From 83f98f7230e890f35b43e8df6db900e37ac612ba Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 04:35:54 +0900
Subject: [PATCH 1/4] feat(providers): explicit single-model completion test

Add a user-confirmed, bounded completion diagnostic for one provider and
one model, next to the existing no-completion connectivity probe:
POST /api/providers/test-completion, `ocx provider test <name> --model <id>`,
and a dashboard control in the provider workspace.

The runner talks to the upstream through the provider's normal
credential, destination and egress path and reports TTFT, total latency
and the raw upstream model metadata read before response.model is
rewritten. Comparison is metadata only and never claims identity.

Refs #2834
---
 .../src/content/docs/guides/web-dashboard.md  |  27 ++
 .../docs/reference/cli/providers-accounts.md  |  31 +-
 .../ProviderCompletionTest.tsx                | 110 +++++++
 .../provider-workspace/ProviderDetails.tsx    |   1 +
 .../provider-workspace/ProviderOverview.tsx   |   6 +-
 .../provider-completion-test.css              |  22 ++
 gui/src/i18n/de.ts                            |  28 ++
 gui/src/i18n/en.ts                            |  28 ++
 gui/src/i18n/fr.ts                            |  28 ++
 gui/src/i18n/ja.ts                            |  28 ++
 gui/src/i18n/ko.ts                            |  28 ++
 gui/src/i18n/pt.ts                            |  28 ++
 gui/src/i18n/ru.ts                            |  28 ++
 gui/src/i18n/tr.ts                            |  28 ++
 gui/src/i18n/vi.ts                            |  28 ++
 gui/src/i18n/zh-TW.ts                         |  28 ++
 gui/src/i18n/zh.ts                            |  28 ++
 gui/tests/provider-completion-test.test.tsx   | 208 ++++++++++++++
 scripts/test-layout/layout.json               |   3 +
 .../references/01_surface_providers-models.md |  12 +-
 src/cli/capabilities-provider-models.ts       |   9 +-
 src/cli/provider-runtime.ts                   |  70 ++++-
 .../management/provider-completion-test.ts    | 270 ++++++++++++++++++
 src/server/management/provider-routes.ts      |   2 +
 src/server/management/route-registry.ts       |   1 +
 structure/INDEX.md                            |   7 +-
 structure/cli-management.md                   |   2 +-
 structure/gui-and-management-api.md           |   2 +-
 structure/manifest.json                       |  11 +
 structure/provider-completion-diagnostic.md   |  11 +
 .../cli-capability-provider-workflows.test.ts |   6 +-
 tests/cli/cli-provider-sync-result.test.ts    | 146 ++++++++++
 tests/fixtures/test-layout-expected.json      |   2 +-
 tests/helpers/provider-completion-fixture.ts  |  22 ++
 ...provider-completion-test-authority.test.ts | 161 +++++++++++
 .../provider-completion-test-ingress.test.ts  |  48 ++++
 .../provider-completion-test.test.ts          | 253 ++++++++++++++++
 37 files changed, 1732 insertions(+), 19 deletions(-)
 create mode 100644 gui/src/components/provider-workspace/ProviderCompletionTest.tsx
 create mode 100644 gui/src/components/provider-workspace/provider-completion-test.css
 create mode 100644 gui/tests/provider-completion-test.test.tsx
 create mode 100644 src/server/management/provider-completion-test.ts
 create mode 100644 structure/provider-completion-diagnostic.md
 create mode 100644 tests/helpers/provider-completion-fixture.ts
 create mode 100644 tests/providers/provider-completion-test-authority.test.ts
 create mode 100644 tests/providers/provider-completion-test-ingress.test.ts
 create mode 100644 tests/providers/provider-completion-test.test.ts

diff --git a/docs-site/src/content/docs/guides/web-dashboard.md b/docs-site/src/content/docs/guides/web-dashboard.md
index 252f7650d39..6cdb10f4d2f 100644
--- a/docs-site/src/content/docs/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/guides/web-dashboard.md
@@ -480,3 +480,30 @@ them. Both switches apply immediately; **Save** never changes them. When interce
 Claude/Anthropic accounts are managed only on **Providers > Anthropic > Accounts**: login and the browser option, the account roster with switch, pause, remove, and reauthentication, the paste-code field, account pool settings, and quota. Claude no longer has an Account sub-tab. Provider-level controls such as the default provider, removal, and the enabled switch stay on Providers.
 
 The bookmarks `#claude` and `#claude/code` open this page, and the former `#claude/settings` redirects to `#claude/code`; `#claude/desktop` selects the separate Claude Desktop tab. The old `#claude/account` bookmark redirects to `#providers?provider=anthropic&tab=accounts`. Legacy `#integrations/claude` and `#integrations/claude/desktop` bookmarks still redirect to `#claude/code` and `#claude/desktop`, respectively. Arrow keys move between tabs; Home and End select the first and last tab.
+
+
+## Test one provider model
+
+In **Providers**, **Test connection** checks discovery connectivity. Use the
+separate **Test completion** control to check whether a selected model answers.
+Choose a model and accept the confirmation that the request may incur provider
+charges. Cancelling the confirmation sends nothing. Changing the provider or
+model, or leaving the page, cancels the test and discards a stale result.
+
+The completion test sends `Reply exactly OK.` once with a 32-token output cap,
+a 20-second deadline and a 64 KiB stream limit. It reports TTFT at the first
+non-empty text delta, total latency, the upstream-reported model and a match,
+mismatch or unknown comparison against the wire model id. Missing or conflicting
+metadata is unknown; upstream metadata does not verify model identity. The panel
+shows the applicability reason when authentication, adapter or transport settings
+cannot be tested. No generated text is displayed, and the diagnostic does not
+update routing health, request history or the provider catalog.
+
+The authenticated management endpoint is
+`POST /api/providers/test-completion?name=<provider>` with exactly
+`{"model":"<model>","confirm":true}`. Dashboard sessions require their usual CSRF
+token. Invalid input returns 400, unknown providers return 404 and a concurrent
+test for the same provider returns 409. Completed diagnostics and applicability
+results return 200, including a structured error when inference fails. Destination
+policy and provider egress settings apply; redirects, retries and failover are disabled.
+For the CLI workflow, see [Providers and accounts](/reference/cli/providers-accounts/).
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index f4ba4e6f112..afc179875a3 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -24,7 +24,7 @@ both `--adapter` and `--base-url`.
 | `list` | `--json`, `--jsonl` | List configured providers and the remaining registry entries; `--jsonl` emits one configured provider object per line. |
 | `add <name>` | `--adapter <adapter>`, `--base-url <url>`, `--api-key <key>`, `--responses-path <path>`, `--auth-mode <key\|forward\|oauth\|local>`, `--default-model <model>`, `--set-default`, `--force`, `--json`, `--sync`, `--live` | Save locally by default; `--sync` attempts client sync in either output mode. `--live` writes through the running proxy and cannot combine with `--sync`. `--force` permits overwrite. |
 | `edit <name>` | provider field flags, `--headers <json>`, `--model-context-tier <model=default\|long_context>`, `--upstream-http-version <http1.1\|->`, `--fast <on\|off>`, `--context-window <N\|->`, `--json` | Edit validated live provider fields without replacing key pools. Repeat `--model-context-tier` for multiple Copilot models. `--headers` merges custom request headers; pass `{}` or `-` to clear them. |
-| `test <name>` | `--json` | Probe the real upstream model endpoint. |
+| `test <name>` | `--model <id>`, `--yes`, `--json` | Check discovery; with `--model`, request one confirmed completion test. |
 | `show <name>` | `--json` | Show config with API keys masked. |
 | `remove <name>` | `--json`, `--live`, `--yes` | Local removal refuses the default and last provider. Live removal requires `--yes` and uses server dependency checks, default reassignment and account/custom-model cleanup. |
 | `set-default <name>` | `--json`, `--live` | Select a local default, or update the running proxy with `--live`. |
@@ -120,10 +120,37 @@ notices. Null, absent or `not-requested` refresh can exit 0 without a client syn
 Read back before recovery; do not repeat a persisted write to repair convergence.
 Errors use safe prose on stderr, including in JSON mode, rather than a JSON error envelope.
 
-`provider test` is separate: it checks upstream model discovery connectivity. A failed connection exits 1; success and a static catalog with no applicable discovery endpoint exit 0.
+`provider test <name>` without `--model` checks upstream model discovery connectivity. A failed connection exits 1; success and a static catalog with no applicable discovery endpoint exit 0.
 `applicable: false` is an expected static-catalog result, not successful inference
 or a failed connection.
 
+To send one completion request for a chosen model, use:
+
+```bash
+ocx provider test my-relay --model my-model
+ocx provider test my-relay --model my-model --yes --json
+```
+
+This test may incur provider charges. An interactive terminal asks for confirmation;
+`--yes` accepts the charge warning. Non-interactive use and `--json` require
+`--yes`. Using `--yes` without `--model` is a usage error. Declining confirmation
+sends no request and exits 1. The command uses the running proxy's management API.
+
+The completion test sends the fixed prompt `Reply exactly OK.`, requests a 32-token output cap, stops after 20 seconds or 64 KiB, and never retries or fails over.
+It supports key-auth or local OpenAI Chat and Responses providers, including
+per-model wire overrides. Disabled, OAuth, forwarded-auth and unsupported adapter
+or transport configurations return an applicability reason without sending a completion.
+TLS profiles, HTTP version pins, enabled request pacing and custom executors with
+a provider proxy override are currently unsupported.
+
+Results include time to first text delta (TTFT), total latency, the requested and
+wire model ids, sanitized upstream model metadata and a distinct match, mismatch
+or unknown comparison. Missing or conflicting metadata is unknown. The comparison
+uses the upstream id before masking, against the id actually sent after alias and
+suffix handling. Provider-reported metadata cannot verify model identity:
+`identityVerified` is always `false`. Generated text is not returned. A failed
+completion exits 1; success and a not-applicable result exit 0.
+
 ### Transport settings and request pacing
 
 `provider edit` is already live. Use `--upstream-http-version http1.1` to pin that
diff --git a/gui/src/components/provider-workspace/ProviderCompletionTest.tsx b/gui/src/components/provider-workspace/ProviderCompletionTest.tsx
new file mode 100644
index 00000000000..63a19421bdb
--- /dev/null
+++ b/gui/src/components/provider-workspace/ProviderCompletionTest.tsx
@@ -0,0 +1,110 @@
+/** An explicitly consented, bounded completion probe; it never runs during discovery. */
+import { useEffect, useRef, useState } from "react";
+import { confirmAction } from "../../action-dialogs";
+import { readJsonOrThrow } from "../../fetch-json";
+import { useI18n, useT } from "../../i18n/shared";
+import { Select } from "../../ui";
+import "./provider-completion-test.css";
+
+type InapplicableReason = "disabled" | "forward_auth" | "oauth_auth" | "unsupported_adapter" | "unsupported_transport";
+type TransportDetail = "tls_profile" | "upstream_http_version" | "request_pacing" | "custom_executor_egress";
+export type CompletionTestResult =
+  | { applicable: false; reason: InapplicableReason; adapter?: string; detail?: TransportDetail }
+  | { applicable: true; ok: boolean; provider: string; requestedModel: string; wireModel: string;
+      wire: "openai-chat" | "openai-responses"; upstreamModel: string | null;
+      modelComparison: "match" | "mismatch" | "unknown";
+      comparisonNote?: "missing_metadata" | "conflicting_metadata"; identityVerified: false;
+      ttftMs: number | null; totalLatencyMs: number; outputTokenCap: 32;
+      termination: "completed" | "failed" | "timeout" | "aborted" | "too_large";
+      error: { code: string; status?: number; message: string } | null };
+
+type Props = { apiBase: string; provider: string; models: string[] };
+
+export default function ProviderCompletionTest({ apiBase, provider, models }: Props) {
+  const t = useT();
+  const [model, setModel] = useState("");
+  const selectedModel = models.includes(model) ? model : "";
+  return (
+    <section className="pws-completion-test" aria-label={t("pws.completion.title")}>
+      <h4 className="pws-section-title">{t("pws.completion.title")}</h4>
+        <Select label={t("pws.completion.model")} value={selectedModel}
+          options={[{ value: "", label: t("pws.completion.choose") }, ...models.map(value => ({ value, label: value }))]}
+          onChange={setModel} />
+        <CompletionRun key={JSON.stringify([apiBase, provider, selectedModel])}
+          apiBase={apiBase} provider={provider} model={selectedModel} />
+    </section>
+  );
+}
+
+function CompletionRun({ apiBase, provider, model }: Omit<Props, "models"> & { model: string }) {
+  const t = useT();
+  const { locale } = useI18n();
+  const [busy, setBusy] = useState(false);
+  const [result, setResult] = useState<CompletionTestResult | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const flight = useRef<AbortController | null>(null);
+  useEffect(() => () => { flight.current?.abort(); flight.current = null; }, []);
+
+  async function run() {
+    if (!model || flight.current) return;
+    const controller = new AbortController();
+    flight.current = controller;
+    setBusy(true);
+    setResult(null);
+    setError(null);
+    try {
+      if (!await confirmAction({ message: t("pws.completion.confirm", { model, provider }),
+        confirmLabel: t("pws.completion.run"), signal: controller.signal, locale }) || controller.signal.aborted) return;
+      // The dashboard's installed fetch wrapper supplies session and CSRF headers, as for the connection test.
+      const response = await fetch(`${apiBase}/api/providers/test-completion?name=${encodeURIComponent(provider)}`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model, confirm: true }), signal: controller.signal,
+      });
+      const value = await readJsonOrThrow<CompletionTestResult>(response, t("pws.completion.failed"));
+      if (!value) throw new Error(t("pws.completion.failed"));
+      if (!controller.signal.aborted) setResult(value);
+    } catch (cause) {
+      if (!controller.signal.aborted) setError(cause instanceof Error ? cause.message : t("pws.completion.failed"));
+    } finally {
+      if (flight.current === controller) {
+        flight.current = null;
+        if (!controller.signal.aborted) setBusy(false);
+      }
+    }
+  }
+
+  return <>
+    <button type="button" className="btn btn-ghost btn-sm" disabled={!model || busy} onClick={() => void run()}>
+      {busy ? t("pws.testing") : t("pws.completion.run")}
+    </button>
+    {error && <p role="alert" className="pws-inline-error pws-completion-result">{error}</p>}
+    {result && <CompletionResult result={result} />}
+  </>;
+}
+
+function CompletionResult({ result }: { result: CompletionTestResult }) {
+  const t = useT();
+  if (!result.applicable) return <div role="status" className="pws-completion-result muted">
+    <p>{t("pws.completion.notApplicable")}: {t(`pws.completion.${result.reason}`)}</p>
+    {result.detail && <p>{t(`pws.completion.${result.detail}`)}</p>}
+    {result.adapter && <p><code>{result.adapter}</code></p>}
+  </div>;
+  return <div role="status" className="pws-completion-result" data-completion-test-state={result.ok ? "ok" : "failed"}>
+    <p className={result.ok ? "pws-status-ok" : "pws-status-warn"}>
+      {t(result.ok ? "pws.completion.ok" : "pws.completion.failed")}
+    </p>
+    <dl className="pws-kv">
+      <div className="pws-kv-row"><dt>{t("pws.completion.ttft")}</dt><dd>{result.ttftMs === null ? "—" : `${result.ttftMs} ms`}</dd></div>
+      <div className="pws-kv-row"><dt>{t("pws.completion.total")}</dt><dd>{result.totalLatencyMs} ms</dd></div>
+    </dl>
+    <p>{result.upstreamModel === null ? t("pws.completion.unreported", { model: result.wireModel })
+      : t("pws.completion.reported", { upstream: result.upstreamModel, model: result.wireModel })}</p>
+    <span className={`badge ${result.modelComparison === "match" ? "badge-green" : result.modelComparison === "mismatch" ? "badge-amber" : "badge-muted"}`}>
+      {t(`pws.completion.${result.modelComparison}`)}
+    </span>
+    {result.comparisonNote && <p className="muted">{t(`pws.completion.${result.comparisonNote}`)}</p>}
+    <p className="muted">{t("pws.completion.identity")}</p>
+    {result.error && <p role="alert" className="pws-inline-error"><code>{result.error.code}</code>
+      {result.error.status !== undefined && <> ({result.error.status})</>}: {result.error.message}</p>}
+  </div>;
+}
diff --git a/gui/src/components/provider-workspace/ProviderDetails.tsx b/gui/src/components/provider-workspace/ProviderDetails.tsx
index 495158b5672..b16dda4bb98 100644
--- a/gui/src/components/provider-workspace/ProviderDetails.tsx
+++ b/gui/src/components/provider-workspace/ProviderDetails.tsx
@@ -288,6 +288,7 @@ export default function ProviderDetails({
             preset={preset}
             apiBase={apiBase}
             connectionIdentity={connectionIdentity}
+            availableModels={availableModels}
             usageTotals={usageTotals}
             quotaReport={quotaReport}
             currentQuotaReading={currentQuotaReading}
diff --git a/gui/src/components/provider-workspace/ProviderOverview.tsx b/gui/src/components/provider-workspace/ProviderOverview.tsx
index c15453d3979..90804455088 100644
--- a/gui/src/components/provider-workspace/ProviderOverview.tsx
+++ b/gui/src/components/provider-workspace/ProviderOverview.tsx
@@ -15,6 +15,7 @@ import type { ProviderUpdatePatch, ProviderUpdateResult } from "./types";
 import ProviderCurrentQuota from "./ProviderCurrentQuota";
 import type { CatalogPreset } from "../provider-catalog/provider-presets";
 import ProviderSponsor from "./ProviderSponsor";
+import ProviderCompletionTest from "./ProviderCompletionTest";
 
 type ConnectionTestResult = {
   applicable?: boolean;
@@ -33,7 +34,7 @@ type ConnectionTestState = {
 
