@north-light/crouter 0.3.160 → 0.3.162

package/dist/core/runtime/broker.js

@@ -36,14 +36,14 @@ import { buildRefInventory } from '../memory/inline-ref-inventory.js';
 import { buildGuidance } from '../memory/inline-ref-guidance.js';
 import { clearSessionCache } from '../substrate/session-cache.js';
 import { FRONT_DOOR_ENV } from './front-door.js';
-import { CANVAS_EXTENSIONS, configuredLadderProviders, equivalentOtherProviderModel, isProviderPinnedModelToken, nextLadderModel, normalizeModel, piInvocationToSdkConfig, } from './launch.js';
+import { CANVAS_EXTENSIONS, configuredLadderProviders, isProviderPinnedModelToken, nextLadderModel, normalizeModel, piInvocationToSdkConfig, } from './launch.js';
 import { assertEngineVersion, loadBrokerEngine } from './broker-sdk.js';
 import { resolveBundledPiPackageDir } from './pi-cli.js';
 import { classify } from '../fault-classifier.js';
 import { PoolCredentialStore } from '../pool-credential-store.js';
 import { clearFault, isModelNotFoundError, isProviderUnconfiguredError, readFault, recordFault, recordFaultForCurrentNode } from './fault.js';
 import { clearCleanAbort, markBusy, markCleanAbort } from './busy.js';
-import { extractCoolingDeadline, MANAGED_PROVIDER_ROTATION_POLICY_UI, } from './managed-provider-cooling.js';
+import { extractCoolingDeadline } from './managed-provider-cooling.js';
 import { AUTH_FAULT_RECOVERY_BODY, CONNECTION_FAULT_RECOVERY_BODY, PROVIDER_FAULT_RECOVERY_BODY } from './fault-recovery-nudge.js';
 import { markFatalOnExhaust, nextFaultRetry, policyFor } from './fault-recovery.js';
 import { probeOnline as probeOnlineReal } from './connectivity.js';
@@ -51,7 +51,8 @@ import { CRTR_CYCLE_CUSTOM_TYPE, cycleAwareMessages } from './session-cycles.js'
 import { BUILTIN_SLASH_COMMANDS, piSessionsRoot } from './pi-vendored.js';
 import { StreamWatchdog, resolveStreamWatchdogMs, releaseKnownStreamWait, KNOWN_STREAM_WAIT_UI } from './stream-watchdog.js';
 import { isDeterministicCommandExpansion } from './command-expansion.js';
-import { clearPreferredModel, isManagedProvider, readRotationConfig, readSubscriptionPool, rememberPreferredModel, resolveProviderCandidates } from '../subscription-state.js';
+import { isManagedProvider, readSubscriptionPool, resolveProviderCandidates } from '../subscription-state.js';
+import { expandModelCandidates, modelRequestFromConfig, probeRouteAvailability } from '../model-routes.js';
 import { encodeFrame, FrameDecoder, FrameOverflowError, BROKER_READ_CAPS, } from './broker-protocol.js';
 const THINKING_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
 /**
@@ -780,7 +781,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         clearTimeout(faultRetryTimer);
         faultRetryTimer = null;
     };
-    const failedRetryProviders = new Set();
+    const failedRetryRoutes = new Set();
     let providerFallbackInFlight = null;
     // Models that have already produced a 404 not_found this session. Guards the
     // not-found fallback below against an infinite swap→re-drive→404 loop when the
@@ -839,122 +840,43 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             return;
         const candidateSession = session;
         const candidateServices = services;
-        // An exact-consult launch (cfg.modelExact) locks the session to the single
-        // captured model — never cross-provider-retry, not even the
-        // modelProviderPinned restore-toward-pin exception below. Unavailability
-        // must fail the turn, not substitute a different model.
+        // An exact-consult launch locks the session to its one captured model.
+        // Other requests advance only through their declared route expansion.
         if (cfg.modelExact === true)
             return;
         const currentSpec = formatModelSpec(session.model, session.thinkingLevel);
         if (currentSpec === null)
             return;
-        const next = equivalentOtherProviderModel(currentSpec, failedRetryProviders);
-        if (next === null)
-            return;
-        // An explicit provider pin forbids turn-time rotation AWAY to another
-        // provider — EXCEPT a switch back TOWARD the recorded restoration pin (a
-        // launch that fell back off a cooling pinned provider records the requested
-        // managed model). Restoring to the pinned provider honors the pin rather
-        // than violating it; every other rotation stays suppressed.
