From d0f2acb7f736d1922a7b6cee817424d15ff6e094 Mon Sep 17 00:00:00 2001
From: huangruiteng <huangrt01@163.com>
Date: Sun, 4 Oct 2026 16:00:05 +0800
Subject: [PATCH 1/2] feat(deepseek): ship the canonical V4.1 Flash id and let
 the Ark rows be configured

The shipped managed execution profile named the retired
`deepseek-v4-flash` spelling while the product label and the vendor's current
id are DeepSeek-V4.1-Flash under `deepseek-flash`. Switch the product default
to the canonical id and keep the retired spelling as an explicit
`LOOPX_TURN_MODEL` / `DSH_MODEL` override, so a host that pins it is a
configuration change.

The steward-executor model field now offers the DeepSeek ids, and the Ark
catalog and runtime config rows take their upstream ids from the operator's own
configuration instead of a fixed GA literal, so adopting a newer endpoint id is
also a configuration change. Both surfaces render the same V4.1 Flash label.

Signed-off-by: huangruiteng <huangrt01@163.com>
---
 .../capability-configuration-fields.tsx       |  6 +-
 .../rfcs/harness-selection-dsh-pi-v0.md       | 15 +++-
 .../rfcs/harness-selection-dsh-pi-v0.zh-CN.md | 13 +++-
 .../deepseek-harness-connector.md             | 11 +--
 docs/reference/operator-model-credential.md   |  2 +-
 docs/reference/protocols/loopx-turn-v0.md     |  4 +-
 .../manager-evidence-and-continuity-v0.md     |  4 +-
 .../loopx-managed-turn-operator-flow-smoke.py |  2 +-
 .../loopx-steward-channel-binding-smoke.py    |  6 +-
 examples/loopx-steward-managed-chat-smoke.py  |  4 +-
 examples/managed-research-team/README.md      |  5 +-
 .../turn_driver/execution_profile.py          |  5 +-
 loopx/dsh_goal_mode/README.md                 |  4 +-
 .../loopx-codex-provider-routing/RUNBOOK.md   |  6 +-
 .../examples/request.json                     |  2 +-
 .../operator_catalog.py                       | 78 +++++++++++++++----
 .../operator_runtime.py                       | 13 +++-
 tests/test_manager_channel_binding.py         |  8 +-
 tests/test_turn_managed_executor_binding.py   |  6 +-
 19 files changed, 132 insertions(+), 62 deletions(-)

diff --git a/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx b/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
index eeea715829..cb18fc67eb 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx
@@ -54,8 +54,12 @@ function ConfigurationFieldControl({ copy, field, id, onChange, value, timezone
     );
   }
   const numeric = field.input_kind === "number";
+  // Models the shipped executors run: the Codex models of the interactive
+  // endpoint and the managed host's DeepSeek default, which is the canonical
+  // `deepseek-flash` id of DeepSeek-V4.1-Flash. Suggestions only: the field
+  // stays free text so an operator can name any id their endpoint serves.
   const modelSuggestions = field.key === "executor_model"
-    ? ["gpt-6-sol", "gpt-6-luna", "gpt-6-astra"] : [];
+    ? ["gpt-6-sol", "gpt-6-luna", "gpt-6-astra", "deepseek-flash", "deepseek-v4-pro"] : [];
   return (
     <label htmlFor={id}>
       <span>{label}</span>
diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
index 6da67d9593..d0c3962c64 100644
--- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
+++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.md
@@ -105,8 +105,8 @@ Both reuse the same Turn host adapters; neither changes the steward default.
 
 A managed host binding names four things: the host adapter, the provider, the
 model, and where the credential comes from. The DSH binding is the DSH Turn host
-with provider `deepseek-official`, model `deepseek-v4-flash` (DeepSeek V4.1
-Flash) at reasoning effort `high`, an endpoint from the operator environment
+with provider `deepseek-official`, model `deepseek-flash` (DeepSeek-V4.1-Flash)
+at reasoning effort `high`, an endpoint from the operator environment
 (`DEEPSEEK_BASE_URL`) and a credential from the operator environment
 (`DEEPSEEK_API_KEY`).
 
@@ -161,11 +161,11 @@ the channel Session on the endpoint the machine now selects.
 
 Both managed surfaces resolve their **execution profile** from one owner
 (`loopx/control_plane/turn_driver/execution_profile.py`): provider
-`deepseek-official`, model `deepseek-v4-flash` (DeepSeek V4.1 Flash) and reasoning
+`deepseek-official`, model `deepseek-flash` (DeepSeek-V4.1-Flash) and reasoning
 effort `high`, overridable by `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` /
 `LOOPX_TURN_REASONING_EFFORT` and, at lower precedence, the legacy `DSH_PROVIDER`
 / `DSH_MODEL`. The readback is one line, `execution_profile`, shaped
-`deepseek-v4-flash@high` in the shipped case, with the provider prepended only
+`deepseek-flash@high` in the shipped case, with the provider prepended only
 when it is not the shipped one; it is one line because every plan payload carries
 it and the agent-facing output budget is a contract, and whichever values the
 line names are the values that run, so an owner-set model appears as itself.
@@ -173,6 +173,13 @@ Credentials authenticate the selected profile and never choose it; the one
 thing a credential resolves is the shipped *host* default of a bounded Turn
 nobody selected, and that resolution carries its own readback source.
 
