amicus 4.9.0 → 4.9.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,73 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.1] - 2026-08-27
+
+*A silent provider failure, and the unservable model ids it produced.*
+
+A session on `deepseek` failed with `you passed deepseek-v4-flash-0731`. Tracing that one error
+found a chain: a provider fetch failed silently, the empty namespace it left behind was
+indistinguishable from "never fetched", and that ambiguity licensed the wizard to synthesise and
+persist a direct model id nothing serves.
+
+### Fixed
+
+- **Per-provider catalog fetch failures are reported instead of collapsing to `[]` (#209).**
+  `fetchAllModels()` returned a flat row array, so a provider whose fetch was REJECTED could not be
+  told apart from one that legitimately serves no models — all four failure modes (non-200, timeout,
+  network error, parse error) resolved to a bare `[]`, and the existing reporting fired only when
+  *every* provider returned nothing. A 401ing key silently zeroed that vendor's namespace and every
+  picker then offered gateway-only routes with no indication why. `fetchAllModelsDetailed()` now
+  carries `{rows, failures}`, the cache persists `providerFailures` alongside the rows they
+  describe, and `amicus models --check` prints
+  `PROVIDER FETCH FAILED: <provider> (HTTP 401)` (`--json` carries the array).
+  `fetchAllModels()` keeps its signature as a rows-only wrapper.
+- **A rejected namespace no longer yields a fabricated direct model id (#208).**
+  `classifyModel` returns `'unknown'` for an empty namespace because it could not distinguish
+  "never fetched" from "fetch rejected", and that licensed `directFormIfSafe` to strip the
+  `openrouter/` prefix and produce an id the direct API does not serve. Optimism is now suppressed
+  when *that vendor's* namespace fetch was rejected, and preserved when it was simply never
+  attempted. Threaded through the picker, the shortlist, both Electron wizard entry points and the
+  CLI setup path — the picker rebuilds its own `catalogInfo`, so without threading the guard was
+  live in unit tests and dead in production.
+- **The persistence path requires catalog evidence (#214).**
+  `toStorableRoute` — whose result is written straight into `config.aliases` and used to seed fresh
+  configs — decided direct-vs-gateway with no catalog evidence at all. It now routes through
+  `directFormIfSafe`, and `toLiveSeedAliases` stops discarding evidence it was already handed.
+- **Alias drift is computed against the same evidence the writer uses.**
+  `findDriftedStoredAliases` resolved its "current" value without `providerFailures`, so a rejected
+  namespace produced false drift whose suggested repair would have written back the very id #208
+  removed.
+- **Guards no longer depend on an optional argument.** `directFormIfSafe`/`directFormIfProven`
+  keyed both the `DIVERGENT_VENDORS` and namespace-rejection checks on a caller-supplied `vendor`
+  that the API marks optional, while the catalog check derived its own — so a caller using the
+  documented shape silently lost two of three guards. The vendor is now derived from the id when
+  omitted.
+- **The setup wizard keeps direct-first routing when the catalog is unavailable.** With no catalog,
+  quick picks fell back to raw `openrouter/…` routes, which Amicus treats as an explicit
+  force-OpenRouter literal — an offline setup would have pinned the user to the gateway
+  permanently.
+- **`pre-commit` no longer fails on a clone that has never stashed.** The hook gated its
+  lint-staged workaround on being inside a worktree; the real trigger is a missing `refs/stash`,
+  which is true of any fresh clone whose first commit precedes its first `git stash`.
+
+### Changed
+
+- **`toCanonicalDefault` is renamed `stripGatewayPrefix`** (`src/utils/curated-models.js`). The old
+  name read as the correct answer and three separate callers took it at its word and persisted ids
+  the direct API may not serve. It cannot be made evidence-taking — it *produces* the candidate
+  `classifyModel` checks — so the name now says what it is. Callers deriving an id that will be
+  called or stored must use `directFormIfSafe`/`directFormIfProven`. Internal utility, not a
+  documented API surface, but importers reaching into `src/utils/` will need the new name.
+- **Route canonicalisation for the setup wizard is decided in the main process.** The renderer
+  carried a hand-copy of `toCanonicalDefault` that had neither of the real primitive's guards; it is
+  deleted, and the safe form now ships to the page as data. Routing policy no longer reaches the
+  renderer at all.
+- **`gatewayOf(id)`** replaces three verbatim copies of the gateway-classification one-liner.
+- An ESLint rule now bans hand-rolled `openrouter/` prefix stripping outside an audited allowlist.
+- CI council bench: `qwen` moves from `qwen3.8-max` to `qwen3.8-27b` — same 1M context, ~4.8x
+  cheaper input. Bench-only; the shipped alias table is unchanged.
+
 ## [4.9.0] - 2026-08-26
 
 *The council does new work.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/usage.md

@@ -538,7 +538,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/electron/ipc-setup.js

@@ -184,11 +184,13 @@ function registerSetupHandlers(getMainWindow, { ipcMain = require('electron').ip
       let cfg = loadConfig();
       if (!cfg) {
         const { toLiveSeedAliases } = require('../src/utils/quick-picks');
-        let catalog = [];
+        // issue 214: getCatalogInfo, not getCatalog -- toLiveSeedAliases PERSISTS
+        // these routes, so it must see which namespaces were rejected.
+        let catalogInfo = { models: [] };
         try {
-          catalog = await require('../src/utils/model-catalog').getCatalog();
+          catalogInfo = await require('../src/utils/model-catalog').getCatalogInfo();
         } catch (_err) { /* offline: pinned seeds */ }
-        cfg = { aliases: toLiveSeedAliases(catalog) };
+        cfg = { aliases: toLiveSeedAliases(catalogInfo) };
       }
       if (!cfg.aliases) { cfg.aliases = {}; }
       if (defaultModel) { cfg.default = defaultModel; }

package/electron/main.js

@@ -327,12 +327,20 @@ function createAmicusWindow() {
 async function createSetupWindow() {
   // Lazy-load setup UI to avoid loading it for sidecar mode
   const { buildSetupHTML } = require('./setup-ui');
-  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, canonicalRoutesFor, toStorableRoute } = require('../src/utils/quick-picks');
   let quickPicks;
   const shortlists = {};
   try {
-    const catalog = await require('../src/utils/model-catalog').getCatalog();
+    // issue 208: getCatalogInfo (not getCatalog) -- the shortlist needs the
+    // per-provider fetch outcomes, or directFormIfSafe's namespace-failure
+    // gate cannot fire and a rejected namespace still yields bare direct ids.
+    const catalogInfo = await require('../src/utils/model-catalog').getCatalogInfo();
+    const catalog = catalogInfo.models;
     quickPicks = resolveQuickPicks(catalog);
+    // issue 214: decide each pick's safe storable form HERE, with the catalog in
+    // hand, and ship it as data. The page cannot require() the canonicalisation
+    // primitives, and its hand-copy of them dropped their guards.
+    for (const p of quickPicks) { p.canonicalRoutes = canonicalRoutesFor(p, catalogInfo); }
 