 export default function ProviderOverview({
   item, preset, usageTotals, quotaReport, currentQuotaReading, onRefreshQuota, oauthEmail, oauth,
-  apiBase, connectionIdentity,
+  apiBase, connectionIdentity, availableModels = [],
   onEditSettings, onViewUsage, onUpdateProvider,
   onCreateJevAuto,
   onReauthenticate, onCancelLogin, reauthBusy = false,
@@ -48,6 +49,7 @@ export default function ProviderOverview({
   /** Login state for OAuth summaries that carry no email (e.g. Cursor/Kimi). */
   oauth?: { loggedIn?: boolean };
   apiBase?: string;
+  availableModels?: string[];
   /** Opaque active credential identity used only to invalidate stale probe results. */
   connectionIdentity?: string;
   onEditSettings?: () => void;
@@ -195,6 +197,8 @@ export default function ProviderOverview({
             )}
           </div>
         )}
+        {apiBase && <ProviderCompletionTest key={connectionProbeKey} apiBase={apiBase} provider={item.name}
+          models={[...new Set([...(item.models ?? []), ...availableModels, ...(item.defaultModel ? [item.defaultModel] : [])])]} />}
         {onEditSettings && (
           <button type="button" className="link-btn pws-edit-settings-link" onClick={onEditSettings}>
             {t("pws.editSettings")}
diff --git a/gui/src/components/provider-workspace/provider-completion-test.css b/gui/src/components/provider-workspace/provider-completion-test.css
new file mode 100644
index 00000000000..43ab8da1482
--- /dev/null
+++ b/gui/src/components/provider-workspace/provider-completion-test.css
@@ -0,0 +1,22 @@
+.pws-completion-test {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  align-items: start;
+  gap: var(--space-2);
+  margin-top: var(--space-4);
+}
+.pws-completion-test > h4,
+.pws-completion-result {
+  grid-column: 1 / -1;
+}
+.pws-completion-test > .custom-select {
+  min-width: 0;
+}
+.pws-completion-result {
+  overflow-wrap: anywhere;
+}
+@media (max-width: 640px) {
+  .pws-completion-test {
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 22c5edac19d..d3300a4a77e 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -6,6 +6,34 @@ import type { TKey } from "./en";
  * German i18n catalog, generated from en.ts. Must match the `TKey` set (compile-checked).
  */
 export const de: Record<TKey, string> = {
+  "pws.completion.title": "Modellantwort testen",
+  "pws.completion.model": "Zu testendes Modell",
+  "pws.completion.choose": "Modell auswählen",
+  "pws.completion.run": "Modell testen",
+  "pws.completion.confirm": "{model} bei {provider} testen? Dabei wird eine echte Anfrage mit maximal 32 Ausgabetokens gesendet. Dies verbraucht Kontingent und kann Kosten verursachen.",
+  "pws.completion.failed": "Modelltest fehlgeschlagen",
+  "pws.completion.ok": "Modelltest erfolgreich",
+  "pws.completion.notApplicable": "Test nicht anwendbar",
+  "pws.completion.ttft": "Zeit bis zum ersten Token",
+  "pws.completion.total": "Gesamtlatenz",
+  "pws.completion.reported": "Upstream meldete {upstream} für {model}",
+  "pws.completion.unreported": "Upstream meldete kein Modell für {model}",
+  "pws.completion.identity": "Die Modellmetadaten stammen vom Upstream-Anbieter und bestätigen nicht die Identität des tatsächlichen Modells.",
+  "pws.completion.match": "Übereinstimmung",
+  "pws.completion.mismatch": "Abweichung",
+  "pws.completion.unknown": "Unbekannt",
+  "pws.completion.missing_metadata": "Die Upstream-Antwort enthält keine Modellmetadaten.",
+  "pws.completion.conflicting_metadata": "Die Upstream-Antwort enthält widersprüchliche Modellmetadaten.",
+  "pws.completion.disabled": "Dieser Anbieter ist deaktiviert.",
+  "pws.completion.forward_auth": "Weitergeleitete Authentifizierung wird nicht unterstützt.",
+  "pws.completion.oauth_auth": "OAuth-Authentifizierung wird nicht unterstützt.",
+  "pws.completion.unsupported_adapter": "Dieser Adapter wird nicht unterstützt.",
+  "pws.completion.unsupported_transport": "Diese Transportkonfiguration wird nicht unterstützt.",
+  "pws.completion.tls_profile": "Ein eigenes TLS-Profil ist konfiguriert.",
+  "pws.completion.upstream_http_version": "Eine Upstream-HTTP-Version ist konfiguriert.",
+  "pws.completion.request_pacing": "Die Anfragedrosselung ist aktiviert.",
+  "pws.completion.custom_executor_egress": "Ein eigener Fetch-Executor mit Anbieter-Proxy kann nicht beibehalten werden.",
+
   "reasoningRetention.advanced": "Erweiterte Einstellungen",
   "reasoningRetention.title": "Aufbewahrung von Denktext",
   "reasoningRetention.enable": "Aufbewahrung von Denktext aktivieren",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 350a21304ae..8c4eabb851b 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -7,6 +7,34 @@ import { desktopCompatibilityCopy } from "./desktop-compatibility-copy";
  * `{var}` are plain interpolations.
  */
 export const en = {
+  "pws.completion.title": "Model completion test",
+  "pws.completion.model": "Model to test",
+  "pws.completion.choose": "Choose a model",
+  "pws.completion.run": "Test model",
+  "pws.completion.confirm": "Test {model} on {provider}? This sends a real completion request with an output cap of 32 tokens. It consumes quota and may incur costs.",
+  "pws.completion.failed": "Model test failed",
+  "pws.completion.ok": "Model test succeeded",
+  "pws.completion.notApplicable": "Test not applicable",
+  "pws.completion.ttft": "Time to first token",
+  "pws.completion.total": "Total latency",
+  "pws.completion.reported": "Upstream reported {upstream} for {model}",
+  "pws.completion.unreported": "Upstream did not report a model for {model}",
+  "pws.completion.identity": "Model metadata is reported by the upstream provider and does not verify the actual model's identity.",
+  "pws.completion.match": "Match",
+  "pws.completion.mismatch": "Mismatch",
+  "pws.completion.unknown": "Unknown",
+  "pws.completion.missing_metadata": "The upstream response contains no model metadata.",
+  "pws.completion.conflicting_metadata": "The upstream response reports conflicting model metadata.",
+  "pws.completion.disabled": "This provider is disabled.",
+  "pws.completion.forward_auth": "Forwarded authentication is not supported.",
+  "pws.completion.oauth_auth": "OAuth authentication is not supported.",
+  "pws.completion.unsupported_adapter": "This adapter is not supported.",
+  "pws.completion.unsupported_transport": "This transport configuration is not supported.",
+  "pws.completion.tls_profile": "A custom TLS profile is configured.",
+  "pws.completion.upstream_http_version": "An upstream HTTP version is configured.",
+  "pws.completion.request_pacing": "Request pacing is enabled.",
+  "pws.completion.custom_executor_egress": "A custom fetch executor with a provider proxy cannot be preserved.",
+
   "reasoningRetention.advanced": "Advanced settings",
   "reasoningRetention.title": "Reasoning retention",
   "reasoningRetention.enable": "Enable reasoning retention",
diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts
index a17e39b0bd0..a8b7dffcd15 100644
--- a/gui/src/i18n/fr.ts
+++ b/gui/src/i18n/fr.ts
@@ -5,6 +5,34 @@ import type { TKey } from "./en";
  * French i18n catalog. Must match the `TKey` set.
  */
 export const fr: Record<TKey, string> = {
+  "pws.completion.title": "Test de réponse du modèle",
+  "pws.completion.model": "Modèle à tester",
+  "pws.completion.choose": "Choisir un modèle",
+  "pws.completion.run": "Tester le modèle",
+  "pws.completion.confirm": "Tester {model} chez {provider} ? Une requête réelle sera envoyée avec une limite de 32 jetons de sortie. Elle consomme du quota et peut entraîner des frais.",
+  "pws.completion.failed": "Échec du test du modèle",
+  "pws.completion.ok": "Test du modèle réussi",
+  "pws.completion.notApplicable": "Test non applicable",
+  "pws.completion.ttft": "Délai du premier jeton",
+  "pws.completion.total": "Latence totale",
+  "pws.completion.reported": "Le serveur amont a indiqué {upstream} pour {model}",
+  "pws.completion.unreported": "Le serveur amont n’a indiqué aucun modèle pour {model}",
+  "pws.completion.identity": "Les métadonnées du modèle sont déclarées par le fournisseur amont et ne vérifient pas l’identité du modèle réel.",
+  "pws.completion.match": "Correspondance",
+  "pws.completion.mismatch": "Différence",
+  "pws.completion.unknown": "Inconnu",
+  "pws.completion.missing_metadata": "La réponse amont ne contient aucune métadonnée de modèle.",
+  "pws.completion.conflicting_metadata": "La réponse amont contient des métadonnées de modèle contradictoires.",
+  "pws.completion.disabled": "Ce fournisseur est désactivé.",
+  "pws.completion.forward_auth": "L’authentification transmise n’est pas prise en charge.",
+  "pws.completion.oauth_auth": "L’authentification OAuth n’est pas prise en charge.",
+  "pws.completion.unsupported_adapter": "Cet adaptateur n’est pas pris en charge.",
+  "pws.completion.unsupported_transport": "Cette configuration de transport n’est pas prise en charge.",
+  "pws.completion.tls_profile": "Un profil TLS personnalisé est configuré.",
+  "pws.completion.upstream_http_version": "Une version HTTP amont est configurée.",
+  "pws.completion.request_pacing": "La régulation des requêtes est activée.",
+  "pws.completion.custom_executor_egress": "Un exécuteur fetch personnalisé avec un proxy fournisseur ne peut pas être conservé.",
+
   "reasoningRetention.advanced": "Paramètres avancés",
   "reasoningRetention.title": "Conservation du raisonnement",
   "reasoningRetention.enable": "Activer la conservation du raisonnement",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 08799fa8f3f..d156b85ec4e 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -5,6 +5,34 @@ import type { TKey } from "./en";
  * Japanese i18n catalog; must match the `TKey` set (compile-checked).
  */
 export const ja: Record<TKey, string> = {
+  "pws.completion.title": "モデル応答テスト",
+  "pws.completion.model": "テストするモデル",
+  "pws.completion.choose": "モデルを選択",
+  "pws.completion.run": "モデルをテスト",
+  "pws.completion.confirm": "{provider} で {model} をテストしますか？出力上限が32トークンの実際のリクエストを送信します。割り当てを消費し、料金が発生する場合があります。",
+  "pws.completion.failed": "モデルテスト失敗",
+  "pws.completion.ok": "モデルテスト成功",
+  "pws.completion.notApplicable": "テスト対象外",
+  "pws.completion.ttft": "最初のトークンまでの時間",
+  "pws.completion.total": "合計遅延",
+  "pws.completion.reported": "{model} に対して上流が {upstream} を報告しました",
+  "pws.completion.unreported": "{model} に対して上流はモデルを報告しませんでした",
+  "pws.completion.identity": "モデルのメタデータは上流プロバイダーが報告した情報であり、実際のモデルの同一性を検証するものではありません。",
+  "pws.completion.match": "一致",
+  "pws.completion.mismatch": "不一致",
+  "pws.completion.unknown": "不明",
+  "pws.completion.missing_metadata": "上流の応答にモデルのメタデータがありません。",
+  "pws.completion.conflicting_metadata": "上流の応答に矛盾するモデルのメタデータがあります。",
+  "pws.completion.disabled": "このプロバイダーは無効です。",
+  "pws.completion.forward_auth": "認証の転送はサポートされていません。",
+  "pws.completion.oauth_auth": "OAuth認証はサポートされていません。",
+  "pws.completion.unsupported_adapter": "このアダプターはサポートされていません。",
+  "pws.completion.unsupported_transport": "この転送設定はサポートされていません。",
+  "pws.completion.tls_profile": "カスタムTLSプロファイルが設定されています。",
+  "pws.completion.upstream_http_version": "上流のHTTPバージョンが設定されています。",
+  "pws.completion.request_pacing": "リクエストのペーシングが有効です。",
+  "pws.completion.custom_executor_egress": "プロバイダーのプロキシを併用するカスタムfetch実行器を維持できません。",
+
   "reasoningRetention.advanced": "詳細設定",
   "reasoningRetention.title": "推論の保持",
   "reasoningRetention.enable": "推論の保持を有効にする",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 0781408ca97..e7277e385e0 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -5,6 +5,34 @@ import type { TKey } from "./en";
  * Korean i18n catalog; must match the `TKey` set (compile-checked).
  */
 export const ko: Record<TKey, string> = {
+  "pws.completion.title": "모델 응답 테스트",
+  "pws.completion.model": "테스트할 모델",
+  "pws.completion.choose": "모델 선택",
+  "pws.completion.run": "모델 테스트",
+  "pws.completion.confirm": "{provider}에서 {model}을 테스트할까요? 출력 한도가 32토큰인 실제 응답 요청을 보냅니다. 할당량이 소모되며 비용이 발생할 수 있습니다.",
+  "pws.completion.failed": "모델 테스트 실패",
+  "pws.completion.ok": "모델 테스트 성공",
+  "pws.completion.notApplicable": "테스트 적용 불가",
+  "pws.completion.ttft": "첫 토큰까지 걸린 시간",
+  "pws.completion.total": "전체 지연 시간",
+  "pws.completion.reported": "{model} 요청에 업스트림이 {upstream} 모델을 보고했습니다",
+  "pws.completion.unreported": "{model} 요청에 업스트림이 모델을 보고하지 않았습니다",
+  "pws.completion.identity": "모델 메타데이터는 업스트림 공급자가 보고한 정보이며 실제 모델의 정체를 검증하지 않습니다.",
+  "pws.completion.match": "일치",
+  "pws.completion.mismatch": "불일치",
+  "pws.completion.unknown": "알 수 없음",
+  "pws.completion.missing_metadata": "업스트림 응답에 모델 메타데이터가 없습니다.",
+  "pws.completion.conflicting_metadata": "업스트림 응답의 모델 메타데이터가 서로 충돌합니다.",
+  "pws.completion.disabled": "비활성화된 공급자입니다.",
+  "pws.completion.forward_auth": "전달 인증은 지원하지 않습니다.",
+  "pws.completion.oauth_auth": "OAuth 인증은 지원하지 않습니다.",
+  "pws.completion.unsupported_adapter": "지원하지 않는 어댑터입니다.",
+  "pws.completion.unsupported_transport": "지원하지 않는 전송 설정입니다.",
+  "pws.completion.tls_profile": "사용자 지정 TLS 프로필이 설정되어 있습니다.",
+  "pws.completion.upstream_http_version": "업스트림 HTTP 버전이 설정되어 있습니다.",
+  "pws.completion.request_pacing": "요청 속도 조절이 활성화되어 있습니다.",
+  "pws.completion.custom_executor_egress": "공급자 프록시와 함께 사용하는 사용자 지정 fetch 실행기를 유지할 수 없습니다.",
+
   "reasoningRetention.advanced": "고급 설정",
   "reasoningRetention.title": "추론 보존",
   "reasoningRetention.enable": "추론 보존 활성화",
diff --git a/gui/src/i18n/pt.ts b/gui/src/i18n/pt.ts
index 5d0f1dd1761..da17099de90 100644
--- a/gui/src/i18n/pt.ts
+++ b/gui/src/i18n/pt.ts
@@ -7,6 +7,34 @@ import type { TKey } from "./en";
  * Technical terms and model identifiers intentionally remain English.
  */
 export const pt: Record<TKey, string> = {
+  "pws.completion.title": "Teste de resposta do modelo",
+  "pws.completion.model": "Modelo a testar",
+  "pws.completion.choose": "Escolha um modelo",
+  "pws.completion.run": "Testar modelo",
+  "pws.completion.confirm": "Testar {model} em {provider}? Isso envia uma solicitação real com limite de 32 tokens de saída. Consome cota e pode gerar custos.",
+  "pws.completion.failed": "Falha no teste do modelo",
+  "pws.completion.ok": "Teste do modelo concluído",
+  "pws.completion.notApplicable": "Teste não aplicável",
+  "pws.completion.ttft": "Tempo até o primeiro token",
+  "pws.completion.total": "Latência total",
+  "pws.completion.reported": "O servidor de origem informou {upstream} para {model}",
+  "pws.completion.unreported": "O servidor de origem não informou um modelo para {model}",
+  "pws.completion.identity": "Os metadados do modelo são informados pelo provedor de origem e não verificam a identidade do modelo real.",
+  "pws.completion.match": "Correspondência",
+  "pws.completion.mismatch": "Divergência",
+  "pws.completion.unknown": "Desconhecido",
+  "pws.completion.missing_metadata": "A resposta de origem não contém metadados do modelo.",
+  "pws.completion.conflicting_metadata": "A resposta de origem contém metadados do modelo conflitantes.",
+  "pws.completion.disabled": "Este provedor está desativado.",
+  "pws.completion.forward_auth": "A autenticação encaminhada não é compatível.",
+  "pws.completion.oauth_auth": "A autenticação OAuth não é compatível.",
+  "pws.completion.unsupported_adapter": "Este adaptador não é compatível.",
+  "pws.completion.unsupported_transport": "Esta configuração de transporte não é compatível.",
+  "pws.completion.tls_profile": "Um perfil TLS personalizado está configurado.",
+  "pws.completion.upstream_http_version": "Uma versão HTTP de origem está configurada.",
+  "pws.completion.request_pacing": "O controle de ritmo das solicitações está ativado.",
+  "pws.completion.custom_executor_egress": "Não é possível manter um executor fetch personalizado com proxy do provedor.",
+
   "reasoningRetention.advanced": "Configurações avançadas",
   "reasoningRetention.title": "Retenção de raciocínio",
   "reasoningRetention.enable": "Ativar retenção de raciocínio",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index ad8863b0cce..40d700a1068 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -5,6 +5,34 @@ import type { TKey } from "./en";
  * Russian i18n catalog; must match the `TKey` set (compile-checked).
  */
 export const ru: Record<TKey, string> = {
+  "pws.completion.title": "Проверка ответа модели",
+  "pws.completion.model": "Модель для проверки",
+  "pws.completion.choose": "Выберите модель",
+  "pws.completion.run": "Проверить модель",
+  "pws.completion.confirm": "Проверить {model} у {provider}? Будет отправлен реальный запрос с ограничением вывода в 32 токена. Он расходует квоту и может повлечь расходы.",
+  "pws.completion.failed": "Проверка модели не удалась",
+  "pws.completion.ok": "Проверка модели успешна",
+  "pws.completion.notApplicable": "Проверка неприменима",
+  "pws.completion.ttft": "Время до первого токена",
+  "pws.completion.total": "Общая задержка",
+  "pws.completion.reported": "Сервер сообщил {upstream} для {model}",
+  "pws.completion.unreported": "Сервер не сообщил модель для {model}",
+  "pws.completion.identity": "Метаданные модели сообщает вышестоящий провайдер; они не подтверждают подлинность фактической модели.",
+  "pws.completion.match": "Совпадение",
+  "pws.completion.mismatch": "Несовпадение",
+  "pws.completion.unknown": "Неизвестно",
+  "pws.completion.missing_metadata": "Ответ сервера не содержит метаданных модели.",
+  "pws.completion.conflicting_metadata": "Ответ сервера содержит противоречивые метаданные модели.",
+  "pws.completion.disabled": "Этот провайдер отключён.",
+  "pws.completion.forward_auth": "Передача аутентификации не поддерживается.",
+  "pws.completion.oauth_auth": "Аутентификация OAuth не поддерживается.",
+  "pws.completion.unsupported_adapter": "Этот адаптер не поддерживается.",
+  "pws.completion.unsupported_transport": "Эта конфигурация транспорта не поддерживается.",
+  "pws.completion.tls_profile": "Настроен пользовательский профиль TLS.",
+  "pws.completion.upstream_http_version": "Настроена версия HTTP вышестоящего сервера.",
+  "pws.completion.request_pacing": "Включено ограничение частоты запросов.",
+  "pws.completion.custom_executor_egress": "Невозможно сохранить пользовательский исполнитель fetch с прокси провайдера.",
+
   "reasoningRetention.advanced": "Расширенные настройки",
   "reasoningRetention.title": "Сохранение рассуждений",
   "reasoningRetention.enable": "Включить сохранение рассуждений",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index 147e954d1c9..b702ff074e2 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -6,6 +6,34 @@ import type { TKey } from "./en";
  * Turkish i18n catalog. Must match the `TKey` set (compile-checked).
  */
 export const tr: Record<TKey, string> = {
+  "pws.completion.title": "Model yanıt testi",
+  "pws.completion.model": "Test edilecek model",
+  "pws.completion.choose": "Bir model seçin",
+  "pws.completion.run": "Modeli test et",
+  "pws.completion.confirm": "{provider} üzerinde {model} test edilsin mi? En fazla 32 çıktı tokenı içeren gerçek bir istek gönderilir. Kota tüketir ve ücrete neden olabilir.",
+  "pws.completion.failed": "Model testi başarısız",
+  "pws.completion.ok": "Model testi başarılı",
+  "pws.completion.notApplicable": "Test uygulanamaz",
+  "pws.completion.ttft": "İlk tokena kadar geçen süre",
+  "pws.completion.total": "Toplam gecikme",
+  "pws.completion.reported": "Üst sunucu {model} için {upstream} bildirdi",
+  "pws.completion.unreported": "Üst sunucu {model} için model bildirmedi",
+  "pws.completion.identity": "Model meta verilerini üst sağlayıcı bildirir; bu bilgiler gerçek modelin kimliğini doğrulamaz.",
+  "pws.completion.match": "Eşleşiyor",
+  "pws.completion.mismatch": "Eşleşmiyor",
+  "pws.completion.unknown": "Bilinmiyor",
+  "pws.completion.missing_metadata": "Üst sunucu yanıtında model meta verisi yok.",
+  "pws.completion.conflicting_metadata": "Üst sunucu yanıtında çelişkili model meta verileri var.",
+  "pws.completion.disabled": "Bu sağlayıcı devre dışı.",
+  "pws.completion.forward_auth": "İletilen kimlik doğrulama desteklenmiyor.",
+  "pws.completion.oauth_auth": "OAuth kimlik doğrulaması desteklenmiyor.",
+  "pws.completion.unsupported_adapter": "Bu bağdaştırıcı desteklenmiyor.",
+  "pws.completion.unsupported_transport": "Bu aktarım yapılandırması desteklenmiyor.",
+  "pws.completion.tls_profile": "Özel bir TLS profili yapılandırılmış.",
+  "pws.completion.upstream_http_version": "Üst sunucu HTTP sürümü yapılandırılmış.",
+  "pws.completion.request_pacing": "İstek hızlandırma sınırlaması etkin.",
+  "pws.completion.custom_executor_egress": "Sağlayıcı vekiliyle kullanılan özel fetch yürütücüsü korunamaz.",
+
   "reasoningRetention.advanced": "Gelişmiş ayarlar",
   "reasoningRetention.title": "Akıl yürütmeyi saklama",
   "reasoningRetention.enable": "Akıl yürütmeyi saklamayı etkinleştir",
diff --git a/gui/src/i18n/vi.ts b/gui/src/i18n/vi.ts
index 18fa8b93963..5c22d8a785e 100644
--- a/gui/src/i18n/vi.ts
+++ b/gui/src/i18n/vi.ts
@@ -7,6 +7,34 @@ import type { TKey } from "./en";
  * Technical terms and model identifiers intentionally remain English.
  */
 export const vi: Record<TKey, string> = {
+  "pws.completion.title": "Kiểm tra phản hồi mô hình",
+  "pws.completion.model": "Mô hình cần kiểm tra",
+  "pws.completion.choose": "Chọn mô hình",
+  "pws.completion.run": "Kiểm tra mô hình",
+  "pws.completion.confirm": "Kiểm tra {model} trên {provider}? Thao tác này gửi yêu cầu thật với giới hạn đầu ra 32 token, tiêu tốn hạn mức và có thể phát sinh chi phí.",
+  "pws.completion.failed": "Kiểm tra mô hình thất bại",
+  "pws.completion.ok": "Kiểm tra mô hình thành công",
+  "pws.completion.notApplicable": "Không áp dụng kiểm tra",
+  "pws.completion.ttft": "Thời gian đến token đầu tiên",
+  "pws.completion.total": "Tổng độ trễ",
+  "pws.completion.reported": "Máy chủ nguồn báo cáo {upstream} cho {model}",
+  "pws.completion.unreported": "Máy chủ nguồn không báo cáo mô hình cho {model}",
+  "pws.completion.identity": "Siêu dữ liệu mô hình do nhà cung cấp nguồn báo cáo và không xác minh danh tính mô hình thực tế.",
+  "pws.completion.match": "Khớp",
+  "pws.completion.mismatch": "Không khớp",
+  "pws.completion.unknown": "Không xác định",
+  "pws.completion.missing_metadata": "Phản hồi từ nguồn không có siêu dữ liệu mô hình.",
+  "pws.completion.conflicting_metadata": "Phản hồi từ nguồn có siêu dữ liệu mô hình mâu thuẫn.",
+  "pws.completion.disabled": "Nhà cung cấp này đã bị tắt.",
+  "pws.completion.forward_auth": "Không hỗ trợ chuyển tiếp xác thực.",
+  "pws.completion.oauth_auth": "Không hỗ trợ xác thực OAuth.",
+  "pws.completion.unsupported_adapter": "Không hỗ trợ bộ điều hợp này.",
+  "pws.completion.unsupported_transport": "Không hỗ trợ cấu hình truyền tải này.",
+  "pws.completion.tls_profile": "Đã cấu hình hồ sơ TLS tùy chỉnh.",
+  "pws.completion.upstream_http_version": "Đã cấu hình phiên bản HTTP của máy chủ nguồn.",
+  "pws.completion.request_pacing": "Đã bật điều tiết yêu cầu.",
+  "pws.completion.custom_executor_egress": "Không thể giữ bộ thực thi fetch tùy chỉnh kết hợp proxy của nhà cung cấp.",
+
   "reasoningRetention.advanced": "Cài đặt nâng cao",
   "reasoningRetention.title": "Lưu giữ suy luận",
   "reasoningRetention.enable": "Bật lưu giữ suy luận",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 783ea79a4fc..73bff674693 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -3,6 +3,34 @@ import type { TKey } from "./en";
 