+**Revision (2026-10-04):** the shipped model default moved from the retired
+`deepseek-v4-flash` spelling to the canonical `deepseek-flash` id of the same
+DeepSeek-V4.1-Flash generation. The retired spelling is still accepted by the
+vendor endpoint and remains available as an explicit `LOOPX_TURN_MODEL` /
+`DSH_MODEL` override, so a host that pins it is a configuration change rather
+than a code change.
+
 Evidence for this binding, separated by source:
 
 - repository-covered without any provider call: with an operator credential the
diff --git a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
index 0e78cb7989..988acfae92 100644
--- a/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
+++ b/docs/architecture/rfcs/harness-selection-dsh-pi-v0.zh-CN.md
@@ -84,8 +84,8 @@ canonical 完成仍是不同事实；本切片不提供动态派生授权或另
 ### 托管宿主绑定与真实环境验证（2026-09-15）
 
 一个托管宿主绑定要说明四件事：宿主适配器、provider、模型，以及凭据来自哪里。
-DSH 绑定是 DSH Turn 宿主 + provider `deepseek-official` + 模型 `deepseek-v4-flash`
-（DeepSeek V4.1 Flash）+ 推理档位 `high`，端点取自运维方环境（`DEEPSEEK_BASE_URL`），
+DSH 绑定是 DSH Turn 宿主 + provider `deepseek-official` + 模型 `deepseek-flash`
+（DeepSeek-V4.1-Flash）+ 推理档位 `high`，端点取自运维方环境（`DEEPSEEK_BASE_URL`），
 凭据取自运维方环境（`DEEPSEEK_API_KEY`）。
 
 LoopX **选择**托管有界 Turn 的默认宿主，而从不由启动时的意外推断
@@ -123,15 +123,20 @@ LoopX **选择**托管有界 Turn 的默认宿主，而从不由启动时的意
 
 两个托管面从同一个所有者解析**执行档位**
 （`loopx/control_plane/turn_driver/execution_profile.py`）：provider
-`deepseek-official`、模型 `deepseek-v4-flash`（DeepSeek V4.1 Flash）、推理档位
+`deepseek-official`、模型 `deepseek-flash`（DeepSeek-V4.1-Flash）、推理档位
 `high`，可由 `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` /
 `LOOPX_TURN_REASONING_EFFORT` 覆盖，更低优先级为历史变量 `DSH_PROVIDER` /
-`DSH_MODEL`。回读是一行 `execution_profile`：出货形态为 `deepseek-v4-flash@high`，
+`DSH_MODEL`。回读是一行 `execution_profile`：出货形态为 `deepseek-flash@high`，
 仅当 provider 不是出货值时前置为 `<provider>/…`。之所以只有一行，是因为每个 plan
 载荷都携带它，而面向 agent 的输出预算是一份契约；该行写出什么值，就是实际会跑的值，
 因此 owner 自己设定的模型会以自身出现。凭据为选定档位提供认证，从不参与选型；凭据
 唯一解析的是"无人显式选择时有界 Turn 的出货宿主默认值"，且该解析自带来源回读。
 
+**修订（2026-10-04）：** 出货模型默认值由已退役的 `deepseek-v4-flash` 拼写改为同一
+DeepSeek-V4.1-Flash 世代的正式 ID `deepseek-flash`。该退役拼写仍被厂商端点接受，
+并继续作为显式 `LOOPX_TURN_MODEL` / `DSH_MODEL` 覆盖可用，因此仍固定旧拼写的宿主
+属于配置变更，而不是代码变更。
+
 该绑定的证据按来源区分：
 
 - 仓库覆盖、无需任何 provider 调用：配置了运维方凭据时出货默认值是 `dsh`，没有时
diff --git a/docs/integrations/deepseek-harness-connector.md b/docs/integrations/deepseek-harness-connector.md
index 1048239b7e..416c4bed5f 100644
--- a/docs/integrations/deepseek-harness-connector.md
+++ b/docs/integrations/deepseek-harness-connector.md
@@ -96,7 +96,7 @@ loopx turn run-once \
   --host generic-cli \
   --execution-mode isolated-headless \
   --project "$PWD" \
-  --host-adapter-command-json '["python3", "-m", "loopx.dsh_goal_mode", "--dsh-home", "/path/to/dsh-home", "--cordis", "/path/to/cordis.yml", "--model", "deepseek-v4-flash"]' \
+  --host-adapter-command-json '["python3", "-m", "loopx.dsh_goal_mode", "--dsh-home", "/path/to/dsh-home", "--cordis", "/path/to/cordis.yml", "--model", "deepseek-flash"]' \
   --validation-command-json '["python3", "/path/to/verify-postcondition.py"]' \
   --execute
 ```
@@ -159,7 +159,7 @@ loopx turn run-once \
   --project "$PWD" \
   --dsh-home /path/to/dsh-home \
   --dsh-cordis /path/to/cordis.yml \
-  --dsh-model deepseek-v4-flash \
+  --dsh-model deepseek-flash \
   --validation-command-json '["python3", "/path/to/verify-postcondition.py"]' \
   --execute
 ```
@@ -183,7 +183,8 @@ credential authenticates it, and `codex-cli` is the default when no credential i
 configured, because an unauthenticated managed host would refuse to run.
 
