@north-light/crouter 0.3.161 → 0.3.163

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/provider-rotation.test.ts

@@ -3,7 +3,8 @@ import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { LockedJsonFile } from "../../../../core/locked-file.ts";
-import type { FallbackTarget, SubscriptionCredential } from "../../lib/subscription-state.ts";
+import { expandModelCandidates } from "../../../../core/model-routes.ts";
+import type { SubscriptionCredential } from "../../lib/subscription-state.ts";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -12,15 +13,18 @@ import { tmpdir } from "node:os";
 const lockedFileUrl = new URL("../../../../core/locked-file.ts", import.meta.url).href;
 
 let home: string;
+let nodeCwd: string;
 let helpers: typeof import("../../lib/subscription-state.ts");
 let providerManagement: typeof import("../../../../core/provider-management.ts");
 let rotationModule: typeof import("../provider-rotation.ts");
 let providerRotationExtension: typeof import("../provider-rotation.ts").default;
 const previousHome = process.env.HOME;
 const previousAgentDir = process.env.PI_CODING_AGENT_DIR;
+const previousModelIntent = process.env.CRTR_MODEL_INTENT;
+const previousNodeCwd = process.env.CRTR_NODE_CWD;
 
 function writeLadderConfig() {
-  const configPath = join(home, ".crouter", "config.json");
+  const configPath = join(nodeCwd, ".crouter", "config.json");
   mkdirSync(dirname(configPath), { recursive: true });
   writeFileSync(
     configPath,
@@ -65,7 +69,7 @@ async function resetRotationState() {
   rmSync(join(home, ".pi", "agent", "auth.json"), { force: true });
   await helpers.writeSubscriptionPool("anthropic", []);
   await helpers.writeSubscriptionPool("openai-codex", []);
-  helpers.clearPreferredModel();
+  rmSync(join(home, ".pi", "agent", "provider-rotation.json"), { force: true });
 }
 
 function observeLines(stream: NodeJS.ReadableStream, onLine: (line: string) => void): void {
@@ -101,8 +105,10 @@ function within<T>(promise: Promise<T>, ms: number, message: string): Promise<T>
 
 before(async () => {
   home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
+  nodeCwd = mkdtempSync(join(tmpdir(), "pi-provider-rotation-cwd-"));
   process.env.HOME = home;
   process.env.PI_CODING_AGENT_DIR = join(home, ".pi", "agent");
+  process.env.CRTR_NODE_CWD = nodeCwd;
   helpers = await import("../../lib/subscription-state.ts");
   providerManagement = await import("../../../../core/provider-management.ts");
   rotationModule = await import("../provider-rotation.ts");
@@ -114,7 +120,12 @@ after(() => {
   else process.env.HOME = previousHome;
   if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
   else process.env.PI_CODING_AGENT_DIR = previousAgentDir;
+  if (previousModelIntent === undefined) delete process.env.CRTR_MODEL_INTENT;
+  else process.env.CRTR_MODEL_INTENT = previousModelIntent;
+  if (previousNodeCwd === undefined) delete process.env.CRTR_NODE_CWD;
+  else process.env.CRTR_NODE_CWD = previousNodeCwd;
   rmSync(home, { recursive: true, force: true });
+  rmSync(nodeCwd, { recursive: true, force: true });
 });
 
 test("normalizes provider subscription pool files", async () => {
@@ -491,17 +502,21 @@ test("loginWithManualInputCleanup's readCode rejects (rather than resolving to \
   );
 });
 
-test("resolves Anthropic to strength-matched OpenAI Codex fallback", async () => {
+test("the synthesized ladder registry preserves family preference before configured strength fallback", async () => {
   await resetRotationState();
   writeLadderConfig();
+  helpers.writeRotationConfig({ defaultFallbackStrength: "medium" });
 
