diff --git a/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx b/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
index eeea715829..cb18fc67eb 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
@@ -54,8 +54,12 @@ function ConfigurationFieldControl({ copy, field, id, onChange, value, timezone
     );
   }
   const numeric = field.input_kind === "number";
+  // Models the shipped executors run: the Codex models of the interactive
+  // endpoint and the managed host's DeepSeek default, which is the canonical
+  // `deepseek-flash` id of DeepSeek-V4.1-Flash. Suggestions only: the field
+  // stays free text so an operator can name any id their endpoint serves.
   const modelSuggestions = field.key === "executor_model"
-    ? ["gpt-6-sol", "gpt-6-luna", "gpt-6-astra"] : [];
+    ? ["gpt-6-sol", "gpt-6-luna", "gpt-6-astra", "deepseek-flash", "deepseek-v4-pro"] : [];
   return (
     <label htmlFor={id}>
       <span>{label}</span>
diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
index 6da67d9593..d0c3962c64 100644
--- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
+++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
@@ -105,8 +105,8 @@ Both reuse the same Turn host adapters; neither changes the steward default.
 
 A managed host binding names four things: the host adapter, the provider, the
 model, and where the credential comes from. The DSH binding is the DSH Turn host
-with provider `deepseek-official`, model `deepseek-v4-flash` (DeepSeek V4.1
-Flash) at reasoning effort `high`, an endpoint from the operator environment
+with provider `deepseek-official`, model `deepseek-flash` (DeepSeek-V4.1-Flash)
+at reasoning effort `high`, an endpoint from the operator environment
 (`DEEPSEEK_BASE_URL`) and a credential from the operator environment
 (`DEEPSEEK_API_KEY`).
 
@@ -161,11 +161,11 @@ the channel Session on the endpoint the machine now selects.
 
 Both managed surfaces resolve their **execution profile** from one owner
 (`loopx/control_plane/turn_driver/execution_profile.py`): provider
-`deepseek-official`, model `deepseek-v4-flash` (DeepSeek V4.1 Flash) and reasoning
+`deepseek-official`, model `deepseek-flash` (DeepSeek-V4.1-Flash) and reasoning
 effort `high`, overridable by `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` /
 `LOOPX_TURN_REASONING_EFFORT` and, at lower precedence, the legacy `DSH_PROVIDER`
 / `DSH_MODEL`. The readback is one line, `execution_profile`, shaped
-`deepseek-v4-flash@high` in the shipped case, with the provider prepended only
+`deepseek-flash@high` in the shipped case, with the provider prepended only
 when it is not the shipped one; it is one line because every plan payload carries
 it and the agent-facing output budget is a contract, and whichever values the
 line names are the values that run, so an owner-set model appears as itself.
@@ -173,6 +173,13 @@ Credentials authenticate the selected profile and never choose it; the one
 thing a credential resolves is the shipped *host* default of a bounded Turn
 nobody selected, and that resolution carries its own readback source.
 
+**Revision (2026-10-04):** the shipped model default moved from the retired
+`deepseek-v4-flash` spelling to the canonical `deepseek-flash` id of the same
+DeepSeek-V4.1-Flash generation. The retired spelling is still accepted by the
+vendor endpoint and remains available as an explicit `LOOPX_TURN_MODEL` /
+`DSH_MODEL` override, so a host that pins it is a configuration change rather
+than a code change.
+
 Evidence for this binding, separated by source:
 
 - repository-covered without any provider call: with an operator credential the
diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
index 0e78cb7989..988acfae92 100644
--- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
+++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
@@ -84,8 +84,8 @@ canonical 完成仍是不同事实；本切片不提供动态派生授权或另
 ### 托管宿主绑定与真实环境验证（2026-09-15）
 
 一个托管宿主绑定要说明四件事：宿主适配器、provider、模型，以及凭据来自哪里。
-DSH 绑定是 DSH Turn 宿主 + provider `deepseek-official` + 模型 `deepseek-v4-flash`
-（DeepSeek V4.1 Flash）+ 推理档位 `high`，端点取自运维方环境（`DEEPSEEK_BASE_URL`），
+DSH 绑定是 DSH Turn 宿主 + provider `deepseek-official` + 模型 `deepseek-flash`
+（DeepSeek-V4.1-Flash）+ 推理档位 `high`，端点取自运维方环境（`DEEPSEEK_BASE_URL`），
 凭据取自运维方环境（`DEEPSEEK_API_KEY`）。
 
 LoopX **选择**托管有界 Turn 的默认宿主，而从不由启动时的意外推断
@@ -123,15 +123,20 @@ LoopX **选择**托管有界 Turn 的默认宿主，而从不由启动时的意
 
