diff --git a/docs-site/public/pr-screenshots/provider-discovery-recovery.png b/docs-site/public/pr-screenshots/provider-discovery-recovery.png
new file mode 100644
index 0000000000..76d58d2520
Binary files /dev/null and b/docs-site/public/pr-screenshots/provider-discovery-recovery.png differ
diff --git a/docs-site/src/content/docs/guides/providers.md b/docs-site/src/content/docs/guides/providers.md
index 46348e5371..a895101933 100644
--- a/docs-site/src/content/docs/guides/providers.md
+++ b/docs-site/src/content/docs/guides/providers.md
@@ -245,6 +245,12 @@ full model slug sent upstream. ClinePass quota is shared by the account across r
 weekly, and monthly limits. A 2026-08-13 live probe verified that every static ClinePass model
 accepts `low`, `medium`, `high`, `xhigh`, and `max` at the gateway input boundary. opencodex
 preserves those requested tiers; any backend-specific normalization remains ClinePass's responsibility.
+Cline documents the Chat Completions route but not an OpenAI-compatible `GET /models` route, so
+opencodex uses the maintained subscription catalog instead of sending an unsupported discovery probe.
+
+**MiMo Free** also uses a maintained static catalog. Its anonymous JWT-backed chat endpoint has no
+model-list contract; `mimo-auto` remains available without an API key and opencodex does not append
+an invalid `/models` probe to the chat URL.
 