 What runs on that host is a separate resolution. The managed execution profile
-defaults to `deepseek-official` / `deepseek-v4-flash` / `high`, overridden by
+defaults to `deepseek-official` / `deepseek-flash` / `high`, the canonical
+DeepSeek-V4.1-Flash id, overridden by
 `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` / `LOOPX_TURN_REASONING_EFFORT` and, at
 lower precedence, by the legacy `DSH_PROVIDER` / `DSH_MODEL`; an explicit
 `--dsh-provider` / `--dsh-model` / `--dsh-reasoning-effort` wins over both. The
@@ -211,7 +212,7 @@ host id:
   "credential_env": "DEEPSEEK_API_KEY",
   "endpoint_env": "DEEPSEEK_BASE_URL",
   "operator_credential_bound": true,
-  "execution_profile": "deepseek-v4-flash@high",
+  "execution_profile": "deepseek-flash@high",
   "output_token_budget": {
     "schema_version": "dsh_output_token_budget_v0",
     "scope": "per_model_request",
@@ -235,7 +236,7 @@ configured. `available` is `false` only when LoopX can prove the planned host
 cannot launch here, and `null` for executors this projection does not probe
 rather than an unproven claim. Only the credential variable *name* is reported;
 the value is never read back. `execution_profile` is the resolved profile as one
-line, `deepseek-v4-flash@high` in the shipped shape, with the provider prepended
+line, `deepseek-flash@high` in the shipped shape, with the provider prepended
 only when it is not the shipped one -- it is one line because every plan carries
 it, and the agent-facing output budget is a contract.
 
diff --git a/docs/reference/operator-model-credential.md b/docs/reference/operator-model-credential.md
index e75f7e00f1..10b124c4e2 100644
--- a/docs/reference/operator-model-credential.md
+++ b/docs/reference/operator-model-credential.md
@@ -171,7 +171,7 @@ Every entry point publishes the same readback, so a reader never has to infer
 the host from the name it resolved: `/api/chat/capabilities` reports the
 steward's `executor_endpoint`, its `executor_endpoint_source`
 (`machine_configuration`, `explicit_config` or `product_default`), the
-`execution_profile` (`deepseek-v4-flash@high` on the shipped managed profile),
+`execution_profile` (`deepseek-flash@high` on the shipped managed profile),
 `available`, the selection policy and allocation reason, and the bound
 Session's `session_mode` and `session_status`. The Session persists its chosen
 endpoint, model, effort, policy, pool and source revision, so later configuration
diff --git a/docs/reference/protocols/loopx-turn-v0.md b/docs/reference/protocols/loopx-turn-v0.md
index 7b28e209ce..b15425347c 100644
--- a/docs/reference/protocols/loopx-turn-v0.md
+++ b/docs/reference/protocols/loopx-turn-v0.md
@@ -133,11 +133,11 @@ then the product default.
 | execution profile field | product default | operator override | legacy lower-precedence override |
 | --- | --- | --- | --- |
 | provider | `deepseek-official` | `LOOPX_TURN_PROVIDER` | `DSH_PROVIDER` |
-| model | `deepseek-v4-flash` | `LOOPX_TURN_MODEL` | `DSH_MODEL` |
+| model | `deepseek-flash` | `LOOPX_TURN_MODEL` | `DSH_MODEL` |
 | reasoning effort | `high` | `LOOPX_TURN_REASONING_EFFORT` | — |
 
 The managed `managed_executor` readback reports the resolved profile as one line,
-`<model>@<reasoning_effort>` (the shipped shape is `deepseek-v4-flash@high`).
+`<model>@<reasoning_effort>` (the shipped shape is `deepseek-flash@high`).
 The provider is prepended as `<provider>/…` only when the resolved provider is
 not the shipped one, because dropping it for a deviating provider would make the
 line claim a profile the Turn would not use. Whichever values the line names are
diff --git a/docs/reference/protocols/manager-evidence-and-continuity-v0.md b/docs/reference/protocols/manager-evidence-and-continuity-v0.md
index f86b43139f..41b6b270c3 100644
--- a/docs/reference/protocols/manager-evidence-and-continuity-v0.md
+++ b/docs/reference/protocols/manager-evidence-and-continuity-v0.md
@@ -84,7 +84,7 @@ frontend projection; explicitly choosing status-only still uses that projection.
 The manager channel's model and reasoning effort follow its executor. On the
 interactive CLI endpoint the defaults are `gpt-6-astra` with `high` reasoning; on
 the managed host they are the managed execution profile
-(`deepseek-official` / `deepseek-v4-flash` / `high`). The machine's
+(`deepseek-official` / `deepseek-flash` / `high`). The machine's
 `steward_executor` machine configuration decides the executor, the model and the
 effort first; set `LOOPX_MANAGER_MODEL` and `LOOPX_MANAGER_REASONING_EFFORT` on
 the Chat service when a machine has no such configuration, and the shipped
@@ -95,7 +95,7 @@ is unchanged. Capabilities expose the manager defaults, their source, and the
 status and revision of the machine document they were read from.
 
