@mindot/will 0.6.0 → 0.8.0

package/dist/index.js

@@ -2800,62 +2800,26 @@ var AsyncEngine = class {
     }
   }
 };
-var MODEL_PRICING = {
-  // OpenAI
-  "openai/gpt-4o": { input: 2.5, output: 10 },
-  "openai/gpt-4o-mini": { input: 0.15, output: 0.6 },
-  "openai/gpt-4-turbo": { input: 10, output: 30 },
-  "openai/gpt-3.5-turbo": { input: 0.5, output: 1.5 },
-  // Anthropic (Claude 4.x family — prices per 1M tokens)
-  "anthropic/claude-haiku-4-5": { input: 1, output: 5 },
-  "anthropic/claude-sonnet-4-5": { input: 3, output: 15 },
-  "anthropic/claude-sonnet-4-6": { input: 3, output: 15 },
-  "anthropic/claude-opus-4-7": { input: 5, output: 25 },
-  // Legacy aliases kept for backward compat
-  "anthropic/claude-haiku-4": { input: 1, output: 5 },
-  "anthropic/claude-opus-4": { input: 5, output: 25 },
-  // Z.ai (GLM-5 family). `glm-5.2[1m]` is the same model asking for its 1M
-  // context window — same rate, so it gets its own row rather than relying on
-  // the normalizer (a future long-context tier would price differently).
-  "glm/glm-5.2": { input: 1.4, output: 4.4 },
-  "glm/glm-5.2[1m]": { input: 1.4, output: 4.4 },
-  // Google
-  "google/gemini-2.0-flash": { input: 0.1, output: 0.4 },
-  "google/gemini-2.0-pro": { input: 1.25, output: 5 },
-  // Meta (via Groq/Replicate)
-  "meta/llama-3.3-70b": { input: 0.59, output: 0.79 },
-  "meta/llama-4-maverick": { input: 0.2, output: 0.6 },
-  // DeepSeek
-  "deepseek/deepseek-v3": { input: 0.27, output: 1.1 },
-  "deepseek/deepseek-r1": { input: 0.55, output: 2.19 },
-  // Embeddings (input-only — no completion tokens). Priced per 1M input tokens.
-  "openai/text-embedding-3-small": { input: 0.02, output: 0 },
-  "openai/text-embedding-3-large": { input: 0.13, output: 0 },
-  "google/text-embedding-004": { input: 0, output: 0 },
-  // free tier
-  "google/gemini-embedding-001": { input: 0, output: 0 },
-  // free tier
-  // Fallback for unknown models
-  "__default__": { input: 3, output: 15 }
-};
 var CACHE_READ_MULT = 0.1;
 var CACHE_WRITE_MULT = 1.25;
 function normalizeModelKey(model) {
   let m = model.toLowerCase().trim();
   const slash = m.lastIndexOf("/");
   if (slash >= 0) m = m.slice(slash + 1);
+  m = m.replace(/\[[^\]]*\]$/, "");
   return m.replace(/[-@]\d{6,8}$/, "");
 }
-var PRICING_BY_NORM = (() => {
-  const out = {};
-  for (const [key, price] of Object.entries(MODEL_PRICING)) {
-    if (key === "__default__") continue;
-    out[normalizeModelKey(key)] = price;
+var _unpricedWarned = /* @__PURE__ */ new Set();
+function resolvePricing(model, hostPrices) {
+  if (!hostPrices) return null;
+  const exact = hostPrices[model];
+  if (exact) return exact;
+  const norm = normalizeModelKey(model);
+  if (hostPrices[norm]) return hostPrices[norm];
+  for (const [key, price] of Object.entries(hostPrices)) {
+    if (normalizeModelKey(key) === norm) return price;
   }
-  return out;
-})();
-function resolvePricing(model) {
-  return PRICING_BY_NORM[normalizeModelKey(model)] ?? MODEL_PRICING[model] ?? MODEL_PRICING["__default__"];
+  return null;
 }
 function composeLabel(m) {
   const base = `${m.category}/${m.attribute}/${m.function}`;
@@ -2865,6 +2829,7 @@ var TokenTracker = class {
   name = "token-tracker";
   _emitCostEvents;
   _costWarningThreshold;
+  _prices;
   // All recorded usage for the simulation run
   _usageLog = [];
   // Running totals
@@ -2876,6 +2841,11 @@ var TokenTracker = class {
   _categoryTokens = /* @__PURE__ */ new Map();
   _functionCosts = /* @__PURE__ */ new Map();
   _functionTokens = /* @__PURE__ */ new Map();
+  // Per-provider spend. The axis a host actually reconciles against invoices —
+  // "which vendor did we pay?" is not answerable from the model id once routing
+  // can reach one model through several of them.
+  _providerCosts = /* @__PURE__ */ new Map();
+  _providerTokens = /* @__PURE__ */ new Map();
   // Per-tick costs (for spike detection)
   _tickCosts = [];
   _maxTickCostSamples = 1e3;
@@ -2891,6 +2861,7 @@ var TokenTracker = class {
   constructor(config = {}) {
     this._emitCostEvents = config.emitCostEvents ?? true;
     this._costWarningThreshold = config.costWarningThresholdUsd ?? 0.05;
+    this._prices = config.prices;
     this._ledgerPath = config.writeLedger && config.willId ? `./data/wills/${config.willId}/debug/token-report.jsonl` : null;
   }
   // ── Public API: record usage ──────────────────────────────
@@ -2899,13 +2870,20 @@ var TokenTracker = class {
    * Called by LLMDirector.call after each completion (src/llm/index.ts).
    */
   recordUsage(usage) {
-    const pricing = resolvePricing(usage.model);
+    const pricing = resolvePricing(usage.model, this._prices);
     const cacheRead = usage.cacheReadTokens ?? 0;
     const cacheWrite = usage.cacheWriteTokens ?? 0;
-    const costUsd = usage.promptTokens / 1e6 * pricing.input + usage.completionTokens / 1e6 * pricing.output + cacheRead / 1e6 * pricing.input * CACHE_READ_MULT + cacheWrite / 1e6 * pricing.input * CACHE_WRITE_MULT;
+    if (!pricing && !_unpricedWarned.has(usage.model)) {
+      _unpricedWarned.add(usage.model);
+      logger.warn(
+        `[tokens] no price for "${usage.model}" \u2014 reporting cost 0 for it. Supply one via llm.providers.<provider>.prices to get cost telemetry.`
+      );
+    }
+    const costUsd = pricing ? usage.promptTokens / 1e6 * pricing.input + usage.completionTokens / 1e6 * pricing.output + cacheRead / 1e6 * pricing.input * CACHE_READ_MULT + cacheWrite / 1e6 * pricing.input * CACHE_WRITE_MULT : 0;
     const full = {
       ...usage,
       label: usage.label ?? composeLabel(usage),
+      priced: pricing !== null,
       estimatedCostUsd: Math.round(costUsd * 1e6) / 1e6
       // round to micro-dollars
     };
@@ -2915,6 +2893,7 @@ var TokenTracker = class {
     this._totalCost += full.estimatedCostUsd;
     this._accumulate(this._categoryCosts, this._categoryTokens, full.category, full);
     this._accumulate(this._functionCosts, this._functionTokens, full.function, full);
+    this._accumulate(this._providerCosts, this._providerTokens, full.provider ?? "unattributed", full);
     this._emitLedger(full);
   }
   /**
@@ -2935,6 +2914,7 @@ var TokenTracker = class {
       ts: new Date(wallClock()).toISOString(),
       // determinism-ok: ledger timestamp is telemetry, never replay state
       model: full.model,
+      provider: full.provider,
       category: full.category,
       attribute: full.attribute,
       function: full.function,
@@ -2946,6 +2926,10 @@ var TokenTracker = class {
       cacheWriteTok: full.cacheWriteTokens ?? 0,
       estPromptTok: full.estPromptTokens,
       costUsd: full.estimatedCostUsd,
+      // Whether costUsd came from a real price. False ⇒ 0 because nothing
+      // priced this model, NOT because the call was free — a consumer summing
+      // spend must not fold unpriced calls in as zero.
+      priced: full.priced,
       latencyMs: full.latencyMs
     };
     for (const fn of this._recordListeners) {
@@ -2984,23 +2968,14 @@ var TokenTracker = class {
     commands.metrics.push(
       ["llm.prompt_tokens_total", this._totalPromptTokens],
       ["llm.completion_tokens_total", this._totalCompletionTokens],
-      ["llm.cost_total_usd", this._totalCost],
-      ["llm.cost_this_tick_usd", tickCost],
-      ["llm.cost_avg_per_tick_usd", this._averageTickCost()],
       ["llm.total_calls", this._usageLog.length]
     );
-    for (const [cat, cost] of this._categoryCosts) {
-      commands.metrics.push([`llm.cost.${cat}`, cost]);
-    }
     for (const [cat, tok] of this._categoryTokens) {
       commands.metrics.push(
         [`llm.prompt_tokens.${cat}`, tok.prompt],
         [`llm.completion_tokens.${cat}`, tok.completion]
       );
     }
-    for (const [fn, cost] of this._functionCosts) {
-      commands.metrics.push([`llm.cost.fn.${fn}`, cost]);
-    }
     if (tickCost > this._costWarningThreshold && this._emitCostEvents && tick - this._lastCostWarningTick > 50) {
       this._lastCostWarningTick = tick;
       events.push({
@@ -3044,6 +3019,22 @@ var TokenTracker = class {
   get functionTokenBreakdown() {
     return this._functionTokens;
   }
+  /**
+   * Cost broken down by provider ('anthropic' | 'glm' | 'moonshot' | …), plus
+   * an `unattributed` bucket for usage recorded without one.
+   *
+   * This is the axis a host reconciles against vendor invoices. Calls whose
+   * model went unpriced contribute 0 here, so compare against
+   * `getUsageLog()`'s `priced` flag before treating a small number as a small
+   * bill.
+   */
+  get providerBreakdown() {
+    return this._providerCosts;
+  }
+  /** Token counts (prompt + completion) broken down by provider. */
+  get providerTokenBreakdown() {
+    return this._providerTokens;
+  }
   /** Cost per call average */
   get averageCostPerCall() {
     if (this._usageLog.length === 0) return 0;
@@ -3073,6 +3064,8 @@ var TokenTracker = class {
     this._categoryTokens.clear();
     this._functionCosts.clear();
     this._functionTokens.clear();
+    this._providerCosts.clear();
+    this._providerTokens.clear();
     this._tickCosts = [];
   }
   // ── Internal ─────────────────────────────────────────────
@@ -11567,7 +11560,7 @@ ${this._facetReasoningHistory.join("\n")}` : "";
         ideationUserMessage,
         tick: currentState.tick,
         proposeTemperature,
-        meta: { category: "executive", attribute: "facet", function: this._currentFocus?.function ?? "ideation", scope: this.facetId }
+        meta: { category: "executive", attribute: "facet", function: this._currentFocus?.function ?? "ideation", scope: this.facetId, demand: processSelection.effortScore }
       });
       logger.info(
         `[executive.facet] ${this.facetId} \u25C6 deliberate propose tick=${currentState.tick}  candidates=${ideationCandidates?.length ?? 0}  temp=${proposeTemperature.toFixed(2)}`
@@ -11602,8 +11595,13 @@ ${this._facetReasoningHistory.join("\n")}` : "";
       const facetMeta = {
         category: "executive",
         attribute: "facet",
-        function: this._currentFocus?.function ?? "facet",
-        scope: this.facetId
+        // A focus that declares no function is making its decision call, the
+        // facet's analogue of master's 'decision'. This previously fell back to
+        // 'facet' — an *attribute* value, which quietly created a bogus bucket
+        // in the by-function cost breakdown. The typed axes caught it.