 两个托管面从同一个所有者解析**执行档位**
 （`loopx/control_plane/turn_driver/execution_profile.py`）：provider
-`deepseek-official`、模型 `deepseek-v4-flash`（DeepSeek V4.1 Flash）、推理档位
+`deepseek-official`、模型 `deepseek-flash`（DeepSeek-V4.1-Flash）、推理档位
 `high`，可由 `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` /
 `LOOPX_TURN_REASONING_EFFORT` 覆盖，更低优先级为历史变量 `DSH_PROVIDER` /
-`DSH_MODEL`。回读是一行 `execution_profile`：出货形态为 `deepseek-v4-flash@high`，
+`DSH_MODEL`。回读是一行 `execution_profile`：出货形态为 `deepseek-flash@high`，
 仅当 provider 不是出货值时前置为 `<provider>/…`。之所以只有一行，是因为每个 plan
 载荷都携带它，而面向 agent 的输出预算是一份契约；该行写出什么值，就是实际会跑的值，
 因此 owner 自己设定的模型会以自身出现。凭据为选定档位提供认证，从不参与选型；凭据
 唯一解析的是"无人显式选择时有界 Turn 的出货宿主默认值"，且该解析自带来源回读。
 
+**修订（2026-10-04）：** 出货模型默认值由已退役的 `deepseek-v4-flash` 拼写改为同一
+DeepSeek-V4.1-Flash 世代的正式 ID `deepseek-flash`。该退役拼写仍被厂商端点接受，
+并继续作为显式 `LOOPX_TURN_MODEL` / `DSH_MODEL` 覆盖可用，因此仍固定旧拼写的宿主
+属于配置变更，而不是代码变更。
+
 该绑定的证据按来源区分：
 
 - 仓库覆盖、无需任何 provider 调用：配置了运维方凭据时出货默认值是 `dsh`，没有时
diff --git a/docs/integrations/deepseek-harness-connector.md b/docs/integrations/deepseek-harness-connector.md
index 1048239b7e..416c4bed5f 100644
--- a/docs/integrations/deepseek-harness-connector.md
+++ b/docs/integrations/deepseek-harness-connector.md
@@ -96,7 +96,7 @@ loopx turn run-once \
   --host generic-cli \
   --execution-mode isolated-headless \
   --project "$PWD" \
-  --host-adapter-command-json '["python3", "-m", "loopx.dsh_goal_mode", "--dsh-home", "/path/to/dsh-home", "--cordis", "/path/to/cordis.yml", "--model", "deepseek-v4-flash"]' \
+  --host-adapter-command-json '["python3", "-m", "loopx.dsh_goal_mode", "--dsh-home", "/path/to/dsh-home", "--cordis", "/path/to/cordis.yml", "--model", "deepseek-flash"]' \
   --validation-command-json '["python3", "/path/to/verify-postcondition.py"]' \
   --execute
 ```
@@ -159,7 +159,7 @@ loopx turn run-once \
   --project "$PWD" \
   --dsh-home /path/to/dsh-home \
   --dsh-cordis /path/to/cordis.yml \
-  --dsh-model deepseek-v4-flash \
+  --dsh-model deepseek-flash \
   --validation-command-json '["python3", "/path/to/verify-postcondition.py"]' \
   --execute
 ```
@@ -183,7 +183,8 @@ credential authenticates it, and `codex-cli` is the default when no credential i
 configured, because an unauthenticated managed host would refuse to run.
 
 What runs on that host is a separate resolution. The managed execution profile
-defaults to `deepseek-official` / `deepseek-v4-flash` / `high`, overridden by
+defaults to `deepseek-official` / `deepseek-flash` / `high`, the canonical
+DeepSeek-V4.1-Flash id, overridden by
 `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` / `LOOPX_TURN_REASONING_EFFORT` and, at
 lower precedence, by the legacy `DSH_PROVIDER` / `DSH_MODEL`; an explicit
 `--dsh-provider` / `--dsh-model` / `--dsh-reasoning-effort` wins over both. The
@@ -211,7 +212,7 @@ host id:
   "credential_env": "DEEPSEEK_API_KEY",
   "endpoint_env": "DEEPSEEK_BASE_URL",
   "operator_credential_bound": true,
-  "execution_profile": "deepseek-v4-flash@high",
+  "execution_profile": "deepseek-flash@high",
   "output_token_budget": {
     "schema_version": "dsh_output_token_budget_v0",
     "scope": "per_model_request",
@@ -235,7 +236,7 @@ configured. `available` is `false` only when LoopX can prove the planned host
 cannot launch here, and `null` for executors this projection does not probe
 rather than an unproven claim. Only the credential variable *name* is reported;
 the value is never read back. `execution_profile` is the resolved profile as one
-line, `deepseek-v4-flash@high` in the shipped shape, with the provider prepended
+line, `deepseek-flash@high` in the shipped shape, with the provider prepended
 only when it is not the shipped one -- it is one line because every plan carries
 it, and the agent-facing output budget is a contract.
 