 **Cline** is the same API key and endpoint on pay-as-you-go usage billing across 100+ models
 (OpenRouter-style ids like `anthropic/claude-sonnet-4-6`). Cline's promotional free models are only
diff --git a/docs-site/src/content/docs/guides/web-dashboard.md b/docs-site/src/content/docs/guides/web-dashboard.md
index a32643fbb6..71be214abd 100644
--- a/docs-site/src/content/docs/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/guides/web-dashboard.md
@@ -49,7 +49,7 @@ the browser or password manager's decision.
 | **Add provider** | Search registry-backed presets for account login, API-key services, local servers, or a custom endpoint. |
 | **Codex Auth** | Add ChatGPT/Codex pool accounts, select the next-session account, refresh 5h / weekly / 30d quotas, enable or disable quota auto-switch, set its 1–100% threshold, and configure transient-failure failover. |
 | **Subagents** | Feature up to five bare native or namespaced routed models in the `spawn_agent` override list. |
-| **Models** | Toggle native GPT and routed models, set provider allowlists and context caps, choose v1/base/v2, and configure the v2 thread limit. Configured providers stay visible as zero-model groups when discovery is off or returns no rows. |
+| **Models** | Toggle native GPT and routed models, set provider allowlists and context caps, choose v1/base/v2, and configure the v2 thread limit. Configured providers stay visible as zero-model groups when discovery is off or returns no rows. When discovery fails, the badge hover keeps configured fallback models explicit and directs OAuth providers, such as xAI, to reauthenticate with `ocx login <provider>` or dashboard reauthentication; other providers link to endpoint and discovery settings. |
 | **Logs** | Auto-refresh recent requests with tokens, requested effort and (when available) effective outbound effort, resolved model, provider, status, request id, duration, and error details. The detail view includes the exact reasoning wire field when the adapter emits one. Filter by opaque conversation/session id (when the client sends one) to total tokens and estimated list-price cost for the currently loaded Logs ring. |
 | **Usage / Debug** | Inspect token-usage coverage and trends, or enable opt-in provider transport and usage-extraction diagnostics. |
 | **Storage** | Read-only CODEX_HOME disk breakdown (sessions, archives, DBs, attachments). Optional archived cleanup: preview the oldest N%, then quarantine to `CODEX_HOME/.trash` (default) or permanently delete behind an explicit checkbox. **Auto-cleanup policy** is opt-in and **default OFF** (`storageCleanupPolicy.enabled`); configure threshold/target/schedule/mode on the Storage page, or trigger **Run now**. Quarantined entries can be restored from the Storage page (JSONL + threads). Active sessions stay read-only. Cleanup and restore are refused while Codex holds the newest/active `state_*.sqlite` locked. |
diff --git a/gui/src/components/provider-workspace/ProviderSettings.tsx b/gui/src/components/provider-workspace/ProviderSettings.tsx
index 26ca85fa35..4c81633a2b 100644
--- a/gui/src/components/provider-workspace/ProviderSettings.tsx
+++ b/gui/src/components/provider-workspace/ProviderSettings.tsx
@@ -36,7 +36,7 @@ export default function ProviderSettings({
   onRegisterSave?: (save: (() => Promise<boolean>) | null) => void;
 }) {
   const t = useT();
-  const initialAuth = String(item.authMode ?? (item.keyOptional ? "local" : "key"));
+  const initialAuth = String(item.authMode ?? "key");
   const [adapter, setAdapter] = useState(item.adapter);
   const [baseUrl, setBaseUrl] = useState(item.baseUrl);
   const [defaultModel, setDefaultModel] = useState(item.defaultModel ?? "");
@@ -59,7 +59,7 @@ export default function ProviderSettings({
     setAdapter(item.adapter);
     setBaseUrl(item.baseUrl);
     setDefaultModel(item.defaultModel ?? "");
-    setAuthMode(String(item.authMode ?? (item.keyOptional ? "local" : "key")));
+    setAuthMode(String(item.authMode ?? "key"));
     setApiKeyTransport(item.apiKeyTransport ?? "x-api-key");
     setNote(item.note ?? "");
     setAllowPrivateNetwork(item.allowPrivateNetwork ?? false);
@@ -112,7 +112,7 @@ export default function ProviderSettings({
   const dirty = adapter.trim() !== item.adapter
     || baseUrl.trim() !== item.baseUrl
     || defaultModel.trim() !== (item.defaultModel ?? "")
-    || authMode !== String(item.authMode ?? (item.keyOptional ? "local" : "key"))
+    || authMode !== String(item.authMode ?? "key")
     || (adapter.trim() === "anthropic" && authMode === "key" && apiKeyTransport !== (item.apiKeyTransport ?? "x-api-key"))
     || note.trim() !== (item.note ?? "")
     || allowPrivateNetwork !== (item.allowPrivateNetwork ?? false)
@@ -335,10 +335,17 @@ export default function ProviderSettings({
         <span className="pwi-settings-label">{t("pws.allowPrivateNetwork")}</span>
       </label>
       <label className="pwi-settings-field" style={{ flexDirection: "row", alignItems: "flex-start", gap: 8 }}>
-        <input type="checkbox" checked={liveModels} onChange={e => setLiveModels(e.target.checked)} />
+        <input
+          type="checkbox"
+          checked={liveModels}
+          disabled={item.liveModelDiscoverySupported === false}
+          onChange={e => setLiveModels(e.target.checked)}
+        />
         <span>
           <span className="pwi-settings-label">{t("pws.liveModels")}</span>
-          <span className="muted text-label" style={{ display: "block", marginTop: 2 }}>{t("pws.liveModelsDesc")}</span>
+          <span className="muted text-label" style={{ display: "block", marginTop: 2 }}>
+            {t(item.liveModelDiscoverySupported === false ? "pws.liveModelsUnsupportedDesc" : "pws.liveModelsDesc")}
+          </span>
         </span>
       </label>
       {dirty && (
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 1ddf5a014f..22587a71a7 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -560,6 +560,9 @@ export const de: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "Die Modellerkennung ist an einem Netzwerkfehler gescheitert.",
   "models.discoveryFailedProvider": "Der Anbieter meldete einen Fehler bei der Modellerkennung.",
   "models.discoveryFailedGeneric": "Die Modellerkennung ist fehlgeschlagen.",
+  "models.discoveryRecoveryReauth": "Melden Sie sich erneut an, um die Live-Modellerkennung wiederherzustellen. Konfigurierte Modelle bleiben verfügbar.",
+  "models.discoveryRecoverySettings": "Konfigurierte Modelle bleiben verfügbar. Prüfen Sie den Endpunkt oder deaktivieren Sie die Live-Modellerkennung in den Anbietereinstellungen.",
+  "models.openProviderLogin": "Anbieter-Anmeldung öffnen",
   "models.openProviderSettings": "Anbietereinstellungen öffnen",
   "models.loading": "Lädt…",
   "models.search": "Modelle suchen…",
@@ -1642,6 +1645,7 @@ export const de: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "Lokales/privates Netzwerk erlauben",
   "pws.liveModels": "Modelle beim Anbieter erkennen",
   "pws.liveModelsDesc": "Lädt den Live-Modellkatalog des Anbieters. Ausschalten, um nur konfigurierte statische Modelle zu verwenden.",
+  "pws.liveModelsUnsupportedDesc": "Dieser Anbieter hat keinen Endpunkt für die Modellliste. OpenCodex verwendet seinen gepflegten statischen Katalog.",
   "pws.optionalPlaceholder": "Optional",
   "pws.providerId": "Anbieter-ID",
   "pws.reauth": "Erneute Anmeldung erforderlich",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 2d2fc96606..5000030fe7 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -585,6 +585,9 @@ export const en = {
   "models.discoveryFailedNetwork": "Model discovery failed due to a network error.",
   "models.discoveryFailedProvider": "The provider reported a model discovery error.",
   "models.discoveryFailedGeneric": "Model discovery failed.",
+  "models.discoveryRecoveryReauth": "Re-login to restore live model discovery. Configured models remain available.",
+  "models.discoveryRecoverySettings": "Configured models remain available. Check the endpoint or disable live model discovery in provider settings.",
+  "models.openProviderLogin": "Open provider login",
   "models.openProviderSettings": "Open provider settings",
   "models.loading": "Loading…",
   "models.search": "Search models…",
@@ -1153,6 +1156,7 @@ export const en = {
   "pws.allowPrivateNetwork": "Allow local/private network",
   "pws.liveModels": "Discover models from provider",
   "pws.liveModelsDesc": "Fetch the provider's live model catalog. Turn this off to use only configured/static models.",
+  "pws.liveModelsUnsupportedDesc": "This provider has no model-list endpoint. OpenCodex uses its maintained static catalog.",
   "pws.optionalPlaceholder": "Optional",
   "pws.providerId": "Provider ID",
   "pws.reauth": "Needs re-auth",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index d87f58f9de..6a60def98a 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -541,6 +541,9 @@ export const ja: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "ネットワークエラーによりモデル検出に失敗しました。",
   "models.discoveryFailedProvider": "プロバイダーがモデル検出エラーを報告しました。",
   "models.discoveryFailedGeneric": "モデル検出に失敗しました。",
+  "models.discoveryRecoveryReauth": "再ログインしてライブモデル検出を復元してください。設定済みのモデルは引き続き使用できます。",
+  "models.discoveryRecoverySettings": "設定済みのモデルは引き続き使用できます。エンドポイントを確認するか、プロバイダー設定でライブモデル検出を無効にしてください。",
+  "models.openProviderLogin": "プロバイダーログインを開く",
   "models.openProviderSettings": "プロバイダー設定を開く",
   "models.loading": "読み込み中…",
   "models.search": "モデルを検索…",
@@ -1095,6 +1098,7 @@ export const ja: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "ローカル/プライベートネットワークを許可",
   "pws.liveModels": "プロバイダーからモデルを検出",
   "pws.liveModelsDesc": "プロバイダーのライブモデルカタログを取得します。オフにすると設定済みの静的モデルのみを使用します。",
+  "pws.liveModelsUnsupportedDesc": "このプロバイダーにはモデル一覧エンドポイントがありません。OpenCodex は管理された静的カタログを使用します。",
   "pws.optionalPlaceholder": "任意",
   "pws.providerId": "プロバイダー ID",
   "pws.reauth": "再認証が必要",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index bbf55e9071..7ff4a4d62f 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -571,6 +571,9 @@ export const ko: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "네트워크 오류로 모델 검색에 실패했습니다.",
   "models.discoveryFailedProvider": "프로바이더가 모델 검색 오류를 보고했습니다.",
   "models.discoveryFailedGeneric": "모델 검색에 실패했습니다.",
+  "models.discoveryRecoveryReauth": "다시 로그인하여 실시간 모델 검색을 복구하세요. 구성된 모델은 계속 사용할 수 있습니다.",
+  "models.discoveryRecoverySettings": "구성된 모델은 계속 사용할 수 있습니다. 엔드포인트를 확인하거나 프로바이더 설정에서 실시간 모델 검색을 끄세요.",
+  "models.openProviderLogin": "프로바이더 로그인 열기",
   "models.openProviderSettings": "프로바이더 설정 열기",
   "models.loading": "불러오는 중…",
   "models.search": "모델 검색…",
@@ -1669,6 +1672,7 @@ export const ko: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "로컬/사설 네트워크 허용",
   "pws.liveModels": "프로바이더에서 모델 검색",
   "pws.liveModelsDesc": "프로바이더의 실시간 모델 카탈로그를 가져옵니다. 끄면 설정된 정적 모델만 사용합니다.",
+  "pws.liveModelsUnsupportedDesc": "이 프로바이더에는 모델 목록 엔드포인트가 없습니다. OpenCodex는 관리되는 정적 카탈로그를 사용합니다.",
   "pws.optionalPlaceholder": "선택사항",
   "pws.providerId": "프로바이더 ID",
   "pws.reauth": "재인증 필요",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 60064fd394..c66357df2a 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -573,6 +573,9 @@ export const ru: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "Обнаружение моделей не удалось из-за сетевой ошибки.",
   "models.discoveryFailedProvider": "Провайдер сообщил об ошибке обнаружения моделей.",
   "models.discoveryFailedGeneric": "Не удалось обнаружить модели.",
+  "models.discoveryRecoveryReauth": "Войдите снова, чтобы восстановить обнаружение моделей. Настроенные модели остаются доступными.",
+  "models.discoveryRecoverySettings": "Настроенные модели остаются доступными. Проверьте конечную точку или отключите обнаружение моделей в настройках провайдера.",
+  "models.openProviderLogin": "Открыть вход провайдера",
   "models.openProviderSettings": "Открыть настройки провайдера",
   "models.loading": "Загрузка…",
   "models.search": "Поиск моделей…",
@@ -1137,6 +1140,7 @@ export const ru: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "Разрешить локальную/частную сеть",
   "pws.liveModels": "Обнаруживать модели провайдера",
   "pws.liveModelsDesc": "Загружать актуальный каталог моделей провайдера. Выключите, чтобы использовать только настроенные статические модели.",
+  "pws.liveModelsUnsupportedDesc": "У этого провайдера нет эндпоинта списка моделей. OpenCodex использует поддерживаемый статический каталог.",
   "pws.optionalPlaceholder": "Необязательно",
   "pws.providerId": "ID провайдера",
   "pws.reauth": "Нужна переавторизация",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index 32b11d6196..82a7ed3eb9 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -576,6 +576,9 @@ export const tr: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "Model keşfi ağ hatası nedeniyle başarısız oldu.",
   "models.discoveryFailedProvider": "Sağlayıcı bir model keşfi hatası bildirdi.",
   "models.discoveryFailedGeneric": "Model keşfi başarısız oldu.",
+  "models.discoveryRecoveryReauth": "Canlı model keşfini geri yüklemek için yeniden giriş yapın. Yapılandırılmış modeller kullanılabilir durumda kalır.",
+  "models.discoveryRecoverySettings": "Yapılandırılmış modeller kullanılabilir durumda kalır. Uç noktayı kontrol edin veya sağlayıcı ayarlarında canlı model keşfini kapatın.",
+  "models.openProviderLogin": "Sağlayıcı girişini aç",
   "models.openProviderSettings": "Sağlayıcı ayarlarını aç",
   "models.loading": "Yükleniyor…",
   "models.search": "Modellerde ara…",
@@ -1144,6 +1147,7 @@ export const tr: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "Yerel/özel ağa izin ver",
   "pws.liveModels": "Sağlayıcıdan canlı model keşfet",
   "pws.liveModelsDesc": "Sağlayıcının canlı model kataloğunu çekin.",
+  "pws.liveModelsUnsupportedDesc": "Bu sağlayıcının model listesi uç noktası yoktur. OpenCodex bakımı yapılan statik kataloğunu kullanır.",
   "pws.optionalPlaceholder": "İsteğe bağlı",
   "pws.providerId": "Sağlayıcı ID",
   "pws.reauth": "Yeniden doğrulama gerekiyor",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 3edb42ebb9..3d9483b7cc 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -441,6 +441,9 @@ export const zhTW: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "由於網路錯誤，模型發現失敗。",
   "models.discoveryFailedProvider": "供應商報告了模型發現錯誤。",
   "models.discoveryFailedGeneric": "模型發現失敗。",
+  "models.discoveryRecoveryReauth": "請重新登入以恢復即時模型發現。已設定的模型仍可使用。",
+  "models.discoveryRecoverySettings": "已設定的模型仍可使用。請檢查端點，或在供應商設定中關閉即時模型發現。",
+  "models.openProviderLogin": "開啟供應商登入",
   "models.openProviderSettings": "開啟供應商設定",
   "models.loading": "載入中…",
   "models.search": "搜尋模型…",
@@ -934,6 +937,7 @@ export const zhTW: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "允許本地/私有網路",
   "pws.liveModels": "從供應商發現模型",
   "pws.liveModelsDesc": "取得供應商的即時模型目錄。關閉後僅使用已配置的靜態模型。",
+  "pws.liveModelsUnsupportedDesc": "此供應商沒有模型清單端點。OpenCodex 將使用其維護的靜態目錄。",
   "pws.optionalPlaceholder": "可選",
   "pws.providerId": "供應商 ID",
   "pws.reauth": "需要重新認證",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 899e1fd6c2..951fedc159 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -568,6 +568,9 @@ export const zh: Record<TKey, string> = {
   "models.discoveryFailedNetwork": "由于网络错误，模型发现失败。",
   "models.discoveryFailedProvider": "提供方报告了模型发现错误。",
   "models.discoveryFailedGeneric": "模型发现失败。",
+  "models.discoveryRecoveryReauth": "请重新登录以恢复实时模型发现。已配置的模型仍可使用。",
+  "models.discoveryRecoverySettings": "已配置的模型仍可使用。请检查端点，或在提供方设置中关闭实时模型发现。",
+  "models.openProviderLogin": "打开提供方登录",
   "models.openProviderSettings": "打开提供方设置",
   "models.loading": "加载中…",
   "models.search": "搜索模型…",
@@ -1662,6 +1665,7 @@ export const zh: Record<TKey, string> = {
   "pws.allowPrivateNetwork": "允许本地/私有网络",
   "pws.liveModels": "从提供方发现模型",
   "pws.liveModelsDesc": "获取提供方的实时模型目录。关闭后仅使用已配置的静态模型。",
+  "pws.liveModelsUnsupportedDesc": "此提供方没有模型列表端点。OpenCodex 将使用其维护的静态目录。",
   "pws.optionalPlaceholder": "可选",
   "pws.providerId": "提供商 ID",
   "pws.reauth": "需要重新认证",
diff --git a/gui/src/models-groups.ts b/gui/src/models-groups.ts
index e6cce7f5cf..f9a5df4a6b 100644
--- a/gui/src/models-groups.ts
+++ b/gui/src/models-groups.ts
@@ -21,6 +21,7 @@ export interface ConfiguredProviderSummary {
 