     // issue 138: one vendor shortlist per family card, resolved server-side from
     // the same catalog the quick picks came from (no extra IPC round-trip).
@@ -341,7 +349,8 @@ async function createSetupWindow() {
       try {
         shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
           catalog,
-          recommendedId: toStorableRoute(p),
+          providerFailures: catalogInfo.providerFailures,
+          recommendedId: toStorableRoute(p, catalogInfo),
         });
       } catch (_e) { /* a shortlist failure must never block the wizard */ }
     }
@@ -520,21 +529,26 @@ function createSettingsChildWindow() {
   // createSetupWindow awaits. A missing or corrupt cache reads back as null
   // and degrades to the same pinned fallback buildSetupHTML already applies
   // when no quickPicks are given.
-  const { resolveQuickPicks, toStorableRoute } = require('../src/utils/quick-picks');
+  const { resolveQuickPicks, canonicalRoutesFor, toStorableRoute } = require('../src/utils/quick-picks');
   const { readCache } = require('../src/utils/model-catalog');
   let quickPicks;
   const shortlists = {};
   try {
     const cacheDoc = readCache();
     const catalog = cacheDoc ? cacheDoc.models : [];
+    // issue 208: the cache doc carries the fetch outcomes for THESE rows.
+    const providerFailures = (cacheDoc && cacheDoc.providerFailures) || [];
     quickPicks = resolveQuickPicks(catalog);
+    // issue 214: see the note at the other resolveQuickPicks site.
+    for (const p of quickPicks) { p.canonicalRoutes = canonicalRoutesFor(p, { models: catalog, providerFailures }); }
 
     const { buildModelShortlist } = require('../src/utils/model-shortlist');
     for (const p of quickPicks) {
       try {
         shortlists[p.alias] = buildModelShortlist(p.vendorPath, {
           catalog,
-          recommendedId: toStorableRoute(p),
+          providerFailures,
+          recommendedId: toStorableRoute(p, { models: catalog, providerFailures }),
         });
       } catch (_e) { /* a shortlist failure must never block the wizard */ }
     }

package/electron/setup-ui.js

@@ -11,9 +11,8 @@ const { buildLocalSectionHTML } = require('./setup-ui-local');
 const { buildLocalScript } = require('./setup-ui-local-script');
 const { getDefaultAliases } = require('../src/utils/config');
 const { getBrandName } = require('./toolbar');
-const { resolveQuickPicks } = require('../src/utils/quick-picks');
+const { resolveQuickPicks, canonicalRoutesFor } = require('../src/utils/quick-picks');
 const { PROVIDER_FAMILY_NAMES } = require('../src/utils/model-fetcher');
-const { listDirectProviders } = require('../src/utils/provider-registry');
 
 /**
  * @param {object} [options={}]
@@ -30,17 +29,26 @@ function buildSetupHTML(options = {}) {
     quickPicks = resolveQuickPicks([]),          // pinned fallbacks when not provided
     shortlists = {},
   } = options;
+  // Council A1 (PR 215): a pick reaching the page WITHOUT canonicalRoutes makes
+  // pickRouteFor fall back to the raw openrouter/... route, which this codebase
+  // treats as an EXPLICIT force-OpenRouter literal that never reconsiders
+  // direct-first -- so an offline setup (pinned fallback above, catalog
+  // unavailable) would pin the user to the gateway permanently. Backfill from an
+  // EMPTY catalog: directFormIfSafe is optimistic when nothing disproves the bare
+  // form (restoring direct-first) while still refusing for DIVERGENT_VENDORS,
+  // which the deleted toBareIfDirect did not.
+  const picks = quickPicks.map(p =>
+    (p && p.canonicalRoutes) ? p : { ...p, canonicalRoutes: canonicalRoutesFor(p, { models: [] }) });
   const brandName = getBrandName(client);
   const keysHtml = buildKeysStepHTML(PROVIDERS);
-  const modelHtml = buildModelStepHTML(quickPicks, undefined, undefined, shortlists);
+  const modelHtml = buildModelStepHTML(picks, undefined, undefined, shortlists);
   const aliasHtml = buildAliasEditorHTML(getDefaultAliases());
   const css = buildWizardCSS();
   const providersJson = JSON.stringify(PROVIDERS);
-  const modelChoicesJson = JSON.stringify(quickPicks);
+  const modelChoicesJson = JSON.stringify(picks);
   const providerNamesJson = JSON.stringify(PROVIDER_NAMES);
   const defaultAliasesJson = JSON.stringify(getDefaultAliases());
   const familyNamesJson = JSON.stringify(PROVIDER_FAMILY_NAMES);
-  const directProvidersJson = JSON.stringify(listDirectProviders());
   return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><title>Amicus Setup</title>
 <style>${css}</style></head><body>
@@ -62,11 +70,11 @@ function buildSetupHTML(options = {}) {
     </div>
   </div>
   <div class="footer"><div class="footer-brand"><svg width="15" height="15" viewBox="0 0 32 32" fill="none"><path d="M4 8H19"/><path d="M4 11H14L19 8"/><path d="M4 14H13L19 8"/><path d="M4 17H12L19 8"/><path d="M4 20H11L19 8"/><path d="M4 23H10L19 8"/><path class="brand-main" d="M19 8H28"/></svg> ${brandName}</div><div class="footer-nav"><button class="nav-btn" id="back-btn" style="display:none">Back</button><button class="nav-btn primary" id="next-btn" disabled>Next</button><button class="nav-btn primary" id="finish-btn" style="display:none">Finish</button></div></div>
-${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson)}
+${buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson)}
 </body></html>`;
 }
 
-function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson, directProvidersJson) {
+function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, defaultAliasesJson, familyNamesJson) {
   const keysJs = buildKeysScript();
   const aliasJs = buildAliasScript();
   const councilJs = buildCouncilScript();
@@ -83,7 +91,6 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
   var providerNamesData = ${providerNamesJson};
   var defaultAliases = Object.assign(Object.create(null), ${defaultAliasesJson});
   var PROVIDER_FAMILY_NAMES = ${familyNamesJson};
-  var directProviders = ${directProvidersJson};
   var routingChoices = {};
   var explicitRouteChoices = {};
   // issue 138: alias -> a SPECIFIC model id the user drilled down to. Empty
@@ -288,20 +295,6 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     } else { nextBtn.disabled = false; }
   }
 
-  // #61: an auto-selected (non-explicit) openrouter/<vendor>/<model> route
-  // whose vendor also has a direct integration must be stored bare
-  // (<vendor>/<model>) so the gateway router can policy-route it direct-first;
-  // a stored openrouter/... string is treated as an explicit force-OpenRouter
-  // literal and never reconsiders direct-first. Mirrors
-  // src/utils/curated-models.js's toCanonicalDefault exactly. Gateway-only
-  // vendors (not in directProviders, e.g. qwen/grok/glm/...) pass through
-  // unchanged since OpenRouter is their only route anyway.
-  function toBareIfDirect(route) {
-    if (typeof route !== 'string' || route.indexOf('openrouter/') !== 0) { return route; }
-    var rest = route.slice('openrouter/'.length);
-    var vendor = rest.split('/')[0];
-    return directProviders.indexOf(vendor) !== -1 ? rest : route;
-  }
 
   // Single source of the route choice for a quick-pick row: explicit pill
   // choice if its key still exists, else first provider with a key, else
@@ -311,12 +304,12 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
     // issue 138: an explicit per-model choice overrides the family flagship.
     var picked = modelChoiceIds[mc.alias];
     if (picked) {
-      // Deliberately NEVER toBareIfDirect(picked) here (unlike the auto-pick
-      // canonicalization below): picked/modelOpenrouterIds come straight
-      // from the shortlist's own id/data-or, and for a DIVERGENT_VENDOR
-      // (e.g. anthropic) that id can already BE its only-callable
-      // openrouter/<vendor>/... form -- stripping the prefix would
-      // fabricate a direct id nothing serves.
+      // A drilled-down pick is returned VERBATIM -- never canonicalised (unlike
+      // the auto-pick below): picked/modelOpenrouterIds come straight from the
+      // shortlist's own id/data-or, which the picker already built through
+      // directFormIfSafe. For a DIVERGENT_VENDOR (e.g. anthropic) that id can
+      // already BE its only-callable openrouter/<vendor>/... form, so touching
+      // the prefix here would fabricate a direct id nothing serves.
       if (routingChoices[mc.alias] === 'openrouter' && explicitRouteChoices[mc.alias]) {
         return modelOpenrouterIds[mc.alias] || picked;
       }
@@ -332,9 +325,13 @@ function buildWizardScript(providersJson, modelChoicesJson, providerNamesJson, d
       if (!prov) { prov = provs[0]; }
     }
     var route = mc.routes[prov] || null;
-    // Only canonicalize auto-picks; an explicit "via OpenRouter" pill click
-    // is a deliberate choice and is returned unchanged.
-    if (route && !explicitRouteChoices[mc.alias]) { route = toBareIfDirect(route); }
+    // issue 214: the SAFE storable form is decided server-side (quick-picks.js
+    // canonicalRoutesFor) and shipped with the pick. The page must not re-derive
+    // it: its old hand-copy of stripGatewayPrefix dropped both of that
+    // primitive's guards. An explicit "via OpenRouter" pill stays unchanged.
+    if (route && !explicitRouteChoices[mc.alias]) {
+      route = (mc.canonicalRoutes && mc.canonicalRoutes[prov]) || route;
+    }
     return route;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [

package/src/sidecar/fanout-leg-fallback.js

@@ -15,6 +15,7 @@ const fs = require('fs');
 const { logger } = require('../utils/logger');
 const { classifyLegError, isRetryable } = require('../utils/error-classify');
 const { deriveChain } = require('./fallback-chains');
+const { gatewayOf } = require('../utils/gateway-router');
 
 /**
  * Append ONE attributed ledger row for a single attempt (spec 6.2/7.1). At
@@ -38,7 +39,7 @@ function recordAttemptSpend({ doc, leg, currentModel, legId, waveId, project, at
     // a substitution carries the substitute's resolved gateway on
     // `routeGateway` (threaded in by the loop, incl. v4.2 'local').
     const gateway = routeGateway || (leg && leg.gateway) ||
-      (String(currentModel).startsWith('openrouter/') ? 'openrouter' : 'direct');
+      gatewayOf(currentModel);
     const row = {
       taskId: legId, waveId, model: currentModel, mode: 'leg', usage,
       op: 'leg', status: doc.status, gateway,

package/src/sidecar/models-render.js

@@ -0,0 +1,71 @@
+/**
+ * Presentation helpers for `amicus models` -- pure string formatting, no I/O.
+ *
+ * Split out of models.js when the per-provider failure line (issue 209) pushed
+ * that file past the 300-line ceiling. Formatting and command flow are
+ * separable concerns, so the ceiling picked the seam: everything here takes a
+ * plain object and returns a string.
+ */
+
+'use strict';
+
+/** '0.000003' per token → '3.00' per Mtok; '—' when unknown or variable (-1) */
+function perMtok(perToken) {
+  if (perToken === null || perToken === undefined) { return '—'; }
+  const n = Number(perToken);
+  if (Number.isNaN(n) || n < 0) { return '—'; }
+  return (n * 1e6).toFixed(2);
+}
+
+function fmtRow(m, aliasesById) {
+  const alias = aliasesById.get(m.id);
+  const aliasCol = alias ? `[${alias}] ` : '';
+  const ctx = m.contextLength ?? '—';
+  const pIn = perMtok(m.pricing && m.pricing.prompt);
+  const pOut = perMtok(m.pricing && m.pricing.completion);
+  return `${aliasCol}${m.id}\n    ${m.name}  ctx ${ctx}  $/Mtok in ${pIn} out ${pOut}`;
+}
+
+/** One readable line per gateway-route finding (Task 6, #gwid). @param {object} f @returns {string} */
+function fmtGatewayFinding(f) {
+  if (f.kind === 'stale') {
+    return `  GATEWAY STALE (${f.gateway}): ${f.alias} -> ${f.model}`;
+  }
+  if (f.kind === 'divergent-missing') {
+    return `  GATEWAY DIVERGENT: ${f.alias} has no direct form; catalog confirms ${f.model}`;
+  }
+  return `  GATEWAY DIVERGENT: ${f.alias} direct form ${f.model} no longer matches catalog (now ${f.expected})`;
+}
+
+const PROBE_LABELS = { served: 'SERVED', 'accepted-but-silent': 'SILENT', error: 'ERROR' };
+
+/** '$0.0004' | '$1.23' | '—' (unknown). Deliberately NOT formatCost (pricing.js):
+ * a probe result's `cost` is a bare number (models-probe.js doesn't carry the
+ * reported/estimated source tag), so this never claims a precision it can't back. */
+function fmtProbeCost(cost) {
+  if (cost === null || cost === undefined || Number.isNaN(cost)) { return '—'; }
+  return cost < 1 ? `$${cost.toFixed(4)}` : `$${cost.toFixed(2)}`;
+}
+
+/** One readable line per probed alias (`--check --live`, v4.6.2 PR3): uppercase
+ * class prefix padded to a fixed column, two-space indent — mirrors the STALE/
+ * DRIFTED/GATEWAY line style above. @param {object} r probeStoredAliases() row */
+function fmtProbeLine(r) {
+  const head = `  ${(PROBE_LABELS[r.outcome] + ':').padEnd(8)}${r.alias} -> ${r.target}`;
+  if (r.outcome === 'served') { return `${head} (${fmtProbeCost(r.cost)})`; }
+  if (r.outcome === 'accepted-but-silent') { return `${head} — ${r.detail} (no output within the probe window)`; }
+  return `${head} — ${r.detail}`;
+}
+
+/** One readable line per REJECTED provider fetch (issue 209): a namespace that is
+ * empty because its key was refused explains stale/absent aliases downstream.
+ * @param {{provider: string, reason: string, status?: number, detail?: string}} f
+ * @returns {string} */
+function fmtProviderFailure(f) {
+  const why = f.reason === 'http-status' ? `HTTP ${f.status}` : (f.detail || f.reason);
+  return `PROVIDER FETCH FAILED: ${f.provider} (${why}) — its models are absent from the catalog`;
+}
+
+module.exports = {
+  perMtok, fmtRow, fmtGatewayFinding, PROBE_LABELS, fmtProbeCost, fmtProbeLine, fmtProviderFailure,
+};

package/src/sidecar/models.js

@@ -21,25 +21,11 @@ const { getFamilies } = require('../utils/curated-models');
 const { pickCurrent } = require('../utils/quick-picks');
 const { probeStoredAliases, selectStoredAliases } = require('./models-probe');
 const { DEFAULT_MAX_LEGS } = require('./fanout-validate');
+const { fmtRow, fmtGatewayFinding, fmtProbeLine, fmtProviderFailure } = require('./models-render');
 
 const CHECK_EXIT_CAP = 100;
 
-/** '0.000003' per token → '3.00' per Mtok; '—' when unknown or variable (-1) */
-function perMtok(perToken) {
-  if (perToken === null || perToken === undefined) { return '—'; }
-  const n = Number(perToken);
-  if (Number.isNaN(n) || n < 0) { return '—'; }
-  return (n * 1e6).toFixed(2);
-}
 
-function fmtRow(m, aliasesById) {
-  const alias = aliasesById.get(m.id);
-  const aliasCol = alias ? `[${alias}] ` : '';
-  const ctx = m.contextLength ?? '—';
-  const pIn = perMtok(m.pricing && m.pricing.prompt);
-  const pOut = perMtok(m.pricing && m.pricing.completion);
-  return `${aliasCol}${m.id}\n    ${m.name}  ctx ${ctx}  $/Mtok in ${pIn} out ${pOut}`;
-}
 
 /** alias marks: id → comma-joined alias names (effective user aliases) */
 function aliasMarks() {
@@ -130,36 +116,9 @@ async function runRefresh(args) {
   return 0;
 }
 
-/** One readable line per gateway-route finding (Task 6, #gwid). @param {object} f @returns {string} */
-function fmtGatewayFinding(f) {
-  if (f.kind === 'stale') {
-    return `  GATEWAY STALE (${f.gateway}): ${f.alias} -> ${f.model}`;
-  }
-  if (f.kind === 'divergent-missing') {
-    return `  GATEWAY DIVERGENT: ${f.alias} has no direct form; catalog confirms ${f.model}`;
-  }
-  return `  GATEWAY DIVERGENT: ${f.alias} direct form ${f.model} no longer matches catalog (now ${f.expected})`;
-}
 