 The managed profile reaches the channel as the same one-line readback the
-governed Turn publishes (`deepseek-v4-flash@high`), so the channel and the
+governed Turn publishes (`deepseek-flash@high`), so the channel and the
 bounded Turns it drives cannot report two different managed profiles; the
 provider is prepended when it is not the shipped one.
 
diff --git a/examples/loopx-managed-turn-operator-flow-smoke.py b/examples/loopx-managed-turn-operator-flow-smoke.py
index b3badaad28..c8760c294c 100644
--- a/examples/loopx-managed-turn-operator-flow-smoke.py
+++ b/examples/loopx-managed-turn-operator-flow-smoke.py
@@ -88,7 +88,7 @@ def main() -> None:
         )
         if planned.get("available") is not True:
             fail(f"a stored credential must make the managed host launchable: {planned}")
-        if planned.get("execution_profile") != "deepseek-v4-flash@high":
+        if planned.get("execution_profile") != "deepseek-flash@high":
             fail(f"the planned profile must be projected: {planned}")
 
         channel = manager_channel_binding(
diff --git a/examples/loopx-steward-channel-binding-smoke.py b/examples/loopx-steward-channel-binding-smoke.py
index 9854f3db06..b0577d30c8 100644
--- a/examples/loopx-steward-channel-binding-smoke.py
+++ b/examples/loopx-steward-channel-binding-smoke.py
@@ -121,9 +121,9 @@ def _assert_selection_moves_the_channel_to_the_managed_host() -> dict[str, objec
         "an explicit endpoint selection must be the only way onto the managed host",
     )
     _assert(
-        selected["model"] == "deepseek-v4-flash"
+        selected["model"] == "deepseek-flash"
         and selected["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
-        and selected["execution_profile"] == "deepseek-v4-flash@high",
+        and selected["execution_profile"] == "deepseek-flash@high",
         "the managed endpoint must run the managed execution profile",
     )
     _assert(
@@ -370,7 +370,7 @@ def _assert_the_machine_default_is_first_class() -> dict[str, object]:
             _assert(
                 binding["model"] == "deepseek-v4-flash"
                 and binding["model_source"] == MANAGER_MODEL_SOURCE_MACHINE_CONFIGURATION
-                and binding["execution_profile"] == "deepseek-v4-flash@high",
+                and binding["execution_profile"] == "deepseek-flash@high",
                 "the model and the effort must follow the machine selection",
             )
             _assert(
diff --git a/examples/loopx-steward-managed-chat-smoke.py b/examples/loopx-steward-managed-chat-smoke.py
index 5c4b4361bb..0903dfb51c 100644
--- a/examples/loopx-steward-managed-chat-smoke.py
+++ b/examples/loopx-steward-managed-chat-smoke.py
@@ -237,9 +237,9 @@ def _run_turn(args: argparse.Namespace) -> int:
         "the managed host must be reached by selection, not by discovering a credential",
     )
     _assert(
-        binding["model"] == "deepseek-v4-flash"
+        binding["model"] == "deepseek-flash"
         and binding["model_source"] == "managed_execution_profile"
-        and binding["execution_profile"] == "deepseek-v4-flash@high",
+        and binding["execution_profile"] == "deepseek-flash@high",
         "the channel must run the managed execution profile",
     )
 
diff --git a/examples/managed-research-team/README.md b/examples/managed-research-team/README.md
index d04a5e2c38..ee86d21a1b 100644
--- a/examples/managed-research-team/README.md
+++ b/examples/managed-research-team/README.md
@@ -26,8 +26,9 @@ uv pip install --python .venv/bin/python -e packages/loopx-ark-turn
 Set `ARK_API_KEY`, `ARK_MODEL_ID` and `ARK_ENVIRONMENT_ID` in the process
 environment. DSH reuses the machine operator credential; `DEEPSEEK_API_KEY`
 is an explicit environment override. The Ark Environment must already belong to the operator;
-this launcher never creates or deletes it. The local model defaults to
-`deepseek-v4-flash@high`; select another profile with `--dsh-model`.
+this launcher never creates or deletes it. The local model defaults to the
+managed profile `deepseek-flash@high` (DeepSeek-V4.1-Flash); select another
+profile with `--dsh-model`.
 
 Choose a **new private disposable directory**. Never point this example at an
 active Goal or research workspace. The canonical Goal quota governs admission;
diff --git a/loopx/control_plane/turn_driver/execution_profile.py b/loopx/control_plane/turn_driver/execution_profile.py
index cb705c82d6..ec746b34dd 100644
--- a/loopx/control_plane/turn_driver/execution_profile.py
+++ b/loopx/control_plane/turn_driver/execution_profile.py
@@ -28,7 +28,10 @@
 # decision recorded once; the environment can override a field, but nothing is
 # discovered and no credential participates in the choice.
 MANAGED_PROVIDER_DEFAULT = "deepseek-official"
-MANAGED_MODEL_DEFAULT = "deepseek-v4-flash"
+# The canonical id of DeepSeek-V4.1-Flash. The retired ``deepseek-v4-flash``
+# spelling is still accepted by the vendor endpoint and remains available as an
+# explicit override, but no shipped surface may name a retired id by default.
+MANAGED_MODEL_DEFAULT = "deepseek-flash"
 MANAGED_REASONING_EFFORT_DEFAULT = "high"
 
 PROVIDER_ENV_VAR = "LOOPX_TURN_PROVIDER"
diff --git a/loopx/dsh_goal_mode/README.md b/loopx/dsh_goal_mode/README.md
index 4348896322..beccbde1bc 100644
--- a/loopx/dsh_goal_mode/README.md
+++ b/loopx/dsh_goal_mode/README.md
@@ -28,7 +28,7 @@ The `deepseek-harness` host surface (aliases: `deepseek_harness`,
 ```bash
 python -m loopx.dsh_goal_mode \
   --cordis /path/to/cordis.yml \
-  --model deepseek-v4-flash \
+  --model deepseek-flash \
   --provider deepseek-official
 ```
 
