Risky behavior now covered

discoverProviderModelsWithCache is the shared gate behind OpenAI-compatible, Codex, Bedrock, and LM Studio catalogs. These tests lock the fail-closed policy:

• A fresh cache is served without calling discovery, and only for the adapter's endpoint scope.
• forceRefresh and ttlMs: 0 still verify the live source. A zero TTL does not leave an expiry that would make the next read look fresh.
• An app-server cache with a default reasoning effort and no advertised choices is refreshed. The same gap on an API cache, or a complete app-server cache, stays fresh.
• A static or empty live result does not replace a non-static cache or rewrite the file. Empty results are persisted only when the adapter allows them. A static result with no cache is returned and not written.
• Discovery errors and timeouts keep the cached catalog and record the failure. With no cache, the error is rethrown and nothing is written.
• A successful write drops blank ids, duplicate ids, and secret runtime fields.
• Cache documents with the wrong version, provider, source, or timestamp are treated as a miss and do not short-circuit discovery.

Test files added/updated

• Added test/providers/model-discovery-service.test.ts

Why these tests materially reduce regression risk

Catalog callers already exercise a few provider paths, but the shared policy was untested on its own. A change that honored a fresh cache when TTL is zero, wiped a live catalog with a static or empty response, mixed endpoint scopes, or trusted a malformed cache file would ship the wrong models or reasoning efforts without a failing unit test.

Validation

• bun run test -- test/providers/model-discovery-service.test.ts test/platform-boundary.test.ts (9 + 1 pass)
• bunx biome check test/providers/model-discovery-service.test.ts
• bun run typecheck