feat(catalog): mark quota-exhausted models and combos inactive

gui/src/i18n/de.ts

@@ -647,6 +647,8 @@ export const de: Record<TKey, string> = {
   "models.discoveryFailedProvider": "Der Anbieter meldete einen Fehler bei der Modellerkennung.",
   "models.discoveryFailedGeneric": "Die Modellerkennung ist fehlgeschlagen.",
   "models.openProviderSettings": "Anbietereinstellungen öffnen",
+  "models.inactiveNoCredit": "Kein Guthaben",
+  "models.inactiveNoCreditHint": "Alle Anbieter hinter diesem Eintrag haben gerade kein Guthaben, eine Anfrage würde also fehlschlagen. Der Eintrag bleibt gelistet und ist wieder nutzbar, sobald das Guthaben zurückgesetzt oder aufgeladen wird.",
   "models.discoveryFailedDependency": "Die Modellsuche ist für diesen Anbieter aktiv. Solange sie fehlschlägt, schalte „{control}“ in den Anbietereinstellungen aus, um stattdessen manuell hinzugefügte oder statische Modelle zu nutzen.",
   "models.loading": "Lädt…",
   "models.search": "Modelle suchen…",

gui/src/i18n/en.ts

@@ -676,6 +676,8 @@ export const en = {
   "models.discoveryFailedProvider": "The provider reported a model discovery error.",
   "models.discoveryFailedGeneric": "Model discovery failed.",
   "models.openProviderSettings": "Open provider settings",
+  "models.inactiveNoCredit": "No credit",
+  "models.inactiveNoCreditHint": "Every provider behind this entry is out of credit right now, so a request would fail. It stays listed and becomes usable again when credit resets or is topped up.",
   "models.discoveryFailedDependency": "Model discovery is on for this provider. While it keeps failing, turn off “{control}” in provider settings to use manually added or static models instead.",
   "models.loading": "Loading…",
   "models.search": "Search models…",

gui/src/i18n/fr.ts

@@ -661,6 +661,8 @@ export const fr: Record<TKey, string> = {
   "models.discoveryFailedProvider": "Le fournisseur a signalé une erreur de détection des modèles.",
   "models.discoveryFailedGeneric": "Échec de la détection des modèles.",
   "models.openProviderSettings": "Ouvrir les paramètres du fournisseur",
+  "models.inactiveNoCredit": "Aucun crédit",
+  "models.inactiveNoCreditHint": "Tous les fournisseurs derrière cette entrée sont à court de crédit ; une requête échouerait. L’entrée reste listée et redevient utilisable une fois le crédit réinitialisé ou rechargé.",
   "models.discoveryFailedDependency": "La découverte de modèles est activée pour ce fournisseur. Tant qu’elle échoue, désactivez « {control} » dans les paramètres du fournisseur pour utiliser à la place les modèles ajoutés manuellement ou statiques.",
   "models.loading": "Chargement…",
   "models.search": "Rechercher des modèles…",

gui/src/i18n/ja.ts

@@ -605,6 +605,8 @@ export const ja: Record<TKey, string> = {
   "models.discoveryFailedProvider": "プロバイダーがモデル検出エラーを報告しました。",
   "models.discoveryFailedGeneric": "モデル検出に失敗しました。",
   "models.openProviderSettings": "プロバイダー設定を開く",
+  "models.inactiveNoCredit": "クレジットなし",
+  "models.inactiveNoCreditHint": "このエントリの背後にあるプロバイダーはすべて現在クレジットがないため、リクエストは失敗します。一覧には残り、クレジットがリセットまたは追加されれば再び使えます。",
   "models.discoveryFailedDependency": "このプロバイダーではモデル検出が有効です。失敗が続く間は、プロバイダー設定で「{control}」をオフにすると、手動で追加したモデルや静的モデルを使えます。",
   "models.loading": "読み込み中…",
   "models.search": "モデルを検索…",