-  assert.deepEqual(helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high"), {
-    providerId: "openai-codex",
-    modelId: "gpt-5.6-sol",
-    label: "openai-codex/gpt-5.6-sol:high",
+  const candidates = expandModelCandidates({
+    kind: "logical",
+    family: "anthropic",
     strength: "strong",
-    thinkingLevel: "high",
-  });
+    spec: "anthropic/claude-opus-4-8:high",
+  }, home, null);
+
+  assert.deepEqual(candidates.map((candidate) => `${candidate.family}/${candidate.strength}`), [
+    "anthropic/strong", "openai/strong", "anthropic/medium", "openai/medium",
+  ]);
 });
 
 test("shared launch/general candidate policy preserves a viable request, skips a cooling request, and reports total exhaustion", async () => {
@@ -525,45 +540,6 @@ test("shared launch/general candidate policy preserves a viable request, skips a
   );
 });
 
-test("resolves OpenAI Codex to strength-matched Anthropic fallback", async () => {
-  writeLadderConfig();
-
-  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "openai-codex/gpt-5.6-terra:medium"), {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-    label: "anthropic/claude-sonnet-4-6:high",
-    strength: "medium",
-    thinkingLevel: "high",
-  });
-});
-
-// Ultra and strong share the bare model id gpt-5.6-sol; the live thinking level selects
-// the matching ladder rung.
-test("disambiguates colliding ladder rungs by the live thinking level", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  const config = helpers.readRotationConfig();
-
-  // max -> ultra rung -> Anthropic ultra (claude-fable-5)
-  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "max"), {
-    providerId: "anthropic",
-    modelId: "claude-fable-5",
-    label: "anthropic/claude-fable-5:high",
-    strength: "ultra",
-    thinkingLevel: "high",
-  });
-
-  // high -> strong rung -> Anthropic strong (claude-opus-4-8)
-  const highTarget = helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "high");
-  assert.ok(highTarget);
-  assert.equal(highTarget.modelId, "claude-opus-4-8");
-
-  // No thinking level falls back to the default-strength tie-break (strong -> opus).
-  const defaultTarget = helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config);
-  assert.ok(defaultTarget);
-  assert.equal(defaultTarget.modelId, "claude-opus-4-8");
-});
-
 test("parses Retry-After seconds and HTTP dates", async () => {
   const now = Date.UTC(2026, 5, 16, 18, 30, 0);
   assert.equal(helpers.parseRetryAfterHeader("1.5", now), 1500);
@@ -575,63 +551,6 @@ test("parses Retry-After seconds and HTTP dates", async () => {
   assert.equal(helpers.parseRetryAfterHeader("not-a-delay", now), undefined);
 });
 
-test("restores preferred model when its provider pool frees up", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.6-sol" } });
-
-  const setModelCalls: any[] = [];
-  const ctx = {
-    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-    modelRegistry: {
-      find(provider: string, id: string) {
-        return { provider, id, api: provider === "openai-codex" ? "openai-codex-responses" : "anthropic-messages" };
-      },
-    },
-  } as any;
-  const pi = {
-    async setModel(model: any) {
-      setModelCalls.push(model);
-      ctx.model = model;
-      return true;
-    },
-  } as any;
-
-  const restored = await helpers.restorePreferredModelIfPossible(pi, ctx);
-
-  assert.equal(restored, true);
-  assert.deepEqual(setModelCalls[0], {
-    provider: "openai-codex",
-    id: "gpt-5.6-sol",
-    api: "openai-codex-responses",
-  });
-  assert.equal(helpers.readRotationConfig().preferredModel, undefined);
-});
-
-test("pinned and exact launches retain their captured model during startup preferred-model restoration", async () => {
-  for (const reason of ["provider-pinned", "model-exact"] as const) {
-    await resetRotationState();
-    await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-    helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.6-sol" } });
-
-    const { ctx, events, pi, setModelCalls } = makeRotationCtx();
-    ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-    ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
-      allowCrossProviderFallback: false,
-      reason,
-    });
-
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    await events.before_agent_start?.({}, ctx);
-
-    assert.deepEqual(setModelCalls, [], `${reason} launches must not restore the shared preferred model`);
-    assert.deepEqual(ctx.model, { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" });
-    assert.deepEqual(helpers.readRotationConfig().preferredModel, { providerId: "openai-codex", modelId: "gpt-5.6-sol" });
-  }
-});
-
 test("keeps newest Retry-After cooldown across overlapping attempts", async () => {
   await resetRotationState();
   await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
@@ -1029,101 +948,13 @@ test("treats numeric subscription refs as 1-based indexes", async () => {
   );
 });
 