-        if (cfg.modelProviderPinned === true) {
-            const pin = readRotationConfig().preferredModel;
-            const targetSpec = parseModelSpec(next.model).modelSpec;
-            const targetProvider = targetSpec.slice(0, targetSpec.indexOf('/'));
-            const targetId = targetSpec.slice(targetSpec.indexOf('/') + 1);
-            if (pin?.providerId !== targetProvider || pin.modelId !== targetId)
+        const routeRequest = modelRequestFromConfig(cfg.model, process.env['CRTR_MODEL_INTENT'], false);
+        if (routeRequest !== undefined) {
+            const routes = expandModelCandidates(routeRequest, process.env['CRTR_NODE_CWD'] ?? cfg.cwd, process.env['CRTR_PROFILE_ID']);
+            const current = parseModelSpec(currentSpec);
+            const liveRank = routes.find((candidate) => `${candidate.providerId}/${candidate.modelId}` === current.modelSpec && candidate.thinkingLevel === current.thinkingLevel)?.rank;
+            const nextRoute = liveRank === undefined ? undefined : routes.slice(liveRank + 1).find((candidate) => !failedRetryRoutes.has(candidate.routeId) && resolveProviderCandidates([{ ...candidate, ...probeRouteAvailability(candidate, registryOf(candidateServices)), automaticFallback: true }]).candidates.length > 0);
+            if (nextRoute === undefined)
                 return;
-        }
-        const fallbackPromise = (async () => {
-            const requestedSpec = parseModelSpec(next.model).modelSpec;
-            const slash = requestedSpec.indexOf('/');
-            const model = slash > 0
-                ? registryOf(candidateServices).find(requestedSpec.slice(0, slash), requestedSpec.slice(slash + 1))
-                : undefined;
-            const requested = parseModelSpec(next.model);
-            const pool = isManagedProvider(requested.modelSpec.slice(0, requested.modelSpec.indexOf('/')))
-                ? readSubscriptionPool(requested.modelSpec.slice(0, requested.modelSpec.indexOf('/')))
-                : [];
-            const resolved = resolveProviderCandidates([{
-                    providerId: requested.modelSpec.slice(0, requested.modelSpec.indexOf('/')),
-                    modelId: requested.modelSpec.slice(requested.modelSpec.indexOf('/') + 1),
-                    thinkingLevel: requested.thinkingLevel,
-                    registered: model !== undefined,
-                    authenticated: model !== undefined && (isManagedProvider(requested.modelSpec.slice(0, requested.modelSpec.indexOf('/')))
-                        ? pool.length > 0
-                        : registryOf(candidateServices).hasConfiguredAuth(model)),
-                    coolingUntil: pool.length > 0 && pool.every((entry) => (entry.rateLimitedUntil || 0) > Date.now())
-                        ? Math.min(...pool.map((entry) => entry.rateLimitedUntil || 0))
-                        : undefined,
-                }]);
-            if (resolved.candidates.length === 0 || model === undefined) {
-                emitEvent({
-                    level: 'debug',
-                    event: 'broker.runtime.diagnostic',
-                    fields: { message: `provider fallback skipped: ${next.model} is ${resolved.rejected[0]?.reason ?? 'unavailable'}` },
-                });
-                return;
-            }
-            // Snapshot the restoration intent before the asynchronous model change;
-            // this retry must not replace a launch-recorded requested pin.
-            const preferred = readRotationConfig().preferredModel;
-            await candidateSession.setModel(model);
-            if (installedGeneration !== generation || session !== candidateSession)
-                return;
-            if (requested.thinkingLevel !== undefined)
-                candidateSession.setThinkingLevel(requested.thinkingLevel);
-            const currentProvider = currentSpec.slice(0, currentSpec.indexOf('/'));
-            const currentModelId = parseModelSpec(currentSpec).modelSpec.slice(currentSpec.indexOf('/') + 1);
-            // A launch fallback already records its requested managed model as the
-            // restoration pin. Keep that intent through turn-time retries; reaching
-            // it makes the temporary pin fulfilled. A normal retry has no such pin,
-            // so retain the failed managed model for provider-rotation to restore.