-const PROBE_LABELS = { served: 'SERVED', 'accepted-but-silent': 'SILENT', error: 'ERROR' };
 
-/** '$0.0004' | '$1.23' | '—' (unknown). Deliberately NOT formatCost (pricing.js):
- * a probe result's `cost` is a bare number (models-probe.js doesn't carry the
- * reported/estimated source tag), so this never claims a precision it can't back. */
-function fmtProbeCost(cost) {
-  if (cost === null || cost === undefined || Number.isNaN(cost)) { return '—'; }
-  return cost < 1 ? `$${cost.toFixed(4)}` : `$${cost.toFixed(2)}`;
-}
 
-/** One readable line per probed alias (`--check --live`, v4.6.2 PR3): uppercase
- * class prefix padded to a fixed column, two-space indent — mirrors the STALE/
- * DRIFTED/GATEWAY line style above. @param {object} r probeStoredAliases() row */
-function fmtProbeLine(r) {
-  const head = `  ${(PROBE_LABELS[r.outcome] + ':').padEnd(8)}${r.alias} -> ${r.target}`;
-  if (r.outcome === 'served') { return `${head} (${fmtProbeCost(r.cost)})`; }
-  if (r.outcome === 'accepted-but-silent') { return `${head} — ${r.detail} (no output within the probe window)`; }
-  return `${head} — ${r.detail}`;
-}
 
 async function runCheck(args) {
   // v4.9 W13 Task B (BACKLOG C5). FIRST — ahead of the catalog-unavailable return
@@ -171,13 +130,17 @@ async function runCheck(args) {
   require('../utils/alias-shadow').auditAliasShadows();
   const catalogInfo = await getCatalogInfo();
   const catalog = catalogInfo.models;
+  const providerFailures = Array.isArray(catalogInfo.providerFailures) ? catalogInfo.providerFailures : [];
   if (!catalog || catalog.length === 0) {
     const probeSkipped = args.live ? 'catalog-unavailable' : null;
     if (args.json) {
       process.stdout.write(JSON.stringify(buildAuditDoc({
-        stale: [], catalogAvailable: false, probeSkipped
+        stale: [], catalogAvailable: false, probeSkipped, providerFailures
       }), null, 2) + '\n');
     } else {
+      // Council C2 (PR 215): "catalog unavailable" is precisely when the user
+      // needs to know WHICH provider refused them.
+      for (const f of providerFailures) { process.stdout.write(fmtProviderFailure(f) + '\n'); }
       process.stdout.write('Catalog unavailable (offline or no providers reachable); cannot check.\n');
       if (probeSkipped) { process.stdout.write(fmtLiveSkipped(probeSkipped) + '\n'); }
     }
@@ -186,7 +149,7 @@ async function runCheck(args) {
   const sources = collectAliasSources();
   const stale = findStaleAliases(sources, catalog)
     .map(s => ({ ...s, suggestions: suggestReplacements(s.model, catalog) }));
-  const drifted = findDriftedStoredAliases(sources, catalog);
+  const drifted = findDriftedStoredAliases(sources, catalogInfo);
   // Task 6 (#gwid): per-gateway-form audit of the curated DEFAULTS
   // (toGatewayRoutes()) — additive to the flat audit above. Informational by
   // default; --strict promotes it to a build-breaking exit code (CI gate).
@@ -221,10 +184,14 @@ async function runCheck(args) {
 
   if (args.json) {
     process.stdout.write(JSON.stringify(buildAuditDoc({
-      stale, catalogAvailable: true, gatewayFindings, drifted, probe: probeResults
+      stale, catalogAvailable: true, gatewayFindings, drifted, probe: probeResults, providerFailures
     }), null, 2) + '\n');
     return exitCode;
   }
+  // issue 209: report REJECTED provider fetches before the alias findings -- an
+  // empty namespace explains stale/absent aliases downstream, and staying
+  // silent about it is the original defect.
+  for (const f of providerFailures) { process.stdout.write(fmtProviderFailure(f) + '\n'); }
   const driftLines = buildFallbackDriftReport(catalog);
   if (stale.length === 0 && drifted.length === 0) {
     process.stdout.write(`All aliases resolve to catalog models (${sources.length} checked).\n`);

package/src/sidecar/reopen-spend.js

@@ -20,7 +20,8 @@ function finalizeSpendForReopen({ taskId, model, mode, op, result, status, proje
     metadata.usage = usage; // buildRunResult surfaces metadata.usage into the --json doc for free
     try {
       const { appendSpend } = require('../utils/spend-ledger');
-      const gateway = metadata.gateway || (String(model).startsWith('openrouter/') ? 'openrouter' : 'direct');
+      const { gatewayOf } = require('../utils/gateway-router');
+      const gateway = metadata.gateway || gatewayOf(model);
       // v4.7.1 Task 7 D16: null-not-absent, the OPPOSITE convention from
       // metadata.tag's absent-not-null (D13) — same `|| null` idiom as start.js:237.
       appendSpend({ taskId, model, mode, usage, op, status, project, gateway, tag: metadata.tag || null }, ctx);

package/src/sidecar/setup.js

@@ -475,9 +475,17 @@ async function runReadlineSetup() {
       await warnOnLowOpenRouterCredit();
     }
 
-    const { getCatalog } = require('../utils/model-catalog');
+    const { getCatalogInfo } = require('../utils/model-catalog');
     let catalog = [];
-    try { catalog = await getCatalog(); } catch (_err) { /* offline: pinned */ }
+    // #208: carry the per-provider fetch outcomes alongside the rows, so the
+    // vendor shortlist below cannot synthesise a bare direct id for a
+    // namespace whose fetch was rejected rather than never attempted.
+    let providerFailures = [];
+    try {
+      const info = await getCatalogInfo();
+      catalog = info.models;
+      providerFailures = info.providerFailures || [];
+    } catch (_err) { /* offline: pinned */ }
 
     // Task 7 (cost-aware defaults P2): per-provider picker, once per keyed
     // provider, BEFORE the mode prompt -- orthogonal to standard-vs-free-council.
@@ -537,7 +545,7 @@ async function runReadlineSetup() {
     }
 
     // Read-modify-write — never rebuild the alias table (no-clobber rule).
-    const cfg = loadConfig() || { aliases: toLiveSeedAliases(catalog) };
+    const cfg = loadConfig() || { aliases: toLiveSeedAliases({ models: catalog, providerFailures }) };
     if (!cfg.aliases) { cfg.aliases = {}; }
     if (chosen.alias) {
       cfg.default = chosen.alias;
@@ -548,7 +556,7 @@ async function runReadlineSetup() {
       // choice), but the alias's VALUE must stay the vendor phase's tier choice --
       // skip the curated-flagship upgrade so it isn't discarded.
       if (pick && !chosen.noUpgrade && !vendorAliasesWritten.has(chosen.alias)) {
-        cfg.aliases[chosen.alias] = toStorableRoute(pick);
+        cfg.aliases[chosen.alias] = toStorableRoute(pick, { models: catalog, providerFailures });
       } else if (cfg.aliases[chosen.alias] === undefined) {
         const fallback = getDefaultAliases()[chosen.alias];
         if (fallback !== undefined) { cfg.aliases[chosen.alias] = fallback; }
@@ -599,6 +607,7 @@ async function runReadlineSetup() {
           const { buildModelShortlist } = require('../utils/model-shortlist');
           const shortlist = buildModelShortlist(pick.vendorPath, {
             catalog,
+            providerFailures,
             recommendedId: cfg.aliases[chosen.alias],
           });
           const specific = await promptForVendorModel(

