diff --git a/docs-site/src/content/docs/fr/reference/adapters.md b/docs-site/src/content/docs/fr/reference/adapters.md
index 04ff6ccd44..eaa0971368 100644
--- a/docs-site/src/content/docs/fr/reference/adapters.md
+++ b/docs-site/src/content/docs/fr/reference/adapters.md
@@ -153,7 +153,7 @@ Si Kiro s’arrête sans appeler l’outil d’achèvement, l’adaptateur effec
 - Les modèles sont découverts par compte avec `GetCascadeModelConfigs` ; ceux qui ne figurent pas dans l'offre disparaissent de la liste au lieu d'échouer au moment de la requête.
 - Cognition impose une limite de longueur sur les descriptions d'outils et une liste de phrases interdites. L'adaptateur réécrit les formulations connues et tronque les descriptions trop longues.
 - Les clés ne se renouvellent pas. Relancez `ocx login devin` lorsqu'une clé expire ou est révoquée.
-- Seul l'identifiant est local quand l'import CLI est utilisé ; le tour part vers Cognition dans les deux cas. Un ancien build livrait sous l'id `devin-cli` un second adaptateur qui exécutait le tour comme une session Agent Client Protocol contre un processus enfant local `devin acp`. Il a été retiré : une configuration qui nomme encore cet adaptateur est réécrite vers `devin` au démarrage, y compris une ligne au nom personnalisé comme `"devin-acp"`.
+- Seul l'identifiant est local quand l'import CLI est utilisé ; le tour part vers Cognition dans les deux cas. Un ancien build livrait sous l'id `devin-cli` un second adaptateur qui exécutait le tour comme une session Agent Client Protocol contre un processus enfant local `devin acp`. Il a été retiré : la configuration canonique qui utilise encore l’id fournisseur `devin-cli` est migrée vers `devin` au démarrage. Une ligne au nom personnalisé comme `"devin-acp"` reste désactivée jusqu’à ce que vous sélectionniez explicitement l’adaptateur `devin` et configuriez l’authentification Devin.
 
 ## `azure-openai` (alias : `azure`)
 
diff --git a/docs-site/src/content/docs/ja/reference/adapters.md b/docs-site/src/content/docs/ja/reference/adapters.md
index f1276511b1..135f9cb6cd 100644
--- a/docs-site/src/content/docs/ja/reference/adapters.md
+++ b/docs-site/src/content/docs/ja/reference/adapters.md
@@ -184,7 +184,7 @@ model discovery の両方に適用されます。
 - `GetCascadeModelConfigs` でアカウントごとにモデルを取得し、プランに含まれないモデルはリクエスト時ではなく一覧の段階で外れます。
 - Cognition はツール説明の長さ制限と完全一致のブロックリストを課します。アダプターが既知の語句を書き換え、長すぎる説明を切り詰めます。
 - キーは更新されません。失効したら `ocx login devin` をやり直してください。
-- CLI インポート経路でもローカルなのは資格情報だけで、ターン自体はどちらの経路でも Cognition へ送られます。以前のビルドには `devin-cli` id で、ローカルの `devin acp` 子プロセスに対して Agent Client Protocol セッションとしてターンを実行する第2のアダプターがありましたが、削除されました。そのアダプターをまだ指す保存済み設定は起動時に `devin` へ書き換えられ、`"devin-acp"` のようなカスタム名の行も同様です。
+- CLI インポート経路でもローカルなのは資格情報だけで、ターン自体はどちらの経路でも Cognition へ送られます。以前のビルドには `devin-cli` id で、ローカルの `devin acp` 子プロセスに対して Agent Client Protocol セッションとしてターンを実行する第2のアダプターがありましたが、削除されました。従来の `devin-cli` プロバイダー id を使う標準設定は起動時に `devin` へ移行されます。`"devin-acp"` のようなカスタム名の行は、`devin` アダプターを明示的に選び Devin 認証を設定するまで無効のままです。
 