-            const switchedProvider = requested.modelSpec.slice(0, requested.modelSpec.indexOf('/'));
-            const switchedModelId = requested.modelSpec.slice(switchedProvider.length + 1);
-            if (preferred?.providerId === switchedProvider && preferred.modelId === switchedModelId) {
-                clearPreferredModel();
-            }
-            else if (preferred === undefined && isManagedProvider(currentProvider)) {
-                rememberPreferredModel({ providerId: currentProvider, modelId: currentModelId });
-            }
-            failedRetryProviders.add(next.fromProvider);
-            broadcastModelChanged(false);
-            emitEvent({
-                level: 'debug',
-                event: 'broker.runtime.diagnostic',
-                fields: { message: `provider fallback after ${kind}: ${currentSpec} → ${formatModelSpec(candidateSession.model, candidateSession.thinkingLevel) ?? next.model}` },
-            });
-        })()
-            .catch((err) => {
-            emitEvent({
-                level: 'debug',
-                event: 'broker.runtime.diagnostic',
-                fields: { message: `provider fallback failed: ${err instanceof Error ? err.message : String(err)}` },
+            const fallbackPromise = (async () => {
+                const target = registryOf(candidateServices).find(nextRoute.providerId, nextRoute.modelId);
+                if (!target)
+                    return;
+                await candidateSession.setModel(target);
+                if (installedGeneration !== generation || session !== candidateSession)
+                    return;
+                candidateSession.setThinkingLevel((nextRoute.thinkingLevel ?? 'off'));
+                failedRetryRoutes.add(nextRoute.routeId);
+                broadcastModelChanged(false);
+            })().catch((err) => { emitEvent({ level: 'debug', event: 'broker.runtime.diagnostic', fields: { message: `provider route fallback failed: ${err instanceof Error ? err.message : String(err)}` } }); }).finally(() => {
+                if (installedGeneration === generation)
+                    providerFallbackInFlight = null;
             });
-        })
-            .finally(() => {
-            if (installedGeneration === generation)
-                providerFallbackInFlight = null;
-        });
-        providerFallbackInFlight = fallbackPromise;
+            providerFallbackInFlight = fallbackPromise;
+            return;
+        }
     };
-    // A 404 not_found is NOT one of pi's auto-retried kinds (it retries 429/5xx
-    // only) and never resolves on its own — the configured model id is wrong or
-    // decommissioned (e.g. the default `anthropic/ultra` pointing at a model the
-    // account can't reach). Left alone the node errors out, the stophook parks it
-    // as a stall, and the daemon force-recycles it onto the SAME bad model in a
-    // loop. Instead: fail the node over to the strong-anthropic ladder model and
-    // re-drive the turn so the work continues. broadcastModelChanged persists the
-    // swap into the durable launch recipe, so a later revive uses the good model
-    // too. Fires on the terminal-error message (stopReason 'error'), the signal a
-    // non-retried request surfaces.
-    //
-    // The SAME treatment covers a provider whose credential could not be resolved
-    // (`Provider is not configured: <id>`). That error is classified `other`, i.e.
-    // fatal, so without this the node parks and every wake re-fails on the same
-    // unusable provider — the only escape being a human running `crtr node config
-    // --model`. Here it substitutes an equivalent model on the OTHER provider (the
-    // same ladder cell `maybeSwitchProviderForRetry` uses), proves that target is
-    // actually authenticated before switching, and re-drives.
+    // A 404 or unconfigured provider is terminal to pi's ordinary retry loop.
+    // Advance once through the request's declared route expansion, then re-drive
+    // the turn on the selected viable route. The raw registry never supplies this
+    // recovery path: it is an explicit routing decision, not a last-resort guess.
     const maybeFallbackOnUnusableModel = (event) => {
         if (event.type !== 'message_end')
             return;
@@ -964,10 +886,8 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         const unconfigured = isProviderUnconfiguredError(msg.errorMessage ?? '');
         if (!unconfigured && !isModelNotFoundError(msg.errorMessage ?? ''))
             return;
-        if (cfg.modelProviderPinned === true)
-            return;
-        // An exact-consult launch must fail closed on a 404 for its locked model,
-        // never auto-fail-over to the strong-anthropic ladder.
+        // Exact-consult launches fail closed. A concrete request's expansion already
+        // contains only the identical model through its eligible credential sources.
         if (cfg.modelExact === true)
             return;
         if (notFoundFallbackInFlight !== null)
@@ -980,30 +900,22 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         const currentSpec = formatModelSpec(session.model, session.thinkingLevel);
         if (currentSpec === null)
             return;
-        notFoundModels.add(currentSpec);
-        // The strong-anthropic ladder cell — "whatever the current strong anthropic
-        // provider model is" (config modelLadders.anthropic.strong), not hardcoded.
-        // An unusable PROVIDER (as opposed to a missing model id) prefers the
-        // same-strength cell on the other provider, so a node keeps the capability
-        // it was launched with instead of being promoted or demoted by the swap.
-        const equivalent = unconfigured ? equivalentOtherProviderModel(currentSpec, failedRetryProviders)?.model : undefined;
-        const target = normalizeModel(equivalent ?? 'anthropic/strong');
-        // Don't loop: the failed model already IS the target, or the target itself
-        // 404'd earlier this session. Leave it to the normal stall/recycle path.