package/src/sidecar/start.js

@@ -219,6 +219,7 @@ async function startSidecar(options) {
     try {
       const { appendSpend } = require('../utils/spend-ledger');
       const { statusFromResult } = require('../utils/result-schema');
+      const { gatewayOf } = require('../utils/gateway-router');
       appendSpend({
         taskId, model, mode: effectiveHeadless ? 'headless' : 'interactive', usage: runUsage,
         op: 'start', status: statusFromResult(result), project: effectiveProject,
@@ -227,7 +228,7 @@ async function startSidecar(options) {
         // inside createSessionMetadata. Reading `metadata.gateway` throws a ReferenceError the
         // best-effort catch swallows → EVERY start-mode spend row silently dropped + start-json.test.js
         // goes red. Use an in-scope value (spec-complete for direct/openrouter):
-        gateway: String(model).startsWith('openrouter/') ? 'openrouter' : 'direct',
+        gateway: gatewayOf(model),
         // (To also attribute v4.2 'local': thread the resolved route gateway — dropped today at
         // cli-handlers-run.js:47 — into createSessionMetadata and read `meta.gateway`, as continue.js:111 does.)
         // v4.7 F8 D16: same in-scope-value rule as gateway above — `m` is the

package/src/utils/alias-audit.js

@@ -172,13 +172,20 @@ function suggestReplacements(staleModel, catalog, n = 3) {
  * @param {Array<{id:string}>} catalog
  * @returns {Array<{alias:string,stored:string,current:string}>}
  */
-function findDriftedStoredAliases(sources, catalog) {
-  if (!catalog || catalog.length === 0) { return []; }
+function findDriftedStoredAliases(sources, catalogOrInfo) {
+  // Council #216 A1/B2/C1: accepts catalogInfo (or a bare array, for existing
+  // callers). Passing models WITHOUT providerFailures made this compute the bare
+  // direct form for a REJECTED namespace while sidecar/setup.js persists the
+  // gateway form -- reporting drift that does not exist, and suggesting a repair
+  // that writes back the unservable direct id issue 208 removed.
+  const info = Array.isArray(catalogOrInfo) ? { models: catalogOrInfo } : (catalogOrInfo || { models: [] });
+  const catalog = info.models || [];
+  if (catalog.length === 0) { return []; }
   const { resolveQuickPicks, toStorableRoute } = require('./quick-picks');
   const current = new Map();
   for (const r of resolveQuickPicks(catalog)) {
     if (r.source !== 'live') { continue; }
-    const stored = toStorableRoute(r);
+    const stored = toStorableRoute(r, info);
     if (stored) { current.set(r.alias, { display: stored, routeValues: new Set(Object.values(r.routes)) }); }
   }
   const byProvider = idsByProvider(catalog);

package/src/utils/alias-shadow.js

@@ -103,7 +103,7 @@ const { collapseExcerpt } = require('./text-sanitize');
  */
 function findAliasShadows(names) {
   const { loadConfig } = require('./config');
-  const { toDefaultAliases, toCanonicalDefault } = require('./curated-models');
+  const { toDefaultAliases, stripGatewayPrefix } = require('./curated-models');
   const cfg = loadConfig();
   const userAliases = (cfg && cfg.aliases && typeof cfg.aliases === 'object') ? cfg.aliases : {};
   // Own keys only: a user config.json can carry a literal `__proto__`/`toString`
@@ -131,7 +131,7 @@ function findAliasShadows(names) {
     // ROUTING has its own audit (`models --check`'s per-gateway section); this
     // notice speaks only when the alias names a different MODEL. The rows still
     // report both sides RAW, so the user can grep their own config.
-    if (toCanonicalDefault(local) === toCanonicalDefault(shipped)) { continue; }
+    if (stripGatewayPrefix(local) === stripGatewayPrefix(shipped)) { continue; }
     out.push({ alias, local, curated: shipped });
   }
   return out;

package/src/utils/curated-models.js

@@ -142,9 +142,11 @@ function getFamilies() {
 }
 
 /**
- * Direct-first canonicalization for a pinned `openrouter/<vendor>/<rest>`
- * route: when `<vendor>` has a direct integration (provider-registry
- * `isDirectProvider`), strip the `openrouter/` prefix so the resulting bare
+ * ⚠️ MECHANICAL primitive, NOT a routing decision (renamed from `toCanonicalDefault`,
+ * issue 214 — model-canonicalization.js explains why that name was a trap). An id that
+ * will be CALLED or STORED must come from directFormIfSafe/directFormIfProven. Strips
+ * the `openrouter/` prefix off a pinned route when `<vendor>` has a direct integration
+ * (provider-registry `isDirectProvider`), so the resulting bare
  * `<vendor>/<rest>` id is policy-routed by the gateway router (direct when a
  * direct key exists, OpenRouter otherwise). Gateway-only vendors (no direct
  * integration — e.g. qwen, x-ai, z-ai, mistralai, minimax, moonshotai,
@@ -154,7 +156,7 @@ function getFamilies() {
  * @param {string} route
  * @returns {string}
  */
-function toCanonicalDefault(route) {
+function stripGatewayPrefix(route) {
   if (typeof route === 'string' && route.startsWith('openrouter/')) {
     const rest = route.slice('openrouter/'.length); // '<vendor>/<rest...>'
     const slashIdx = rest.indexOf('/');
@@ -211,7 +213,7 @@ function vendorOf(orRoute) {
 function directFormFor(vendorPath, obj) {
   if (obj[vendorPath]) { return obj[vendorPath]; } // explicit, authored, current direct id
   if (DIVERGENT_VENDORS.has(vendorPath)) { return undefined; } // no explicit form + divergent → omit
-  const bare = toCanonicalDefault(obj.openrouter); // safe only when ids are identical across gateways
+  const bare = stripGatewayPrefix(obj.openrouter); // safe only when ids are identical across gateways
   return bare !== obj.openrouter ? bare : undefined; // gateway-only vendor → undefined
 }
 
@@ -293,6 +295,6 @@ function toDefaultAliases() {
 }
 
 module.exports = {
-  getFamilies, toDefaultAliases, toCanonicalDefault, listCuratedRoutes, toGatewayRoutes,
+  getFamilies, toDefaultAliases, stripGatewayPrefix, listCuratedRoutes, toGatewayRoutes,
   directFormProvenance, DIVERGENT_VENDORS
 };

package/src/utils/gateway-router.js

@@ -12,6 +12,16 @@ const { classifyModel } = require('./model-classification');
 const { isDirectProvider } = require('./provider-registry');
 const HINTS = require('./remediation-hints');
 
+/**
+ * Which gateway an executable id routes through (issue 214). The inverse of
+ * `executableFor`. Non-string input reads as 'direct' rather than throwing --
+ * callers pass raw values off run metadata.
+ * @param {*} id @returns {'openrouter'|'direct'}
+ */
+function gatewayOf(id) {
+  return typeof id === 'string' && id.startsWith('openrouter/') ? 'openrouter' : 'direct';
+}
+
 /** Build the executable id for a gateway. */
 function executableFor(gateway, vendor, model) {
   return gateway === 'openrouter' ? `openrouter/${vendor}/${model}` : `${vendor}/${model}`;
@@ -199,4 +209,4 @@ function resolveRoute(req) {
   return routeError({ requested: d.raw, reason: 'no_key_for_vendor', preferredGateway: 'direct', suggestions: [] });
 }
 
-module.exports = { resolveRoute };
+module.exports = { gatewayOf, resolveRoute };

package/src/utils/model-canonicalization.js

@@ -32,7 +32,19 @@
 
 'use strict';
 
