The Oxbox Survey

The Oxbox Survey catalogs the free and cheap models on the public gateways, tries a few of them, and reports what it took to get a usable code review out of each one. Every model here was given the same job: review public code, through oxbox. More about the survey.

This week's highlights

• Checking a cheap run cost 73 to 137 times the initial cheap model cost. openai/gpt-oss-120b invented 11 of 12 findings for half a cent, and checking them cost 36 to 67 cents.
• minimax/minimax-m3:free is gone from OpenRouter. The only free model this survey rated Good left the free catalog, and the paid minimax/minimax-m3 stays at $0.30 and $1.20 per million.
• OpenRouter billed double the listed price on one run. A model id is a pool of endpoints, and the router sent a z-ai/glm-5.3-flash request to one priced at twice the listing.
• GLM-5.3 Flash found 19 real defects in a live repository for 2 cents. Five review batches, 28 findings, 19 verified real, one of them filed as a bug.
• Six of seven models produced a patch that would not apply. The hunk headers were wrong, and the findings behind them were mostly right.

Editor's notes

This week I did a lot of experimenting on how to get Claude to generate better text for the report; I came up with a Google Doc review workflow that has helped a lot to refine the generator.

The survey machinery and oxbox tool also went through several rounds of improvements to work better with subscriptions to Claude Code and Codex as a cheaper way to supervise the tests than running through OpenRouter at full cost.

The main change is the focus of the report: on the models and the interesting parts about getting them to work. I wanted to do some comparisons against using supervised "free" models vs. just using frontier models in the first place, but that will have to wait for the next report.

--Curtis

What's new this week

• minimax/minimax-m3:free was delisted from OpenRouter between the 2026-09-01 and 2026-09-07 captures. It was the survey's only free model rated Good, and it is held out of this week's manifest as delisted. The paid minimax/minimax-m3 remains at $0.30 in and $1.20 out per million, unchanged since 2026-09-01. Why it matters: A reader who took last issue's top free recommendation has to pick something else this week, and the paid listing of the same model is not free. MiniMax M3 on OpenRouter · the record: what models changed since the last issue

• z-ai/glm-5.3-flash found 19 real defects in 28 findings across five batches of a live repository, for 2 cents of model tokens. Between 2026-09-07 and 2026-09-08 it reviewed five sets of files from paniolo at tag v0.1.19. One finding, a retry path that can press a key twice after a lost acknowledgement, was filed as paniolo issue #172. Why it matters: This is the week's evidence that a model priced under a tenth of a cent per thousand tokens finds real defects, on code that is not a fixture. paniolo · the survey's 2026-09-07 and 2026-09-08 runs · the record: the runs

• Both models in this week's manifest were repriced within nine days, in opposite directions. deepseek/deepseek-v4-flash rose 23.6%, from $0.0717 in and $0.1434 out per million to $0.0886 and $0.1772, between the 2026-09-01 and 2026-09-07 captures. z-ai/glm-5.3-flash fell 6.7%, from $0.075 in and $0.25 out to $0.07 and $0.2333, between the 2026-09-07 and 2026-09-10 captures. Why it matters: A price copied from a listing last week is not the price this week, so a cost estimate needs re-checking before a large batch goes out. DeepSeek V4 Flash on OpenRouter · GLM-5.3 Flash on OpenRouter · the record: what models changed since the last issue

• Three of OpenCode Zen's free listings stop an outside request with the message "OpenCode's free tier can only be used in OpenCode." In the survey's first access probe of that venue, on 2026-09-10, 13 of the 60 listings probed answered. big-pickle, ling-3.0-flash-fin-free, and mimo-v2.5-free each returned HTTP 400 with that message. Why it matters: Three listings a reader would count as free cannot be called from their own script at all, whatever the catalog says. OpenCode Zen · the survey's 2026-09-10 access probe · the record: the models

