fix(core): derive the OpenCode Free model set from the models.dev snapshot

apps/desktop/src/main/__tests__/runtime-host-connections-ipc-main.test.ts

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
+import { OPENCODE_FREE_DEFAULT_ENABLED_MODELS } from '@maka/core/llm-connections';
 import type { ConnectionCatalogSnapshot } from '@maka/core/runtime-policy';
 import {
   projectHostConnections,
@@ -261,11 +262,8 @@ test('preserves the provider default inventory beside the recommended model', as
     defaultModel: 'nemotron-3-ultra-free',
   });
 
-  assert.deepEqual(createdModels, [
-    'nemotron-3-ultra-free',
-    'mimo-v2.5-free',
-    'deepseek-v4-flash-free',
-  ]);
+  // Snapshot-derived set; assert the contract, not today's ids.
+  assert.deepEqual(createdModels, [...OPENCODE_FREE_DEFAULT_ENABLED_MODELS]);
 });
 
 test('projects the Host default target without inventing a second Connection authority', () => {

packages/core/src/__tests__/llm-connections.test.ts

@@ -7,6 +7,7 @@ import {
 } from '../model-metadata.js';
 import { curatedCatalogFallbackModelsForProvider } from '../model-metadata.js';
 import {
+  authorizeConnectionModel,
   backendKindOf,
   effectiveBaseUrl,
   normalizeConnectionBaseUrl,
@@ -268,3 +269,15 @@ test('provider recognition does not resolve inherited object members', () => {
     );
   }
 });
+
+test('a quarantined model id is vetoed even when enabled and present in the inventory', () => {
+  const connection = {
+    providerType: 'opencode-free' as ProviderType,
+    enabledModelIds: ['nemotron-3-ultra-free', 'muse-spark-1.2-contributor-free'],
+    models: [{ id: 'nemotron-3-ultra-free' }, { id: 'muse-spark-1.2-contributor-free' }],
+  };
+  assert.equal(authorizeConnectionModel(connection, 'muse-spark-1.2-contributor-free'), undefined);
+  assert.deepEqual(authorizeConnectionModel(connection, 'nemotron-3-ultra-free'), {
+    id: 'nemotron-3-ultra-free',
+  });
+});

packages/core/src/llm-connections.ts

@@ -249,6 +249,12 @@ export function authorizeConnectionModel(
 ): ModelInfo | undefined {
   const model = modelId.trim();
   if (!model || !connectionEnabledModelIds(connection).includes(model)) return undefined;
+  // The one veto: quarantined ids fail in a shape the send cannot surface
+  // (e.g. a billed 200 with an empty completion), so the request settling it
+  // is not available as the arbiter. See ProviderDefaults.brokenModelIds.
+  if (PROVIDER_DEFAULTS[connection.providerType]?.brokenModelIds?.includes(model)) {
+    return undefined;
+  }
   // The observed row wins wherever it exists: it carries wire metadata such as
   // `apiProtocol`, and capabilities, which a synthesized entry cannot. Absent
   // capabilities already mean "unknown", not "unsupported".

packages/core/src/model-catalog.ts

@@ -232,12 +232,18 @@ export function buildConnectionModelCatalogEntries(
   if (!defaults) return [];
   const supportsModelDiscovery = providerSupportsModelDiscovery(connection.providerType);
   const catalogFallbackModels = curatedCatalogFallbackModelsForProvider(connection.providerType);
-  const fallbackModels = [...(catalogFallbackModels ?? defaults.fallbackModels)];
+  // Quarantined ids never surface as offerable entries — from any source,
+  // including inventories stored or selections made before the quarantine —
+  // mirroring the `authorizeConnectionModel` veto.
+  const broken = new Set(defaults.brokenModelIds ?? []);
+  const fallbackModels = [...(catalogFallbackModels ?? defaults.fallbackModels)].filter(
+    (id) => !broken.has(id),
+  );
   return buildModelCatalogEntries({
     providerType: connection.providerType,
     connectionSlug: connection.slug,
     defaultModel: connection.defaultModel,
-    models: connection.models,
+    models: connection.models?.filter(({ id }) => !broken.has(id)),
     modelSource: connection.modelSource,
     modelsFetchedAt: connection.modelsFetchedAt,
     fallbackModels: supportsModelDiscovery
@@ -260,7 +266,9 @@ export function buildConnectionModelCatalogEntries(
     // (#1584), and fixing it at one call site left the others broken. The raw
     // array, not `connectionEnabledModelIds`: that one folds in `defaultModel`,
     // which `provenanceSources` already reports as `connection_default`.
-    savedModelIds: [...(connection.enabledModelIds ?? []), ...(input.savedModelIds ?? [])],
+    savedModelIds: [...(connection.enabledModelIds ?? []), ...(input.savedModelIds ?? [])].filter(
+      (choice) => !broken.has(typeof choice === 'string' ? choice : (choice?.id ?? '')),
+    ),
   });
 }