fix: four of the nine default pins were already retired

[catomean]

fix: four of the nine default pins were already retired

Checked freeChain() against the live catalogues on 2026-08-25. Four of its
nine ids no longer exist:

groq       llama-3.3-70b-versatile        GONE
groq       llama-3.1-8b-instant           GONE   <- whole vendor dead
openrouter openai/gpt-oss-20b:free        GONE   <- was FIRST in the list
openrouter nvidia/nemotron-3-nano-30b...  GONE

The chain exists because a single pinned free model is a scheduled outage. That
reasoning has a hole this package fell into: the chain is ITSELF a list of pins,
so it rots too — and a chain whose first vendor is entirely dead is a slower
version of the failure it was built to prevent. Every caller paid two Groq 404s
and then a third on the preferred OpenRouter fallback before reaching a model
that could answer.

Consumers inherited it. FleetCrown used the same Groq id for direct, unchained
calls and was silently broken for eight days: its nightly frontier digest fell
back to a canned headline, and activity digests, calendar extraction, proposal
extraction and hosted-runner analysis all failed one at a time, quietly enough
that nothing looked broken.

Replacements probed, not guessed — the package's own rule. openai/gpt-oss-120b
and openai/gpt-oss-20b each returned a correct native tool_call with correct
arguments. The two retired OpenRouter ids are removed; the other five were
confirmed present in the 419-model catalogue.

── catalog: the check that can actually run on a timer ──────────────────────

New module, exported as checkCatalog / hasRot / deadProviders /
catalogReport. One GET /models per provider and ZERO tokens, which is the
entire point: a tool-call probe costs real money and therefore can never be
scheduled, so the only existing defence was a command someone had to remember
to type. Existence is cheap enough to check nightly. npm run check:catalog
runs it against this package's own defaults and exits 1 on confirmed rot.

It lives here rather than in each app because the check is the same everywhere,
and the first app to need it had already written its own, slightly differently.

Three states, not two. live: null means the catalogue could not be READ — no
key, network failure, non-200, or a body that parses but lists nothing. That is
not an empty catalogue. Reporting it as rot invents an outage; reporting it as
a pass hides one. hasRot counts only CONFIRMED absences, so an offline or
keyless run cannot fail a pipeline for something it never saw.

That distinction earned itself immediately: Node's global fetch is intermittently
broken on the laptop this was written on, and the checker correctly reported
7 UNCHECKED rather than "every model retired" — which would have sent me
"fixing" ids that were live.

deadProviders is separate from hasRot on purpose: a chain missing some
models is degraded, a chain missing an entire vendor is back to being a single
point of failure, and those deserve different words.

── modelCost is provider-dependent, and was silently wrong about it ─────────

The existing paidModelsIn guard caught the new Groq pins and called them PAID.
It was not a false alarm to suppress — it was the guard finding a real hole in
its own rule.

modelCost decides from the id: a slashed id without :free is paid. That is
right for OpenRouter, where openai/gpt-oss-20b genuinely bills. It is wrong
for Groq, where the same string is just that vendor's name for a model whose
cost is the account's tier. The rule was only ever safe because direct vendors
used bare ids (llama-3.1-8b-instant → "unknown"); Groq now ships
vendor-prefixed ids, so the shape stopped identifying the vendor.

So Provider gains routed?: boolean (true for OpenRouter), and modelCostAt
judges an id AT its provider. At a direct vendor the verdict is "unknown" —
never "free", which would reopen the hole this module was written to close.
modelCost(id) is unchanged for existing callers, with a docstring saying what
it assumes.

A false "paid" here is not harmless: it pressures someone into "fixing" a
working free model, and a guard that cries wolf gets disabled — taking the three
real cases it does catch with it. Pinned by a test that the routed vendor's
anthropic/claude-sonnet-5 and google/gemini-2.0-flash-001 are still flagged.

verify: 44/44 pass. Live catalogue check: all 7 pins present, no rot. Mutation:
restoring the retired pins turns it red (exit 1, deadProviders ["groq"]).

Co-Authored-By: Claude Opus 5 noreply@anthropic.com