• Three free models were added to OpenRouter and all three answered, taking the free listings that answer from 6 of 21 to 8 of 21. inclusionai/ling-3.0-flash-sante:free was listed on 2026-09-04, nex-agi/nex-n2.5-pro:free on 2026-09-07, and nex-agi/nex-n2.5-mini:free on 2026-09-08. None of the three has been run through oxbox, so nothing here speaks to their review quality. Why it matters: Four listings that could not be called last issue can be called now, and two that could be called are gone, so a shortlist built on 2026-09-01 is stale. OpenRouter free models · the survey's 2026-09-01 and 2026-09-10 access probes · the record: the models

Top things we learned

• Checking the week's worst run cost 73 to 137 times what the run itself cost. openai/gpt-oss-120b, pinned to DeepInfra, emitted 12 findings on a 6,096-byte file that has no seeded defects, and 11 of them were invented. The run cost under half a cent and took 577 seconds. Opus 5 charged 36 cents to check the 12 findings and Fable 5.1 charged 67 cents. Three other models given the same file said nothing at all, and were right to. Why it matters: Price a cheap model's run as the model's bill plus a supervisor's, treat a long findings list from a cheap model as a cost rather than a yield, and ask for uncertainty markers so the invented findings are cheaper to sort. the survey's 2026-09-08 runs · the record: the runs · Oxbox Survey costs

• Pin the endpoint and cap the price, or the bill is not the price on the listing. A z-ai/glm-5.3-flash request on 2026-09-06 was routed to SiliconFlow instead of Z.AI, and the upstream cost line worked out to $0.15 in and $0.50 out per million against a listing of $0.075 and $0.25. OpenRouter showed 23 endpoints for that model that day, priced from list to five times list. A pin trades availability for attribution: deepseek/deepseek-v4-flash pinned to DigitalOcean with fallbacks off got HTTP 429 twice before answering on the third attempt, five minutes on. Why it matters: Send OpenRouter a provider object naming only the endpoints you have measured, with fallbacks off and a maximum price at the listing, so a route priced above list is skipped instead of billed, and read the route back out of the response rather than assuming it. the survey's 2026-09-06 and 2026-09-07 runs · GLM-5.3 Flash on OpenRouter · the record: the runs

• A cheap model that seems to hang may be a bad endpoint: the same request took 33 minutes on one and 47 seconds on another. deepseek/deepseek-v4-flash was given a 6,096-byte file to review, spent 99,999 of its 100,000 completion tokens on reasoning, and returned empty content after 1,984 seconds. The identical payload re-sent later reached a different endpoint and came back with two findings in 47 seconds. Why it matters: Treat a stall as a route fact until a second endpoint says otherwise, and record which endpoint served each run so the comparison is possible at all. the survey's 2026-09-06 and 2026-09-07 runs · the record: the runs

• Ask a cheap model for findings, not for a patch: six of seven produced a diff that would not apply. Seven models were given the same task on 2026-09-08, a patch adding secret patterns to a scanner, and six emitted diffs that git apply --check rejected. The failure was almost always the hunk header, and the regexes behind the broken header were usually right: four of the six had all eight verdicts correct. Why it matters: Take the findings and write the patch yourself, or keep git apply --recount in the loop and re-run the tests, because a header that applies after repair is not a patch that was correct. the survey's 2026-09-08 runs · the record: the runs

• Check for an empty answer, not just a successful request: nothing came back in three different shapes this week. One 6,096-byte review produced two 900-second timeouts inside an hour, one from openai/gpt-oss-120b and one from cohere/north-mini-code:free, and the second timed out again when pinned to Cohere, which is that listing's only endpoint. Separately, inclusionai/ling-3.0-flash-fin:free and nvidia/nemotron-3.5-lightning each returned HTTP 200 with empty content. Why it matters: Test the content field rather than the status code, count an empty completion as a failed run, set a read timeout you can afford to lose, and plan a re-send, because a pin cannot rescue a listing that has only one endpoint. the survey's 2026-09-08 runs · the record: the runs

Models we're using this week

These are the models in this week's manifest, in the manifest's order. A model is here because its Editor's Rating puts it there. The scores quoted below are measured from the record, and the rating is the editor's judgment, said as such. The manifest carries an endpoint pin and a price cap for both entries, and it needs oxbox 1.1.0 or newer to read.

