omnius 1.0.847 → 1.0.849

package/docs/DISCOVERY.md

@@ -455,6 +455,8 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.guides-tui-workflows` | TUI Workflows | The TUI is the primary Omnius control surface for interactive use. |
 | `guide.handoff-crl-encoder-decoder-fix-uppercase` | HANDOFF: CRL Encoder/Decoder Bidirectional Fix | Date: 2026-04-22 Status: Needs Implementation Failing Test: packages/memory/tests/crl-converter.test.ts - "should validate roundtrip accuracy" |
 | `guide.index` | Omnius Documentation | Omnius is an autonomous local-first agent runtime with a TUI, REST daemon, P2P sponsor mesh, Telegram bridge, realtime conversation mode, media generation routes, and AIWG-compatible documentation skills. |
+| `guide.inference-fallback-priority` | Inference fallback priority | Local inference remains first. After a qualifying local failure and any required manual approval, the remote cascade uses these stages: |
+| `guide.keyless-provider-survey` | Keyless provider survey | Reviewed 2026-10-12. Discovery used public primary documentation and metadata. Live probes contained small synthetic prompts, never private conversation or repository context, and executed no tools. The complete sanitized survey is recorded with the keyless fallback work order. |
 | `guide.longhaul-35b-workorders` | Work Orders — Long-Haul Implementation on a 35B-Class Model | Origin: Root-cause review of the myactuator ESP32/PlatformIO session (35B ornith-vision) plus a 2026-literature sweep of surprising remedies. See companion analysis in docs/context-management-medium-models-proposal.md and docs/duplicate-calls-root-cause-analysis.md. |
 | `guide.memory-integration-analysis` | Memory Integration Analysis — Parallel Systems Gap Assessment | Date: 2026-04-23 Status: ✅ INTEGRATED — All P0 gaps closed Context: Review of literature on memory compression + integration testing of Omnius parallel memory systems |
 | `guide.model-capability-awareness-and-multimodal-memory-root-fix` | Model Capability Awareness And Multimodal Identity Memory Root Fix | Status: planning and integration tracker |
@@ -463,6 +465,7 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.omnius-self-edit-eval-2026-06-10` | Omnius Self-Edit Evaluation — Uncommitted Changes &amp; Duplicate-Tool-Call Failure Mode | &gt; Eval of the working-tree changes against docs/opencode-agentic-loop-comparison.md. &gt; Subject: an Omnius instance editing its own orchestrator to implement the P0–P10 &gt; learnings. Generated 2026-06-10. |
 | `guide.ontology-long-horizon-work-graph-uppercase` | Ontology Long-Horizon Work Graph | Use an ontological graph to control large and long tasks. Make each work item, relation, claim, and evidence item addressable. Keep one canonical graph across planning, execution, verification, and completion. |
 | `guide.opencode-agentic-loop-comparison` | OpenCode → Omnius: Agentic Loop &amp; Sub-Agent Delegation Comparison | &gt; Exhaustive comparison between https://github.com/anomalyco/opencode/tree/dev and &gt; packages/orchestrator/src/agenticRunner.ts (omnius). &gt; Generated 2026-06-10. |
+| `guide.opencode-free-model-discovery` | OpenCode free-model discovery | The pure parser in packages/orchestrator/src/opencode-free-models.ts adapts OpenCode's catalog discovery. The shared keyless registry and production fallback backend consume it to register the anonymous route; the parser itself makes no inference requests. Onboarding uses the same discovery and request adapter. |
 | `guide.operations-delay-analysis` | Unnecessary Causes of Delays Between Agent Actions | Analysis of packages/orchestrator/src/ (95 files) — identified delay sources ranked by impact. |
 | `guide.operations-delay-fix-review` | Delay Fix Review — Commits Since Delay Analysis | Date: 2026-06-10 Reference: /docs/operations/delay-analysis.md (15 delay sources documented) |
 | `guide.operations-runtime-hygiene` | Runtime Hygiene | Runtime hygiene keeps long-running Omnius instances from accumulating stale state, stuck child processes, or leaked project artifacts. |
@@ -520,6 +523,23 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.voice-flow-architecture` | Voice TTS Flow — Architecture &amp; Implementation Guide | This document describes the voice synthesis system in omnius: how it's built, how all the pieces connect, and how to add new voice features following the same patterns. |
 | `guide.work-orders-active-inference-route-remote-probes-20261012` | Active Inference Route Remote Probes 20261012 | Bundled Omnius documentation artifact: docs/work-orders/active-inference-route-remote-probes-20261012.json. |
 | `guide.work-orders-daemon-hud-ui-overhaul` | Daemon HUD UI Overhaul Work Order | Overhaul the daemon web interface using /home/roko/Desktop/hud-ui-style-kit(6)/hud-ui-style-kit as the source of truth. Preserve current daemon behavior while replacing the OpenWebUI-like rounded dashboard styling with the cold tactical HUD visual system. |
+| `guide.work-orders-evidence-fallback-model-benchmarks-20261012` | Fallback Model Benchmarks 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-model-benchmarks-20261012.json. |
+| `guide.work-orders-evidence-fallback-quality-installed-20261012` | Fallback Quality Installed 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-quality-installed-20261012.json. |
+| `guide.work-orders-evidence-fallback-reply-contracts-installed-20261012` | Fallback Reply Contracts Installed 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/fallback-reply-contracts-installed-20261012.json. |
+| `guide.work-orders-evidence-installed-fallback-verification-20261012` | Installed Fallback Verification 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/installed-fallback-verification-20261012.json. |
+| `guide.work-orders-evidence-keyless-compatibility-20261012` | Keyless Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/keyless-compatibility-20261012.json. |
+| `guide.work-orders-evidence-keyless-provider-survey-20261012` | Keyless Provider Survey 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/keyless-provider-survey-20261012.json. |
+| `guide.work-orders-evidence-kilo-production-compatibility-20261012` | Kilo Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/kilo-production-compatibility-20261012.json. |
+| `guide.work-orders-evidence-native-conversation-prompt-audit-20261012` | Native Conversation Prompt Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-conversation-prompt-audit-20261012.json. |
+| `guide.work-orders-evidence-native-goal-contract-probe-20261012` | Native Goal Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/native-goal-contract-probe-20261012.json. |
+| `guide.work-orders-evidence-opencode-all-free-audit-20261012` | Opencode All Free Audit 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-all-free-audit-20261012.json. |
+| `guide.work-orders-evidence-opencode-all-free-installed-verification-20261012` | Opencode All Free Installed Verification 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-all-free-installed-verification-20261012.json. |