-        if (target === currentSpec || notFoundModels.has(target)) {
-            emitEvent({
-                level: 'debug',
-                event: 'broker.runtime.diagnostic',
-                fields: { message: `not_found fallback skipped: ${currentSpec} has no healthy strong-anthropic target (${target})` },
-            });
+        const current = parseModelSpec(currentSpec);
+        // A 404 rejects the provider/model itself, not only one thinking setting.
+        notFoundModels.add(current.modelSpec);
+        const routeRequest = modelRequestFromConfig(cfg.model, process.env['CRTR_MODEL_INTENT'], false);
+        const routes = routeRequest ? expandModelCandidates(routeRequest, process.env['CRTR_NODE_CWD'] ?? cfg.cwd, process.env['CRTR_PROFILE_ID']) : [];
+        const liveRank = routes.find((candidate) => `${candidate.providerId}/${candidate.modelId}` === current.modelSpec && candidate.thinkingLevel === current.thinkingLevel)?.rank;
+        const nextRoute = liveRank === undefined ? undefined : routes.slice(liveRank + 1).find((candidate) => {
+            if (notFoundModels.has(`${candidate.providerId}/${candidate.modelId}`))
+                return false;
+            return resolveProviderCandidates([{ ...candidate, ...probeRouteAvailability(candidate, registryOf(candidateServices)), automaticFallback: true }]).candidates.length > 0;
+        });
+        if (!nextRoute)
             return;
-        }
+        const target = `${nextRoute.providerId}/${nextRoute.modelId}${nextRoute.thinkingLevel ? `:${nextRoute.thinkingLevel}` : ''}`;
         const fallbackPromise = (async () => {
-            const targetSpec = parseModelSpec(target).modelSpec;
-            const slash = targetSpec.indexOf('/');
-            const model = slash > 0
-                ? registryOf(candidateServices).find(targetSpec.slice(0, slash), targetSpec.slice(slash + 1))
-                : undefined;
+            const model = registryOf(candidateServices).find(nextRoute.providerId, nextRoute.modelId);
             if (model === undefined) {
                 emitEvent({
                     level: 'debug',
@@ -1012,22 +924,10 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                 });
                 return;
             }
-            // Swapping onto a second provider that ALSO has no credential would just
-            // repeat the fault under a different name, so prove this one resolves.
-            if (unconfigured && !registryOf(candidateServices).hasConfiguredAuth(model)) {
-                emitEvent({
-                    level: 'debug',
-                    event: 'broker.runtime.diagnostic',
-                    fields: { message: `unconfigured-provider fallback skipped: ${target} is not authenticated either` },
-                });
-                return;
-            }
-            const requested = parseModelSpec(target);
             await candidateSession.setModel(model);
             if (installedGeneration !== generation || session !== candidateSession)
                 return;
-            if (requested.thinkingLevel !== undefined)
-                candidateSession.setThinkingLevel(requested.thinkingLevel);
+            candidateSession.setThinkingLevel((nextRoute.thinkingLevel ?? 'off'));
             broadcastModelChanged();
             const resolved = formatModelSpec(candidateSession.model, candidateSession.thinkingLevel) ?? target;
             emitEvent({
@@ -1320,25 +1220,11 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // buildPiArgv replays on revive). Best-effort: a degenerate/ephemeral node
     // with no canvas row just skips persistence. CRTR_NODE_ID is set in the
     // broker's own env (merged by piInvocationToSdkConfig at boot).
-    // `pinnedOverride`, when passed, is the durable-pin decision for THIS model
-    // change — decided by the caller from the change's RAW pre-normalize token
-    // (an explicit set_model). Omitted — an algorithmic model change (cycle_model,
-    // cycle_ladder, a provider-fallback/not-found/cooling re-drive) — the existing
-    // pin is carried through UNCHANGED via the `meta.launch` spread, exactly as
-    // before: those changes never re-decide a pin the user didn't ask to change.
-    //
-    // `cfg.modelProviderPinned` is this broker's LIVE authoritative pin state —
-    // every in-process policy read (the retry-fallback gate, the model-not-found
-    // gate, and pinnedToFirst on a reload_auth re-drive) consults it directly, not
-    // the boot-time launch recipe. Mutate it here, synchronously, BEFORE the
-    // best-effort durable write below, so an explicit set_model takes effect for
-    // the very next policy decision even when the canvas row is unreachable
-    // (a degenerate/ephemeral node). Only ever reached from the success path of a
-    // completed `set_model` — never before the engine call it decided from has
-    // actually succeeded.