 /** Traditional Chinese (Taiwan) UI strings — keys must match `en.ts` 1:1. */
 export const zhTW: Record<TKey, string> = {
+  "pws.completion.title": "模型回應測試",
+  "pws.completion.model": "要測試的模型",
+  "pws.completion.choose": "選擇模型",
+  "pws.completion.run": "測試模型",
+  "pws.completion.confirm": "要在 {provider} 上測試 {model} 嗎？這會傳送一次真實請求，輸出上限為 32 個 token。測試會消耗配額，並可能產生費用。",
+  "pws.completion.failed": "模型測試失敗",
+  "pws.completion.ok": "模型測試成功",
+  "pws.completion.notApplicable": "不適用此測試",
+  "pws.completion.ttft": "首個 token 延遲",
+  "pws.completion.total": "總延遲",
+  "pws.completion.reported": "上游針對 {model} 回報了 {upstream}",
+  "pws.completion.unreported": "上游未針對 {model} 回報模型",
+  "pws.completion.identity": "模型中繼資料由上游供應商回報，無法驗證實際模型的身分。",
+  "pws.completion.match": "相符",
+  "pws.completion.mismatch": "不相符",
+  "pws.completion.unknown": "未知",
+  "pws.completion.missing_metadata": "上游回應不包含模型中繼資料。",
+  "pws.completion.conflicting_metadata": "上游回應中的模型中繼資料互相衝突。",
+  "pws.completion.disabled": "此供應商已停用。",
+  "pws.completion.forward_auth": "不支援轉送驗證。",
+  "pws.completion.oauth_auth": "不支援 OAuth 驗證。",
+  "pws.completion.unsupported_adapter": "不支援此介面卡。",
+  "pws.completion.unsupported_transport": "不支援此傳輸設定。",
+  "pws.completion.tls_profile": "已設定自訂 TLS 設定檔。",
+  "pws.completion.upstream_http_version": "已設定上游 HTTP 版本。",
+  "pws.completion.request_pacing": "已啟用請求速率控制。",
+  "pws.completion.custom_executor_egress": "無法保留同時使用供應商代理的自訂 fetch 執行器。",
+
   "reasoningRetention.advanced": "進階設定",
   "reasoningRetention.title": "推理保留",
   "reasoningRetention.enable": "啟用推理保留",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index dacb18d70ea..61bdf2c41dc 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -5,6 +5,34 @@ import type { TKey } from "./en";
  * Chinese i18n catalog; must match the `TKey` set (compile-checked).
  */
 export const zh: Record<TKey, string> = {
+  "pws.completion.title": "模型响应测试",
+  "pws.completion.model": "要测试的模型",
+  "pws.completion.choose": "选择模型",
+  "pws.completion.run": "测试模型",
+  "pws.completion.confirm": "要在 {provider} 上测试 {model} 吗？这会发送一次真实请求，输出上限为 32 个 token。测试会消耗配额，并可能产生费用。",
+  "pws.completion.failed": "模型测试失败",
+  "pws.completion.ok": "模型测试成功",
+  "pws.completion.notApplicable": "不适用此测试",
+  "pws.completion.ttft": "首个 token 延迟",
+  "pws.completion.total": "总延迟",
+  "pws.completion.reported": "上游针对 {model} 报告了 {upstream}",
+  "pws.completion.unreported": "上游未针对 {model} 报告模型",
+  "pws.completion.identity": "模型元数据由上游提供商报告，不能验证实际模型的身份。",
+  "pws.completion.match": "匹配",
+  "pws.completion.mismatch": "不匹配",
+  "pws.completion.unknown": "未知",
+  "pws.completion.missing_metadata": "上游响应不包含模型元数据。",
+  "pws.completion.conflicting_metadata": "上游响应中的模型元数据相互冲突。",
+  "pws.completion.disabled": "此提供商已禁用。",
+  "pws.completion.forward_auth": "不支持转发认证。",
+  "pws.completion.oauth_auth": "不支持 OAuth 认证。",
+  "pws.completion.unsupported_adapter": "不支持此适配器。",
+  "pws.completion.unsupported_transport": "不支持此传输配置。",
+  "pws.completion.tls_profile": "已配置自定义 TLS 配置文件。",
+  "pws.completion.upstream_http_version": "已配置上游 HTTP 版本。",
+  "pws.completion.request_pacing": "已启用请求速率控制。",
+  "pws.completion.custom_executor_egress": "无法保留同时使用提供商代理的自定义 fetch 执行器。",
+
   "reasoningRetention.advanced": "高级设置",
   "reasoningRetention.title": "推理保留",
   "reasoningRetention.enable": "启用推理保留",
diff --git a/gui/tests/provider-completion-test.test.tsx b/gui/tests/provider-completion-test.test.tsx
new file mode 100644
index 00000000000..46a62310463
--- /dev/null
+++ b/gui/tests/provider-completion-test.test.tsx
@@ -0,0 +1,208 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import ProviderOverview from "../src/components/provider-workspace/ProviderOverview";
+import type { CompletionTestResult } from "../src/components/provider-workspace/ProviderCompletionTest";
+import { LanguageProvider } from "../src/i18n/provider";
+import type { WorkspaceItem } from "../src/provider-workspace/catalog";
+import { acceptActionDialog, actionDialogOpen, actionDialogText, dismissActionDialog } from "./helpers/action-dialog";
+
+const globals = ["document", "window", "navigator", "localStorage", "HTMLElement", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previous: Record<string, unknown>;
+let win: Window;
+let root: Root | undefined;
+let host: HTMLElement;
+let requests: Array<{ url: string; init: RequestInit }>;
+const originalFetch = globalThis.fetch;
+const item: WorkspaceItem = { name: "test vendor", adapter: "openai-chat", baseUrl: "https://example.test/v1",
+  hasApiKey: true, models: ["configured"], defaultModel: "default" };
+const success: Extract<CompletionTestResult, { applicable: true }> = {
+  applicable: true, ok: true, provider: item.name, requestedModel: "configured", wireModel: "wire-model",
+  wire: "openai-chat", upstreamModel: "wire-model", modelComparison: "match", identityVerified: false,
+  ttftMs: 12, totalLatencyMs: 45, outputTokenCap: 32, termination: "completed", error: null,
+};
+let respond: () => Promise<Response>;
+
+beforeEach(() => {
+  previous = Object.fromEntries(globals.map(key => [key, Reflect.get(globalThis, key)]));
+  win = new Window({ url: "http://localhost/#providers" });
+  Object.defineProperty(win.navigator, "language", { configurable: true, value: "en-US" });
+  for (const [key, value] of Object.entries({ window: win, document: win.document, navigator: win.navigator,
+    localStorage: win.localStorage, HTMLElement: win.HTMLElement, IS_REACT_ACT_ENVIRONMENT: true })) {
+    Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+  }
+  host = document.createElement("div"); document.body.append(host);
+  requests = [];
+  respond = async () => Response.json(success);
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    requests.push({ url: String(input), init: init! });
+    return respond();
+  }) as typeof fetch;
+});
+afterEach(async () => {
+  await act(async () => { root?.unmount(); }); root = undefined;
+  globalThis.fetch = originalFetch;
+  win.close();
+  for (const key of globals) Object.defineProperty(globalThis, key, { configurable: true, writable: true, value: previous[key] });
+});
+async function render(provider = item, identity = "credential-a", apiBase = "http://localhost") {
+  if (!root) {
+    const { createRoot } = await import("react-dom/client"); root = createRoot(host);
+  }
+  await act(async () => {
+    root!.render(<LanguageProvider><ProviderOverview item={provider} apiBase={apiBase}
+      connectionIdentity={identity} availableModels={["listed", "configured"]} /></LanguageProvider>);
+  });
+}
+function runButton() {
+  return Array.from(host.querySelectorAll<HTMLButtonElement>("button")).find(button => button.textContent === "Test model")!;
+}
+async function select(model = "configured") {
+  await act(async () => { host.querySelector<HTMLButtonElement>('[role="combobox"][aria-label="Model to test"]')!.click(); });
+  const option = Array.from(document.querySelectorAll<HTMLButtonElement>('[role="option"]')).find(o => o.textContent === model)!;
+  expect(option).toBeTruthy();
+  await act(async () => { option.click(); });
+}
+async function begin(accept = true) {
+  await act(async () => { runButton().click(); });
+  expect(actionDialogOpen(document)).toBe(true);
+  if (accept) await act(async () => { acceptActionDialog(document); });
+}
+function hold() {
+  let release!: (response: Response) => void;
+  respond = () => new Promise<Response>(resolve => { release = resolve; });
+  return (result: CompletionTestResult = success) => release(Response.json(result));
+}
+
+test("model selection and explicit confirmation are required; configured/listed/default ids are deduplicated", async () => {
+  await render();
+  expect(runButton().disabled).toBe(true); expect(requests).toHaveLength(0);
+  await select();
+  expect(runButton().disabled).toBe(false); expect(requests).toHaveLength(0);
+  await begin(false);
+  expect(requests).toHaveLength(0);
+  expect(actionDialogText(document)).toContain("32");
+  expect(actionDialogText(document)).toContain("quota");
+  expect(actionDialogText(document)).toContain("costs");
+  expect(actionDialogText(document)).toContain("configured");
+  expect(actionDialogText(document)).toContain(item.name);
+  await act(async () => { acceptActionDialog(document); });
+  expect(requests).toHaveLength(1);
+  expect(requests[0].url).toBe("http://localhost/api/providers/test-completion?name=test%20vendor");
+  expect(requests[0].init.method).toBe("POST");
+  expect(new Headers(requests[0].init.headers).get("content-type")).toBe("application/json");
+  expect(JSON.parse(String(requests[0].init.body))).toEqual({ model: "configured", confirm: true });
+  await select("listed"); await select("default");
+  await act(async () => { host.querySelector<HTMLButtonElement>('[role="combobox"]')!.click(); });
+  expect(Array.from(document.querySelectorAll('[role="option"]')).map(o => o.textContent)).toEqual([
+    "Choose a model", "configured", "listed", "default",
+  ]);
+});
+
+test("canceling the confirmation sends zero requests", async () => {
+  await render(); await select(); await begin(false);
+  await act(async () => { dismissActionDialog(document); });
+  expect(requests).toHaveLength(0); expect(runButton().disabled).toBe(false);
+});
+
+for (const change of ["model", "provider", "credential", "endpoint", "unmount"] as const) {
+  test(`${change} change aborts and suppresses a late completion response`, async () => {
+    const release = hold();
+    await render(); await select(); await begin();
+    const signal = requests[0].init.signal!;
+    expect(signal.aborted).toBe(false);
+    if (change === "model") await select("listed");
+    else if (change === "provider") await render({ ...item, name: "other" });
+    else if (change === "credential") await render(item, "credential-b");
+    else if (change === "endpoint") await render(item, "credential-a", "http://localhost:9999");
+    else await act(async () => { root!.unmount(); root = undefined; });
+    expect(signal.aborted).toBe(true);
+    await act(async () => { release(); });
+    expect(host.querySelector('[data-completion-test-state]')).toBeNull();
+    if (change !== "unmount") {
+      if (change !== "model") await select();
+      respond = async () => Response.json({ ...success, upstreamModel: "new-model", modelComparison: "mismatch" });
+      await begin();
+      expect(host.textContent).toContain("new-model");
+    }
+  });
+  test(`${change} change withdraws a pending confirmation without sending`, async () => {
+    await render(); await select(); await begin(false);
+    if (change === "model") await select("listed");
+    else if (change === "provider") await render({ ...item, name: "other" });
+    else if (change === "credential") await render(item, "credential-b");
+    else if (change === "endpoint") await render(item, "credential-a", "http://localhost:9999");
+    else await act(async () => { root!.unmount(); root = undefined; });
+    expect(actionDialogOpen(document)).toBe(false); expect(requests).toHaveLength(0);
+  });
+}
+
+test("success renders timing, upstream comparison and the identity disclaimer", async () => {
+  await render(); await select(); await begin();
+  expect(host.querySelector('[data-completion-test-state="ok"]')).toBeTruthy();
+  for (const text of ["Model test succeeded", "Time to first token", "12 ms", "Total latency", "45 ms",
+    "Upstream reported wire-model for wire-model", "Match", "does not verify the actual model's identity"]) {
+    expect(host.textContent).toContain(text);
+  }
+});
+
+test("mismatched metadata is distinct from completion success", async () => {
+  respond = async () => Response.json({ ...success, upstreamModel: "another-model", modelComparison: "mismatch" });
+  await render(); await select(); await begin();
+  expect(host.querySelector('[data-completion-test-state="ok"]')).toBeTruthy();
+  expect(host.textContent).toContain("Upstream reported another-model for wire-model");
+  expect(host.querySelector(".badge-amber")?.textContent).toBe("Mismatch");
+});
+
+for (const [note, message] of [["missing_metadata", "no model metadata"], ["conflicting_metadata", "conflicting model metadata"]] as const) {
+  test(`unknown comparison renders ${note}`, async () => {
+    respond = async () => Response.json({ ...success, upstreamModel: null, modelComparison: "unknown", comparisonNote: note, ttftMs: null });
+    await render(); await select(); await begin();
+    expect(host.textContent).toContain("Upstream did not report a model for wire-model");
+    expect(host.querySelector(".badge-muted")?.textContent).toBe("Unknown");
+    expect(host.textContent).toContain(message);
+    expect(host.querySelector(".pws-kv dd")?.textContent).not.toContain("null");
+  });
+}
+
+for (const reason of ["disabled", "forward_auth", "oauth_auth", "unsupported_adapter", "unsupported_transport"] as const) {
+  test(`inapplicable ${reason} renders its reason without success or timing`, async () => {
+    respond = async () => Response.json({ applicable: false, reason, adapter: "anthropic" });
+    await render(); await select(); await begin();
+    expect(host.textContent).toContain("Test not applicable");
+    expect(host.textContent).toContain("anthropic");
+    expect(host.textContent).not.toContain("Time to first token");
+    expect(host.querySelector('[data-completion-test-state]')).toBeNull();
+  });
+}
+
+for (const [detail, message] of [["tls_profile", "custom TLS profile"], ["upstream_http_version", "upstream HTTP version"],
+  ["request_pacing", "Request pacing"], ["custom_executor_egress", "custom fetch executor"]] as const) {
+  test(`inapplicable transport renders ${detail}`, async () => {
+    respond = async () => Response.json({ applicable: false, reason: "unsupported_transport", detail });
+    await render(); await select(); await begin();
+    expect(host.textContent).toContain(message);
+  });
+}
+
+for (const termination of ["failed", "timeout", "aborted", "too_large"] as const) {
+  test(`${termination} result renders code, message, status and timings`, async () => {
+    respond = async () => Response.json({ ...success, ok: false, termination, ttftMs: null,
+      error: { code: termination === "failed" ? "http_status" : termination, status: 401, message: "Fixed safe failure" } });
+    await render(); await select(); await begin();
+    expect(host.querySelector('[data-completion-test-state="failed"]')).toBeTruthy();
+    expect(host.querySelector('[role="alert"]')?.textContent).toContain(termination === "failed" ? "http_status" : termination);
+    expect(host.querySelector('[role="alert"]')?.textContent).toContain("401");
+    expect(host.querySelector('[role="alert"]')?.textContent).toContain("Fixed safe failure");
+    expect(host.textContent).toContain("45 ms");
+    expect(host.textContent).toContain("does not verify the actual model's identity");
+  });
+}
+
+test("HTTP rejection displays the management API error and allows retry", async () => {
+  respond = async () => Response.json({ error: "completion test already running for this provider" }, { status: 409 });
+  await render(); await select(); await begin();
+  expect(host.querySelector('[role="alert"]')?.textContent).toBe("completion test already running for this provider");
+  expect(runButton().disabled).toBe(false);
+});
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index edab985cdac..60f23dea9c9 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -1404,6 +1404,9 @@
     "provider-capacity.test.ts": "providers",
     "provider-config-batch-management.test.ts": "providers",
     "provider-config-validation.test.ts": "providers",
+    "provider-completion-test-authority.test.ts": "providers",
+    "provider-completion-test-ingress.test.ts": "providers",
+    "provider-completion-test.test.ts": "providers",
     "provider-connection-test.test.ts": "providers",
     "provider-cost-overlay-config.test.ts": "providers",
     "provider-discovery-log-suppression.test.ts": "providers",
diff --git a/skills/ocx/references/01_surface_providers-models.md b/skills/ocx/references/01_surface_providers-models.md
index 09eec1bc3ef..389b3d476ae 100644
--- a/skills/ocx/references/01_surface_providers-models.md
+++ b/skills/ocx/references/01_surface_providers-models.md
@@ -263,21 +263,25 @@ State-changing: yes. JSON mode: `payload`.
 
 ### `ocx provider test`
 
-Usage: `ocx provider test <name> [--json]`
+Usage: `ocx provider test <name> [--model <id> [--yes]] [--json]`
 
-Probe a provider's live model discovery connectivity.
+Probe discovery connectivity or explicitly test one model completion.
 
 State-changing: yes. JSON mode: `payload`.
 
 | Method | Route |
 |---|---|
 | POST | `/api/providers/test` |
+| POST | `/api/providers/test-completion` |
 
 | Flag | Value | Meaning |
 |---|---|---|
-| `--json` | boolean | Emit the probe result. |
+| `--model` | string | Run one bounded completion for this model instead of discovery. |
+| `--yes` | boolean | Confirm completion quota/cost; requires --model. Mandatory with --json or non-interactive input. |
+| `--json` | boolean | Emit the probe result; completion warnings go to stderr. |
 
-- May contact the upstream provider; requires operator intent to probe. Static catalogs can return applicable:false; failed connectivity exits nonzero.
+- Without --model, discovery behavior is unchanged; static catalogs can return applicable:false. Completion tests print a quota/cost warning and require a default-No terminal confirmation or --yes; cancellation exits 1 without a request.
+- Completion output includes TTFT, total latency, upstream/wire model metadata and comparison. Metadata is not proof of model identity; mismatch still exits 0. Failed tests exit 1; non-applicable results exit 0.
 
 ### `ocx provider quota`
 
diff --git a/src/cli/capabilities-provider-models.ts b/src/cli/capabilities-provider-models.ts
index abf1b61cfc9..7f364594657 100644
--- a/src/cli/capabilities-provider-models.ts
+++ b/src/cli/capabilities-provider-models.ts
@@ -49,10 +49,11 @@ export const PROVIDER_MODEL_CAPABILITIES: readonly Capability[] = [
     details: ["At least one edit is required; only supplied fields are patched. update is an existing alias. Use provider show only for local state, not as proof of the live write.","Management errors use safe fixed provider diagnostics; catalog failures retain the saved receipt and a nonzero exit."],
   },
   {
-    command: ["provider", "test"], summary: "Probe a provider's live model discovery connectivity.",
-    usage: "ocx provider test <name> [--json]", routes: [{ method: "POST", path: "/api/providers/test" }], mutates: true, json: "payload",
-    flags: [{ name: "--json", value: "boolean", summary: "Emit the probe result." }],
-    details: ["May contact the upstream provider; requires operator intent to probe. Static catalogs can return applicable:false; failed connectivity exits nonzero."],
+    command: ["provider", "test"], summary: "Probe discovery connectivity or explicitly test one model completion.",
+    usage: "ocx provider test <name> [--model <id> [--yes]] [--json]",
+    routes: [{ method: "POST", path: "/api/providers/test" }, { method: "POST", path: "/api/providers/test-completion" }], mutates: true, json: "payload",
+    flags: [{ name: "--model", value: "string", summary: "Run one bounded completion for this model instead of discovery." }, { name: "--yes", value: "boolean", summary: "Confirm completion quota/cost; requires --model. Mandatory with --json or non-interactive input." }, { name: "--json", value: "boolean", summary: "Emit the probe result; completion warnings go to stderr." }],
+    details: ["Without --model, discovery behavior is unchanged; static catalogs can return applicable:false. Completion tests print a quota/cost warning and require a default-No terminal confirmation or --yes; cancellation exits 1 without a request.", "Completion output includes TTFT, total latency, upstream/wire model metadata and comparison. Metadata is not proof of model identity; mismatch still exits 0. Failed tests exit 1; non-applicable results exit 0."],
   },
   {
     command: ["provider", "quota"], summary: "Read provider quota reports, optionally refreshing them.",
diff --git a/src/cli/provider-runtime.ts b/src/cli/provider-runtime.ts
index 27e19ab03bf..d403e0615ab 100644
--- a/src/cli/provider-runtime.ts
+++ b/src/cli/provider-runtime.ts
@@ -10,8 +10,10 @@ import {
   takeBooleanOption,
   takeFlag,
   takeOption,
+  terminalSafeText,
   type RuntimeApiDeps,
 } from "./runtime-api";
+import { interactiveConfirm } from "./interactive-confirm";
 import { takeProviderEditSettings } from "./provider-settings";
 import { printProviderReceipt, runProviderAction } from "./provider-result";
 import { providerQuotaLine } from "./account-extended";
@@ -46,7 +48,7 @@ const USAGE = `Usage:
       [--retain-models <id,id|->] [--model <id> --text-only]
       [--xai-chat <on|off>] [--upstream-http-version <http1.1|->] [--fast <on|off>] [--context-window <tokens|->]
       [--allow-private-network <on|off>] [--model-context-tier <model=default|long_context>] [--json]
-  ocx provider test <name> [--json]
+  ocx provider test <name> [--model <id> [--yes]] [--json]
   ocx provider quota [--refresh] [--json]
   ocx provider resets [--limit <n>] [--json]
   ocx provider presets [--json]
@@ -147,12 +149,78 @@ async function edit(argv: string[], deps: RuntimeApiDeps): Promise<number> {
   return printProviderReceipt(result, wantsJson, "Provider edit");
 }
 