gui/src/i18n/ko.ts

@@ -658,6 +658,8 @@ export const ko: Record<TKey, string> = {
   "models.discoveryFailedProvider": "프로바이더가 모델 검색 오류를 보고했습니다.",
   "models.discoveryFailedGeneric": "모델 검색에 실패했습니다.",
   "models.openProviderSettings": "프로바이더 설정 열기",
+  "models.inactiveNoCredit": "크레딧 없음",
+  "models.inactiveNoCreditHint": "이 항목이 쓰는 프로바이더가 모두 크레딧이 없어서 지금 요청하면 실패해요. 목록에는 그대로 남고, 크레딧이 초기화되거나 충전되면 다시 쓸 수 있어요.",
   "models.discoveryFailedDependency": "이 프로바이더는 모델 검색이 켜져 있어요. 계속 실패한다면 프로바이더 설정에서 ‘{control}’을 꺼야 직접 추가한 모델이나 정적 모델을 쓸 수 있어요.",
   "models.loading": "불러오는 중…",
   "models.search": "모델 검색…",

gui/src/i18n/ru.ts

@@ -660,6 +660,8 @@ export const ru: Record<TKey, string> = {
   "models.discoveryFailedProvider": "Провайдер сообщил об ошибке обнаружения моделей.",
   "models.discoveryFailedGeneric": "Не удалось обнаружить модели.",
   "models.openProviderSettings": "Открыть настройки провайдера",
+  "models.inactiveNoCredit": "Нет кредитов",
+  "models.inactiveNoCreditHint": "У всех провайдеров этой записи сейчас закончились кредиты, поэтому запрос завершится ошибкой. Запись остаётся в списке и снова заработает после сброса или пополнения кредитов.",
   "models.discoveryFailedDependency": "Обнаружение моделей включено для этого провайдера. Пока оно не работает, отключите «{control}» в настройках провайдера, чтобы использовать вручную добавленные или статические модели.",
   "models.loading": "Загрузка…",
   "models.search": "Поиск моделей…",

gui/src/i18n/tr.ts

@@ -663,6 +663,8 @@ export const tr: Record<TKey, string> = {
   "models.discoveryFailedProvider": "Sağlayıcı bir model keşfi hatası bildirdi.",
   "models.discoveryFailedGeneric": "Model keşfi başarısız oldu.",
   "models.openProviderSettings": "Sağlayıcı ayarlarını aç",
+  "models.inactiveNoCredit": "Kredi yok",
+  "models.inactiveNoCreditHint": "Bu girdinin arkasındaki tüm sağlayıcıların kredisi şu anda bitmiş durumda, bu yüzden istek başarısız olur. Girdi listede kalır ve kredi sıfırlandığında veya yüklendiğinde yeniden kullanılabilir.",
   "models.discoveryFailedDependency": "Bu sağlayıcı için model keşfi açık. Başarısız olmaya devam ettiği sürece, elle eklenen veya statik modelleri kullanmak için sağlayıcı ayarlarından „{control}“ seçeneğini kapatın.",
   "models.loading": "Yükleniyor…",
   "models.search": "Modellerde ara…",

gui/src/i18n/zh-TW.ts

@@ -524,6 +524,8 @@ export const zhTW: Record<TKey, string> = {
   "models.discoveryFailedProvider": "供應商報告了模型發現錯誤。",
   "models.discoveryFailedGeneric": "模型發現失敗。",
   "models.openProviderSettings": "開啟供應商設定",
+  "models.inactiveNoCredit": "無額度",
+  "models.inactiveNoCreditHint": "此項目背後的供應商目前都沒有額度，送出請求會失敗。項目仍會列出，額度重置或儲值後即可繼續使用。",
   "models.discoveryFailedDependency": "此供應商已開啟模型探索。若持續失敗，可在供應商設定中關閉「{control}」，改用手動新增的模型或靜態模型。",
   "models.loading": "載入中…",
   "models.search": "搜尋模型…",

gui/src/i18n/zh.ts

@@ -655,6 +655,8 @@ export const zh: Record<TKey, string> = {
   "models.discoveryFailedProvider": "提供方报告了模型发现错误。",
   "models.discoveryFailedGeneric": "模型发现失败。",
   "models.openProviderSettings": "打开提供方设置",
+  "models.inactiveNoCredit": "无额度",
+  "models.inactiveNoCreditHint": "该条目背后的提供方当前都没有额度，请求会失败。条目仍会列出，额度重置或充值后即可继续使用。",
   "models.discoveryFailedDependency": "该提供方已开启模型发现。若持续失败，可在提供方设置中关闭“{control}”，改用手动添加的模型或静态模型。",
   "models.loading": "加载中…",
   "models.search": "搜索模型…",

