[rqzbeh]

Summary

Fixes #11284, following the maintainer's suggested direction: Antigravity OAuth connects that end without a Cloud Code projectId are now persisted as testStatus:"degraded" instead of a silent testStatus:"active" row that showed "Connected" while every model call failed.

Root cause

Production evidence (VPS docker instance, read-only inspection): 5 of 18 stored antigravity rows had project_id="" with providerSpecificData.projectId="" while tier=g1-pro-tier / subscriptionTier="Google AI Pro" were fully populated — the token exchange and loadCodeAssist round-trips succeeded, but Google returned no cloudaicompanionProject. These are Google BYOP accounts (no automatic GCP project creation for standard-tier accounts, #8491): onboardUser answers 200 OK without creating a project. The old connect-time path swallowed that outcome (bare catch / .catch(() => {})) and persisted active-with-empty-projectId; request-time selection then excluded those rows → "No active credentials for provider: antigravity".

Changes

1. Connect-time classification (src/lib/oauth/providers/antigravity.ts): postExchangeAntigravity now reports why no project was found —
   • requires_manual_project: onboardUser answered 200 without cloudaicompanionProject in the body (BYOP; retrying can never succeed);
   • discovery_failed: loadCodeAssist/onboardUser errored, timed out, or stayed empty after onboarding.
     A projectId present directly in the onboardUser response is used when discovery lags behind server-side project creation.
2. Degrade-marking at connect (src/lib/oauth/antigravityProjectGate.ts + [action]/route.ts exchange/poll-callback + connectionPersistence.ts): the connection IS saved, but with testStatus:"degraded", errorCode:"missing_project_id", lastErrorType:"oauth_missing_project_id" and a descriptive lastError. Both upsert branches (update-existing and create-new) apply the degrade fields. The response stays success:true and carries a warning string so the dashboard can explain the state instead of showing a false green. No rejection, no data loss — the refresh token stays stored.
3. Self-healing: persistDiscoveredAntigravityProjectId() flips the row back to active the moment a projectId is discovered at request time (transient failures recover with zero user action). Confirmed-BYOP accounts get disabled by markAntigravityMissingCloudCodeProject() on first dispatch (isActive:false + unavailable — recoverable, not terminal) so selection rotates to healthy siblings.
4. Selection-side filter (open-sse/services/antigravityProjectPersist.ts): empty-projectId siblings and confirmed-missing rows (even with stale ids) are skipped when a healthier account exists. When NO account has a project, the pool passes through unchanged so the typed runtime 422 (not an empty-selection 404) explains what to fix.

User-facing flow after this PR

• Transient discovery failure: connect completes with a visible degraded/warning state → first chat request re-runs bootstrap → row self-heals to active.
• BYOP account: connect completes as degraded → first request returns the actionable GCP_PROJECT_REQUIRED 422 → account auto-disabled so siblings serve traffic. Dashboard shows the real error instead of "Connected".

TDD validation (Hard Rule #18)

New tests (RED→GREEN):

• tests/unit/antigravity-oauth-empty-project-rejection.test.ts — outcome classification + mapTokens propagation
• tests/unit/oauth-route-antigravity-project-gate.test.ts — degrade gate wired into both exchange branches; saved-not-active contract; typed error fields
• tests/unit/antigravity-missing-project-autodisable.test.ts — disable on confirm / re-enable on discovery
• tests/unit/antigravity-empty-project-selection.test.ts — selection rotation semantics

Updated: tests/unit/antigravity-missing-project-chat.test.ts (persisted-state assertions).

Focused suites: 51/51 new+regression tests pass (run via fleet worker); typecheck:core exit 0; check:file-size OK (route 979 < cap 1000); dashboard/open-sse typecheck baselines unchanged.

⚠️ base-red inherited: #9985