+interface CompletionTestDto {
+  applicable: boolean;
+  reason?: string;
+  detail?: string;
+  adapter?: string;
+  ok?: boolean;
+  wireModel?: string;
+  upstreamModel?: string | null;
+  modelComparison?: "match" | "mismatch" | "unknown";
+  comparisonNote?: "missing_metadata" | "conflicting_metadata";
+  ttftMs?: number | null;
+  totalLatencyMs?: number;
+  error?: { code: string; message: string; status?: number } | null;
+}
+
+async function testCompletion(name: string, model: string, yes: boolean, wantsJson: boolean, deps: RuntimeApiDeps): Promise<number> {
+  const input = deps.stdinImpl ?? process.stdin;
+  if (!yes && (wantsJson || !input.isTTY)) {
+    throw new CliUsageError("completion tests consume quota and may incur cost; --yes is required with --json or non-interactive input", USAGE);
+  }
+  const warning = terminalSafeText(`${name}: completion test for model ${model}. Warning: this sends an upstream request, consumes quota and may incur cost.`);
+  if (wantsJson) console.error(warning);
+  else console.log(warning);
+  if (!yes && !await interactiveConfirm({
+    question: "Run this completion test?", defaultYes: false, input: input as NodeJS.ReadStream,
+  })) {
+    console.log("cancelled");
+    return 1;
+  }
+  const result = await runtimeRequest<CompletionTestDto>(`/api/providers/test-completion?name=${encodeURIComponent(name)}`, {
+    method: "POST", redirect: "error", body: JSON.stringify({ model, confirm: true }),
+  }, deps);
+  if (result.applicable === false) {
+    printData(result, wantsJson, [
+      `${name}: not applicable — ${result.reason}`,
+      ...(result.detail ? [`Detail: ${result.detail}`] : []),
+      ...(result.adapter ? [`Adapter: ${result.adapter}`] : []),
+    ]);
+    return 0;
+  }
+  if (result.ok === true) {
+    printData(result, wantsJson, [
+      `${name}: connected`,
+      `TTFT: ${result.ttftMs ?? "unknown"} ms`,
+      `Total latency: ${result.totalLatencyMs ?? "unknown"} ms`,
+      `Upstream reported ${result.upstreamModel ?? "unknown"} for ${result.wireModel} — ${result.modelComparison}${result.comparisonNote ? ` (${result.comparisonNote})` : ""}`,
+      "metadata only — not proof of model identity",
+    ]);
+    return 0;
+  }
+  printData(result, wantsJson, [
+    `${name}: failed`,
+    `${result.error?.code ?? "unknown"}: ${result.error?.message ?? "Completion test failed"}${result.error?.status === undefined ? "" : ` (HTTP ${result.error.status})`}`,
+  ]);
+  return 1;
+}
+
 async function testProvider(argv: string[], deps: RuntimeApiDeps): Promise<number> {
   const args = [...argv];
   const name = args.shift()?.trim();
   const wantsJson = takeFlag(args, "--json");
   if (!name) throw new CliUsageError("provider name is required", USAGE);
+  const model = takeOption(args, "--model")?.trim();
+  const yes = takeFlag(args, "--yes");
   rejectArgs(args, USAGE);
+  if (yes && model === undefined) throw new CliUsageError("--yes requires --model", USAGE);
+  if (model !== undefined) {
+    if (!model || model.length > 256 || /[\x00-\x1f\x7f]/.test(model)) {
+      throw new CliUsageError("--model must contain 1..256 characters without control characters", USAGE);
+    }
+    return testCompletion(name, model, yes, wantsJson, deps);
+  }
   const result = await runtimeRequest<Record<string, unknown>>(`/api/providers/test?name=${encodeURIComponent(name)}`, {
     method: "POST",
   }, deps);
diff --git a/src/server/management/provider-completion-test.ts b/src/server/management/provider-completion-test.ts
new file mode 100644
index 00000000000..c8f684deace
--- /dev/null
+++ b/src/server/management/provider-completion-test.ts
@@ -0,0 +1,270 @@
+/**
+ * Explicit single-model diagnostic, isolated from discovery, routing health and request history.
+ * Unsupported transports: TLS profiles, HTTP version pins, enabled pacing, custom fetch + proxy.
+ * Adding an exclusion requires a regression test. No retries, failover, or output preview.
+ */
+import type { OcxConfig, OcxProviderConfig } from "../../types";
+import { routedProviderConfig } from "../../providers/routed-config";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import { resolveModelAlias } from "../../providers/default-aliases";
+import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-selection";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
+import { openAIChatTransport, stripBracketedModelSuffix } from "../../adapters/openai-chat/wire";
+import { buildResponsesTransport } from "../../adapters/openai-responses/transport";
+import { assertProviderDestinationAllowed } from "../../lib/destination-policy";
+import { providerOutboundPost, ProviderOutboundPolicyError, ProviderOutboundSendCancelledError,
+  type ProviderOutboundDependencies } from "../../lib/provider-outbound";
+import { redactSecretString } from "../../lib/redact";
+import { decodeServerSentEvents } from "../../lib/sse-decoder";
+import { createTranslatorBudget } from "../../lib/translator-budget";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+export const COMPLETION_TEST_PROMPT = "Reply exactly OK.";
+export const COMPLETION_TEST_OUTPUT_TOKEN_CAP = 32;
+export const COMPLETION_TEST_TIMEOUT_MS = 20_000;
+export const COMPLETION_TEST_MAX_BYTES = 64 * 1024;
+
+type Wire = "openai-chat" | "openai-responses";
+type Code = "destination_refused" | "credential_missing" | "credential_changed" | "http_status" | "redirect"
+  | "network" | "stream_error" | "premature_eof" | "no_content" | "timeout" | "aborted" | "too_large";
+const MESSAGES: Record<Code, string> = {
+  destination_refused: "Provider destination refused by policy.",
+  credential_missing: "Provider credential is missing.",
+  credential_changed: "Provider request authority changed before send.",
+  http_status: "Upstream returned an unsuccessful HTTP status.",
+  redirect: "Upstream redirect refused.",
+  network: "Upstream network request failed.",
+  stream_error: "Upstream stream reported an error.",
+  premature_eof: "Upstream stream ended without a terminal event.",
+  no_content: "Upstream completed without a text delta.",
+  timeout: "Completion test deadline exceeded.",
+  aborted: "Completion test was cancelled.",
+  too_large: "Upstream stream exceeded the byte limit.",
+};
+export type ProviderCompletionTestResult = {
+  applicable: false;
+  reason: "disabled" | "forward_auth" | "oauth_auth" | "unsupported_adapter" | "unsupported_transport";
+  adapter?: string;
+  detail?: "tls_profile" | "upstream_http_version" | "request_pacing" | "custom_executor_egress";
+} | {
+  applicable: true; ok: boolean; provider: string; requestedModel: string; wireModel: string; wire: Wire;
+  upstreamModel: string | null; modelComparison: "match" | "mismatch" | "unknown";
+  comparisonNote?: "missing_metadata" | "conflicting_metadata";
+  identityVerified: false; ttftMs: number | null; totalLatencyMs: number; outputTokenCap: 32;
+  termination: "completed" | "failed" | "timeout" | "aborted" | "too_large";
+  error: null | { code: Code; status?: number; message: string };
+};
+export interface ProviderCompletionTestInput { config: OcxConfig; name: string; model: string; signal?: AbortSignal }
+export interface ProviderCompletionTestDependencies {
+  now?: () => number;
+  timeoutMs?: number;
+  outboundDependencies?: ProviderOutboundDependencies;
+}
+
+function transportExclusion(row: OcxProviderConfig): Extract<ProviderCompletionTestResult, { applicable: false }>["detail"] {
+  if (row.tlsProfile !== undefined) return "tls_profile";
+  if (row.upstreamHttpVersion !== undefined) return "upstream_http_version";
+  if (row.requestPacing?.enabled) return "request_pacing";
+  if (typeof (row as { fetch?: unknown }).fetch === "function" && "proxy" in row) return "custom_executor_egress";
+  return undefined;
+}
+function effectiveModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
+  const known = new Set([...(row.models ?? []), ...Object.keys(row.modelAliases ?? {})]);
+  const native = known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
+  return row.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+}
+function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model: string) {
+  const routed = resolveWireProtocolOverride(name, model, routedProviderConfig(name, row));
+  const wire = routed.adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") throw new Error("unsupported adapter");
+  const transport = wire === "openai-chat" ? openAIChatTransport(routed)
+    : buildResponsesTransport(routed, { headers: new Headers() });
+  const headers = new Headers(transport.headers);
+  headers.set("Accept", "text/event-stream");
+  const wireModel = effectiveModel(config, routed, model);
+  // Capture primitive values now: rows and their nested header objects may mutate in place.
+  const selection = routed._apiKeyAttempt;
+  const fingerprint = JSON.stringify({ wire, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
+    authMode: routed.authMode, apiKey: routed.apiKey,
+    selection: selection && { entryId: selection.entryId, reference: selection.reference, revision: selection.revision },
+    allowPrivateNetwork: routed.allowPrivateNetwork, proxy: routed.proxy, noProxy: routed.noProxy, disabled: row.disabled });
+  return { routed, wire: wire as Wire, wireModel, headers, url: transport.url, fingerprint };
+}
+function maskedModel(raw: string, secrets: Array<string | undefined>): string {
+  if (secrets.some(secret => typeof secret === "string" && secret.length > 0 && raw.includes(secret))) return "[redacted]";
+  return redactSecretString(raw.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256));
+}
+function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(signal.reason);
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+    promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+class DiagnosticFailure extends Error { constructor(readonly code: Code) { super(MESSAGES[code]); } }
+
+/** Direct diagnostic; callers supply an existing provider name and an already validated model. */
+export async function runProviderCompletionTest(
+  { config, name, model, signal: requestSignal }: ProviderCompletionTestInput,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<ProviderCompletionTestResult> {
+  const row = config.providers[name];
+  if (!Object.hasOwn(config.providers, name) || !row) throw new Error("unknown provider");
+  if (row.disabled) return { applicable: false, reason: "disabled" };
+  const authKind = PROVIDER_REGISTRY.find(entry => entry.id === name)?.authKind;
+  if (row.authMode === "forward" || authKind === "forward") return { applicable: false, reason: "forward_auth" };
+  if (row.authMode === "oauth" || authKind === "oauth") return { applicable: false, reason: "oauth_auth" };
+  const detail = transportExclusion(row);
+  if (detail) return { applicable: false, reason: "unsupported_transport", detail };
+  // Metadata resolution must never dereference keychain/env/pool credentials.
+  const { apiKey: _key, apiKeyPool: _pool, _apiKeyAttempt: _attempt, ...metadata } = row;
+  let snapshot: OcxProviderConfig = metadata;
+  let destinationRefused = false;
+  try { snapshot = routedProviderConfig(name, metadata); } catch { destinationRefused = true; }
+  const wire = resolveWireProtocolOverride(name, model, snapshot).adapter;
+  if (wire !== "openai-chat" && wire !== "openai-responses") return { applicable: false, reason: "unsupported_adapter", adapter: wire };
+  const now = deps.now ?? (() => performance.now());
+  const result: Extract<ProviderCompletionTestResult, { applicable: true }> = {
+    applicable: true, ok: false, provider: name, requestedModel: model, wireModel: effectiveModel(config, snapshot, model), wire,
+    upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata", identityVerified: false,
+    ttftMs: null, totalLatencyMs: 0, outputTokenCap: COMPLETION_TEST_OUTPUT_TOKEN_CAP, termination: "failed", error: null,
+  };
+  const fail = (code: Code, status?: number) => {
+    result.error = { code, message: MESSAGES[code], ...(status !== undefined ? { status } : {}) };
+    result.termination = code === "timeout" || code === "aborted" || code === "too_large" ? code : "failed";
+    return result;
+  };
+  if (destinationRefused) return fail("destination_refused");
+  try { assertProviderDestinationAllowed(name, snapshot); } catch { return fail("destination_refused"); }
+  let resolved: OcxProviderConfig;
+  try { resolved = routedProviderConfig(name, row); } catch { return fail("credential_missing"); }
+  if (resolved.authMode === "key" && !resolved.keyOptional && !resolved.apiKey?.trim()) return fail("credential_missing");
+  let authority: ReturnType<typeof derive>;
+  try { authority = derive(config, name, row, model); } catch { return fail("network"); }
+  const secrets = [authority.routed.apiKey, ...Object.values(authority.routed.headers ?? {}),
+    ...[...authority.headers].filter(([name]) => name === "authorization" || name === "x-api-key").map(([, value]) => value)];
+  result.wire = authority.wire;
+  result.wireModel = authority.wireModel;
+  const controller = new AbortController();
+  const deadline = AbortSignal.timeout(deps.timeoutMs ?? COMPLETION_TEST_TIMEOUT_MS);
+  const signal = AbortSignal.any([...(requestSignal ? [requestSignal] : []), deadline, controller.signal]);
+  const started = now();
+  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+  let response: Response | undefined;
+  let observed: string | undefined;
+  let conflicting = false, terminal = false, content = false, finishReason = false;
+  const observe = (value: unknown) => {
+    if (typeof value !== "string") return;
+    if (observed === undefined) observed = value;
+    else if (value !== observed) conflicting = true;
+  };
+  try {
+    signal.throwIfAborted();
+    const body = JSON.stringify(authority.wire === "openai-chat"
+      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32 }
+      : { model: authority.wireModel, input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+    const pending = providerOutboundPost(name, authority.routed, authority.url, { headers: authority.headers, body, signal }, {
+      ...deps.outboundDependencies,
+      beforeSend: () => {
+        try {
+          const current = config.providers[name];
+          return current === row && !current.disabled && !transportExclusion(current)
+            && derive(config, name, current, model).fingerprint === authority.fingerprint
+            && (!authority.routed.apiKey || providerApiKeySelectionIsCurrent(config, name, authority.routed));
+        } catch { return false; }
+      },
+    });
+    // Even an executor ignoring AbortSignal cannot retain a late response body.
+    void pending.then(late => { if (signal.aborted) void late.body?.cancel().catch(() => {}); }, () => {});
+    response = await abortable(pending, signal);
+    if (response.status >= 300 && response.status < 400) return fail("redirect");
+    if (!response.ok) return fail("http_status", response.status);
+    if (!response.body) return fail("premature_eof");
+    reader = response.body.getReader();
+    let bytes = 0;
+    const counted = new ReadableStream<Uint8Array>({
+      async pull(target) {
+        try {
+          const next = await abortable(reader!.read(), signal);
+          if (next.done) { target.close(); return; }
+          bytes += next.value.byteLength;
+          if (bytes > COMPLETION_TEST_MAX_BYTES) throw new DiagnosticFailure("too_large");
+          target.enqueue(next.value);
+        } catch (error) { target.error(error); }
+      },
+      cancel() { void reader!.cancel().catch(() => {}); },
+    }, { highWaterMark: 0 });
+    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget: createTranslatorBudget() })) {
+      if (authority.wire === "openai-chat" && event.data.trim() === "[DONE]") { terminal = true; break; }
+      let chunk: Record<string, any>;
+      try { chunk = JSON.parse(event.data); } catch { throw new DiagnosticFailure("stream_error"); }
+      if (!chunk || typeof chunk !== "object" || chunk.error || event.event === "error" || chunk.type === "error" || chunk.type === "response.failed") {
+        throw new DiagnosticFailure("stream_error");
+      }
+      let text = false;
+      if (authority.wire === "openai-chat") {
+        observe(chunk.model);
+        if (Array.isArray(chunk.choices)) for (const choice of chunk.choices) {
+          if (typeof choice?.delta?.content === "string" && choice.delta.content.length > 0) text = true;
+          if (choice?.finish_reason != null) finishReason = true;
+        }
+      } else {
+        const type = chunk.type ?? event.event;
+        if (["response.created", "response.completed", "response.incomplete"].includes(type)) observe(chunk.response?.model);
+        text = type === "response.output_text.delta" && typeof chunk.delta === "string" && chunk.delta.length > 0;
+        terminal = type === "response.completed" || type === "response.incomplete";
+        if (type === "response.failed") throw new DiagnosticFailure("stream_error");
+      }
+      if (text) { content = true; result.ttftMs ??= Math.max(0, now() - started); }
+      if (terminal) break;
+    }
+    signal.throwIfAborted();
+    if (!terminal && !(authority.wire === "openai-chat" && finishReason)) return fail("premature_eof");
+    if (!content) return fail("no_content");
+    result.ok = true;
+    result.termination = "completed";
+    return result;
+  } catch (error) {
+    return fail(requestSignal?.aborted ? "aborted" : deadline.aborted ? "timeout"
+      : error instanceof DiagnosticFailure ? error.code
+      : error instanceof ProviderOutboundSendCancelledError ? "credential_changed"
+      : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
+  } finally {
+    result.totalLatencyMs = Math.max(0, now() - started);
+    if (observed !== undefined && !conflicting) {
+      result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
+      delete result.comparisonNote;
+      result.upstreamModel = maskedModel(observed, secrets);
+    } else if (conflicting) result.comparisonNote = "conflicting_metadata";
+    controller.abort();
+    // Cancellation is initiated on every exit; do not wait on a misbehaving executor.
+    if (reader) { void reader.cancel().catch(() => {}); try { reader.releaseLock(); } catch { /* read pending */ } }
+    else void response?.body?.cancel().catch(() => {});
+  }
+}
+
+const inFlight = new Set<string>();
+export async function handleProviderCompletionTestRoute(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+  deps: ProviderCompletionTestDependencies = {},
+): Promise<Response> {
+  let body: unknown;
+  try { body = await req.json(); } catch { return jsonResponse({ error: "invalid completion test request" }, 400); }
+  if (!body || typeof body !== "object" || Array.isArray(body)
+    || Object.keys(body).some(key => key !== "model" && key !== "confirm")
+    || (body as { confirm?: unknown }).confirm !== true || typeof (body as { model?: unknown }).model !== "string") {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const model = (body as { model: string }).model.trim();
+  if (!model || model.length > 256 || /[\x00-\x1f\x7f-\x9f]/.test((body as { model: string }).model)) {
+    return jsonResponse({ error: "invalid completion test request" }, 400);
+  }
+  const name = url.searchParams.get("name") ?? "";
+  if (!Object.hasOwn(config.providers, name) || !config.providers[name]) return jsonResponse({ error: "unknown provider" }, 404);
+  if (inFlight.has(name)) return jsonResponse({ error: "completion test already running for this provider" }, 409);
+  inFlight.add(name);
+  try { return jsonResponse(await runProviderCompletionTest({ config, name, model, signal: req.signal }, deps)); }
+  finally { inFlight.delete(name); }
+}
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index 0dd9cfb8ba1..ac5092e12f2 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -1602,6 +1602,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     });
   }
 
+  if (url.pathname === "/api/providers/test-completion" && req.method === "POST") return (await import("./provider-completion-test")).handleProviderCompletionTestRoute(ctx);
+
   // Lightweight connectivity probe: perform the provider's live /models fetch DIRECTLY and
   // report only real upstream evidence. The catalog aggregate (fetchAllModels) deliberately
   // hides fetch failures behind stale/static fallbacks, so a catalog-presence check would
diff --git a/src/server/management/route-registry.ts b/src/server/management/route-registry.ts
index 72037819a04..715c5bc7147 100644
--- a/src/server/management/route-registry.ts
+++ b/src/server/management/route-registry.ts
@@ -373,6 +373,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers/test-completion", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
diff --git a/structure/INDEX.md b/structure/INDEX.md
index 096a550041a..679bc54e51a 100644
--- a/structure/INDEX.md
+++ b/structure/INDEX.md
@@ -99,6 +99,7 @@ The dashboard, the management API, and third-party client config ownership.
 | --- | --- |
 | [`cli-management.md`](cli-management.md) | Terminal help and capability metadata, management-client output and the generated operating reference. |
 | [`gui-and-management-api.md`](gui-and-management-api.md) | Dashboard serving, authentication boundaries, /api/* ownership, and startup safety. |
+| [`provider-completion-diagnostic.md`](provider-completion-diagnostic.md) | Explicit single-model completion test: consent, applicability gate, send-time authority fingerprint, bounded streaming and metadata comparison. |
 | [`dashboard-and-usage.md`](dashboard-and-usage.md) | Dashboard page contracts, usage accounting and request metrics, and per-surface management settings. |
 | [`pricing.md`](pricing.md) | User price policies, prompt-length rate selection, persistence and estimate cache invalidation. |
 | [`clients/integrations.md`](clients/integrations.md) | Third-party client config ownership, snapshots, refresh, disable, and restore. |
@@ -150,7 +151,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `desktop/ui/cli.html` | [`desktop-terminal-command.md`](desktop-terminal-command.md) |
 | `desktop/ui/cli.js` | [`desktop-terminal-command.md`](desktop-terminal-command.md) |
 | `docs-site/` | [`ops/docs-and-release.md`](ops/docs-and-release.md) |
-| `gui/` | [`overview.md`](overview.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`design-methodology.md`](design-methodology.md)<br>[`companion.md`](companion.md) |
+| `gui/` | [`overview.md`](overview.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`provider-completion-diagnostic.md`](provider-completion-diagnostic.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`design-methodology.md`](design-methodology.md)<br>[`companion.md`](companion.md) |
 | `gui/src/components/ModelPriceDialog.tsx` | [`pricing.md`](pricing.md) |
 | `scripts/` | [`overview.md`](overview.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `scripts/generate-ocx-skill-surface.ts` | [`cli-management.md`](cli-management.md) |
@@ -167,7 +168,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/chatgpt/` | [`clients/chatgpt-desktop.md`](clients/chatgpt-desktop.md) |
 | `src/claude/` | [`runtime.md`](runtime.md)<br>[`providers/anthropic-progress.md`](providers/anthropic-progress.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`clients/claude-desktop-config-reads.md`](clients/claude-desktop-config-reads.md) |
 | `src/cli.ts` | [`runtime.md`](runtime.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
-| `src/cli/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`local-messaging.md`](local-messaging.md)<br>[`cli-management.md`](cli-management.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`clients/codex-desktop.md`](clients/codex-desktop.md)<br>[`clients/chatgpt-desktop.md`](clients/chatgpt-desktop.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
+| `src/cli/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`local-messaging.md`](local-messaging.md)<br>[`cli-management.md`](cli-management.md)<br>[`provider-completion-diagnostic.md`](provider-completion-diagnostic.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`clients/codex-desktop.md`](clients/codex-desktop.md)<br>[`clients/chatgpt-desktop.md`](clients/chatgpt-desktop.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `src/cli/account-preservation.ts` | [`providers/openai-signed-in-preservation.md`](providers/openai-signed-in-preservation.md) |
 | `src/cli/codex-provider.ts` | [`codex-provider-routing.md`](codex-provider-routing.md) |
 | `src/cli/models-runtime.ts` | [`pricing.md`](pricing.md) |
@@ -232,7 +233,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/router.ts` | [`runtime.md`](runtime.md) |
 | `src/routing/` | [`catalog.md`](catalog.md) |
 | `src/routing/history/` | [`dashboard-and-usage.md`](dashboard-and-usage.md) |
-| `src/server/` | [`providers/generic-account-pool.md`](providers/generic-account-pool.md)<br>[`runtime.md`](runtime.md)<br>[`codex-prompts.md`](codex-prompts.md)<br>[`catalog.md`](catalog.md)<br>[`subagents.md`](subagents.md)<br>[`transports/byte-accounting.md`](transports/byte-accounting.md)<br>[`transports/responses.md`](transports/responses.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`transports/responses-wire-shapes.md`](transports/responses-wire-shapes.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`transports/policy-fallback.md`](transports/policy-fallback.md)<br>[`transports/streaming-health.md`](transports/streaming-health.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`data-planes/images.md`](data-planes/images.md)<br>[`data-planes/inbound-compat.md`](data-planes/inbound-compat.md)<br>[`providers/anthropic-progress.md`](providers/anthropic-progress.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/jev-decision.md`](providers/jev-decision.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md)<br>[`adapters/registry.md`](adapters/registry.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
+| `src/server/` | [`providers/generic-account-pool.md`](providers/generic-account-pool.md)<br>[`runtime.md`](runtime.md)<br>[`codex-prompts.md`](codex-prompts.md)<br>[`catalog.md`](catalog.md)<br>[`subagents.md`](subagents.md)<br>[`transports/byte-accounting.md`](transports/byte-accounting.md)<br>[`transports/responses.md`](transports/responses.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`transports/responses-wire-shapes.md`](transports/responses-wire-shapes.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`transports/policy-fallback.md`](transports/policy-fallback.md)<br>[`transports/streaming-health.md`](transports/streaming-health.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`data-planes/images.md`](data-planes/images.md)<br>[`data-planes/inbound-compat.md`](data-planes/inbound-compat.md)<br>[`providers/anthropic-progress.md`](providers/anthropic-progress.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/jev-decision.md`](providers/jev-decision.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md)<br>[`adapters/registry.md`](adapters/registry.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`provider-completion-diagnostic.md`](provider-completion-diagnostic.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
 | `src/server/gui-pair-delivery.ts` | [`remote-link.md`](remote-link.md) |
 | `src/server/index.ts` | [`adapters/compatibility-lab.md`](adapters/compatibility-lab.md) |
 | `src/server/inference/advisor-diagnostics.ts` | [`advisor.md`](advisor.md) |
diff --git a/structure/cli-management.md b/structure/cli-management.md
index 7e588af09df..398069b1b75 100644
--- a/structure/cli-management.md
+++ b/structure/cli-management.md
@@ -61,7 +61,7 @@ live and latest durable rows are captured under the same mutation lock as deleti
 
 `src/cli/provider.ts` selects explicit --live lifecycle operations before local configuration calls. `src/cli/provider-lifecycle-runtime.ts` pins the management target for roster/preset reads and one add/default/remove mutation, refuses redirects and never falls back to local state. Add is an upsert with an observed no-force check, not atomic create-only protection. Default is a standalone patch; live removal requires --yes and leaves dependency/default/account cleanup to the server. Local add keeps its default target and actually performs requested --sync before JSON output; configApplied and catalog convergence are separate, and an unchanged existing catalog can converge without new writes; saved-but-unavailable/refused/failed sync is nonzero, while policy skips retain truthful needsSync. Known catalog ownership and saved-config removal warnings reach human output and the local `sync.warning` receipt; only the owner's fixed path-free guidance and namespace count are projected, so appended arbitrary diagnostics remain private. Explicit local authentication/path overrides pass the management owner's completed-candidate validation before registration, saving, discovery or sync; unflagged local behavior is unchanged.
 
-`src/cli/provider-settings.ts` consumes only the three additional edit fields and owns pacing rules/status. Configured rules come from config, observations from the separate pacing endpoint. Scalar writes preserve observed model rules but replace the entire block without CAS; numeric changes do not implicitly enable pacing. Complete-file replacement is exclusive with scalar flags and uses the canonical pacing validator. `src/cli/provider-runtime.ts` propagates the safe provider edit result's numeric outcome and the connectivity test outcome. Failed connectivity remains exit 1 through the outer provider dispatcher; successful and non-applicable static-catalog observations remain exit 0.
+`src/cli/provider-settings.ts` consumes only the three additional edit fields and owns pacing rules/status. Configured rules come from config, observations from the separate pacing endpoint. Scalar writes preserve observed model rules but replace the entire block without CAS; numeric changes do not implicitly enable pacing. Complete-file replacement is exclusive with scalar flags and uses the canonical pacing validator. `src/cli/provider-runtime.ts` propagates the safe provider edit result's numeric outcome and the connectivity test outcome. Failed connectivity remains exit 1 through the outer provider dispatcher; successful and non-applicable static-catalog observations remain exit 0. `ocx provider test <name> --model <id>` instead posts `{ model, confirm: true }` to `POST /api/providers/test-completion` only after printing the provider/model and a quota/cost warning and receiving consent: an interactive yes, or `--yes` (required for non-TTY and `--json`); a declined prompt exits 1 and usage errors send nothing. Its result prints TTFT, total latency and upstream-reported metadata for the wire model with a metadata-only disclaimer; a mismatch is shown distinctly but exits 0, non-applicable rows exit 0 and failed tests exit 1.
 
 `src/cli/provider-batch.ts` reuses the authoritative named editor parser from `src/server/auth-cors.ts`. Snapshot strips only four GUI decorations, validates, then emits exactly defaultProvider/providers. Supplied baseline/next documents are not stripped or normalized; removals require --yes, the wire body is one exact PUT, and stale baselines are not automatically refreshed or retried. Batch removal does not claim single-DELETE OAuth account cleanup. Neither the snapshot nor address pinning supplies a cross-invocation process identity guarantee.
 