diff --git a/docs/reference/operator-model-credential.md b/docs/reference/operator-model-credential.md
index e75f7e00f1..10b124c4e2 100644
--- a/docs/reference/operator-model-credential.md
+++ b/docs/reference/operator-model-credential.md
@@ -171,7 +171,7 @@ Every entry point publishes the same readback, so a reader never has to infer
 the host from the name it resolved: `/api/chat/capabilities` reports the
 steward's `executor_endpoint`, its `executor_endpoint_source`
 (`machine_configuration`, `explicit_config` or `product_default`), the
-`execution_profile` (`deepseek-v4-flash@high` on the shipped managed profile),
+`execution_profile` (`deepseek-flash@high` on the shipped managed profile),
 `available`, the selection policy and allocation reason, and the bound
 Session's `session_mode` and `session_status`. The Session persists its chosen
 endpoint, model, effort, policy, pool and source revision, so later configuration
diff --git a/docs/reference/protocols/loopx-turn-v0.md b/docs/reference/protocols/loopx-turn-v0.md
index 7b28e209ce..b15425347c 100644
--- a/docs/reference/protocols/loopx-turn-v0.md
+++ b/docs/reference/protocols/loopx-turn-v0.md
@@ -133,11 +133,11 @@ then the product default.
 | execution profile field | product default | operator override | legacy lower-precedence override |
 | --- | --- | --- | --- |
 | provider | `deepseek-official` | `LOOPX_TURN_PROVIDER` | `DSH_PROVIDER` |
-| model | `deepseek-v4-flash` | `LOOPX_TURN_MODEL` | `DSH_MODEL` |
+| model | `deepseek-flash` | `LOOPX_TURN_MODEL` | `DSH_MODEL` |
 | reasoning effort | `high` | `LOOPX_TURN_REASONING_EFFORT` | — |
 
 The managed `managed_executor` readback reports the resolved profile as one line,
-`<model>@<reasoning_effort>` (the shipped shape is `deepseek-v4-flash@high`).
+`<model>@<reasoning_effort>` (the shipped shape is `deepseek-flash@high`).
 The provider is prepended as `<provider>/…` only when the resolved provider is
 not the shipped one, because dropping it for a deviating provider would make the
 line claim a profile the Turn would not use. Whichever values the line names are
diff --git a/docs/reference/protocols/manager-evidence-and-continuity-v0.md b/docs/reference/protocols/manager-evidence-and-continuity-v0.md
index f86b43139f..41b6b270c3 100644
--- a/docs/reference/protocols/manager-evidence-and-continuity-v0.md
+++ b/docs/reference/protocols/manager-evidence-and-continuity-v0.md
@@ -84,7 +84,7 @@ frontend projection; explicitly choosing status-only still uses that projection.
 The manager channel's model and reasoning effort follow its executor. On the
 interactive CLI endpoint the defaults are `gpt-6-astra` with `high` reasoning; on
 the managed host they are the managed execution profile
-(`deepseek-official` / `deepseek-v4-flash` / `high`). The machine's
+(`deepseek-official` / `deepseek-flash` / `high`). The machine's
 `steward_executor` machine configuration decides the executor, the model and the
 effort first; set `LOOPX_MANAGER_MODEL` and `LOOPX_MANAGER_REASONING_EFFORT` on
 the Chat service when a machine has no such configuration, and the shipped
@@ -95,7 +95,7 @@ is unchanged. Capabilities expose the manager defaults, their source, and the
 status and revision of the machine document they were read from.
 
 The managed profile reaches the channel as the same one-line readback the
-governed Turn publishes (`deepseek-v4-flash@high`), so the channel and the
+governed Turn publishes (`deepseek-flash@high`), so the channel and the
 bounded Turns it drives cannot report two different managed profiles; the
 provider is prepended when it is not the shipped one.
 
diff --git a/examples/loopx-managed-turn-operator-flow-smoke.py b/examples/loopx-managed-turn-operator-flow-smoke.py
index b3badaad28..c8760c294c 100644
--- a/examples/loopx-managed-turn-operator-flow-smoke.py
+++ b/examples/loopx-managed-turn-operator-flow-smoke.py
@@ -88,7 +88,7 @@ def main() -> None:
         )
         if planned.get("available") is not True:
             fail(f"a stored credential must make the managed host launchable: {planned}")
-        if planned.get("execution_profile") != "deepseek-v4-flash@high":
+        if planned.get("execution_profile") != "deepseek-flash@high":
             fail(f"the planned profile must be projected: {planned}")
 
