@ran-sh/dsh-crew 1.3.2 → 1.5.0

package/src/jobs.mjs

@@ -8,7 +8,7 @@
 // never passes an explicit dshBin that would bypass it. The worker rides the
 // `sdk-minimal` profile with the Crew overlay applied as a --patch.
 
-import { createStandaloneHarness } from './standalone-sdk.mjs';
+import { createStandaloneHarness } from './standalone-sdk.mjs';
 import { readFileSync, mkdirSync, existsSync } from 'node:fs';
 import { createShardWriter } from './status-shard.mjs';
 import { fileURLToPath } from 'node:url';
@@ -19,6 +19,9 @@ import { captureWorkspaceBaseline, captureWorkspaceDiff, NOT_A_GIT_REPOSITORY }
 import { buildOutcome, JOB_PHASES } from './workflow.mjs';
 import { raceWaiters } from './removable-waiter.mjs';
 import { buildDirectSelectionTrace } from './model-routing.mjs';
+import { normalizeModelSchedule, scheduleAdmission } from './model-schedule.mjs';
+import { appendSessionOrigin } from './session-origins.mjs';
+import { readGlobalConfig } from './install/install.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const CONFIG_DIR = join(homedir(), '.config', 'dsh-crew');
@@ -26,6 +29,13 @@ const CREW_DSH_HOME = join(homedir(), '.config', 'dsh-crew', 'harness');
 const STATUS_FILE = join(CONFIG_DIR, 'status.json');
 const CORDIS = join(ROOT, 'worker.cordis.yml');
 
+// Read the operator's schedule once per dispatch. An unreadable config must not
+// block a job: a missing or damaged file means no restriction, matching how the
+// router treats an absent schedule.
+function readModelSchedule() {
+  try { return normalizeModelSchedule(readGlobalConfig().model_schedule); } catch { return normalizeModelSchedule(undefined); }
+}
+
 export const TIERS = {
   flash: { model: 'deepseek-v4-flash', label: 'V4 Flash' },
   pro: { model: 'deepseek-v4-pro', label: 'V4 Pro' },
@@ -109,6 +119,14 @@ export function startJob({
 }) {
   const tierInfo = TIERS[tier];
   if (!tierInfo) throw new Error(`unknown tier "${tier}" (expected: ${Object.keys(TIERS).join(', ')})`);
+  // Standalone dispatch names its provider/model directly rather than walking a
+  // catalog, but a peak `block` still applies: without this the schedule would be
+  // silently ignored on every standalone job.
+  const standaloneRef = { provider: 'deepseek-official', model: tierInfo.model };
+  const standaloneAt = new Date();
+  if (scheduleAdmission(readModelSchedule(), standaloneRef, standaloneAt)?.mode === 'block') {
+    throw Object.assign(new Error('MODEL_BLOCKED_PEAK'), { policyCode: 'MODEL_BLOCKED_PEAK' });
+  }
   if (!ROLES[role]) throw new Error(`unknown role "${role}" (expected: ${Object.keys(ROLES).join(', ')})`);
   if (!['off', 'high', 'max'].includes(effort)) throw new Error(`unknown effort "${effort}" (expected: off, high, max)`);
   if (!existsSync(CORDIS)) throw new Error(`worker overlay not found at ${CORDIS}`);
@@ -123,7 +141,7 @@ export function startJob({
     throw new Error(`DEEPSEEK_API_KEY not found in env or ${join(CONFIG_DIR, '.env')}`);
   }
 
-  const harness = createStandaloneHarness({
+  const harness = createStandaloneHarness({
     profile: 'sdk-minimal',
     patches: [CORDIS],
     dshHome: CREW_DSH_HOME,
@@ -178,6 +196,10 @@ export function startJob({
     .catch(() => ({ kind: 'no-git', reason: NOT_A_GIT_REPOSITORY, error: 'workspace audit failed' }));
 
   const sessionId = id;
+  // Standalone dispatches write into the same shared session store as the hub,
+  // so they need the same provenance record or a Crew-scoped cleanup would leave
+  // them behind.
+  appendSessionOrigin({ sessionId, role, jobId: id });
   const onNotification = (n) => {
     if (n.method === 'session.status') return;
     if (n.method !== 'session.event') return;

package/src/model-routing.mjs

@@ -5,6 +5,7 @@
 // routing boundary.
 