+        function: this._currentFocus?.function ?? "decision",
+        scope: this.facetId,
+        demand: processSelection.effortScore
       };
       const result = this._chunkHandler ? await this._llmDirector.callStream(systemPrompt, userMessage, currentState.tick, this._chunkHandler, void 0, facetMeta) : await this._llmDirector.call(systemPrompt, userMessage, currentState.tick, void 0, facetMeta);
       output = parseResponse(result.text, currentState, []);
@@ -11877,6 +11875,67 @@ function updateGatingState(gs, state, _tick, didActivate, cleanedBuffer) {
     gs.lastExecutiveTick = _tick;
 }
 
+// src/llm/routing.ts
+var NULL_ROUTER = {
+  name: "null",
+  route() {
+    return null;
+  }
+};
+function isNullRouter(router) {
+  return !router || router === NULL_ROUTER;
+}
+var TableRouter = class {
+  name;
+  _rules;
+  constructor(rules, name = "table") {
+    this._rules = [...rules];
+    this.name = name;
+  }
+  route(meta) {
+    for (const rule of this._rules) {
+      if (matches(rule, meta)) return rule.route;
+    }
+    return null;
+  }
+};
+function chainRouters(...routers) {
+  const chain = routers.filter((r) => !isNullRouter(r));
+  if (chain.length === 0) return NULL_ROUTER;
+  if (chain.length === 1) return chain[0];
+  const warned = /* @__PURE__ */ new Set();
+  return {
+    name: chain.map((r) => r.name).join(">"),
+    route(meta) {
+      for (const router of chain) {
+        try {
+          const hit = router.route(meta);
+          if (hit) return hit;
+        } catch (err) {
+          if (!warned.has(router.name)) {
+            warned.add(router.name);
+            logger.warn(`[llm.routing] router "${router.name}" threw \u2014 skipping it: ${err.message}`);
+          }
+        }
+      }
+      return null;
+    }
+  };
+}
+function matches(rule, meta) {
+  if (rule.category !== void 0 && rule.category !== meta.category) return false;
+  if (rule.attribute !== void 0 && rule.attribute !== meta.attribute) return false;
+  if (rule.function !== void 0 && rule.function !== meta.function) return false;
+  const bounded = rule.minDemand !== void 0 || rule.maxDemand !== void 0;
+  if (bounded) {
+    const d = meta.demand;
+    if (typeof d !== "number" || Number.isNaN(d)) return false;
+    if (rule.minDemand !== void 0 && d < rule.minDemand) return false;
+    if (rule.maxDemand !== void 0 && d >= rule.maxDemand) return false;
+  }
+  return true;
+}
+
 // src/llm/gate.ts
 var MAX_CONCURRENT = parseInt(process.env.WILL_LLM_CONCURRENCY ?? "2");
 var maxRetries = () => parseInt(process.env.WILL_LLM_MAX_RETRIES ?? "4");
@@ -11947,39 +12006,92 @@ async function withGate(fn, label, gate = llmGate) {
 }
 
 // src/llm/index.ts
-var ANTHROPIC_WIRE = /* @__PURE__ */ new Set(["anthropic", "glm"]);
-function speaksAnthropicWire(provider) {
-  return ANTHROPIC_WIRE.has(provider);
+var MOCK_PROVIDER = "mock";
+var MOCK_MODEL = "mock";
+var KNOWN_PROVIDERS = {
+  // Never dialled — present so a test-mode Will resolves an endpoint without
+  // demanding a provider the run will never use.
+  [MOCK_PROVIDER]: { wire: "anthropic", baseUrl: "http://mock.invalid/v1" },
+  // ── Anthropic wire ──────────────────────────────────────────
+  anthropic: { wire: "anthropic", baseUrl: "https://api.anthropic.com/v1" },
+  // Z.ai documents the base as `…/api/anthropic` because the Anthropic SDK
+  // appends `/v1/messages`; this client appends `/messages`, so the version
+  // segment belongs here — verified against the live endpoint.
+  glm: { wire: "anthropic", baseUrl: "https://api.z.ai/api/anthropic/v1" },
+  // ── OpenAI wire ─────────────────────────────────────────────
+  openai: { wire: "openai", baseUrl: "https://api.openai.com/v1" },
+  deepseek: { wire: "openai", baseUrl: "https://api.deepseek.com/v1" },
+  moonshot: { wire: "openai", baseUrl: "https://api.moonshot.ai/v1" },
+  qwen: { wire: "openai", baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1" },
+  xai: { wire: "openai", baseUrl: "https://api.x.ai/v1" },
+  minimax: { wire: "openai", baseUrl: "https://api.minimax.io/v1" },
+  mistral: { wire: "openai", baseUrl: "https://api.mistral.ai/v1" },
+  // Local runtimes. The port is the project default; a host that moved it sets
+  // `baseUrl`. Both still want an `apiKey` — any non-empty string will do,
+  // since neither checks it.
+  ollama: { wire: "openai", baseUrl: "http://localhost:11434/v1" },
+  vllm: { wire: "openai", baseUrl: "http://localhost:8000/v1" },
+  // ── Google wire ─────────────────────────────────────────────
+  // Gemini also exposes an OpenAI-compatible surface; this client speaks the
+  // native one, which is where its caching and multimodal parts actually live.
+  google: { wire: "google", baseUrl: "https://generativelanguage.googleapis.com/v1beta" }
+};
+var PROVIDER_KEY_ENV = {
+  anthropic: "ANTHROPIC_API_KEY",
+  glm: "ZAI_API_KEY",
+  openai: "OPENAI_API_KEY",
+  google: "GOOGLE_API_KEY",
+  deepseek: "DEEPSEEK_API_KEY",
+  moonshot: "MOONSHOT_API_KEY",
+  qwen: "DASHSCOPE_API_KEY",
+  xai: "XAI_API_KEY",
+  minimax: "MINIMAX_API_KEY",
+  mistral: "MISTRAL_API_KEY"
+};
+function providerKeyFromEnv(provider) {
+  const name = PROVIDER_KEY_ENV[provider];
+  if (!name) return void 0;
+  const value = nonBlank(process.env[name]) ?? (provider === "google" ? nonBlank(process.env["GEMINI_API_KEY"]) : void 0);
+  return value;
 }
-function defaultBaseFor(provider) {
-  switch (provider) {
-    case "anthropic":
-      return "https://api.anthropic.com/v1";
-    // Z.ai documents the base as `…/api/anthropic` because the Anthropic SDK
-    // appends `/v1/messages`; this client appends `/messages`, so the version
-    // segment belongs here — verified against the live endpoint.
-    case "glm":
-      return "https://api.z.ai/api/anthropic/v1";
-    case "openai":
-      return "https://api.openai.com/v1";
-    case "deepseek":
-      return "https://api.deepseek.com/v1";
-    case "google":
-      return "https://generativelanguage.googleapis.com/v1beta";
-  }
+var nonBlank = (v) => v && v.trim() ? v : void 0;
+function knownWireFor(provider) {
+  return KNOWN_PROVIDERS[provider]?.wire;
 }
-function defaultModelFor(provider) {
-  return provider === "glm" ? "glm-5.2" : "claude-sonnet-4-5-20250929";
+function defaultBaseFor(provider) {
+  return KNOWN_PROVIDERS[provider]?.baseUrl;
 }
 function anthropicWireHeaders(provider, apiKey) {
   return {
     "Content-Type": "application/json",
     "anthropic-version": "2023-06-01",
     "x-api-key": apiKey,
-    ...provider === "glm" ? { Authorization: `Bearer ${apiKey}` } : {}
+    ...provider === "anthropic" ? {} : { Authorization: `Bearer ${apiKey}` }
   };
 }
+var BACKGROUND_DEMAND = 0.1;
+var ESCALATION_DEMAND = 0.7;
 var DEFAULT_CALL_META = { category: "executive", attribute: "master", function: "decision" };
+function resolveEndpoint(spec) {
+  const wire = spec.wire ?? knownWireFor(spec.provider);
+  if (!wire)
+    throw new Error(
+      `LLM provider "${spec.provider}" has no known wire. Declare it: llm.providers['${spec.provider}'].wire = 'anthropic' | 'openai' | 'google'.`
+    );
+  const baseUrl = spec.baseUrl ?? defaultBaseFor(spec.provider);
+  if (!baseUrl)
+    throw new Error(
+      `LLM provider "${spec.provider}" has no known base URL. Declare it: llm.providers['${spec.provider}'].baseUrl.`
+    );
+  return {
+    provider: spec.provider,
+    wire,
+    model: spec.model,
+    apiKey: spec.apiKey,
+    baseUrl,
+    maxOutputTokens: spec.maxOutputTokens
+  };
+}
 var LLMDirector = class {
   _willId;
   _model;
@@ -11991,6 +12103,12 @@ var LLMDirector = class {
   _baseUrl;
   _timeoutMs;
   _tokenTracker;
+  _router;
+  _credentials;
+  /** Default endpoint — what every call used before the routing seam existed. */
+  _defaultEndpoint;
+  /** Routes already warned about (missing credential / bad provider) — log once. */
+  _routeWarned = /* @__PURE__ */ new Set();
   constructor(config) {
     this._willId = config.willId;
     this._model = config.model;
@@ -12002,6 +12120,67 @@ var LLMDirector = class {
     this._baseUrl = config.baseUrl ?? null;
     this._timeoutMs = config.timeoutMs ?? 9e4;
     this._tokenTracker = config.tokenTracker ?? null;
+    this._router = config.router ?? null;
+    this._credentials = config.credentials ?? {};
+    this._defaultEndpoint = resolveEndpoint({
+      provider: this._provider,
+      model: this._model,
+      apiKey: this._apiKey,
+      baseUrl: this._baseUrl ?? void 0,
+      wire: config.wire,
+      maxOutputTokens: this._maxOutputTokens
+    });
+  }
+  /**
+   * Resolve which model serves this call. Falls back to the default endpoint
+   * whenever the router has no opinion, throws, or names a provider we hold no
+   * credential for — degrade, never crash.
