Read-only. Changes nothing, disables nothing, proposes nothing — it makes visible what
drifts unseen. Fable's architecture pass named it the second card, after exposing the
catalog's fields, and deliberately as a diagnostic rather than a fix: the hand lists live
on hosts with running agents, so the cutover is an operator decision, not a script's.
Measured on pica: 13 providers, 53 entries — and SIX providers point at endpoints that no
longer answer (bosch-ornith, bosch-qwen, dirac:8081, and all three escher entries, escher
being the machine that went out for RMA). Of the entries that route through the gateway,
4 of 5 name models it no longer serves. deus carries a byte-identical file.
Two distinctions separate a finding from noise, and the first draft got both wrong, which
is why they are spelled out in the docstring:
* Normalise BOTH sides. The hand list stores gateway ids with the display tag
("[local] deepseek-v4-flash") and so does the catalog; stripping one side only
guarantees zero matches and reads as total drift. My first run reported 51 of 53
entries unknown — an artefact of my own comparison, not a fleet fault.
* Not every entry belongs in the catalog. A provider aimed straight at a backend
bypasses the gateway on purpose and is absent from the catalog without being dead.
Those are probed directly and reported separately. "Points at the gateway" is decided
by hostname AND port, since the same box also runs litellm on 4000 with its own id
namespace — a substring match put 36 litellm entries in the wrong bucket.
A 401 counts as answering: an authenticated endpoint that refuses us is alive, which is
the question being asked.