 import { rankAdaptiveCandidates } from './adaptive-routing.mjs';
+import { scheduleAdmission } from './model-schedule.mjs';
 
 export const DEFAULT_TIER_MODEL_PREFERENCES = Object.freeze({
   flash: 'deepseek-v4-flash',
@@ -26,36 +27,39 @@ export const MODEL_SELECTION_REASON_CODES = Object.freeze({
   PROVIDER_UNAVAILABLE: 'PROVIDER_UNAVAILABLE',
   PREFERRED_MODEL_UNAVAILABLE: 'PREFERRED_MODEL_UNAVAILABLE',
   PREFERRED_MODEL_AMBIGUOUS: 'PREFERRED_MODEL_AMBIGUOUS',
-  ADAPTIVE_DEPRIORITIZED: 'ADAPTIVE_DEPRIORITIZED',
-  PROVIDER_TOMBSTONED: 'PROVIDER_TOMBSTONED',
-  CREDENTIAL_MISSING: 'CREDENTIAL_MISSING',
-  QUOTA_EXHAUSTED: 'QUOTA_EXHAUSTED',
-  RATE_LIMITED: 'RATE_LIMITED',
-  PROBE_TIMEOUT: 'PROBE_TIMEOUT',
-  PROVIDER_INTERNAL_ERROR: 'PROVIDER_INTERNAL_ERROR',
-  HARNESS_DEFAULT_INVALID: 'HARNESS_DEFAULT_INVALID',
+  ADAPTIVE_DEPRIORITIZED: 'ADAPTIVE_DEPRIORITIZED',
+  PROVIDER_TOMBSTONED: 'PROVIDER_TOMBSTONED',
+  CREDENTIAL_MISSING: 'CREDENTIAL_MISSING',
+  QUOTA_EXHAUSTED: 'QUOTA_EXHAUSTED',
+  RATE_LIMITED: 'RATE_LIMITED',
+  PEAK_RESTRICTED: 'PEAK_RESTRICTED',
+  PEAK_ADVISORY: 'PEAK_ADVISORY',
+  PROBE_TIMEOUT: 'PROBE_TIMEOUT',
+  PROVIDER_INTERNAL_ERROR: 'PROVIDER_INTERNAL_ERROR',
+  HARNESS_DEFAULT_INVALID: 'HARNESS_DEFAULT_INVALID',
   HARNESS_DEFAULT_PROVIDER_UNAVAILABLE: 'HARNESS_DEFAULT_PROVIDER_UNAVAILABLE',
   PRIMARY_CANDIDATES_EXHAUSTED: 'PRIMARY_CANDIDATES_EXHAUSTED',
   ESCALATION_CANDIDATES_EXHAUSTED: 'ESCALATION_CANDIDATES_EXHAUSTED',
-  NO_AVAILABLE_MODEL: 'NO_AVAILABLE_MODEL',
-});
-
-const HEALTH_BLOCK_REASONS = Object.freeze({
-  'credential-missing': MODEL_SELECTION_REASON_CODES.CREDENTIAL_MISSING,
-  'quota-exhausted': MODEL_SELECTION_REASON_CODES.QUOTA_EXHAUSTED,
-  'rate-limited': MODEL_SELECTION_REASON_CODES.RATE_LIMITED,
-  timeout: MODEL_SELECTION_REASON_CODES.PROBE_TIMEOUT,
-  'internal-error': MODEL_SELECTION_REASON_CODES.PROVIDER_INTERNAL_ERROR,
-});
-
-const BLOCKED_MODEL_CODES = Object.freeze({
-  [MODEL_SELECTION_REASON_CODES.CREDENTIAL_MISSING]: 'MODEL_BLOCKED_CREDENTIAL',
-  [MODEL_SELECTION_REASON_CODES.QUOTA_EXHAUSTED]: 'MODEL_BLOCKED_QUOTA',
-  [MODEL_SELECTION_REASON_CODES.RATE_LIMITED]: 'MODEL_BLOCKED_RATE_LIMIT',
-  [MODEL_SELECTION_REASON_CODES.PROBE_TIMEOUT]: 'MODEL_BLOCKED_TIMEOUT',
-  [MODEL_SELECTION_REASON_CODES.PROVIDER_INTERNAL_ERROR]: 'MODEL_BLOCKED_PROVIDER',
-  [MODEL_SELECTION_REASON_CODES.PROVIDER_TOMBSTONED]: 'MODEL_BLOCKED_TOMBSTONED',
-});
+  NO_AVAILABLE_MODEL: 'NO_AVAILABLE_MODEL',
+});
+
+const HEALTH_BLOCK_REASONS = Object.freeze({
+  'credential-missing': MODEL_SELECTION_REASON_CODES.CREDENTIAL_MISSING,
+  'quota-exhausted': MODEL_SELECTION_REASON_CODES.QUOTA_EXHAUSTED,
+  'rate-limited': MODEL_SELECTION_REASON_CODES.RATE_LIMITED,
+  timeout: MODEL_SELECTION_REASON_CODES.PROBE_TIMEOUT,
+  'internal-error': MODEL_SELECTION_REASON_CODES.PROVIDER_INTERNAL_ERROR,
+});
+
+const BLOCKED_MODEL_CODES = Object.freeze({
+  [MODEL_SELECTION_REASON_CODES.CREDENTIAL_MISSING]: 'MODEL_BLOCKED_CREDENTIAL',
+  [MODEL_SELECTION_REASON_CODES.QUOTA_EXHAUSTED]: 'MODEL_BLOCKED_QUOTA',
+  [MODEL_SELECTION_REASON_CODES.RATE_LIMITED]: 'MODEL_BLOCKED_RATE_LIMIT',
+  [MODEL_SELECTION_REASON_CODES.PROBE_TIMEOUT]: 'MODEL_BLOCKED_TIMEOUT',
+  [MODEL_SELECTION_REASON_CODES.PROVIDER_INTERNAL_ERROR]: 'MODEL_BLOCKED_PROVIDER',
+  [MODEL_SELECTION_REASON_CODES.PROVIDER_TOMBSTONED]: 'MODEL_BLOCKED_TOMBSTONED',
+  [MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED]: 'MODEL_BLOCKED_PEAK',
+});
 