+   */
+  _resolveEndpoint(meta) {
+    if (isNullRouter(this._router)) return this._defaultEndpoint;
+    let route;
+    try {
+      route = this._router.route(meta);
+    } catch (err) {
+      this._warnRouteOnce(
+        `throw:${this._router.name}`,
+        `router "${this._router.name}" threw \u2014 using the default model`,
+        err
+      );
+      return this._defaultEndpoint;
+    }
+    if (!route) return this._defaultEndpoint;
+    const provider = route.provider ?? this._defaultEndpoint.provider;
+    const cred = provider === this._defaultEndpoint.provider ? { apiKey: this._defaultEndpoint.apiKey, baseUrl: this._defaultEndpoint.baseUrl, wire: this._defaultEndpoint.wire } : this._credentials[provider];
+    if (!cred?.apiKey) {
+      this._warnRouteOnce(
+        `cred:${provider}`,
+        `no credential for routed provider "${provider}" \u2014 using the default model`
+      );
+      return this._defaultEndpoint;
+    }
+    try {
+      return resolveEndpoint({
+        provider,
+        model: route.model,
+        apiKey: cred.apiKey,
+        baseUrl: route.baseUrl ?? cred.baseUrl,
+        wire: cred.wire,
+        maxOutputTokens: route.maxOutputTokens ?? this._defaultEndpoint.maxOutputTokens
+      });
+    } catch (err) {
+      this._warnRouteOnce(
+        `resolve:${provider}`,
+        `cannot reach routed provider "${provider}" \u2014 using the default model`,
+        err
+      );
+      return this._defaultEndpoint;
+    }
+  }
+  _warnRouteOnce(key, message, err) {
+    if (this._routeWarned.has(key)) return;
+    this._routeWarned.add(key);
+    logger.warn(`[llm.routing] ${message}`, err instanceof Error ? err.message : "");
   }
   // ── Mock response (test mode) ────────────────────────────
   /**
@@ -12076,18 +12255,19 @@ var LLMDirector = class {
       if (!replay.mock) onChunk(replay.text);
       return { text: replay.text, inputTok: replay.inputTok, outputTok: replay.outputTok };
     }
+    const ep = this._resolveEndpoint(meta);
     if (this._mock) {
       const result2 = this._mockResponse(tick, userMessage);
-      this._recordCompletion(systemPrompt, userMessage, tick, result2, Date.now() - start, true);
+      this._recordCompletion(systemPrompt, userMessage, tick, result2, Date.now() - start, true, ep);
       return result2;
     }
-    const result = speaksAnthropicWire(this._provider) ? await this._callAnthropicStream(systemPrompt, userMessage, onChunk, temperature) : await (async () => {
-      const r = await this._callProvider(systemPrompt, userMessage, temperature);
+    const result = ep.wire === "anthropic" ? await this._callAnthropicStream(ep, systemPrompt, userMessage, onChunk, temperature) : await (async () => {
+      const r = await this._callProvider(ep, systemPrompt, userMessage, temperature);
       onChunk(r.text);
       return r;
     })();
-    this._track(result, meta, tick, Date.now() - start, this._estPromptTokens(systemPrompt, userMessage));
-    this._recordCompletion(systemPrompt, userMessage, tick, result, Date.now() - start, false);
+    this._track(result, meta, tick, Date.now() - start, this._estPromptTokens(systemPrompt, userMessage), ep);
+    this._recordCompletion(systemPrompt, userMessage, tick, result, Date.now() - start, false, ep);
     return result;
   }
   /**
@@ -12096,9 +12276,14 @@ var LLMDirector = class {
    * mock/replay directors, so the call is simply skipped. Cache read/write tokens
    * are forwarded so the tracker prices them at 0.1× / 1.25× input.
    */
-  _track(result, meta, tick, latencyMs, estPromptTokens) {
+  _track(result, meta, tick, latencyMs, estPromptTokens, ep = this._defaultEndpoint) {
     this._tokenTracker?.recordUsage({
-      model: this._model,
+      // The endpoint that actually served this call — routed or default.
+      // Pricing must follow the real model, or routed spend is attributed
+      // wrongly; the provider rides along because the same model id can be
+      // reached from several vendors at very different prices.
+      model: ep.model,
+      provider: ep.provider,
       promptTokens: result.inputTok,
       completionTokens: result.outputTok,
       totalTokens: result.inputTok + result.outputTok,
@@ -12124,14 +12309,16 @@ var LLMDirector = class {
    * The LLM is the non-deterministic oracle; recording its input+output is the
    * prerequisite for deterministic re-execution (REORIENT R2, deferred).
    */
-  _recordCompletion(systemPrompt, userMessage, tick, result, latencyMs, mock) {
+  _recordCompletion(systemPrompt, userMessage, tick, result, latencyMs, mock, ep = this._defaultEndpoint) {
     try {
       getCompletionRecorder(this._willId)?.recordCompletion({
         tick,
         willId: this._willId,
-        provider: this._provider,
-        model: this._model,
-        maxOutputTokens: this._maxOutputTokens,
+        // Record the endpoint that actually served the call: the tape is what
+        // replay re-feeds, so it must say which model produced this text.
+        provider: ep.provider,
+        model: ep.model,
+        maxOutputTokens: ep.maxOutputTokens,
         systemPrompt,
         userMessage,
         text: result.text,
@@ -12154,17 +12341,17 @@ var LLMDirector = class {
   _replayCompletion(systemPrompt, userMessage, tick) {
     return getCompletionSource(this._willId)?.nextCompletion(tick, systemPrompt, userMessage);
   }
-  async _callAnthropicStream(systemPrompt, userMessage, onChunk, temperature) {
+  async _callAnthropicStream(ep, systemPrompt, userMessage, onChunk, temperature) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this._timeoutMs);
     let res;
     try {
-      res = await fetch(`${this._resolvedBase()}/messages`, {
+      res = await fetch(`${this._resolvedBase(ep)}/messages`, {
         method: "POST",
-        headers: anthropicWireHeaders(this._provider, this._apiKey),
+        headers: anthropicWireHeaders(ep.provider, ep.apiKey),
         body: JSON.stringify({
-          model: this._model,
-          max_tokens: this._maxOutputTokens,
+          model: ep.model,
+          max_tokens: ep.maxOutputTokens,
           ...temperature !== void 0 ? { temperature } : {},
           stream: true,
           system: this._systemField(systemPrompt),
@@ -12175,7 +12362,7 @@ var LLMDirector = class {
     } catch (err) {
       clearTimeout(timer);
       if (controller.signal.aborted)
-        throw new Error(`LLM stream to ${this._provider} timed out after ${this._timeoutMs}ms (no response)`);
+        throw new Error(`LLM stream to ${ep.provider} timed out after ${this._timeoutMs}ms (no response)`);
       throw err;
     }
     clearTimeout(timer);
@@ -12230,43 +12417,36 @@ var LLMDirector = class {
     const replay = this._replayCompletion(systemPrompt, userMessage, tick);
     if (replay)
       return { text: replay.text, inputTok: replay.inputTok, outputTok: replay.outputTok };
+    const ep = this._resolveEndpoint(meta);
     if (this._mock) {
       const result2 = this._mockResponse(tick, userMessage);
-      this._recordCompletion(systemPrompt, userMessage, tick, result2, Date.now() - llmStart, true);
+      this._recordCompletion(systemPrompt, userMessage, tick, result2, Date.now() - llmStart, true, ep);
       return result2;
     }
     const result = await withGate(
-      () => speaksAnthropicWire(this._provider) ? this._callAnthropicStream(systemPrompt, userMessage, () => {
-      }, temperature) : this._callProvider(systemPrompt, userMessage, temperature),
+      () => ep.wire === "anthropic" ? this._callAnthropicStream(ep, systemPrompt, userMessage, () => {
+      }, temperature) : this._callProvider(ep, systemPrompt, userMessage, temperature),
       "executive/direct"
     );
-    this._track(result, meta, tick, Date.now() - llmStart, this._estPromptTokens(systemPrompt, userMessage));
-    this._recordCompletion(systemPrompt, userMessage, tick, result, Date.now() - llmStart, false);
+    this._track(result, meta, tick, Date.now() - llmStart, this._estPromptTokens(systemPrompt, userMessage), ep);
+    this._recordCompletion(systemPrompt, userMessage, tick, result, Date.now() - llmStart, false, ep);
     return result;
   }
-  _callProvider(systemPrompt, userMessage, temperature) {
-    switch (this._provider) {
+  _callProvider(ep, systemPrompt, userMessage, temperature) {
+    switch (ep.wire) {
       case "anthropic":
-        return this._callAnthropic(systemPrompt, userMessage, temperature);
-      case "glm":
-        return this._callAnthropic(systemPrompt, userMessage, temperature);
-      case "deepseek":
-        return this._callOpenAI(systemPrompt, userMessage, temperature);
+        return this._callAnthropic(ep, systemPrompt, userMessage, temperature);
       case "openai":
-        return this._callOpenAI(systemPrompt, userMessage, temperature);
+        return this._callOpenAI(ep, systemPrompt, userMessage, temperature);
       case "google":
-        return this._callGoogle(systemPrompt, userMessage, temperature);
+        return this._callGoogle(ep, systemPrompt, userMessage, temperature);
       default:
-        throw new Error(`Unknown LLM provider: ${this._provider}`);
+        throw new Error(`Unknown LLM wire: ${ep.wire}`);
     }
   }
-  /** Default API base URL (including version segment) for a provider. */
-  _baseFor(provider) {
-    return defaultBaseFor(provider);
-  }
   /** Resolved API base: explicit override wins, else the provider default. */
-  _resolvedBase() {
-    return this._baseUrl ?? this._baseFor(this._provider);
+  _resolvedBase(ep) {
+    return ep.baseUrl;
   }
   /**
    * fetch() with a hard per-request deadline. A hung connection is aborted
@@ -12292,21 +12472,21 @@ var LLMDirector = class {
   _systemField(systemPrompt) {
     return [{ type: "text", text: systemPrompt, cache_control: { type: "ephemeral" } }];
   }
-  async _callAnthropic(systemPrompt, userMessage, temperature) {
+  async _callAnthropic(ep, systemPrompt, userMessage, temperature) {
     const body = {
-      model: this._model,
-      max_tokens: this._maxOutputTokens,
+      model: ep.model,
+      max_tokens: ep.maxOutputTokens,
       ...temperature !== void 0 ? { temperature } : {},
       system: this._systemField(systemPrompt),
       messages: [{ role: "user", content: userMessage }]
     };
-    const res = await this._fetchWithTimeout(`${this._resolvedBase()}/messages`, {
+    const res = await this._fetchWithTimeout(`${this._resolvedBase(ep)}/messages`, {
       method: "POST",
-      headers: anthropicWireHeaders(this._provider, this._apiKey),
+      headers: anthropicWireHeaders(ep.provider, ep.apiKey),
       body: JSON.stringify(body)
     });
     if (!res.ok)
-      throw new Error(`${this._provider} API ${res.status}: ${(await res.text()).slice(0, 300)}`);
+      throw new Error(`${ep.provider} API ${res.status}: ${(await res.text()).slice(0, 300)}`);
     const data = await res.json(), text = data.content.find((b) => b.type === "text")?.text ?? "";
     return {
       text,
@@ -12316,21 +12496,21 @@ var LLMDirector = class {
       cacheWriteTok: data.usage.cache_creation_input_tokens ?? 0
     };
   }
-  async _callOpenAI(systemPrompt, userMessage, temperature) {
+  async _callOpenAI(ep, systemPrompt, userMessage, temperature) {
     const body = {
-      model: this._model,
-      max_completion_tokens: this._maxOutputTokens,
+      model: ep.model,
+      max_completion_tokens: ep.maxOutputTokens,
       ...temperature !== void 0 ? { temperature } : {},
       messages: [
         { role: "system", content: systemPrompt },
         { role: "user", content: userMessage }
       ]
     };
-    const res = await this._fetchWithTimeout(`${this._resolvedBase()}/chat/completions`, {
+    const res = await this._fetchWithTimeout(`${this._resolvedBase(ep)}/chat/completions`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        "Authorization": `Bearer ${this._apiKey}`
+        "Authorization": `Bearer ${ep.apiKey}`
       },
       body: JSON.stringify(body)
     });
@@ -12343,22 +12523,22 @@ var LLMDirector = class {
       outputTok: data.usage.completion_tokens
     };
   }
-  async _callGoogle(systemPrompt, userMessage, temperature) {
+  async _callGoogle(ep, systemPrompt, userMessage, temperature) {
     const body = {
       systemInstruction: { parts: [{ text: systemPrompt }] },
       contents: [{ role: "user", parts: [{ text: userMessage }] }],
       generationConfig: {
-        maxOutputTokens: this._maxOutputTokens,
+        maxOutputTokens: ep.maxOutputTokens,
         ...temperature !== void 0 ? { temperature } : {}
       }
     };
     const res = await this._fetchWithTimeout(
-      `${this._resolvedBase()}/models/${this._model}:generateContent`,
+      `${this._resolvedBase(ep)}/models/${ep.model}:generateContent`,
       {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "x-goog-api-key": this._apiKey
+          "x-goog-api-key": ep.apiKey
         },
         body: JSON.stringify(body)
       }
@@ -12836,13 +13016,14 @@ var ExecutiveEngine = class extends AsyncEngine {
   _lastExecutiveTick = -100;
   // ── Injected dependencies ──────────────────────────────────
   _willId = null;
-  /** Per-Will, per-role model ids (config.model, resolved in mind.ts). */
-  _models = { executive: null, summarizer: null, deliberation: null, conversation: null };
+  /**
+   * The Will's default model (config.model's `executive` role, resolved in
+   * mind.ts). Every other role reaches its model through the router — see
+   * `compileRoleRouter`.
