[Bug]: Deleting a provider leaves its routed models in the Codex catalog after ocx sync

[Ttungx]

Client or integration

Codex App

Area

Proxy and routing

Summary

After removing a provider from ~/.opencodex/config.json, its routed models remain in
~/.codex/opencodex-catalog.json and models_cache.json indefinitely. The ghost models
keep appearing in the Codex App model picker and in codex debug models; selecting one
fails at request time because no provider can serve it. ocx sync and ocx sync-cache
do not remove them. The only recovery is manually deleting the catalog files and re-running
ocx sync. Expected behavior: deleting a provider should drop its routed models from the
catalog on the next sync, while keeping routed entries that external tools (e.g. Cursor)
injected.

Reproduction

1. Configure a routed provider, e.g. future-grok with adapter: openai-chat, then run
   ocx sync. Confirm its models are listed in ~/.codex/opencodex-catalog.json (measured
   48 occurrences of future-grok).
2. Remove the provider from the dashboard or directly from ~/.opencodex/config.json.
   The running proxy no longer lists it under GET /api/providers (only 3 providers remain).
3. Run ocx sync again and then ocx sync-cache.
4. Observed: grep -c "future-grok" ~/.codex/opencodex-catalog.json still returns 48; the
   Codex App model picker keeps showing the deleted provider's models.
5. Workaround that confirms the data source: back up and delete
   ~/.codex/opencodex-catalog.json, run ocx sync and ocx sync-cache; the ghost models
   disappear (count drops to 0).

Version

2.8.0

Operating system

Windows 11 24H2

Provider and model

No response

Logs or error output

No error is raised during `ocx sync`; the stale entries are silently preserved.

Screenshots and supporting files

No response

Redacted configuration

{
  "defaultProvider": "openai",
  "providers": {
    "openai": { "adapter": "openai", "authMode": "oauth" },
    "opencode-free": { "adapter": "openai-chat", "authMode": "key" }
  }
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.

[github-actions]

_{Automated translation bookkeeping — detected language: unknown.}

[lidge-jun]

Fixed on dev (merge 808b885). Sync now distinguishes OpenCodex-authored rows (the Routed via opencodex → ownership signature, including the June–July legacy forms and legacy combo aliases) from genuinely foreign rows: rows of a deleted provider are dropped in both the partial-gather and the empty-gather (transient-protection) branches, while Cursor/user rows stay preserved. Regressions cover both branches and all signature eras. Full CI green: https://github.com/lidge-jun/opencodex/actions/runs/30733116558 — scheduled for the next release train.