         channel = manager_channel_binding(
diff --git a/examples/loopx-steward-channel-binding-smoke.py b/examples/loopx-steward-channel-binding-smoke.py
index 9854f3db06..b0577d30c8 100644
--- a/examples/loopx-steward-channel-binding-smoke.py
+++ b/examples/loopx-steward-channel-binding-smoke.py
@@ -121,9 +121,9 @@ def _assert_selection_moves_the_channel_to_the_managed_host() -> dict[str, objec
         "an explicit endpoint selection must be the only way onto the managed host",
     )
     _assert(
-        selected["model"] == "deepseek-v4-flash"
+        selected["model"] == "deepseek-flash"
         and selected["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
-        and selected["execution_profile"] == "deepseek-v4-flash@high",
+        and selected["execution_profile"] == "deepseek-flash@high",
         "the managed endpoint must run the managed execution profile",
     )
     _assert(
@@ -370,7 +370,7 @@ def _assert_the_machine_default_is_first_class() -> dict[str, object]:
             _assert(
                 binding["model"] == "deepseek-v4-flash"
                 and binding["model_source"] == MANAGER_MODEL_SOURCE_MACHINE_CONFIGURATION
-                and binding["execution_profile"] == "deepseek-v4-flash@high",
+                and binding["execution_profile"] == "deepseek-flash@high",
                 "the model and the effort must follow the machine selection",
             )
             _assert(
diff --git a/examples/loopx-steward-managed-chat-smoke.py b/examples/loopx-steward-managed-chat-smoke.py
index 5c4b4361bb..0903dfb51c 100644
--- a/examples/loopx-steward-managed-chat-smoke.py
+++ b/examples/loopx-steward-managed-chat-smoke.py
@@ -237,9 +237,9 @@ def _run_turn(args: argparse.Namespace) -> int:
         "the managed host must be reached by selection, not by discovering a credential",
     )
     _assert(
-        binding["model"] == "deepseek-v4-flash"
+        binding["model"] == "deepseek-flash"
         and binding["model_source"] == "managed_execution_profile"
-        and binding["execution_profile"] == "deepseek-v4-flash@high",
+        and binding["execution_profile"] == "deepseek-flash@high",
         "the channel must run the managed execution profile",
     )
 
diff --git a/examples/managed-research-team/README.md b/examples/managed-research-team/README.md
index d04a5e2c38..ee86d21a1b 100644
--- a/examples/managed-research-team/README.md
+++ b/examples/managed-research-team/README.md
@@ -26,8 +26,9 @@ uv pip install --python .venv/bin/python -e packages/loopx-ark-turn
 Set `ARK_API_KEY`, `ARK_MODEL_ID` and `ARK_ENVIRONMENT_ID` in the process
 environment. DSH reuses the machine operator credential; `DEEPSEEK_API_KEY`
 is an explicit environment override. The Ark Environment must already belong to the operator;
-this launcher never creates or deletes it. The local model defaults to
-`deepseek-v4-flash@high`; select another profile with `--dsh-model`.
+this launcher never creates or deletes it. The local model defaults to the
+managed profile `deepseek-flash@high` (DeepSeek-V4.1-Flash); select another
+profile with `--dsh-model`.
 
 Choose a **new private disposable directory**. Never point this example at an
 active Goal or research workspace. The canonical Goal quota governs admission;
diff --git a/loopx/control_plane/turn_driver/execution_profile.py b/loopx/control_plane/turn_driver/execution_profile.py
index cb705c82d6..ec746b34dd 100644
--- a/loopx/control_plane/turn_driver/execution_profile.py
+++ b/loopx/control_plane/turn_driver/execution_profile.py
@@ -28,7 +28,10 @@
 # decision recorded once; the environment can override a field, but nothing is
 # discovered and no credential participates in the choice.
 MANAGED_PROVIDER_DEFAULT = "deepseek-official"
-MANAGED_MODEL_DEFAULT = "deepseek-v4-flash"
+# The canonical id of DeepSeek-V4.1-Flash. The retired ``deepseek-v4-flash``
+# spelling is still accepted by the vendor endpoint and remains available as an
+# explicit override, but no shipped surface may name a retired id by default.
+MANAGED_MODEL_DEFAULT = "deepseek-flash"
 MANAGED_REASONING_EFFORT_DEFAULT = "high"
 
 PROVIDER_ENV_VAR = "LOOPX_TURN_PROVIDER"
diff --git a/loopx/dsh_goal_mode/README.md b/loopx/dsh_goal_mode/README.md
index 4348896322..beccbde1bc 100644
--- a/loopx/dsh_goal_mode/README.md
+++ b/loopx/dsh_goal_mode/README.md
@@ -28,7 +28,7 @@ The `deepseek-harness` host surface (aliases: `deepseek_harness`,
 ```bash
 python -m loopx.dsh_goal_mode \
   --cordis /path/to/cordis.yml \
-  --model deepseek-v4-flash \
+  --model deepseek-flash \
   --provider deepseek-official
 ```
 