 export function normalizeModelRef(raw) {
   if (!raw || typeof raw !== 'object') return null;
@@ -124,7 +128,7 @@ function traceBase({
   };
 }
 
-function candidateDecision(ref, source, status, { reasonCode, advertised } = {}) {
+function candidateDecision(ref, source, status, { reasonCode, advertised } = {}) {
   return {
     provider: ref?.provider ?? null,
     model: ref?.model ?? null,
@@ -133,28 +137,40 @@ function candidateDecision(ref, source, status, { reasonCode, advertised } = {})
     ...(reasonCode ? { reason_code: reasonCode } : {}),
     ...(advertised === false ? { advertised: false } : {}),
   };
-}
-
-function healthAdmissionReason(ref, { healthStore, healthGate, tombstones } = {}) {
-  if (tombstones?.[ref?.provider] === 'absent') return MODEL_SELECTION_REASON_CODES.PROVIDER_TOMBSTONED;
-  if (healthGate !== 'hard-failures' || typeof healthStore?.get !== 'function') return null;
-  const observation = healthStore.get(ref?.provider, ref?.model);
-  if (observation?.fresh !== true) return null;
-  return HEALTH_BLOCK_REASONS[observation.state] ?? null;
-}
-
-function blockedSelection(trace, ref, source, reasonCode) {
-  trace.fallback_reason = reasonCode;
-  return {
-    ok: false,
-    code: BLOCKED_MODEL_CODES[reasonCode] ?? 'MODEL_BLOCKED_PROVIDER',
-    message: `Model ${ref?.provider ?? 'unknown'}/${ref?.model ?? 'unknown'} is blocked by ${reasonCode}.`,
-    selection_trace: trace,
-  };
-}
+}
+
+function healthAdmissionReason(ref, { healthStore, healthGate, tombstones } = {}) {
+  if (tombstones?.[ref?.provider] === 'absent') return MODEL_SELECTION_REASON_CODES.PROVIDER_TOMBSTONED;
+  if (healthGate !== 'hard-failures' || typeof healthStore?.get !== 'function') return null;
+  const observation = healthStore.get(ref?.provider, ref?.model);
+  if (observation?.fresh !== true) return null;
+  return HEALTH_BLOCK_REASONS[observation.state] ?? null;
+}
+
+/**
+ * Peak/off-peak admission for one candidate.
+ *
+ * Returns `null` when the model is unrestricted or off-peak; otherwise the
+ * schedule's verdict, which the caller applies. A `warn` rule is advisory — the
+ * candidate is still selected, and the trace records why.
+ */
+function peakAdmission(schedule, ref, at) {
+  if (!schedule) return null;
+  return scheduleAdmission(schedule, ref, at);
+}
 