-    const persistModelChoice = (pinnedOverride) => {
-        if (pinnedOverride !== undefined)
-            cfg.modelProviderPinned = pinnedOverride;
+    // `pinnedOverride`, when passed, is the durable launch-recipe decision for
+    // an explicit model change, derived from its raw pre-normalize token. Omitted
+    // algorithmic changes retain the existing recipe field through the spread;
+    // route expansion, rather than a mutable broker pin, selects retry recovery.
+    const persistModelChoice = (pinnedOverride, explicit = false) => {
         const nodeId = process.env['CRTR_NODE_ID'];
         const spec = formatModelSpec(session.model, session.thinkingLevel);
         if (nodeId === undefined || nodeId === '' || spec === null)
@@ -1347,9 +1233,24 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
             const meta = getNode(nodeId);
             if (meta === null)
                 return;
-            const launch = meta.launch !== undefined
-                ? { ...meta.launch, model: spec, ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}) }
-                : undefined;
+            const launch = meta.launch === undefined
+                ? undefined
+                : explicit
+                    ? (() => {
+                        const { modelIntent: _modelIntent, env, ...rest } = meta.launch;
+                        const { CRTR_MODEL_INTENT: _intentEnv, ...remainingEnv } = env;
+                        return {
+                            ...rest,
+                            model: spec,
+                            ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}),
+                            env: remainingEnv,
+                        };
+                    })()
+                    : { ...meta.launch, model: spec, ...(pinnedOverride !== undefined ? { modelProviderPinned: pinnedOverride } : {}) };
+            if (explicit) {
+                delete process.env['CRTR_MODEL_INTENT'];
+                cfg.model = spec;
+            }
             updateNode(nodeId, { model_override: spec, ...(launch !== undefined ? { launch } : {}) });
         }
         catch {
@@ -1360,9 +1261,9 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
     // set_model/cycle_model the broker announces it itself — otherwise the new
     // model reaches no viewer (the requester gets only a bare ack) and every
     // footer shows the stale model until the next unrelated event.
-    const broadcastModelChanged = (persist = true, pinnedOverride) => {
+    const broadcastModelChanged = (persist = true, pinnedOverride, explicit = false) => {
         if (persist)
-            persistModelChoice(pinnedOverride);
+            persistModelChoice(pinnedOverride, explicit);
         broadcast({ type: 'model_changed', model: isUnknownModel(session.model) ? undefined : session.model, spec: formatModelSpec(session.model, session.thinkingLevel) });
     };
     const buildSnapshot = () => ({
@@ -1506,11 +1407,6 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
         forward: (client, request) => sendFrame(client, request),
         pending: pendingDialogs,
         broadcast: broadcastUi,
-        providerRotationPolicy: () => cfg.modelExact === true
-            ? { allowCrossProviderFallback: false, reason: 'model-exact' }
-            : cfg.modelProviderPinned === true
-                ? { allowCrossProviderFallback: false, reason: 'provider-pinned' }
-                : { allowCrossProviderFallback: true },
         // A deliberate managed-provider cooldown wait is known liveness, not a wedged
         // stream: pause the dead-stream watchdog for its duration. Only pause for a
         // finite future deadline, and resume ONLY while the same turn is still
@@ -2436,7 +2332,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                     // setModelLive), carries the RAW-token pin decision explicitly.
                     // Otherwise frame.model itself IS the raw/explicit token (a
                     // slash-command arg, or a concrete picker pick) and derives it.
-                    broadcastModelChanged(true, frame.pinned !== undefined ? frame.pinned : isProviderPinnedModelToken(frame.model));
+                    broadcastModelChanged(true, frame.pinned !== undefined ? frame.pinned : isProviderPinnedModelToken(frame.model), true);
                 })
                     .catch(engineErrorTo(client));
                 break;
@@ -2862,8 +2758,7 @@ export async function runBroker(nodeId, startupAt = process.hrtime.bigint(), sta
                                     await authSession.setModel(resolved.model);
                                     if (installedGeneration !== authGeneration || session !== authSession)
                                         return;
-                                    if (resolved.thinkingLevel !== undefined)
-                                        authSession.setThinkingLevel(resolved.thinkingLevel);
+                                    authSession.setThinkingLevel((resolved.thinkingLevel ?? 'off'));
                                     broadcastModelChanged();
                                     drivePendingKickoff();
                                 }
@@ -3122,199 +3017,49 @@ export function snapshotMessages(session) {
 // alone on a failed re-drive attempt).