-const { toCanonicalDefault, DIVERGENT_VENDORS } = require('./curated-models');
+/*
+ * Why `stripGatewayPrefix` (curated-models.js) is not the function to reach for:
+ * under its old name `toCanonicalDefault` it read as the CORRECT answer, and three
+ * callers took it at its word and persisted ids the direct API may not serve — the
+ * wizard's hand-copy `toBareIfDirect`, `toStorableRoute`, and `toDefaultAliases`
+ * before it was rewritten. Issue 214 renamed it rather than giving it a
+ * `catalogInfo` parameter, because that is circular: it PRODUCES the candidate id
+ * that `classifyModel` then checks against the catalog. The evidence check belongs
+ * one level up, here. Direct use of the primitive is correct only when normalising
+ * two strings before COMPARING them (alias-shadow.js).
+ */
+
+const { stripGatewayPrefix, DIVERGENT_VENDORS } = require('./curated-models');
 const { classifyModel } = require('./model-classification');
 
 /**
@@ -41,10 +53,47 @@ const { classifyModel } = require('./model-classification');
  * @param {{models: Array<{id:string, authoritative?: boolean}>}} catalogInfo
  * @returns {string} the bare direct id when not proven invalid, else `orId` unchanged
  */
+/**
+ * #208: did THIS vendor's direct namespace get ATTEMPTED and REJECTED for the
+ * catalog in hand? An empty namespace has two causes and `classifyModel`
+ * cannot tell them apart -- it returns 'unknown' for both. "Never fetched"
+ * (offline, no key) leaves optimism reasonable; "fetched and refused" means we
+ * know nothing about the namespace, and synthesising a direct id out of no
+ * knowledge is exactly how `deepseek/deepseek-v4-flash-0731` -- an id no
+ * gateway serves -- reached a real user config. Keyed on the VENDOR, never on
+ * "any failure": one provider's 401 says nothing about another's namespace.
+ * @param {string} vendor
+ * @param {{providerFailures?: Array<{provider: string}>}} catalogInfo
+ * @returns {boolean}
+ */
+function namespaceFetchFailed(vendor, catalogInfo) {
+  const failures = catalogInfo && catalogInfo.providerFailures;
+  return Array.isArray(failures) && failures.some(f => f && f.provider === vendor);
+}
+
+/**
+ * Vendor segment of an executable id: `openrouter/<vendor>/<rest>` or
+ * `<vendor>/<rest>`. Council #216 (A2/B1): both guards below used to key on the
+ * CALLER's `vendor` argument while classifyModel derived its own from the id, so
+ * a caller passing none -- which toStorableRoute's JSDoc permits
+ * (`vendorPath?:string`) -- silently lost the DIVERGENT and namespace-rejection
+ * checks while the catalog check kept working. Deriving closes that asymmetry.
+ * @param {*} id @returns {string} '' when the id carries no vendor segment
+ */
+function vendorOfId(id) {
+  if (typeof id !== 'string') { return ''; }
+  const rest = id.startsWith('openrouter/') ? id.slice('openrouter/'.length) : id;
+  const idx = rest.indexOf('/');
+  return idx > 0 ? rest.slice(0, idx) : '';
+}
+
 function directFormIfSafe(vendor, orId, catalogInfo) {
-  if (DIVERGENT_VENDORS.has(vendor)) { return orId; }
-  const bare = toCanonicalDefault(orId);
+  const v = vendor || vendorOfId(orId);
+  if (DIVERGENT_VENDORS.has(v)) { return orId; }
+  const bare = stripGatewayPrefix(orId);
   if (bare === orId) { return orId; } // gateway-only vendor -- no direct integration at all
+  // Optimism is only justified when the namespace was never attempted.
+  if (namespaceFetchFailed(v, catalogInfo)) { return orId; }
   return classifyModel(bare, 'direct', catalogInfo) === 'invalid' ? orId : bare;
 }
 
@@ -55,10 +104,10 @@ function directFormIfSafe(vendor, orId, catalogInfo) {
  * @returns {string} the bare direct id only when PROVEN valid, else `orId` unchanged
  */
 function directFormIfProven(vendor, orId, catalogInfo) {
-  if (DIVERGENT_VENDORS.has(vendor)) { return orId; }
-  const bare = toCanonicalDefault(orId);
+  if (DIVERGENT_VENDORS.has(vendor || vendorOfId(orId))) { return orId; }
+  const bare = stripGatewayPrefix(orId);
   if (bare === orId) { return orId; }
   return classifyModel(bare, 'direct', catalogInfo) === 'valid' ? bare : orId;
 }
 
-module.exports = { directFormIfSafe, directFormIfProven };
+module.exports = { directFormIfSafe, directFormIfProven, namespaceFetchFailed, vendorOfId };

package/src/utils/model-catalog.js

@@ -19,7 +19,7 @@ const path = require('path');
 // this module is first required (the test pattern re-mocks mid-test).
 function _getConfigDir() { return require('./config').getConfigDir(); }
 function _readApiKeyValues() { return require('./api-key-store').readApiKeyValues(); }
-async function _fetchAllModels(keys) { return require('./model-fetcher').fetchAllModels(keys); }
+async function _fetchAllModels(keys) { return require('./model-fetcher').fetchAllModelsDetailed(keys); }
 
 const DEFAULT_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24h
 const CATALOG_SCHEMA_VERSION = 2;
@@ -69,8 +69,16 @@ function writeCacheDoc(doc) {
 }
 
 /** Write a successful fetch: fresh models/fetchedAt, outcome fields cleared. @param {Array} models */
-function writeCache(models) {
-  writeCacheDoc({ schemaVersion: CATALOG_SCHEMA_VERSION, fetchedAt: Date.now(), models });
+function writeCache(models, providerFailures) {
+  writeCacheDoc({
+    schemaVersion: CATALOG_SCHEMA_VERSION,
+    fetchedAt: Date.now(),
+    models,
+    // #209: which providers were ATTEMPTED and REJECTED for this fetch. Persisted
+    // alongside the rows because it describes THESE rows -- a cache served later
+    // is still a catalog whose deepseek namespace is empty for a reason.
+    providerFailures: Array.isArray(providerFailures) ? providerFailures : [],
+  });
 }
 
 /**
@@ -80,9 +88,17 @@ function writeCache(models) {
  * carries only the outcome fields (no models/fetchedAt to report).
  * @param {string} reason short error-class string
  */
-function writeRefreshFailure(reason) {
+function writeRefreshFailure(reason, providerFailures) {
   const existing = readCache() || { schemaVersion: CATALOG_SCHEMA_VERSION };
-  writeCacheDoc({ ...existing, lastRefreshAttempt: Date.now(), lastRefreshError: reason });
+  const doc = { ...existing, lastRefreshAttempt: Date.now(), lastRefreshError: reason };
+  // Council C1 (PR 215): a TOTAL outage is exactly when the per-provider
+  // breakdown matters most, and this path used to discard the failures the
+  // refresh had just computed. Only overwrite when this attempt produced some --
+  // an attempt that learned nothing must not erase a previous attempt's detail.
+  if (Array.isArray(providerFailures) && providerFailures.length > 0) {
+    doc.providerFailures = providerFailures;
+  }
+  writeCacheDoc(doc);
 }
 
 /**
@@ -91,7 +107,7 @@ function writeRefreshFailure(reason) {
  */
 async function refreshCatalog() {
   const keys = _readApiKeyValues();
-  const models = await _fetchAllModels(keys);
+  const { rows: models, failures: providerFailures } = await _fetchAllModels(keys);
   // The anthropic rows are a hardcoded zero-network floor: a result containing
   // ONLY them means every network provider failed. Treat that as a failed
   // refresh — never clobber a previously-good cache with the floor (the
@@ -105,10 +121,10 @@ async function refreshCatalog() {
     const reason = (models || []).length > 0
       ? 'floor-only: all providers returned no network rows'
       : 'network-error: all providers unreachable';
-    writeRefreshFailure(reason);
+    writeRefreshFailure(reason, providerFailures);
     return [];
   }
-  writeCache(models);
+  writeCache(models, providerFailures);
   return models;
 }
 