-function selectTrace(trace, ref, source, { advertised, fallbackReason } = {}) {
-  trace.ordered_candidates.push(candidateDecision(ref, source, 'selected', { advertised }));
+function blockedSelection(trace, ref, source, reasonCode) {
+  trace.fallback_reason = reasonCode;
+  return {
+    ok: false,
+    code: BLOCKED_MODEL_CODES[reasonCode] ?? 'MODEL_BLOCKED_PROVIDER',
+    message: `Model ${ref?.provider ?? 'unknown'}/${ref?.model ?? 'unknown'} is blocked by ${reasonCode}.`,
+    selection_trace: trace,
+  };
+}
+
+function selectTrace(trace, ref, source, { advertised, fallbackReason, reasonCode } = {}) {
+  trace.ordered_candidates.push(candidateDecision(ref, source, 'selected', { advertised, reasonCode }));
   trace.selected = { provider: ref.provider, model: ref.model, source };
   trace.selection_source = source;
   trace.fallback_reason = fallbackReason ?? null;
@@ -190,6 +206,7 @@ export function buildDirectSelectionTrace({
   model,
   source = 'legacy-strict',
   escalationReason = null,
+  peakAdvisory = false,
 } = {}) {
   const trace = traceBase({ role, logicalAttempt, modelClassHint, strategy, candidateSet, escalationReason });
   const ref = normalizeModelRef({ provider, model });
@@ -197,7 +214,9 @@ export function buildDirectSelectionTrace({
     trace.fallback_reason = MODEL_SELECTION_REASON_CODES.NO_AVAILABLE_MODEL;
     return trace;
   }
-  return selectTrace(trace, ref, source);
+  return selectTrace(trace, ref, source, {
+    reasonCode: peakAdvisory ? MODEL_SELECTION_REASON_CODES.PEAK_ADVISORY : null,
+  });
 }
 
 /**
@@ -239,7 +258,7 @@ export function enrichSelectionTrace(trace, {
   return base;
 }
 
-export function resolveWorkerModel({
+export function resolveWorkerModel({
   tier,
   priority,
   priorityConfigured = false,
@@ -248,13 +267,15 @@ export function resolveWorkerModel({
   fallback = 'harness-default',
   preferredModelId = DEFAULT_TIER_MODEL_PREFERENCES[tier],
   traceContext = {},
-  adaptive,
-  adaptiveHealth,
-  healthStore,
-  healthGate,
-  allowFallback = true,
-  tombstones,
-} = {}) {
+  adaptive,
+  adaptiveHealth,
+  healthStore,
+  healthGate,
+  allowFallback = true,
+  tombstones,
+  schedule,
+  at,
+} = {}) {
   const providers = providerMap(catalog);
   const normalizedPriority = normalizeModelPriority(priority);
   const prioritySource = typeof traceContext.prioritySource === 'string' && traceContext.prioritySource
@@ -269,37 +290,57 @@ export function resolveWorkerModel({
     escalationReason: traceContext.escalationReason ?? null,
   });
 
