[WRONG BRANCH] fix(cursor): prevent cross-account Max Mode capability leakage

src/adapters/cursor/catalog.ts

@@ -441,8 +441,8 @@ function composeWireId(baseId: string, kind: CursorVariantKind, effort: string |
  * Legacy slugs (thinking/fast/-1m variants) keep resolving forever — picker
  * rows shrink, routability does not (alias-retention contract, 003).
  *
- * `liveMaxModeIds` optionally extends the static maxMode evidence with the
- * bases the live GetUsableModels roster flags (union semantics).
+ * `liveMaxModeIds` optionally extends the static maxMode evidence with
+ * route-scoped bases from the selected account's GetUsableModels roster.
  */
 export function resolveCursorSelection(
   pickedId: string,
@@ -465,32 +465,10 @@ export function resolveCursorSelection(
     ? `${capability.wirePrefix}${canonicalId}`
     : canonicalId;
   const ultraRequested = parsed.ultra || reasoning?.toLowerCase() === "ultra";
-  const evidence = liveMaxModeIds ?? liveCursorMaxModeBases;
-  const maxModeArmed = capability.maxModeVerified === true || evidence.has(parsed.baseId);
+  const maxModeArmed = capability.maxModeVerified === true || liveMaxModeIds?.has(parsed.baseId) === true;
   return { wireId, canonicalId, maxMode: ultraRequested && maxModeArmed, known: true };
 }
 
-/**
- * Live Max-Mode evidence (GetUsableModels maxModeModels). Provider discovery
- * records the BASES the live roster flags; the resolver unions this with the
- * static `maxModeVerified` gate so ultra generalizes automatically as evidence
- * arrives — never from window size (devlog 260828 blocker-4 fold).
- */
-let liveCursorMaxModeBases: ReadonlySet<string> = new Set();
-
-export function recordLiveCursorMaxModeModels(liveIds: readonly string[]): void {
-  const bases = new Set<string>();
-  for (const id of liveIds) {
-    const parsed = parseCursorVariantId(id);
-    if (parsed.known) bases.add(parsed.baseId);
-  }
-  liveCursorMaxModeBases = bases;
-}
-
-export function liveCursorMaxModeBasesForTests(): ReadonlySet<string> {
-  return liveCursorMaxModeBases;
-}
-
 export interface CursorUmbrellaRow {
   readonly id: string;
   readonly efforts: readonly string[];

src/codex/catalog/provider-fetch.ts

@@ -46,7 +46,6 @@ import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
-import { recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -1328,9 +1327,6 @@ async function fetchProviderModelsWithAuth(
     });
     if (liveResult.ok) {
       const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
-      // Live Max-Mode evidence feeds the umbrella resolver's ultra gate
-      // (devlog 260828_cursor_umbrella_catalog; union with static evidence).
-      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? []);
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.

tests/cursor-umbrella-rows.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import {
   cursorUmbrellaRows,
-  recordLiveCursorMaxModeModels,
   resolveCursorSelection,
 } from "../src/adapters/cursor/catalog";
 import { CURSOR_STATIC_MODELS, cursorModelReasoningEfforts } from "../src/adapters/cursor/discovery";
@@ -81,17 +80,10 @@ describe("cursor umbrella picker rows (devlog 260828_cursor_umbrella_catalog)",
     });
   });
 
-  describe("live Max-Mode evidence generalizes ultra", () => {
-    test("recorded live maxModeModels arm ultra for their bases and reset cleanly", () => {
-      recordLiveCursorMaxModeModels(["claude-opus-4-8-high-fast"]);
-      try {
-        expect(resolveCursorSelection("claude-opus-4-8", "ultra").maxMode).toBe(true);
-        expect(resolveCursorSelection("claude-opus-4-7", "ultra").maxMode).toBe(false);
-      } finally {
-        recordLiveCursorMaxModeModels([]);
-      }
+  describe("Max-Mode evidence stays request-scoped", () => {
+    test("omitted live evidence cannot arm ultra for an unverified base", () => {
       expect(resolveCursorSelection("claude-opus-4-8", "ultra").maxMode).toBe(false);
-      // Static evidence survives the reset.
+      // Static evidence remains available without account-local discovery.
       expect(resolveCursorSelection("kimi-k3", "ultra").maxMode).toBe(true);
     });
   });