-test("switches exhausted Anthropic sessions to OpenAI Codex fallback", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-
-  const ctx = {
-    model: { provider: "anthropic", id: "claude-sonnet-4-6", api: "anthropic-messages" },
-    modelRegistry: {
-      find(provider: string, id: string) {
-        return provider === "openai-codex" && id === "gpt-5.6-terra" ? { provider, id, api: "openai-codex-responses" } : undefined;
-      },
-    },
-  } as any;
-  let switchedTo: any;
-  let thinkingLevel: string | undefined;
-  const piApi = {
-    async setModel(model: any) {
-      switchedTo = model;
-      ctx.model = model;
-      return true;
-    },
-    setThinkingLevel(level: string) {
-      thinkingLevel = level;
-    },
-  } as any;
-
-  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
-
-  assert.deepEqual(target, {
-    providerId: "openai-codex",
-    modelId: "gpt-5.6-terra",
-    label: "openai-codex/gpt-5.6-terra:medium",
-    strength: "medium",
-    thinkingLevel: "medium",
-  });
-  assert.deepEqual(switchedTo, {
-    provider: "openai-codex",
-    id: "gpt-5.6-terra",
-    api: "openai-codex-responses",
-  });
-  assert.equal(thinkingLevel, "medium");
-  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
-    providerId: "anthropic",
-    modelId: "claude-sonnet-4-6",
-  });
-});
-
-test("switches exhausted OpenAI Codex sessions to Anthropic fallback", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-
+function makeRotationCtx(modelIntent?: string) {
+  const concreteRequest = arguments.length > 0 && modelIntent === undefined;
+  if (modelIntent === undefined) delete process.env.CRTR_MODEL_INTENT;
+  else process.env.CRTR_MODEL_INTENT = modelIntent;
   const ctx = {
     model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-    modelRegistry: {
-      find(provider: string, id: string) {
-        return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
-      },
-    },
-  } as any;
-  let switchedTo: any;
-  let thinkingLevel: string | undefined;
-  const piApi = {
-    async setModel(model: any) {
-      switchedTo = model;
-      ctx.model = model;
-      return true;
-    },
-    setThinkingLevel(level: string) {
-      thinkingLevel = level;
-    },
-  } as any;
-
-  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
-
-  assert.deepEqual(target, {
-    providerId: "anthropic",
-    modelId: "claude-opus-4-8",
-    label: "anthropic/claude-opus-4-8:high",
-    strength: "strong",
     thinkingLevel: "high",
-  });
-  assert.deepEqual(switchedTo, {
-    provider: "anthropic",
-    id: "claude-opus-4-8",
-    api: "anthropic-messages",
-  });
-  assert.equal(thinkingLevel, "high");
-  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
-    providerId: "openai-codex",
-    modelId: "gpt-5.6-sol",
-  });
-});
-
-function makeRotationCtx() {
-  const ctx = {
-    model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
     ui: { setStatus() {} },
     modelRegistry: {
       find(provider: string, id: string) {
@@ -1134,12 +965,22 @@ function makeRotationCtx() {
     },
   } as any;
   const setModelCalls: any[] = [];
+  const thinkingLevelCalls: string[] = [];
   const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
   const events: Record<string, (...args: any[]) => unknown> = {};
   const commands: Record<string, { handler: (args: string, ctx: any) => unknown }> = {};
   const pi = {
     registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
-      providers[name] = provider;
+      providers[name] = {
+        ...provider,
+        streamSimple(...args: any[]) {
+          if (!concreteRequest) {
+            const model = args[0] as { provider: string };
+            process.env.CRTR_MODEL_INTENT = model.provider === "anthropic" ? "anthropic/strong" : "openai/strong";
+          }
+          return provider.streamSimple(...args);
+        },
+      };
     },
     registerCommand(name: string, command: { handler: (args: string, ctx: any) => unknown }) {
       commands[name] = command;
@@ -1152,11 +993,42 @@ function makeRotationCtx() {
       ctx.model = model;
       return true;
     },
-    setThinkingLevel() {},
+    setThinkingLevel(level: string) {
+      thinkingLevelCalls.push(level);
+      ctx.thinkingLevel = level;
+    },
   } as any;
-  return { ctx, setModelCalls, providers, events, commands, pi };
+  return { ctx, setModelCalls, thinkingLevelCalls, providers, events, commands, pi };
 }
 
