[hxy91819]

Problem

SDK model-discovery failure can be swallowed and converted into an Auto-only fallback catalog, making a failed session initialization appear usable.

Evidence

The former getAvailableModels caught runner.listModels() errors and continued with an empty list. The SDK runner also accepted an empty catalog. Added regressions assert propagation of discovery errors and rejection of empty SDK results.

Fix

Propagate discovery failures, reject empty SDK catalogs, and register the session only after initial model discovery succeeds. Document the failure behavior instead of caching a misleading fallback.

No source-ancestry prerequisites beyond the upstream baseline. Unique scope is upstream-main/20260924-d422bdd..fix/model-discovery-errors (five files). This branch conflicts with SDK-only removal in agent code/tests and with model-parameters in agent tests; integration must preserve both error handling and parameter enrichment.

Validation

Fresh exact-source verification of validated source, not a descendant/aggregate substitution:

nub install --frozen-lockfile — exit 0
nub run check — exit 0
Found 0 warnings and 0 errors.
All matched files use the correct format.
nub run test:run — exit 0
 Test Files  19 passed (19)
      Tests  184 passed (184)
nub run build — exit 0

Tracked worktree remained clean after validation. Used a disposable detached worktree and its own frozen-lockfile Nub install. Opt-in real-model tests, where present, remained skipped; these results do not claim live authentication, billing or real sandbox containment.

Rebase, dependencies and evidence

Based directly on current upstream main; no unmerged ancestry prerequisite.

Submission alias has the same tree as the verified source branch; current upstream main remains the source baseline. Overlapping implementations and compatibility limitations are documented above. Exact-source validation is now complete. This PR is ready for maintainer review; declared prerequisites and integration conflicts still constrain merge order.

Ready for review

Exact-source check, full default test suite and build all passed. The earlier source-verification gap is closed. Declared prerequisites remain merge-order constraints, not a reason to prevent review; this does not authorize merging unrelated prerequisite features.