 export interface ProviderModelGroup<Row> {
   provider: string;
+  authMode?: string;
   rows: Row[];
   native: boolean;
   liveModels: boolean;
@@ -56,6 +57,7 @@ export function buildProviderModelGroups<Row extends { provider: string; native?
       const configured = providerByName.get(provider);
       return {
         provider,
+        authMode: configured?.authMode,
         rows: providerRows,
         native: providerRows.length > 0 && providerRows.every(row => row.native === true),
         liveModels: configured?.liveModels !== false,
diff --git a/gui/src/pages/Models.tsx b/gui/src/pages/Models.tsx
index bf63718c2c..874c4210a5 100644
--- a/gui/src/pages/Models.tsx
+++ b/gui/src/pages/Models.tsx
@@ -48,7 +48,7 @@ import {
   THREAD_OPTION_SET,
   THREAD_OPTIONS,
   writeCollapsedProviders,
-  discoveryFailureLabel,
+  discoveryFailureTitle,
   type ModelRow,
   type ProviderContextCapsResponse,
   type ShadowCallData,
@@ -912,7 +912,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
   const selectedModelMap = selectedModels ?? {};
 
   const renderGroup = (group: ProviderModelGroup<ModelRow>) => {
-    const { provider, rows, native, liveModels, discovery } = group;
+    const { provider, rows, native, liveModels, discovery, authMode } = group;
     const isCollapsed = collapsed.has(provider);
     // Final visibility, not just the disable flag: a model is visible to Codex only when the
     // provider allowlist admits it AND it is not disabled. Reading `disabled` alone made the
@@ -970,7 +970,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
            <span
              className="badge badge-amber"
              role="status"
-             title={discoveryFailureLabel(t, discoveryFailure)}
+              title={discoveryFailureTitle(t, discoveryFailure, authMode)}
            >
              {t("models.discoveryFailedBadge")}
            </span>
@@ -1054,7 +1054,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
           <div className="models-provider-body">
             {isNative && <p className="muted text-label models-provider-hint">{t("models.nativeHint")}</p>}
             {rows.length === 0 && (
-              <EmptyProviderHint liveModels={liveModels} discovery={discovery} showFailureBadge={false} />
+              <EmptyProviderHint liveModels={liveModels} discovery={discovery} authMode={authMode} showFailureBadge={false} />
             )}
             {rows.length > PAGE / 2 && (
               <input
diff --git a/gui/src/pages/models-provider-hints.tsx b/gui/src/pages/models-provider-hints.tsx
index 4280664359..0e87001310 100644
--- a/gui/src/pages/models-provider-hints.tsx
+++ b/gui/src/pages/models-provider-hints.tsx
@@ -2,15 +2,17 @@ import { IconInfo } from "../icons";
 import { useT } from "../i18n/shared";
 import { navigateHash } from "../hash-routing";
 import type { ProviderDiscoverySummary } from "../models-groups";
-import { discoveryFailureLabel } from "./models-shared";
+import { discoveryFailureLabel, discoveryRecoveryLabel } from "./models-shared";
 
 export function EmptyProviderHint({
   liveModels,
   discovery,
+  authMode,
   showFailureBadge = true,
 }: {
   liveModels: boolean;
   discovery?: ProviderDiscoverySummary;
+  authMode?: string;
   showFailureBadge?: boolean;
 }) {
   const t = useT();
@@ -21,7 +23,7 @@ export function EmptyProviderHint({
       <span>
         {failed && showFailureBadge && <><span className="badge badge-amber">{t("models.discoveryFailedBadge")}</span>{" "}</>}
         {failed
-          ? `${discoveryFailureLabel(t, failed)} `
+          ? `${discoveryFailureLabel(t, failed)} ${discoveryRecoveryLabel(t, authMode)} `
           : `${t(liveModels ? "models.emptyDiscovery" : "models.emptyDiscoveryDisabled")} `}
         <button type="button" className="link-btn" onClick={() => navigateHash("providers")}>
           {t("models.openProviderSettings")}
diff --git a/gui/src/pages/models-shared.ts b/gui/src/pages/models-shared.ts
index ab845a13c4..cde4a727ee 100644
--- a/gui/src/pages/models-shared.ts
+++ b/gui/src/pages/models-shared.ts
@@ -25,6 +25,20 @@ export function discoveryFailureLabel(
   }
 }
 