+// A live route carries the session's exact thinking level through every provider
+// request, including the requests that continue a turn after tool results.
+test("preserves a manually selected thinking level across provider requests", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, thinkingLevelCalls, providers, events, pi } = makeRotationCtx("openai/strong");
+  ctx.thinkingLevel = "max";
+  rotationModule.__setStreamForProviderForTest(() => (async function* () {
+    yield { type: "text_delta", text: "continued after tool result" };
+  })() as any);
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+    for await (const _event of stream) {
+      // Drain the managed-provider request to completion.
+    }
+
+    assert.deepEqual(thinkingLevelCalls, ["max"]);
+    assert.equal(ctx.thinkingLevel, "max");
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
 // Codex exhaustion switches the model and serves the same turn on the Anthropic fallback.
 test("falls back transparently and serves the turn on Anthropic when Codex is exhausted", async () => {
   await resetRotationState();
@@ -1195,12 +1067,9 @@ test("falls back transparently and serves the turn on Anthropic when Codex is ex
   }
 });
 
-// Live incident: a viewer explicitly selected qualified Sol, which set the
-// broker's provider pin, but the extension ignored that broker state. The first
-// model call could request a tool; on the post-tool continuation a shared Codex
-// cooldown then rotated the supposedly-pinned session through every Anthropic
-// credential. The live broker policy must be consulted on every provider call.
-test("an explicit live Sol pin forbids Anthropic fallback on a post-tool provider continuation", async () => {
+// A concrete request only expands to routes carrying its exact model id. A
+// cooling Codex Sol route must not substitute Anthropic's different model.
+test("a cooling concrete model never substitutes a different-provider model", async () => {
   await resetRotationState();
   writeLadderConfig();
   await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
@@ -1208,11 +1077,7 @@ test("an explicit live Sol pin forbids Anthropic fallback on a post-tool provide
   const expectedDeadline = helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil;
   await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
 
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
-    allowCrossProviderFallback: false,
-    reason: "provider-pinned",
-  });
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
   let streamCalls = 0;
   rotationModule.__setStreamForProviderForTest((_model) => {
     streamCalls += 1;
@@ -1231,10 +1096,10 @@ test("an explicit live Sol pin forbids Anthropic fallback on a post-tool provide
     const emitted = [] as any[];
     for await (const event of stream) emitted.push(event);
 
-    assert.deepEqual(setModelCalls, [], "the pinned Sol session never switches to Anthropic");
+    assert.deepEqual(setModelCalls, [], "the concrete Sol request never switches to Anthropic");
     assert.equal(streamCalls, 0);
     assert.equal(emitted.length, 1);
-    assert.match(emitted[0].error.errorMessage, /explicitly pinned/i);
+    assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/i);
     assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
   } finally {
     rotationModule.__setStreamForProviderForTest(undefined);
@@ -1346,8 +1211,6 @@ test("surfaces the transient error and rotates to the fallback once the in-place
     // The turn was served on the fallback, never failed with a terminal error.
     assert.ok(emitted.some((e) => e.type === "text_delta"));
     assert.ok(!emitted.some((e) => e.type === "error"));
-    // The user was told about the transient failure AND that it rotated.
-    assert.ok(notifications.some((n) => /transient error after 3 attempts/.test(n.message) && /rotating/i.test(n.message)));
     // The struggling anthropic credential was cooled down so rotation moved on.
     assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now());
   } finally {
@@ -1758,14 +1621,14 @@ test("emits an actionable 'not authenticated' error without switching models whe
   assert.deepEqual(setModelCalls, []);
   assert.equal(emitted.length, 1);
   assert.equal(emitted[0].type, "error");
-  assert.match(emitted[0].error.errorMessage, /OpenAI Codex not authenticated.*crtr sys setup/);
+  assert.match(emitted[0].error.errorMessage, /All provider routes exhausted \(tried openai\)/);
 });
 