 // ---------------------------------------------------------------------------
 async function resolveLaunchModel(services, cfg) {
-    // Resolve one viable model against the SERVICES registry, which includes
-    // extension-provided providers. `resolveProviderCandidates` is the SOLE
-    // launch selection path — the same viability policy governs turn-time retry
-    // and rotation fallback — so launch selection can never diverge from
-    // rotation. A requested model gets first refusal (its provider pinned when
-    // the caller pinned it), then the authenticated registry order decides.
-    const requested = cfg.model ? parseModelSpec(cfg.model) : undefined;
-    const faultLaunchModel = (message) => {
-        recordFaultForCurrentNode({
-            link: 'crtr→pi',
-            op: 'model resolution at launch',
-            kind: 'model-not-found',
-            retry: { disposition: 'fatal' },
-            message,
+    // Route declarations own preference order; the raw registry remains only a
+    // legacy tail for models a user did not declare.
+    const routeRequest = modelRequestFromConfig(cfg.model, process.env['CRTR_MODEL_INTENT'], cfg.modelExact === true);
+    if (routeRequest !== undefined) {
+        const registry = registryOf(services);
+        const routes = expandModelCandidates(routeRequest, process.env['CRTR_NODE_CWD'] ?? cfg.cwd, process.env['CRTR_PROFILE_ID']);
+        const routeKeys = new Set(routes.map((candidate) => `${candidate.providerId}/${candidate.modelId}`));
+        // A concrete request may advance only through its declared same-model
+        // credential-source routes. The raw registry tail is logical-request legacy.
+        const tail = routeRequest.kind === 'logical'
+            ? registry.getAll()
+                .filter((model) => !routeKeys.has(`${model.provider}/${model.id}`))
+                .map((model, index) => ({ routeId: `registry:${model.provider}/${model.id}`, credentialSource: 'registry', family: model.provider, strength: 'strong', providerId: model.provider, modelId: model.id, rank: routes.length + index }))
+            : [];
+        const hasManagedAuthenticated = [...routes, ...tail].some((candidate) => {
+            const availability = probeRouteAvailability(candidate, registry);
+            return isManagedProvider(candidate.providerId) && availability.registered && availability.authenticated;
         });
-        throw new Error(`[broker] FATAL: ${message}`);
-    };
-    if (requested !== undefined && requested.modelSpec.indexOf('/') <= 0) {
-        faultLaunchModel(`model '${cfg.model}' has no 'provider/id' form and cannot be resolved`);
-    }
-    const requestedProvider = requested?.modelSpec.slice(0, requested.modelSpec.indexOf('/'));
-    const requestedId = requested?.modelSpec.slice(requested.modelSpec.indexOf('/') + 1);
-    const registry = registryOf(services);
-    // The requested model's SAME-STRENGTH cell on the OTHER provider — the one
-    // substitution that preserves the caller's intent, since a persona asks for a
-    // STRENGTH (`explore: openai/light`) and the ladder only picks the id. It is
-    // candidate #2, ahead of raw registry order: without it, an unavailable
-    // `openai/light` fell through to whatever the registry happened to list first
-    // (`anthropic/claude-fable-5` — the most expensive model there is) for a scout
-    // that asked for the cheapest. This is the SAME mapping turn-time rotation
-    // already falls back through (`equivalentOtherProviderModel`), so launch
-    // selection and rotation now degrade identically instead of divergently.
-    const ladderFallback = cfg.modelExact === true || cfg.model === undefined
-        ? null
-        : equivalentOtherProviderModel(cfg.model);
-    const ladderCandidate = (() => {
-        if (ladderFallback === null)
-            return undefined;
-        const spec = parseModelSpec(ladderFallback.model);
-        const slash = spec.modelSpec.indexOf('/');
-        if (slash <= 0)
-            return undefined;
-        const provider = spec.modelSpec.slice(0, slash);
-        const id = spec.modelSpec.slice(slash + 1);
-        if (provider === requestedProvider && id === requestedId)
-            return undefined;
-        return { provider, id, thinkingLevel: spec.thinkingLevel };
-    })();
-    const requestedModel = requestedProvider !== undefined && requestedId !== undefined
-        ? registry.find(requestedProvider, requestedId)
-        : undefined;
-    // Enumerate every REGISTERED model (not just the authenticated set) so the
-    // resolver itself classifies each candidate's registered/authenticated/
-    // cooling state and reports a per-candidate rejection reason. Requested
-    // first, then the rest of the registry in order.
-    // cfg.modelExact locks launch selection to ONLY the requested candidate —
-    // the rest of the registry is never spread in, so no cross-model/cross-
-    // provider substitution is even reachable below.