@@ -149,6 +165,8 @@ async function getCatalogInfo(opts = {}) {
     fetchedAt: cache ? cache.fetchedAt : null,
     lastRefreshAttempt: (doc && doc.lastRefreshAttempt) || null,
     lastRefreshError: (doc && doc.lastRefreshError) || null,
+    // #209: namespace-level fetch outcomes for the CACHED rows above.
+    providerFailures: (doc && Array.isArray(doc.providerFailures)) ? doc.providerFailures : [],
   };
 }
 

package/src/utils/model-fetcher.js

@@ -136,48 +136,85 @@ function fetchModelsFromProvider(provider, key) {
 }
 
 /**
- * Perform the HTTPS fetch + normalize for a single configured provider.
- * Resolves to `[]` on any non-200 response, network error, timeout, or parse error.
+ * Perform the HTTPS fetch + normalize for a single configured provider,
+ * REPORTING why it failed (issue #209). The four failure modes used to
+ * collapse to a bare `[]`, which made a rejected fetch indistinguishable from
+ * a provider that legitimately serves no models -- and that ambiguity is what
+ * lets `classifyModel` return 'unknown' for a namespace whose fetch was
+ * actually refused (see #208).
  * @param {string} provider - Key into PROVIDER_FETCH_CONFIG
  * @param {string} key - API key
- * @returns {Promise<Array>} Normalized model rows, or [] on any failure
+ * @returns {Promise<{rows: Array, failure: {reason: string, status?: number, detail?: string}|null}>}
  */
-function fetchViaConfig(provider, key) {
+function fetchViaConfigDetailed(provider, key) {
   const config = PROVIDER_FETCH_CONFIG[provider];
   const url = config.buildUrl ? config.buildUrl(key) : config.url;
   const headers = config.authHeader(key);
 
   return new Promise((resolve) => {
     let chunks = '';
+    const ok = (rows) => resolve({ rows, failure: null });
+    const fail = (failure) => resolve({ rows: [], failure });
+
     const timer = setTimeout(() => {
       req.destroy();
-      resolve([]);
+      fail({ reason: 'timeout', detail: `no response within ${FETCH_TIMEOUT_MS}ms` });
     }, FETCH_TIMEOUT_MS);
 
     const req = https.get(url, { headers }, (res) => {
       if (res.statusCode !== 200) {
         clearTimeout(timer);
         res.on('data', () => {});
-        res.on('end', () => resolve([]));
+        res.on('end', () => fail({ reason: 'http-status', status: res.statusCode }));
         return;
       }
       res.on('data', (chunk) => { chunks += chunk; });
       res.on('end', () => {
         clearTimeout(timer);
         try {
-          resolve(config.normalize(chunks));
-        } catch (_err) {
-          resolve([]);
+          ok(config.normalize(chunks));
+        } catch (err) {
+          fail({ reason: 'parse-error', detail: err.message });
         }
       });
     });
-    req.on('error', () => {
+    req.on('error', (err) => {
       clearTimeout(timer);
-      resolve([]);
+      fail({ reason: 'network-error', detail: err.message });
     });
   });
 }
 
+/**
+ * Rows-only view of `fetchViaConfigDetailed`, preserving the historical
+ * contract (`[]` on any failure) for existing callers.
+ * @param {string} provider @param {string} key @returns {Promise<Array>}
+ */
+function fetchViaConfig(provider, key) {
+  return fetchViaConfigDetailed(provider, key).then(r => r.rows);
+}
+
+/**
+ * Per-provider fetch WITH failure reporting. Mirrors
+ * `fetchModelsFromProvider`'s special cases exactly:
+ *  - anthropic without a key: the hardcoded floor, no network, NOT a failure.
+ *  - anthropic with a key that yields nothing: floor rows, failure reported.
+ *  - unknown provider: no rows, not a failure (nothing was attempted).
+ * @param {string} provider @param {string} key
+ * @returns {Promise<{rows: Array, failure: object|null}>}
+ */
+function fetchModelsFromProviderDetailed(provider, key) {
+  const floor = () => ANTHROPIC_MODELS.map(r => ({ ...r, authoritative: false }));
+  if (provider === 'anthropic') {
+    if (!key) { return Promise.resolve({ rows: floor(), failure: null }); }
+    return fetchViaConfigDetailed('anthropic', key).then(({ rows, failure }) =>
+      (rows.length > 0 ? { rows, failure: null } : { rows: floor(), failure }));
+  }
+  const config = PROVIDER_FETCH_CONFIG[provider];
+  if (!config) { return Promise.resolve({ rows: [], failure: null }); }
+  return fetchViaConfigDetailed(provider, key);
+}
+
 /** Providers to fetch: every keyed provider + openrouter (keyless-capable) + anthropic. */
 function providersToFetch(keys) {
   const set = new Set(Object.keys(keys).filter(p => keys[p]));
@@ -190,12 +227,16 @@ function providersToFetch(keys) {
  * Fetch models from all providers that have keys configured; openrouter is
  * always included (keyless public endpoint) as is anthropic (hardcoded list).
  * @param {Object<string, string>} keys - Map of provider → API key string
- * @returns {Promise<Array<{id: string, name: string, contextLength: number|null, pricing: object|null}>>} Combined model list
+ * @returns {Promise<{rows: Array, failures: Array<{provider: string, reason: string, status?: number, detail?: string}>}>}
  */
-async function fetchAllModels(keys) {
+async function fetchAllModelsDetailed(keys) {
   const providers = providersToFetch(keys);
-  const results = await Promise.all(providers.map(p => fetchModelsFromProvider(p, keys[p] || '')));
-  const rows = results.flat();
+  const results = await Promise.all(providers.map(p =>
+    fetchModelsFromProviderDetailed(p, keys[p] || '').then(r => ({ provider: p, ...r }))));
+  const rows = results.flatMap(r => r.rows);
+  const failures = results
+    .filter(r => r.failure)
+    .map(r => ({ provider: r.provider, ...r.failure }));
   // v4.2 §4.4: append local-provider rows via the scheme-aware probe (5s, [] on failure).
   try {
     const { getLocalProviders } = require('./local-providers');
@@ -205,7 +246,17 @@ async function fetchAllModels(keys) {
       listLocalModels(e, { timeoutMs: 5000, bearer: e.apiKeyEnv ? process.env[e.apiKeyEnv] : undefined })));
     for (const r of localResults) { rows.push(...r); }
   } catch (_err) { /* local rows are best-effort — never break the cloud catalog */ }
-  return rows;
+  return { rows, failures };
+}
+
+/**
+ * Rows-only view of `fetchAllModelsDetailed` — the historical signature, kept
+ * so existing callers and their tests are unaffected.
+ * @param {Object<string, string>} keys
+ * @returns {Promise<Array>} Combined model list
+ */
+async function fetchAllModels(keys) {
+  return (await fetchAllModelsDetailed(keys)).rows;
 }
 
 /**
@@ -236,6 +287,8 @@ function groupModelsByFamily(models) {
 module.exports = {
   fetchModelsFromProvider,
   fetchAllModels,
+  fetchAllModelsDetailed,
+  fetchModelsFromProviderDetailed,
   providersToFetch,
   groupModelsByFamily,
   ANTHROPIC_MODELS,

package/src/utils/model-shortlist.js

@@ -60,7 +60,8 @@ function compareShortlistRows(a, b) {
 
 /**
  * @param {string} vendor e.g. 'deepseek'
- * @param {{catalog?: Array<object>, recommendedId?: string, limit?: number}} [options]
+ * @param {{catalog?: Array<object>, recommendedId?: string, limit?: number,
+ *   providerFailures?: Array<{provider:string}>}} [options]
  * @returns {{recommendedId: (string|null), suggested: Array<object>,
  *   rest: Array<object>, total: number}}
  */
@@ -69,7 +70,9 @@ function buildModelShortlist(vendor, options = {}) {
   const limit = Number.isInteger(options.limit) && options.limit > 0
     ? options.limit : SHORTLIST_LIMIT;
 