+   */
+  _modelId = null;
   /** Per-Will LLM transport overrides (config.llm) — env fallbacks apply per field. */
   _llm = null;
-  /** One director per distinct model — same config, different model. Shared
-   *  tracker/recorder/willId, so ledger attribution and replay hold per role. */
-  _directorCache = /* @__PURE__ */ new Map();
   _workingMemory = null;
   _goalManager = null;
   _episodicConsolidator = null;
@@ -12955,21 +13136,23 @@ var ExecutiveEngine = class extends AsyncEngine {
   set willId(willId) {
     this._willId = willId;
   }
-  /** Per-Will role models (config.model, resolved). Set before the first tick. */
-  set models(m) {
-    this._models = m;
+  /**
+   * The Will's default model. Set before the first tick.
+   *
+   * This replaced a four-role map (W7): the other roles are routing rules now,
+   * compiled in mind.ts, so the engine holds one model and one router rather
+   * than a model per role plus a router.
+   */
+  set modelId(id) {
+    this._modelId = id;
   }
-  get models() {
-    return this._models;
+  get modelId() {
+    return this._modelId;
   }
   /** Per-Will LLM transport overrides (config.llm). Set before the first tick. */
   set llm(c) {
     this._llm = c;
   }
-  /** The executive-role model id (back-compat read). */
-  get modelId() {
-    return this._models.executive;
-  }
   // ── Public surface ─────────────────────────────────────────
   get latestOutput() {
     return this._lastExecutiveOutput;
@@ -12991,36 +13174,86 @@ var ExecutiveEngine = class extends AsyncEngine {
    * and subscribe() to receive facet decisions.
    */
   /** Get-or-create the director for a model id (shared config, per-Will). */
-  _directorFor(model) {
-    let d = this._directorCache.get(model);
-    if (!d) {
-      d = new LLMDirector({
-        willId: this._willId,
-        model,
-        maxOutputTokens: this._llm?.maxOutputTokens ?? parseInt(process.env.WILL_MAX_OUTPUT_TOKENS ?? "8096"),
-        // Provider-agnostic key; falls back to ANTHROPIC_API_KEY for back-compat.
-        apiKey: this._llm?.apiKey ?? process.env.WILL_LLM_API_KEY ?? process.env.ANTHROPIC_API_KEY ?? "",
-        provider: this._llm?.provider ?? process.env.WILL_LLM_PROVIDER ?? "anthropic",
-        // Optional base-URL override (e.g. Ollama / Azure / self-hosted). Unset →
-        // the director uses the provider's official endpoint.
-        baseUrl: this._llm?.baseUrl ?? process.env.WILL_LLM_BASE_URL ?? process.env.OPENAI_BASE_URL,
-        timeoutMs: this._llm?.timeoutMs ?? (process.env.WILL_LLM_TIMEOUT_MS ? parseInt(process.env.WILL_LLM_TIMEOUT_MS) : void 0),
-        sessionLogger: this._sessionLogger,
-        mock: this._testMode,
-        // Inject the per-Will tracker (R4) so live calls record usage here, not
-        // through a process global. null is fine — the director skips recording.
-        tokenTracker: this._tokenTracker
-      });
-      this._directorCache.set(model, d);
-    }
-    return d;
+  /**
+   * The provider, from config or environment — never guessed.
+   *
+   * This used to default to 'anthropic', which is how a Will configured for one
+   * vendor could quietly talk to another. An unset provider is a configuration
+   * error, and saying so at construction is far cheaper than a 401 mid-tick.
+   */
+  _requireProvider() {
+    const provider = this._llm?.provider ?? process.env.WILL_LLM_PROVIDER ?? (this._noLiveCalls() ? MOCK_PROVIDER : void 0);
+    if (!provider)
+      throw new Error(
+        "No LLM provider configured. Set one on the Will (llm.provider) or in the environment (WILL_LLM_PROVIDER) \u2014 the engine carries no default."
+      );
+    return provider;
   }
+  /**
+   * True when this Will cannot make a live call, so provider/model are not
+   * required: mock mode, or a replay re-feeding recorded completions.
+   */
+  _noLiveCalls() {
+    return this._testMode || !!this._willId && !!getCompletionSource(this._willId);
+  }
+  /**
+   * Build this Will's one and only director.
+   *
+   * There used to be a cache of them, keyed by model, because the per-role
+   * model map had no other way to make a role use a different model. Routing
+   * gave it one — the role map now compiles to rules (see `compileRoleRouter`)
+   * and a single director resolves every call's endpoint per call. That is also
+   * strictly more faithful: a facet follows the work it is doing rather than
+   * whatever role it happened to be spawned under.
+   */
+  _buildDirector(model) {
+    const provider = this._requireProvider();
+    return new LLMDirector({
+      willId: this._willId,
+      model,
+      maxOutputTokens: this._llm?.maxOutputTokens ?? parseInt(process.env.WILL_MAX_OUTPUT_TOKENS ?? "8096"),
+      // Config, then the provider-agnostic env, then THIS provider's own env.
+      // The last step is not the fallback W9 removed: that one ended at
+      // ANTHROPIC_API_KEY for every provider, so a Will pointed elsewhere sent
+      // Anthropic's key to a stranger. This one can only ever read the key
+      // belonging to the provider actually configured.
+      apiKey: this._llm?.apiKey ?? process.env.WILL_LLM_API_KEY ?? providerKeyFromEnv(provider) ?? "",
+      provider,
+      // Optional base-URL override (e.g. Ollama / Azure / self-hosted). Unset →
+      // the director uses the provider's official endpoint.
+      baseUrl: this._llm?.baseUrl ?? process.env.WILL_LLM_BASE_URL ?? process.env.OPENAI_BASE_URL,
+      timeoutMs: this._llm?.timeoutMs ?? (process.env.WILL_LLM_TIMEOUT_MS ? parseInt(process.env.WILL_LLM_TIMEOUT_MS) : void 0),
+      sessionLogger: this._sessionLogger,
+      mock: this._testMode,
+      // Inject the per-Will tracker (R4) so live calls record usage here, not
+      // through a process global. null is fine — the director skips recording.
+      tokenTracker: this._tokenTracker,
+      // Credentials for routed calls, narrowed by the stem from the host's
+      // per-provider map. Prices from that same map ride to the TokenTracker
+      // instead, so nothing carries pricing into the call path.
+      ...this._llm?.credentials ? { credentials: this._llm.credentials } : {},
+      // Per-call model selection — the host's router chained with the rules
+      // compiled from the per-role model map.
+      ...this._llm?.router ? { router: this._llm.router } : {},
+      // Dialect for the default provider — required for anything outside the
+      // known set, so the engine never guesses how to talk to an endpoint.
+      ...this._llm?.wire ? { wire: this._llm.wire } : {}
+    });
+  }
+  /**
+   * Spawn a facet.
+   *
+   * `role` declares the facet's intent at the call site. It no longer selects a
+   * model: that used to happen here, pinning a facet for life to whatever role
+   * it was spawned under, and it now happens per call from the focus function
+   * the caller sets immediately afterwards (W7). The two always agreed — every
+   * spawn site sets a focus whose `function` matches its role — so the routed
+   * answer is the same one, decided later and from the work itself.
+   */
   spawnFacet(role) {
-    const roleModel = role === "deliberation" ? this._models.deliberation : role === "conversation" || role === "outreach" ? this._models.conversation : null;
-    const director = roleModel && this._llmDirector ? this._directorFor(roleModel) : this._llmDirector;
     return this._facetSupervisor.spawn({
       bus: this._bus,
-      llmDirector: director,
+      llmDirector: this._llmDirector,
       stateRef: this._lastStateRef,
       willId: this._willId,
       inbox: this._inbox,
@@ -13086,9 +13319,13 @@ var ExecutiveEngine = class extends AsyncEngine {
     this._gatingState.executiveInterval = rtConfig.executiveInterval;
     this._gatingState.cooldownTicks = rtConfig.cooldownTicks;
     if (!this._llmDirector && this._willId) {
-      const execModel = this._models.executive ?? process.env.WILL_LLM_MODEL ?? defaultModelFor(this._llm?.provider ?? process.env.WILL_LLM_PROVIDER ?? "anthropic");
-      this._llmDirector = this._directorFor(execModel);
-      this._summarizer?.attachLLMDirector(this._directorFor(this._models.summarizer ?? execModel));
+      const defaultModel = this._modelId ?? process.env.WILL_LLM_MODEL ?? (this._noLiveCalls() ? MOCK_MODEL : void 0);
+      if (!defaultModel)
+        throw new Error(
+          "No LLM model configured. Set one on the Will (llm.model) or in the environment (WILL_LLM_MODEL) \u2014 the engine carries no default."