+| `guide.work-orders-evidence-opencode-production-compatibility-20261012` | Opencode Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/opencode-production-compatibility-20261012.json. |
+| `guide.work-orders-evidence-ovh-production-compatibility-20261012` | Ovh Production Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-production-compatibility-20261012.json. |
+| `guide.work-orders-evidence-ovh-structured-context-compatibility-20261012` | Ovh Structured Context Compatibility 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/ovh-structured-context-compatibility-20261012.json. |
+| `guide.work-orders-evidence-terminal-review-contract-probe-20261012` | Terminal Review Contract Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-contract-probe-20261012.json. |
+| `guide.work-orders-evidence-terminal-review-error-probe-20261012` | Terminal Review Error Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-error-probe-20261012.json. |
+| `guide.work-orders-evidence-terminal-review-schema-repair-probe-20261012` | Terminal Review Schema Repair Probe 20261012 | Bundled Omnius documentation artifact: docs/work-orders/evidence/terminal-review-schema-repair-probe-20261012.json. |
 | `guide.work-orders-hermes-architecture-deltas-01-public-scrutiny-provenance-control-index-uppercase` | Public Scrutiny Provenance Control Index | Bundled Omnius documentation artifact: docs/work-orders/hermes-architecture-deltas/01-public-scrutiny-provenance-control/INDEX.md. |
 | `guide.work-orders-hermes-architecture-deltas-01-public-scrutiny-provenance-control-workorder-uppercase` | Workorder: Public Scrutiny Provenance Control | Add a public Telegram scrutiny control plane that can elevate completion provenance checks when public accuracy risk rises, without hard-coded scenario phrases or shortcut wording that teaches the model to satisfy the gate without evidence. |
 | `guide.work-orders-hermes-architecture-deltas-02-context-engine-plugin-boundary-index-uppercase` | Context Engine Plugin Boundary Index | Bundled Omnius documentation artifact: docs/work-orders/hermes-architecture-deltas/02-context-engine-plugin-boundary/INDEX.md. |
@@ -643,11 +663,16 @@ Daemon equivalents are `GET /v1/discovery/bootstrap`, `GET /v1/discovery?q=<inte
 | `guide.work-orders-telegram-reliability-consolidation-2026-09-28` | Telegram Reliability Consolidation — 2026-09-28 | Rule: check a box only after the named behavior is implemented and its listed verification passes. A parent box stays open until every child box is checked. |
 | `guide.work-orders-wo-active-inference-route-and-telegram-review-20261012-uppercase` | Active inference route and Telegram completion review | Status: implementation complete and verified. Publication remains with the user. |
 | `guide.work-orders-wo-am-gaps-uppercase` | Associative Memory Gap Work Orders | Generated: 2026-04-13 Source: Deep audit of multimodal associative memory systems Status: READY FOR IMPLEMENTATION |
+| `guide.work-orders-wo-fallback-quality-order-20261012-uppercase` | Benchmark-informed fallback cascade | Status: implemented and verified. Publication and active runtime replacement remain with the user. Telegram progress presentation stays deferred. |
+| `guide.work-orders-wo-fallback-reply-contracts-20261012-uppercase` | Fallback reply contracts and live Telegram regressions | Status: implemented and verified in source and the freshly installed package. Publishing and restarting the active bot remain user-owned. The subsequent OpenCode-first capability ordering is tracked in its work order; Telegram progress presentation remains explicitly deferred. |
 | `guide.work-orders-wo-inference-fallback-20261012-uppercase` | Local inference outage fallback | Status: source implementation complete and verified. Installed-runtime activation is separate; the running daemon has not been upgraded or restarted. |
+| `guide.work-orders-wo-keyless-fallback-coverage-20261012-uppercase` | Keyless automatic fallback coverage and compatibility | Status: implemented and verified. Publication and replacement of the running bot remain user-owned; the running bot has not been restarted by this work. |
 | `guide.work-orders-wo-native-transport-fresh-install-20261012-uppercase` | Native transport failure in the fresh npm installation gate | Status: implemented and verified. Publication remains with the user. |
+| `guide.work-orders-wo-opencode-all-free-models-20261012-uppercase` | All OpenCode free models in the fallback cascade | Status: implemented and verified. Publication and runtime replacement remain with the user. The subsequent live-reply fixes are tracked separately in fallback reply contracts. The original preferred-first/provider-fairness ordering recorded below has been superseded by benchmark-informed priority at the user's subsequent request. |
 | `guide.work-orders-wo-primary-checkout-fallback-delivery-20261012-uppercase` | Primary checkout delivery and remote output capacity | Status: implementation complete and verified in the primary checkout. Publication remains with the user. |
 | `guide.work-orders-wo-telegram-fallback-20261012-uppercase` | Telegram outage fallback and user-selected approval mode | Status: implementation complete; distributable verification recorded below. Publication and runtime installation are reserved for the user. |
 | `guide.work-orders-wo-telegram-plain-answer-and-provider-catalog-20261012-uppercase` | Preserve native Telegram answers and use compatible free inference routes | Status: implemented and verified. The user owns publication and runtime replacement. |
+| `guide.work-orders-wo-telegram-progress-presentation-20261012-uppercase` | Telegram progress presentation | Status: queued, explicitly deferred by the user until the inference endpoint patch is completed and verified. Do not implement this presentation work as part of the current inference repair. |
 | `guide.work-orders-wo-telegram-unavailable-review-presentation-20261012-uppercase` | Telegram reply presentation when an auxiliary review is unavailable | Status: implemented and verified. Publication and runtime replacement remain with the user. |
 | `guide.work-orders-world-class-memory-compiler-readme-uppercase` | World-Class Memory Compiler Program | Status: active implementation program Owner: Omnius orchestration and memory packages Last updated: 2026-07-13 |
 | `guide.work-orders-world-class-memory-compiler-tracker-uppercase` | Memory Compiler Implementation Tracker | Last reconciled: 2026-07-13 Authority: This file is the granular program tracker. The work-order documents define the contract and acceptance criteria; neither test output nor a model claim may check an item without the named evidence. |

package/docs/inference-fallback-priority.md

@@ -0,0 +1,91 @@
+# Inference fallback priority
+
+Local inference remains first. After a qualifying local failure and any required
+manual approval, the remote cascade uses these stages:
+
+1. Every eligible OpenCode free model, in benchmark-informed order.