@@ -128,7 +128,7 @@ SDK 以 `finish_reason=max-tokens` 结束时，内置 host 会产生不可自动
   settings for the real runtime.
 - Provider, model and reasoning effort come from the managed execution profile
   (`loopx/control_plane/turn_driver/execution_profile.py`): product defaults
-  `deepseek-official` / `deepseek-v4-flash` / `high`, overridden by
+  `deepseek-official` / `deepseek-flash` / `high`, overridden by
   `LOOPX_TURN_PROVIDER` / `LOOPX_TURN_MODEL` / `LOOPX_TURN_REASONING_EFFORT` and,
   at lower precedence, by the legacy `DSH_PROVIDER` / `DSH_MODEL`. An explicit CLI
   value wins over both, and the resolved profile reports its own source. A
diff --git a/packages/loopx-codex-provider-routing/RUNBOOK.md b/packages/loopx-codex-provider-routing/RUNBOOK.md
index d244a31dcd..63e5f00f90 100644
--- a/packages/loopx-codex-provider-routing/RUNBOOK.md
+++ b/packages/loopx-codex-provider-routing/RUNBOOK.md
@@ -177,7 +177,7 @@ flowchart LR
   CPA --> A[Codex subscription A]
   CPA --> B[Codex subscription B]
   CPA -. future expansion .-> C[Codex subscription C<br/>reserved, not configured]
-  CPA --> Ark[Ark DeepSeek V4 Flash]
+  CPA --> Ark[Ark DeepSeek V4.1 Flash]
   CCS[CC Switch<br/>bootstrap / rollback] -. credentials and profiles .-> CPA
   Home -. explicit stale-task migration .-> Swap[AgentSwap<br/>offline sidecar]
   Swap -. new native session .-> Quarantine[隔离 target task]
@@ -205,7 +205,7 @@ flowchart LR
 | `fast/codex-b/gpt-5.6-sol` | Prefer B：B → A；不落 Ark | `text, image` | Fast，强制 `priority` |
 | [`gpt-5.6-luna`](https://developers.openai.com/codex/models) | Luna；复用同一个 A/B 账号环，只在 Codex A/B 间路由，不异构降级到 Ark | `text, image`；推理档位为 `low` 至 `max`，不声明 `ultra` | Standard；不生成重复 Fast alias |
 | `codex-c/gpt-5.6-sol` | 预留；只有第三个订阅真实接入并通过矩阵后才暴露 | 由真实 credential 决定 | 不预声明 |
-| `ark/deepseek-v4-flash` | 手动固定到 Ark DeepSeek V4 Flash | `text` | 不支持 |
+| `ark/deepseek-v4-flash` | 手动固定到 Ark DeepSeek V4.1 Flash（上游 ID 由 operator 配置决定） | `text` | 不支持 |
 | `gpt-5.6-sol` | 隐藏 compatibility alias；处理 App / host 继承裸 model metadata 的旧 task，实际行为与 Auto 一致 | `text, image` | 可选，默认关闭 |
 
 模型 ID 是路由契约，不是上游真实 model slug。显示名可本地化，但 ID 一经上线应保持稳定，
@@ -465,7 +465,7 @@ openai-compatibility:
     models:
       - name: "<ARK_DEEPSEEK_V4_FLASH_ENDPOINT_ID>"
         alias: "deepseek-v4-flash"
-        display-name: "Ark DeepSeek V4 Flash"
+        display-name: "Ark DeepSeek V4.1 Flash"
         is-compat: true
         input-modalities: [text]
         output-modalities: [text]
diff --git a/packages/loopx-codex-provider-routing/examples/request.json b/packages/loopx-codex-provider-routing/examples/request.json
index fcb2c2d96d..b7cd825c7b 100644
--- a/packages/loopx-codex-provider-routing/examples/request.json
+++ b/packages/loopx-codex-provider-routing/examples/request.json
@@ -160,7 +160,7 @@
         "candidates": [
           "ark-text"
         ],
-        "display_name": "Ark · DeepSeek V4 Flash",
+        "display_name": "Ark · DeepSeek V4.1 Flash",
         "input_modalities": [
           "text"
         ],
diff --git a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
index 508fdee786..246e2c5adc 100644
--- a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
+++ b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_catalog.py
@@ -16,18 +16,53 @@
 
 from .selectors import FAST_MODELS, MODEL_FAMILIES, ROUTES, SLOTS, VISIBLE_SELECTORS
 