• z-ai/glm-5.3-flash on OpenRouter, $0.07 in and $0.2333 out per million, rank 1. In 11 runs through oxbox it scored 10 of 10 on the grounding quiz twice, and its five batches on a live repository produced 19 verified real findings from 28 for 2 cents of model tokens. Editor's Rating: Acceptable, dated 2026-09-06, in the editor's words fast and mostly good, with Z.AI's regulatory status a concern. Why this model: It is the only cheap model in the record with verified findings on code that is not a fixture, at a price a tenth of a cent per thousand tokens. GLM-5.3 Flash on OpenRouter · this week's manifest · the record: the runs

• deepseek/deepseek-v4-flash on OpenRouter, $0.0886 in and $0.1772 out per million, rank 2. In 9 runs through oxbox it scored 10 of 10 on the grounding quiz twice, the second time in 37 seconds for a tenth of a cent, and it is the cheapest model in the record per real finding when checked by Opus 5, at about 5 cents. Editor's Rating: Acceptable, dated 2026-09-07, in the editor's words we fixed the routing problem, otherwise it's decent. Why this model: It is the cheapest verified finding in the record once its endpoint is pinned, and its price rose 23.6% this week without changing that. DeepSeek V4 Flash on OpenRouter · this week's manifest · the record: the runs

What a review cost

Every figure here is at the checking model's list price through the API. Opus 5 is priced at $5 in and $25 out per million, with cache reads at $0.50 and cache writes at $6.25. Fable 5.1 is priced at $10 in and $50 out per million, with cache reads at $0.25 and cache writes at $12.50. A reader whose checking model is covered by a subscription pays in quota rather than dollars, and the two are not the same bill.

The model half of openai/gpt-oss-120b's 12-finding run on the file with no defects cost under half a cent. Checking those 12 findings, metered as one request through OpenRouter, cost 36 cents with Opus 5 and 67 cents with Fable 5.1. The two supervisors disagreed on one verdict of the 12, so a comparison between supervisors is a second run and never a multiplication. The price on a listing is not what a review costs: the model half is a fraction of a cent and the checking half is tens of cents.

A free model is not free. minimax/minimax-m3:free billed nothing and still cost 37 cents per real finding under Fable 5.1, all of it in the supervisor's tokens. The cheapest real finding in the record is deepseek/deepseek-v4-flash at about 5 cents each, both halves, under Opus 5 over six checked runs. The five z-ai/glm-5.3-flash batches on a live repository cost 2 cents in model tokens for 19 real findings, but a Sonnet 5 subagent did the checking and the harness does not record its output tokens, so no checking figure exists for them.

A metered check is one request that reads the source and cannot reproduce anything. It is the fallback, and its price is the price of the fallback. The full tables, one tab per checking model, are in the Oxbox Survey costs workbook, with the same-batch, per-fixture, ratings, and rubric tabs.

How far to trust this

Everything above is what the survey tried, not what a vendor said. Three tiers, once: measured means the catalog capture, observed means a run or a probe this survey made, and reported means a vendor or a third party said it.

The sample is small and it is one reviewer's code. The week's largest batch was 21 runs, seven models against three fixtures, plus two pinned re-sends. Five further batches were reviews of one live repository. The zero-defect control is a single 6,096-byte Python file with no seeded defects, so a model's score on it says how much it invents, not how much it finds. Real repositories are the other half of the evidence, and there are five batches of them.

Access is one moment. A rate limit or an upstream outage at probe time is not a property of the model. The probe is one synthetic snippet that can disqualify a listing but can never recommend one.

A cost here is the model's bill plus a supervisor's, at the supervisor's list price through the API. A reader on a subscription pays in quota, not dollars.

Findings are verified by reproducing the stated failure against the pinned source wherever it can be run, and by reading it where it cannot. Two capable checkers reading the same file reached opposite verdicts once, and four commands settled it.

Free means the vendor may train on what you send. Everything here is public code, so that is priced in and it is not a reason a model is excluded. A reader sending anything else should read the terms.