+2. Every eligible Hermes model, as explicitly requested by the operator.
+3. Remaining keyless routes merged by model quality across providers.
+4. Explicitly configured keyed providers, in their configured order.
+
+An explicit `keyless: false` policy retains configured-only behavior. The
+OpenCode and Hermes stages are discovered lazily: successful OpenCode inference
+does not fetch lower provider catalogs. All stages retain the existing deadline,
+capability, context, cost, cooldown, ownership and cancellation checks. Models
+cooling after HTTP 429 do not hold up ready alternatives. Ready retries retain
+the original cascade priority rather than simply favoring an earlier expiry.
+
+## Benchmark basis
+
+The host-owned table in
+`packages/orchestrator/src/inference-fallback-priority.ts` uses non-estimated
+Artificial Analysis Intelligence Index **v4.3.2**, observed 2026-10-12. The same
+revision includes agentic workflow, terminal, coding, knowledge and long-context
+evaluations. Scores from older index revisions are not mixed into this order.
+
+| OpenCode model | Published index | Evaluated setting |
+| --- | ---: | --- |
+| [Muse Spark 1.3](https://artificialanalysis.ai/models/muse-spark-1-3) | 48.09 | Max; Xhigh separately scores 45.07 |
+| [Step 5 Preview](https://artificialanalysis.ai/models/step-5) | 43.73 | Reasoning |
+| [Ling 3.1 Flash](https://artificialanalysis.ai/models/ling-3-1-flash) | 41.09 | Reasoning |
+| [MiMo V2.6 Flash](https://artificialanalysis.ai/models/mimo-v2-6-flash) | 37.88 | Reasoning |
+| [Nemotron 3.5 Lightning](https://artificialanalysis.ai/models/nemotron-3-5-lightning) | 12.86 | Reasoning |
+
+These are published measurements of the named models, not benchmarks of the
+anonymous endpoints. Gateway effort, precision and checkpoint equivalence have
+not been established. The runtime uses each named model's highest published
+non-estimated variant as a preference for model potential; this does not change
+the caller's thinking policy or silently request maximum reasoning effort.
+
+Official coding results provide separate cross-checks: Muse 1.3 Max reports
+75.4% DeepSWE v1.1 and 88.8% Terminal-Bench 2.1; Step 5 High reports 67.7% and
+85.0%; MiMo Flash-RL reports 67.9% and 87.6%. Different harnesses and settings
+prevent treating those figures as an exact cross-model league table.
+[Meta](https://dev.meta.ai/models/muse-spark),
+[StepFun](https://www.stepfun.com/step-5-preview),
+[Xiaomi](https://huggingface.co/XiaomiMiMo/MiMo-V2.6-Flash-RL).
+
+## Unranked models and dynamic discovery
+
+Space Bunny and Big Pickle are undisclosed or rolling aliases. LongCat 2.5 has
+no exact comparable published result in the bounded search. They remain
+eligible after models with comparable measured results; this placement expresses
+evidence confidence, not proof that they are weaker. Small original experiments
+on Big Pickle and Space Bunny use different subsets and are recorded separately,
+without converting them into an invented AA score. New free models remain
+automatically discovered within the existing catalog bounds.
+
+For unmeasured models, declared tool/schema support and usable context/output
+headroom provide deterministic operational tie-breaks, followed by the host
+preferred identity and stable model ID. These fields do not measure intelligence.
+An opaque selector remains unranked; known measured concrete models precede it.
+For a wholly unmeasured compatible pool, its existing automatic selector remains
+available before concrete alternatives, without borrowing their token limits.
+
+The [research receipt](work-orders/evidence/fallback-model-benchmarks-20261012.json)
+maps 44 advertised candidate identities across OpenCode, Hermes, Kilo, LLM7, OVH
+and ch.at, with exact-version/mode alternatives and exclusions. Only measured
+matching identities enter the runtime table. Estimated-only scores, older
+LongCat/Mistral versions, and base-model scores for the quantized Hermes
+derivative do not become fabricated endpoint measurements.
+
+Published quality never establishes free access. In particular, current LLM7
+concrete rows advertise positive prices and its homepage describes free-token
+access; these facts do not confer anonymous tool/schema authority. The existing
+pricing and authentication filters remain in force.
+
+## Compatibility and verification
+
+Before dispatch, exact native tools, structured output and full request token
+budgets still determine eligibility. Ling's explicit schema-support rejection
+excludes it from schema-bearing turns. Muse retains its Responses transport.
+Learned native grammar restrictions are isolated by endpoint/model/API, and the
+complete original host schema remains authoritative. Successful output ends
+the cascade; no replay occurs after visible ordinary output or tool fragments.