 ## `azure-openai`（別名: `azure`）
 
diff --git a/docs-site/src/content/docs/ko/reference/adapters.md b/docs-site/src/content/docs/ko/reference/adapters.md
index 83aeaf2dd3..3f9f04a8ad 100644
--- a/docs-site/src/content/docs/ko/reference/adapters.md
+++ b/docs-site/src/content/docs/ko/reference/adapters.md
@@ -219,7 +219,7 @@ discovery에 모두 적용됩니다.
 - `GetCascadeModelConfigs`로 계정별 모델을 조회하고, 플랜에 없는 모델은 요청 시점이 아니라 목록에서 걸러집니다.
 - Cognition은 도구 설명 길이 제한과 정확 문구 차단 목록을 적용합니다. 어댑터가 알려진 문구를 바꾸고 긴 설명을 잘라냅니다.
 - 키는 갱신되지 않습니다. 만료되거나 폐기되면 `ocx login devin`을 다시 실행하세요.
-- CLI 임포트 경로를 써도 로컬인 것은 자격뿐이며, 턴은 어느 경로든 Cognition으로 갑니다. 예전 빌드에는 `devin-cli` id 아래 로컬 `devin acp` 자식 프로세스에 Agent Client Protocol 세션으로 턴을 실행하는 두 번째 어댑터가 있었지만 제거됐습니다. 그 어댑터를 아직 가리키는 저장 설정은 스타트업에서 `devin`으로 리라이트되며, `"devin-acp"` 같은 커스텀 이름 행도 마찬가지입니다.
+- CLI 임포트 경로를 써도 로컬인 것은 자격뿐이며, 턴은 어느 경로든 Cognition으로 갑니다. 예전 빌드에는 `devin-cli` id 아래 로컬 `devin acp` 자식 프로세스에 Agent Client Protocol 세션으로 턴을 실행하는 두 번째 어댑터가 있었지만 제거됐습니다. 기존 `devin-cli` 공급자 id를 사용하는 표준 설정은 시작 시 `devin`으로 마이그레이션됩니다. `"devin-acp"` 같은 사용자 지정 이름 행은 `devin` 어댑터를 명시적으로 선택하고 Devin 인증을 구성할 때까지 비활성 상태로 유지됩니다.
 
 ## `azure-openai` (별칭: `azure`)
 
diff --git a/docs-site/src/content/docs/reference/adapters.md b/docs-site/src/content/docs/reference/adapters.md
index 1f480bc109..25093d9bd5 100644
--- a/docs-site/src/content/docs/reference/adapters.md
+++ b/docs-site/src/content/docs/reference/adapters.md
@@ -453,8 +453,9 @@ configuration that names the old id is rewritten at startup.
   `devin auth login` once, then add the provider.
 - An earlier build shipped a second adapter under the id `devin-cli` that ran the turn as an
   Agent Client Protocol session against a local `devin acp` child process. It is gone. A saved
-  configuration that still names that adapter is rewritten to `devin` at startup, including a
-  custom-named row such as `"devin-acp"`.
+  canonical configuration that still uses the `devin-cli` provider id is migrated to `devin` at
+  startup. A custom-named row such as `"devin-acp"` remains disabled until you explicitly select
+  the `devin` adapter and configure Devin authentication.
 - The chat request is calibrated, not guessed. Three things gate it together: the credential is the
   session token doubled and dash-joined in an `Authorization: Basic` header while the protobuf body
   keeps one copy, the request envelope goes up uncompressed, and `Metadata` #31 carries a
diff --git a/docs-site/src/content/docs/ru/reference/adapters.md b/docs-site/src/content/docs/ru/reference/adapters.md
index d2d1f53de9..11075fb0f4 100644
--- a/docs-site/src/content/docs/ru/reference/adapters.md
+++ b/docs-site/src/content/docs/ru/reference/adapters.md
@@ -244,7 +244,7 @@ authorization.
 - Модели запрашиваются для каждой учётной записи через `GetCascadeModelConfigs`; отсутствующие в тарифе отсеиваются в списке, а не падают в момент запроса.
 - Cognition ограничивает длину описаний инструментов и блокирует точные фразы. Адаптер переписывает известные формулировки и обрезает слишком длинные описания.
 - Ключи не обновляются. После истечения или отзыва выполните `ocx login devin` заново.
-- При импорте из CLI локальны только учётные данные — сам запрос в любом случае уходит в Cognition. В более ранней сборке под id `devin-cli` существовал второй адаптер, который выполнял ход как сеанс Agent Client Protocol с локальным дочерним процессом `devin acp`. Он удалён: сохранённая конфигурация, которая всё ещё ссылается на тот адаптер, переписывается на `devin` при запуске, включая строку с произвольным именем вроде `"devin-acp"`.
+- При импорте из CLI локальны только учётные данные — сам запрос в любом случае уходит в Cognition. В более ранней сборке под id `devin-cli` существовал второй адаптер, который выполнял ход как сеанс Agent Client Protocol с локальным дочерним процессом `devin acp`. Он удалён: каноническая конфигурация, всё ещё использующая id провайдера `devin-cli`, при запуске переносится на `devin`. Строка с произвольным именем вроде `"devin-acp"` остаётся отключённой, пока вы явно не выберете адаптер `devin` и не настроите аутентификацию Devin.
 