A model's vendor can be on a United States restricted-party list and nothing in a catalog listing says so. The lists and this week's vendors are set out in the record, under Restricted-party listings.

The scores are measured from the record. The Editor's Rating is one person's judgment, said as such.

---

The record

The models

The catalog is the model list a router publishes. Each table below is one venue's catalog as captured on 2026-09-10, with the result of a one-snippet access probe the same day. Context and maximum output are in tokens.

OpenRouter, captured 2026-09-10T02:08:58Z: 21 free listings, all 21 probed, 8 answered. On 2026-09-01 the count was 6 of 21. The catalog carries prices, so free is measured here.

The 13 OpenRouter listings that did not answer, by error:

The eight HTTP 404 listings and the two HTTP 403 listings are unchanged from 2026-09-01. google/lyria-3-pro-preview flipped from an error on 2026-09-01 to answering on 2026-09-10, but its reply to the probe was song lyrics, so the probe scored it malformed.

Requesty, captured 2026-09-10T02:09:57Z: 12 free listings, all 12 probed, 7 answered, the same count as 2026-09-01. The catalog carries prices, so free is measured here. No listing was added, removed, or changed since 2026-09-01. Requesty publishes no moderation flag.

The five Requesty listings that did not answer, by error:

ZenMux, captured 2026-09-10T02:12:29Z: 5 free listings, all 5 probed, 4 answered, the same as 2026-09-01. No listing was added, removed, or changed since 2026-09-01. ZenMux publishes no output cap and no moderation flag for any listing. It requires a funded account and stops a request from an unfunded one at call time.

OpenCode Zen, captured 2026-09-10T02:07:51Z: 70 listings on the whole roster, 60 probed, 13 answered. This is the first access probe of this venue, so there is no earlier count to compare with. The catalog carries no prices, so whether a listing is free is unknown and is recorded as unknown, never as false. The catalog publishes no context window or output cap.

The 47 OpenCode Zen listings that did not answer, by error:

This survey's OpenCode account carries billing and a $10 deposit, so the cardless path has never been tested here.

The stealth models

No venue reported a cloaked listing in the 2026-09-10 capture, and none has since 2026-08-24; OpenRouter is the only venue that marks its own, with a stealth/ id prefix, so the count is measured there and unknown elsewhere.

What models changed since the last issue

Added:

• inclusionai/ling-3.0-flash-sante:free on OpenRouter, between the 2026-09-01 and 2026-09-07 captures, listing date 2026-09-04. 262K context, 32,768 max output tokens, no response_format. Answered the 2026-09-10 probe.
• nex-agi/nex-n2.5-mini:free on OpenRouter, between the 2026-09-07 and 2026-09-10 captures, listing date 2026-09-08. 262K context, 235,929 max output tokens, response_format supported. Answered the 2026-09-10 probe.
• nex-agi/nex-n2.5-pro:free on OpenRouter, between the 2026-09-07 and 2026-09-10 captures, listing date 2026-09-07. 262K context, 235,929 max output tokens, response_format supported. Answered the 2026-09-10 probe.
• Eight roster additions on OpenCode Zen between the 2026-09-01 and 2026-09-07 captures: claude-fable-5-1, deepseek-v4-flash-vision-exp, gemini-3.8-flash, glm-5.3, glm-5.3-flash, gpt-6-astra, muse-spark-1.3, and muse-spark-1.3-contributor-free. The venue publishes no pricing, so whether any of them is free is unknown.

Delisted:

• minimax/minimax-m3:free on OpenRouter, between the 2026-09-01 and 2026-09-07 captures. It carries Editor's Rating Good, dated 2026-09-06, and was rank 1 of the 2026-09-01 manifest. Its two runs produced 20 real findings of 27 emitted. The paid minimax/minimax-m3 remains at $0.30 in and $1.20 out per million, so the model is still there at a price.
• minimax/minimax-m2.7:free on OpenRouter, in the same window. It answered the 2026-09-01 probe and was never run through oxbox.
• z-ai/glm-5.2:free on OpenRouter, in the same window. It was rate limited at the 2026-09-01 probe and was never run through oxbox.
• laguna-s-2.1-free on OpenCode Zen, between the 2026-09-01 and 2026-09-07 captures.
• x-preview-f-free on OpenCode Zen, absent from the 2026-09-10 roster. It was the last cloaked listing this survey ran: one run, 5 findings, all 5 real, in 900 seconds, rated Marginal by the editor on 2026-09-06 for the speed.