gui/src/pages/Models.tsx

@@ -1724,7 +1724,15 @@ export default function Models({ apiBase, restartEpoch = 0 }: { apiBase: string;
                  >
                    <div className="row models-model-row">
                      <Switch on={!off} onClick={() => void applyVisibility("models", provider, [{ id: m.id, native: m.native === true }], off)} disabled={busy || m.initialSelectionPending} label={m.native ? m.id : m.namespaced} />
-                     {m.initialSelectionPending && <span className="models-chip muted" role="status">{t("models.initialSelectionPending")}</span>}
+                    {m.initialSelectionPending && <span className="models-chip muted" role="status">{t("models.initialSelectionPending")}</span>}
+                    {/* #1711: listed and selectable, but every usable target is out of credit.
+                        Not a visibility change and not the operator's disable flag — the row is
+                        still offered, which is what the issue asks for. */}
+                    {m.quotaInactiveReason === "no_credit" && (
+                      <span className="models-chip muted" role="status" title={t("models.inactiveNoCreditHint")}>
+                        {t("models.inactiveNoCredit")}
+                      </span>
+                    )}
                      {aliases.models[provider]?.[m.id] && <strong className="mono text-control">{aliases.models[provider][m.id].alias}</strong>}
                      <span className="models-model-identity">
                        <code className="mono text-control" style={{ color: off ? "var(--faint)" : "var(--text)", textDecoration: off ? "line-through" : "none" }}>{m.native ? modelLabel(m.id) : m.namespaced}</code>

gui/src/pages/models-shared.ts

@@ -38,6 +38,12 @@ export interface ModelRow {
   displayNameOverride?: string;
   displayNameSource?: "operator" | "provider" | "fallback";
   manualPricing?: boolean;
+  /**
+   * Listed but currently unable to serve, because every usable target is quota-exhausted
+   * (#1711). Distinct from `disabled`, which is the operator's own choice, and from visibility:
+   * the row is still offered.
+   */
+  quotaInactiveReason?: "no_credit";
   /**
    * Provider-published cost class from model discovery (#3666). Absent means unknown — either
    * the provider publishes no per-token rates, or the row was cached by a build that predates

scripts/test-layout/layout.json

@@ -275,6 +275,7 @@
     "catalog-retain-models.test.ts": "codex-integration",
     "catalog-verbosity-default.test.ts": "codex-integration",
     "catalog-vision-sidecar-modalities.test.ts": "codex-integration",
+    "catalog-zero-credit-picker.test.ts": "codex-integration",
     "chat-completions-endpoint.test.ts": "responses",
     "chat-json-sse-fallback.test.ts": "responses",
     "chat-refusal.test.ts": "responses",

src/codex/catalog/parsing.ts

@@ -144,6 +144,17 @@ export interface CatalogModel {
   codexToolMode?: "code_mode_only" | "shell";
   /** Normalized upstream capability names retained for management/API consumers (#485 follow-up). */
   capabilities?: string[];
+  /**
+   * This row is listed but cannot currently serve a request (#1711). Today the only value is
+   * "no_credit", set when every usable target has positive quota-exhaustion evidence.
+   *
+   * It is NOT visibility. The row stays `visibility: "list"` on purpose: the issue explicitly
+   * rejects hiding, and Codex Desktop only understands "list" and "hide" anyway, so hiding would
+   * be the one outcome the reporter asked not to have. An OpenCodex-aware consumer greys the
+   * entry; the native picker ignores the field, which is the honest limit of what a custom
+   * catalog field can do.
+   */
+  quotaInactiveReason?: "no_credit";
   /**
    * Discovered per-token cost class for this routed model (#3666). "free" means the provider's
    * own /models row reported a numeric zero for BOTH the prompt and the completion rate;