-  const { preselectedId, rows } = buildProviderDefaultChoices(vendor, { catalog });
+  const { preselectedId, rows } = buildProviderDefaultChoices(vendor, {
+    catalog, providerFailures: options.providerFailures,
+  });
   if (!rows || rows.length === 0) {
     return { recommendedId: null, suggested: [], rest: [], total: 0 };
   }

package/src/utils/provider-default-picker.js

@@ -118,9 +118,11 @@ function chooseRowId(vendor, isDirect, row, paired, catalogInfo) {
  * @param {string} vendor
  * @returns {Array<{id:string,name:string,contextLength:(number|null),pricePerMInput:(number|null),isPreselected:boolean}>}
  */
-function buildRows(catalog, vendor) {
+function buildRows(catalog, vendor, providerFailures) {
   const byId = new Map(catalog.filter(r => r && typeof r.id === 'string').map(r => [r.id, r]));
-  const catalogInfo = { models: catalog };
+  // issue 208: providerFailures MUST ride along -- this rebuilds catalogInfo from a bare
+  // array, so dropping it leaves directFormIfSafe's namespace gate dead in production.
+  const catalogInfo = { models: catalog, providerFailures: providerFailures || [] };
   const directPrefix = `${vendor}/`;
   const orPrefix = `openrouter/${vendor}/`;
   // Hoisted: `vendor` is fixed for the whole call, so this is decided once
@@ -229,7 +231,7 @@ function buildProviderDefaultChoices(vendor, options = {}) {
   if (typeof vendor !== 'string' || !vendor) { return { preselectedId: null, rows: [] }; }
 
   const catalog = Array.isArray(options.catalog) ? options.catalog : [];
-  const rows = buildRows(catalog, vendor);
+  const rows = buildRows(catalog, vendor, options.providerFailures);
   if (rows.length === 0) { return { preselectedId: null, rows: [] }; }
 
   const preselectedId = computePreselectedId(vendor, options.tier, catalog, rows);
@@ -271,6 +273,7 @@ function buildProviderDefaultChoices(vendor, options = {}) {
  * @returns {{alias: string, setAsDefault: boolean}}
  */
 function applyProviderDefault(vendor, chosenId, { seedDefaultIfAbsent = true, catalog } = {}) {
+  // Council C4 (PR 215): NO providerFailures -- directFormIfProven strips only on POSITIVE evidence, so a failed/empty namespace ('unknown') already returns chosenId untouched.
   const catalogInfo = { models: Array.isArray(catalog) ? catalog : [] };
   const storedId = directFormIfProven(vendor, chosenId, catalogInfo);
 

package/src/utils/quick-picks.js

@@ -10,7 +10,8 @@
 
 'use strict';
 
-const { getFamilies, toDefaultAliases, toCanonicalDefault, DIVERGENT_VENDORS } = require('./curated-models');
+const { getFamilies, toDefaultAliases, DIVERGENT_VENDORS } = require('./curated-models');
+const { directFormIfSafe } = require('./model-canonicalization');
 
 const MARKER_RE = /(-preview|-exp|-beta|-latest|:free)+$/;
 
@@ -84,12 +85,20 @@ function resolveQuickPicks(catalog) {
  * @param {{vendorPath?:string, routes?:Object<string,string>}} pick
  * @returns {string|undefined}
  */
-function toStorableRoute(pick) {
+function toStorableRoute(pick, catalogInfo) {
   const routes = (pick && pick.routes) || {};
   if (pick && DIVERGENT_VENDORS.has(pick.vendorPath)) {
     return routes[pick.vendorPath] || routes.openrouter;
   }
-  return toCanonicalDefault(routes.openrouter || Object.values(routes)[0]);
+  const route = routes.openrouter || Object.values(routes)[0];
+  if (!route) { return undefined; }
+  // issue 214 remedy 1: this value is PERSISTED (sidecar/setup.js writes it into
+  // config.aliases; toLiveSeedAliases seeds a fresh config with it), so it must
+  // not be a blind prefix strip. directFormIfSafe keeps the optimism for a
+  // namespace that was never fetched while refusing for one the catalog
+  // disproves OR whose fetch was rejected -- the gap #208 closed on the picker
+  // path and left open here.
+  return directFormIfSafe(pick.vendorPath, route, catalogInfo || { models: [] });
 }
 
 /**
@@ -98,15 +107,44 @@ function toStorableRoute(pick) {
  * overlaid value is not a raw prefix strip.
  * @returns {Object<string,string>}
  */
-function toLiveSeedAliases(catalog) {
+function toLiveSeedAliases(catalogOrInfo) {
+  // Accepts the bare models array (historical callers) or a full catalogInfo.
+  // issue 214: the evidence was always handed in and then discarded.
+  const info = Array.isArray(catalogOrInfo)
+    ? { models: catalogOrInfo }
+    : (catalogOrInfo || { models: [] });
   const seeds = toDefaultAliases();
-  for (const r of resolveQuickPicks(catalog || [])) {
+  for (const r of resolveQuickPicks(info.models || [])) {
     if (r.source === 'live' && r.routes.openrouter) {
-      const stored = toStorableRoute(r);
+      const stored = toStorableRoute(r, info);
       if (stored) { seeds[r.alias] = stored; }
     }
   }
   return seeds;
 }
 
-module.exports = { compareIdsDesc, pickCurrent, resolveQuickPicks, toLiveSeedAliases, toStorableRoute };
+
+/**
+ * Per-provider SAFE storable form for a resolved quick pick (issue 214).
+ *
+ * The wizard renderer used to derive this itself, via a hand-copy of
+ * `stripGatewayPrefix` (`toBareIfDirect`) that dropped both of the real
+ * primitive's guards: it stripped `openrouter/` for DIVERGENT_VENDORS
+ * (fabricating anthropic's dot id, which the direct API rejects) and stripped
+ * for a namespace whose fetch had failed. The renderer cannot `require()`, so
+ * the decision is made here -- once, with the catalog in hand -- and shipped
+ * to the page as data.
+ * @param {{vendorPath: string, routes: Object<string,string>}} pick
+ * @param {{models: Array<{id:string}>, providerFailures?: Array<{provider:string}>}} catalogInfo
+ * @returns {Object<string,string>} provider -> safe storable id
+ */
+function canonicalRoutesFor(pick, catalogInfo) {
+  const out = {};
+  const routes = (pick && pick.routes) || {};
+  for (const [provider, route] of Object.entries(routes)) {
+    out[provider] = directFormIfSafe(pick.vendorPath, route, catalogInfo || { models: [] });
+  }
+  return out;
+}
+
+module.exports = { compareIdsDesc, canonicalRoutesFor, pickCurrent, resolveQuickPicks, toLiveSeedAliases, toStorableRoute };

package/src/utils/result-schema.js

@@ -231,7 +231,8 @@ function buildCatalogDoc({ models, fetchedAt, refreshed = false, search = null,
  *   probeSkipped?: string|null}} opts
  */
 function buildAuditDoc({
-  stale, catalogAvailable, gatewayFindings = [], drifted = [], probe = [], probeSkipped = null
+  stale, catalogAvailable, gatewayFindings = [], drifted = [], probe = [], probeSkipped = null,
+  providerFailures = []
 }) {
   return {
     schemaVersion: SCHEMA_VERSION,
@@ -246,6 +247,11 @@ function buildAuditDoc({
     probeCount: probe.length,
     probe,
     probeSkipped,
+    // issue 209: providers ATTEMPTED and REJECTED for the catalog in hand. An
+    // empty namespace is otherwise indistinguishable from a provider that
+    // genuinely serves nothing.
+    providerFailuresCount: providerFailures.length,
+    providerFailures,
   };
 }