 ## `azure-openai` (алиас: `azure`)
 
diff --git a/docs-site/src/content/docs/tr/reference/adapters.md b/docs-site/src/content/docs/tr/reference/adapters.md
index 6167bfe6df..db7f0d3b97 100644
--- a/docs-site/src/content/docs/tr/reference/adapters.md
+++ b/docs-site/src/content/docs/tr/reference/adapters.md
@@ -317,7 +317,7 @@ başlığından Cursor OAuth/erişim belirteci.
 - Modeller hesaba göre `GetCascadeModelConfigs` ile keşfedilir; pakette olmayanlar istek anında hata vermek yerine listeden düşer.
 - Cognition araç açıklamaları için uzunluk sınırı ve birebir ifade engeli uygular. Bağdaştırıcı bilinen ifadeleri yeniden yazar, uzun açıklamaları kırpar.
 - Anahtarlar yenilenmez. Süresi dolduğunda veya iptal edildiğinde `ocx login devin` komutunu yeniden çalıştırın.
-- CLI içe aktarma yolu kullanıldığında yerel olan yalnızca kimlik bilgisidir; tur her iki yolda da Cognition'a gider. Önceki bir sürüm, `devin-cli` kimliği altında turu yerel bir `devin acp` alt sürecine karşı Agent Client Protocol oturumu olarak çalıştıran ikinci bir bağdaştırıcıyla geliyordu. Kaldırıldı: o bağdaştırıcıyı hâlâ adlandıran kayıtlı bir yapılandırma, `"devin-acp"` gibi özel adlı bir satır da dahil olmak üzere başlangıçta `devin`'e yeniden yazılır.
+- CLI içe aktarma yolu kullanıldığında yerel olan yalnızca kimlik bilgisidir; tur her iki yolda da Cognition'a gider. Önceki bir sürüm, `devin-cli` kimliği altında turu yerel bir `devin acp` alt sürecine karşı Agent Client Protocol oturumu olarak çalıştıran ikinci bir bağdaştırıcıyla geliyordu. Kaldırıldı: hâlâ `devin-cli` sağlayıcı kimliğini kullanan standart yapılandırma başlangıçta `devin`'e taşınır. `"devin-acp"` gibi özel adlı bir satır, `devin` bağdaştırıcısını açıkça seçip Devin kimlik doğrulamasını yapılandırana kadar devre dışı kalır.
 
 ## `azure-openai` (takma ad: `azure`)
 
diff --git a/docs-site/src/content/docs/zh-cn/reference/adapters.md b/docs-site/src/content/docs/zh-cn/reference/adapters.md
index e111743887..d850b0eed4 100644
--- a/docs-site/src/content/docs/zh-cn/reference/adapters.md
+++ b/docs-site/src/content/docs/zh-cn/reference/adapters.md
@@ -203,7 +203,7 @@ Cursor 的 HTTP/1.1 兼容传输：通过 `agent.v1.AgentService/RunSSE` 接收
 - 通过 `GetCascadeModelConfigs` 按账号获取模型；不在套餐内的模型在列表阶段就被过滤，而不是到请求时才失败。
 - Cognition 对工具说明有长度上限和精确短语黑名单。适配器会改写已知短语并截断过长的说明。
 - 密钥不会刷新。失效后请重新执行 `ocx login devin`。
-- 即使走 CLI 导入路径，本地的也只有凭据，请求本身无论哪条路径都发往 Cognition。早期版本曾在 `devin-cli` id 下提供第二个适配器，把请求作为对本地 `devin acp` 子进程的 Agent Client Protocol 会话来执行，现已移除。仍引用该适配器的已保存配置会在启动时重写为 `devin`，包括 `"devin-acp"` 这类自定义名称的行。
+- 即使走 CLI 导入路径，本地的也只有凭据，请求本身无论哪条路径都发往 Cognition。早期版本曾在 `devin-cli` id 下提供第二个适配器，把请求作为对本地 `devin acp` 子进程的 Agent Client Protocol 会话来执行，现已移除。仍使用 `devin-cli` 提供商 id 的规范配置会在启动时迁移到 `devin`。`"devin-acp"` 这类自定义名称的行会保持禁用，直到你明确选择 `devin` 适配器并配置 Devin 身份验证。
 