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index d9f8afa5a83..48d657e10e4 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -290,7 +290,7 @@ per-request first-party callback reads that live object; a failed write leaves i
 | Diagnostics/sync | `src/server/management/config-routes.ts` — `GET /api/diagnostics/project-config` reports project-level Codex config that bypasses managed routing; `POST /api/sync` re-runs catalog/config sync. The diagnostic reports the bypass; it does not rewrite the project file. |
 | Sidecar/shadow-call settings | `src/server/management/config-routes.ts` — `GET/PUT /api/sidecar-settings` and `GET/PUT /api/shadow-call-settings`, and `GET/PUT /api/auto-review-settings`. The auto-review settings route validates the global reviewer selector, persists its enabled/model fields with rollback before publication, then converges the catalog and returns its disposition; the Models panel keeps the server echo and displays a pending-sync notice whenever no commit is reported. Sidecar PUT accepts model and backend (web-search union: openai/anthropic/xai/gemini/exa; xAI is live through stored Grok OAuth, while Gemini/Exa remain inert until their executors ship) plus validated `webSearch.xSearch`, optional `webSearch.exaApiKey` (write/clear only — never echoed by GET or the PUT response; redact.ts strips it from logs), `webSearch.reasoning`, `vision.reasoning`, `vision.enabled`, `vision.maxDescriptionsPerTurn`, and `vision.timeoutMs`; the read and PUT-response payload reports model, backend, reasoning, enabled, the vision per-turn limit, and timeout. An effective `vision.enabled` change persists before one bounded catalog-only convergence updates the managed catalog and Codex model cache; the PUT response returns `catalogRefreshPending` for incomplete work. Identical effective values and unrelated partial writes do not converge, and no result claims client reload. `timeoutMs` is validated against the runtime integer bounds in `src/vision/timeout-bounds.ts`. Provider/OAuth credentials live in their stores; `exaApiKey` is the one sidecar-owned secret and follows the write-only contract above. Both shadow-call responses also report the resolved `sourceModels` — the prefixes the runtime actually intercepts (`src/lib/shadow-call.ts`, default `gpt-6-luna` and `gpt-5.6-luna`; the retired `gpt-5.4-mini` stays available as an explicit `sourceModels` entry for 0.144.x clients), so no client hard-codes a helper slug that a Codex release can invalidate. PUT refuses a qualified target that only the router's default-provider fallback accepts. Provider disable and delete report the target they leave behind as `dependentShadowIntercept` (`shadowInterceptProviderDependency` in `src/server/management/shadow-call-validation.ts`), and at request time an unresolvable target returns `409 intercept_target_unavailable` before any send (`src/server/responses/shadow-target-availability.ts`); it never falls back to the native source model or the default provider. |
 | Storage | `src/server/management/logs-usage-routes.ts` — `GET /api/storage`, `POST /api/storage/cleanup/preview` and `/api/storage/cleanup`, `GET /api/storage/trash`, `POST /api/storage/trash/restore`, and `GET/PUT /api/storage/cleanup-policy` plus `POST /api/storage/cleanup-policy/run`. `GET /api/storage/cleanup-policy/test-stream` and `GET /api/storage/trash/restore/test-stream` exist for progress-stream testing. Cleanup takes an explicit `mode`: `quarantine` moves to trash and is restorable, `permanent` is not. The caller must name the mode — there is no default that silently deletes. |
-| Provider quotas and tests | `src/server/management/provider-routes.ts` — `GET /api/provider-quotas`, `POST /api/providers/test`, `GET/PUT /api/provider-context-caps`, `GET /api/provider-presets`. A quota read may be served from cache or force-refreshed; absent quota data is reported as unknown rather than as a measured zero. |
+| Provider quotas and tests | `src/server/management/provider-routes.ts` — `GET /api/provider-quotas`, `POST /api/providers/test`, `POST /api/providers/test-completion` (explicit single-model completion diagnostic, [contract](provider-completion-diagnostic.md)), `GET/PUT /api/provider-context-caps`, `GET /api/provider-presets`. A quota read may be served from cache or force-refreshed; absent quota data is reported as unknown rather than as a measured zero. |
 | Models and visibility | `src/server/management/model-routes.ts` — `GET /api/models`, `PUT /api/disabled-models`, `PUT /api/model-visibility`, `PUT /api/selected-models`, `GET/POST /api/custom-models`, `PUT /api/model-settings`. Visibility writes trigger catalog sync through the owning server path. `PUT /api/model-settings` edits one routed row's capability axes in place — context window, declared input modalities, reasoning ladder and its default — through the provider-level per-model maps the runtime already reads, so the row keeps its discovery provenance instead of being replaced by a custom model. Every field is optional and `null` clears the declaration back to the registry/catalog answer; display name is deliberately absent because `PUT /api/providers/{provider}/model-display-names` already owns it. |
 | Effort and fallback | `src/server/management/agent-settings-routes.ts` — `GET/PUT /api/effort-caps`, `/api/subagent-models`, `/api/subagent-model-fallback`. Caps clamp; they do not reject. |
 | Grok and Claude integrations | `src/server/management/agent-settings-routes.ts` — `GET /api/grok`, `PUT /api/grok/selection`, `POST /api/grok/apply`, `GET/PUT /api/claude-desktop`, `POST /api/claude-desktop/apply` (`mode`: `gateway` default for new installs, `first-party` opt-in, or legacy shapes), `GET /api/claude-desktop/status` (`mode`, `riskWarning`, `firstParty`), `GET/PUT /api/claude-code`. Gateway apply writes an external app's profile, so its status probe must read the same resolved path it writes (see [`responses.md`](transports/responses.md)); first-party apply writes only the Claude Code proxy env, see [`clients/claude-desktop.md`](clients/claude-desktop.md#desktop-modes-gateway-and-first-party). `gui/src/pages/ClaudeDesktop.tsx` renders the mode selector and sends the chosen `mode` with apply. It leads with Default model and Quick task model, which set the `opus` and `haiku` family defaults through `gui/src/pages/claude-desktop-roles.ts` (same move rules as the family lanes, which sit under a folded Advanced disclosure); the profile wire shape is unchanged. `gui/src/pages/ClaudeCode.tsx` is one page with a single Save bar; its Save body (`gui/src/pages/claude-code-save.ts`) omits `enabled`, which only the immediate connection switch writes. `PUT /api/claude-code` re-runs macOS system-env reconciliation (`src/server/system-env.ts`) whenever the body carries `systemEnv`, `authMode`, a model slot or a lever field: keys opencodex tracks as injected are refreshed or unset once the config stops producing them, and a launchd value the user set before injection is never touched.  `gui/src/pages/claude-code-tier-defaults.tsx` edits `tierModels` through the Save bar's dirty/poll/revert contract. `GET /api/claude-code/model-defaults` previews local user defaults; `POST` accepts exactly a fingerprint bound to the full settings document and saved tiers (`src/claude/model-default-settings.ts`). Changed settings/tiers return 409 and existing empty/corrupt documents are refused. Apply stages private bytes, captures the actual shared file into `model-default-backups/apply-*/settings.json` under the Claude config directory, validates that capture, then publishes with an exclusive hard link. A competing destination is never replaced, even on rollback; there is a brief missing-file interval, and unsupported cross-volume/link operations have no overwrite fallback. Failed restoration returns `settings_recovery_required` with the private recovery path shown as an alert. Selected aliases receive paired `_MODEL_NAME` labels via `claudeTierDisplayName` in `src/claude/context-windows.ts`. Preview includes label additions/updates and uses an empty `after` string for removal. An existing label is managed only when it exactly matches the generated name for its current alias (an identical manually entered label is indistinguishable); custom, empty and non-string labels are preserved. Unset tiers retain both their settings model IDs and display labels; a matching generated label is removed only when an explicitly selected tier is replaced with a non-alias; no client restart, connection credential change or Desktop family edit occurs. Covered by `tests/claude-integration/claude-model-default-labels.test.ts`, `tests/claude-integration/claude-intercept-settings.test.ts`, `tests/server/model-settings-management-api.test.ts`, `gui/tests/claude-code-save.test.ts` and `gui/tests/claude-code-background-helper.test.tsx`. |
diff --git a/structure/manifest.json b/structure/manifest.json
index 8d556d6d56c..1918b51504a 100644
--- a/structure/manifest.json
+++ b/structure/manifest.json
@@ -629,6 +629,17 @@
         "src/vision/"
       ]
     },
+    {
+      "path": "provider-completion-diagnostic.md",
+      "tier": 5,
+      "title": "Provider Completion Diagnostic",
+      "scope": "Explicit single-model completion test: consent, applicability gate, send-time authority fingerprint, bounded streaming and metadata comparison.",
+      "documents": [
+        "gui/",
+        "src/cli/",
+        "src/server/"
+      ]
+    },
     {
       "path": "dashboard-and-usage.md",
       "tier": 5,
diff --git a/structure/provider-completion-diagnostic.md b/structure/provider-completion-diagnostic.md
new file mode 100644
index 00000000000..6409ef5ddd8
--- /dev/null
+++ b/structure/provider-completion-diagnostic.md
@@ -0,0 +1,11 @@
+# Provider Completion Diagnostic
+
+The explicit, user-confirmed single-model completion test that complements the no-completion connectivity probe (`POST /api/providers/test`). It is served by `src/server/management/provider-completion-test.ts`, reached from `src/cli/provider-runtime.ts` (`ocx provider test <name> --model <id>`) and `gui/src/components/provider-workspace/ProviderCompletionTest.tsx`. Regression suites: `tests/providers/provider-completion-test.test.ts`, `tests/providers/provider-completion-test-authority.test.ts`, `tests/providers/provider-completion-test-ingress.test.ts`, `gui/tests/provider-completion-test.test.tsx`.
+
+Provider routes lazily dispatch `POST /api/providers/test-completion?name=...` to the completion runner. The registry assigns the mutating route to `src/server/management/provider-routes.ts`; normal management authentication, Origin admission and dashboard CSRF apply. Exact input is `{ model, confirm: true }`; invalid input, unknown providers and concurrent tests return 400, 404 and 409. A process-local slot is released in `finally` on every outcome.
+
+Applicability checks disabled state, forwarded/OAuth auth, unsupported transports and effective per-model wire before credentials. TLS profiles, HTTP-version pins, enabled pacing and custom executors with provider proxy overrides are unsupported. Metadata routing removes stored keys/pools; destination policy precedes real key resolution. Only OpenAI Chat and Responses execute, through existing transport builders and `providerOutboundPost`, without redirects, retries or failover. Aliases and suffixes reuse existing helpers.
+
+A memory-only fingerprint captures wire, URL, wire model, sorted headers, auth, key selection/resolved key, destination policy, egress and disabled state. Before physical send the same live row must reproduce it, with current key-selection authority for credentialed rows; changes return `credential_changed` with no send.
+
+The prompt is `Reply exactly OK.`, output cap 32, deadline 20 seconds and stream cap 64 KiB including partial frames. Shared SSE decoding records TTFT at the first non-empty text delta. Chat DONE or finish-reason plus EOF, and Responses completed/incomplete events, establish completion only with text. Every exit aborts and cancels. Errors use fixed messages; HTTP failures include status without reading bodies. Raw model comparison precedes known-secret masking, control stripping, 256-character truncation and generic redaction. Missing/conflicting metadata is unknown; `identityVerified` is false. No output preview, config, health, history or catalog mutation is produced.
diff --git a/tests/cli/cli-capability-provider-workflows.test.ts b/tests/cli/cli-capability-provider-workflows.test.ts
index 8f1d761d4bc..48f878f4c96 100644
--- a/tests/cli/cli-capability-provider-workflows.test.ts
+++ b/tests/cli/cli-capability-provider-workflows.test.ts
@@ -203,7 +203,11 @@ describe("provider/model discovery follows existing handlers", () => {
     expect(await handleModelsRuntimeCommand("selected", ["fixture", "--set", "m", "--clear"], deps)).not.toBe(0);
     expect(await handleModelsRuntimeCommand("edit", ["id", "--context-window", "-"], deps)).not.toBe(0);
     expect(await handleProviderRuntimeCommand("test", [], deps)).not.toBe(0);
-    expect(capability("provider test").routes).toEqual([{ method: "POST", path: "/api/providers/test" }]);
+    expect(capability("provider test").routes).toEqual([
+      { method: "POST", path: "/api/providers/test" }, { method: "POST", path: "/api/providers/test-completion" },
+    ]);
+    expect(capability("provider test").usage).toBe("ocx provider test <name> [--model <id> [--yes]] [--json]");
+    expect(capability("provider test").flags.map(flag => flag.name)).toEqual(["--model", "--yes", "--json"]);
     expect(await handleProviderRuntimeCommand("edit", ["other", "--xai-chat", "on"], deps)).not.toBe(0);
     expect(calls).toEqual([]);
   });
diff --git a/tests/cli/cli-provider-sync-result.test.ts b/tests/cli/cli-provider-sync-result.test.ts
index e99fe6f981c..2b4fd311767 100644
--- a/tests/cli/cli-provider-sync-result.test.ts
+++ b/tests/cli/cli-provider-sync-result.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { readFileSync, writeFileSync } from "node:fs";
+import { PassThrough } from "node:stream";
 import { handleProviderCommand, type ProviderCommandDeps } from "../../src/cli/provider";
 import { syncModelsToCodex, type CodexSyncResult } from "../../src/codex/sync";
 import { refreshCodexModelCatalog } from "../../src/codex/refresh";
@@ -269,3 +270,148 @@ describe("provider add keeps requested local sync independent of JSON output", (
     expect(printed()).toBe("");
   });
 });
+
+
+type ProbeCall = { path: string; method: string; body: unknown };
+function probeDeps(payload: unknown, calls: ProbeCall[], tty = false): ProviderCommandDeps {
+  return {
+    baseUrl: "http://127.0.0.1:19223",
+    stdinImpl: Object.assign(new PassThrough(), { isTTY: tty }),
+    fetchImpl: (async (input, init) => {
+      const url = new URL(String(input));
+      calls.push({ path: url.pathname + url.search, method: init?.method ?? "GET",
+        body: init?.body === undefined ? undefined : JSON.parse(String(init.body)) });
+      return Response.json(payload);
+    }) as typeof fetch,
+  };
+}
+const completed = {
+  applicable: true, ok: true, provider: "example", requestedModel: "model[fast]", wireModel: "model",
+  wire: "openai-chat", upstreamModel: "model", modelComparison: "match", identityVerified: false,
+  ttftMs: 12, totalLatencyMs: 34, outputTokenCap: 32, termination: "completed", error: null,
+};
+const completionArgs = ["test", "example", "--model", "model[fast]"];
+const warnings = () => stderr.mock.calls.flat().join("\n");
+
+describe("provider single-model completion consent and result", () => {
+  test.each([
+    { payload: { ok: true, message: "discovered", latencyMs: 4 }, code: 0 },
+    { payload: { ok: false, error: "discovery failed", latencyMs: 5 }, code: 1 },
+    { payload: { applicable: false }, code: 0 },
+  ])("unflagged discovery retains request and human output", async ({ payload, code }) => {
+    const calls: ProbeCall[] = [];
+    await handleProviderCommand(["test", "example"], probeDeps(payload, calls));
+    expect(process.exitCode).toBe(code);
+    expect(calls).toEqual([{ path: "/api/providers/test?name=example", method: "POST", body: undefined }]);
+    expect(printed()).toContain(payload.applicable === false ? "Static catalog" : payload.ok ? "connected" : "failed");
+    expect(printed()).not.toContain("quota");
+    expect(warnings()).toBe("");
+  });
+
+  test.each([
+    { args: completionArgs, tty: false },
+    { args: [...completionArgs, "--json"], tty: false },
+    { args: [...completionArgs, "--json"], tty: true },
+    { args: ["test", "example", "--yes"], tty: true },
+    { args: ["test", "example", "--yes", "--json"], tty: false },
+    { args: ["test", "example", "--model"], tty: true },
+    { args: ["test", "example", "--model", "   ", "--yes"], tty: false },
+    { args: ["test", "example", "--model", "x".repeat(257), "--yes"], tty: false },
+    { args: ["test", "example", "--model", "a\x00b", "--yes"], tty: false },
+    { args: [...completionArgs, "--yes", "--yes"], tty: false },
+  ])("invalid/unconfirmed invocation refuses before all requests", async ({ args, tty }) => {
+    const calls: ProbeCall[] = [];
+    await handleProviderCommand(args, probeDeps(completed, calls, tty));
+    expect(process.exitCode).toBe(2);
+    expect(calls).toEqual([]);
+    expect(printed()).toBe("");
+  });
+
+  test.each(["n\n", "\n", "no\n", "anything else\n", "yes\n", "y\n"])("TTY answer %j controls dispatch", async answer => {
+    const calls: ProbeCall[] = [];
+    const deps = probeDeps(completed, calls, true);
+    const terminal = spyOn(process.stdout, "write").mockImplementation(() => true);
+    try {
+      const pending = handleProviderCommand(completionArgs, deps);
+      // The existing confirm helper accepts an injected stream without changing global stdin.
+      // Wait for its question rather than racing the provider dispatch's dynamic import.
+      for (let i = 0; i < 100 && terminal.mock.calls.length === 0; i++) await Bun.sleep(1);
+      expect(terminal.mock.calls.flat().join("")).toContain("[y/N]");
+      expect(printed()).toContain("example");
+      expect(printed()).toContain("model[fast]");
+      expect(printed()).toContain("quota");
+      expect(printed()).toContain("cost");
+      expect(calls).toEqual([]);
+      (deps.stdinImpl as PassThrough).write(answer);
+      await pending;
+      const yes = answer === "yes\n" || answer === "y\n";
+      expect(process.exitCode).toBe(yes ? 0 : 1);
+      expect(calls).toHaveLength(yes ? 1 : 0);
+      expect(printed()).toContain(yes ? "connected" : "cancelled");
+    } finally { terminal.mockRestore(); (deps.stdinImpl as PassThrough).destroy(); }
+  });
+
+  test.each([false, true])("--yes emits warning before its single request (json=%s)", async json => {
+    const calls: ProbeCall[] = [];
+    const deps = probeDeps(completed, calls);
+    const fetchImpl = deps.fetchImpl!;
+    deps.fetchImpl = (async (input, init) => {
+      const warning = json ? warnings() : printed();
+      expect(warning).toContain("example"); expect(warning).toContain("model[fast]");
+      expect(warning).toContain("quota"); expect(warning).toContain("cost");
+      return fetchImpl(input, init);
+    }) as typeof fetch;
+    await handleProviderCommand([...completionArgs, "--yes", ...(json ? ["--json"] : [])], deps);
+    expect(process.exitCode).toBe(0);
+    expect(calls).toEqual([{ path: "/api/providers/test-completion?name=example", method: "POST", body: { model: "model[fast]", confirm: true } }]);
+    if (json) { expect(JSON.parse(printed())).toEqual(completed); expect(stdout.mock.calls).toHaveLength(1); }
+    else {
+      expect(warnings()).toBe("");
+      for (const text of ["connected", "TTFT: 12 ms", "Total latency: 34 ms", "Upstream reported model for model — match", "metadata only — not proof of model identity"]) expect(printed()).toContain(text);
+    }
+  });
+
+  test.each([
+    { upstreamModel: "other-model", modelComparison: "mismatch" },
+    { upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata" },
+    { upstreamModel: null, modelComparison: "unknown", comparisonNote: "conflicting_metadata" },
+  ])("reports $modelComparison without claiming model identity", async metadata => {
+    const calls: ProbeCall[] = [];
+    await handleProviderCommand([...completionArgs, "--yes"], probeDeps({ ...completed, ...metadata }, calls));
+    expect(process.exitCode).toBe(0);
+    expect(printed()).toContain(`Upstream reported ${metadata.upstreamModel ?? "unknown"} for model — ${metadata.modelComparison}`);
+    if (metadata.comparisonNote) expect(printed()).toContain(metadata.comparisonNote);
+    expect(printed()).toContain("metadata only — not proof of model identity");
+  });
+
+  test.each([
+    { applicable: false, reason: "disabled" },
+    { applicable: false, reason: "forward_auth" },
+    { applicable: false, reason: "oauth_auth" },
+    { applicable: false, reason: "unsupported_adapter", adapter: "anthropic" },
+    { applicable: false, reason: "unsupported_transport", detail: "tls_profile" },
+  ])("non-applicable result renders $reason and exits zero", async payload => {
+    await handleProviderCommand([...completionArgs, "--yes"], probeDeps(payload, []));
+    expect(process.exitCode).toBe(0);
+    expect(printed()).toContain(payload.reason);
+    if (payload.adapter) expect(printed()).toContain(payload.adapter);
+    if (payload.detail) expect(printed()).toContain(payload.detail);
+    expect(printed()).not.toContain("connected");
+  });
+
+  test.each([false, true])("failed DTO is nonzero with code/message/status (json=%s)", async json => {
+    const payload = { ...completed, ok: false, termination: "failed", error: { code: "http_status", message: "Upstream request failed", status: 401 } };
+    await handleProviderCommand([...completionArgs, "--yes", ...(json ? ["--json"] : [])], probeDeps(payload, []));
+    expect(process.exitCode).toBe(1);
+    if (json) expect(JSON.parse(printed())).toEqual(payload);
+    else for (const text of ["http_status", "Upstream request failed", "401"]) expect(printed()).toContain(text);
+  });
+
+  test("failed DTO without status prints fixed diagnostic and no HTTP placeholder", async () => {
+    await handleProviderCommand([...completionArgs, "--yes"], probeDeps({ ...completed, ok: false,
+      error: { code: "timeout", message: "Completion test timed out" } }, []));
+    expect(process.exitCode).toBe(1);
+    expect(printed()).toContain("timeout: Completion test timed out");
+    expect(printed()).not.toContain("HTTP");
+  });
+});
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index b29ec798a94..6227c95f154 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -978,7 +978,7 @@
   "provider-account-quota-persistence.test.ts": "providers", "provider-account-quota-routes.test.ts": "server",
   "provider-account-quota.test.ts": "providers", "provider-api-keys.test.ts": "providers",
   "provider-capacity.test.ts": "providers", "provider-config-batch-management.test.ts": "providers",
-  "provider-config-validation.test.ts": "providers", "provider-connection-test.test.ts": "providers",
+  "provider-config-validation.test.ts": "providers", "provider-completion-test-authority.test.ts": "providers", "provider-completion-test-ingress.test.ts": "providers", "provider-completion-test.test.ts": "providers", "provider-connection-test.test.ts": "providers",
   "provider-cost-overlay-config.test.ts": "providers", "provider-discovery-log-suppression.test.ts": "providers",
   "provider-egress-fetch.test.ts": "responses", "provider-egress-management-validation.test.ts": "server",
   "provider-egress-outbound.test.ts": "providers", "provider-egress.test.ts": "lib",
diff --git a/tests/helpers/provider-completion-fixture.ts b/tests/helpers/provider-completion-fixture.ts
new file mode 100644
index 00000000000..9ec970f61db
--- /dev/null
+++ b/tests/helpers/provider-completion-fixture.ts
@@ -0,0 +1,22 @@
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { runProviderCompletionTest, type ProviderCompletionTestDependencies } from "../../src/server/management/provider-completion-test";
+import { handleManagementAPI } from "../../src/server/management-api";
+export const frame = (data: unknown, event?: string) => `${event ? `event: ${event}\n` : ""}data: ${typeof data === "string" ? data : JSON.stringify(data)}\n\n`;
+export const chat = (model: string | undefined = "test-model", content = "OK") => frame({ model, choices: [{ delta: { content }, finish_reason: "stop" }] }) + frame("[DONE]");
+export function fixture(overrides: Partial<OcxProviderConfig> = {}, respond: (init?: RequestInit) => Response | Promise<Response> = () => new Response(chat())) {
+  const calls: { url: string; init?: RequestInit }[] = [];
+  const row: OcxProviderConfig & { fetch?: typeof fetch } = {
+    adapter: "openai-chat", baseUrl: "https://provider.example/v1", authMode: "key", apiKey: "opaque-fixture-key", liveModels: false,
+    fetch: (async (url, init) => { calls.push({ url: String(url), init }); return respond(init); }) as typeof fetch,
+    ...overrides,
+  };
+  const config = { port: 0, hostname: "127.0.0.1", defaultProvider: "fixture", providers: { fixture: row } } as OcxConfig;
+  const run = (model = "test-model", deps?: ProviderCompletionTestDependencies, signal?: AbortSignal) => runProviderCompletionTest({ config, name: "fixture", model, signal }, deps);
+  const route = async (body: unknown = { model: "test-model", confirm: true }, name = "fixture", signal?: AbortSignal) => {
+    const req = new Request(`http://127.0.0.1/api/providers/test-completion?name=${name}`, { method: "POST", headers: { Host: "127.0.0.1", "content-type": "application/json" }, body: JSON.stringify(body), signal });
+    const response = await handleManagementAPI(req, new URL(req.url), config, {});
+    if (!response) throw new Error("missing route");
+    return { status: response.status, body: await response.json() as any };
+  };
+  return { row, config, calls, run, route };
+}
diff --git a/tests/providers/provider-completion-test-authority.test.ts b/tests/providers/provider-completion-test-authority.test.ts
new file mode 100644
index 00000000000..1f73670bb64
--- /dev/null
+++ b/tests/providers/provider-completion-test-authority.test.ts
@@ -0,0 +1,161 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { handleProviderCompletionTestRoute } from "../../src/server/management/provider-completion-test";
+import { fixture, chat } from "../helpers/provider-completion-fixture";
+import type { ProviderOutboundDependencies } from "../../src/lib/provider-outbound";
+import { setProviderKeychainEntryFactoryForTests } from "../../src/providers/key-store";
+import { PROXY_ENV_KEYS } from "../../src/lib/proxy-env";
+import { createTempHome } from "../helpers/temp-home";
+import { saveConfig, getConfigPath } from "../../src/config";
+import { healthEvidenceForCandidate, clearHealthHistoryCacheForTests } from "../../src/routing/health";
+import { queryRequestHistory, closeRequestHistoryIndex } from "../../src/routing/history/indexer";
+
+const proxyKeys = PROXY_ENV_KEYS.flatMap(key => [key, key.toLowerCase()]);
+const originalProxyEnv = Object.fromEntries(proxyKeys.map(key => [key, process.env[key]]));
+const originalFetch = globalThis.fetch;
+const previousKey = process.env.OCX_COMPLETION_FIXTURE_KEY;
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  setProviderKeychainEntryFactoryForTests(null);
+  for (const key of proxyKeys) {
+    const value = originalProxyEnv[key];
+    if (value === undefined) delete process.env[key]; else process.env[key] = value;
+  }
