test(catalog): guard the dated fold's direction at the merge loop, not the predicate

#3034 widens the dated-suffix matcher and pins it with a predicate test that the
fold stays one-way: isDatedVariantId("deepseek-v4-pro", "deepseek-v4-pro-0813")
is false. That assertion is true of every implementation, including one whose
merge loop calls the predicate a second time with the arguments swapped -- which
is exactly what #3041 originally proposed and then withdrew.

So the guard is moved to where the resurrection would actually happen. These
three drive mergeConfiguredModelsIntoLiveCatalog itself, carried from #3041:

- a live base row must not resurrect a configured dated id
- a live MMDD dated row still folds onto its configured base
- a dated id named in retainConfiguredModelIds survives

Both directions were mutation-checked. Adding
|| isDatedVariantId(candidate.id, live.id) to the merge loop fails only the
first test (253 pass / 1 fail); narrowing the suffix back to /^\d{8}$/ fails 13,
including the MMDD and YYMM folds. Neither mutation is caught by the predicate
test alone.

The retention test is labelled for what it actually covers: production fills
retainConfiguredModelIds from combo targets, not from providers.*.models, so it
pins the OCX-111 path. The operator-facing opt-in is #1690's retainModels, which
does not exist yet -- and until it does, the dated id #3024 reports is still
dropped. This lands the safe half of #3024 and says so.

(cherry picked from commit a909682)

Author: lidge-jun

tests/codex-catalog.test.ts

@@ -3,7 +3,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { applyNativeVisibility, augmentRoutedModelsWithMetadata, augmentRoutedModelsWithRegistryOpenAiApiRows, buildCatalogEntries, buildComboCatalogOmission, catalogModelSlug, clampCatalogModelsToCodexSupport, clampEntryToCodexSupportedEfforts, clampedDefaultEffort, CODEX_ACCOUNT_BOUND_CATALOG_KIND, CODEX_NATIVE_ALIAS_CATALOG_KIND, comboCatalogOmissionReason, deriveComboCatalogModel, exactComboCatalogSlugs, filterCatalogVisibleModels, filterSupportedNativeSlugs, gatherRoutedModels as gatherRoutedModelsDirect, isDatedVariantId, isMediaGenerationModelId, loadBundledCodexCatalog, materializeBundledCodexCatalog, mergeCatalogEntriesForSync, NATIVE_DAYBREAK_BLUE_MODEL, NATIVE_OPENAI_MODELS, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiCapabilitySourceSlug, nativeOpenAiContextWindow, nativeReasoningEfforts, normalizeRoutedCatalogEntry, resetCatalogRuntimeStateForTests, resetOpenAiApiCatalogWarningStateForTests, resolveComboCatalogMember, shouldExposeRoutedModel, upstreamNativeEntry } from "../src/codex/catalog";
-import { applyProviderConfigHints } from "../src/codex/catalog/provider-fetch";
+import { applyProviderConfigHints, mergeConfiguredModelsIntoLiveCatalog } from "../src/codex/catalog/provider-fetch";
 import {
   CODEX_CUSTOM_MODEL_CATALOG_KIND,
   CODEX_PROVIDER_MODEL_CATALOG_KIND,
@@ -3713,6 +3713,49 @@ describe("Codex catalog routed normalization", () => {
     expect(isDatedVariantId("deepseek-v4-pro", "deepseek-v4-pro-0813")).toBe(false);
   });
 
+  // The predicate test above is necessary and not sufficient: it passes on any
+  // implementation, including one whose MERGE LOOP calls the predicate a second time with
+  // the arguments swapped. These three drive `mergeConfiguredModelsIntoLiveCatalog` itself,
+  // so they fail if the loop ever becomes bidirectional. Carried from #3041, where the
+  // reverse fold was proposed and then withdrawn — the guard outlives the proposal.
+  test("the merge loop does not infer a configured dated id from a live base id", () => {
+    const { models, droppedConfiguredIds } = mergeConfiguredModelsIntoLiveCatalog({
+      name: "deepseek",
+      provider: {},
+      models: [{ id: "deepseek-v4-pro" } as never],
+      configured: [{ id: "deepseek-v4-pro-0813" } as never],
+    });
+    expect(droppedConfiguredIds).toEqual(["deepseek-v4-pro-0813"]);
+    expect(models.map(m => m.id)).not.toContain("deepseek-v4-pro-0813");
+  });
+
+  test("the merge loop folds a live MMDD dated row onto its configured base", () => {
+    const { models, droppedConfiguredIds } = mergeConfiguredModelsIntoLiveCatalog({
+      name: "deepseek",
+      provider: {},
+      models: [{ id: "deepseek-v4-pro-0813" } as never],
+      configured: [{ id: "deepseek-v4-pro" } as never],
+    });
+    expect(droppedConfiguredIds).toEqual([]);
+    expect(models.map(m => m.id)).toContain("deepseek-v4-pro");
+  });
+
+  // Retention of a dated id is a decision someone made, not an inference from a name.
+  // Note what this set actually is: production fills `retainConfiguredModelIds` from combo
+  // targets, not from `providers.*.models`, so this pins the combo-target path (OCX-111).
+  // The operator-facing opt-in is #1690's `retainModels`, which does not exist yet.
+  test("a dated id named in retainConfiguredModelIds survives the drop", () => {
+    const { models, droppedConfiguredIds } = mergeConfiguredModelsIntoLiveCatalog({
+      name: "deepseek",
+      provider: {},
+      models: [{ id: "deepseek-v4-pro" } as never],
+      configured: [{ id: "deepseek-v4-pro-0813" } as never],
+      retainConfiguredModelIds: new Set(["deepseek-v4-pro-0813"]),
+    });
+    expect(droppedConfiguredIds).toEqual([]);
+    expect(models.map(m => m.id)).toContain("deepseek-v4-pro-0813");
+  });
+
   test("disabled providers are excluded from routed model gathering", async () => {
     const models = await gatherRoutedModels({
       port: 10100,