+  // One clock read for the whole resolution. Calling `new Date()` per admission
+  // would let a resolution that straddles a peak boundary judge candidates
+  // against different instants — the filter and the all-blocked rescan below
+  // could then disagree about the same candidate.
+  const selectionAt = at ?? new Date();
+
   // Explicit priority — including an intentionally empty configured list — is
   // authoritative. Adaptive mode records that bypass but never reorders it.
   if (priorityConfigured || normalizedPriority.length > 0) {
     rankForTrace(trace, normalizedPriority, { adaptive, adaptiveHealth, explicitPriority: true });
   }
 
-  for (let index = 0; index < normalizedPriority.length; index++) {
-    const ref = normalizedPriority[index];
-    const provider = providers.get(ref.provider);
+  for (let index = 0; index < normalizedPriority.length; index++) {
+    const ref = normalizedPriority[index];
+    const provider = providers.get(ref.provider);
     if (!provider) {
       trace.ordered_candidates.push(candidateDecision(ref, prioritySource, 'skipped', {
         reasonCode: MODEL_SELECTION_REASON_CODES.PROVIDER_UNAVAILABLE,
-      }));
-      continue;
-    }
-    const advertised = (provider.models ?? []).some((model) => model?.id === ref.model);
-    const healthReason = healthAdmissionReason(ref, { healthStore, healthGate, tombstones });
-    if (healthReason) {
-      trace.ordered_candidates.push(candidateDecision(ref, prioritySource, 'skipped', {
-        reasonCode: healthReason, advertised,
-      }));
-      if (allowFallback === false) return blockedSelection(trace, ref, prioritySource, healthReason);
-      continue;
-    }
-    selectTrace(trace, ref, prioritySource, { advertised });
+      }));
+      continue;
+    }
+    const advertised = (provider.models ?? []).some((model) => model?.id === ref.model);
+    const healthReason = healthAdmissionReason(ref, { healthStore, healthGate, tombstones });
+    if (healthReason) {
+      trace.ordered_candidates.push(candidateDecision(ref, prioritySource, 'skipped', {
+        reasonCode: healthReason, advertised,
+      }));
+      if (allowFallback === false) return blockedSelection(trace, ref, prioritySource, healthReason);
+      continue;
+    }
+    // A peak-blocked model is skipped so the next candidate can serve the job;
+    // only an explicit no-fallback call turns it into a hard failure.
+    const peak = peakAdmission(schedule, ref, selectionAt);
+    if (peak?.mode === 'block') {
+      trace.ordered_candidates.push(candidateDecision(ref, prioritySource, 'skipped', {
+        reasonCode: MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED, advertised,
+      }));
+      if (allowFallback === false) return blockedSelection(trace, ref, prioritySource, MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED);
+      continue;
+    }
+    selectTrace(trace, ref, prioritySource, {
+      advertised,
+      reasonCode: peak?.mode === 'warn' ? MODEL_SELECTION_REASON_CODES.PEAK_ADVISORY : null,
+    });
     return {
       ok: true,
       ...ref,
       source: 'priority',
       matchedPriorityIndex: index,
       ...(advertised ? {} : { advertised: false }),
+      ...(peak?.mode === 'warn' ? { peak_advisory: true } : {}),
       selection_trace: trace,
     };
   }
@@ -312,47 +353,79 @@ export function resolveWorkerModel({
       if ((provider.models ?? []).some((model) => model?.id === preferredModelId)) {
         matches.push({ provider: provider.id, model: preferredModelId });
       }
-    }
-    if (matches.length === 1) {
-      const preferred = matches[0];
-      const healthReason = healthAdmissionReason(preferred, { healthStore, healthGate, tombstones });
-      if (healthReason) {
-        trace.ordered_candidates.push(candidateDecision(preferred, 'preferred-default', 'skipped', {
-          reasonCode: healthReason,
-        }));
-        if (allowFallback === false) return blockedSelection(trace, preferred, 'preferred-default', healthReason);
-      } else {
-        rankForTrace(trace, matches, { adaptive, adaptiveHealth });
-        selectTrace(trace, preferred, 'preferred-default');
-        return { ok: true, ...preferred, source: 'preferred-default', selection_trace: trace };