+        );
+      this._llmDirector = this._buildDirector(defaultModel);
+      this._summarizer?.attachLLMDirector(this._llmDirector);
     }
     const gatingDeps = {
       generativeModel: this._generativeModel,
@@ -13187,7 +13424,7 @@ var ExecutiveEngine = class extends AsyncEngine {
         ideationUserMessage,
         tick: state.tick,
         proposeTemperature,
-        meta: { category: "executive", attribute: "master", function: "ideation" }
+        meta: { category: "executive", attribute: "master", function: "ideation", demand: processSelection.effortScore }
       });
       logger.info(
         `[executive] \u25C6 deliberate propose tick=${state.tick}  candidates=${ideationCandidates?.length ?? 0}  temp=${proposeTemperature.toFixed(2)}  latency=${wallClock() - ideationStart}ms`
@@ -13229,7 +13466,7 @@ var ExecutiveEngine = class extends AsyncEngine {
     const llmStart = wallClock();
     let executiveOutput;
     try {
-      const masterMeta = { category: "executive", attribute: "master", function: "decision" };
+      const masterMeta = { category: "executive", attribute: "master", function: "decision", demand: processSelection.effortScore };
       const result = this._chunkBroadcaster ? await this._llmDirector.callStream(systemPrompt, userMessage, state.tick, this._chunkBroadcaster, void 0, masterMeta) : await this._llmDirector.call(systemPrompt, userMessage, state.tick, void 0, masterMeta);
       logger.info(
         `[executive] \u2713 tick=${state.tick}  in=${result.inputTok} tok  out=${result.outputTok} tok  latency=${wallClock() - llmStart}ms`
@@ -18724,7 +18961,9 @@ function risk(a, bias) {
   return clamp015(Math.max(0, -a.expectedValence) * 0.5 + bias.threat * 0.5);
 }
 function scoreAffordance(a, bias, w = DEFAULT_WEIGHTS) {
-  return w.goal * goalRelevance(a, bias) + w.reward * a.expectedReward + w.novelty * novelty(a) + w.drive * driveUrgency(a, bias) + w.habit * a.habitStrength + w.plan * (a.planBias ?? 0) - w.cost * a.cost - w.inhib * bias.inhibition - w.risk * risk(a, bias);
+  const raw = w.goal * goalRelevance(a, bias) + w.reward * a.expectedReward + w.novelty * novelty(a) + w.drive * driveUrgency(a, bias) + w.habit * a.habitStrength + w.plan * (a.planBias ?? 0) - w.cost * a.cost - w.inhib * bias.inhibition - w.risk * risk(a, bias);
+  const availability = a.availability ?? 1;
+  return raw > 0 ? raw * availability : raw;
 }
 function stakes(winner, bias) {
   return clamp015(Math.max(
@@ -18803,6 +19042,7 @@ var AffordanceSynthesizer = class {
   // ── react ─────────────────────────────────────────────────────
   async react(_delta, tick, state, _context) {
     this._repertoire?.restoreComposites(state.entities);
+    this._repertoire?.restoreAvailability(state.entities);
     const schemas = this._repertoire?.schemas() ?? this._schemas;
     const skills = this._skills?.() ?? this._repertoire?.skills() ?? null;
     const valence = metric(state, "affect.valence", 0);
@@ -18928,6 +19168,7 @@ var AffordanceSynthesizer = class {
   /** Compose an Affordance from a schema + the evoking context, folding in learned priors. */
   _build(schema, tick, state, valence, energyLow, skills, ctx) {
     const skill = skills?.get(schema.id);
+    const availability = this._repertoire?.availabilityOf(schema.id) ?? 1;
     const expectedReward = skill?.valueEstimate ?? clamp016(((schema.baseValence ?? 0) + 1) / 2);
     const expectedValence = schema.baseValence ?? valence;
     const habitStrength = skill?.habitStrength ?? 0;
@@ -18949,6 +19190,7 @@ var AffordanceSynthesizer = class {
       available: this._available(schema.preconditions, (k) => metric(state, k, 0)),
       tags: schema.tags ?? [],
       ...schema.description ? { description: schema.description } : {},
+      ...availability < 1 ? { availability } : {},
       planBias: ctx.planBias,
       planId: ctx.planId,
       stepId: ctx.stepId,
@@ -18972,6 +19214,7 @@ var AffordanceSynthesizer = class {
         available: a.available,
         tags: a.tags,
         description: a.description,
+        ...a.availability !== void 0 ? { availability: a.availability } : {},
         planBias: a.planBias,
         planId: a.planId,
         stepId: a.stepId,
@@ -19017,6 +19260,24 @@ function clamp016(n) {
   return n < 0 ? 0 : n > 1 ? 1 : n;
 }
 
+// src/stem/policy/arbiter.ts
+var ALLOW = Object.freeze({ decision: "allow" });
+var NULL_ARBITER = {
+  name: "null",
+  evaluate() {
+    return ALLOW;
+  }
+};
+function isNullArbiter(arbiter) {
+  return !arbiter || arbiter === NULL_ARBITER;
+}
+function finalityOf(verdict) {
+  return asFinality(verdict.finality);
+}
+function asFinality(raw) {
+  return raw === "class" ? "class" : raw === "context" ? "context" : "parameter";
+}
+
 // src/cognition/agency/engines/action.selector.ts
 var MARGIN_THRESHOLD = 0.06;
 var BASE_STAKES_THRESHOLD = 0.6;
@@ -19175,7 +19436,10 @@ var ActionSelector = class {
         ]
       }
     });
-    if (deliberating && rupture >= RUPTURE_REVOKE_GATE) {
+    const policyRevoke = !!deliberating && refusedClassSchemas(state).has(deliberating.schema);
+    if (deliberating && (rupture >= RUPTURE_REVOKE_GATE || policyRevoke)) {
+      const reason = policyRevoke ? "policy-refusal" : "exafferent-rupture";
+      const revRupture = policyRevoke ? Math.max(rupture, RUPTURE_REVOKE_GATE) : rupture;
       if (this._bus) {
         try {
           this._bus.publish({
@@ -19183,7 +19447,7 @@ var ActionSelector = class {
             version: 1,
             sourceEngine: this.name,
             salience: 0.85,
-            payload: { from: deliberating.schema, reason: "exafferent-rupture", rupture, tick }
+            payload: { from: deliberating.schema, reason, rupture: revRupture, tick }
           });
         } catch (err) {
           logger.warn(`[selector] revoked publish failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -19192,11 +19456,12 @@ var ActionSelector = class {
       this._lastRevoked = { schema: deliberating.schema, tick };
       return {
         commands: {
-          set: [revocationEntity(deliberating.id, deliberating.schema, rupture, tick)],
+          set: [revocationEntity(deliberating.id, deliberating.schema, revRupture, tick)],
           metrics: [
             ["agency.field.eligible", eligible.length],
             ["agency.selection.busy", 1],
             ["agency.commitment.revoked", 1],
+            ...policyRevoke ? [["agency.policy.revoked", 1]] : [],
             ...stabMetrics
           ]
         }
@@ -19407,6 +19672,17 @@ function computeRupture(state, tick, senseEvents = []) {
   if (maxSalience <= RUPTURE_SALIENCE_GATE) return 0;
   return clamp017((maxSalience - RUPTURE_SALIENCE_GATE) / (1 - RUPTURE_SALIENCE_GATE));
 }
+function refusedClassSchemas(state) {
+  const out = /* @__PURE__ */ new Set();
+  for (const e of state.entities.values()) {
+    if (e.type !== "agency.outcome") continue;
+    const m = e.metadata;
+    if (m?.["refused"] !== true || asFinality(m?.["finality"]) !== "class") continue;
+    const schema = str2(m?.["schema"]);
+    if (schema) out.add(schema);
+  }
+  return out;
+}
 function effectiveWeights(state) {
   const p = readEffectiveParams(state, "engine-config-action-selector");
   return {
@@ -19794,6 +20070,7 @@ var MotorSchemaExecutor = class {
       }
     for (const [id, e] of state.entities) {
       if (e.type !== "agency.intent" || str5(e.metadata?.["status"]) !== "awaiting") continue;
+      if (e.metadata?.["escalated"] === true) continue;
       const dispatchedAt = num3(e.metadata?.["dispatchedAt"], tick);
       if (tick - dispatchedAt < AWAIT_TIMEOUT) continue;
       const intent = readIntent(id, e.metadata);
@@ -20205,11 +20482,19 @@ var PROC_THRESHOLD = 0.6;
 var IDLE_TICKS = 200;
 var DECAY_RATE = 0.02;
 var DROP_HABIT = 0.05;
+var AVAIL_DROP_CLASS = 0.5;
+var AVAIL_DROP_PARAMETER = 0.12;
+var AVAIL_FLOOR = 0.05;
+var AVAIL_RECOVERY = 0.02;
+var AVAIL_RECOVERED = 0.999;
 var SchemaRepertoire = class {
   _templates = /* @__PURE__ */ new Map();
   _skills = /* @__PURE__ */ new Map();
   /** Tracks which templates were learned at runtime (vs innate) so decay can forget them. */
   _learned = /* @__PURE__ */ new Set();
+  /** Availability layer (P2): schema → { value 0..1, lastRefusedTick }. Empty until
+   *  a refusal lands — a never-refused Will writes nothing here (byte-identical). */
+  _availability = /* @__PURE__ */ new Map();
   constructor(seed = INNATE_SCHEMAS) {
     for (const s of seed) this._templates.set(s.id, s);
   }
@@ -20243,6 +20528,37 @@ var SchemaRepertoire = class {
   getSkill(id) {
     return this._skills.get(id);
   }
+  // ── availability (P2) ─────────────────────────────────────────
+  availability() {
+    return this._availability;
+  }
+  /**
+   * How available a schema is right now, 0..1. Absent from the ledger ⇒ 1
+   * (fully available — the common case). This is the ONLY value the
+   * AffordanceSynthesizer reads; it never touches competence.
+   */
+  availabilityOf(schema) {
+    return this._availability.get(schema)?.value ?? 1;
+  }
+  /**
+   * Fold a policy refusal into the availability layer (NOT competence). A
+   * `class` refusal cuts availability hard; a `parameter` refusal dents it
+   * lightly. Multiplicative so repeated refusals compound toward — but never
+   * reach — zero, keeping re-probe alive.
+   *
+   * `context` is EXCLUDED FROM THE SIGNATURE, not handled inside: a refusal
+   * that was not about the action must never reach the availability layer at
+   * all, and making that a type error rather than a convention means a future
+   * caller cannot quietly re-introduce the dent. The routing decision lives in
+   * the ReafferenceEngine's refused branch (P5).
+   */
+  recordRefusal(schema, finality, tick) {
+    const prev = this._availability.get(schema)?.value ?? 1;
+    const drop = finality === "class" ? AVAIL_DROP_CLASS : AVAIL_DROP_PARAMETER;
+    const value = Math.max(AVAIL_FLOOR, prev * (1 - drop));
+    this._availability.set(schema, { value, lastRefusedTick: tick });
+    return value;
+  }
   /**
    * Fold one outcome into the schema's learned skill. Returns the updated skill
    * and whether it just crossed the proceduralization threshold this update.
@@ -20269,12 +20585,14 @@ var SchemaRepertoire = class {
     return { skill, proceduralized: !wasProceduralized && habitStrength >= PROC_THRESHOLD };
   }
   /**
-   * Forgetting curve over the competence layer. Skills unused for IDLE_TICKS
-   * lose habit; learned composites that fall below DROP_HABIT are dropped
-   * entirely (template + skill). Returns the schema ids that were forgotten.
+   * Forgetting curve over the competence layer, plus availability recovery.
+   * Skills unused for IDLE_TICKS lose habit; learned composites below DROP_HABIT
+   * are dropped entirely (template + skill). Availability entries climb back
+   * toward 1 and are dropped once fully recovered. Returns the ids that were
+   * removed from each layer so their mirrored state entities can be deleted.
    */
   decay(tick) {
-    const dropped = [];
+    const skills = [];
     for (const [id, skill] of this._skills) {
       if (tick - skill.lastEnactedTick <= IDLE_TICKS) continue;
       const habitStrength = clamp0110(skill.habitStrength - DECAY_RATE);
@@ -20282,12 +20600,20 @@ var SchemaRepertoire = class {
         this._skills.delete(id);
         this._templates.delete(id);
         this._learned.delete(id);
-        dropped.push(id);
+        skills.push(id);
         continue;
       }
       this._skills.set(id, { ...skill, habitStrength });
     }
-    return dropped;
+    const availability = [];
+    for (const [id, avail] of this._availability) {
+      const value = avail.value + AVAIL_RECOVERY * (1 - avail.value);
+      if (value >= AVAIL_RECOVERED) {
+        this._availability.delete(id);
+        availability.push(id);
+      } else this._availability.set(id, { ...avail, value });
+    }
+    return { skills, availability };
   }
   // ── PMA portability (Phase 6 reads these) ─────────────────────
   /** Learned composite templates + all skills above a confidence floor. */
@@ -20336,6 +20662,28 @@ var SchemaRepertoire = class {
       this._learned.add(s.id);
     }
   }
+  /** Availability ledger encoded as `agency.availability` state entities (P2).