+export function discoveryRecoveryLabel(t: TFn, authMode?: string): string {
+  return authMode === "oauth"
+    ? t("models.discoveryRecoveryReauth")
+    : t("models.discoveryRecoverySettings");
+}
+
+export function discoveryFailureTitle(
+  t: TFn,
+  discovery: Extract<ProviderDiscoverySummary, { status: "failed" }>,
+  authMode?: string,
+): string {
+  return `${discoveryFailureLabel(t, discovery)} ${discoveryRecoveryLabel(t, authMode)}`;
+}
+
 export interface ModelRow {
   provider: string;
   id: string;
@@ -123,4 +137,3 @@ export function writeCollapsedProviders(collapsed: Set<string>, storage: Storage
   }
 }
 
-
diff --git a/gui/src/provider-workspace/catalog.ts b/gui/src/provider-workspace/catalog.ts
index 847d0ae326..1a80637f5f 100644
--- a/gui/src/provider-workspace/catalog.ts
+++ b/gui/src/provider-workspace/catalog.ts
@@ -38,6 +38,8 @@ export interface WorkspaceProvider {
   models?: string[];
   /** Whether the proxy fetches the provider's live model catalog (default true). */
   liveModels?: boolean;
+  /** False when the canonical provider has no model-list endpoint contract. */
+  liveModelDiscoverySupported?: boolean;
   authMode?: "key" | "forward" | "oauth" | "local" | string;
   keyOptional?: boolean;
   /** Free pricing (may still require an API key). */
diff --git a/gui/tests/models-empty-provider.test.tsx b/gui/tests/models-empty-provider.test.tsx
index 442e96bf17..cccac5aa18 100644
--- a/gui/tests/models-empty-provider.test.tsx
+++ b/gui/tests/models-empty-provider.test.tsx
@@ -8,6 +8,7 @@ import { clearClientResourceStoresForTests } from "../src/client-resource";
 import { LanguageProvider } from "../src/i18n/provider";
 import Models from "../src/pages/Models";
 import { EmptyProviderHint } from "../src/pages/models-provider-hints";
+import { normalizeHashPath } from "../src/hash-routing";
 import type { ProviderDiscoverySummary } from "../src/models-groups";
 import { gatherRoutedModels as gatherRoutedModelsDirect } from "../../src/codex/catalog";
 import { withStubbedProviderFetch } from "../../tests/helpers/catalog-provider-fetch";
@@ -49,10 +50,10 @@ afterEach(() => {
   });
 });
 
-function renderHint(liveModels: boolean, discovery?: ProviderDiscoverySummary): string {
+function renderHint(liveModels: boolean, discovery?: ProviderDiscoverySummary, authMode?: string): string {
   return renderToStaticMarkup(
     <LanguageProvider>
-      <EmptyProviderHint liveModels={liveModels} discovery={discovery} />
+      <EmptyProviderHint liveModels={liveModels} discovery={discovery} authMode={authMode} />
     </LanguageProvider>,
   );
 }
@@ -152,6 +153,7 @@ test("Models page combines final visibility, atomic actions, discovery status, a
     if (url.endsWith("/api/providers")) {
       return Response.json([{
         name: provider,
+        authMode: "oauth",
         liveModels: true,
         models: ids,
         contextWindow: providerContextWindow,
@@ -218,7 +220,10 @@ test("Models page combines final visibility, atomic actions, discovery status, a
     expect(container.textContent).toContain("2/5 visible");
     expect(switchFor("gemini-pro").getAttribute("aria-pressed")).toBe("true");
     expect(switchFor("claude-sonnet").getAttribute("aria-pressed")).toBe("false");
-    expect(container.querySelector(".badge.badge-amber")?.textContent).toContain("Discovery failed");
+    const discoveryBadge = container.querySelector<HTMLElement>(".badge.badge-amber");
+    expect(discoveryBadge?.textContent).toContain("Discovery failed");
+    expect(discoveryBadge?.title).toContain("Re-login to restore live model discovery");
+    expect(discoveryBadge?.title).toContain("Configured models remain available");
     expect(container.textContent).not.toContain("Not selected");
 
     await act(async () => buttonText("Context windows").click());
@@ -546,6 +551,57 @@ test("failed HTTP discovery renders an amber status badge and reason", () => {
   expect(html).toContain('class="badge badge-amber"');
   expect(html).toContain('role="status"');
   expect(html).toContain('class="link-btn"');
+  expect(html).toContain("Configured models remain available");
+  expect(html).toContain("Check the endpoint or disable live model discovery");
+});
+
+test("OAuth discovery failure tells the user to re-login", () => {
+  const html = renderHint(true, { status: "failed", reason: "http", httpStatus: 400 }, "oauth");
+  expect(html).toContain("Re-login to restore live model discovery");
+  expect(html).toContain("Configured models remain available");
+  expect(html).toContain("Open provider settings");
+  expect(html).not.toContain("Open provider login");
+});
+
+test("Open provider settings navigates to the Providers route", async () => {
+  const domGlobals = ["document", "window", "IS_REACT_ACT_ENVIRONMENT"] as const;
+  const previousDescriptors = Object.fromEntries(
+    domGlobals.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]),
+  ) as Record<(typeof domGlobals)[number], PropertyDescriptor | undefined>;
+  const win = new Window({ url: "http://localhost/#models" });
+  const container = win.document.createElement("div");
+  win.document.body.append(container);
+  let root: Root | undefined;
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: win.document },
+    window: { configurable: true, value: win },
+    IS_REACT_ACT_ENVIRONMENT: { configurable: true, value: true },
+  });
+
+  try {
+    const { createRoot } = await import("react-dom/client");
+    await act(async () => {
+      root = createRoot(container);
+      root.render(
+        <LanguageProvider>
+          <EmptyProviderHint liveModels discovery={{ status: "failed", reason: "http", httpStatus: 401 }} />
+        </LanguageProvider>,
+      );
+    });
+    await act(async () => { await new Promise(resolve => win.setTimeout(resolve, 0)); await Promise.resolve(); });
+    const cta = container.querySelector<HTMLButtonElement>("button.link-btn")!;
+    expect(cta.textContent).toContain("Open provider settings");
+    await act(async () => cta.click());
+    expect(normalizeHashPath(win.location.hash)).toBe("providers");
+  } finally {
+    await act(async () => root?.unmount());
+    win.close();
+    for (const key of domGlobals) {
+      const descriptor = previousDescriptors[key];
+      if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+      else delete (globalThis as Record<string, unknown>)[key];
+    }
+  }
 });
 
 test("failed discovery renders each server-owned reason without provider detail", () => {
diff --git a/gui/tests/provider-settings-live-models-provenance.test.tsx b/gui/tests/provider-settings-live-models-provenance.test.tsx
index 097780177e..d95c75539f 100644
--- a/gui/tests/provider-settings-live-models-provenance.test.tsx
+++ b/gui/tests/provider-settings-live-models-provenance.test.tsx
@@ -115,3 +115,33 @@ test("changing an explicit false to true sends an explicit liveModels choice", a
   expect(patches[0]?.liveModels).toBe(true);
   await act(async () => { root.unmount(); });
 });
+
+test("an optional-key preset never submits local auth while changing discovery", async () => {
+  const { root, container, patches } = await mountSettings({
+    name: "mimo-free",
+    adapter: "mimo-free",
+    baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
+    defaultModel: "mimo-auto",
+    keyOptional: true,
+    liveModels: true,
+  } as WorkspaceItem);
+  const toggles = container.querySelectorAll<HTMLInputElement>('input[type="checkbox"]');
+
+  await act(async () => { toggles[1]!.click(); });
+  await save(container);
+
+  expect(patches[0]).toMatchObject({ authMode: "key", liveModels: false });
+  await act(async () => { root.unmount(); });
+});
+
+test("an unsupported provider disables the live-discovery toggle", async () => {
+  const { root, container } = await mountSettings({
+    ...provider(false),
+    liveModelDiscoverySupported: false,
+  } as WorkspaceItem);
+  const toggles = container.querySelectorAll<HTMLInputElement>('input[type="checkbox"]');
+
+  expect(toggles[1]?.disabled).toBe(true);
+  expect(container.textContent).toContain("This provider has no model-list endpoint. OpenCodex uses its maintained static catalog.");
+  await act(async () => { root.unmount(); });
+});
diff --git a/src/adapters/mimo-free.ts b/src/adapters/mimo-free.ts
index b02ea0d20e..a257e7d4c9 100644
--- a/src/adapters/mimo-free.ts
+++ b/src/adapters/mimo-free.ts
@@ -40,6 +40,18 @@ function randomUserAgent(): string {
   return USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)]!;
 }
 
