[Bug] Normal builds regenerate the model catalog and can silently drop providers

[fettpl]

Affected area

AI providers/models, CI, and release reproducibility.

What happened?

Every AI package build invokes live model generation before compiling. Catalog fetch failures can return empty arrays, after which the generator writes a replacement tracked snapshot. A release built from a reviewed SHA can therefore contain different provider membership, limits, or pricing from that commit.

OpenRouter, Gateway and models.dev error handling return empty catalogs. Snapshot writing and top-level handling overwrite the output and log rejected generator failures without explicitly setting a nonzero exit status.

Steps to reproduce

1. Inspect packages/ai/package.json: ordinary build invokes generate-models.
2. In an isolated fixture, stub all catalog requests; return a valid catalog for one source and an error or malformed/empty response for another.
3. Run only the refresh path inside that disposable fixture and compare generated provider membership with the starting snapshot; capture the exit status.
4. Repeat with different valid responses for the same source commit. Do not run generation against the working checkout for this check.

The current source makes silent partial replacement possible; no live outage or broken production catalog was induced during this audit.

Expected behavior

Normal builds compile the reviewed snapshot without refreshing it. Refreshing catalog data is explicit, validated, and fails without damaging the last good snapshot.

Acceptance criteria

• Normal build and release paths do not fetch catalogs or modify models.generated.ts.
• Explicit refresh validates source responses, required provider/model invariants, and schema before atomically replacing output.
• Network, schema, or required-source failures return nonzero and leave the previous snapshot byte-identical.
• Refresh output is deterministic for identical fixtures, with reviewable provenance/diffs.
• Intentional partial refresh, if supported, is explicit and never silently removes unrelated providers.
• Hermetic tests cover successful refresh, outage, empty response, malformed response, and repeat determinism.

Solution design and verification

Separate compilation from catalog refresh; retain refresh as a dedicated maintenance command. Use injectable/fake source adapters and validate the assembled catalog before write/rename. Add a source-snapshot drift assertion to the build verification path. Do not hand-edit generated model entries or change provider selection semantics as part of this work.

Additional context

Revalidated from closed #930 / PR #960. Discussion #1394 concerns making newly released OpenRouter models available at runtime; that product question is distinct from deterministic release inputs. PR #1970 is open and changes the toolchain, so keep this invariant regardless of whether Node or Bun executes compilation.

Please confirm whether maintainers want this scoped work and where to track it. No replacement PR is being submitted.

Version and environment

Source audit of main@cd10724fe02bbe9a18592737de17c8101710bf73 (package version 0.9.1), 2026-09-03. Reviewed a clean source snapshot on macOS 26.6.2 (25G83), arm64, zsh 5.9 in a non-interactive Codex terminal. Installation method: source snapshot; no installation or live application reproduction was performed. The steps above describe isolated verification, not a claim that a production failure was induced.