 ## `azure-openai`（别名：`azure`）
 
diff --git a/docs-site/src/content/docs/zh-tw/reference/adapters.md b/docs-site/src/content/docs/zh-tw/reference/adapters.md
index c155c8ae51..773174f807 100644
--- a/docs-site/src/content/docs/zh-tw/reference/adapters.md
+++ b/docs-site/src/content/docs/zh-tw/reference/adapters.md
@@ -175,7 +175,7 @@ Kiro 的 assistant 文字本身沒有可靠的回合結束標記，但終止的
 - 以 `GetCascadeModelConfigs` 依帳號取得模型；方案未涵蓋的模型在清單階段就被濾除。
 - Cognition 對工具說明設有長度上限與完全比對的封鎖清單。轉接器會改寫已知語句並截斷過長說明。
 - 金鑰不會更新。失效後請重新執行 `ocx login devin`。
-- 即使走 CLI 匯入路徑，本機的也只有憑證，請求本身無論哪條路徑都發往 Cognition。早期版本曾在 `devin-cli` id 下提供第二個轉接器，把請求作為對本機 `devin acp` 子行程的 Agent Client Protocol 工作階段來執行，現已移除。仍引用該轉接器的已儲存設定會在啟動時重寫為 `devin`，包括 `"devin-acp"` 這類自訂名稱的列。
+- 即使走 CLI 匯入路徑，本機的也只有憑證，請求本身無論哪條路徑都發往 Cognition。早期版本曾在 `devin-cli` id 下提供第二個轉接器，把請求作為對本機 `devin acp` 子行程的 Agent Client Protocol 工作階段來執行，現已移除。仍使用 `devin-cli` 提供者 id 的標準設定會在啟動時遷移至 `devin`。`"devin-acp"` 這類自訂名稱的列會維持停用，直到你明確選取 `devin` 轉接器並設定 Devin 驗證。
 
 ## `azure-openai`（別名：`azure`）
 
diff --git a/src/providers/devin-cli-authmode-migration.ts b/src/providers/devin-cli-authmode-migration.ts
index 8bb56d4641..d736aa9e30 100644
--- a/src/providers/devin-cli-authmode-migration.ts
+++ b/src/providers/devin-cli-authmode-migration.ts
@@ -12,14 +12,12 @@
  * key: the `devin-cli` registry entry is gone, so the PROVIDER_REGISTRY lookup
  * that gated the rewrite here could never fire again.
  *
- * The adapter repair must keep working for CUSTOM-NAMED rows. The ACP adapter
- * was removed, so `"devin-cli"` is not a constructible adapter id and
- * `createRegisteredAdapter` would throw `Unknown adapter: devin-cli`. The
- * canonical `devin` row gets its adapter pinned from the registry by
- * `routedProviderConfig`, but a row named e.g. `"devin-acp"` has nothing
- * pinning it and would fail every request. So every row naming the retired
- * adapter is rewritten to `devin`, whatever the row is called, and each
- * rewrite is reported.
+ * Custom-named rows fail closed. The retired ACP transport used the installed
+ * CLI's identity and ignored both configured and caller credentials, so
+ * silently changing one of those rows into a cloud provider could send a
+ * credential with different provenance to Cognition. The warning tells the
+ * operator to reconfigure it explicitly; retaining the unknown adapter id
+ * prevents requests from reaching any upstream in the meantime.
  *
  * A row carrying the retired ACP identity URL is repointed at the api-server
  * in the same pass. That URL was never a destination — it existed only so
@@ -55,10 +53,15 @@ export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProj
   const warnings: string[] = [];
   let changed = false;
 