Repriced:

• deepseek/deepseek-v4-flash on OpenRouter, between the 2026-09-01 and 2026-09-07 captures: $0.07168 in and $0.14336 out per million became $0.088606 and $0.177212, a rise of 23.6%. This is the survey's rank 2 recommendation.
• z-ai/glm-5.3-flash on OpenRouter, between the 2026-09-07 and 2026-09-10 captures: $0.075 in and $0.25 out per million became $0.07 and $0.2333, a fall of 6.7%. This is the survey's rank 1 recommendation. The manifest's price cap for each entry follows the new listing.

Revealed:

• No cloaked listing was claimed or revealed since the last issue. No attribution search was run this issue.

Other changes:

• thinkingmachines/inkling-small:free on OpenRouter gained logprobs and top_logprobs in its supported parameters between the 2026-09-07 and 2026-09-10 captures. The listing still stops a plain API call with HTTP 403, so no caller can reach them.
• nvidia/nemotron-3-ultra-550b-a55b on Requesty answers now, where it returned an upstream error on 2026-09-01.
• nvidia/nemotron-3.5-lightning-30b-a3b on Requesty timed out on the 2026-09-10 probe, where it answered on 2026-09-01.
• novita/inclusionai/ling-3.0-tiny on Requesty returned HTTP 404 from the provider, where it returned an upstream error on 2026-09-01.
• The Requesty and ZenMux catalogs themselves did not change between 2026-09-01 and 2026-09-10.

The runs

Every run below went through oxbox on OpenRouter. The fixture called the zero-defect control is a single 6,096-byte Python file with no seeded defects. The grounding quiz is ten questions about a file, three of them unanswerable from it. The patch fixture asks for one diff adding secret patterns to a scanner, and a patch passes three checks: it applies as delivered, its eight pattern verdicts are right, and the tests pass. The week's batch on 2026-09-08 was 21 runs, seven models against those three fixtures, plus two pinned re-sends. Five further batches were reviews of paniolo at tag v0.1.19. An empty answer and a correct "no defects found" produce identical counts, so the record marks four runs this week as having answered nothing, which is not the same as having found nothing.

Endpoints on 2026-09-06. OpenRouter's public endpoints listing showed 15 endpoints for deepseek/deepseek-v4-flash and 23 for z-ai/glm-5.3-flash, priced from list to five times list, with output caps from 2,048 to 943,718 tokens. Seven DeepSeek runs in the record went to three different endpoints, and six GLM runs went to four. oxbox 1.1.0, released 2026-09-07, passes a provider object through from the command line or a manifest entry.

z-ai/glm-5.3-flash, six runs since the last issue and 11 in all. Manifest rank 1, with effort pinned to high, below the model's own default of max, because every survey run went out at high. Pinned to the four endpoints its rated runs went to, z-ai/fp8, gmicloud/fp8, streamlake/fp8, and siliconflow/fp8, with fallbacks off and the price cap at the listing. SiliconFlow billed double the listing on 2026-09-06, so the cap excludes it until it prices at list again.