src/codex/catalog/provider-fetch.ts

@@ -60,6 +60,7 @@ import {
   comboModelId,
   getCombo,
   listComboIds,
+  quotaInactiveReason,
   targetKey,
 } from "../../combos";
 import type { NormalizedComboConfig } from "../../combos/types";
@@ -2681,7 +2682,16 @@ async function gatherRoutedModelsUncached(
   return {
     models: models.map(model => {
       const displayName = aliasDisplayNames.get(`${model.provider}/${model.id}`);
-      return displayName && !model.displayName ? { ...model, displayName } : model;
+      // #1711: one stamping point for every row this gather produces — routed, combo, and custom
+      // alike — because it is the only place that has both the finished list and the config the
+      // quota rules need. A combo votes over its own targets; anything else votes over the single
+      // provider that would serve it.
+      const targets = model.provider === COMBO_NAMESPACE
+        ? config.combos?.[model.id]?.targets ?? []
+        : [{ provider: model.provider }];
+      const inactive = quotaInactiveReason(config, targets);
+      const named = displayName && !model.displayName ? { ...model, displayName } : model;
+      return inactive ? { ...named, quotaInactiveReason: inactive } : named;
     }),
     comboOmissions: localOmissions,
     providerAuthOutcomes: localProviderAuthOutcomes,

src/codex/catalog/sync.ts

@@ -99,6 +99,12 @@ export const PICKER_ORDER_PRIORITY_BASE = 1_000;
 // independent of display order. It does not freeze native advertisements. Absent on unmoved rows.
 export const SPAWN_PRIORITY_FIELD = "opencodex_spawn_priority";
 
+// OpenCodex-private catalog field: this row is listed but currently unable to serve (#1711).
+// Codex ignores unknown catalog fields (same as opencodex_catalog_kind and the spawn priority
+// above) and ensureStrictCatalogFields does not strip extras, so this is invisible to the native
+// picker and cannot change what Codex offers. It never touches `visibility`.
+export const CATALOG_INACTIVE_REASON_FIELD = "opencodex_inactive_reason";
+
 export type SpawnAgentSurface = "v1" | "v2";
 
 export type SubagentRosterExclusionReason =
@@ -383,6 +389,10 @@ export function deriveEntry(
       if (model) applyCatalogMetadata(e, model.provider, model.id, model.contextCap);
       applyCatalogModelMetadata(e, model);
       if (model?.catalogKind) e.opencodex_catalog_kind = model.catalogKind;
+      // Additive only. `visibility` is untouched: an inactive row must still be OFFERED, which is
+      // the whole point of #1711 — operator disable is what removes rows, and it stays a separate
+      // path from this one.
+      if (model?.quotaInactiveReason) e[CATALOG_INACTIVE_REASON_FIELD] = model.quotaInactiveReason;
     } else {
       applyNativeOpenAiContextOverride(e, contextCap);
       if (isGpt56NativeSlug(slug)) ensureGpt56ReasoningLevels(e);
@@ -430,6 +440,10 @@ export function deriveEntry(
   if (model && isRouted) applyCatalogMetadata(entry, model.provider, model.id, model.contextCap);
   applyCatalogModelMetadata(entry, model);
   if (model?.catalogKind) entry.opencodex_catalog_kind = model.catalogKind;
+  // Same additive stamp as the templated path above. A routed row that reaches the no-template
+  // fallback is still a served row, so omitting it here would make the field depend on whether a
+  // template happened to be cached — which is exactly what the regression test caught.
+  if (model?.quotaInactiveReason) entry[CATALOG_INACTIVE_REASON_FIELD] = model.quotaInactiveReason;
   if (!isRouted) applyNativeOpenAiContextOverride(entry, contextCap);
   return ensureStrictCatalogFields(normalizeServiceTiers(entry), {
     preserveExactInputModalities: preserveExact,

src/combos/index.ts

@@ -27,9 +27,11 @@ export {
   noteComboSuccess,
   pickComboTarget,
   pickComboTargetWithWait,
+  quotaInactiveReason,
   tryPickComboModel,
   UnknownComboError,
   type ComboPick,
+  type QuotaInactiveReason,
 } from "./resolve";
 export {
   clearComboTargetCooldowns,

src/combos/resolve.ts

@@ -92,6 +92,58 @@ export function cachedProviderQuotaIsExhausted(
   return false;
 }
 