-    const orderedModels = [
-        ...(requestedProvider !== undefined && requestedId !== undefined
-            ? [{ provider: requestedProvider, id: requestedId, model: requestedModel, thinkingLevel: requested?.thinkingLevel }]
-            : []),
-        ...(ladderCandidate !== undefined
-            ? [{
-                    provider: ladderCandidate.provider,
-                    id: ladderCandidate.id,
-                    model: registry.find(ladderCandidate.provider, ladderCandidate.id),
-                    thinkingLevel: ladderCandidate.thinkingLevel,
-                }]
-            : []),
-        ...(cfg.modelExact === true ? [] : registry.getAll()
-            .filter((candidate) => (candidate.provider !== requestedProvider || candidate.id !== requestedId)
-            && (ladderCandidate === undefined || candidate.provider !== ladderCandidate.provider || candidate.id !== ladderCandidate.id))
-            .map((candidate) => ({
-            provider: candidate.provider,
-            id: candidate.id,
-            model: candidate,
-            thinkingLevel: undefined,
-        }))),
-    ];
-    // Tier 1/2 policy: a non-managed candidate is only automatic-fallback-eligible
-    // when NO managed provider has an authenticated (pool-occupied) credential
-    // ANYWHERE in the ordered set — regardless of that managed candidate's
-    // current cooling state. A cooling-but-authenticated managed pool still
-    // blocks automatic fallback to a non-managed provider (preserves 4be8be6's
-    // intent: don't silently abandon a paid managed subscription for a
-    // pay-per-token key just because it's rate-limited right now). Only when
-    // there is NO managed-authenticated candidate at all does a registered +
-    // authenticated non-managed model become an acceptable automatic launch
-    // fallback (tier 2); only when even that is unavailable does launch fall all
-    // the way through to a model-less boot (tier 3, below).
-    const hasManagedAuthenticated = orderedModels.some((candidate) => {
-        if (!isManagedProvider(candidate.provider))
-            return false;
-        if (candidate.model === undefined)
-            return false; // not registered
-        return readSubscriptionPool(candidate.provider).length > 0;
-    });
-    const selection = resolveProviderCandidates(orderedModels.map((candidate, index) => {
-        // Managed providers authenticate off their subscription pool's accounts, not
-        // static credentials; a fully-cooling pool marks the candidate cooling.
-        const pool = isManagedProvider(candidate.provider) ? readSubscriptionPool(candidate.provider) : [];
-        const explicit = index === 0 && requestedProvider !== undefined && requestedId !== undefined;
-        return {
-            providerId: candidate.provider,
-            modelId: candidate.id,
-            thinkingLevel: candidate.thinkingLevel,
-            registered: candidate.model !== undefined,
-            // Non-managed models are valid automatic fallback when explicitly
-            // requested, when the candidate IS a managed provider itself, or (tier
-            // 2) when no managed-authenticated candidate exists anywhere in this
-            // launch's candidate set.
-            automaticFallback: explicit || isManagedProvider(candidate.provider) || !hasManagedAuthenticated,
-            authenticated: candidate.model !== undefined && (isManagedProvider(candidate.provider)
-                ? pool.length > 0
-                : registry.hasConfiguredAuth(candidate.model)),
-            coolingUntil: pool.length > 0 && pool.every((entry) => (entry.rateLimitedUntil || 0) > Date.now())
-                ? Math.min(...pool.map((entry) => entry.rateLimitedUntil || 0))
-                : undefined,
-        };
-    }), Date.now(), 
-    // An explicit provider pin forbids cross-provider fallback for an
-    // unregistered/unauthenticated request; only a transient managed cooldown
-    // on the pinned provider still boots a viable alternative.
-    { pinnedToFirst: cfg.modelProviderPinned === true && requested !== undefined });
-    const selected = selection.candidates[0];
-    if (selected === undefined) {
-        const rejectionText = selection.rejected.length > 0
-            ? selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason === 'non-managed-fallback' ? 'non-managed provider is not an automatic fallback' : reason}`).join('; ')
-            : 'no candidates were supplied';
-        // An exact-consult launch must FAIL rather than fall through to a
-        // model-less session — an unavailable captured model faults the launch
-        // (crash), never a silent degrade/substitution.