-      }
-    }
-    if (matches.length > 1) {
-      const availableMatches = matches.filter((candidate) => {
-        const healthReason = healthAdmissionReason(candidate, { healthStore, healthGate, tombstones });
-        if (!healthReason) return true;
-        trace.ordered_candidates.push(candidateDecision(candidate, 'preferred-default', 'skipped', {
-          reasonCode: healthReason,
-        }));
-        return false;
-      });
-      if (availableMatches.length === 0) {
-        const blocked = matches.find((candidate) => healthAdmissionReason(candidate, { healthStore, healthGate, tombstones }));
-        if (blocked && allowFallback === false) {
-          return blockedSelection(trace, blocked, 'preferred-default', healthAdmissionReason(blocked, { healthStore, healthGate, tombstones }));
-        }
-      }
-      const preferredProvider = normalizeModelRef(harnessDefault)?.provider;
-      const deterministicMatch = availableMatches.find((candidate) => candidate.provider === preferredProvider) ?? null;
-      const baseline = deterministicMatch
-        ? [deterministicMatch, ...availableMatches.filter((candidate) => candidate.provider !== deterministicMatch.provider)]
-        : availableMatches;
-      const ranked = rankForTrace(trace, baseline, { adaptive, adaptiveHealth });
-      const adaptiveChoice = ranked.trace.decision_supported ? ranked.candidates[0] : null;
-      const match = adaptiveChoice ?? deterministicMatch;
-      if (match) {
-        const decisionOrder = adaptiveChoice ? ranked.candidates : availableMatches;
-        for (const candidate of decisionOrder) {
+    }
+    if (matches.length === 1) {
+      const preferred = matches[0];
+      const healthReason = healthAdmissionReason(preferred, { healthStore, healthGate, tombstones });
+      const peak = healthReason ? null : peakAdmission(schedule, preferred, selectionAt);
+      const blockReason = healthReason ?? (peak?.mode === 'block' ? MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED : null);
+      if (blockReason) {
+        trace.ordered_candidates.push(candidateDecision(preferred, 'preferred-default', 'skipped', {
+          reasonCode: blockReason,
+        }));
+        if (allowFallback === false) return blockedSelection(trace, preferred, 'preferred-default', blockReason);
+      } else {
+        rankForTrace(trace, matches, { adaptive, adaptiveHealth });
+        selectTrace(trace, preferred, 'preferred-default', {
+          reasonCode: peak?.mode === 'warn' ? MODEL_SELECTION_REASON_CODES.PEAK_ADVISORY : null,
+        });
+        return {
+          ok: true,
+          ...preferred,
+          source: 'preferred-default',
+          ...(peak?.mode === 'warn' ? { peak_advisory: true } : {}),
+          selection_trace: trace,
+        };
+      }
+    }
+    if (matches.length > 1) {
+      // Keep each admitted candidate's advisory verdict alongside it: a `warn`
+      // rule is only advisory if the caller learns about it, and recomputing it
+      // after the pick would re-evaluate a clock already read once.
+      const verdicts = new Map();
+      const availableMatches = matches.filter((candidate) => {
+        const healthReason = healthAdmissionReason(candidate, { healthStore, healthGate, tombstones });
+        const peak = healthReason ? null : peakAdmission(schedule, candidate, selectionAt);
+        const reason = healthReason ?? (peak?.mode === 'block' ? MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED : null);
+        if (!reason) {
+          verdicts.set(modelRefKey(candidate), peak ?? null);
+          return true;
+        }
+        trace.ordered_candidates.push(candidateDecision(candidate, 'preferred-default', 'skipped', {
+          reasonCode: reason,
+        }));
+        return false;
+      });
+      if (availableMatches.length === 0) {
+        const blocked = matches.find((candidate) => healthAdmissionReason(candidate, { healthStore, healthGate, tombstones })
+          || peakAdmission(schedule, candidate, selectionAt)?.mode === 'block');
+        if (blocked && allowFallback === false) {
+          const reason = healthAdmissionReason(blocked, { healthStore, healthGate, tombstones })