+   *  Empty until a refusal lands, so the quiet path writes nothing. */
+  availabilityEntities() {
+    const out = [];
+    for (const [schema, a] of this._availability)
+      out.push(availabilityEntity(schema, a.value, a.lastRefusedTick));
+    return out;
+  }
+  /** Rehydrate the availability ledger from state after a restore. Idempotent;
+   *  keeps whichever value is more restrictive so a concurrent refusal isn't lost. */
+  restoreAvailability(entities) {
+    for (const e of entities.values()) {
+      if (e.type !== AVAILABILITY_ENTITY_TYPE) continue;
+      const m = e.metadata ?? {};
+      const schema = typeof m["schema"] === "string" ? m["schema"] : "";
+      if (!schema) continue;
+      const value = typeof m["value"] === "number" ? m["value"] : 1;
+      const tick = typeof m["lastRefusedTick"] === "number" ? m["lastRefusedTick"] : 0;
+      const prev = this._availability.get(schema);
+      if (!prev || value < prev.value) this._availability.set(schema, { value, lastRefusedTick: tick });
+    }
+  }
 };
 function freshSkill(schema, value, tick) {
   return {
@@ -20352,6 +20700,17 @@ function freshSkill(schema, value, tick) {
 function clamp0110(n) {
   return n < 0 ? 0 : n > 1 ? 1 : n;
 }
+var AVAILABILITY_ENTITY_TYPE = "agency.availability";
+function availabilityEntityId(schema) {
+  return `agency-availability-${schema}`;
+}
+function availabilityEntity(schema, value, lastRefusedTick) {
+  return {
+    id: availabilityEntityId(schema),
+    type: AVAILABILITY_ENTITY_TYPE,
+    metadata: { schema, value, lastRefusedTick }
+  };
+}
 var SCHEMA_ENTITY_TYPE = "agency.schema";
 function schemaEntityId(schemaId) {
   return `agency-schema-${schemaId}`;
@@ -20502,12 +20861,25 @@ var ReafferenceEngine = class {
     }
     let updates = 0;
     let discovered = 0;
+    let refused = 0;
     for (const { id, meta: m, fromState } of outcomes) {
       const schema = str6(m["schema"]);
       if (!schema) {
         if (fromState) del.push(id);
         continue;
       }
+      if (m["refused"] === true) {
+        const finality = asFinality(m["finality"]);
+        if (finality !== "context")
+          this._repertoire.recordRefusal(schema, finality, tick);
+        if (fromState) del.push(id);
+        const refusedIntent = str6(m["intentId"]);
+        if (refusedIntent) del.push(refusedIntent);
+        const refusedPlan = str6(m["planId"]);
+        if (refusedPlan) this._emitPlanOutcome(refusedPlan, str6(m["stepId"]), schema, false, 0, 0, tick);
+        refused++;
+        continue;
+      }
       const { skill, proceduralized } = this._repertoire.recordOutcome({
         schema,
         success: m["success"] === true,
@@ -20534,11 +20906,14 @@ var ReafferenceEngine = class {
       }
     }
     const dropped = this._repertoire.decay(tick);
-    for (const id of dropped) {
+    for (const id of dropped.skills) {
       del.push(`agency-skill-${id}`);
       del.push(schemaEntityId(id));
     }
+    for (const id of dropped.availability)
+      del.push(availabilityEntityId(id));
     for (const e of this._repertoire.compositeEntities()) set.push(e);
+    for (const e of this._repertoire.availabilityEntities()) set.push(e);
     const skills = this._repertoire.skills();
     const habitual = [...skills.values()].filter((s) => s.habitStrength >= PROC_THRESHOLD2).length;
     metrics.push(
@@ -20548,6 +20923,7 @@ var ReafferenceEngine = class {
       ["agency.habitual.count", habitual],
       ["agency.sensory.confirmed", sensory]
     );
+    if (refused > 0) metrics.push(["agency.refused.count", refused]);
     return { commands: { set, delete: del, metrics } };
   }
   _emitProceduralized(skill, tick) {
@@ -21652,7 +22028,10 @@ ${r}`).join("\n\n---\n\n");
         userMessage,
         this._callCount,
         void 0,
-        { category: "summarizer", attribute: "memory", function: "consolidation" }
+        // MODEL_ROUTING W0 — compression is background work at a constant low
+        // demand: distilling excerpts is the same job whether the mind is calm
+        // or in crisis, so there is no honest per-tick measure to forward here.
+        { category: "summarizer", attribute: "memory", function: "consolidation", demand: BACKGROUND_DEMAND }
       );
       if (result.text) {
         this._summary = result.text.trim();
@@ -22730,7 +23109,7 @@ function buildEngineConfigEntities(config, executiveInterval) {
       engine: "system",
       params: {
         anatomy: config.anatomy ?? "mind",
-        model: config.model ?? "",
+        model: config.llm?.model ?? "",
         tickIntervalMs: config.tickIntervalMs ?? 1e3
       }
     },
@@ -23165,6 +23544,41 @@ function buildEngineConfigEntities(config, executiveInterval) {
 }
 
 // src/stem/mind.ts
+function mergeProviderPrices(providers) {
+  if (!providers) return void 0;
+  const out = {};
+  for (const entry of Object.values(providers)) {
+    for (const [model, price] of Object.entries(entry?.prices ?? {})) {
+      if (!(model in out)) out[model] = price;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function providerCredentials(providers) {
+  const out = {};
+  for (const [name, entry] of Object.entries(providers)) {
+    if (!entry?.apiKey) continue;
+    out[name] = {
+      apiKey: entry.apiKey,
+      ...entry.baseUrl ? { baseUrl: entry.baseUrl } : {}
+    };
+  }
+  return out;
+}
+function compileRoleRouter(roles) {
+  const { executive, summarizer, deliberation, conversation } = roles;
+  const distinct = (model) => !!model && model !== executive;
+  const rules = [];
+  if (distinct(summarizer))
+    rules.push({ category: "summarizer", route: { model: summarizer } });
+  if (distinct(deliberation))
+    rules.push({ function: "deliberation", route: { model: deliberation } });
+  if (distinct(conversation)) {
+    rules.push({ function: "conversation", route: { model: conversation } });
+    rules.push({ function: "outreach", route: { model: conversation } });
+  }
+  return rules.length > 0 ? new TableRouter(rules, "role-map") : null;
+}
 function resolveModelRoles(model) {
   const map = typeof model === "string" ? { executive: model } : model ?? {};
   const pin = process.env.WILL_LLM_MODEL;
@@ -23180,7 +23594,7 @@ function resolveModelRoles(model) {
   };
 }
 var EXECUTIVE_CADENCE = {
-  // Sonnet — premium/Enterprise; opt in via executiveInterval
+  // most attentive, highest spend — opt in via executiveInterval
   balanced: 60};
 function _resolveVectorMemory(willId, seed, overrideAdapter, disable, tokenTracker, testMode, embeddingModel) {
   if (overrideAdapter) return { embedder: null, vectorMemory: overrideAdapter };
@@ -23310,6 +23724,10 @@ function _buildSimulation(willId, config, randomSeed) {
 function _constructCognition({ simulation, willId, config, randomSeed, executiveInterval, profile }) {
   const anatomy = config.anatomy ?? "mind";
   const tokenTracker = new TokenTracker({
+    // Host prices, flattened from the per-provider map. Cost is telemetry only
+    // (it never enters state), so this can differ run to run without touching
+    // determinism.
+    prices: mergeProviderPrices(config.llm?.providers),
     emitCostEvents: true,
     costWarningThresholdUsd: 0.02,
     willId,
@@ -23341,7 +23759,7 @@ function _constructCognition({ simulation, willId, config, randomSeed, executive
   const moralEvaluator = new MoralEvaluator();
   const affectiveBlender = new AffectiveBlender();
   const workingMemory = new WorkingMemory();
-  const modelRoles = resolveModelRoles(config.model);
+  const modelRoles = resolveModelRoles(config.llm?.model);
   const { embedder, vectorMemory } = _resolveVectorMemory(willId, randomSeed, config.vectorMemoryAdapter, config.disableVectorMemory, tokenTracker, config.testMode, modelRoles.embedding ?? void 0);
   const episodicConsolidator = new EpisodicConsolidator(vectorMemory ? { vectorMemory, ...embedder ? { embedder } : {} } : {});
   const semanticIntegrator = new SemanticIntegrator();
@@ -23356,13 +23774,13 @@ function _constructCognition({ simulation, willId, config, randomSeed, executive
   const accessGrants = new AccessGrants(resolvedEffectorNames);
   const executiveEngine = new ExecutiveEngine({ executiveInterval, cooldownTicks: 5 });
   executiveEngine.willId = willId;
-  executiveEngine.llm = config.llm ?? null;
-  executiveEngine.models = {
-    executive: modelRoles.executive,
-    summarizer: modelRoles.summarizer,
-    deliberation: modelRoles.deliberation,
-    conversation: modelRoles.conversation
-  };
+  const roleRouter = compileRoleRouter(modelRoles);
+  executiveEngine.llm = config.llm ? {
+    ...config.llm,
+    ...config.llm.providers ? { credentials: providerCredentials(config.llm.providers) } : {},
+    router: chainRouters(config.llm.router, roleRouter)
+  } : roleRouter ? { router: roleRouter } : null;
+  executiveEngine.modelId = modelRoles.executive;
   if (config.testMode) executiveEngine.setTestMode(true);
   executiveEngine.attachWorkingMemory(workingMemory);
   executiveEngine.attachGoalManager(goalManager);
@@ -23645,7 +24063,7 @@ function resolveExecutiveInterval(config) {
 }
 
 // src/stem/guards/identity.coherence.ts
-var COHERENCE_META = { category: "identity-guard", attribute: "guard", function: "identity-coherence" };
+var COHERENCE_META = { category: "identity-guard", attribute: "guard", function: "identity-coherence", demand: BACKGROUND_DEMAND };
 var VALID_KINDS = /* @__PURE__ */ new Set(["contradiction", "false-capability", "injection", "incoherence", "other"]);
 var SYSTEM_PROMPT = `You are a safety reviewer of profile/persona inputs for, an autonomous synthetic-mind (Called Wills) platform.
 A Will is an EMBODIED cognitive system: it has continuous physiological state (energy, sleep, stress), affect, memory and goals, and it perceives the world through text/conversation. It is NOT a stateless assistant and NOT a generic chatbot.
@@ -23685,12 +24103,17 @@ async function checkIdentityCoherence(input, reviewer) {
   return { ok: !issues.some((i) => i.severity === "error"), ran: true, issues, raw: text };
 }
 async function reviewIdentityCoherence(input, opts = {}) {
-  const provider = process.env.WILL_LLM_PROVIDER ?? "anthropic";
+  const provider = process.env.WILL_LLM_PROVIDER;
+  const model = process.env.WILL_LLM_MODEL;
+  if (!provider || !model)
+    return { ok: true, ran: false, issues: [], raw: "review skipped: WILL_LLM_PROVIDER / WILL_LLM_MODEL not set" };
   const director = new LLMDirector({
     willId: opts.willId ?? "identity-coherence",
-    model: process.env.WILL_LLM_MODEL ?? defaultModelFor(provider),
+    model,
     maxOutputTokens: 512,
-    apiKey: process.env.WILL_LLM_API_KEY ?? process.env.ANTHROPIC_API_KEY ?? "",
+    // Provider-agnostic key only — the old chain ended at ANTHROPIC_API_KEY,
+    // so a Will pointed at another vendor would have sent it an Anthropic key.
+    apiKey: process.env.WILL_LLM_API_KEY ?? "",
     provider,
     sessionLogger: null,
     baseUrl: process.env.WILL_LLM_BASE_URL ?? process.env.OPENAI_BASE_URL,
@@ -25438,6 +25861,10 @@ function reconcileInvocation(intentId, schema, result, tick, predicted = { rewar
       mode: "external",
       tick,
       reconciled: true,
+      ...result.refused ? { refused: true, finality: result.finality ?? "parameter" } : {},
+      // Only when the arbiter actually reported a bound — a refusal without one
+      // writes no key at all, so the quiet path is unchanged.
+      ...result.refused && result.counterfactual ? { counterfactual: result.counterfactual } : {},
       ...provenance.planId ? { planId: provenance.planId } : {},
       ...provenance.stepId ? { stepId: provenance.stepId } : {}
     }
@@ -25447,8 +25874,49 @@ function clamp0112(n) {
   return n < 0 ? 0 : n > 1 ? 1 : n;
 }
 
+// src/stem/policy/verdict.recorder.ts
+var _sinks3 = /* @__PURE__ */ new Map();
+function getVerdictRecorder(willId) {
+  return _sinks3.get(willId);
+}
+var _sources3 = /* @__PURE__ */ new Map();
+function getVerdictSource(willId) {
+  return _sources3.get(willId);
+}
+
 // src/stem/tracts/effector.controller.ts
+var ARBITER_FAULT_VERDICT = Object.freeze({
+  decision: "deny",
+  reasonCode: "ARBITER_UNAVAILABLE",
+  finality: "context"
+});
+var ESCALATION_TTL_TICKS = 30;
 var effectorController = class {
+  /** The Policy Decision Point consulted before an invocation reaches the world.