+  if (previousKey === undefined) delete process.env.OCX_COMPLETION_FIXTURE_KEY; else process.env.OCX_COMPLETION_FIXTURE_KEY = previousKey;
+});
+const addresses = { hostname: "provider.example", addresses: [{ address: "93.184.216.34", family: 4 as const }], privateNetwork: false };
+function pinned(mutate: () => void, send: () => void): ProviderOutboundDependencies {
+  return {
+    resolveAddresses: async () => { mutate(); return addresses; },
+    pinnedPost: async () => { send(); return new Response(chat()); },
+  };
+}
+
+describe("beforeSend request authority fingerprint", () => {
+  for (const kind of ["replace", "headers", "baseUrl", "path", "model-wire", "disabled", "private-policy", "key", "keyless-headers", "proxy", "noProxy"] as const) {
+    test(`${kind} changed during DNS: zero physical sends`, async () => {
+      for (const key of proxyKeys) delete process.env[key];
+      const f = fixture({ headers: { "X-Authority": "before" } });
+      delete f.row.fetch;
+      if (kind === "keyless-headers") { f.row.authMode = "local"; f.row.keyOptional = true; delete f.row.apiKey; }
+      let sends = 0;
+      const result = await f.run("test-model", { outboundDependencies: pinned(() => {
+        switch (kind) {
+          case "replace": f.config.providers.fixture = { ...f.row }; break;
+          case "headers": case "keyless-headers": f.row.headers!["X-Authority"] = "after"; break;
+          case "baseUrl": f.row.baseUrl = "https://other.example/v1"; break;
+          case "path": f.row.chatCompletionsPath = "/different"; break;
+          case "model-wire": f.row.modelAdapters = { "test-model": "openai-responses" }; break;
+          case "disabled": f.row.disabled = true; break;
+          case "private-policy": f.row.allowPrivateNetwork = true; break;
+          case "key": f.row.apiKey = "after-key"; break;
+          case "proxy": f.row.proxy = false; break;
+          case "noProxy": f.row.noProxy = "provider.example"; break;
+        }
+      }, () => sends++) });
+      expect(result).toMatchObject({ error: { code: "credential_changed" }, termination: "failed" });
+      expect(sends).toBe(0);
+      expect(f.calls).toHaveLength(0);
+    });
+  }
+  for (const kind of ["env", "keychain"] as const) test(`${kind} resolved key rotation: zero physical sends`, async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    let secret = "before-key", sends = 0;
+    process.env.OCX_COMPLETION_FIXTURE_KEY = secret;
+    const factory = () => ({ getPassword: () => secret, setPassword() {}, deletePassword: () => true });
+    setProviderKeychainEntryFactoryForTests(factory);
+    const f = fixture({ apiKey: kind === "env" ? "$OCX_COMPLETION_FIXTURE_KEY" : "keychain:fixture" });
+    delete f.row.fetch;
+    expect(await f.run("test-model", { outboundDependencies: pinned(() => {
+      secret = "after-key";
+      process.env.OCX_COMPLETION_FIXTURE_KEY = secret;
+      setProviderKeychainEntryFactoryForTests(factory);
+    }, () => sends++) })).toMatchObject({ error: { code: "credential_changed" } });
+    expect(sends).toBe(0);
+  });
+  test("unchanged keyless authority sends successfully", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const f = fixture({ authMode: "local", keyOptional: true, apiKey: undefined });
+    delete f.row.fetch;
+    let sends = 0;
+    expect(await f.run("test-model", { outboundDependencies: pinned(() => {}, () => sends++) })).toMatchObject({ ok: true });
+    expect(sends).toBe(1);
+  });
+  test("provider direct and proxy egress use the existing outbound transport owner", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    process.env.HTTPS_PROXY = "http://global-egress.example:3128";
+    let pinnedSends = 0;
+    const proxies: unknown[] = [];
+    globalThis.fetch = (async (_url, init) => {
+      proxies.push((init as RequestInit & { proxy?: unknown })?.proxy);
+      return new Response(chat());
+    }) as typeof fetch;
+    for (const proxy of ["direct", "http://provider-egress.example:8080"] as const) {
+      const f = fixture({ proxy }); delete f.row.fetch;
+      expect(await f.run("test-model", { outboundDependencies: pinned(() => {}, () => pinnedSends++) })).toMatchObject({ ok: true });
+    }
+    expect(pinnedSends).toBe(1);
+    expect(proxies).toEqual(["http://provider-egress.example:8080/"]);
+  });
+});
+
+describe("completion route concurrency", () => {
+  for (const outcome of ["success", "http", "throw", "abort"] as const) test(`409 during ${outcome}, finally releases the provider slot`, async () => {
+    let release!: () => void;
+    const barrier = new Promise<void>(resolve => { release = resolve; });
+    let entered!: () => void;
+    const entry = new Promise<void>(resolve => { entered = resolve; });
+    const controller = new AbortController();
+    const f = fixture({}, async () => {
+      entered(); await barrier;
+      if (outcome === "throw") throw new Error("upstream failure");
+      return outcome === "http" ? new Response("failed", { status: 500 }) : new Response(chat());
+    });
+    const first = f.route(undefined, "fixture", controller.signal);
+    await entry;
+    expect(await f.route()).toEqual({ status: 409, body: { error: "completion test already running for this provider" } });
+    if (outcome === "abort") controller.abort();
+    release();
+    expect((await first).status).toBe(200);
+    expect((await f.route()).status).toBe(200);
+    expect(f.calls).toHaveLength(2);
+  });
+  for (const outcome of ["timeout", "too_large", "stream_error"] as const) test(`${outcome} route releases its occupied slot`, async () => {
+    let entered!: () => void;
+    const entry = new Promise<void>(resolve => { entered = resolve; });
+    const f = fixture({}, async () => { entered(); return new Response(new ReadableStream({
+      start(c) {
+        if (outcome === "too_large") setTimeout(() => c.enqueue(new Uint8Array(65537)), 10);
+        if (outcome === "stream_error") setTimeout(() => c.enqueue(new TextEncoder().encode('data: {"error":{}}\n\n')), 10);
+      },
+    })); });
+    const invoke = async () => {
+      const req = new Request("http://127.0.0.1/api/providers/test-completion?name=fixture", { method: "POST", body: JSON.stringify({ model: "test-model", confirm: true }) });
+      return handleProviderCompletionTestRoute({ req, url: new URL(req.url), config: f.config }, { timeoutMs: 30 });
+    };
+    const first = invoke();
+    await entry;
+    expect((await invoke()).status).toBe(409);
+    expect(await (await first).json()).toMatchObject({ error: { code: outcome } });
+    f.row.fetch = (async () => new Response(chat())) as typeof fetch;
+    expect(await (await invoke()).json()).toMatchObject({ ok: true });
+  });
+});
+
+test("diagnostics leave config file, route health and request history unchanged", async () => {
+  const home = createTempHome("ocx-completion-unchanged-");
+  try {
+    const f = fixture();
+    saveConfig(f.config);
+    const beforeConfig = readFileSync(getConfigPath(), "utf8");
+    const beforeHistory = await queryRequestHistory({}, undefined, 20);
+    clearHealthHistoryCacheForTests();
+    const beforeHealth = healthEvidenceForCandidate({ provider: "fixture", model: "test-model", now: 1_900_000_000_000 });
+    expect(await f.run()).toMatchObject({ ok: true });
+    expect(readFileSync(getConfigPath(), "utf8")).toBe(beforeConfig);
+    const afterHistory = await queryRequestHistory({}, undefined, 20);
+    expect(afterHistory.rows).toEqual(beforeHistory.rows);
+    clearHealthHistoryCacheForTests();
+    expect(healthEvidenceForCandidate({ provider: "fixture", model: "test-model", now: 1_900_000_000_000 })).toEqual(beforeHealth);
+  } finally { closeRequestHistoryIndex(); home.remove(); }
+});
diff --git a/tests/providers/provider-completion-test-ingress.test.ts b/tests/providers/provider-completion-test-ingress.test.ts
new file mode 100644
index 00000000000..940300dcb8b
--- /dev/null
+++ b/tests/providers/provider-completion-test-ingress.test.ts
@@ -0,0 +1,48 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { saveConfig } from "../../src/config";
+import { startServer } from "../../src/server";
+import { createTempHome, type TempHome } from "../helpers/temp-home";
+import { fixture } from "../helpers/provider-completion-fixture";
+
+const previousAdmin = process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+const previousData = process.env.OPENCODEX_API_AUTH_TOKEN;
+let home: TempHome;
+beforeEach(() => {
+  home = createTempHome("ocx-completion-ingress-");
+  process.env.OPENCODEX_ADMIN_AUTH_TOKEN = "completion-admin-fixture";
+  process.env.OPENCODEX_API_AUTH_TOKEN = "completion-data-fixture";
+});
+afterEach(() => {
+  if (previousAdmin === undefined) delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN; else process.env.OPENCODEX_ADMIN_AUTH_TOKEN = previousAdmin;
+  if (previousData === undefined) delete process.env.OPENCODEX_API_AUTH_TOKEN; else process.env.OPENCODEX_API_AUTH_TOKEN = previousData;
+  home.remove();
+});
+
+test("real management ingress rejects anonymous/data credentials, foreign Origin and GUI session without CSRF before any upstream send", async () => {
+  // Exercise startServer's real auth/origin/CSRF gates rather than a fabricated route principal.
+  const f = fixture();
+  saveConfig(f.config);
+  const server = startServer(0);
+  const originalFetch = globalThis.fetch;
+  let sends = 0;
+  globalThis.fetch = (async (input, init) => {
+    const url = input instanceof Request ? input.url : String(input);
+    if (url.includes("provider.example")) { sends++; throw new Error("must not send"); }
+    return originalFetch(input, init);
+  }) as typeof fetch;
+  try {
+    const target = new URL("/api/providers/test-completion?name=fixture", server.url);
+    const post = (headers: Record<string, string>) => fetch(target, { method: "POST", headers: { "content-type": "application/json", ...headers }, body: JSON.stringify({ model: "test-model", confirm: true }) });
+    expect((await post({})).status).toBe(401);
+    expect((await post({ "x-opencodex-api-key": "completion-data-fixture" })).status).toBe(401);
+    expect((await post({ "x-opencodex-api-key": "completion-admin-fixture", Origin: "https://foreign.example" })).status).toBe(403);
+    const html = await (await fetch(new URL("/opencodex-session", server.url))).text();
+    const token = html.match(/name="opencodex-session-token" content="([^"]+)"/)?.[1];
+    const csrf = html.match(/name="opencodex-session-csrf" content="([^"]+)"/)?.[1];
+    expect(token).toBeDefined(); expect(csrf).toBeDefined();
+    const missingCsrf = await post({ "x-opencodex-api-key": token!, "x-opencodex-gui-origin": server.url.origin, Origin: server.url.origin });
+    expect([401, 403]).toContain(missingCsrf.status);
+    expect(sends).toBe(0);
+    expect(f.calls).toHaveLength(0);
+  } finally { globalThis.fetch = originalFetch; await server.stop(true); }
+});
diff --git a/tests/providers/provider-completion-test.test.ts b/tests/providers/provider-completion-test.test.ts
new file mode 100644
index 00000000000..69a3f8bbede
--- /dev/null
+++ b/tests/providers/provider-completion-test.test.ts
@@ -0,0 +1,253 @@
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import { frame, chat, fixture } from "../helpers/provider-completion-fixture";
+import { runProviderCompletionTest, COMPLETION_TEST_PROMPT, COMPLETION_TEST_MAX_BYTES } from "../../src/server/management/provider-completion-test";
+import { setProviderKeychainEntryFactoryForTests } from "../../src/providers/key-store";
+import * as keyResolver from "../../src/providers/api-key-resolve";
+import type { OcxProviderConfig } from "../../src/types";
+
+afterEach(() => setProviderKeychainEntryFactoryForTests(null));
+
+describe("completion test applicability and input", () => {
+  const invalid = [null, [], false, {}, { model: "test-model" }, { model: "test-model", confirm: false },
+    { model: "test-model", confirm: true, prompt: "hello" }, { model: 1, confirm: true },
+    ...["", " ", "x".repeat(257), "a\nb", "a\u0000b", "a\u007fb", "\ntest-model"].map(model => ({ model, confirm: true }))];
+  for (const [index, body] of invalid.entries()) test(`invalid body ${index}: 400 and no send`, async () => {
+    const f = fixture();
+    expect((await f.route(body)).status).toBe(400);
+    expect(f.calls).toHaveLength(0);
+  });
+  test("unknown provider: 404 and no send", async () => {
+    const f = fixture();
+    expect(await f.route(undefined, "absent")).toEqual({ status: 404, body: { error: "unknown provider" } });
+    expect(f.calls).toHaveLength(0);
+  });
+  for (const [overrides, reason] of [
+    [{ disabled: true, authMode: "oauth" }, "disabled"], [{ authMode: "forward" }, "forward_auth"],
+    [{ authMode: "oauth" }, "oauth_auth"], [{ adapter: "anthropic" }, "unsupported_adapter"], [{ adapter: "google" }, "unsupported_adapter"],
+  ] as const) test(`${reason} runs before resolving any stored key`, async () => {
+    let reads = 0;
+    setProviderKeychainEntryFactoryForTests(() => { reads++; throw new Error("must not read"); });
+    const spy = spyOn(keyResolver, "resolveProviderApiKey");
+    try {
+      const f = fixture({ ...overrides, apiKey: "keychain:fixture" });
+      expect(await f.run()).toMatchObject({ applicable: false, reason });
+      expect(reads).toBe(0);
+      expect(spy.mock.calls.every(([reference]) => reference === undefined)).toBe(true);
+      expect(f.calls).toHaveLength(0);
+    } finally { spy.mockRestore(); }
+  });
+  for (const [overrides, detail] of [
+    [{ tlsProfile: "chrome" }, "tls_profile"], [{ upstreamHttpVersion: "http1.1" }, "upstream_http_version"],
+    [{ requestPacing: { enabled: true } }, "request_pacing"], [{ proxy: false }, "custom_executor_egress"],
+  ] as const) test(`unsupported ${detail} has no send`, async () => {
+    const f = fixture(overrides as Partial<OcxProviderConfig>);
+    expect(await f.run()).toEqual({ applicable: false, reason: "unsupported_transport", detail });
+    expect(f.calls).toHaveLength(0);
+  });
+  for (const [name, reason] of [["openai", "forward_auth"], ["github-copilot", "oauth_auth"]] as const) test(`registry auth gate ${name} needs no credential lookup`, async () => {
+    let reads = 0;
+    setProviderKeychainEntryFactoryForTests(() => { reads++; throw new Error("must not read"); });
+    const f = fixture({ authMode: "local", apiKey: "keychain:fixture" });
+    f.config.providers[name] = f.row;
+    expect(await runProviderCompletionTest({ config: f.config, name, model: "test-model" })).toEqual({ applicable: false, reason });
+    expect(reads).toBe(0); expect(f.calls).toHaveLength(0);
+  });
+  test("prototype-shaped unknown provider is still 404", async () => {
+    const f = fixture();
+    expect((await f.route(undefined, "__proto__")).status).toBe(404);
+    expect(f.calls).toHaveLength(0);
+  });
+  test("destination refused before key lookup", async () => {
+    let reads = 0;
+    setProviderKeychainEntryFactoryForTests(() => { reads++; throw new Error("must not read"); });
+    const f = fixture({ baseUrl: "https://127.0.0.1/v1", apiKey: "keychain:fixture" });
+    expect(await f.run()).toMatchObject({ error: { code: "destination_refused" } });
+    expect(f.calls).toHaveLength(0);
+    expect(reads).toBe(0);
+  });
+  test("missing key refuses without a send", async () => {
+    const f = fixture({ apiKey: undefined });
+    expect(await f.run()).toMatchObject({ error: { code: "credential_missing" } });
+    expect(f.calls).toHaveLength(0);
+  });
+  test("invalid per-model adapter is ignored by the shared resolver", async () => {
+    const f = fixture({ modelAdapters: { "test-model": "anthropic" as any } });
+    expect(await f.run()).toMatchObject({ ok: true, wire: "openai-chat" });
+    expect(f.calls).toHaveLength(1);
+  });
+});
+
+describe("bounded wire and model observations", () => {
+  test("chat uses exact prompt/body, adapter path, static row, cap, and headers", async () => {
+    const f = fixture({ chatCompletionsPath: "/custom/chat", headers: { "X-Provider": "fixture" } });
+    const result = await f.run();
+    expect(result).toMatchObject({ applicable: true, ok: true, requestedModel: "test-model", wireModel: "test-model", wire: "openai-chat",
+      upstreamModel: "test-model", modelComparison: "match", identityVerified: false, outputTokenCap: 32, termination: "completed", error: null });
+    if (!result.applicable) throw new Error("applicable");
+    expect(result.ttftMs).not.toBeNull();
+    expect(result.totalLatencyMs).toBeGreaterThanOrEqual(result.ttftMs!);
+    expect(f.calls).toHaveLength(1);
+    expect(f.calls[0]!.url).toBe("https://provider.example/v1/custom/chat");
+    const init = f.calls[0]!.init!;
+    expect(JSON.parse(String(init.body))).toEqual({ model: "test-model", messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32 });
+    expect(new Headers(init.headers).get("authorization")).toBe("Bearer opaque-fixture-key");
+    expect(new Headers(init.headers).get("accept")).toBe("text/event-stream");
+    expect(init.redirect).toBe("manual");
+    expect(init.signal!.aborted).toBe(true);
+  });
+  for (const terminal of ["response.completed", "response.incomplete"]) test(`responses override: ${terminal}`, async () => {
+    const payload = frame({ type: "response.created", response: { model: "test-model" } })
+      + frame({ type: "response.output_text.delta", delta: "OK" }) + frame({ type: terminal, response: { model: "test-model" } });
+    const f = fixture({ modelAdapters: { "test-model": "openai-responses" }, responsesPath: "/custom/responses" }, () => new Response(payload));
+    expect(await f.run()).toMatchObject({ ok: true, wire: "openai-responses", modelComparison: "match", termination: "completed" });
+    expect(f.calls[0]!.url).toBe("https://provider.example/v1/custom/responses");
+    expect(JSON.parse(String(f.calls[0]!.init!.body))).toEqual({ model: "test-model", input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+  });
+  test("arbitrary SSE byte splits including CRLF and UTF-8", async () => {
+    const bytes = new TextEncoder().encode(chat("test-model", "응답").replaceAll("\n", "\r\n"));
+    let position = 0;
+    const f = fixture({}, () => new Response(new ReadableStream({ pull(c) {
+      if (position === bytes.length) c.close(); else c.enqueue(bytes.slice(position, ++position));
+    } })));
+    expect(await f.run()).toMatchObject({ ok: true, modelComparison: "match" });
+  });
+  test("role/reasoning-only events do not start TTFT", async () => {
+    let clock = 0;
+    const frames = [frame({ choices: [{ delta: { role: "assistant", reasoning_content: "private" } }] }), chat()];
+    const f = fixture({}, () => new Response(new ReadableStream({ pull(c) {
+      clock += 50;
+      const next = frames.shift(); if (next) c.enqueue(new TextEncoder().encode(next)); else c.close();
+    } }, { highWaterMark: 0 }), { headers: { "content-type": "text/event-stream" } }));
+    expect(await f.run("test-model", { now: () => clock })).toMatchObject({ ok: true, ttftMs: 100, totalLatencyMs: 100 });
+  });
+  for (const [upstream, expected] of [["other", "mismatch"], ["test-model", "match"], ["", "mismatch"]]) test(`raw upstream comparison ${expected}`, async () => {
+    const f = fixture({}, () => new Response(chat(upstream)));
+    expect(await f.run()).toMatchObject({ upstreamModel: upstream, modelComparison: expected });
+  });
+  test("alias and bracket suffix reuse existing model authorities", async () => {
+    const f = fixture({ modelAliases: { "native[1m]": "friendly" }, modelSuffixBracketStrip: true }, () => new Response(chat("native")));
+    expect(await f.run("friendly")).toMatchObject({ wireModel: "native", requestedModel: "friendly", modelComparison: "match" });
+    expect(JSON.parse(String(f.calls[0]!.init!.body)).model).toBe("native");
+  });
+  test("missing metadata is unknown", async () => {
+    const f = fixture({}, () => new Response(frame({ choices: [{ delta: { content: "OK" } }] }) + frame("[DONE]")));
+    expect(await f.run()).toMatchObject({ ok: true, upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata" });
+  });
+  test("conflicting metadata is unknown and cannot assert identity", async () => {
+    const f = fixture({}, () => new Response(frame({ model: "a", choices: [] }) + chat("b")));
+    expect(await f.run()).toMatchObject({ ok: true, upstreamModel: null, modelComparison: "unknown", comparisonNote: "conflicting_metadata", identityVerified: false });
+  });
+  for (const model of ["opaque-fixture-key", "x".repeat(250) + "opaque-fixture-key", "x\u0000opaque-fixture-key\u0000"]) test(`secret masked before cleanup/truncation ${model.length}`, async () => {
+    const f = fixture({}, () => new Response(chat(model)));
+    const result = await f.run();
+    expect(result).toMatchObject({ upstreamModel: "[redacted]", modelComparison: "mismatch" });
+    expect(JSON.stringify(result)).not.toContain("opaque-fixture-key");
+  });
+  test("raw comparison precedes header secret masking", async () => {
+    const f = fixture({ headers: { "X-Private": "test-model" } });
+    expect(await f.run()).toMatchObject({ upstreamModel: "[redacted]", modelComparison: "match" });
+  });
+  test("a control-containing configured secret masks the whole raw model", async () => {
+    const f = fixture({ apiKey: "opaque\tkey" }, () => new Response(chat("raw opaque\tkey response")));
+    expect(await f.run()).toMatchObject({ upstreamModel: "[redacted]" });
+  });
+  test("model secret masking retains the authority captured before the send", async () => {
+    const f = fixture({ headers: { "X-Private": "opaque-original-header" } }, () => {
+      f.row.headers!["X-Private"] = "new-value";
+      return new Response(chat("opaque-original-header"));
+    });
+    expect(await f.run()).toMatchObject({ upstreamModel: "[redacted]", modelComparison: "mismatch" });
+  });
+  test("untrusted metadata is cleaned and bounded", async () => {
+    const f = fixture({}, () => new Response(chat("\u0000" + "m".repeat(300) + "\u007f")));
+    expect(await f.run()).toMatchObject({ upstreamModel: "m".repeat(256), modelComparison: "mismatch" });
+  });
+});
+
+describe("failure classification and cleanup", () => {
+  for (const status of [401, 500, 302]) test(`HTTP ${status} never reads a secret body or follows Location`, async () => {
+    let cancelled = false;
+    const f = fixture({}, () => new Response(new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode("opaque-fixture-key")); }, cancel() { cancelled = true; } }),
+      { status, headers: { location: "https://other.example/secret" } }));
+    const result = await f.run();
+    expect(result).toMatchObject({ ok: false, termination: "failed", error: { code: status === 302 ? "redirect" : "http_status", ...(status === 302 ? {} : { status }) } });
+    expect(JSON.stringify(result)).not.toContain("opaque-fixture-key");
+    expect(JSON.stringify(result)).not.toContain("other.example");
+    expect(f.calls).toHaveLength(1);
+    expect(cancelled).toBe(true);
+  });
+  test("network throw has fixed safe error", async () => {
+    const f = fixture({}, () => { throw new Error("opaque-fixture-key https://secret.example"); });
+    expect(await f.run()).toMatchObject({ error: { code: "network", message: "Upstream network request failed." } });
+    expect(f.calls).toHaveLength(1);
+  });
+  for (const [wire, payload, code] of [
+    ["openai-chat", frame({ error: { message: "opaque-fixture-key" } }), "stream_error"],
+    ["openai-responses", frame({ type: "response.failed", response: { error: "opaque-fixture-key" } }), "stream_error"],
+    ["openai-chat", frame({ message: "opaque-fixture-key" }, "error"), "stream_error"],
+    ["openai-chat", frame({ choices: [{ delta: { content: "OK" } }] }), "premature_eof"],
+    ["openai-responses", frame({ type: "response.output_text.delta", delta: "OK" }), "premature_eof"],
+    ["openai-chat", frame("[DONE]"), "no_content"],
+    ["openai-responses", frame({ type: "response.completed" }), "no_content"],
+  ] as const) test(`${wire} ${code} ${payload.length}`, async () => {
+    let cancelled = false;
+    const f = fixture({ adapter: wire }, () => new Response(new ReadableStream({ start(c) {
+      c.enqueue(new TextEncoder().encode(payload));
+      if (code === "premature_eof") c.close();
+    }, cancel() { cancelled = true; } })));
+    const result = await f.run();
+    expect(result).toMatchObject({ ok: false, error: { code } });
+    expect(JSON.stringify(result)).not.toContain("opaque-fixture-key");
+    expect(f.calls[0]!.init!.signal!.aborted).toBe(true);
+    if (code !== "premature_eof") expect(cancelled).toBe(true);
+  });
+  test("finish_reason and EOF are sufficient for chat", async () => {
+    const f = fixture({}, () => new Response(frame({ choices: [{ delta: { content: "OK" }, finish_reason: "stop" }] })));
+    expect(await f.run()).toMatchObject({ ok: true });
+  });
+  test("counts incomplete frames toward the 64 KiB limit and cancels", async () => {
+    let cancelled = false;
+    const f = fixture({}, () => new Response(new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode("data: " + "x".repeat(COMPLETION_TEST_MAX_BYTES))); }, cancel() { cancelled = true; } })));
+    expect(await f.run()).toMatchObject({ termination: "too_large", error: { code: "too_large" } });
+    expect(cancelled).toBe(true);
+  });
+  test("deadline cancels a stalled stream even when executor ignores abort", async () => {
+    let cancelled = false;
+    const f = fixture({}, () => new Response(new ReadableStream({ cancel() { cancelled = true; } })));
+    expect(await f.run("test-model", { timeoutMs: 20 })).toMatchObject({ termination: "timeout", error: { code: "timeout" } });
+    expect(cancelled).toBe(true);
+  });
+  test("request abort cancels upstream reader", async () => {
+    let cancelled = false;
+    const controller = new AbortController();
+    const f = fixture({}, () => new Response(new ReadableStream({ start() { setTimeout(() => controller.abort(), 10); }, cancel() { cancelled = true; } })));
+    expect(await f.run("test-model", {}, controller.signal)).toMatchObject({ termination: "aborted", error: { code: "aborted" } });
+    expect(cancelled).toBe(true);
+  });
+  test("terminal cleanup cannot hang on an executor whose cancel never settles", async () => {
+    let cancelled = false;
+    const f = fixture({}, () => new Response(new ReadableStream({
+      start(c) { c.enqueue(new TextEncoder().encode(chat())); },
+      cancel() { cancelled = true; return new Promise(() => {}); },
+    })));
+    expect(await f.run("test-model", { timeoutMs: 30 })).toMatchObject({ ok: true });
+    expect(cancelled).toBe(true);
+  });
+  test("deadline cancels a late response from an executor ignoring abort", async () => {
+    let respond!: (response: Response) => void;
+    let observedCancellation!: () => void;
+    const cancellation = new Promise<void>(resolve => { observedCancellation = resolve; });
+    let cancelled = false;
+    const pending = new Promise<Response>(resolve => { respond = resolve; });
+    const f = fixture({}, () => pending);
+    expect(await f.run("test-model", { timeoutMs: 10 })).toMatchObject({ error: { code: "timeout" } });
+    respond(new Response(new ReadableStream({ cancel() { cancelled = true; observedCancellation(); } })));
+    await cancellation;
+    expect(cancelled).toBe(true);
+  });
+  test("already aborted request sends nothing", async () => {
+    const f = fixture();
+    expect(await f.run("test-model", {}, AbortSignal.abort())).toMatchObject({ error: { code: "aborted" } });
+    expect(f.calls).toHaveLength(0);
+  });
+});