-SELECTORS = {slug: route["display_name"] for (slug, route) in ROUTES.items()}
-SELECTORS.update(
+ROUTE_SELECTORS = {slug: route["display_name"] for (slug, route) in ROUTES.items()}
+ROUTE_SELECTORS.update(
     {model: f"{label} · Auto (legacy id)" for model, label in MODEL_FAMILIES.items()}
 )
-SELECTORS.update(
-    {
-        "ark/deepseek-v4-flash": "Ark · DeepSeek V4 Flash",
-        "deepseek-v4-flash": "Ark · DeepSeek V4 Flash (legacy id)",
-        "deepseek-v4-flash-ga-260731": "Ark · DeepSeek V4 Flash (260731)",
-        "deepseek-v4-pro-ga-260813": "Ark · DeepSeek V4 Pro (260813)",
+ARK_FLASH_ALIAS = "ark/deepseek-v4-flash"
+ARK_LEGACY_FLASH_ALIAS = "deepseek-v4-flash"
+ARK_FLASH_LABEL = "Ark · DeepSeek V4.1 Flash"
+ARK_PRO_LABEL = "Ark · DeepSeek V4 Pro"
+# The ids a stock operator configuration names. They are only the default view
+# of the Ark rows: an operator who configures a newer upstream generation --
+# DeepSeek-V4.1-Flash under its own endpoint id -- gets that id's row instead,
+# because the configured id is the model a request has to name.
+SHIPPED_ARK_MODEL = "deepseek-v4-flash-ga-260731"
+SHIPPED_ARK_PRO_MODEL = "deepseek-v4-pro-ga-260813"
+
+
+def release_suffix(model: str) -> str:
+    """Return the release an upstream id pins, so two generations read apart."""
+
+    tail = model.rsplit("-", 1)[-1]
+    return tail if len(tail) == 6 and tail.isdigit() else model
+
+
+def ark_selectors(flash_model: str, pro_model: str) -> dict[str, str]:
+    """Return the Ark-backed catalog rows for the configured upstream ids.
+
+    The two ids come from the operator's own configuration, so moving to a
+    newer upstream generation is a configuration change rather than a source
+    change. The two historical aliases stay, so a selector pinned to either
+    spelling keeps resolving to whatever the endpoint now serves.
+    """
+
+    return {
+        ARK_FLASH_ALIAS: ARK_FLASH_LABEL,
+        ARK_LEGACY_FLASH_ALIAS: f"{ARK_FLASH_LABEL} (legacy id)",
+        flash_model: f"{ARK_FLASH_LABEL} ({release_suffix(flash_model)})",
+        pro_model: f"{ARK_PRO_LABEL} ({release_suffix(pro_model)})",
     }
-)
+
+
+# The rows a stock configuration publishes. Kept as the module-level view for
+# readers that predate the configurable Ark ids; one operator's projection is
+# the AppCatalog instance's own, built from the ids that operator configured.
+SELECTORS = {
+    **ROUTE_SELECTORS,
+    **ark_selectors(SHIPPED_ARK_MODEL, SHIPPED_ARK_PRO_MODEL),
+}
 FAST_SELECTORS = set(FAST_MODELS)
 ROUTE_FALLBACK_TAILS = {slug: route["tail"] for (slug, route) in ROUTES.items()}
 EXPECTED_ROUTE_ORDERS = {
@@ -123,6 +158,15 @@ def __init__(self, runtime):
         self.AUTH_DIR = runtime.AUTH_DIR
         self.SLOTS_FILE = runtime.SLOTS_FILE
         self.PORT = runtime.PORT
+        # The Ark rows follow the ids this operator configured, so a newer
+        # upstream generation is adopted from the private configuration
+        # instead of from a literal in this module.
+        self.ARK_MODEL = runtime.ARK_MODEL
+        self.ARK_PRO_MODEL = runtime.ARK_PRO_MODEL
+        self.SELECTORS = {
+            **ROUTE_SELECTORS,
+            **ark_selectors(self.ARK_MODEL, self.ARK_PRO_MODEL),
+        }
 
     def ark_source(self, slug: str) -> dict[str, Any]:
         for path in (self.ARK_CATALOG, self.ARK_PROFILE_CATALOG, self.OUTPUT):
@@ -140,7 +184,7 @@ def generate_catalog(self) -> dict[str, Any]:
             for model in (*MODEL_FAMILIES, "gpt-5.6-luna")
         }
         entries = []
-        for slug, label in SELECTORS.items():
+        for slug, label in self.SELECTORS.items():
             route = ROUTES.get(slug, ROUTES.get(f"auto/{slug}"))
             if route:
                 source = deepcopy(sources[route["model"]])
@@ -153,7 +197,7 @@ def generate_catalog(self) -> dict[str, Any]:
                     ]
             else:
                 source = self.ark_source(
-                    slug if slug.endswith("260813") else "deepseek-v4-flash-ga-260731"
+                    self.ARK_PRO_MODEL if slug == self.ARK_PRO_MODEL else self.ARK_MODEL
                 )
             entry = make_entry(source, slug, label, len(entries) + 1)
             entry["visibility"] = "list" if slug in VISIBLE_SELECTORS else "hide"
@@ -331,7 +375,7 @@ def probe(self) -> dict[str, Any]:
             for row in data
             if isinstance(row, dict)
             and not row.get("hidden")
-            and row.get("id") not in SELECTORS
+            and row.get("id") not in self.SELECTORS
         )
         rows = {
             str(row.get("id")): {
@@ -348,9 +392,9 @@ def probe(self) -> dict[str, Any]:
                 ],
             }
             for row in data
-            if isinstance(row, dict) and row.get("id") in SELECTORS
+            if isinstance(row, dict) and row.get("id") in self.SELECTORS
         }
-        missing = sorted(set(SELECTORS) - set(rows))
+        missing = sorted(set(self.SELECTORS) - set(rows))
         hidden = sorted(
             key
             for key, row in rows.items()
@@ -358,7 +402,7 @@ def probe(self) -> dict[str, Any]:
         )
         wrong_display_names = sorted(
             key
-            for (key, display_name) in SELECTORS.items()
+            for (key, display_name) in self.SELECTORS.items()
             if rows.get(key, {}).get("displayName") != display_name
         )
         wrong_default_service_tiers = sorted(
@@ -372,7 +416,7 @@ def probe(self) -> dict[str, Any]:
         )
         missing_auto_efforts = sorted(set(AUTO_REASONING_EFFORTS) - set(auto_efforts))
         live_models = self.cpa_models()
-        cpa_missing = sorted(set(SELECTORS) - live_models)
+        cpa_missing = sorted(set(self.SELECTORS) - live_models)
         route_traversal = self.route_traversal_readback()
         route_mismatches = sorted(
             route
@@ -393,7 +437,7 @@ def probe(self) -> dict[str, Any]:
             "schema_version": "cpa_codex_app_model_probe_v1",
             "codex_binary": str(self.CODEX_BINARY),
             "catalog_path": str(self.OUTPUT),
-            "expected_selectors": sorted(SELECTORS),
+            "expected_selectors": sorted(self.SELECTORS),
             "projected_selectors": rows,
             "visible_selectors": sorted(
                 key for key, row in rows.items() if not row.get("hidden")
diff --git a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
index 553063e644..dd91b1b4a6 100644
--- a/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
+++ b/packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing/operator_runtime.py
@@ -15,6 +15,7 @@
 from pathlib import Path
 from typing import Any
 