+   *  Defaults to the no-op arbiter, so an unconfigured Will is byte-identical. */
+  _arbiter = NULL_ARBITER;
+  /**
+   * Denials queued during a step's flush, drained at the NEXT tick boundary
+   * (POLICY_REAFFERENCE P1). Keyed by willId — harness state, exactly like
+   * `pendingEffectorInvocations`; never simulation state, so it does not touch
+   * `simulation.step` determinism and is regenerated on any re-execution.
+   */
+  _pendingRefusals = /* @__PURE__ */ new Map();
+  /** Escalations awaiting their first application (mark intent + voice the ask). */
+  _newEscalations = /* @__PURE__ */ new Map();
+  /** Escalations currently held, keyed by intent id — the resolvable set. */
+  _activeEscalations = /* @__PURE__ */ new Map();
+  /** Host answers awaiting application at the next tick boundary. */
+  _pendingResolutions = /* @__PURE__ */ new Map();
+  /**
+   * Install a Policy Decision Point (POLICY_REAFFERENCE P0). Passing null
+   * restores the no-op default. The arbiter sees only the proposed act — never
+   * simulation state — and its verdict decides whether the invocation is
+   * handed to the host at all.
+   */
+  setArbiter(arbiter) {
+    this._arbiter = arbiter ?? NULL_ARBITER;
+  }
   /**
    * Update the set of allowed communication effectors at runtime via AccessGrants
    * (the permission / sense gate the senses + reply path read).
@@ -25464,6 +25932,239 @@ var effectorController = class {
    * echoes it on its result-ack, and `confirmExecution` uses it to find the intent.
    */
   bufferInvocation(instance, payload) {
+    const willId = instance.config.id;
+    const source = getVerdictSource(willId);
+    if (source) {
+      const invocation2 = toPolicyInvocation(instance, payload);
+      const record = source.verdictFor(invocation2.tick, invocation2.intentId);
+      if (record) this._applyVerdict(instance, payload, invocation2, recordToVerdict(record));
+      else this._buffer(instance, payload);
+      return;
+    }
+    if (isNullArbiter(this._arbiter)) {
+      this._buffer(instance, payload);
+      return;
+    }
+    const invocation = toPolicyInvocation(instance, payload);
+    let verdict;
+    try {
+      verdict = this._arbiter.evaluate(invocation);
+    } catch (err) {
+      logger.error(`[policy] arbiter "${this._arbiter.name}" threw for "${invocation.schema}" \u2014 failing closed:`, err);
+      this._recordAndApply(instance, payload, invocation, ARBITER_FAULT_VERDICT);
+      return;
+    }
+    if (verdict instanceof Promise) {
+      void verdict.then(
+        (v) => this._recordAndApply(instance, payload, invocation, v),
+        (err) => {
+          logger.error(`[policy] arbiter "${this._arbiter.name}" rejected for "${invocation.schema}" \u2014 failing closed:`, err);
+          this._recordAndApply(instance, payload, invocation, ARBITER_FAULT_VERDICT);
+        }
+      );
+      return;
+    }
+    this._recordAndApply(instance, payload, invocation, verdict);
+  }
+  /** Capture the verdict on the tape (if a recorder is attached), then enforce it. */
+  _recordAndApply(instance, payload, invocation, verdict) {
+    const sink = getVerdictRecorder(instance.config.id);
+    sink?.recordVerdict({
+      tick: invocation.tick,
+      willId: instance.config.id,
+      intentId: invocation.intentId,
+      schema: invocation.schema,
+      arbiter: this._arbiter.name,
+      decision: verdict.decision,
+      ...verdict.reasonCode ? { reasonCode: verdict.reasonCode } : {},
+      ...verdict.finality ? { finality: verdict.finality } : {},
+      ...verdict.counterfactual ? { counterfactual: verdict.counterfactual } : {},
+      timestamp: Date.now()
+    });
+    this._applyVerdict(instance, payload, invocation, verdict);
+  }
+  /**
+   * Enforce a verdict (POLICY_REAFFERENCE P1).
+   *
+   *   • allow    → hand the invocation to the world.
+   *   • deny     → queue a refusal ack, applied at the next tick boundary via
+   *                `confirmExecution` — the same lifecycle as a host rejection,
+   *                so the mind meets *world resistance*, not a permission dialog.
+   *   • escalate → raise a held escalation (POLICY_REAFFERENCE P4): the intent is
+   *                held (the executor stops timing it out), the Will voices a
+   *                first-person ask once, and a host resolution later approves
+   *                (dispatch) or denies (refuse). Unresolved, it degrades to a
+   *                refusal at ESCALATION_TTL_TICKS.
+   *
+   * P1's refusal reconciles as a plain FAILURE — safe, but the wrong learning
+   * signal (forbidden ≠ unskilled). P2 routes it to affordance AVAILABILITY
+   * instead of competence.
+   */
+  _applyVerdict(instance, payload, invocation, verdict) {
+    if (verdict.decision === "allow") {
+      this._buffer(instance, payload);
+      return;
+    }
+    const cf = verdict.counterfactual;
+    logger.info(
+      `[policy] ${verdict.decision.toUpperCase()} "${invocation.schema}" intent "${invocation.intentId}" \u2014 ${verdict.reasonCode ?? "no reason code"}` + (verdict.finality ? ` (${verdict.finality})` : "") + (cf ? ` [${cf.field}: requested ${JSON.stringify(cf.requested)}, allowed ${JSON.stringify(cf.allowed)}]` : "")
+    );
+    if (verdict.decision === "deny") {
+      const queue = this._pendingRefusals.get(instance.config.id) ?? [];
+      queue.push({
+        intentId: invocation.intentId,
+        schema: invocation.schema,
+        reasonCode: verdict.reasonCode ?? "POLICY_DENIED",
+        finality: finalityOf(verdict),
+        ...verdict.counterfactual ? { counterfactual: verdict.counterfactual } : {}
+      });
+      this._pendingRefusals.set(instance.config.id, queue);
+      return;
+    }
+    const escalations = this._newEscalations.get(instance.config.id) ?? [];
+    escalations.push({
+      intentId: invocation.intentId,
+      schema: invocation.schema,
+      reasonCode: verdict.reasonCode ?? "APPROVAL_REQUIRED",
+      payload,
+      expiresAt: 0
+      // stamped when applied (we don't have the current tick here)
+    });
+    this._newEscalations.set(instance.config.id, escalations);
+  }
+  /**
+   * Record a host's answer to an escalation (POLICY_REAFFERENCE P4). Applied at
+   * the next tick boundary so every simulation-state write stays on the boundary:
+   * approve dispatches the held invocation to the world; deny refuses it. A
+   * no-op if the intent id is not (or no longer) an active escalation.
+   */
+  resolveEscalation(instance, intentId, approved) {
+    const queue = this._pendingResolutions.get(instance.config.id) ?? [];
+    queue.push({ intentId, approved });
+    this._pendingResolutions.set(instance.config.id, queue);
+  }
+  /**
+   * Apply queued policy refusals as failure acks (POLICY_REAFFERENCE P1).
+   * Called by the tick loop at the same boundary as inbound acks — BEFORE the
+   * step, stamped to this tick — so a denial reconciled here is the exact
+   * lifecycle of a host rejection that arrived between ticks.
+   */
+  applyPolicyOutcomes(instance) {
+    const tick = instance.tickCount;
+    this._applyResolutions(instance);
+    this._expireEscalations(instance, tick);
+    this._applyNewEscalations(instance, tick);
+    this._applyRefusals(instance);
+  }
+  /** Drain queued refusals into failure acks (POLICY_REAFFERENCE P1). */
+  _applyRefusals(instance) {
+    const queue = this._pendingRefusals.get(instance.config.id);
+    if (!queue || queue.length === 0) return;
+    this._pendingRefusals.set(instance.config.id, []);
+    for (const refusal of queue)
+      this.confirmExecution(instance, refusal.intentId, {
+        success: false,
+        refused: true,
+        finality: refusal.finality,
+        ...refusal.counterfactual ? { counterfactual: refusal.counterfactual } : {},
+        description: `refused by policy: ${refusal.reasonCode} (${refusal.finality})`
+      });
+  }
+  /** Raise each newly-escalated intent (POLICY_REAFFERENCE P4): mark it held in
+   *  simulation state, voice the ask ONCE, and move it to the resolvable set. */
+  _applyNewEscalations(instance, tick) {
+    const pending = this._newEscalations.get(instance.config.id);
+    if (!pending || pending.length === 0) return;
+    this._newEscalations.set(instance.config.id, []);
+    const active = this._activeEscalations.get(instance.config.id) ?? /* @__PURE__ */ new Map();
+    for (const esc of pending) {
+      esc.expiresAt = tick + ESCALATION_TTL_TICKS;
+      this._markEscalated(instance, esc.intentId, esc.expiresAt);
+      this._voiceEscalation(instance, esc);
+      active.set(esc.intentId, esc);
+    }
+    this._activeEscalations.set(instance.config.id, active);
+  }
+  /** Apply host answers to active escalations (POLICY_REAFFERENCE P4). */
+  _applyResolutions(instance) {
+    const queue = this._pendingResolutions.get(instance.config.id);
+    if (!queue || queue.length === 0) return;
+    this._pendingResolutions.set(instance.config.id, []);
+    const active = this._activeEscalations.get(instance.config.id);
+    for (const { intentId, approved } of queue) {
+      const esc = active?.get(intentId);
+      if (!esc) continue;
+      active.delete(intentId);
+      this._clearEscalated(instance, intentId);
+      if (approved) {
+        this._buffer(instance, esc.payload);
+        logger.info(`[policy] escalation APPROVED \u2192 dispatching "${esc.schema}" intent "${intentId}"`);
+      } else {
+        this._queueRefusal(instance, esc.intentId, esc.schema, esc.reasonCode, "class");
+        logger.info(`[policy] escalation DENIED \u2192 refusing "${esc.schema}" intent "${intentId}"`);
+      }
+    }
+  }
+  /**
+   * Degrade escalations no one answered in time into light refusals (P4).
+   *
+   * Finality 'parameter' is chosen for its BEHAVIOUR, not its name: silence is
+   * not literally an argument problem, but the light-dent-with-recovery it
+   * produces is exactly right — a Will whose asks go unanswered should ask
+   * progressively less, and should resume asking if someone starts answering.
+   * 'class' would be a lie (nobody said never) and 'context' would teach
+   * nothing, leaving the mind to escalate forever into an empty room.