@@ -128,7 +128,7 @@ SDK 以 `finish_reason=max-tokens` 结束时，内置 host 会产生不可自动
   settings for the real runtime.
 - Provider, model and reasoning effort come from the managed execution profile
   (`loopx/control_plane/turn_driver/execution_profile.py`): product defaults
-  `deepseek-official` / `deepseek-v4-flash` / `high`, overridden by
+  `deepseek-official` / `deepseek-flash` / `high`, overridden by
   `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` / `LOOPX_TURN_REASONING_EFFORT` and,
   at lower precedence, by the legacy `DSH_PROVIDER` / `DSH_MODEL`. An explicit CLI
   value wins over both, and the resolved profile reports its own source. A
diff --git a/packages/loopx-codex-provider-routing/RUNBOOK.md b/packages/loopx-codex-provider-routing/RUNBOOK.md
index d244a31dcd..63e5f00f90 100644
--- a/packages/loopx-codex-provider-routing/RUNBOOK.md
+++ b/packages/loopx-codex-provider-routing/RUNBOOK.md
@@ -177,7 +177,7 @@ flowchart LR
   CPA --> A[Codex subscription A]
   CPA --> B[Codex subscription B]
   CPA -. future expansion .-> C[Codex subscription C<br/>reserved, not configured]
-  CPA --> Ark[Ark DeepSeek V4 Flash]
+  CPA --> Ark[Ark DeepSeek V4.1 Flash]
   CCS[CC Switch<br/>bootstrap / rollback] -. credentials and profiles .-> CPA
   Home -. explicit stale-task migration .-> Swap[AgentSwap<br/>offline sidecar]
   Swap -. new native session .-> Quarantine[隔离 target task]
@@ -205,7 +205,7 @@ flowchart LR
 | `fast/codex-b/gpt-5.6-sol` | Prefer B：B → A；不落 Ark | `text, image` | Fast，强制 `priority` |
 | [`gpt-5.6-luna`](https://developers.openai.com/codex/models) | Luna；复用同一个 A/B 账号环，只在 Codex A/B 间路由，不异构降级到 Ark | `text, image`；推理档位为 `low` 至 `max`，不声明 `ultra` | Standard；不生成重复 Fast alias |
 | `codex-c/gpt-5.6-sol` | 预留；只有第三个订阅真实接入并通过矩阵后才暴露 | 由真实 credential 决定 | 不预声明 |
-| `ark/deepseek-v4-flash` | 手动固定到 Ark DeepSeek V4 Flash | `text` | 不支持 |
+| `ark/deepseek-v4-flash` | 手动固定到 Ark DeepSeek V4.1 Flash（上游 ID 由 operator 配置决定） | `text` | 不支持 |
 | `gpt-5.6-sol` | 隐藏 compatibility alias；处理 App / host 继承裸 model metadata 的旧 task，实际行为与 Auto 一致 | `text, image` | 可选，默认关闭 |
 
 模型 ID 是路由契约，不是上游真实 model slug。显示名可本地化，但 ID 一经上线应保持稳定，
@@ -465,7 +465,7 @@ openai-compatibility:
     models:
       - name: "<ARK_DEEPSEEK_V4_FLASH_ENDPOINT_ID>"
         alias: "deepseek-v4-flash"
-        display-name: "Ark DeepSeek V4 Flash"
+        display-name: "Ark DeepSeek V4.1 Flash"
         is-compat: true
         input-modalities: [text]
         output-modalities: [text]
diff --git a/packages/loopx-codex-provider-routing/examples/request.json b/packages/loopx-codex-provider-routing/examples/request.json
index fcb2c2d96d..b7cd825c7b 100644
--- a/packages/loopx-codex-provider-routing/examples/request.json
+++ b/packages/loopx-codex-provider-routing/examples/request.json
@@ -160,7 +160,7 @@
         "candidates": [
           "ark-text"
         ],
-        "display_name": "Ark · DeepSeek V4 Flash",
+        "display_name": "Ark · DeepSeek V4.1 Flash",
         "input_modalities": [
           "text"
         ],
diff --git a/packages/loopx-codex-provider-routing/smoke/operator_smoke.py b/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
index 8afb4c8f76..1747b3e13b 100644
--- a/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
+++ b/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
@@ -11,7 +11,7 @@
 from unittest.mock import patch
 
 from loopx_codex_provider_routing.operator import rollback, run, snapshot
-from loopx_codex_provider_routing.operator_catalog import AppCatalog
+from loopx_codex_provider_routing.operator_catalog import AppCatalog, release_suffix
 from loopx_codex_provider_routing.operator_runtime import (
     CPAOperator,
     sha256,
@@ -159,6 +159,42 @@ def test_runtime_never_maps_subscription_selectors_to_ark(self):
             self.assertNotIn(f'alias: "{alias}"', compatibility)
         self.assertIn("disable-cooling: false", config)
 