• 2026-09-06, zero-defect control: 4 findings, 0 real. Routed to SiliconFlow. Billed $0.003398, where the listing computes $0.0017 for the same tokens. The upstream cost line was $0.000258 for 1,720 prompt tokens and $0.00314 for 6,280 completion tokens, which is $0.15 in and $0.50 out per million against a listing of $0.075 and $0.25.
• 2026-09-07, paniolo's four OCR helpers at the pre-fix checkout: 7 findings, 5 real, three of them already fixed that day.
• 2026-09-08, paniolo ch9329/src/server.rs and ch9329/src/uart.rs, 22,428 bytes, review mode: 6 findings, 5 real, 201 seconds, $0.0022. Finding 1: retry_once_on_timeout re-runs the whole command line after a lost acknowledgement, so key enter can press twice and type can retype the string. Confirmed against uart.rs lines 177 to 185 and 228, where tap() and type_text in session.rs cannot resume. Filed as paniolo issue #172.
• 2026-09-08, paniolo hdmicap/src/server.rs, 51,284 bytes: 4 findings, 4 real, none refuted, 493 seconds, $0.0061.
• 2026-09-08, paniolo netbootd/src/dhcp.rs, 57,394 bytes: 4 findings, 2 real, 1 refuted. One real finding was a defect in that day's own first-client MAC lock change.
• 2026-09-08, paniolo's four OCR helpers at v0.1.19: 7 findings, 3 real, 1 refuted, including a hole in that day's input-bounds change.
• Totals for the five paniolo batches: 28 findings, 19 verified real, $0.0196 billed for model tokens, wall clock from 76 to 493 seconds. A Sonnet 5 subagent checked all five, and the harness does not record its output tokens, so no dollar figure for checking them exists.
• Across all runs: grounding quiz 10 of 10 twice. Zero-defect control 8 findings over two runs, 1 real, plus 1 counted benign. Patch fixture passed all three checks as a baseline on 2026-09-02 and produced a hunk header that would not apply as a candidate on 2026-09-06. Speed score 2 on real work and 3 on the zero-defect control. Cost per real finding, both halves, checked by Opus 5 over five checked runs: $0.0708.

deepseek/deepseek-v4-flash, six runs since the last issue and 9 in all. Manifest rank 2, effort high, which is the model's own default. Pinned to digitalocean, streamlake/fp8, and novita/fp8, the three endpoints its rated runs went to, fallbacks off, price cap at the listing. Novita billed 1.6 times list on 2026-09-06, so the cap excludes it until it prices at list.

• 2026-09-06, grounding quiz: 10 of 10 in 37 seconds, $0.0010, from a third provider.
• 2026-09-06, zero-defect control: 1,984 seconds, finish reason length, 99,999 of 100,000 completion tokens on reasoning, empty content, $0.01597 billed, endpoint StreamLake. Answered nothing.
• 2026-09-06, the same payload re-sent: 47 seconds, 2 findings, 1 real, from a fourth provider.
• 2026-09-06, patch fixture: did not apply, 8 of 8 verdicts behind the header, 986 seconds, $0.0024. An earlier attempt had 7 of 8 behind a header that also did not apply.
• 2026-09-07, zero-defect control pinned by name to StreamLake: 151 seconds, 1 finding, 0 real.
• 2026-09-07, zero-defect control pinned to DigitalOcean with fallbacks off: HTTP 429 twice, then an answer on the third attempt five minutes on. 320 seconds, 1 finding, 0 real. The pin held.
• Across all runs: grounding quiz 10 of 10 twice. Zero-defect control 4 findings over four candidate runs, 1 real. Speed score 0 on the zero-defect control. Cost per real finding, both halves, checked by Opus 5 over six checked runs: $0.0466, the cheapest in the record.

anthropic/claude-fable-5.1, three runs, a baseline and never a manifest entry.

• 2026-09-06, grounding quiz: 10 of 10 in 33 seconds, $0.2756, which sets the fixture's cost ceiling at $0.0276 per correct answer.
• 2026-09-06, zero-defect control: 5 findings, 2 real, 2 benign, 1 invention. Both real findings were self-labeled uncertain. 90 seconds, $0.3663.
• Patch fixture: declined the task twice, once with the motivation stated first, so the trigger is the material and not the framing.

openai/gpt-oss-120b, four runs on 2026-09-08.