From 37582cee5bb8fed962141a46adbe0381af93c718 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 04:42:13 +0900
Subject: [PATCH 2/4] fix(providers): dispose diagnostic translator budget,
 resolve aliases before wire, count real sends in ingress tests

Refs #2834
---
 .../management/provider-completion-test.ts    | 21 +++++----
 structure/provider-completion-diagnostic.md   |  4 +-
 ...provider-completion-test-authority.test.ts | 10 ++++-
 .../provider-completion-test-ingress.test.ts  | 35 +++++++++------
 .../provider-completion-test.test.ts          | 43 +++++++++++++++++++
 5 files changed, 89 insertions(+), 24 deletions(-)

diff --git a/src/server/management/provider-completion-test.ts b/src/server/management/provider-completion-test.ts
index c8f684deace..1941477790f 100644
--- a/src/server/management/provider-completion-test.ts
+++ b/src/server/management/provider-completion-test.ts
@@ -69,20 +69,21 @@ function transportExclusion(row: OcxProviderConfig): Extract<ProviderCompletionT
   if (typeof (row as { fetch?: unknown }).fetch === "function" && "proxy" in row) return "custom_executor_egress";
   return undefined;
 }
-function effectiveModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
+function nativeModel(config: OcxConfig, row: OcxProviderConfig, model: string): string {
   const known = new Set([...(row.models ?? []), ...Object.keys(row.modelAliases ?? {})]);
-  const native = known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
-  return row.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+  return known.has(model) ? model : resolveModelAlias(config, row, known, model) ?? model;
 }
 function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model: string) {
-  const routed = resolveWireProtocolOverride(name, model, routedProviderConfig(name, row));
+  const resolved = routedProviderConfig(name, row);
+  const native = nativeModel(config, resolved, model);
+  const routed = resolveWireProtocolOverride(name, native, resolved);
   const wire = routed.adapter;
   if (wire !== "openai-chat" && wire !== "openai-responses") throw new Error("unsupported adapter");
   const transport = wire === "openai-chat" ? openAIChatTransport(routed)
     : buildResponsesTransport(routed, { headers: new Headers() });
   const headers = new Headers(transport.headers);
   headers.set("Accept", "text/event-stream");
-  const wireModel = effectiveModel(config, routed, model);
+  const wireModel = routed.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
   // Capture primitive values now: rows and their nested header objects may mutate in place.
   const selection = routed._apiKeyAttempt;
   const fingerprint = JSON.stringify({ wire, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
@@ -123,11 +124,13 @@ export async function runProviderCompletionTest(
   let snapshot: OcxProviderConfig = metadata;
   let destinationRefused = false;
   try { snapshot = routedProviderConfig(name, metadata); } catch { destinationRefused = true; }
-  const wire = resolveWireProtocolOverride(name, model, snapshot).adapter;
+  const native = nativeModel(config, snapshot, model);
+  const wire = resolveWireProtocolOverride(name, native, snapshot).adapter;
   if (wire !== "openai-chat" && wire !== "openai-responses") return { applicable: false, reason: "unsupported_adapter", adapter: wire };
   const now = deps.now ?? (() => performance.now());
   const result: Extract<ProviderCompletionTestResult, { applicable: true }> = {
-    applicable: true, ok: false, provider: name, requestedModel: model, wireModel: effectiveModel(config, snapshot, model), wire,
+    applicable: true, ok: false, provider: name, requestedModel: model,
+    wireModel: snapshot.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native, wire,
     upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata", identityVerified: false,
     ttftMs: null, totalLatencyMs: 0, outputTokenCap: COMPLETION_TEST_OUTPUT_TOKEN_CAP, termination: "failed", error: null,
   };
@@ -153,6 +156,7 @@ export async function runProviderCompletionTest(
   const started = now();
   let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
   let response: Response | undefined;
+  const translatorBudget = createTranslatorBudget();
   let observed: string | undefined;
   let conflicting = false, terminal = false, content = false, finishReason = false;
   const observe = (value: unknown) => {
@@ -196,7 +200,7 @@ export async function runProviderCompletionTest(
       },
       cancel() { void reader!.cancel().catch(() => {}); },
     }, { highWaterMark: 0 });
-    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget: createTranslatorBudget() })) {
+    for await (const event of decodeServerSentEvents(counted, { signal, translatorBudget })) {
       if (authority.wire === "openai-chat" && event.data.trim() === "[DONE]") { terminal = true; break; }
       let chunk: Record<string, any>;
       try { chunk = JSON.parse(event.data); } catch { throw new DiagnosticFailure("stream_error"); }
@@ -232,6 +236,7 @@ export async function runProviderCompletionTest(
       : error instanceof ProviderOutboundSendCancelledError ? "credential_changed"
       : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
   } finally {
+    translatorBudget.dispose();
     result.totalLatencyMs = Math.max(0, now() - started);
     if (observed !== undefined && !conflicting) {
       result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
diff --git a/structure/provider-completion-diagnostic.md b/structure/provider-completion-diagnostic.md
index 6409ef5ddd8..0459a5ad489 100644
--- a/structure/provider-completion-diagnostic.md
+++ b/structure/provider-completion-diagnostic.md
@@ -4,8 +4,8 @@ The explicit, user-confirmed single-model completion test that complements the n
 
 Provider routes lazily dispatch `POST /api/providers/test-completion?name=...` to the completion runner. The registry assigns the mutating route to `src/server/management/provider-routes.ts`; normal management authentication, Origin admission and dashboard CSRF apply. Exact input is `{ model, confirm: true }`; invalid input, unknown providers and concurrent tests return 400, 404 and 409. A process-local slot is released in `finally` on every outcome.
 
-Applicability checks disabled state, forwarded/OAuth auth, unsupported transports and effective per-model wire before credentials. TLS profiles, HTTP-version pins, enabled pacing and custom executors with provider proxy overrides are unsupported. Metadata routing removes stored keys/pools; destination policy precedes real key resolution. Only OpenAI Chat and Responses execute, through existing transport builders and `providerOutboundPost`, without redirects, retries or failover. Aliases and suffixes reuse existing helpers.
+Applicability checks disabled state, forwarded/OAuth auth, unsupported transports and effective per-model wire before credentials. TLS profiles, HTTP-version pins, enabled pacing and custom executors with provider proxy overrides are unsupported. Metadata routing removes stored keys/pools; destination policy precedes real key resolution. Only OpenAI Chat and Responses execute, through existing transport builders and `providerOutboundPost`, without redirects, retries or failover. Both applicability and authority derivation resolve aliases to native model ids before selecting per-model wires, then apply wire-model suffix stripping through existing helpers.
 
 A memory-only fingerprint captures wire, URL, wire model, sorted headers, auth, key selection/resolved key, destination policy, egress and disabled state. Before physical send the same live row must reproduce it, with current key-selection authority for credentialed rows; changes return `credential_changed` with no send.
 
-The prompt is `Reply exactly OK.`, output cap 32, deadline 20 seconds and stream cap 64 KiB including partial frames. Shared SSE decoding records TTFT at the first non-empty text delta. Chat DONE or finish-reason plus EOF, and Responses completed/incomplete events, establish completion only with text. Every exit aborts and cancels. Errors use fixed messages; HTTP failures include status without reading bodies. Raw model comparison precedes known-secret masking, control stripping, 256-character truncation and generic redaction. Missing/conflicting metadata is unknown; `identityVerified` is false. No output preview, config, health, history or catalog mutation is produced.
+The prompt is `Reply exactly OK.`, output cap 32, deadline 20 seconds and stream cap 64 KiB including partial frames. Shared SSE decoding records TTFT at the first non-empty text delta. Chat DONE or finish-reason plus EOF, and Responses completed/incomplete events, establish completion only with text. Every exit aborts, cancels and disposes the diagnostic's translator budget. Errors use fixed messages; HTTP failures include status without reading bodies. Raw model comparison precedes known-secret masking, control stripping, 256-character truncation and generic redaction. Missing/conflicting metadata is unknown; `identityVerified` is false. No output preview, config, health, history or catalog mutation is produced.
diff --git a/tests/providers/provider-completion-test-authority.test.ts b/tests/providers/provider-completion-test-authority.test.ts
index 1f73670bb64..fdf56acd8ca 100644
--- a/tests/providers/provider-completion-test-authority.test.ts
+++ b/tests/providers/provider-completion-test-authority.test.ts
@@ -55,7 +55,6 @@ describe("beforeSend request authority fingerprint", () => {
       }, () => sends++) });
       expect(result).toMatchObject({ error: { code: "credential_changed" }, termination: "failed" });
       expect(sends).toBe(0);
-      expect(f.calls).toHaveLength(0);
     });
   }
   for (const kind of ["env", "keychain"] as const) test(`${kind} resolved key rotation: zero physical sends`, async () => {
@@ -81,6 +80,15 @@ describe("beforeSend request authority fingerprint", () => {
     expect(await f.run("test-model", { outboundDependencies: pinned(() => {}, () => sends++) })).toMatchObject({ ok: true });
     expect(sends).toBe(1);
   });
+  test("alias wire changes during DNS invalidate the effective authority", async () => {
+    const f = fixture({ proxy: "direct", modelAliases: { native: "friendly" }, modelAdapters: { native: "openai-responses" } });
+    delete f.row.fetch;
+    let sends = 0;
+    expect(await f.run("friendly", { outboundDependencies: pinned(() => {
+      f.row.modelAdapters!.native = "openai-chat";
+    }, () => sends++) })).toMatchObject({ wire: "openai-responses", error: { code: "credential_changed" } });
+    expect(sends).toBe(0);
+  });
   test("provider direct and proxy egress use the existing outbound transport owner", async () => {
     for (const key of proxyKeys) delete process.env[key];
     process.env.HTTPS_PROXY = "http://global-egress.example:3128";
diff --git a/tests/providers/provider-completion-test-ingress.test.ts b/tests/providers/provider-completion-test-ingress.test.ts
index 940300dcb8b..244346c9c82 100644
--- a/tests/providers/provider-completion-test-ingress.test.ts
+++ b/tests/providers/provider-completion-test-ingress.test.ts
@@ -1,8 +1,10 @@
-import { afterEach, beforeEach, expect, test } from "bun:test";
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
 import { saveConfig } from "../../src/config";
 import { startServer } from "../../src/server";
 import { createTempHome, type TempHome } from "../helpers/temp-home";
-import { fixture } from "../helpers/provider-completion-fixture";
+import { chat, fixture } from "../helpers/provider-completion-fixture";
+import * as pinnedHttp from "../../src/lib/pinned-http";
+import * as destinationPolicy from "../../src/lib/destination-policy";
 
 const previousAdmin = process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
 const previousData = process.env.OPENCODEX_API_AUTH_TOKEN;
@@ -20,29 +22,36 @@ afterEach(() => {
 
 test("real management ingress rejects anonymous/data credentials, foreign Origin and GUI session without CSRF before any upstream send", async () => {
   // Exercise startServer's real auth/origin/CSRF gates rather than a fabricated route principal.
-  const f = fixture();
+  const f = fixture({ proxy: "direct" });
+  delete f.row.fetch;
   saveConfig(f.config);
   const server = startServer(0);
-  const originalFetch = globalThis.fetch;
-  let sends = 0;
-  globalThis.fetch = (async (input, init) => {
-    const url = input instanceof Request ? input.url : String(input);
-    if (url.includes("provider.example")) { sends++; throw new Error("must not send"); }
-    return originalFetch(input, init);
-  }) as typeof fetch;
+  const dns = spyOn(destinationPolicy, "resolvePublicAddresses").mockResolvedValue({
+    hostname: "provider.example", addresses: [{ address: "93.184.216.34", family: 4 }], privateNetwork: false,
+  });
+  const sends = spyOn(pinnedHttp, "pinnedHttpPost").mockImplementation(async () => new Response(chat()));
   try {
     const target = new URL("/api/providers/test-completion?name=fixture", server.url);
     const post = (headers: Record<string, string>) => fetch(target, { method: "POST", headers: { "content-type": "application/json", ...headers }, body: JSON.stringify({ model: "test-model", confirm: true }) });
     expect((await post({})).status).toBe(401);
+    expect(sends).not.toHaveBeenCalled();
     expect((await post({ "x-opencodex-api-key": "completion-data-fixture" })).status).toBe(401);
+    expect(sends).not.toHaveBeenCalled();
     expect((await post({ "x-opencodex-api-key": "completion-admin-fixture", Origin: "https://foreign.example" })).status).toBe(403);
+    expect(sends).not.toHaveBeenCalled();
     const html = await (await fetch(new URL("/opencodex-session", server.url))).text();
     const token = html.match(/name="opencodex-session-token" content="([^"]+)"/)?.[1];
     const csrf = html.match(/name="opencodex-session-csrf" content="([^"]+)"/)?.[1];
     expect(token).toBeDefined(); expect(csrf).toBeDefined();
     const missingCsrf = await post({ "x-opencodex-api-key": token!, "x-opencodex-gui-origin": server.url.origin, Origin: server.url.origin });
     expect([401, 403]).toContain(missingCsrf.status);
-    expect(sends).toBe(0);
-    expect(f.calls).toHaveLength(0);
-  } finally { globalThis.fetch = originalFetch; await server.stop(true); }
+    expect(sends).not.toHaveBeenCalled();
+    // Same ingress and pinned transport: an authorized request must reach this counter.
+    const authorized = await post({ "x-opencodex-api-key": "completion-admin-fixture" });
+    expect(authorized.status).toBe(200);
+    expect(await authorized.json()).toMatchObject({ applicable: true, ok: true, wire: "openai-chat" });
+    expect(sends).toHaveBeenCalledTimes(1);
+    expect(sends.mock.calls[0]![0]).toBe("https://provider.example/v1/chat/completions");
+    expect(JSON.parse(sends.mock.calls[0]![2]).model).toBe("test-model");
+  } finally { sends.mockRestore(); dns.mockRestore(); await server.stop(true); }
 });
diff --git a/tests/providers/provider-completion-test.test.ts b/tests/providers/provider-completion-test.test.ts
index 69a3f8bbede..b4815596333 100644
--- a/tests/providers/provider-completion-test.test.ts
+++ b/tests/providers/provider-completion-test.test.ts
@@ -4,6 +4,7 @@ import { runProviderCompletionTest, COMPLETION_TEST_PROMPT, COMPLETION_TEST_MAX_
 import { setProviderKeychainEntryFactoryForTests } from "../../src/providers/key-store";
 import * as keyResolver from "../../src/providers/api-key-resolve";
 import type { OcxProviderConfig } from "../../src/types";
+import { translatorLiveBudgetCountForTests } from "../../src/lib/translator-budget";
 
 afterEach(() => setProviderKeychainEntryFactoryForTests(null));
 
@@ -75,6 +76,16 @@ describe("completion test applicability and input", () => {
     expect(await f.run()).toMatchObject({ ok: true, wire: "openai-chat" });
     expect(f.calls).toHaveLength(1);
   });
+  test("alias to a hard-pinned unsupported wire is rejected before credentials", async () => {
+    let reads = 0;
+    setProviderKeychainEntryFactoryForTests(() => { reads++; throw new Error("must not read"); });
+    const f = fixture({ apiKey: "keychain:fixture", modelAliases: { "minimax-m2.7": "friendly" } });
+    f.config.providers["opencode-go"] = f.row;
+    expect(await runProviderCompletionTest({ config: f.config, name: "opencode-go", model: "friendly" }))
+      .toEqual({ applicable: false, reason: "unsupported_adapter", adapter: "anthropic" });
+    expect(reads).toBe(0);
+    expect(f.calls).toHaveLength(0);
+  });
 });
 
 describe("bounded wire and model observations", () => {
@@ -129,6 +140,22 @@ describe("bounded wire and model observations", () => {
     expect(await f.run("friendly")).toMatchObject({ wireModel: "native", requestedModel: "friendly", modelComparison: "match" });
     expect(JSON.parse(String(f.calls[0]!.init!.body)).model).toBe("native");
   });
+  for (const adapter of ["openai-chat", "anthropic"] as const) test(`alias resolves native Responses override before ${adapter} applicability`, async () => {
+    const payload = frame({ type: "response.created", response: { model: "native" } })
+      + frame({ type: "response.output_text.delta", delta: "OK" })
+      + frame({ type: "response.completed", response: { model: "native" } });
+    const f = fixture({ adapter, modelAliases: { native: "friendly" }, modelAdapters: { native: "openai-responses" } }, () => new Response(payload));
+    expect(await f.run("friendly")).toMatchObject({ ok: true, wire: "openai-responses", wireModel: "native", modelComparison: "match" });
+    expect(f.calls).toHaveLength(1);
+    expect(f.calls[0]!.url).toBe("https://provider.example/v1/responses");
+    expect(JSON.parse(String(f.calls[0]!.init!.body))).toEqual({ model: "native", input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
+  });
+  test("native wire override precedes bracket suffix stripping", async () => {
+    const f = fixture({ adapter: "openai-responses", modelAliases: { "native[1m]": "friendly" },
+      modelAdapters: { "native[1m]": "openai-chat" }, modelSuffixBracketStrip: true }, () => new Response(chat("native")));
+    expect(await f.run("friendly")).toMatchObject({ ok: true, wire: "openai-chat", wireModel: "native" });
+    expect(f.calls[0]!.url).toBe("https://provider.example/v1/chat/completions");
+  });
   test("missing metadata is unknown", async () => {
     const f = fixture({}, () => new Response(frame({ choices: [{ delta: { content: "OK" } }] }) + frame("[DONE]")));
     expect(await f.run()).toMatchObject({ ok: true, upstreamModel: null, modelComparison: "unknown", comparisonNote: "missing_metadata" });
@@ -165,6 +192,22 @@ describe("bounded wire and model observations", () => {
 });
 
 describe("failure classification and cleanup", () => {
+  for (const outcome of ["success", "http_status", "stream_error", "too_large", "timeout", "aborted"] as const) test(`${outcome} releases its translator budget`, async () => {
+    const before = translatorLiveBudgetCountForTests();
+    const controller = new AbortController();
+    const f = fixture({}, () => {
+      if (outcome === "success") return new Response(chat());
+      if (outcome === "http_status") return new Response(null, { status: 500 });
+      return new Response(new ReadableStream({ start(c) {
+        if (outcome === "stream_error") c.enqueue(new TextEncoder().encode(frame({ error: {} })));
+        if (outcome === "too_large") c.enqueue(new Uint8Array(COMPLETION_TEST_MAX_BYTES + 1));
+        if (outcome === "aborted") setTimeout(() => controller.abort(), 10);
+      } }));
+    });
+    const result = await f.run("test-model", { timeoutMs: 100 }, controller.signal);
+    expect(result).toMatchObject(outcome === "success" ? { ok: true } : { error: { code: outcome } });
+    expect(translatorLiveBudgetCountForTests()).toBe(before);
+  });
   for (const status of [401, 500, 302]) test(`HTTP ${status} never reads a secret body or follows Location`, async () => {
     let cancelled = false;
     const f = fixture({}, () => new Response(new ReadableStream({ start(c) { c.enqueue(new TextEncoder().encode("opaque-fixture-key")); }, cancel() { cancelled = true; } }),