+function isCanonicalMimoFreeEndpoint(baseUrl: string): boolean {
+  try {
+    const actual = new URL(baseUrl.trim());
+    const expected = new URL(MIMO_CHAT_URL);
+    actual.pathname = actual.pathname.replace(/\/+$/, "") || "/";
+    expected.pathname = expected.pathname.replace(/\/+$/, "") || "/";
+    return actual.toString().replace(/\/$/, "") === expected.toString().replace(/\/$/, "");
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Anonymous per-install client id for the bootstrap `client` field. A random UUID
  * persisted under the config dir (OPENCODEX_HOME-aware) — deliberately NOT derived
@@ -194,6 +206,11 @@ export function injectMimoSystemMarker(body: unknown): unknown {
  * On 401/403, flushes the JWT cache and retries once via fetchResponse.
  */
 export function createMimoFreeAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  if (!isCanonicalMimoFreeEndpoint(provider.baseUrl)) {
+    throw new Error(
+      "The mimo-free adapter only supports the canonical Xiaomi MiMo Free endpoint. Use openai-chat for a custom endpoint.",
+    );
+  }
   const base = createOpenAIChatAdapter(provider);
   // Per-adapter session-affinity id (random, per process instance).
   const sessionId = `ses_${Math.random().toString(36).slice(2, 26)}`;
diff --git a/src/providers/derive.ts b/src/providers/derive.ts
index 0aef212180..97c2d045ea 100644
--- a/src/providers/derive.ts
+++ b/src/providers/derive.ts
@@ -395,13 +395,24 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     modelReasoningEffortMap: prov.modelReasoningEffortMap,
   };
   const seed = providerConfigSeed(entry);
+  // `mimo-free` shipped in legacy rows with either an omitted auth mode or the invalid `local`
+  // mode before the registry key contract became authoritative. Repair authentication only;
+  // an explicit model list remains operator-owned for every canonical legacy shape.
+  const repairLegacyMimoFreeAuth = name === "mimo-free"
+    && (prov.authMode === undefined || prov.authMode === "local")
+    && seed.authMode === "key";
+  if (repairLegacyMimoFreeAuth) prov.authMode = "key";
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
   if (prov.responsesPath === undefined && seed.responsesPath !== undefined) prov.responsesPath = seed.responsesPath;
   // Fill mode only when absent: an explicit persisted `direct` must never be overwritten.
   if (prov.codexAccountMode === undefined && seed.codexAccountMode !== undefined) prov.codexAccountMode = seed.codexAccountMode;
   if (!prov.models && seed.models) prov.models = [...seed.models];
-  if (prov.liveModels === undefined && seed.liveModels !== undefined) prov.liveModels = seed.liveModels;
+  // An exact canonical preset with a static-only registry contract cannot honor a stale saved
+  // discovery opt-in: there is no supported endpoint to call. Custom destinations fail the
+  // transport match above and keep their explicit operator setting.
+  if (entry.liveModelDiscoverySupported === false) prov.liveModels = false;
+  else if (prov.liveModels === undefined && seed.liveModels !== undefined) prov.liveModels = seed.liveModels;
   if (prov.contextWindow === undefined && seed.contextWindow !== undefined) prov.contextWindow = seed.contextWindow;
   if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
   if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
diff --git a/src/providers/registry.ts b/src/providers/registry.ts
index 975f778782..838fbaa492 100644
--- a/src/providers/registry.ts
+++ b/src/providers/registry.ts
@@ -149,6 +149,8 @@ export interface ProviderRegistryEntry {
   defaultModel?: string;
   models?: string[];
   liveModels?: boolean;
+  /** Registry-only capability: false when the provider has no model-list endpoint contract. */
+  liveModelDiscoverySupported?: false;
   /**
    * Registry-only per-model wire defaults for mixed OpenAI-compatible gateways.
    * These are intentionally not seeded into saved config: an explicit `modelAdapters`
@@ -860,6 +862,7 @@ const CLINE_PASS_MODELS = [
   "cline-pass/mimo-v2.5",
   "cline-pass/mimo-v2.5-pro",
   "cline-pass/minimax-m3",
+  "cline-pass/qwen3.8-max",
   "cline-pass/qwen3.7-max",
   "cline-pass/qwen3.7-plus",
 ];
@@ -884,9 +887,10 @@ const CLINE_PASS_IMAGE_MODELS = new Set([
   "cline-pass/minimax-m3",
   "cline-pass/qwen3.7-plus",
 ]);
-const CLINE_PASS_TEXT_ONLY_MODELS = CLINE_PASS_MODELS.filter(id => !CLINE_PASS_IMAGE_MODELS.has(id));
+const CLINE_PASS_MODALITY_KNOWN_MODELS = CLINE_PASS_MODELS.filter(id => id !== "cline-pass/qwen3.8-max");
+const CLINE_PASS_TEXT_ONLY_MODELS = CLINE_PASS_MODALITY_KNOWN_MODELS.filter(id => !CLINE_PASS_IMAGE_MODELS.has(id));
 const CLINE_PASS_MODEL_INPUT_MODALITIES: Record<string, string[]> = Object.fromEntries(
-  CLINE_PASS_MODELS.map(id => [id, CLINE_PASS_IMAGE_MODELS.has(id) ? ["text", "image"] : ["text"]]),
+  CLINE_PASS_MODALITY_KNOWN_MODELS.map(id => [id, CLINE_PASS_IMAGE_MODELS.has(id) ? ["text", "image"] : ["text"]]),
 );
 
 export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
@@ -1299,6 +1303,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     baseUrl: "https://api.cline.bot/api/v1",
     authKind: "key",
     dashboardUrl: "https://app.cline.bot",
+    // Cline documents the static ClinePass catalog and Chat Completions endpoint, but no
+    // OpenAI-style GET /models route. Do not probe the API base with an unsupported endpoint.
+    liveModelDiscoverySupported: false,
+    liveModels: false,
     defaultModel: "cline-pass/kimi-k3",
     models: CLINE_PASS_MODELS,
     modelContextWindows: CLINE_PASS_MODEL_CONTEXT_WINDOWS,
@@ -2357,7 +2365,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     authKind: "key",
     keyOptional: true,
     featured: true,
-    liveModels: true,
+    preserveCustomDestination: true,
+    // This bespoke JWT-backed chat endpoint has no model-list contract. The single maintained
+    // model below is authoritative; appending /models only produces a misleading HTTP 400.
+    liveModelDiscoverySupported: false,
+    liveModels: false,
     dashboardUrl: "https://xiaomimimo.com",
     defaultModel: "mimo-auto",
     models: ["mimo-auto"],
@@ -2481,7 +2493,11 @@ export function providerMatchesRegistryTransport(
   if (entry.allowBaseUrlOverride || /\{[^}]*\}/.test(entry.baseUrl)) return false;
   if (typeof provider.baseUrl !== "string") return false;
   if (provider.adapter !== entry.adapter) return false;
-  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  // MiMo Free was previously persisted as `local` by the dashboard despite this exact
+  // key-optional transport being registry-owned key auth. Admit only that legacy combination
+  // so enrichment can repair it; every other non-key mode still fails closed.
+  if (provider.authMode !== undefined && provider.authMode !== "key"
+    && !(id === "mimo-free" && provider.authMode === "local")) return false;
   return normalizedProviderEndpoint(provider.baseUrl) === normalizedProviderEndpoint(entry.baseUrl);
 }
 