+
+Source regressions cover full 512-model OpenCode traversal before Hermes,
+unknown-model discovery, published-score ordering, cross-provider quality merge,
+configured-only/tail behavior, cooldown recovery, ready retry priority and
+unchanged tool/schema/Stop contracts. The packaged backend verifier repeats the
+ordering and schema repair through synthetic HTTP with no real inference or
+Telegram messages.

package/docs/keyless-provider-survey.md

@@ -0,0 +1,48 @@
+# Keyless provider survey
+
+Reviewed 2026-10-12. Discovery used public primary documentation and metadata. Live probes contained small synthetic prompts, never private conversation or repository context, and executed no tools. The complete sanitized survey is recorded with the keyless fallback work order.
+
+## Kilo Gateway
+
+[Kilo authentication documentation](https://kilo.ai/docs/gateway/authentication) explicitly permits anonymous free-model requests, limited to 200 per hour per IP. Its [API reference](https://kilo.ai/docs/gateway/api-reference) specifies the OpenAI-compatible base `https://api.kilo.ai/api/gateway`, `POST /chat/completions`, streaming, native tools and structured output. No authorization or client-identity adapter was required by the probes.
+
+The unauthenticated [model catalog](https://api.kilo.ai/api/gateway/models) returned 391 rows, 486,989 bytes, SHA-256 `5fa77a837d02c12c0a3b68f7fd7bf18c09c4f988c30a25de0a012311fe6330fd`. Sixteen rows advertised explicit zero input and output pricing. [Kilo's free-model methodology](https://kilo.ai/landing/free-models) uses both prices, rather than requiring a free suffix. Current metadata must determine eligibility; paid rows never become keyless routes merely because the catalog itself is public.
+
+| Model ID | Tools | Strict schema advertised | Context | Max output |
+| --- | --- | --- | ---: | ---: |
+| `kilo-auto/free` | Yes | No | 256000 | 32768 |
+| `inclusionai/ling-3.1-flash` | Yes | No | 262144 | 235929 |
+| `dots-studio/dots-3-note-preview:free` | Yes | Yes | 512000 | 460800 |
+| `liquid/lfm-2.5-2.6b:free` | Yes | Yes | 65536 | 8192 |
+| `nvidia/nemotron-3.5-lightning:free` | Yes | No | 1000000 | 65536 |
+| `thinkingmachines/inkling-small:free` | Yes | No | 1048576 | 262144 |
+| `poolside/laguna-s-2.1:free` | Yes | No | 262144 | 32768 |
+| `poolside/laguna-xs-2.1:free` | Yes | No | 262144 | 32768 |
+| `cohere/north-mini-code:free` | Yes | No | 256000 | 64000 |
+| `nvidia/nemotron-3.5-content-safety:free` | No | No | 128000 | 8192 |
+| `nvidia/nemotron-3-ultra-550b-a55b:free` | Yes | No | 1000000 | 65536 |
+| `nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free` | Yes | No | 256000 | 65536 |
+| `google/lyria-3-pro-preview` | No | No | 1048576 | 65536 |
+| `google/lyria-3-clip-preview` | No | No | 1048576 | 65536 |
+| `nvidia/nemotron-3-super-120b-a12b:free` | Yes | Yes | 262144 | 235929 |
+| `openrouter/free` | Yes | Yes | 200000 | Unknown |
+
+Tools and strict schema in this table reflect `supported_parameters`, including `tools` and `structured_outputs`; absence is not a live capability proof. Context and output limits come from the catalog and its `top_provider`. Content-safety classifiers and Lyria audio-generation models are unsuitable for general conversational fallback despite zero pricing. Auto/router models can change their underlying provider.
+
+Three anonymous streamed probes completed with normal terminal receipts and `usage.cost: 0`, `is_byok: false`:
+
+- Liquid returned exactly `OK` in 1.358 seconds.
+- Nemotron 3 Super returned the requested custom `omnius_probe` call with correct arguments in 1.140 seconds. Nothing executed.
+- Nemotron 3 Super returned correct JSON under a strict schema in 3.641 seconds.
+
+Nemotron 3 Super is the preferred model established by these native-tool and schema probes. Liquid is a verified fast text alternative. These synthetic checks do not establish performance on complex tasks or every catalog model. Kilo documents [provider-specific data handling and NVIDIA trial terms](https://kilo.ai/docs/gateway/models-and-providers).
+
+## Other reviewed families
+
+The [public inference registry](https://robit-man.github.io/inference/) contains twelve families. LLM7 and OVH have model-specific native chat contracts; ch.at is a catalog-less text route. [OpenCode discovery and accepted compatibility shapes](opencode-free-model-discovery.md) are documented separately.
+
+OVH's [official capabilities](https://docs.ovhcloud.com/en/guides/public-cloud/ai-machine-learning/ai-endpoints-capabilities) distinguish anonymous access at two requests per minute per IP/model from authenticated access. Advertised authenticated catalog prices do not establish a charge for a request that uses the documented pinned anonymous tier. This is a provider-specific distinction, not a general waiver of zero-price checks for other catalogs.
+
+AI Horde accepted an anonymous asynchronous text job, which remained queued and was canceled; a second submission received HTTP 403. Its text job API needs prompt serialization, worker-context validation, bounded polling and cancellation. No completed Horde generation was verified. Public Hugging Face Gradio Spaces need per-application schemas and session handling; the official Qwen3 demo exposed its named API, but the synthetic call failed session initialization. Public dedicated Hugging Face endpoints need owner-published URLs. inference.sh embeds are publisher-funded hosted agents, not generic model endpoints. Jina Reader extracts documents; AHM7's documented image-chat endpoint requires an image. These families cannot be assumed to preserve native chat/tools/schema contracts.
+
+The current Pollinations API, Airforce, HackClub, FreeInference and Puter's CLI-compatible flow require account credentials. llmfaucet and the KeylessAI relay had unresolved advertised API hosts during this survey. Prexzy had no verified active conversational endpoint. None supplied an additional verified anonymous route.

