Catalog audit: attachment flag contradicts modalities.input in 289 flagged entries (279 unique files)

While investigating why vision-capable models get image-blocked in
OpenCode (via the models.dev catalog), we scanned the whole catalog for
entries where attachment contradicts modalities.input — the invariant
the sync runners themselves apply ("attachment is derived from non-text
input modalities", see ovhcloud/chutes notes in sync.md).

Result: 289 flagged entries across 7,878 TOML files — 279 unique
underlying files (10 flagged paths are symlink mirrors of an
already-counted file). Largest clusters: helicone 49, poe 43, vercel 25,
alibaba-cn 20, alibaba 19, amazon-bedrock 10, siliconflow-cn 9, azure 9,
zenmux 8.

Two of them (moonshotai/kimi-k2.5, opencode/grok-code) are fixed in a
companion PR referencing this issue — that fix also clears the
moonshotai-cn symlink mirror of kimi-k2.5, leaving 286 flagged rows
(277 unique).

The downstream cost is real and already reported on the consumer side:
OpenCode users hit this data error as "vision model cannot see images"
symptoms (anomalyco/opencode#23427, #22673, #40894, #36020). Single-model
modality reports in this repo (#5712, #479) were accepted and fixed —
this issue is the systematic version of those.

Three semantic questions we'd like maintainer guidance on before
batch-fixing the rest:

1. Audio-only models (whisper/voxtral/ASR: input ["audio"] or
   ["text","audio"]): should attachment follow the modality-derivation
   convention (true), or the "file attachments" semantics (false)? 33
   entries (input == ["audio"] or ["text","audio"] among the contradictory
   rows; 28 provider + 5 lab).
2. Gateway providers (amazon-bedrock, azure, io-net, …): does the
   transport genuinely reject images (flag intentionally false), or are
   these the same omissions as the lab entries? Needs per-provider doc
   checks.
3. Generated entries (vercel, via packages/core/script/generate-*.ts):
   hand edits get overwritten by the generator — fix the generator, the
   upstream source, or the entries?

Happy to work through these provider-by-provider in small PRs, per the
"prefer small, provider-specific PRs" guidance — just need the semantics
settled first.

Reproduction

pip3 install tomli
python3 - <<'EOF'
import glob, os, sys
try:
    import tomli as toml
except ImportError:
    sys.exit("pip3 install tomli first")

files = sorted(set(glob.glob('models/*/*.toml') + glob.glob('providers/*/models/**/*.toml', recursive=True)))
rows, broken, total = [], 0, len(files)
for f in files:
    p = os.path.realpath(f)
    if not os.path.exists(p):
        broken += 1
        continue
    try:
        d = toml.load(open(p, 'rb'))
    except Exception as e:
        rows.append((f, 'PARSE-ERR', str(e)))
        continue
    att = d.get('attachment')
    if att is None:
        continue
    mod = d.get('modalities', {}).get('input')
    if mod is None:
        continue
    if att != any(m != 'text' for m in mod):
        rows.append((f, att, mod))

from collections import Counter
prov = Counter(r[0].split('/')[1] if r[0].startswith('providers/') else '(lab)' for r in rows)
print(f"**Scope:** {total} TOML files scanned ({broken} unresolvable symlinks excluded), **{len(rows)} contradictions found.**\n")
print("| Provider | Count |\n|---|---|")
for k, v in prov.most_common():
    print(f"| {k} | {v} |")
print("\n<details>\n<summary>Full list (289 expected)</summary>\n")
print("| Entry | attachment | modalities.input |\n|---|---|---|")
for f, att, mod in rows:
    if att == 'PARSE-ERR':
        print(f"| {f} | parse error | {mod} |")
    else:
        print(f"| {f} | {att} | {mod} |")
print("\n</details>")
EOF

Notes:

• 32 unresolvable symlink paths are skipped.
• Symlink mirrors are counted as separate rows (hence 289 rows vs 279
  unique underlying files).

Flagged entries

Start by reading sync.md for the attachment invariant and inspect the relevant packages/core/script/generate-*.ts generators before editing generated entries. Run the provided Python audit to reproduce the contradictions, then check provider documentation and determine how audio-only, gateway, and generated entries should be handled. Done means the semantics are settled and the remaining unintended contradictions are corrected without generator overwrites.