diff --git a/src/router.ts b/src/router.ts
index 12edcd532f..293d62a3f9 100644
--- a/src/router.ts
+++ b/src/router.ts
@@ -254,12 +254,15 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
   }
   const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
+  const repairLegacyMimoFreeAuth = providerName === "mimo-free"
+    && (provider.authMode === undefined || provider.authMode === "local");
   const explicitKeyOverride = registryEntry.authKind === "oauth"
     && registryEntry.allowKeyAuthOverride === true
     && provider.authMode === "key"
     && resolvedApiKey !== undefined;
   const canonicalAuthMode = explicitKeyOverride
     ? "key"
+    : repairLegacyMimoFreeAuth ? "key"
     : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
       ? registryEntry.authKind
     : provider.authMode === "forward" ? undefined : provider.authMode;
@@ -343,6 +346,9 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       : {}),
     authMode: canonicalAuthMode,
     apiKey: resolvedApiKey,
+    ...(registryEntry.liveModelDiscoverySupported === false
+      ? { liveModels: false }
+      : {}),
     // Backfill the Google wire mode + Vertex project/location from the registry when the user
     // config omits them, so a minimal `google-vertex`/`google-antigravity` entry still routes
     // through the correct branch (CCA/Vertex) instead of falling back to AI Studio.
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index dd7742cc02..14a6368d5a 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -19,7 +19,7 @@ import {
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
-import { providerConfigSeed } from "../providers/derive";
+import { enrichProviderFromRegistry, providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
@@ -564,7 +564,9 @@ export function copyIfDefined<K extends keyof OcxProviderConfig>(
 /** Public dashboard DTO for config.json: provider entries with secrets stripped and documented fields exposed (including `modelCosts`). */
 export function safeConfigDTO(config: OcxConfig): unknown {
   const providers: Record<string, Record<string, unknown>> = {};
-  for (const [name, provider] of Object.entries(config.providers)) {
+  for (const [name, configuredProvider] of Object.entries(config.providers)) {
+    const provider = { ...configuredProvider };
+    enrichProviderFromRegistry(name, provider);
     const dto: Record<string, unknown> = {
       adapter: provider.adapter,
       baseUrl: publicProviderBaseUrl(provider.baseUrl),
@@ -609,10 +611,13 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     // still pointed at the same vendor route, and a usage restriction the user needs to see
     // must not disappear because the row was renamed. Prefer the same-name entry so an
     // unrenamed provider keeps its exact registry note.
-    const registryNote = (providerMatchesRegistryTransport(name, provider)
+    const sameNameRegistryEntry = providerMatchesRegistryTransport(name, provider)
       ? getProviderRegistryEntry(name)
-      : registryEntryForProviderDestination(provider))?.note;
+      : undefined;
+    const registryEntry = sameNameRegistryEntry ?? registryEntryForProviderDestination(provider);
+    const registryNote = registryEntry?.note;
     if (typeof registryNote === "string" && registryNote.trim()) dto.note = registryNote;
+    if (sameNameRegistryEntry?.liveModelDiscoverySupported === false) dto.liveModelDiscoverySupported = false;
     const codexAccountMode = providerCodexAccountMode(name, provider);
     if (codexAccountMode) dto.codexAccountMode = codexAccountMode;
     providers[name] = dto;
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index 116fee697a..3846475d60 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -33,7 +33,7 @@ import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { ProviderOutboundPolicyError, providerOutboundGet, providerOutboundPost, providerRedirectError } from "../../lib/provider-outbound";
 import { parseAntigravityAvailableModels } from "../../providers/antigravity-models";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
-import { deriveProviderPresets } from "../../providers/derive";
+import { deriveProviderPresets, enrichProviderFromRegistry } from "../../providers/derive";
 import { effectiveGoogleMode, providerCodexAccountMode, providerMatchesRegistryTransport } from "../../providers/registry";
 import {
   extractModelEnvelopeRows,
@@ -93,6 +93,14 @@ type ProviderPatchApplication =
       headersTouched: boolean;
     };
 
+function providerSupportsLiveModelDiscovery(name: string, provider: OcxProviderConfig): boolean {
+  const entry = getProviderRegistryEntry(name);
+  return !(
+    entry?.liveModelDiscoverySupported === false
+    && providerMatchesRegistryTransport(name, provider)
+  );
+}
+
 /**
  * Apply the recognized PATCH field mask onto a provider copy. The caller runs this once
  * for validation and again inside the config mutation lock against the newest provider,
@@ -174,6 +182,9 @@ function applyProviderPatchFields(
   }
   if (Object.hasOwn(rawBody, "liveModels")) {
     if (typeof rawBody.liveModels !== "boolean") return { error: "liveModels must be a boolean" };
+    if (rawBody.liveModels && !providerSupportsLiveModelDiscovery(name, next)) {
+      return { error: "live model discovery is not supported for this provider" };
+    }
     next.liveModels = rawBody.liveModels;
     touched = true;
   }
@@ -305,23 +316,31 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
   }
 
   if (url.pathname === "/api/providers" && req.method === "GET") {
-    return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
+    return jsonResponse(Object.entries(config.providers).map(([name, configured]) => {
+      const p = { ...configured };
+      enrichProviderFromRegistry(name, p);
+      const registryEntry = providerMatchesRegistryTransport(name, configured)
+        ? getProviderRegistryEntry(name)
+        : undefined;
+      return ({
       name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
       hasApiKey: !!p.apiKey,
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
       liveModels: p.liveModels !== false,
+      liveModelDiscoverySupported: registryEntry?.liveModelDiscoverySupported !== false,
       models: p.models ?? [],
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
       noStructuredOutputModels: p.noStructuredOutputModels,
-      authMode: p.authMode,
+      authMode: p.authMode ?? registryEntry?.authKind,
       apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
-    })));
+      });
+    }));
   }
 
   if (url.pathname === LOCAL_PROVIDER_RELOAD_PATH && req.method === "POST") {
@@ -626,7 +645,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         message: "Passthrough provider is configured (forwards your Codex login; no upstream /models).",
       });
     }
-    if (prov.liveModels === false) {
+    if (prov.liveModels === false || !providerSupportsLiveModelDiscovery(name, prov)) {
       // A static catalog has no live discovery endpoint to test. This is neither
       // positive connectivity evidence nor an outage, and it must stay before
       // credential resolution/network access for providers such as Antigravity.
diff --git a/tests/cline-pass-provider.test.ts b/tests/cline-pass-provider.test.ts
index c90896154a..a333cd9d0c 100644
--- a/tests/cline-pass-provider.test.ts
+++ b/tests/cline-pass-provider.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { createOpenAIChatAdapter } from "../src/adapters/openai-chat";
 import { createTranslatorBudget } from "../src/lib/translator-budget";
 import { KEY_LOGIN_PROVIDERS } from "../src/oauth/key-providers";
-import { providerConfigSeed } from "../src/providers/derive";
+import { enrichProviderFromRegistry, providerConfigSeed } from "../src/providers/derive";
 import { PROVIDER_REGISTRY } from "../src/providers/registry";
 import { routeModel } from "../src/router";
 import type { OcxConfig, OcxParsedRequest } from "../src/types";
@@ -17,6 +17,7 @@ const OFFICIAL_CLINE_PASS_MODELS = [
   "cline-pass/mimo-v2.5",
   "cline-pass/mimo-v2.5-pro",
   "cline-pass/minimax-m3",
+  "cline-pass/qwen3.8-max",
   "cline-pass/qwen3.7-max",
   "cline-pass/qwen3.7-plus",
 ];
@@ -63,7 +64,7 @@ describe("ClinePass provider", () => {
     });
     expect(entry?.models).toEqual(OFFICIAL_CLINE_PASS_MODELS);
     expect(entry?.models).toContain(entry?.defaultModel);
-    expect(entry?.liveModels).toBeUndefined();
+    expect(entry?.liveModels).toBe(false);
     expect(entry?.reasoningEfforts).toEqual(["low", "medium", "high", "xhigh", "max"]);
     expect(entry?.modelReasoningEfforts).toBeUndefined();
     expect(entry?.modelMaxInputTokens).toBeUndefined();
@@ -74,6 +75,7 @@ describe("ClinePass provider", () => {
       "cline-pass/mimo-v2.5-pro",
       "cline-pass/qwen3.7-max",
     ]);
+    expect(entry?.modelInputModalities?.["cline-pass/qwen3.8-max"]).toBeUndefined();
     expect(entry?.modelInputModalities?.["cline-pass/kimi-k3"]).toEqual(["text", "image"]);
     expect(entry?.modelInputModalities?.["cline-pass/glm-5.2"]).toEqual(["text"]);
     expect(KEY_LOGIN_PROVIDERS["cline-pass"]?.models).toEqual(OFFICIAL_CLINE_PASS_MODELS);
@@ -112,6 +114,14 @@ describe("ClinePass provider", () => {
     });
   });
 
