fix(core): quarantine retired opencode-free model x-preview-f-free

[liuxiaocs7]

Summary

OpenCode Free offered Ox Alpha Free (x-preview-f-free) as a default-enabled, picker-visible free model, but the model has been retired upstream on OpenCode Zen — it is gone from the anonymous /models listing and every completion returns HTTP 401 {"type":"ModelError","message":"Model x-preview-f-free is not supported"} (verified live, 2026-08-30). models.dev still snapshots it as free + active, so the snapshot-derived free list (isFree && lifecycle !== 'deprecated' && functionCalling) kept offering a model that can no longer send.

This adds x-preview-f-free to OPENCODE_FREE_BROKEN_MODEL_IDS, the established deny-only quarantine. A single entry propagates through three existing paths: it is dropped from the opencodeFreeModelIds derivation (and thus from fallbackModels / defaultEnabledModelIds), filtered out of the picker catalog in buildConnectionModelCatalogEntries, and vetoed in authorizeConnectionModel so any stored selection cannot send. The dated comment records the removal condition: drop the entry once the models.dev snapshot marks it deprecated (or upstream serves it again).

A durable follow-up (out of scope here) is tracked in the issue: cross-check the derived free set against the live Zen /models listing at metadata-refresh time so retired-upstream models drop automatically instead of waiting on models.dev.

Fixes #4214

Verification

Ran locally against compiled dist/:

• New test in packages/core/src/__tests__/provider-catalog-contract.test.ts (opencode-free retired-model quarantine) — asserts x-preview-f-free is quarantined out of fallbackModels / defaultEnabledModelIds and that no broken id leaks back into the offered candidates. Fails without the change (the id is absent from brokenModelIds and present in the derived free list) and passes with it.
• packages/core: provider-catalog-contract (incl. the new tests) 11/11, plus llm-connections and model-catalog — all pass.
• packages/runtime-host: bootstrap-runtime-policy — 9/9 pass.
• packages/runtime: opencode-free-anonymous — 7/7 pass.
• @maka/core build (tsc) passes; the runtime invariant opencodeFreeModelIds[0] === OPENCODE_FREE_DEFAULT_MODEL still holds.
• biome check clean on both changed files (lint + format).
• Derived free list after the change: ['nemotron-3-ultra-free','big-pickle','hy3-free','mimo-v2.5-free','nemotron-3.5-lightning-free'] (was 6; x-preview-f-free removed). brokenModelIds = ['muse-spark-1.2-contributor-free','x-preview-f-free'].

Not run: full-repo typecheck / lint / knip across every workspace (change is isolated to @maka/core; the affected workspaces above build and test clean).

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code (Opus 4.8) — live-probed the OpenCode Zen endpoint to diagnose the retirement, wrote the quarantine change, its test, and the comment, and ran the verification above. The commit carries a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

[P2] Keep a quarantined stored default out of the model picker

buildConnectionModelCatalogEntries filters connection.models and enabledModelIds against brokenModelIds, but it still passes the raw connection.defaultModel into buildModelCatalogEntries. If an existing OpenCode Free connection has x-preview-f-free as its default—a reachable persisted state because this model was previously picker-visible—makeMissingDefaultEntry adds it back. On this exact head, a production-path probe through buildChatModelChoices still returns Ox Alpha Free (Unlimited) as an available default choice, while authorizeConnectionModel returns undefined for the same connection and model.

That leaves affected upgrade users seeing and selecting a model that the send authority refuses, so the quarantine does not yet cover the picker path claimed by the PR. The new tests only check the derived fallbackModels and defaultEnabledModelIds; they do not exercise a persisted broken default. Please filter the broken ID from the catalog's defaultModel source as well, and add a regression through buildChatModelChoices with the retired ID present as the stored default, enabled model, and inventory row.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.