 // The builtin ladder is available even with no ~/.crouter/config.json, so a config-less
 // user can still resolve cross-provider fallbacks.
 test("degrades gracefully via the builtin ladder when a config-less user has no cross-provider credentials", async () => {
   await resetRotationState();
-  rmSync(join(home, ".crouter", "config.json"), { force: true });
+  rmSync(join(nodeCwd, ".crouter", "config.json"), { force: true });
 
   const ctx = {
     model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
@@ -1797,6 +1660,7 @@ test("degrades gracefully via the builtin ladder when a config-less user has no
     setThinkingLevel() {},
   } as any;
 
+  process.env.CRTR_MODEL_INTENT = "anthropic/strong";
   await providerRotationExtension(pi);
   await events.session_start?.({}, ctx);
   // Anthropic's pool is empty, so the credential loop never runs. The builtin ladder resolves
@@ -1809,26 +1673,10 @@ test("degrades gracefully via the builtin ladder when a config-less user has no
   assert.deepEqual(setModelCalls, []);
   assert.equal(emitted.length, 1);
   assert.equal(emitted[0].type, "error");
-  assert.match(emitted[0].error.errorMessage, /Claude not authenticated.*crtr sys setup/);
+  assert.match(emitted[0].error.errorMessage, /All provider routes exhausted \(tried live:anthropic\/claude-opus-4-8\)/);
   assert.ok(!emitted[0].error.errorMessage.includes("configure a openai ladder"));
 });
 
-// readModelLadders() reads the builtin anthropic/openai ladder when config.json is absent.
-test("resolves the builtin anthropic ladder (medium = sonnet-5) with no ~/.crouter/config.json present", async () => {
-  await resetRotationState();
-  rmSync(join(home, ".crouter", "config.json"), { force: true });
-
-  const target = helpers.resolveFallbackTarget("anthropic", "anthropic/claude-sonnet-5:xhigh");
-
-  assert.deepEqual(target, {
-    providerId: "openai-codex",
-    modelId: "gpt-5.6-terra",
-    label: "openai-codex/gpt-5.6-terra:medium",
-    strength: "medium",
-    thinkingLevel: "medium",
-  });
-});
-
 // A cooling provider must settle the turn with a typed retry deadline. Holding
 // the stream open here rendered the node as generic `Working...` for five silent
 // minutes and prevented the broker's existing scheduled retry path from owning
@@ -1952,9 +1800,7 @@ test("emits a typed rate-limit cooling error for a long provider deadline", asyn
     assert.equal(emitted[0].type, "error");
     // Rate-limit-classifiable so classify('pi→provider', msg) → rate-limit/auto (not fatal other).
     assert.match(emitted[0].error.errorMessage, /rate limit/i);
-    // Still carries the actionable fallback hint.
-    assert.match(emitted[0].error.errorMessage, /authenticate a fallback provider/);
-    // And the typed cooling diagnostic carrying the exact pool deadline for the stophook.
+    // The typed cooling diagnostic carries the exact pool deadline for the stophook.
     assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
     assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
   } finally {
@@ -1988,10 +1834,6 @@ test("an excluded invalid_grant credential does not mask a cooling credential",
   assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
 });
 
