The picker cache the old rows came from is taken away, not just stopped being written (#1185)

[gen16k]

#1185 stopped writing Claude Code's discovery cache and the flag that makes the picker read it. It did not take either away — the flag is scrubbed at the next root waired claude enable, and the file was never removed. So a host that upgrades and has not re-run enable as root carries a stale cache the picker still reads.

Found on sv-mag while doing L97's on-device after-check, and reproduced against the real client before fixing.

The state a host is actually in

sv-mag, right now:

$ cat ~/.claude/cache/gateway-models.json
{"baseUrl":"http://127.0.0.1:9472","fetchedAt":1788458345856,"models":[
 {"id":"claude-waired-auto","display_name":"Waired — 200k (any of your devices)"},
 {"id":"anthropic-waired-local","display_name":"Waired local (this device)"},
 {"id":"claude-waired-peer","display_name":"Waired peer (another device)"}]}

$ grep DISCOVERY /etc/claude-code/managed-settings.json
    "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY": "1",

Written 2026-09-03. Both survive an upgrade, and both are removed only by a root waired claude enable.

What that looks like — measured, not inferred

Claude Code 2.1.261, an isolated CLAUDE_CONFIG_DIR holding that cache and a modelPicker lineup, discovery enabled, /model opened in a pty:

row	on screen
ZZOLD-Waired-auto (cache)	yes
ZZOLD-Waired-local (cache)	yes
ZZOLD-Waired-peer (cache)	yes
ZZNEW-Waired (modelPicker)	yes
ZZNEW-Waired-local (modelPicker)	yes

Both lists. Three of the rows are the same destinations under their old names.

The fix

RemoveRetiredCache in internal/integration/claudecode/retiredcache.go, called from the per-user picker write. That is the half that needs no elevation and runs on every claude launch through the SessionStart hook, so it closes the window without waiting for anybody to re-run enable as root; by the time the root half scrubs the flag there is nothing left to read. waired claude disable clears it too.

Ownership, the same discipline as the rest of #1185: only a document that names this gateway and whose every row is a Waired id. A cache describing some other gateway is somebody else's — and Claude Code ignores it anyway, since it compares baseUrl against the live ANTHROPIC_BASE_URL by exact string, so the narrow rule is also the complete one. Absent, unreadable, unparseable and foreign are all left alone without an error: this runs inside a hook on every launch, and a surprise there would be a failure on a path whose whole job is best-effort.

Verified on sv-mag with a build of this branch

-rw------- 1 gen16k gen16k 306 Sep  3 17:59 /home/gen16k/.claude/cache/gateway-models.json
Wrote Claude Code /model rows: /home/gen16k/.claude/settings.json
ls: cannot access '/home/gen16k/.claude/cache/gateway-models.json': No such file or directory

and the rows it wrote are the new ones, with per-peer entries from the live mesh:

waired, waired/local, waired/peer,
waired/peer-pc-mbp14-m5-local, waired/peer-sv-macmini-local

Checks

go build ./..., go test ./..., gofmt -l, golangci-lint run --max-same-issues=0. New table test covers ours / a different gateway / a foreign model id / one waired id among foreign ones / an empty list / not JSON / no live base URL / no file / CLAUDE_CONFIG_DIR.

docs-not-needed: the cache file is named to users nowhere on the site — #1241 already rewrote the one troubleshooting section that mentioned it, and this change only deletes a file waired itself wrote.

Refs #1185
Refs waired-ai/waired#1313

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJUUSmAfbRdjER1seDdjXm