+    def test_ark_rows_follow_the_configured_generation(self):
+        """One configured id yields one row, labelled by product generation.
+
+        The Ark rows are the only DeepSeek surface that names an upstream
+        endpoint id, so they must be adopted from the operator's configuration
+        rather than from a literal here; otherwise moving to a newer generation
+        -- DeepSeek-V4.1-Flash -- would need a source change.
+        """
+
+        generation = "deepseek-v4-1-flash-ga-261001"
+        configured = AppCatalog(
+            CPAOperator(OperatorSettings({**self.data, "ark_model": generation}))
+        )
+        self.assertIn(generation, configured.SELECTORS)
+        self.assertNotIn(self.data["ark_model"], configured.SELECTORS)
+        self.assertEqual(
+            configured.SELECTORS[generation], "Ark · DeepSeek V4.1 Flash (261001)"
+        )
+        # The two historical aliases keep resolving, and the ids that need no
+        # release suffix read as their own id.
+        self.assertEqual(
+            configured.SELECTORS["ark/deepseek-v4-flash"], "Ark · DeepSeek V4.1 Flash"
+        )
+        self.assertEqual(
+            configured.SELECTORS["deepseek-v4-flash"],
+            "Ark · DeepSeek V4.1 Flash (legacy id)",
+        )
+        self.assertEqual(release_suffix("deepseek-flash"), "deepseek-flash")
+
+    def test_runtime_config_renders_the_same_generation_label(self):
+        # A row that reads as one generation in the App catalog and another in
+        # the CPA config would make two surfaces disagree about what runs.
+        config = self.runtime.runtime_config("fixture-key", management_secret="fixture")
+        self.assertIn('display-name: "Ark · DeepSeek V4.1 Flash"', config)
+        self.assertIn('alias: "deepseek-v4-flash"', config)
+
     def test_cooldown_reset_is_scoped_and_not_a_health_claim(self):
         self.seed()
         entry = {"name": "b.json", "auth_index": "fixture-index", "disabled": False}
diff --git a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
index 508fdee786..246e2c5adc 100644
--- a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
+++ b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
@@ -16,18 +16,53 @@
 
 from .selectors import FAST_MODELS, MODEL_FAMILIES, ROUTES, SLOTS, VISIBLE_SELECTORS
 
-SELECTORS = {slug: route["display_name"] for (slug, route) in ROUTES.items()}
-SELECTORS.update(
+ROUTE_SELECTORS = {slug: route["display_name"] for (slug, route) in ROUTES.items()}
+ROUTE_SELECTORS.update(
     {model: f"{label} · Auto (legacy id)" for model, label in MODEL_FAMILIES.items()}
 )
-SELECTORS.update(
-    {
-        "ark/deepseek-v4-flash": "Ark · DeepSeek V4 Flash",
-        "deepseek-v4-flash": "Ark · DeepSeek V4 Flash (legacy id)",
-        "deepseek-v4-flash-ga-260731": "Ark · DeepSeek V4 Flash (260731)",
-        "deepseek-v4-pro-ga-260813": "Ark · DeepSeek V4 Pro (260813)",
+ARK_FLASH_ALIAS = "ark/deepseek-v4-flash"
+ARK_LEGACY_FLASH_ALIAS = "deepseek-v4-flash"
+ARK_FLASH_LABEL = "Ark · DeepSeek V4.1 Flash"
+ARK_PRO_LABEL = "Ark · DeepSeek V4 Pro"
+# The ids a stock operator configuration names. They are only the default view
+# of the Ark rows: an operator who configures a newer upstream generation --
+# DeepSeek-V4.1-Flash under its own endpoint id -- gets that id's row instead,
+# because the configured id is the model a request has to name.
+SHIPPED_ARK_MODEL = "deepseek-v4-flash-ga-260731"
+SHIPPED_ARK_PRO_MODEL = "deepseek-v4-pro-ga-260813"
+
+
+def release_suffix(model: str) -> str:
+    """Return the release an upstream id pins, so two generations read apart."""
+
+    tail = model.rsplit("-", 1)[-1]
+    return tail if len(tail) == 6 and tail.isdigit() else model
+
+
+def ark_selectors(flash_model: str, pro_model: str) -> dict[str, str]:
+    """Return the Ark-backed catalog rows for the configured upstream ids.
+
+    The two ids come from the operator's own configuration, so moving to a
+    newer upstream generation is a configuration change rather than a source
+    change. The two historical aliases stay, so a selector pinned to either
+    spelling keeps resolving to whatever the endpoint now serves.
+    """
+
+    return {
+        ARK_FLASH_ALIAS: ARK_FLASH_LABEL,
+        ARK_LEGACY_FLASH_ALIAS: f"{ARK_FLASH_LABEL} (legacy id)",
+        flash_model: f"{ARK_FLASH_LABEL} ({release_suffix(flash_model)})",
+        pro_model: f"{ARK_PRO_LABEL} ({release_suffix(pro_model)})",
     }
-)
+
+
+# The rows a stock configuration publishes. Kept as the module-level view for
+# readers that predate the configurable Ark ids; one operator's projection is
+# the AppCatalog instance's own, built from the ids that operator configured.
+SELECTORS = {
+    **ROUTE_SELECTORS,
+    **ark_selectors(SHIPPED_ARK_MODEL, SHIPPED_ARK_PRO_MODEL),
+}
 FAST_SELECTORS = set(FAST_MODELS)
 ROUTE_FALLBACK_TAILS = {slug: route["tail"] for (slug, route) in ROUTES.items()}
 EXPECTED_ROUTE_ORDERS = {
@@ -123,6 +158,15 @@ def __init__(self, runtime):
         self.AUTH_DIR = runtime.AUTH_DIR
         self.SLOTS_FILE = runtime.SLOTS_FILE
         self.PORT = runtime.PORT
+        # The Ark rows follow the ids this operator configured, so a newer
+        # upstream generation is adopted from the private configuration
+        # instead of from a literal in this module.
+        self.ARK_MODEL = runtime.ARK_MODEL
+        self.ARK_PRO_MODEL = runtime.ARK_PRO_MODEL
+        self.SELECTORS = {
+            **ROUTE_SELECTORS,
+            **ark_selectors(self.ARK_MODEL, self.ARK_PRO_MODEL),
+        }
 