+  test("canonical transport overrides a stale saved live-discovery opt-in", () => {
+    const provider = { ...providerConfigSeed(registryEntry()), liveModels: true };
+
+    enrichProviderFromRegistry("cline-pass", provider);
+
+    expect(provider.liveModels).toBe(false);
+  });
+
   test("explicit reasoning disable uses the gateway object instead of leaking reasoning_effort", () => {
     const provider = providerConfigSeed(PROVIDER_REGISTRY.find(entry => entry.id === "cline-pass")!);
     const request = createOpenAIChatAdapter({ ...provider, apiKey: "cline-test-key" })
diff --git a/tests/mimo-free-model-preservation.test.ts b/tests/mimo-free-model-preservation.test.ts
new file mode 100644
index 0000000000..c66d1b5850
--- /dev/null
+++ b/tests/mimo-free-model-preservation.test.ts
@@ -0,0 +1,80 @@
+import { expect, test } from "bun:test";
+import { PROVIDER_REGISTRY } from "../src/providers/registry";
+import { enrichProviderFromRegistry, providerConfigSeed } from "../src/providers/derive";
+import { routeModel } from "../src/router";
+import type { OcxConfig, OcxProviderConfig } from "../src/types";
+
+test("static-only canonical key provider preserves explicit configured models", () => {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === "mimo-free")!;
+  const provider = {
+    ...providerConfigSeed(entry),
+    models: ["mimo-auto", "preview-model"],
+    liveModels: true,
+  };
+
+  enrichProviderFromRegistry("mimo-free", provider);
+
+  expect(provider.liveModels).toBe(false);
+  expect(provider.models).toEqual(["mimo-auto", "preview-model"]);
+
+  const config: OcxConfig = {
+    port: 10100,
+    defaultProvider: "mimo-free",
+    providers: { "mimo-free": provider },
+  };
+  const route = routeModel(config, "mimo-free/mimo-auto");
+  expect(route.provider.liveModels).toBe(false);
+  expect(route.provider.models).toEqual(["mimo-auto", "preview-model"]);
+});
+
+test("legacy canonical MiMo row repairs auth without replacing explicit models", () => {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === "mimo-free")!;
+  const provider: OcxProviderConfig = {
+    adapter: "mimo-free",
+    baseUrl: entry.baseUrl,
+    liveModels: true,
+    models: ["mimo-auto", "preview-model"],
+  };
+
+  enrichProviderFromRegistry("mimo-free", provider);
+
+  expect(provider).toMatchObject({
+    authMode: "key",
+    liveModels: false,
+    models: ["mimo-auto", "preview-model"],
+  });
+
+  const config: OcxConfig = {
+    port: 10100,
+    defaultProvider: "mimo-free",
+    providers: { "mimo-free": {
+      adapter: "mimo-free",
+      baseUrl: entry.baseUrl,
+      liveModels: true,
+      models: ["mimo-auto", "preview-model"],
+    } },
+  };
+  const route = routeModel(config, "mimo-free/mimo-auto");
+  expect(route.provider).toMatchObject({
+    authMode: "key",
+    liveModels: false,
+    models: ["mimo-auto", "preview-model"],
+  });
+});
+
+test("legacy canonical MiMo row without models receives the registry default", () => {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === "mimo-free")!;
+  const provider: OcxProviderConfig = {
+    adapter: "mimo-free",
+    baseUrl: entry.baseUrl,
+    liveModels: true,
+  };
+
+  enrichProviderFromRegistry("mimo-free", provider);
+
+  expect(provider).toMatchObject({
+    authMode: "key",
+    liveModels: false,
+    models: ["mimo-auto"],
+  });
+});
diff --git a/tests/mimo-free-provider.test.ts b/tests/mimo-free-provider.test.ts
index a97ece2378..317b7437c2 100644
--- a/tests/mimo-free-provider.test.ts
+++ b/tests/mimo-free-provider.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, test, mock, beforeEach } from "bun:test";
 import { PROVIDER_REGISTRY } from "../src/providers/registry";
-import { providerConfigSeed, deriveKeyLoginMap, deriveFeaturedProviderIds } from "../src/providers/derive";
+import { providerConfigSeed, deriveKeyLoginMap, deriveFeaturedProviderIds, enrichProviderFromRegistry } from "../src/providers/derive";
+import { routeModel } from "../src/router";
 import {
   getMimoClientId,
   resetMimoClientIdCache,
@@ -11,7 +12,7 @@ import {
   MIMO_CHAT_URL,
   createMimoFreeAdapter,
 } from "../src/adapters/mimo-free";
-import type { OcxParsedRequest, OcxProviderConfig } from "../src/types";
+import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../src/types";
 
 function minimalRequest(model = "mimo-auto"): OcxParsedRequest {
   return {
@@ -32,14 +33,74 @@ describe("mimo-free provider registry", () => {
     expect(entry?.authKind).toBe("key");
     expect(entry?.keyOptional).toBe(true);
     expect(entry?.featured).toBe(true);
-    expect(entry?.liveModels).toBe(true);
+    expect(entry?.preserveCustomDestination).toBe(true);
+    expect(entry?.liveModels).toBe(false);
     expect(entry?.defaultModel).toBe("mimo-auto");
   });
 
   test("providerConfigSeed propagates keyOptional and liveModels", () => {
     const seed = providerConfigSeed(entry!);
     expect(seed.keyOptional).toBe(true);
-    expect(seed.liveModels).toBe(true);
+    expect(seed.liveModels).toBe(false);
+  });
+
+  test("canonical transport overrides a stale saved live-discovery opt-in", () => {
+    const provider = { ...providerConfigSeed(entry!), liveModels: true };
+
+    enrichProviderFromRegistry("mimo-free", provider);
+
+    expect(provider.liveModels).toBe(false);
+  });
+
+  test("canonical transport repairs the legacy optional-key local auth mode", () => {
+    const provider = { ...providerConfigSeed(entry!), authMode: "local" as const, liveModels: true };
+
+    enrichProviderFromRegistry("mimo-free", provider);
+
+    expect(provider.authMode).toBe("key");
+    expect(provider.liveModels).toBe(false);
+  });
+
+  test("request routing repairs canonical auth while preserving configured models", () => {
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: "mimo-free",
+      providers: {
+        "mimo-free": {
+          adapter: "mimo-free",
+          baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
+          authMode: "local",
+          liveModels: true,
+          models: ["stale-model"],
+        },
+      },
+    };
+
+    const route = routeModel(config, "mimo-free/mimo-auto");
+
+    expect(route.provider).toMatchObject({
+      authMode: "key",
+      liveModels: false,
+      models: ["stale-model"],
+    });
+  });
+
+  test("same-named custom transport keeps its configured catalog and discovery setting", () => {
+    const provider: OcxProviderConfig = {
+      adapter: "mimo-free",
+      baseUrl: "https://custom.example/free-chat",
+      authMode: "key",
+      models: ["custom-model"],
+      liveModels: true,
+    };
+
+    enrichProviderFromRegistry("mimo-free", provider);
+
+    expect(provider).toMatchObject({
+      baseUrl: "https://custom.example/free-chat",
+      models: ["custom-model"],
+      liveModels: true,
+    });
   });
 