From 1aeeb5950e477b7f64726780095bfe164a5261a3 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:15:36 +0900
Subject: [PATCH 3/4] fix(providers): admit local cleartext providers and keep
 gateway routing in completion test

Refs #2834
---
 .../management/provider-completion-test.ts    | 21 +++--
 structure/provider-completion-diagnostic.md   |  4 +-
 ...provider-completion-test-authority.test.ts | 86 ++++++++++++++++++-
 3 files changed, 104 insertions(+), 7 deletions(-)

diff --git a/src/server/management/provider-completion-test.ts b/src/server/management/provider-completion-test.ts
index 1941477790f..ed6afb7d99f 100644
--- a/src/server/management/provider-completion-test.ts
+++ b/src/server/management/provider-completion-test.ts
@@ -11,7 +11,9 @@ import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-select
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { openAIChatTransport, stripBracketedModelSuffix } from "../../adapters/openai-chat/wire";
 import { buildResponsesTransport } from "../../adapters/openai-responses/transport";
-import { assertProviderDestinationAllowed } from "../../lib/destination-policy";
+import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
+import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
+import { assertProviderDestinationAllowed, providerAllowsPrivateNetwork } from "../../lib/destination-policy";
 import { providerOutboundPost, ProviderOutboundPolicyError, ProviderOutboundSendCancelledError,
   type ProviderOutboundDependencies } from "../../lib/provider-outbound";
 import { redactSecretString } from "../../lib/redact";
@@ -84,13 +86,20 @@ function derive(config: OcxConfig, name: string, row: OcxProviderConfig, model:
   const headers = new Headers(transport.headers);
   headers.set("Accept", "text/event-stream");
   const wireModel = routed.modelSuffixBracketStrip ? stripBracketedModelSuffix(native) : native;
+  const openRouterRouting = wire === "openai-chat" ? resolveOpenRouterRouting(routed, native) : undefined;
+  const vercelRouting = wire === "openai-chat" ? resolveVercelGatewayRouting(routed, native) : undefined;
+  const providerRouting = vercelRouting ? vercelGatewayProviderPayload(vercelRouting)
+    : openRouterRouting ? openRouterProviderPayload(openRouterRouting) : undefined;
+  // Normal inference admits registry-local defaults as well as the operator's explicit opt-in.
+  // Materialize that effective policy for the outbound wrapper's narrower local HTTP safeguard.
+  const allowLocalCleartextPost = providerAllowsPrivateNetwork(name, routed);
   // Capture primitive values now: rows and their nested header objects may mutate in place.
   const selection = routed._apiKeyAttempt;
-  const fingerprint = JSON.stringify({ wire, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
+  const fingerprint = JSON.stringify({ wire, providerRouting, allowLocalCleartextPost, url: transport.url, wireModel, headers: [...headers].sort(([a], [b]) => a.localeCompare(b)),
     authMode: routed.authMode, apiKey: routed.apiKey,
     selection: selection && { entryId: selection.entryId, reference: selection.reference, revision: selection.revision },
     allowPrivateNetwork: routed.allowPrivateNetwork, proxy: routed.proxy, noProxy: routed.noProxy, disabled: row.disabled });
-  return { routed, wire: wire as Wire, wireModel, headers, url: transport.url, fingerprint };
+  return { routed, wire: wire as Wire, wireModel, providerRouting, allowLocalCleartextPost, headers, url: transport.url, fingerprint };
 }
 function maskedModel(raw: string, secrets: Array<string | undefined>): string {
   if (secrets.some(secret => typeof secret === "string" && secret.length > 0 && raw.includes(secret))) return "[redacted]";
@@ -167,10 +176,12 @@ export async function runProviderCompletionTest(
   try {
     signal.throwIfAborted();
     const body = JSON.stringify(authority.wire === "openai-chat"
-      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32 }
+      ? { model: authority.wireModel, messages: [{ role: "user", content: COMPLETION_TEST_PROMPT }], stream: true, max_tokens: 32,
+        ...(authority.providerRouting ? { provider: authority.providerRouting } : {}) }
       : { model: authority.wireModel, input: COMPLETION_TEST_PROMPT, stream: true, max_output_tokens: 32, store: false });
-    const pending = providerOutboundPost(name, authority.routed, authority.url, { headers: authority.headers, body, signal }, {
+    const pending = providerOutboundPost(name, { ...authority.routed, allowPrivateNetwork: authority.allowLocalCleartextPost }, authority.url, { headers: authority.headers, body, signal }, {
       ...deps.outboundDependencies,
+      allowLocalCleartextPost: authority.allowLocalCleartextPost,
       beforeSend: () => {
         try {
           const current = config.providers[name];
diff --git a/structure/provider-completion-diagnostic.md b/structure/provider-completion-diagnostic.md
index 0459a5ad489..32067a70e12 100644
--- a/structure/provider-completion-diagnostic.md
+++ b/structure/provider-completion-diagnostic.md
@@ -6,6 +6,8 @@ Provider routes lazily dispatch `POST /api/providers/test-completion?name=...` t
 
 Applicability checks disabled state, forwarded/OAuth auth, unsupported transports and effective per-model wire before credentials. TLS profiles, HTTP-version pins, enabled pacing and custom executors with provider proxy overrides are unsupported. Metadata routing removes stored keys/pools; destination policy precedes real key resolution. Only OpenAI Chat and Responses execute, through existing transport builders and `providerOutboundPost`, without redirects, retries or failover. Both applicability and authority derivation resolve aliases to native model ids before selecting per-model wires, then apply wire-model suffix stripping through existing helpers.
 
-A memory-only fingerprint captures wire, URL, wire model, sorted headers, auth, key selection/resolved key, destination policy, egress and disabled state. Before physical send the same live row must reproduce it, with current key-selection authority for credentialed rows; changes return `credential_changed` with no send.
+Local HTTP probes materialize the existing effective private-network policy (operator opt-in or a registry-local default) and enable `providerOutboundPost`'s local-cleartext safeguard. Its narrow host/address allowlist, DNS-answer checks and proxy refusal still apply; public HTTP and private destinations without admission are refused. Chat probes resolve OpenRouter and Vercel AI Gateway routing with the same helpers as the chat adapter, keyed by the native model before suffix stripping, and serialize the resulting `provider` field. Responses does not synthesize that chat-only field.
+
+A memory-only fingerprint captures wire, URL, wire model, computed gateway routing, local-cleartext admission, sorted headers, auth, key selection/resolved key, destination policy, egress and disabled state. Before physical send the same live row must reproduce it, with current key-selection authority for credentialed rows; changes return `credential_changed` with no send.
 
 The prompt is `Reply exactly OK.`, output cap 32, deadline 20 seconds and stream cap 64 KiB including partial frames. Shared SSE decoding records TTFT at the first non-empty text delta. Chat DONE or finish-reason plus EOF, and Responses completed/incomplete events, establish completion only with text. Every exit aborts, cancels and disposes the diagnostic's translator budget. Errors use fixed messages; HTTP failures include status without reading bodies. Raw model comparison precedes known-secret masking, control stripping, 256-character truncation and generic redaction. Missing/conflicting metadata is unknown; `identityVerified` is false. No output preview, config, health, history or catalog mutation is produced.
diff --git a/tests/providers/provider-completion-test-authority.test.ts b/tests/providers/provider-completion-test-authority.test.ts
index fdf56acd8ca..b190a5ce9c2 100644
--- a/tests/providers/provider-completion-test-authority.test.ts
+++ b/tests/providers/provider-completion-test-authority.test.ts
@@ -1,7 +1,10 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
-import { handleProviderCompletionTestRoute } from "../../src/server/management/provider-completion-test";
+import { runProviderCompletionTest, handleProviderCompletionTestRoute } from "../../src/server/management/provider-completion-test";
 import { fixture, chat } from "../helpers/provider-completion-fixture";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { createOpenAIChatAdapter } from "../../src/adapters/openai-chat";
+import type { OcxProviderConfig } from "../../src/types";
 import type { ProviderOutboundDependencies } from "../../src/lib/provider-outbound";
 import { setProviderKeychainEntryFactoryForTests } from "../../src/providers/key-store";
 import { PROXY_ENV_KEYS } from "../../src/lib/proxy-env";
@@ -167,3 +170,84 @@ test("diagnostics leave config file, route health and request history unchanged"
     expect(healthEvidenceForCandidate({ provider: "fixture", model: "test-model", now: 1_900_000_000_000 })).toEqual(beforeHealth);
   } finally { closeRequestHistoryIndex(); home.remove(); }
 });
+
+
+describe("local cleartext completion transport", () => {
+  for (const name of ["ollama", "vllm", "lm-studio", "litellm"]) test(`${name} registry HTTP default reaches the counted transport`, async () => {
+    const entry = PROVIDER_REGISTRY.find(row => row.id === name)!;
+    const f = fixture({ baseUrl: entry.baseUrl, authMode: entry.authKind === "local" ? "local" : "key", proxy: "direct" });
+    delete f.row.fetch;
+    f.config.providers[name] = f.row;
+    let sends = 0;
+    const result = await runProviderCompletionTest({ config: f.config, name, model: "test-model" }, { outboundDependencies: {
+      resolveAddresses: async () => ({ hostname: "localhost", addresses: [{ address: "127.0.0.1", family: 4 }], privateNetwork: true }),
+      pinnedPost: async url => { sends++; expect(url).toBe(`${entry.baseUrl}/chat/completions`); return new Response(chat()); },
+    } });
+    expect(result).toMatchObject({ ok: true, termination: "completed" });
+    expect(sends).toBe(1);
+    expect(f.row.allowPrivateNetwork).toBeUndefined();
+  });
+  test("operator opt-in admits a private literal through the executor safeguard", async () => {
+    const f = fixture({ baseUrl: "http://192.168.1.10:8000/v1", allowPrivateNetwork: true });
+    expect(await f.run()).toMatchObject({ ok: true });
+    expect(f.calls).toHaveLength(1);
+  });
+  for (const [baseUrl, allowPrivateNetwork] of [
+    ["http://provider.example/v1", true], ["http://93.184.216.34/v1", true],
+    ["http://192.168.1.10:8000/v1", false], ["http://169.254.169.254/v1", true],
+  ] as const) test(`refused ${baseUrl}, private opt-in ${allowPrivateNetwork}: zero sends`, async () => {
+    const f = fixture({ baseUrl, allowPrivateNetwork });
+    expect(await f.run()).toMatchObject({ error: { code: "destination_refused" } });
+    expect(f.calls).toHaveLength(0);
+  });
+  test("local HTTP still refuses DNS answers outside the local allowlist", async () => {
+    const f = fixture({ baseUrl: "http://localhost:8000/v1", allowPrivateNetwork: true, proxy: "direct" });
+    delete f.row.fetch;
+    let sends = 0;
+    expect(await f.run("test-model", { outboundDependencies: pinned(() => {}, () => sends++) }))
+      .toMatchObject({ error: { code: "destination_refused" } });
+    expect(sends).toBe(0);
+  });
+});
+
+const gatewayCases: { name: string; baseUrl: string; defaults: Partial<OcxProviderConfig>; models: Partial<OcxProviderConfig>; expectedDefault: unknown; expectedModel: unknown }[] = [
+  { name: "OpenRouter", baseUrl: "https://openrouter.ai/api/v1",
+    defaults: { openRouterRouting: { order: ["default-backend"], allowFallbacks: false } },
+    models: { modelOpenRouterRouting: { "native[1m]": { only: ["locked-backend"], allowFallbacks: false } } },
+    expectedDefault: { order: ["default-backend"], allow_fallbacks: false }, expectedModel: { only: ["locked-backend"], allow_fallbacks: false } },
+  { name: "Vercel", baseUrl: "https://ai-gateway.vercel.sh/v1",
+    defaults: { vercelGatewayRouting: { order: ["default-backend"], sort: "cost" } },
+    models: { modelVercelGatewayRouting: { "native[1m]": { only: ["locked-backend"], sort: "ttft" } } },
+    expectedDefault: { order: ["default-backend"], sort: "cost" }, expectedModel: { only: ["locked-backend"], sort: "ttft" } },
+];
+describe("completion gateway routing matches the chat adapter", () => {
+  for (const gateway of gatewayCases) {
+    for (const mode of ["none", "default", "model"] as const) test(`${gateway.name} ${mode} routing uses the native model before suffix stripping`, async () => {
+      const f = fixture({ baseUrl: gateway.baseUrl, modelAliases: { "native[1m]": "friendly" }, modelSuffixBracketStrip: true,
+        ...(mode === "none" ? {} : gateway.defaults), ...(mode === "model" ? gateway.models : {}) });
+      expect(await f.run("friendly")).toMatchObject({ ok: true, wireModel: "native" });
+      const actual = JSON.parse(String(f.calls[0]!.init!.body));
+      const adapter = createOpenAIChatAdapter(f.row).buildRequest({ modelId: "native[1m]", stream: true,
+        context: { messages: [{ role: "user", content: "Reply exactly OK." }], tools: [] }, options: {} });
+      const expected = mode === "none" ? undefined : mode === "default" ? gateway.expectedDefault : gateway.expectedModel;
+      expect(actual.provider).toEqual(expected);
+      expect(actual.provider).toEqual(JSON.parse(String(adapter.body)).provider);
+      expect(Object.hasOwn(actual, "provider")).toBe(mode !== "none");
+    });
+    for (const kind of ["default", "model"] as const) test(`${gateway.name} ${kind} routing mutation during DNS cancels before transport`, async () => {
+      const f = fixture({ baseUrl: gateway.baseUrl, proxy: "direct", ...gateway.defaults, ...gateway.models });
+      delete f.row.fetch;
+      let sends = 0;
+      expect(await f.run(kind === "model" ? "native[1m]" : "other-model", { outboundDependencies: pinned(() => {
+        if (gateway.name === "OpenRouter") {
+          if (kind === "model") f.row.modelOpenRouterRouting!["native[1m]"]!.only!.push("changed");
+          else f.row.openRouterRouting!.allowFallbacks = true;
+        } else {
+          if (kind === "model") f.row.modelVercelGatewayRouting!["native[1m]"]!.only!.push("changed");
+          else f.row.vercelGatewayRouting!.sort = "tps";
+        }
+      }, () => sends++) })).toMatchObject({ error: { code: "credential_changed" } });
+      expect(sends).toBe(0);
+    });
+  }
+});

From 1b9fef08a5d02c0ad9ffa82d4931541834141466 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:46:40 +0900
Subject: [PATCH 4/4] fix(providers): bound completion-test body reads, round
 latency, align CLI model check

Refs #2834
---
 src/cli/provider-runtime.ts                   |  2 +-
 .../management/provider-completion-test.ts    |  9 ++++++---
 tests/cli/cli-provider-sync-result.test.ts    |  1 +
 .../provider-completion-test.test.ts          | 19 ++++++++++++++++++-
 4 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/src/cli/provider-runtime.ts b/src/cli/provider-runtime.ts
index d403e0615ab..3ccc19a60b6 100644
--- a/src/cli/provider-runtime.ts
+++ b/src/cli/provider-runtime.ts
@@ -216,7 +216,7 @@ async function testProvider(argv: string[], deps: RuntimeApiDeps): Promise<numbe
   rejectArgs(args, USAGE);
   if (yes && model === undefined) throw new CliUsageError("--yes requires --model", USAGE);
   if (model !== undefined) {
-    if (!model || model.length > 256 || /[\x00-\x1f\x7f]/.test(model)) {
+    if (!model || model.length > 256 || /[\x00-\x1f\x7f-\x9f]/.test(model)) {
       throw new CliUsageError("--model must contain 1..256 characters without control characters", USAGE);
     }
     return testCompletion(name, model, yes, wantsJson, deps);
diff --git a/src/server/management/provider-completion-test.ts b/src/server/management/provider-completion-test.ts
index ed6afb7d99f..c2fd14fef94 100644
--- a/src/server/management/provider-completion-test.ts
+++ b/src/server/management/provider-completion-test.ts
@@ -21,6 +21,7 @@ import { decodeServerSentEvents } from "../../lib/sse-decoder";
 import { createTranslatorBudget } from "../../lib/translator-budget";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
+import { managementBodyTooLargeResponse, readManagementJsonBody } from "./body";
 
 export const COMPLETION_TEST_PROMPT = "Reply exactly OK.";
 export const COMPLETION_TEST_OUTPUT_TOKEN_CAP = 32;
@@ -232,7 +233,7 @@ export async function runProviderCompletionTest(
         terminal = type === "response.completed" || type === "response.incomplete";
         if (type === "response.failed") throw new DiagnosticFailure("stream_error");
       }
-      if (text) { content = true; result.ttftMs ??= Math.max(0, now() - started); }
+      if (text) { content = true; result.ttftMs ??= Math.max(0, Math.round(now() - started)); }
       if (terminal) break;
     }
     signal.throwIfAborted();
@@ -248,7 +249,7 @@ export async function runProviderCompletionTest(
       : error instanceof ProviderOutboundPolicyError ? "destination_refused" : "network");
   } finally {
     translatorBudget.dispose();
-    result.totalLatencyMs = Math.max(0, now() - started);
+    result.totalLatencyMs = Math.max(0, Math.round(now() - started));
     if (observed !== undefined && !conflicting) {
       result.modelComparison = observed === authority.wireModel ? "match" : "mismatch";
       delete result.comparisonNote;
@@ -267,7 +268,9 @@ export async function handleProviderCompletionTestRoute(
   deps: ProviderCompletionTestDependencies = {},
 ): Promise<Response> {
   let body: unknown;
-  try { body = await req.json(); } catch { return jsonResponse({ error: "invalid completion test request" }, 400); }
+  try { body = await readManagementJsonBody(req); } catch (error) {
+    return managementBodyTooLargeResponse(error, req, config) ?? jsonResponse({ error: "invalid completion test request" }, 400);
+  }
   if (!body || typeof body !== "object" || Array.isArray(body)
     || Object.keys(body).some(key => key !== "model" && key !== "confirm")
     || (body as { confirm?: unknown }).confirm !== true || typeof (body as { model?: unknown }).model !== "string") {
diff --git a/tests/cli/cli-provider-sync-result.test.ts b/tests/cli/cli-provider-sync-result.test.ts
index 2b4fd311767..3c84990e69d 100644
--- a/tests/cli/cli-provider-sync-result.test.ts
+++ b/tests/cli/cli-provider-sync-result.test.ts
@@ -318,6 +318,7 @@ describe("provider single-model completion consent and result", () => {
     { args: ["test", "example", "--model", "   ", "--yes"], tty: false },
     { args: ["test", "example", "--model", "x".repeat(257), "--yes"], tty: false },
     { args: ["test", "example", "--model", "a\x00b", "--yes"], tty: false },
+    { args: ["test", "example", "--model", "a\u0085b", "--yes"], tty: false },
     { args: [...completionArgs, "--yes", "--yes"], tty: false },
   ])("invalid/unconfirmed invocation refuses before all requests", async ({ args, tty }) => {
     const calls: ProbeCall[] = [];
diff --git a/tests/providers/provider-completion-test.test.ts b/tests/providers/provider-completion-test.test.ts
index b4815596333..ee77a4e1114 100644
--- a/tests/providers/provider-completion-test.test.ts
+++ b/tests/providers/provider-completion-test.test.ts
@@ -11,7 +11,7 @@ afterEach(() => setProviderKeychainEntryFactoryForTests(null));
 describe("completion test applicability and input", () => {
   const invalid = [null, [], false, {}, { model: "test-model" }, { model: "test-model", confirm: false },
     { model: "test-model", confirm: true, prompt: "hello" }, { model: 1, confirm: true },
-    ...["", " ", "x".repeat(257), "a\nb", "a\u0000b", "a\u007fb", "\ntest-model"].map(model => ({ model, confirm: true }))];
+    ...["", " ", "x".repeat(257), "a\nb", "a\u0000b", "a\u007fb", "a\u0085b", "\ntest-model"].map(model => ({ model, confirm: true }))];
   for (const [index, body] of invalid.entries()) test(`invalid body ${index}: 400 and no send`, async () => {
     const f = fixture();
     expect((await f.route(body)).status).toBe(400);
@@ -22,6 +22,12 @@ describe("completion test applicability and input", () => {
     expect(await f.route(undefined, "absent")).toEqual({ status: 404, body: { error: "unknown provider" } });
     expect(f.calls).toHaveLength(0);
   });
+  test("oversized request body: shared management limit answers 413 and no send", async () => {
+    const f = fixture();
+    const response = await f.route({ model: "test-model", confirm: true, pad: "x".repeat(4 * 1024 * 1024 + 16) });
+    expect(response.status).toBe(413);
+    expect(f.calls).toHaveLength(0);
+  });
   for (const [overrides, reason] of [
     [{ disabled: true, authMode: "oauth" }, "disabled"], [{ authMode: "forward" }, "forward_auth"],
     [{ authMode: "oauth" }, "oauth_auth"], [{ adapter: "anthropic" }, "unsupported_adapter"], [{ adapter: "google" }, "unsupported_adapter"],
@@ -131,6 +137,17 @@ describe("bounded wire and model observations", () => {
     } }, { highWaterMark: 0 }), { headers: { "content-type": "text/event-stream" } }));
     expect(await f.run("test-model", { now: () => clock })).toMatchObject({ ok: true, ttftMs: 100, totalLatencyMs: 100 });
   });
+  test("fractional clock readings are reported as whole milliseconds", async () => {
+    const readings = [10.25, 138.9, 375.61];
+    let last = readings[0]!;
+    const f = fixture();
+    const result = await f.run("test-model", { now: () => (last = readings.shift() ?? last) });
+    expect(result).toMatchObject({ ok: true });
+    const { ttftMs, totalLatencyMs } = result as { ttftMs: number; totalLatencyMs: number };
+    expect(Number.isInteger(ttftMs)).toBe(true);
+    expect(Number.isInteger(totalLatencyMs)).toBe(true);
+    expect(totalLatencyMs).toBeGreaterThanOrEqual(ttftMs);
+  });
   for (const [upstream, expected] of [["other", "mismatch"], ["test-model", "match"], ["", "mismatch"]]) test(`raw upstream comparison ${expected}`, async () => {
     const f = fixture({}, () => new Response(chat(upstream)));
     expect(await f.run()).toMatchObject({ upstreamModel: upstream, modelComparison: expected });