     def ark_source(self, slug: str) -> dict[str, Any]:
         for path in (self.ARK_CATALOG, self.ARK_PROFILE_CATALOG, self.OUTPUT):
@@ -140,7 +184,7 @@ def generate_catalog(self) -> dict[str, Any]:
             for model in (*MODEL_FAMILIES, "gpt-5.6-luna")
         }
         entries = []
-        for slug, label in SELECTORS.items():
+        for slug, label in self.SELECTORS.items():
             route = ROUTES.get(slug, ROUTES.get(f"auto/{slug}"))
             if route:
                 source = deepcopy(sources[route["model"]])
@@ -153,7 +197,7 @@ def generate_catalog(self) -> dict[str, Any]:
                     ]
             else:
                 source = self.ark_source(
-                    slug if slug.endswith("260813") else "deepseek-v4-flash-ga-260731"
+                    self.ARK_PRO_MODEL if slug == self.ARK_PRO_MODEL else self.ARK_MODEL
                 )
             entry = make_entry(source, slug, label, len(entries) + 1)
             entry["visibility"] = "list" if slug in VISIBLE_SELECTORS else "hide"
@@ -331,7 +375,7 @@ def probe(self) -> dict[str, Any]:
             for row in data
             if isinstance(row, dict)
             and not row.get("hidden")
-            and row.get("id") not in SELECTORS
+            and row.get("id") not in self.SELECTORS
         )
         rows = {
             str(row.get("id")): {
@@ -348,9 +392,9 @@ def probe(self) -> dict[str, Any]:
                 ],
             }
             for row in data
-            if isinstance(row, dict) and row.get("id") in SELECTORS
+            if isinstance(row, dict) and row.get("id") in self.SELECTORS
         }
-        missing = sorted(set(SELECTORS) - set(rows))
+        missing = sorted(set(self.SELECTORS) - set(rows))
         hidden = sorted(
             key
             for key, row in rows.items()
@@ -358,7 +402,7 @@ def probe(self) -> dict[str, Any]:
         )
         wrong_display_names = sorted(
             key
-            for (key, display_name) in SELECTORS.items()
+            for (key, display_name) in self.SELECTORS.items()
             if rows.get(key, {}).get("displayName") != display_name
         )
         wrong_default_service_tiers = sorted(
@@ -372,7 +416,7 @@ def probe(self) -> dict[str, Any]:
         )
         missing_auto_efforts = sorted(set(AUTO_REASONING_EFFORTS) - set(auto_efforts))
         live_models = self.cpa_models()
-        cpa_missing = sorted(set(SELECTORS) - live_models)
+        cpa_missing = sorted(set(self.SELECTORS) - live_models)
         route_traversal = self.route_traversal_readback()
         route_mismatches = sorted(
             route
@@ -393,7 +437,7 @@ def probe(self) -> dict[str, Any]:
             "schema_version": "cpa_codex_app_model_probe_v1",
             "codex_binary": str(self.CODEX_BINARY),
             "catalog_path": str(self.OUTPUT),
-            "expected_selectors": sorted(SELECTORS),
+            "expected_selectors": sorted(self.SELECTORS),
             "projected_selectors": rows,
             "visible_selectors": sorted(
                 key for key, row in rows.items() if not row.get("hidden")
diff --git a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
index 553063e644..dd91b1b4a6 100644
--- a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
+++ b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
@@ -15,6 +15,7 @@
 from pathlib import Path
 from typing import Any
 
+from .operator_catalog import ARK_FLASH_LABEL, ARK_PRO_LABEL
 from .operator_observations import ObservationMixin
 from .selectors import FAST_MODELS, MODEL_FAMILIES, ROUTES, SLOTS, aliases_for_slot
 
