Closing the loop on the provider refactor

Yesterday’s provider-API refactor shipped the shape of the thing. Today proved it holds under scrutiny — closing every review comment, then fixing something quietly annoying users: markdown leaking into the chat UI as literal asterisks.

A critic/arbiter pass over the provider chokepoint cleared every must-fix. Anthropic’s 413 handling flips from unverified to verified — the token-cap check was already a local heuristic, not a live round-trip, so tightening the guarantee cost nothing extra per request. Gemini’s over-limit detection moves from string-sniffing to matching the actual error code and status, splitting into a rate-limit path and a response-too-large path, with the remaining edge case logged as a deliberate follow-up rather than swallowed. Telemetry fields on the request/response objects got properly declared instead of monkey-patched on after construction, and success logging now only fires when a response actually came back — a subtle bug where a failed call could log a phantom zero-token row and corrupt usage tracking. Four “kept around for the tests” wrapper functions came out of the service layer, replaced by tests driving the real client code through a proper test subclass. The unit suite held at 1,064 passing, zero new failures.

A senior-architecture pass found one more gap: the provider resolver silently fell through to the chat provider for any unrecognized type, including one reserved type nothing constructs yet. Silent fallback on an unhandled case becomes a confusing bug months later, so it now raises explicitly. Stale docstrings referencing deleted compatibility shims were scrubbed in the same pass.

Two smaller finds fell out of that scrutiny. A leftover Ollama helper module had survived the original cleanup, with only one real production caller left; everything else importing it was test code reaching into internals it shouldn’t have touched. The one real function moved to its actual caller, five test imports got repointed at production code, and the rest was deleted — net minus 131 lines, behavior unchanged. A Gemini ID-uniqueness test also turned out to be patching a function that path never calls — ids are minted with a UUID, not a timestamp, making the mock both banned by policy and inert. Dead patch removed, docstring rewritten to match reality.

The one genuinely new feature: a markdown-to-HTML fallback on the final chat response. Chalie’s system prompt asks models for HTML, but models occasionally slip back into markdown — bold asterisks, backtick code spans — leaking straight into the UI as literal punctuation. The fix runs at the single point where a response leaves the reasoning loop on its way to the user: it masks code spans first so markers inside survive, then converts bold, italic, underline, and inline code, avoiding false positives on legitimate underscores in variable names. It only touches responses headed to a person — background channels like the memory encoder or context compaction, which expect structured JSON or plain text, are left alone.

None of today’s changes alter behavior for anything already working correctly; they alter the failure cases — over-limit errors that used to get miscategorized, silent fallbacks that used to hide, tests that checked the wrong thing, markdown that used to leak straight through. That’s the compounding kind of progress: each fix removes one more way the system could quietly do the wrong thing without telling anyone. The provider layer now has a documented, tested seam between “the model said something” and “the app knows what to do with it” — the seam the next round of provider or model changes will need.

• Critic/arbiter fixes on the provider chokepoint: verified 413 handling, structured Gemini over-limit detection, success-only telemetry logging

• Provider resolver now raises explicitly on an unhandled provider type instead of silently falling back to chat

• Deleted a leftover Ollama helper module left over from the refactor’s first pass; its one real function moved to its actual caller, five test imports repointed at production code

• Removed a banned, inert mock from a Gemini ID-uniqueness test and rewrote its docstring to match the real uuid-based logic

• New markdown-to-HTML fallback catches models slipping past the HTML-only prompt, applied only to user-facing final responses so background channels are untouched