   test("is included in the key-login map", () => {
diff --git a/tests/provider-discovery-capability.test.ts b/tests/provider-discovery-capability.test.ts
new file mode 100644
index 0000000000..1981e1847e
--- /dev/null
+++ b/tests/provider-discovery-capability.test.ts
@@ -0,0 +1,24 @@
+import { expect, test } from "bun:test";
+import { safeConfigDTO } from "../src/server/auth-cors";
+import type { OcxConfig } from "../src/types";
+
+test("renamed provider does not inherit another preset static discovery capability", () => {
+  const dto = safeConfigDTO({
+    port: 10100,
+    defaultProvider: "my-cline",
+    providers: {
+      "my-cline": {
+        adapter: "openai-chat",
+        baseUrl: "https://api.cline.bot/api/v1",
+        authMode: "key",
+        liveModels: true,
+        models: ["anthropic/claude-sonnet-4-6"],
+      },
+    },
+  } as OcxConfig) as {
+    providers: Record<string, { liveModels?: boolean; liveModelDiscoverySupported?: boolean }>;
+  };
+
+  expect(dto.providers["my-cline"]?.liveModels).toBe(true);
+  expect(dto.providers["my-cline"]?.liveModelDiscoverySupported).not.toBe(false);
+});
diff --git a/tests/provider-discovery-safety-regressions.test.ts b/tests/provider-discovery-safety-regressions.test.ts
new file mode 100644
index 0000000000..f9b01729e7
--- /dev/null
+++ b/tests/provider-discovery-safety-regressions.test.ts
@@ -0,0 +1,90 @@
+import { afterEach, expect, test } from "bun:test";
+import { createMimoFreeAdapter, MIMO_CHAT_URL } from "../src/adapters/mimo-free";
+import { handleManagementAPI } from "../src/server/management-api";
+import type { OcxConfig, OcxProviderConfig } from "../src/types";
+import { ManagementRequest as Request } from "./helpers/management-auth";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+test("mimo-free adapter fails closed for a custom destination", () => {
+  const provider: OcxProviderConfig = {
+    adapter: "mimo-free",
+    baseUrl: "https://custom.example/free-chat",
+    authMode: "key",
+  };
+
+  expect(() => createMimoFreeAdapter(provider)).toThrow(/canonical Xiaomi MiMo Free endpoint/i);
+});
+
+test("mimo-free adapter accepts the canonical destination with a trailing slash", () => {
+  const provider: OcxProviderConfig = {
+    adapter: "mimo-free",
+    baseUrl: `${MIMO_CHAT_URL}/`,
+    authMode: "key",
+  };
+
+  expect(() => createMimoFreeAdapter(provider)).not.toThrow();
+});
+
+test("canonical static provider ignores stale liveModels true without network access", async () => {
+  let fetches = 0;
+  globalThis.fetch = (async () => {
+    fetches += 1;
+    return new Response("unsupported", { status: 400 });
+  }) as typeof fetch;
+
+  const config: OcxConfig = {
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "cline-pass",
+    providers: {
+      "cline-pass": {
+        adapter: "openai-chat",
+        baseUrl: "https://api.cline.bot/api/v1",
+        authMode: "key",
+        apiKey: "test-key",
+        liveModels: true,
+        models: ["cline-pass/kimi-k3"],
+      },
+    },
+  };
+  const req = new Request("http://127.0.0.1/api/providers/test?name=cline-pass", { method: "POST" });
+  const res = await handleManagementAPI(req, new URL(req.url), config, {});
+  if (!res) throw new Error("handler returned no response");
+
+  expect(await res.json()).toEqual({ applicable: false, reason: "static_catalog", latencyMs: 0 });
+  expect(fetches).toBe(0);
+});
+
+test("canonical static provider rejects a liveModels true management patch", async () => {
+  const config: OcxConfig = {
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "cline-pass",
+    providers: {
+      "cline-pass": {
+        adapter: "openai-chat",
+        baseUrl: "https://api.cline.bot/api/v1",
+        authMode: "key",
+        apiKey: "test-key",
+        liveModels: false,
+        models: ["cline-pass/kimi-k3"],
+      },
+    },
+  };
+  const req = new Request("http://127.0.0.1/api/providers?name=cline-pass", {
+    method: "PATCH",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ liveModels: true }),
+  });
+  const res = await handleManagementAPI(req, new URL(req.url), config, {});
+  if (!res) throw new Error("handler returned no response");
+
+  expect(res.status).toBe(400);
+  expect(await res.json()).toEqual({ error: "live model discovery is not supported for this provider" });
+  expect(config.providers["cline-pass"]?.liveModels).toBe(false);
+});
diff --git a/tests/provider-static-registry-management.test.ts b/tests/provider-static-registry-management.test.ts
new file mode 100644
index 0000000000..f05f6af631
--- /dev/null
+++ b/tests/provider-static-registry-management.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { clearModelCache, markProviderDiscoveryFailed } from "../src/codex/model-cache";
+import { handleManagementAPI } from "../src/server/management-api";
+import { ManagementRequest as Request } from "./helpers/management-auth";
+
+describe("static-only provider management", () => {
+  test("provider list repairs registry metadata without replacing saved models", async () => {
+    markProviderDiscoveryFailed("mimo-free", { reason: "http", httpStatus: 400 });
+    markProviderDiscoveryFailed("cline-pass", { reason: "http", httpStatus: 404 });
+    try {
+      const requestUrl = new URL("http://127.0.0.1/api/providers");
+      const response = await handleManagementAPI(
+        new Request(requestUrl),
+        requestUrl,
+        {
+          port: 10100,
+          defaultProvider: "mimo-free",
+          providers: {
+            "mimo-free": {
+              adapter: "mimo-free",
+              baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
+              authMode: "local",
+              liveModels: true,
+              models: ["mimo-auto", "preview-model"],
+            },
+            "cline-pass": {
+              adapter: "openai-chat",
+              baseUrl: "https://api.cline.bot/api/v1",
+              authMode: "key",
+              liveModels: true,
+              models: ["cline-pass/kimi-k3"],
+            },
+          },
+        },
+      );
+      const providers = await response!.json() as Array<Record<string, unknown>>;
+
+      expect(providers.find(provider => provider.name === "mimo-free")).toMatchObject({
+        authMode: "key",
+        liveModels: false,
+        liveModelDiscoverySupported: false,
+        models: ["mimo-auto", "preview-model"],
+      });
+      expect(providers.find(provider => provider.name === "mimo-free")).not.toHaveProperty("discovery");
+      expect(providers.find(provider => provider.name === "cline-pass")).toMatchObject({
+        liveModels: false,
+        liveModelDiscoverySupported: false,
+        models: ["cline-pass/kimi-k3"],
+      });
+      expect(providers.find(provider => provider.name === "cline-pass")).not.toHaveProperty("discovery");
+    } finally {
+      clearModelCache();
+    }
+  });
+});
diff --git a/tests/server-auth.test.ts b/tests/server-auth.test.ts
index 1a5f78fc7a..d5e9f0adb7 100644
--- a/tests/server-auth.test.ts
+++ b/tests/server-auth.test.ts
@@ -490,8 +490,10 @@ describe("server local API auth", () => {
         "mimo-free": {
           adapter: "mimo-free",
           baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
-          authMode: "key",
+          authMode: "local",
           keyOptional: true,
+          liveModels: true,
+          models: ["stale-model"],
         },
       },
     } as OcxConfig) as {
@@ -509,6 +511,9 @@ describe("server local API auth", () => {
       adapter: "mimo-free",
       authMode: "key",
       keyOptional: true,
+      liveModelDiscoverySupported: false,
+      liveModels: false,
+      models: ["stale-model"],
       hasApiKey: false,
     });
   });