package/docs/opencode-free-model-discovery.md

@@ -0,0 +1,59 @@
+# OpenCode free-model discovery
+
+The pure parser in `packages/orchestrator/src/opencode-free-models.ts` adapts OpenCode's catalog discovery. The shared keyless registry and production fallback backend consume it to register the anonymous route; the parser itself makes no inference requests. Onboarding uses the same discovery and request adapter.
+
+Source revision: [`anomalyco/opencode@15b24ae12ddb8b7ae3e923b286b4032761bee510`](https://github.com/anomalyco/opencode/tree/15b24ae12ddb8b7ae3e923b286b4032761bee510), reviewed 2026-10-12.
+
+- [`packages/core/src/models-dev.ts`](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/models-dev.ts) reads `https://models.opencode.ai/api.json`, normalizes provider/model transport, capabilities, costs and token limits, and uses a bundled snapshot with a five-minute refresh.
+- [`packages/core/src/plugin/models-dev.ts`](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/plugin/models-dev.ts) excludes deprecated models and models without text support.
+- [`packages/core/src/plugin/provider/opencode.ts`](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/plugin/provider/opencode.ts) enables anonymous access using the public sentinel `public` and disables models with positive input costs when no real key is configured.
+
+Omnius requires explicit zero input and output costs, including any advertised context tiers and cache prices. It pins the provider and endpoint, accepts the OpenAI-compatible chat transport and the per-model `@ai-sdk/openai` Responses transport, excludes foreign endpoints and unsupported protocols, and preserves documented tool, schema and token-limit metadata. Missing schema support remains unknown. The returned `admission: "catalog_only"` records that metadata alone establishes no route availability. Responses models use the dedicated adapter at the same pinned `/inference/v1/responses` endpoint.
+
+The catalog lists paid models too. The inference `/v1/models` response supplies IDs without cost or capability metadata and cannot establish free eligibility. Free suffixes are insufficient: Big Pickle has zero costs without that suffix, and old free rows can remain deprecated or unavailable.
+
+An optional intersection with `https://opencode.ai/inference/v1/models` removes free metadata rows that the gateway no longer lists. This unauthenticated endpoint returned 83 IDs on 2026-10-12; `exo-free`, `ling-3.0-flash-fin-free` and `nemotron-3-ultra-free` were absent. These observations are not hardcoded exclusions. A valid empty list excludes all models; missing, malformed or oversized discovery preserves the canonical zero-cost metadata instead of treating a discovery outage as an authoritative empty provider. ID-only rows can never add a model or supply price, tools, schema or context metadata.
+
+The [complete free-model follow-up](work-orders/WO-opencode-all-free-models-20261012.md)
+removes the previous 16-model cascade cutoff: all eligible OpenCode models within
+the shared 512-row catalog bound are queued. The subsequent
+[benchmark-informed priority](inference-fallback-priority.md) exhausts eligible
+OpenCode models before Hermes and other providers. The current audit found seven live free chat models plus
+`muse-spark-1.3-contributor-free`, whose `@ai-sdk/openai` declaration selects
+Responses. The ordinary chat adapter must never substitute for that transport.
+
+On 2026-10-12, synthetic tool-less Nemotron requests returned HTTP 403 `FreeTierError`, including probes using the public sentinel, current upstream headers and legacy `/zen/v1/chat/completions` endpoint. Within the user's explicitly authorized partner compatibility scope, a subsequent source-derived native-shaped request succeeded at `https://opencode.ai/inference/v1/chat/completions`: HTTP 200 SSE, visible answer `OK`, normal `stop` and `[DONE]`, in 1.044 seconds. It used `opencode/latest/2.0.27/cli`, client `cli`, transparent `x-omnius-client: omnius/1.0.847`, fresh source-format session/message IDs, the current system prefix, genuine read/shell definitions, automatic tool selection and streaming. No tool executed. This demonstrates native-agent availability for that request; it does not identify which shape differences the server requires or establish all models and modes.
+
+Two further synthetic streamed probes also returned HTTP 200 with normal terminal receipts. The same compatibility definitions with `tool_choice: "none"` and a strict JSON schema produced exactly `{"value":"ok"}` without tool calls in 4.120 seconds. A forced custom `omnius_probe` tool alongside those definitions returned that custom call with the expected arguments in 0.946 seconds. These establish those request shapes for Nemotron, without executing any tool or sending private context. They do not imply every catalog model supports them.
+
+Current [App metadata](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/app.ts) and [model request construction](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/session/model-request.ts) supply the header format. The public [inference proxy](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/console/app/src/lib/inference-proxy.ts) delegates free-tier admission to the inference service; its server-side guard was not found in this public source tree. No TLS fingerprint or hidden-signature requirement has been established. See the provider's [access discussion](https://github.com/anomalyco/opencode/issues/49580).
+
+The module exports fixed header, system-prefix and core-tool metadata from that pinned source, plus an OpenAI-style catalog normalizer. Its request-header factory generates fresh source-format identifiers and uses a stable SHA-1 of the public namespace `omnius` as its project marker. It can retain a caller-owned session ID for affinity while issuing a fresh message ID per request. It reads no user credentials, private project paths or existing conversation/session data and supplies no Authorization header or execution implementation. A truthful `omnius/unknown` attribution is allowed when no application version is available.
+
+Callers must keep host authorization, original tool schemas, history and tool-choice bindings, invert any existing tool-name aliases, and reject calls to compatibility definitions that have no host execution authority. The parser's catalog-only receipt remains separate from live route admission. Identifier generation follows upstream [Identifier](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/schema/src/identifier.ts) and [SessionID](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/schema/src/session-id.ts); core metadata follows the [read](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/tool/plugin/read.ts) and [shell](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/packages/core/src/tool/plugin/shell.ts) definitions.