+from .operator_catalog import ARK_FLASH_LABEL, ARK_PRO_LABEL
 from .operator_observations import ObservationMixin
 from .selectors import FAST_MODELS, MODEL_FAMILIES, ROUTES, SLOTS, aliases_for_slot
 
@@ -182,6 +183,10 @@ def runtime_config(
             port = self.PORT
         if management_secret is None:
             management_secret = self.management_key()
+        # The same rows the App catalog publishes, so one row cannot read as two
+        # generations depending on which surface rendered it.
+        flash_legacy_label = f"{ARK_FLASH_LABEL} (legacy id)"
+        flash_endpoint_label = f"{ARK_FLASH_LABEL} (endpoint id)"
         return "\n".join(
             [
                 'host: "127.0.0.1"',
@@ -224,7 +229,7 @@ def runtime_config(
                 *self.ark_fallback_models(),
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 '        alias: "ark/deepseek-v4-flash"',
-                '        display-name: "Ark · DeepSeek V4 Flash"',
+                f"        display-name: {yaml_quote(ARK_FLASH_LABEL)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -233,7 +238,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 '        alias: "deepseek-v4-flash"',
-                '        display-name: "Ark · DeepSeek V4 Flash (legacy id)"',
+                f"        display-name: {yaml_quote(flash_legacy_label)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -242,7 +247,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_MODEL)}",
                 f"        alias: {yaml_quote(self.ARK_MODEL)}",
-                '        display-name: "Ark · DeepSeek V4 Flash (endpoint id)"',
+                f"        display-name: {yaml_quote(flash_endpoint_label)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
@@ -251,7 +256,7 @@ def runtime_config(
                 '          levels: ["high", "medium", "low"]',
                 f"      - name: {yaml_quote(self.ARK_PRO_MODEL)}",
                 f"        alias: {yaml_quote(self.ARK_PRO_MODEL)}",
-                '        display-name: "Ark · DeepSeek V4 Pro"',
+                f"        display-name: {yaml_quote(ARK_PRO_LABEL)}",
                 "        force-mapping: true",
                 "        is-compat: true",
                 "        input-modalities: [text]",
diff --git a/tests/test_manager_channel_binding.py b/tests/test_manager_channel_binding.py
index 3a8ce9d857..1f48775c30 100644
--- a/tests/test_manager_channel_binding.py
+++ b/tests/test_manager_channel_binding.py
@@ -181,11 +181,11 @@ def test_selecting_the_managed_host_runs_the_managed_execution_profile(monkeypat
     assert selected["available"] is True
     # The model follows the executor: the managed host runs the same execution
     # profile a governed Turn runs, so the channel and its workers agree.
-    assert selected["model"] == "deepseek-v4-flash"
+    assert selected["model"] == "deepseek-flash"
     assert selected["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
     # One line, the same shape the governed Turn readback publishes, so the
     # channel and its workers cannot report two different managed profiles.
-    assert selected["execution_profile"] == "deepseek-v4-flash@high"
+    assert selected["execution_profile"] == "deepseek-flash@high"
     assert selected["credential_env_var"] == "DEEPSEEK_API_KEY"
     assert "fixture" not in json.dumps(selected)
 
@@ -284,7 +284,7 @@ def test_a_machine_that_selects_only_an_executor_keeps_the_lower_layers(monkeypa
     assert binding["executor_endpoint"] == "dsh"
     # The model and the effort still resolve from the managed execution profile
     # the selected host runs, not from the last value some other reader saw.
-    assert binding["model"] == "deepseek-v4-flash"
+    assert binding["model"] == "deepseek-flash"
     assert binding["model_source"] == MANAGER_MODEL_SOURCE_MANAGED_PROFILE
     assert manager_model_config(
         {"LOOPX_MANAGER_REASONING_EFFORT": "low"},
@@ -387,7 +387,7 @@ def test_explicit_model_override_wins_on_either_endpoint():
             "DEEPSEEK_API_KEY": "fixture",
             "LOOPX_TURN_REASONING_EFFORT": "max",
         }
-    ) == {"model": "deepseek-v4-flash", "reasoning_effort": "max"}
+    ) == {"model": "deepseek-flash", "reasoning_effort": "max"}
     # Selection is what moves the pair: the same credential without it leaves
     # the interactive endpoint on its own vendor model and effort.
     assert manager_model_config(
diff --git a/tests/test_turn_managed_executor_binding.py b/tests/test_turn_managed_executor_binding.py
index 836de2fe7f..475bb45cf8 100644
--- a/tests/test_turn_managed_executor_binding.py
+++ b/tests/test_turn_managed_executor_binding.py
@@ -451,7 +451,7 @@ def test_a_deviating_provider_is_named_in_the_profile_line():
         module_probe=_RUNTIME,
     )
 