-// Fix 1 (switchToFallbackIfPossible): pi's `setModel` returns false when the target lacks
-// configured auth and leaves the model unchanged. A concurrent transition can still land on
-// the target while that call is in flight; accept only that observed live result and reject
-// every other false return.
 test("a same-turn 429 settles immediately instead of starting cooldown continuations", async () => {
   await resetRotationState();
   writeLadderConfig();
@@ -2059,54 +1901,6 @@ test("does not requeue a zero Retry-After credential without a later success", a
   }
 });
 
-test("switchToFallbackIfPossible accepts a false setModel only when the live model already equals the target", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-
-  const target = helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high");
-  assert.ok(target && target.providerId === "openai-codex" && target.modelId === "gpt-5.6-sol", "anthropic opus falls back to codex sol");
-
-  // Benign: setModel returns false without changing the model, while an independent
-  // concurrent transition lands on the exact target before the required live re-read.
-  {
-    let modelReads = 0;
-    const ctx = {
-      get model() {
-        modelReads++;
-        return modelReads === 1
-          ? { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" }
-          : { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
-      },
-      modelRegistry: { find: (provider: string, id: string) => ({ provider, id, api: "x" }) },
-    } as any;
-    const pi = {
-      async setModel(_m: any) { return false; },
-      setThinkingLevel() {},
-      getThinkingLevel() { return undefined; },
-    } as any;
-    const result = await helpers.switchToFallbackIfPossible(pi, ctx);
-    assert.ok(result, "a false setModel with the target already current must be accepted");
-    assert.equal(result!.providerId, "openai-codex");
-    assert.equal(result!.modelId, "gpt-5.6-sol");
-  }
-
-  // Real failure: setModel returns false and the live model stays DIFFERENT from the target
-  // → the switch is a genuine failure and must be rejected (undefined).
-  {
-    const ctx = {
-      model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      modelRegistry: { find: (provider: string, id: string) => ({ provider, id, api: "x" }) },
-    } as any;
-    const pi = {
-      async setModel(_m: any) { return false; }, // leaves ctx.model on anthropic
-      setThinkingLevel() {},
-      getThinkingLevel() { return undefined; },
-    } as any;
-    const result = await helpers.switchToFallbackIfPossible(pi, ctx);
-    assert.equal(result, undefined, "a false setModel that did not land on the target is a real failure");
-  }
-});
-
 // Fresh-availability re-entry (Fix 3a): a credential that becomes ready AFTER the initial
 // `available` snapshot (a concurrent turn's cooldown expiring, or a causally valid success)
 // must be consumed by re-entering the SAME provider, not lost to a stale snapshot that would
@@ -2221,103 +2015,6 @@ test("both pools cooling: emits a rate-limit-classifiable terminal carrying the
   }
 });
 
