fix(inference): keep retired-model 404s fatal when they say expired

The 'expired' credential-404 marker misfires on model-deprecation 404s
("model 'gpt-4o' has expired - migrate ..."): reclassifying those as
credential_failure would send the operator to log in again for a model
that no longer exists. Add a deprecation veto (model mention plus
retirement signal) that runs before the auth markers, with a keeper
test. Drop the cross-lane refresh-failed terminal test: that input
shape is owned by #1139 (CL-8628), which covers the same dedup in
runner/refresh-lock tests.

Author: TheGreatAxios

src/inference-error-message.test.ts

@@ -194,21 +194,6 @@ describe("terminalProviderFailureMessage", () => {
     expect(message.toLowerCase()).not.toMatch(/log in again/);
   });
 
-  test("terminal Codex refresh-failed auth error renders one re-login hint", () => {
-    // Joint surface with #1139 (CL-8628 refresh serialization): both lanes
-    // land credential failures in the CodexAuthError copy shape, and the
-    // terminal dedup must swallow the generic hint for either source.
-    const message = terminalProviderFailureMessage("codex/work", {
-      category: "credential_failure",
-      message:
-        'Codex profile "work" could not be refreshed (invalid_grant). Log in again.',
-      statusCode: 401,
-      providerId: "codex/work",
-    });
-    expect(message).toContain('Codex profile "work"');
-    expect(message.toLowerCase().match(/log in again/g)).toHaveLength(1);
-  });
-
   test("terminal genuine unknown-model 404 keeps switch-models guidance", () => {
     const message = terminalProviderFailureMessage("codex/work", {
       category: "fatal",

src/inference-gateway-error.test.ts

@@ -390,6 +390,27 @@ describe("normalizeInferenceErrorForRetry", () => {
     expect(normalizeInferenceErrorForRetry(error)).toBe(error);
   });
 
+  test("Codex model-deprecation 404 containing 'expired' stays fatal", () => {
+    // Keeper: a retired model names itself with the credential marker word,
+    // but logging in again cannot resurrect it — the fatal switch-models
+    // path must win over the expired-credential reclassification.
+    const error = {
+      category: "fatal" as const,
+      message:
+        "The model 'gpt-4o' has expired. Migrate to 'gpt-5' to continue.",
+      statusCode: 404,
+      providerId: "codex/work",
+      raw: {
+        error: {
+          code: "model_expired",
+          message: "The model 'gpt-4o' has expired (2025-02-01).",
+          type: "invalid_request_error",
+        },
+      },
+    };
+    expect(normalizeInferenceErrorForRetry(error)).toBe(error);
+  });
+
   test("non-Codex 404 keeps fatal switch-models guidance", () => {
     const error = {
       category: "fatal" as const,

src/inference-gateway-error.ts

@@ -544,6 +544,38 @@ function hasCodexCredentialAuthSignal(error: InferenceErrorLike): boolean {
   );
 }
 
+/**
+ * Model-deprecation signals that veto the credential-404 classifier. A
+ * retired-model 404 can itself carry the word "expired" ("model 'gpt-4o'
+ * has expired — migrate to 'gpt-5'"), and reclassifying it as
+ * credential_failure would send the operator to log in again for a model
+ * that no longer exists. The veto needs a model mention plus a deprecation
+ * signal so bare credential texts ("the access token expired") still
+ * reclassify.
+ */
+const CODEX_MODEL_DEPRECATION_MARKERS = [
+  "model_expired",
+  "model_deprecated",
+  "deprecated",
+  "deprecation",
+  "retired",
+  "sunset",
+  "no longer supported",
+  "no longer available",
+  "has expired",
+  "end of life",
+] as const;
+
+function looksLikeCodexModelDeprecation(error: InferenceErrorLike): boolean {
+  const combined = [error.message ?? "", stringFromRaw(error.raw)]
+    .join("\n")
+    .toLowerCase();
+  if (!combined.includes("model")) return false;
+  return CODEX_MODEL_DEPRECATION_MARKERS.some((marker) =>
+    combined.includes(marker),
+  );
+}
+
 /**
  * Single shared predicate behind the Codex credential-404 re-login copy: the
  * classifier brands with it (formatCodexCredential404Message) and the
@@ -607,7 +639,8 @@ function recordCodexCredential404Reclassification(
  * re-login copy matches the CodexAuthError shape so the TUI names the
  * affected profile through its existing auth matchers; the original
  * diagnostic rides along in parens so the model name stays debuggable.
- * Anything without an auth signal keeps the fatal switch-models path.
+ * Anything without an auth signal keeps the fatal switch-models path, as
+ * does a model-deprecation 404 even when it carries the word "expired".
  */
 function normalizeCodexCredential404Error(
   error: InferenceErrorWithGoContext,
@@ -617,6 +650,10 @@ function normalizeCodexCredential404Error(
   const providerId = error.providerId;
   if (providerId === undefined || !isCodexProviderName(providerId))
     return error;
+  // A retired model is a fatal switch-models failure, never a credential
+  // failure: the veto runs before the auth markers so deprecation wins over
+  // a merely expired-sounding word.
+  if (looksLikeCodexModelDeprecation(error)) return error;
   if (!hasCodexCredentialAuthSignal(error)) return error;
   const profile = codexProfileFromProviderName(providerId) ?? providerId;
   const message = formatCodexCredential404Message(profile, error.message ?? "");