• Grounding quiz: 10 of 10 in 179 seconds, $0.0009, route DeepInfra.
• Patch fixture: a fenced diff whose hunk header is a bare @@ with no line numbers. git apply --check rejects it with "No valid patches in input". 0 of 8, 136 seconds, $0.0026.
• Zero-defect control, unpinned: no response before the 900-second read timeout, so no answer, no route, no token count, and no bill.
• Zero-defect control, pinned to DeepInfra: 12 findings, 1 real under the standing ruling, 11 invented, 577 seconds, $0.0049.
• Check by Opus 5, one metered request through OpenRouter: $0.3577 billed, 130 seconds, 11 refuted and 1 confirmed.
• Check by Fable 5.1 the same way: $0.6703 billed, 118 seconds, all 12 refuted. The two checkers disagreed on one finding of the 12.
• Cost per real finding, both halves, checked by Opus 5 over three checked runs: $0.3652.

cohere/north-mini-code:free, four runs on 2026-09-08.

• Grounding quiz: 10 of 10 in 25 seconds, $0, route Cohere. All three unanswerable questions were declined with a reason.
• Patch fixture: did not apply, 8 of 8 verdicts behind the header, zero self-hits, 243 seconds, $0.
• Zero-defect control, unpinned: timed out at 900 seconds, the second timeout on the fixture inside an hour.
• Zero-defect control, pinned to Cohere, its only endpoint: timed out again at 901 seconds.

xiaomi/mimo-v2.5, three runs on 2026-09-08.

• Grounding quiz: 10 of 10 in 46 seconds, $0.0025, with line-level citations. It quoted the logging warning on the last trap.
• Patch fixture: did not apply, 8 of 8 verdicts behind the header. It added a ninth pattern rather than rewriting one. 95 seconds, $0.0032, route StreamLake.
• Zero-defect control: 0 findings, the ideal answer, with its reasons stated. 237 seconds, $0.0045.

nvidia/nemotron-3.5-lightning, three runs on 2026-09-08.

• Grounding quiz: 0 of 10. Empty content in 3 seconds, finish reason stop, 519 completion tokens with 559 counted as reasoning, and no visible text. Answered nothing.
• Patch fixture: did not apply, 8 of 8 verdicts behind the header, after 46,531 completion tokens of which 37,816 were reasoning. The only fault was the line count in its header. 112 seconds, $0.0101, route DeepInfra.
• Zero-defect control: 0 findings, the ideal answer, 99 seconds, $0.0082.

mistralai/mistral-small-2603, three runs on 2026-09-08.

• Grounding quiz: 9 of 10 in 7 seconds, $0.0021, the fastest run on that fixture. It answered an unanswerable question with "900 seconds (15 minutes)".
• Patch fixture: did not apply, and only 3 of 8 verdicts behind the header, 19 seconds.
• Zero-defect control: 3 findings, 0 real, 24 seconds, $0.0056. Checked as one metered request by Opus 5 at $0.2350 and by Fable 5.1 at $0.4007. Both agreed that two of the three describe a real failure with the wrong cause, and both refuted the third.

inclusionai/ling-3.0-flash-fin:free, three runs on 2026-09-08.

• Grounding quiz: 10 of 10 in 8 seconds, $0, the fastest correct run of the batch.
• Patch fixture: the only patch of the seven that applied as delivered. It emitted eight diffs where one was asked, and the first applies and fixes 3 of 8. 47 seconds.
• Zero-defect control: returned nothing. The whole 32,768-token output cap went to reasoning. 73 seconds. Answered nothing.

dots-studio/dots-3-note-preview:free, three runs on 2026-09-08.

• Grounding quiz: 10 of 10 in 18 seconds, $0. It cited the timeout constant while saying it is not the answer.
• Patch fixture: did not apply. The hunk header carries XXXX where the line numbers go. 0 of 8, 231 seconds.
• Zero-defect control: 0 findings, the ideal answer, and it named the two pre-registered non-defects as non-defects. 139 seconds.

The patch fixture across models. The paid frontier models applied as delivered: google/gemini-3.7-flash, openai/gpt-5.6-sol, and z-ai/glm-5.3-flash each passed all three checks on 2026-09-02. Of the seven candidates on 2026-09-08, xiaomi/mimo-v2.5, nvidia/nemotron-3.5-lightning, and cohere/north-mini-code:free each failed the apply check on the line count in the header with 8 of 8 verdicts behind it and zero self-hits.

minimax/minimax-m3:free, two runs before this issue: 20 real findings of 27 emitted. Cost per real finding, checked by Fable 5.1, with a model half of zero: $0.3671.