@@ -182,6 +183,10 @@ def runtime_config(
             port = self.PORT
         if management_secret is None:
             management_secret = self.management_key()
+        # The same rows the App catalog publishes, so one row cannot read as two
+        # generations depending on which surface rendered it.
+        flash_legacy_label = f"{ARK_FLASH_LABEL} (legacy id)"
+        flash_endpoint_label = f"{ARK_FLASH_LABEL} (endpoint id)"
         return "\n".join(
             [
                 'host: "127.0.0.1"',
@@ -224,7 +229,7 @@ def runtime_config(
                 *self.ark_fallback_models(),
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 '        alias: "ark/deepseek-v4-flash"',
-                '        display-name: "Ark · DeepSeek V4 Flash"',
+                f"        display-name: {yaml_quote(ARK_FLASH_LABEL)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -233,7 +238,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 '        alias: "deepseek-v4-flash"',
-                '        display-name: "Ark · DeepSeek V4 Flash (legacy id)"',
+                f"        display-name: {yaml_quote(flash_legacy_label)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -242,7 +247,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 f"        alias: {yaml_quote(self.ARK_MODEL)}",
-                '        display-name: "Ark · DeepSeek V4 Flash (endpoint id)"',
+                f"        display-name: {yaml_quote(flash_endpoint_label)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -251,7 +256,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_PRO_MODEL)}",
                 f"        alias: {yaml_quote(self.ARK_PRO_MODEL)}",
-                '        display-name: "Ark · DeepSeek V4 Pro"',
+                f"        display-name: {yaml_quote(ARK_PRO_LABEL)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
diff --git a/tests/test_manager_channel_binding.py b/tests/test_manager_channel_binding.py
index 3a8ce9d857..1f48775c30 100644
--- a/tests/test_manager_channel_binding.py
+++ b/tests/test_manager_channel_binding.py
@@ -181,11 +181,11 @@ def test_selecting_the_managed_host_runs_the_managed_execution_profile(monkeypat
     assert selected["available"] is True
     # The model follows the executor: the managed host runs the same execution
     # profile a governed Turn runs, so the channel and its workers agree.
-    assert selected["model"] == "deepseek-v4-flash"
+    assert selected["model"] == "deepseek-flash"
     assert selected["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
     # One line, the same shape the governed Turn readback publishes, so the
     # channel and its workers cannot report two different managed profiles.
-    assert selected["execution_profile"] == "deepseek-v4-flash@high"
+    assert selected["execution_profile"] == "deepseek-flash@high"
     assert selected["credential_env_var"] == "DEEPSEEK_API_KEY"
     assert "fixture" not in json.dumps(selected)
 
@@ -284,7 +284,7 @@ def test_a_machine_that_selects_only_an_executor_keeps_the_lower_layers(monkeypa
     assert binding["executor_endpoint"] == "dsh"
     # The model and the effort still resolve from the managed execution profile
     # the selected host runs, not from the last value some other reader saw.
-    assert binding["model"] == "deepseek-v4-flash"
+    assert binding["model"] == "deepseek-flash"
     assert binding["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
     assert manager_model_config(
         {"LOOPX_MANAGER_REASONING_EFFORT": "low"},
@@ -387,7 +387,7 @@ def test_explicit_model_override_wins_on_either_endpoint():
             "DEEPSEEK_API_KEY": "fixture",
             "LOOPX_TURN_REASONING_EFFORT": "max",
         }
-    ) == {"model": "deepseek-v4-flash", "reasoning_effort": "max"}
+    ) == {"model": "deepseek-flash", "reasoning_effort": "max"}
     # Selection is what moves the pair: the same credential without it leaves
     # the interactive endpoint on its own vendor model and effort.
     assert manager_model_config(
diff --git a/tests/test_turn_managed_executor_binding.py b/tests/test_turn_managed_executor_binding.py
index 836de2fe7f..475bb45cf8 100644
--- a/tests/test_turn_managed_executor_binding.py
+++ b/tests/test_turn_managed_executor_binding.py
@@ -451,7 +451,7 @@ def test_a_deviating_provider_is_named_in_the_profile_line():
         module_probe=_RUNTIME,
     )
 
-    assert binding["execution_profile"] == "fixture-provider/deepseek-v4-flash@high"
+    assert binding["execution_profile"] == "fixture-provider/deepseek-flash@high"
 
 
 def test_unconfigured_non_managed_hosts_carry_no_execution_profile():
@@ -519,7 +519,7 @@ def test_an_unsupported_effort_fails_closed_before_launch():
 
     # The refused effort is visible next to the typed verdict, so a reader does
     # not have to re-derive which configured value the endpoint rejected.
-    assert binding["execution_profile"] == "deepseek-v4-flash@turbo"
+    assert binding["execution_profile"] == "deepseek-flash@turbo"
     assert binding["available"] is False
     assert binding["unavailable_reason"] == INVALID_REASONING_EFFORT
 
@@ -534,7 +534,7 @@ def test_a_missing_launch_fact_still_outranks_the_profile_verdict():
     # One typed reason per readback: the missing credential is the fact that
     # decides whether this executor launches at all.
     assert binding["unavailable_reason"] == OPERATOR_CREDENTIAL_UNCONFIGURED
-    assert binding["execution_profile"] == "deepseek-v4-flash@turbo"
+    assert binding["execution_profile"] == "deepseek-flash@turbo"
 
 
 def test_the_agent_facing_profile_line_stays_one_bounded_line():