+
+The adapted discovery is covered by OpenCode's [MIT license](https://github.com/anomalyco/opencode/blob/15b24ae12ddb8b7ae3e923b286b4032761bee510/LICENSE):
+
+```text
+MIT License
+
+Copyright (c) 2025 opencode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/docs/work-orders/WO-fallback-quality-order-20261012.md

@@ -0,0 +1,70 @@
+# Benchmark-informed fallback cascade
+
+Status: implemented and verified. Publication and active runtime replacement
+remain with the user. Telegram progress presentation stays deferred.
+
+## User request
+
+Try all free OpenCode models from highest capability to lowest before Hermes,
+then descend through remaining keyless endpoints. Research published benchmarks
+for the actual listed model versions to determine the stack. Do not derail the
+ongoing inference compatibility repair.
+
+## Findings and work
+
+The prior helper tried configured providers first, preferred Nemotron over
+stronger available models, and interleaved providers before exhausting OpenCode.
+OpenCode's catalog provides no quality score; its upstream default follows
+release date, which is not an intelligence ranking.
+
+The [benchmark evidence](evidence/fallback-model-benchmarks-20261012.json) uses
+current Artificial Analysis v4.3.2 plus original vendor coding evaluations.
+Current comparable OpenCode order is Muse 1.3, Step 5, Ling 3.1, MiMo 2.6,
+Nemotron 3.5. Three additional anonymous/unmeasured models remain eligible;
+they are explicitly unranked rather than assigned fabricated scores. Free
+gateway reasoning settings and checkpoint equivalence remain unverified.
+
+Implement OpenCode-all → Hermes-all → remaining keyless merged by model quality
+→ configured keyed tail. Preserve explicit configured-only policy, model-specific
+and provider-wide quota scopes, schema adapters, tool/context/cost admission,
+deadline bounds, manual permission and no replay after output. Do not delay
+ready alternatives for a throttled higher route. Ready retries use original
+cascade priority. Research scores must never confer free-access authority.
+
+The [priority reference](../inference-fallback-priority.md) records the source
+URLs, exact settings, unknown-model behavior and operational limitations.
+
+## Acceptance
+
+- A successful 512th OpenCode model produces zero lower-provider dispatches;
+  full OpenCode exhaustion reaches Hermes only after all eligible OpenCode rows.
+- A stronger measured nonpreferred model precedes a weaker seed. Catalog or
+  registry row order does not change selection. Newly discovered unknown models
+  remain included; incompatible or nonfree rows remain excluded.
+- Remaining providers merge by model quality, so a weak alternative does not
+  preempt a stronger model at another endpoint. Opaque selectors claim no fixed
+  benchmark identity.
+- Cooldowns immediately allow ready alternatives; recovery returns to higher
+  routes. Stop, stale ownership, total deadlines and bounded retries still hold.
+- Verify source suites, complete workspace build, freshly installed package and
+  actual bundled backend ordering/schema checks. Commit and push scoped work.
+
+## Verification receipt
+
+542 orchestrator tests passed with one existing skip; 122 CLI tests passed.
+The complete workspace build, package bundle, README/tarball audit and fresh
+compiler-free global npm installation passed. SQLite, CLI and library loaded.
+
+The [freshly installed backend receipt](evidence/fallback-quality-installed-20261012.json)
+records 64/64 mocked transport cases passing. Six reach the 512th OpenCode alias
+with zero other-provider generations; two prove benchmark preference over the
+Nemotron seed and larger unmeasured context limits; two exhaust ten eligible
+keyless aliases before the configured keyed tail. Native tool, Responses,
+structured validation and the original-schema `uniqueItems` regressions remain
+green. These checks made no real inference requests or Telegram sends.
+
+Prepared artifact: `publish/omnius-1.0.848.tgz`, SHA-256
+`2f0b02299333dea363eaa93c8e1f7e10a4371aeb3388fba35e6a3a39359c8611`.
+Its bundled backend SHA-256 is
+`651aa2819b85678d8aac1fa84f9e9c6fd7a088d17645d9cd212b00500bcf468c`.
+No publication or active runtime restart was performed.

package/docs/work-orders/WO-fallback-reply-contracts-20261012.md

@@ -0,0 +1,116 @@
+# Fallback reply contracts and live Telegram regressions
+
+Status: implemented and verified in source and the freshly installed package.
+Publishing and restarting the active bot remain user-owned. The subsequent
+OpenCode-first capability ordering is tracked in
+[its work order](WO-fallback-quality-order-20261012.md); Telegram progress
+presentation remains explicitly deferred.
+
+## User steering
+
+The running cascade selects OpenCode Nemotron, Kilo Nemotron and Hermes but
+reports `invalid_response`; OVH reports `empty_response`, and Big Pickle rejects
+the request with HTTP 400. Handle the actual protocol and expected reply contract
+dynamically for every selected fallback. Do not treat a successful isolated
+provider probe as proof that production routing uses the same adapter.
+
+The user also reported that replying to ordinary "good dog" chatter created and
+uploaded `reply.txt`. Review current live logs and fix evidenced problems before
+publication; preserve the ongoing full free-model coverage work.
+
+## Evidence
+
+The scoped public run `telegram-c34a3d7d53728329-1791861851684-1` began at
+2026-10-13T03:24:12Z. It produced a plain reply, which the host rejected after a
+semantic review demanded delivery evidence. The current criterion was
+`effect:visible_response`; the current user message requested no file. That
+rejection led to a failed file send, file creation, another blocked result check,
+then a successful upload and an echoed final reply at 03:25:41Z. Eventual upload
+success does not justify the invented delivery obligation.
+
+The [sanitized prompt audit](evidence/native-conversation-prompt-audit-20261012.json)
+also found generic zero-execution guidance that told the model to take a tool
+action for a conversational goal. Tool receipt authority must remain intact;
+ordinary conversation must not be required to manufacture execution evidence.