Restricted-party listings

A model's vendor can be on a United States restricted-party list and nothing in a catalog listing says so. What follows is stated as facts about lists, never as legal advice. A reader in a regulated setting should check the lists themselves and their own procurement rules.

The Entity List, United States Commerce Department export controls, restricts supplying listed companies with United States-origin items. Zhipu AI, the vendor behind the z-ai listings, was added effective 2025-01-16, per the Federal Register, 2025-00704. In this week's catalogs that is z-ai/glm-4.7-flash-free and z-ai/glm-4.6v-flash-free on ZenMux, and z-ai/glm-5.3-flash, this issue's rank 1 recommendation, on OpenRouter. z-ai/glm-5.2:free was delisted from OpenRouter this week. Being listed does not by itself forbid a customer from calling the vendor's hosted API, but procurement and compliance policies commonly key on the list.

The 1260H list, the Defense Department's list of "Chinese military companies", bars the department from contracting with listed companies and, from June 2027, from buying their products through third parties. The June 2026 update added Alibaba, the vendor behind Qwen, along with Baidu, per WilmerHale, 2026-06-11 and CNBC, 2026-06-09. The only Qwen listings in this week's catalogs are qwen3.5-plus and qwen3.6-plus on OpenCode Zen, and neither was probed.

Affiliates are not listings. inclusionAI, the vendor behind the inclusionai/ling listings, is Ant Group's open source arm, and Ant Group is an Alibaba affiliate. Neither Ant Group nor inclusionAI appears in the two citations above, so their listings say "Ant Group, Alibaba affiliate; not itself listed" and never inherit Alibaba's flag. This is what the record shows, and the record is the two citations, not a fresh check of the lists.

Pending additions. The editor reports that further Chinese AI vendors are on a non-public backlog for Entity List addition. No citable source exists as of 2026-09-06, so no vendor is named here.

Not named. MiniMax, Xiaomi, Nex AGI, dots studio, Moonshot, and Sapiens AI all have listings in this week's catalogs, and none of them appears in the two citations above, so none carries a flag here.

Sources

Fetched and used:

• OpenRouter models API: the free listings, context windows, output caps, supported parameters, expiration dates, and prices, captured 2026-09-10T02:08:58Z.
• OpenRouter chat completions: the access probe of the 21 free listings, which answered and with what error, probed 2026-09-10T02:09:56Z.
• Requesty models API: the 12 free listings and their fields, captured 2026-09-10T02:09:57Z.
• Requesty chat completions: the access probe for Requesty, probed 2026-09-10T02:12:29Z.
• ZenMux models API: the 5 free listings, captured 2026-09-10T02:12:29Z.
• ZenMux chat completions: the access probe for ZenMux, probed 2026-09-10T02:13:06Z.
• OpenCode Zen models API: the 70-listing roster, which carries no prices, captured 2026-09-10T02:07:51Z.
• OpenCode Zen chat completions: the first access probe of that venue, 60 of 70 listings, 13 answers, and the free-tier error message, probed 2026-09-10T02:08:58Z.
• Federal Register, 2025-00704: the Entity List addition of Zhipu AI, effective 2025-01-16.
• WilmerHale, 2026-06-11: the June 2026 1260H update adding Alibaba and Baidu.
• CNBC, 2026-06-09: the same 1260H update, as a second source.
• oxbox: the tool every run in this issue went through. Version 1.1.0 of 2026-09-07 is the floor for reading this week's manifest.
• Oxbox Survey costs: the full cost tables, one tab per checking model, plus the per-fixture, ratings, and rubric tabs.
• paniolo: the live repository reviewed in five batches, at tag v0.1.19.

Not fetched this issue:

• The OpenRouter stealth page and the free-models collection. Every venue's capture reported zero cloaked listings, so there was nothing to reconcile against the page, and no attribution search was run.

---

This edition is published from its source file. The evidence behind it, the catalog snapshots and the manifests, is in oxbox-survey, and nothing from there is edited on the way here.