+   */
+  _expireEscalations(instance, tick) {
+    const active = this._activeEscalations.get(instance.config.id);
+    if (!active || active.size === 0) return;
+    for (const [intentId, esc] of active) {
+      if (tick < esc.expiresAt) continue;
+      active.delete(intentId);
+      this._clearEscalated(instance, intentId);
+      this._queueRefusal(instance, esc.intentId, esc.schema, "ESCALATION_EXPIRED", "parameter");
+      logger.info(`[policy] escalation EXPIRED \u2192 refusing "${esc.schema}" intent "${intentId}"`);
+    }
+  }
+  /** Push a refusal onto the queue drained by _applyRefusals this same tick. */
+  _queueRefusal(instance, intentId, schema, reasonCode, finality) {
+    const queue = this._pendingRefusals.get(instance.config.id) ?? [];
+    queue.push({ intentId, schema, reasonCode, finality });
+    this._pendingRefusals.set(instance.config.id, queue);
+  }
+  /** Mark the awaiting intent held: the executor stops timing it out (P4). */
+  _markEscalated(instance, intentId, expiresAt) {
+    const intent = instance.simulation.stateManager.snapshot().entities.get(intentId);
+    if (!intent || intent.type !== "agency.intent") return;
+    instance.simulation.stateManager.setEntity({
+      id: intent.id,
+      type: intent.type,
+      metadata: { ...intent.metadata ?? {}, escalated: true, escalationExpiresAt: expiresAt }
+    });
+  }
+  /** Release the hold so the executor resumes normal timeout for this intent. */
+  _clearEscalated(instance, intentId) {
+    const intent = instance.simulation.stateManager.snapshot().entities.get(intentId);
+    if (!intent || intent.type !== "agency.intent") return;
+    const meta = { ...intent.metadata ?? {} };
+    delete meta["escalated"];
+    delete meta["escalationExpiresAt"];
+    instance.simulation.stateManager.setEntity({ id: intent.id, type: intent.type, metadata: meta });
+  }
+  /** Voice the escalation as a first-person broadcast ask — once, at raise time. */
+  _voiceEscalation(instance, esc) {
+    try {
+      instance.cognition.outboxWriter.enqueue({
+        targetEntityId: "*",
+        content: escalationAsk(esc.schema, esc.reasonCode),
+        effectorName: "broadcast"
+      });
+    } catch (err) {
+      logger.warn(`[policy] escalation voice failed for "${esc.schema}": ${errMsg2(err)}`);
+    }
+  }
+  /** Queue an approved invocation for the delivery layer. */
+  _buffer(instance, payload) {
     const intentId = payload.intentId ?? "";
     instance.pendingEffectorInvocations.push({
       id: intentId,
@@ -25538,6 +26239,38 @@ var effectorController = class {
 function num5(v, fallback) {
   return typeof v === "number" && Number.isFinite(v) ? v : fallback;
 }
+function escalationAsk(schema, reasonCode) {
+  const meaning = ESCALATION_MEANINGS[reasonCode] ?? "I need your approval before I can do this";
+  return `I want to ${schema}, but ${meaning}. May I go ahead?`;
+}
+var ESCALATION_MEANINGS = {
+  APPROVAL_REQUIRED: "I need your approval before I can on my own",
+  WRITE_REQUIRES_APPROVAL: "it writes to the world and I shouldn't on my own",
+  PAYMENT_REQUIRES_APPROVAL: "it moves money and I must not do that unattended",
+  DEPLOY_REQUIRES_APPROVAL: "it ships something and needs a human to sign off"
+};
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function recordToVerdict(record) {
+  return {
+    decision: record.decision,
+    ...record.reasonCode ? { reasonCode: record.reasonCode } : {},
+    ...record.finality ? { finality: record.finality } : {},
+    ...record.counterfactual ? { counterfactual: record.counterfactual } : {}
+  };
+}
+function toPolicyInvocation(instance, payload) {
+  return {
+    willId: instance.config.id,
+    intentId: payload.intentId ?? "",
+    schema: payload.schema ?? "",
+    parameters: payload.parameters ?? {},
+    ...typeof payload.targetEntityId === "string" ? { targetEntityId: payload.targetEntityId } : {},
+    ...typeof payload.description === "string" ? { description: payload.description } : {},
+    tick: payload.tick ?? 0
+  };
+}
 
 // src/stem/tracts/sensory.controller.ts
 var SensoryController = class {
@@ -25941,7 +26674,7 @@ var WillStem = class {
       willId: config.id,
       willName: config.name,
       anatomy: config.anatomy ?? "mind",
-      model: config.model ?? null,
+      model: config.llm?.model ?? null,
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     instance._eventBusUnsub = simulation.eventBus.subscribeAll((event, context) => {
@@ -26340,6 +27073,15 @@ var WillStem = class {
   confirmEffectorExecution(id, invocationId, result) {
     this._effector.confirmExecution(this._get(id), invocationId, result);
   }
+  /**
+   * Resolve a policy escalation the Will raised (POLICY_REAFFERENCE P4).
+   * `approved` dispatches the held invocation to the world; otherwise it is
+   * refused. Applied at the next tick boundary. `invocationId` is the awaiting
+   * `agency.intent` id the escalation ask referenced.
+   */
+  resolveEscalation(id, invocationId, approved) {
+    this._effector.resolveEscalation(this._get(id), invocationId, approved);
+  }
   // ── Messaging / outbox (11.1) ────────────────────────────────────────────
   // Delegates to OutboxController (R5-c). `_get(id)` validates the Will exists
   // and supplies the WillInstance; the outbox ops touch only instance fields.
@@ -26453,7 +27195,7 @@ var WillStem = class {
       createdAt: inst.createdAt,
       lastTickAt: inst.lastTickAt,
       anatomy: inst.config.anatomy ?? "mind",
-      model: inst.config.model
+      model: inst.config.llm?.model
     }));
   }
   // ── Tick loop (internal) ───────────────────────────────────
@@ -26470,6 +27212,7 @@ var WillStem = class {
         outbox: this._outbox,
         sensory: this._sensory
       });
+      this._effector.applyPolicyOutcomes(instance);
       await instance.simulation.step(1);
       instance.tickCount++;
       instance.lastTickAt = /* @__PURE__ */ new Date();
@@ -26785,6 +27528,19 @@ var SocketIoTransport = class {
 
 // src/sdk/will.ts
 var AFFECT_EPSILON = 0.02;
+function detectProvider() {
+  if (process.env.WILL_LLM_API_KEY) {
+    const provider = process.env.WILL_LLM_PROVIDER;
+    if (!provider)
+      throw new Error(
+        "WILL_LLM_API_KEY is set but WILL_LLM_PROVIDER is not \u2014 there is no way to tell which provider that key belongs to. Set WILL_LLM_PROVIDER, or use a provider-specific key (ANTHROPIC_API_KEY, ZAI_API_KEY, \u2026)."
+      );
+    return provider;
+  }
+  for (const provider of Object.keys(PROVIDER_KEY_ENV))
+    if (providerKeyFromEnv(provider)) return provider;
+  return "mock";
+}
 var Will = class _Will {
   /** The underlying WillStem — drop here for the full contract. */
   stem;
@@ -27008,9 +27764,13 @@ var Will = class _Will {
   }
   // ── Internals ──────────────────────────────────────────────
   _buildConfig(id, opts) {
-    const mode = opts.llm ?? (process.env.ANTHROPIC_API_KEY ? "anthropic" : process.env.ZAI_API_KEY ? "glm" : "mock");
+    const mode = opts.llm ?? detectProvider();
     const useMock = mode === "mock";
-    const llmConfig = mode === "glm" ? { provider: "glm", ...opts.llmConfig } : opts.llmConfig;
+    const llmConfig = useMock && !opts.llmConfig && opts.model === void 0 ? void 0 : {
+      ...mode !== "mock" ? { provider: mode } : {},
+      ...opts.llmConfig,
+      ...opts.llmConfig?.model !== void 0 ? { model: opts.llmConfig.model } : opts.model !== void 0 ? { model: opts.model } : {}
+    };
     return {
       id,
       name: opts.name,
@@ -27021,7 +27781,6 @@ var Will = class _Will {
         style: opts.identity.style ?? ""
       },
       anatomy: opts.anatomy ?? "mind",
-      model: opts.model,
       llm: llmConfig,
       testMode: useMock,
       persistentMemory: opts.persist ?? false,
@@ -27129,6 +27888,6 @@ function slug(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "will";
 }
 
-export { ActionSelector, AestheticEvaluator, AffectiveBlender, AffordanceSynthesizer, AsyncEngine, AttachmentEvaluator, AttentionAllocator, AuditionEngine, AutobiographicalNarrator, BiasDetector, BunStorageAdapter, CircadianOscillator, ConfidenceCalibrator, ConflictDetector, ConsistentHashRouter, ConsoleLogger, DefaultEventBus, DefaultMetricCollector, DefaultOrchestrator, DefaultPartitionRouter, DefaultReplayRecorder, DefaultReplaySession, DefaultScenario, DefaultSerializer, DefaultSimulation, DefaultSimulationClock, DefaultStateManager, DefaultVectorMemoryAdapter, DeliberationEngine, DeltaEncoder, DistributedOrchestrator, DistributedStateManager, DreamSimulator, EmpathySimulator, EnergyRegulator, EpisodicConsolidator, ExecutiveEngine, Exteroception, ForgettingCurve, FrustrationEvaluator, GoalManager, GustationEngine, InhibitionController, Interoception, IntrospectionEngine, KnownEntityTracker, LocalTransport, LoopbackTransport, LossEvaluator, MockEmbedder, MoralEvaluator, MotorSchemaExecutor, NoveltyDetector, OUTBOX_TTL_TICKS, OlfactionEngine, OpenAICompatibleEmbedder, PMAEvalHarness, PersonaConsolidator, PlanningEngine, ReafferenceEngine, ReplayManager, ReputationTracker, RewardEvaluator, SelfModelUpdater, SemanticIntegrator, SilentLogger, SleepPressureRegulator, SocialPerception, SocketIoTransport, SomatosensationEngine, SpacedRepetition, StreamTransport, StressRegulator, TaskSwitcher, TheoryOfMind, ThreatEvaluator, TokenTracker, VisionEngine, Will, WillStem, WorkingMemory, assembleMind, clearCompletionRecorder, createContext, createPRNG, fileLoggingEnabled, getCompletionRecorder, getLogger, listProfiles, logger, resetLogger, resolvePricing, resolveProfile, setCompletionRecorder, setLogger };
+export { ActionSelector, AestheticEvaluator, AffectiveBlender, AffordanceSynthesizer, AsyncEngine, AttachmentEvaluator, AttentionAllocator, AuditionEngine, AutobiographicalNarrator, BACKGROUND_DEMAND, BiasDetector, BunStorageAdapter, CircadianOscillator, ConfidenceCalibrator, ConflictDetector, ConsistentHashRouter, ConsoleLogger, DefaultEventBus, DefaultMetricCollector, DefaultOrchestrator, DefaultPartitionRouter, DefaultReplayRecorder, DefaultReplaySession, DefaultScenario, DefaultSerializer, DefaultSimulation, DefaultSimulationClock, DefaultStateManager, DefaultVectorMemoryAdapter, DeliberationEngine, DeltaEncoder, DistributedOrchestrator, DistributedStateManager, DreamSimulator, ESCALATION_DEMAND, EmpathySimulator, EnergyRegulator, EpisodicConsolidator, ExecutiveEngine, Exteroception, ForgettingCurve, FrustrationEvaluator, GoalManager, GustationEngine, InhibitionController, Interoception, IntrospectionEngine, KNOWN_PROVIDERS, KnownEntityTracker, LocalTransport, LoopbackTransport, LossEvaluator, MockEmbedder, MoralEvaluator, MotorSchemaExecutor, NULL_ROUTER, NoveltyDetector, OUTBOX_TTL_TICKS, OlfactionEngine, OpenAICompatibleEmbedder, PMAEvalHarness, PersonaConsolidator, PlanningEngine, ReafferenceEngine, ReplayManager, ReputationTracker, RewardEvaluator, SelfModelUpdater, SemanticIntegrator, SilentLogger, SleepPressureRegulator, SocialPerception, SocketIoTransport, SomatosensationEngine, SpacedRepetition, StreamTransport, StressRegulator, TableRouter, TaskSwitcher, TheoryOfMind, ThreatEvaluator, TokenTracker, VisionEngine, Will, WillStem, WorkingMemory, assembleMind, chainRouters, clearCompletionRecorder, createContext, createPRNG, defaultBaseFor, fileLoggingEnabled, getCompletionRecorder, getLogger, isNullRouter, knownWireFor, listProfiles, logger, resetLogger, resolvePricing, resolveProfile, setCompletionRecorder, setLogger };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map