-  // Every row, not only the registry id: a custom-named row had no registry pin,
-  // so after the ACP removal it is the one that cannot construct an adapter.
   for (const [name, row] of Object.entries(config.providers ?? {})) {
     if (!row || row.adapter !== RETIRED_ACP_ADAPTER) continue;
+    if (name !== RETIRED_ACP_ADAPTER) {
+      warnings.push(
+        `left custom provider "${name}" disabled because adapter ${RETIRED_ACP_ADAPTER} was removed: `
+        + "choose adapter devin and configure Devin authentication explicitly before using this provider.",
+      );
+      continue;
+    }
     row.adapter = "devin";
     changed = true;
     let detail = "";
diff --git a/structure/adapters/registry.md b/structure/adapters/registry.md
index 1952e3615f..e94ac50d0c 100644
--- a/structure/adapters/registry.md
+++ b/structure/adapters/registry.md
@@ -48,8 +48,9 @@ Some adapters share another adapter's routed-tool semantics while retaining inde
   credential turned out to be the ordinary cloud token, so the child process bought nothing that
   importing the token did not, and it cost a placeholder `buildRequest`, a disabled
   `parseStream`, an identity-only `baseUrl`, and a subprocess running in the operator's tree.
-  `projectDevinCliAuthMode` rewrites any saved row that still names the retired adapter id,
-  alongside the merge migration that retires the `devin-cli` provider id itself.
+  The merge migration rewrites the canonical `devin-cli` provider id. A custom-named row that
+  still names the retired adapter is left on that unknown id so requests fail closed until the
+  operator explicitly selects `devin` and configures Devin authentication.
 
 The registry records those relationships with `contractParent`. A parent relationship does **not** mean the registry recursively constructs a parent adapter and injects it into the child. Azure and MiMo keep owning their existing internal composition. This avoids making production constructors depend on test/conformance needs and keeps this authority refactor behavior-neutral.
 
diff --git a/tests/providers/devin-cli-authmode-migration.test.ts b/tests/providers/devin-cli-authmode-migration.test.ts
index 01f66a28cf..f8d3d8255a 100644
--- a/tests/providers/devin-cli-authmode-migration.test.ts
+++ b/tests/providers/devin-cli-authmode-migration.test.ts
@@ -12,7 +12,7 @@ describe("devin-cli retired-adapter migration", () => {
   // devin-provider-merge-migration.ts: the `devin-cli` registry entry is gone,
   // so the PROVIDER_REGISTRY lookup that gated the local -> oauth rewrite here
   // could never fire again. What remains is the adapter repair, which must
-  // keep working for custom-named rows that no registry pin protects.
+  // fail closed for custom-named rows that no registry pin protects.
 
   test("rewrites the registry-id row that still names the removed ACP adapter", () => {
     // The ACP adapter is gone, so the saved id is no longer constructible. The
@@ -25,20 +25,20 @@ describe("devin-cli retired-adapter migration", () => {
     expect(p.warnings.join(" ")).toContain("devin-cli -> devin");
   });
 
-  test("converts a custom-named ACP row, which no registry pin protects", () => {
-    // `devin-acp` was the documented escape hatch. Nothing pins a custom name,
-    // so after the removal this row is the one that would throw
-    // `Unknown adapter: devin-cli` on every request.
+  test("leaves a custom-named ACP row disabled pending explicit authentication", () => {
     const config = {
       providers: {
         "devin-acp": { adapter: "devin-cli", baseUrl: "https://cli.devin.ai" },
       },
     } as unknown as Parameters<typeof projectDevinCliAuthMode>[0];
     const p = projectDevinCliAuthMode(config);
-    expect(p.changed).toBe(true);
-    expect(p.config.providers!["devin-acp"]!.adapter).toBe("devin");
-    expect(p.config.providers!["devin-acp"]!.baseUrl).toBe("https://server.codeium.com");
-    expect(p.warnings.join(" ")).toContain("devin-acp");
+    expect(p.changed).toBe(false);
+    expect(p.config.providers!["devin-acp"]).toEqual({
+      adapter: "devin-cli",
+      baseUrl: "https://cli.devin.ai",
+    });
+    expect(p.warnings.join(" ")).toContain('left custom provider "devin-acp" disabled');
+    expect(p.warnings.join(" ")).toContain("configure Devin authentication explicitly");
   });
 
   test("leaves a non-ACP baseUrl alone while still retiring the adapter", () => {