+/**
+ * Why a catalog row is offered but cannot currently serve a request (#1711).
+ *
+ * Only one reason exists today. It is a string rather than a boolean so a later cause — a
+ * cooldown, a revoked key — can be told apart by a consumer that already reads the field.
+ */
+export type QuotaInactiveReason = "no_credit";
+
+/**
+ * `"no_credit"` when every USABLE target of a catalog row has positive exhaustion evidence
+ * (#1711), otherwise undefined.
+ *
+ * This deliberately reuses the runtime rules in `targetProviderIsUsable` above rather than the
+ * Dashboard's `quotaStateFromReport`, which is harsher: it treats `remaining <= 0` as exhausted
+ * without requiring `percent >= 100` and ignores an elapsed `resetAt`. A catalog row marked
+ * inactive on the harsher rule would contradict the router, which would still happily send the
+ * request.
+ *
+ * Three rules carry the correctness, all inherited rather than restated:
+ *
+ * - A target the operator has removed or disabled is not usable and is not evidence either way;
+ *   it drops out before the vote. If nothing is left, the row is unavailable for an operator
+ *   reason rather than a quota one, so this returns undefined.
+ * - The canonical ChatGPT forward provider is exempt. Native account selection owns model-scoped
+ *   quota, and a provider-level summary cannot veto it.
+ * - A stale cache is NOT exhaustion. `getCachedProviderQuota` returns null past its 30-minute
+ *   window, and a null reading ends the vote rather than counting as evidence, so an unprobed
+ *   provider is never marked inactive.
+ *
+ * "Every" is the bar on purpose: one target that can still serve makes the row serviceable, which
+ * is exactly what the combo loop concludes at request time.
+ */
+export function quotaInactiveReason(
+  config: OcxConfig,
+  targets: readonly { provider: string }[],
+  now = Date.now(),
+): QuotaInactiveReason | undefined {
+  const usable = targets.filter(target => {
+    if (!Object.hasOwn(config.providers, target.provider)) return false;
+    const provider = config.providers[target.provider];
+    return !!provider && provider.disabled !== true;
+  });
+  if (usable.length === 0) return undefined;
+  for (const target of usable) {
+    const provider = config.providers[target.provider]!;
+    if (isCanonicalOpenAiForwardProvider(provider)) return undefined;
+    const quota = getCachedProviderQuota(target.provider, now);
+    if (!quota || !cachedProviderQuotaIsExhausted(quota, now)) return undefined;
+  }
+  return "no_credit";
+}
+
 function smoothWeightedIndex(
   targets: Required<OcxComboTarget>[],
   state: SelectionState,

src/server/management/model-rows.ts

@@ -147,10 +147,25 @@ export async function listManagementModelRows(
     };
   });
   const publicModels = uniqueCatalogModelsForPublicList(models);
+  // Custom rows below are REBUILT from config.customModels rather than spread from a
+  // CatalogModel, so every field gather computed for the same slug has to be carried across by
+  // hand. Without this a custom model whose provider is out of credit would be the one row on
+  // the page that never shows as inactive (#1711), because the gather-derived row it replaces
+  // is dropped by the slug dedup below.
+  const quotaInactiveByNamespaced = new Map(
+    publicModels
+      .filter(model => model.quotaInactiveReason !== undefined)
+      .map(model => [catalogModelSlug(model), model.quotaInactiveReason!] as const),
+  );
   const comboNamespaced = new Set(
     publicModels.filter(model => model.provider === "combo").map(catalogModelSlug),
   );
-  const visibleCustomModels = customModels.filter(model => !comboNamespaced.has(model.namespaced));
+  const visibleCustomModels = customModels
+    .filter(model => !comboNamespaced.has(model.namespaced))
+    .map(model => {
+      const quotaInactiveReason = quotaInactiveByNamespaced.get(model.namespaced);
+      return quotaInactiveReason ? { ...model, quotaInactiveReason } : model;
+    });
   // Custom metadata wins when a physical live/static row resolves to the same Codex-facing
   // slug, while a combo keeps the same precedence it has in routing and /v1/models.
   const customNamespaced = new Set(visibleCustomModels.map(c => c.namespaced));