+
+Current debug artifacts redact actual outbound requests and do not retain
+auxiliary provider response bodies. The generic `invalid_response` category
+combined transport JSON, native tool and structured-schema failures; that label
+alone did not identify the cause. Production-helper probes with invented context
+isolated it: the simple native-goal schema passed, but the full terminal-review
+schema produced an HTTP 200 error envelope. The upstream Nvidia grammar rejected
+`uniqueItems`, wrapped as `server_error`. See the [exact safe diagnostic
+receipt](evidence/terminal-review-error-probe-20261012.json). No private message,
+credential or raw provider response body is retained in the public receipts.
+
+## Work and acceptance
+
+1. Trace selected-model metadata through the actual production fallback helper,
+   backend factory, request builder and response decoder. Select Chat Completions
+   or Responses per model, preserve tool/schema/context contracts, and condition
+   unsupported wire hints without weakening host validation.
+2. Exercise the actual native-goal review policy and schema through these
+   production adapters with invented conversation/evidence. Derive provider
+   limits from their public catalogs. Use no local inference, real actions,
+   Telegram messages or private human context. Honor quota cooldowns.
+3. Add safe, precise rejection diagnostics identifying the expected reply kind
+   and validation stage; never print raw bodies, secret values or user context.
+   Validate structured auxiliary replies before exposing their text as a
+   completed reply. Preserve Stop, ownership and no replay after visible output.
+4. Repair evidenced conversational tool pressure and test a direct chat reply
+   without files, uploads or fabricated tool receipts. Real mutation/delivery
+   requests must retain actual effect and provider-acknowledgement requirements.
+5. Run focused and production Telegram regressions, rebuild the package, verify
+   the freshly installed artifact and record scoped commit/push receipts.
+
+## Additional live checks
+
+Review later runs for duplicate contradictory completion events and tool
+description truncation. Apply only repairs supported by current evidence;
+record unresolved observations explicitly instead of broadening the task into
+unrelated runtime changes.
+
+## Implementation and verification
+
+- Normalize in-band provider errors before decoding Chat Completions or
+  Responses, including HTTP 200 JSON and SSE envelopes. Retain only whitelisted
+  failure categories and status, never upstream text or nested causes.
+- Learn the proven native `uniqueItems` restriction per full endpoint path,
+  model and API shape for five minutes. Retry that route once with a separately
+  lowered wire schema. Preserve the complete original host schema, completion
+  callback, tool parameters and uniqueness checks. Include original-schema
+  guidance in the admitted request budget. Do not strip arbitrary constraints.
+- Validate expected JSON and native tool calls before releasing structured
+  replies or executable tool fragments. Accept one complete JSON fence without
+  changing values; reject prose extraction, malformed arguments, unoffered
+  calls, truncation and duplicate citations. Preserve cancellation, ownership,
+  deadlines, manual fallback permission and the no-replay boundary after output.
+- Distinguish JSON syntax, schema mismatch, unsupported schema, tool choice,
+  tool arguments and transport envelope failures in safe route diagnostics.
+- Remove generic pressure to manufacture tool execution for conversation.
+  Preserve file-write/edit/send purpose before long scoped paths consume the
+  model-facing description budget. Text replies need no fabricated reply file;
+  requested material effects still require actual tool and delivery receipts.
+
+Source verification: 520 orchestrator tests passed with one existing skip;
+122 CLI tests passed. The complete workspace build and artifact audit passed.
+The compiler-free fresh npm installation loaded SQLite and the CLI/library;
+60 deterministic checks exercised the actual installed backend, including
+12 full terminal-review grammar-repair/host-rejection cases.
+
+The [post-repair live receipt](evidence/terminal-review-schema-repair-probe-20261012.json)
+uses the actual production fallback helper and backend with synthetic context,
+the unchanged full terminal-review schema and public provider limits. OpenCode
+and Kilo both rejected the initial native grammar, then returned original-schema
+valid JSON after the same-route repair. Kilo chose `deliver`; OpenCode chose
+`stop`. OpenCode's generated justification was not retained, so semantic
+correctness is not claimed. Hermes reached the adapted request and returned
+HTTP 429; the probe stopped at its two-send quota. No local inference, Telegram
+messages or tool actions occurred. Remote quota or outage can still exhaust a
+bounded cascade; this repair does not promise perpetual service availability.
+
+The later 03:28 run's successful handler result and failed synthetic terminal
+projection are distinct events. The latter retained pending visible-response
+acknowledgement. This observation does not establish a duplicate-handler bug or
+justify weakening the delivery gate; presentation work remains queued in
+[its work order](WO-telegram-progress-presentation-20261012.md).

package/docs/work-orders/WO-keyless-fallback-coverage-20261012.md

@@ -0,0 +1,125 @@
+# Keyless automatic fallback coverage and compatibility
+
+Status: implemented and verified. Publication and replacement of the running bot
+remain user-owned; the running bot has not been restarted by this work.
+
+## Requested outcome
+
+Make the automatic inference fallback chain function in the production Telegram
+and TUI backend. Add only anonymous, keyless providers. Check the whole public
+catalog at https://robit-man.github.io/inference/, find additional free providers,
+and reuse OpenCode's free-model discovery and routing, including Nemotron where
+it is actually available without credentials.
+
+The user requested "never fail." No implementation can guarantee an external
+provider's availability. This work must maximize compatible route coverage,
+preserve successful replies, and test bounded, honest failure when every remote
+route is unavailable; it must not manufacture successful inference or hide a
+failed request. This limitation does not reduce the coverage requirement.
+
+## Ordered work and acceptance evidence
+
+1. Inspect the current registry, cascade, production integration and live failure
+   evidence. Preserve unrelated worktree changes. Record all catalog families,
+   candidate URLs, protocols, anonymous authentication requirements and exclusion
+   reasons instead of counting endpoint discovery as working inference.