+        const selection = resolveProviderCandidates([...routes, ...tail].map((candidate) => ({
+            ...candidate,
+            ...probeRouteAvailability(candidate, registry),
+            automaticFallback: candidate.routeId.startsWith('registry:')
+                ? (isManagedProvider(candidate.providerId) || !hasManagedAuthenticated)
+                : true,
+        })), Date.now(), { pinnedToFirst: routeRequest.kind === 'exact' });
+        const selected = selection.candidates[0];
+        if (selected !== undefined) {
+            const model = registry.find(selected.providerId, selected.modelId);
+            if (model !== undefined) {
+                if ((selected.rank ?? 0) > 0)
+                    emitEvent({ level: 'warn', event: 'broker.model.launch_fallback', fields: { requested: cfg.model, selected: `${selected.providerId}/${selected.modelId}`, route_id: selected.routeId, credential_source: selected.credentialSource, rank: selected.rank } });
+                return { model, thinkingLevel: selected.thinkingLevel };
+            }
+        }
         if (cfg.modelExact === true) {
-            return faultLaunchModel(`exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejectionText})`);
+            const rejection = selection.rejected.map(({ candidate, reason }) => `'${candidate.providerId}/${candidate.modelId}' ${reason}`).join('; ');
+            recordFaultForCurrentNode({ link: 'crtr→pi', op: 'model resolution at launch', kind: 'model-not-found', retry: { disposition: 'fatal' }, message: `exact-consult model '${cfg.model}' is unavailable — refusing to substitute (${rejection})` });
+            throw new Error(`[broker] FATAL: exact-consult model '${cfg.model}' is unavailable`);
         }
-        // Tier 3: no viable candidate at all (genuine zero-auth, OR every managed
-        // pool is cooling AND no non-managed provider is authenticated). This is
-        // NOT a fault — the caller constructs a model-less session so the
-        // socket/listener still comes up and the user can /login; reload_auth
-        // re-invokes this same helper to re-drive once auth changes.
-        emitEvent({
-            level: 'warn',
-            event: 'broker.model.none_viable',
-            fields: {
-                rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({
-                    provider: candidate.providerId,
-                    model: candidate.modelId,
-                    reason,
-                })),
-                rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16),
-            },
-        });
+        emitEvent({ level: 'warn', event: 'broker.model.none_viable', fields: { rejected_candidates: selection.rejected.slice(0, 16).map(({ candidate, reason }) => ({ provider: candidate.providerId, model: candidate.modelId, reason, route_id: candidate.routeId, credential_source: candidate.credentialSource })), rejected_candidates_omitted: Math.max(0, selection.rejected.length - 16) } });
         return undefined;
     }
-    const model = registry.find(selected.providerId, selected.modelId);
-    if (model === undefined) {
-        return faultLaunchModel(`selected model '${selected.providerId}/${selected.modelId}' disappeared during launch`);
-    }
-    const thinkingLevel = selected.thinkingLevel;
-    // A launch that does not get the model it asked for is a SUBSTITUTION, and it
-    // used to be entirely silent: the session simply came up on another model and
-    // the only trace was the pi `model_change` entry in the .jsonl. One line, only
-    // on the rare path, carrying the per-candidate rejection reasons that decided
-    // it — so "why is this node on the wrong model" is answerable from the log.
-    if (requestedProvider !== undefined &&
-        requestedId !== undefined &&
-        (selected.providerId !== requestedProvider || selected.modelId !== requestedId)) {
-        emitEvent({
-            level: 'warn',
-            event: 'broker.model.launch_fallback',
-            fields: {
-                requested: `${requestedProvider}/${requestedId}`,
-                selected: `${selected.providerId}/${selected.modelId}`,
-                ladder_equivalent: ladderFallback === null ? null : ladderFallback.model,
-                rejected_candidates: selection.rejected.slice(0, 8).map(({ candidate, reason }) => ({
-                    provider: candidate.providerId,
-                    model: candidate.modelId,
-                    reason,
-                })),
-            },
-        });
-    }
-    if (requestedProvider !== undefined &&
-        requestedId !== undefined &&
-        isManagedProvider(requestedProvider) &&
-        requestedModel !== undefined &&
-        (selected.providerId !== requestedProvider || selected.modelId !== requestedId)) {
-        // This launch fallback is temporary: retain the requested managed pin for
-        // provider-rotation's before_agent_start restoration once it is ready.
-        rememberPreferredModel({ providerId: requestedProvider, modelId: requestedId });
-    }
-    return { model, thinkingLevel };
+    return undefined;
 }
 /**
  * Wrap a live ModelRuntime so a model-less `createAgentSessionFromServices`
@@ -3631,7 +3376,6 @@ export function makeBrokerUiContext(deps) {
     };
     const noop = () => { };
     const ctx = {
-        [MANAGED_PROVIDER_ROTATION_POLICY_UI]: deps.providerRotationPolicy ?? (() => ({ allowCrossProviderFallback: true })),
         // The broker-owned known-stream-wait control (see BrokerDialogDeps): a
         // deliberate provider cooldown is KNOWN liveness, so the provider extension
         // reaches this through the stable symbol to pause the dead-stream watchdog for