-// Live-incident regression (Hearth: a home's config.json had `gpt-5.6-*` ladder rungs baked
-// in while the installed guest's model registry only had `gpt-5.5`): when the ONLY viable
-// fallback target is authenticated (its pool has a credential) but its resolved model isn't
-// in this build's registry, the terminal error must name that specific reason -- not the old
-// generic "authenticate a fallback provider" text, which is actively wrong when the real
-// blocker is a stale/out-of-sync ladder, not a missing login.
-test("surfaces a specific 'not in model registry' reason instead of misleadingly telling the user to authenticate", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
-  // OpenAI Codex IS authenticated -- the fallback rejection must NOT be "no credentials".
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  // Registry recognizes anthropic's own model but NOT the configured openai-codex fallback
-  // rung (`gpt-5.6-sol`, from writeLadderConfig) -- simulating an installed guest whose
-  // catalog hasn't caught up with the configured ladder.
-  ctx.modelRegistry = {
-    find(provider: string, id: string) {
-      return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
-    },
-  };
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(sleepCalls, []);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.match(emitted[0].error.errorMessage, /openai-codex\/gpt-5\.6-sol:high is not in this build's model registry/);
-    assert.match(emitted[0].error.errorMessage, /modelLadders config is out of sync with the installed model catalog/);
-    assert.doesNotMatch(emitted[0].error.errorMessage, /authenticate a fallback provider/);
-    // The repair command must be EXECUTABLE as printed: `--value`, the CONFIG ladder
-    // provider key (`openai`, not the runtime `openai-codex`), and the target's strength.
-    assert.match(
-      emitted[0].error.errorMessage,
-      /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/,
-    );
-  } finally {
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// Every fallback-rejection discriminant maps to actionable advice. Only `no_credentials`
-// advises authentication because the other rejection states require a different remedy.
-test("fallback rejection hints: only no_credentials advises authentication; every other discriminant gets accurate advice", async () => {
-  const codex = {
-    providerId: "openai-codex",
-    modelId: "gpt-5.6-sol",
-    label: "openai-codex/gpt-5.6-sol:high",
-    strength: "strong",
-  } as FallbackTarget;
-
-  const noCreds = rotationModule.__fallbackRejectionHintForTest("no_credentials", codex);
-  assert.match(noCreds, /authenticate a fallback provider/);
-  assert.match(noCreds, /OpenAI Codex/);
-  assert.match(noCreds, /\/provider-sub openai-codex add/);
-
-  const unregistered = rotationModule.__fallbackRejectionHintForTest("model_unregistered", codex);
-  assert.doesNotMatch(unregistered, /authenticate a fallback provider/);
-  assert.match(unregistered, /not in this build's model registry/);
-  // Executable repair command: --value, CONFIG ladder key (openai), target strength.
-  assert.match(unregistered, /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/);
-
-  const alreadyTried = rotationModule.__fallbackRejectionHintForTest("already_attempted", codex);
-  assert.doesNotMatch(alreadyTried, /authenticate a fallback provider/);
-  assert.match(alreadyTried, /already tried this turn/);
-  assert.match(alreadyTried, /try again later/);
-
-  const cooling = rotationModule.__fallbackRejectionHintForTest("cooling", codex);
-  assert.doesNotMatch(cooling, /authenticate a fallback provider/);
-  assert.match(cooling, /also cooling down/);
-
-  const pinned = rotationModule.__fallbackRejectionHintForTest("provider_pinned");
-  assert.doesNotMatch(pinned, /authenticate a fallback provider/);
-  assert.match(pinned, /explicitly pinned/);
-
-  const noLadder = rotationModule.__fallbackRejectionHintForTest("no_ladder_entry");
-  assert.doesNotMatch(noLadder, /authenticate a fallback provider/);
-  assert.match(noLadder, /no cross-provider fallback is configured/);
-  assert.match(noLadder, /modelLadders/);
-});
-
 // A 429 observed during this provider call must author the deadline from the
 // freshly-mutated pool, without retrying or sleeping inside the active turn.
 test("schedules a sole credential cooldown observed in this turn from fresh pool state", async () => {
@@ -2417,18 +2114,14 @@ test("treats a headerless Codex usage-limit message as turn-local and falls back
   }
 });
 
-test("a pinned provider's headerless usage-limit stays turn-local and carries its retry deadline", async () => {
+test("a concrete model's headerless usage-limit stays turn-local and carries its retry deadline", async () => {
   await resetRotationState();
   writeLadderConfig();
   await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
   await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
 
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
   ctx.model = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
-  ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
-    allowCrossProviderFallback: false,
-    reason: "provider-pinned",
-  });
   rotationModule.__setStreamForProviderForTest(() => {
     return (async function* () {
       yield {
@@ -2564,9 +2257,8 @@ test("a provider with no account: rotation never switches onto it", async () =>
   assert.deepEqual(setModelCalls, [], "never switches the session model onto an unconfigured provider");
   assert.equal(emitted.length, 1);
   assert.equal(emitted[0].type, "error");
-  // The blocker is a missing login, and the error says exactly that instead of wedging a node.
-  assert.match(emitted[0].error.errorMessage, /authenticate a fallback provider/);
-  assert.match(emitted[0].error.errorMessage, /\/provider-sub openai-codex add/);
+  // An unauthenticated fallback never receives a model switch, while the live route's cooldown remains actionable.
+  assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/);
 });