[Bug]: Grok refresh restores removed gateway models from cache

[NOirBRight]

Before submitting

• I searched existing issues and did not find a duplicate for Grok model removal.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Connect Grok CLI to a third-party model gateway (CodexHub in this case) and let T3 discover its additional model IDs.
2. Disconnect Grok CLI from that gateway and restore the official Grok configuration.
3. Confirm grok models and grok agent stdio ACP initialize._meta.modelState.availableModels no longer contain the gateway models.
4. Refresh provider status in T3 and inspect the Grok model list in Settings or the model picker.

Expected behavior

A successful, complete Grok model discovery replaces the previously discovered inventory. Removed gateway models disappear from the client and persisted cache. Explicit custom models continue to follow current T3 settings; failed or incomplete discovery can retain the last known inventory.

Actual behavior

T3 still lists the disconnected gateway's models. This is a server inventory merge problem, not evidence that Grok CLI is still routed through the gateway.

Read-only verification on this machine:

• Grok's config.toml no longer contains CodexHub references.
• T3's Grok instance has no custom models or instance environment overrides.
• Both grok models and ACP initialize return exactly grok-4.7, grok-4.7-build-fast, grok-4.6, and grok-4.5.
• T3's persisted Grok snapshot still contains 17 rows: the four current models, the old grok-build fallback, and 12 codexhub-* rows. The stale rows have isCustom: false because they were discovered from the CLI.
• Running the actual mergeProviderModels function with that previous snapshot and the four freshly advertised models reproduces 17 merged rows, including all 12 removed gateway models, even with status: "ready" and authenticated/installed state.

Diagnosis and minimal reproduction

On current main, shouldRetainMissingProviderModels returns true unconditionally for Grok. mergeProviderModels then appends every previous non-custom model absent from the new list.

The Grok probe itself already receives the correct current list; it is the shared registry merge that restores removed rows.

A minimal regression case at the exported mergeProviderSnapshot seam:

const fresh = {
  instanceId: ProviderInstanceId.make("grok"),
  driver: ProviderDriverKind.make("grok"),
  enabled: true,
  installed: true,
  status: "ready",
  auth: { status: "authenticated" },
  version: "1.0.44",
  checkedAt: "2026-09-30T00:00:00.000Z",
  models: [{ slug: "grok-4.7", name: "Grok 4.7", isCustom: false }],
} satisfies ServerProvider;
const previous = {
  ...fresh,
  models: [
    ...fresh.models,
    { slug: "codexhub-removed-model", name: "Removed gateway model", isCustom: false },
  ],
};
// Expected only grok-4.7; current code returns both rows.
expect(mergeProviderSnapshot(previous, fresh).models.map((m) => m.slug))
  .toEqual(["grok-4.7"]);

This affects the shared server inventory consumed by web, desktop, and mobile. A frontend-only filter would leave stale persisted entries behind.

Impact

Minor bug or occasional failure. The model picker advertises models that the current Grok configuration no longer exposes.

Version or commit

Source diagnosis and reproduction: main @ 0fcd5f90611451cca842689faea53b5450c022da (also checked against upstream main on 2026-09-30). This SHA describes the investigated source, not an asserted build SHA of the installed desktop app.

Environment

Linux; Grok CLI 1.0.44 (5b807183dd79) [stable]; Node v26.10.0; official Grok account; previously connected through CodexHub.

Related work

• fix(server): remove retired Codex models after refresh #9773 merged the same removal semantics for Codex only.
• fix(server): stop restoring stale OpenCode models #4095 merged the analogous fix for OpenCode only.
• fix(server): keep provider inventories consistent after refresh #10292 proposed broader inventory consistency, but was closed without merging.

Current main still excludes Grok from successful-discovery replacement. I did not find a Grok-specific issue or an active fix for this path.

Workaround

No cache deletion or live state changes were attempted. Ordinary refresh still restores removed models through the merge logic.

Investigated and filed with GPT-6.1 Sol through the Codex harness in T3 Code.