-    assert binding["execution_profile"] == "fixture-provider/deepseek-v4-flash@high"
+    assert binding["execution_profile"] == "fixture-provider/deepseek-flash@high"
 
 
 def test_unconfigured_non_managed_hosts_carry_no_execution_profile():
@@ -519,7 +519,7 @@ def test_an_unsupported_effort_fails_closed_before_launch():
 
     # The refused effort is visible next to the typed verdict, so a reader does
     # not have to re-derive which configured value the endpoint rejected.
-    assert binding["execution_profile"] == "deepseek-v4-flash@turbo"
+    assert binding["execution_profile"] == "deepseek-flash@turbo"
     assert binding["available"] is False
     assert binding["unavailable_reason"] == INVALID_REASONING_EFFORT
 
@@ -534,7 +534,7 @@ def test_a_missing_launch_fact_still_outranks_the_profile_verdict():
     # One typed reason per readback: the missing credential is the fact that
     # decides whether this executor launches at all.
     assert binding["unavailable_reason"] == OPERATOR_CREDENTIAL_UNCONFIGURED
-    assert binding["execution_profile"] == "deepseek-v4-flash@turbo"
+    assert binding["execution_profile"] == "deepseek-flash@turbo"
 
 
 def test_the_agent_facing_profile_line_stays_one_bounded_line():

From 09933b414337fa468631dc8c080c62a86fd902a7 Mon Sep 17 00:00:00 2001
From: huangruiteng <huangrt01@163.com>
Date: Sun, 4 Oct 2026 16:29:01 +0800
Subject: [PATCH 2/2] test(cpa-operator): pin the configured Ark generation and
 the V4.1 Flash label

A configured upstream id must yield its own catalog row, the two historical
aliases must keep resolving, and the App catalog and the CPA runtime config
must not render two different generations for one row.

Signed-off-by: huangruiteng <huangrt01@163.com>
---
 .../smoke/operator_smoke.py                   | 38 ++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/packages/loopx-codex-provider-routing/smoke/operator_smoke.py b/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
index 8afb4c8f76..1747b3e13b 100644
--- a/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
+++ b/packages/loopx-codex-provider-routing/smoke/operator_smoke.py
@@ -11,7 +11,7 @@
 from unittest.mock import patch
 
 from loopx_codex_provider_routing.operator import rollback, run, snapshot
-from loopx_codex_provider_routing.operator_catalog import AppCatalog
+from loopx_codex_provider_routing.operator_catalog import AppCatalog, release_suffix
 from loopx_codex_provider_routing.operator_runtime import (
     CPAOperator,
     sha256,
@@ -159,6 +159,42 @@ def test_runtime_never_maps_subscription_selectors_to_ark(self):
             self.assertNotIn(f'alias: "{alias}"', compatibility)
         self.assertIn("disable-cooling: false", config)
 
+    def test_ark_rows_follow_the_configured_generation(self):
+        """One configured id yields one row, labelled by product generation.
+
+        The Ark rows are the only DeepSeek surface that names an upstream
+        endpoint id, so they must be adopted from the operator's configuration
+        rather than from a literal here; otherwise moving to a newer generation
+        -- DeepSeek-V4.1-Flash -- would need a source change.
+        """
+
+        generation = "deepseek-v4-1-flash-ga-261001"
+        configured = AppCatalog(
+            CPAOperator(OperatorSettings({**self.data, "ark_model": generation}))
+        )
+        self.assertIn(generation, configured.SELECTORS)
+        self.assertNotIn(self.data["ark_model"], configured.SELECTORS)
+        self.assertEqual(
+            configured.SELECTORS[generation], "Ark · DeepSeek V4.1 Flash (261001)"
+        )
+        # The two historical aliases keep resolving, and the ids that need no
+        # release suffix read as their own id.
+        self.assertEqual(
+            configured.SELECTORS["ark/deepseek-v4-flash"], "Ark · DeepSeek V4.1 Flash"
+        )
+        self.assertEqual(
+            configured.SELECTORS["deepseek-v4-flash"],
+            "Ark · DeepSeek V4.1 Flash (legacy id)",
+        )
+        self.assertEqual(release_suffix("deepseek-flash"), "deepseek-flash")
+
+    def test_runtime_config_renders_the_same_generation_label(self):
+        # A row that reads as one generation in the App catalog and another in
+        # the CPA config would make two surfaces disagree about what runs.
+        config = self.runtime.runtime_config("fixture-key", management_secret="fixture")
+        self.assertIn('display-name: "Ark · DeepSeek V4.1 Flash"', config)
+        self.assertIn('alias: "deepseek-v4-flash"', config)
+
     def test_cooldown_reset_is_scoped_and_not_a_health_claim(self):
         self.seed()
         entry = {"name": "b.json", "auth_index": "fixture-index", "disabled": False}