+2. Trace OpenCode's actual free-provider loader, catalog and wire transport from
+   primary source. Reuse its zero-cost/keyless selection behavior, not a stale
+   handpicked model list. Exclude paid entries, signup/API-key routes, unsupported
+   protocols and services that reject anonymous Omnius clients.
+3. Probe candidate routes with synthetic public data only. Check text, streaming,
+   native tools, tool-result continuation, structured output and advertised input
+   capacity. No action emitted by a probe is executed. Record observed support
+   and failures separately from catalog hints. Do not send local model requests.
+4. Implement the usable adapters and compatibility conditions, shared discovery
+   where practical, fair cascade coverage, provider/model cooldowns, cancellation
+   and local recovery. Keep whole prompt and required tool/schema contracts;
+   preserve manual approval, credential isolation and no replay after visible
+   streaming output begins. New automatic routes must require no actual keys.
+5. Test deterministic transport failures, quota/auth failures, malformed/empty
+   replies, incompatible models, catalog loss, provider retirement, tool/schema
+   constraints, all-routes failure, Stop and successful local recovery. Exercise
+   production backend plus Telegram/TUI integration rather than only a separate
+   raw HTTP harness.
+6. Rebuild workspaces, verify packaged runtime, run synthetic live checks on
+   admitted providers and save sanitized receipts. Commit and push scoped changes
+   after tests pass. Report remaining coverage, failures and activation state
+   precisely; do not claim runtime adoption before it occurs.
+
+## Current evidence
+
+Baseline: commit 57e93104. The saved Telegram run at 2026-10-13T01:03:40Z
+exhausted Hermes, OVH and LLM7 and consolidated as a timeout without any tools.
+The previous cascade allowed six model routes and three models per provider,
+with a 20-second request / 60-second remote budget.
+
+The production cascade now starts with OpenCode and Kilo's anonymous routes,
+followed by the existing Hermes, LLM7, OVH and ch.at routes. OpenCode discovery
+requires explicit zero costs and optionally intersects the gateway's live model
+IDs to remove retired entries. Kilo requires explicit zero prompt and completion
+prices and excludes non-chat models, including classifiers and music generators.
+OVH's documented anonymous tier is pinned independently of its authenticated
+catalog prices. Public registry entries cannot grant these provider-specific
+exceptions or request identities. No actual keys or new credentialed profiles
+are required by the added routes.
+
+Runtime and onboarding share OpenCode's source-derived request adapter. Original
+host tool schemas remain authoritative; compatibility-only calls are rejected.
+Full prompt and required tool/schema contracts are preserved. The parser accepts
+framed SSE and complete JSON responses to streaming requests without replaying a
+generation. Local availability failures admit fallback, cancellation and manual
+decisions remain binding, and a later request retries local inference. Provider
+quota cooldowns apply across models and respect bounded Retry-After values.
+Selection allows 16 compatible models per provider, with fair dispatch across
+admitted providers. Healthy Hermes continuation took 32 seconds; remote defaults
+are therefore 45 seconds per request and 120 seconds overall.
+
+## Verification and limits
+
+Live synthetic checks used the actual production backend and executed no tools:
+
+- [Hermes](evidence/keyless-compatibility-20261012.json) passed text, streaming,
+  native tools, tool-result continuation, strict schema and a large native-tool
+  packet. ch.at passed text, streaming and the large packet but failed tool and
+  schema contracts; it is restricted to text requests without required schemas.
+- [OpenCode Nemotron 3.5 Lightning](evidence/opencode-production-compatibility-20261012.json)
+  passed all six contracts. Big Pickle passed five but rejected strict schema.
+  Retired catalog rows found by these probes are now removed through live-ID
+  discovery. Ling quota failures remain recorded, not counted as success.
+- [Kilo Nemotron 3 Super, North Mini Code and Dots 3 Note](evidence/kilo-production-compatibility-20261012.json)
+  each passed all six contracts. Lyria's authentication failure exposed a
+  non-chat metadata ambiguity; music generators are now excluded and covered by
+  regression tests. Other catalog models remain unverified.
+- [OVH](evidence/ovh-production-compatibility-20261012.json) passed text,
+  streaming and native tools before a quota response. A later
+  [structured/context check](evidence/ovh-structured-context-compatibility-20261012.json)
+  passed both contracts. LLM7 returned a one-hour quota cooldown, which was
+  honored rather than repeatedly probed.
+
+All 460 unique source regression tests passed, with one existing skip, across
+the orchestrator and CLI suites. An isolated snapshot of the staged code also
+passed a full recursive build and all 460 tests (365 orchestrator, 95 CLI),
+without depending on unrelated unstaged changes. This includes production private/public
+Telegram greeting admission and semantic review without a false incomplete
+suffix. The compatibility harness passed 26 tests. The
+[freshly installed bundle receipt](evidence/installed-fallback-verification-20261012.json)
+records 36 passing mocked transport cases, including automatic/manual fallback,
+local recovery, quota handling, more than six failed routes, OpenCode/Kilo,
+native tool/schema contracts and cancellation. These installed tests sent no
+real inference requests or Telegram messages.
+
+A full clean recursive workspace build, publish bundling, tarball audit
+(540 files, zero warnings) and fresh compiler-free npm installation passed.
+The required SQLite prebuild loaded. The prepared artifact is
+`publish/omnius-1.0.847.tgz`, SHA-256
+`5266aa7ca1845bb389f4e7470eb461837516ed99607d09673f11b9ad4fe89309`.
+Its installed `dist/index.js` hash matches the packaged receipt. No package was
+published and no running bot was replaced.
+
+The durable [provider survey](evidence/keyless-provider-survey-20261012.json)
+covers all 12 public-page families and seven additional candidates. Keyed,
+non-chat and unverified adapters are classified explicitly; discovery alone
+does not enroll a route. Every catalog model has not been live-tested, and
+external providers can still exhaust quotas or fail simultaneously. See
+[provider findings](../keyless-provider-survey.md) and
+[OpenCode source provenance](../opencode-free-model-discovery.md).