+            ?? MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED;
+          return blockedSelection(trace, blocked, 'preferred-default', reason);
+        }
+      }
+      const preferredProvider = normalizeModelRef(harnessDefault)?.provider;
+      const deterministicMatch = availableMatches.find((candidate) => candidate.provider === preferredProvider) ?? null;
+      // Filtering can leave exactly one admissible candidate while removing the
+      // one that matched the Harness Default provider, which leaves both the
+      // deterministic match and the adaptive choice empty. Ambiguity only means
+      // something with two or more candidates left, so a lone survivor is picked
+      // outright rather than reported as ambiguous and dropped.
+      const soleMatch = availableMatches.length === 1 ? availableMatches[0] : null;
+      const baseline = deterministicMatch
+        ? [deterministicMatch, ...availableMatches.filter((candidate) => candidate.provider !== deterministicMatch.provider)]
+        : availableMatches;
+      // Ranking still runs for a lone survivor so `trace.adaptive` reflects the
+      // configured policy in this shape too; the result is not consulted, because
+      // ranking orders candidates rather than admitting them and must never
+      // discard the only one that passed admission.
+      const ranked = rankForTrace(trace, soleMatch ? [soleMatch] : baseline, { adaptive, adaptiveHealth });
+      const adaptiveChoice = !soleMatch && ranked?.trace.decision_supported ? ranked.candidates[0] : null;
+      const match = soleMatch ?? adaptiveChoice ?? deterministicMatch;
+      if (match) {
+        const decisionOrder = soleMatch ? [] : adaptiveChoice ? ranked.candidates : availableMatches;
+        for (const candidate of decisionOrder) {
           if (candidate.provider === match.provider && candidate.model === match.model) continue;
           trace.ordered_candidates.push(candidateDecision(candidate, 'preferred-default', 'skipped', {
             reasonCode: adaptiveChoice
@@ -360,10 +433,21 @@ export function resolveWorkerModel({
               : MODEL_SELECTION_REASON_CODES.PREFERRED_MODEL_AMBIGUOUS,
           }));
         }
-        selectTrace(trace, match, 'preferred-default');
-        return { ok: true, ...match, source: 'preferred-default', selection_trace: trace };
+        const verdict = verdicts.get(modelRefKey(match)) ?? null;
+        selectTrace(trace, match, 'preferred-default', {
+          reasonCode: verdict?.mode === 'warn' ? MODEL_SELECTION_REASON_CODES.PEAK_ADVISORY : null,
+        });
+        return {
+          ok: true,
+          ...match,
+          source: 'preferred-default',
+          ...(verdict?.mode === 'warn' ? { peak_advisory: true } : {}),
+          selection_trace: trace,
+        };
       }
-      for (const candidate of matches) {
+      // Only the candidates still in play can be ambiguous; one already rejected
+      // for a concrete reason keeps that reason and appears once.
+      for (const candidate of availableMatches) {
         trace.ordered_candidates.push(candidateDecision(candidate, 'preferred-default', 'skipped', {
           reasonCode: MODEL_SELECTION_REASON_CODES.PREFERRED_MODEL_AMBIGUOUS,
         }));
@@ -385,37 +469,52 @@ export function resolveWorkerModel({
 
   if (fallback === 'harness-default') {
     const defaultRef = normalizeModelRef(harnessDefault);
+    // The Harness Default is often also a priority or preferred candidate, and
+    // that candidate has already been judged. Recording it a second time with a
+    // different reason would make the trace contradict itself, so a ref that
+    // already has a verdict keeps it.
+    const alreadyJudged = defaultRef
+      ? trace.ordered_candidates.some((row) => row.provider === defaultRef.provider && row.model === defaultRef.model)
+      : false;
     if (!defaultRef) {
       trace.ordered_candidates.push(candidateDecision(null, 'harness-default', 'skipped', {
         reasonCode: MODEL_SELECTION_REASON_CODES.HARNESS_DEFAULT_INVALID,
       }));
+    } else if (alreadyJudged) {
+      // Keep its existing verdict; nothing further to record.
     } else if (!providers.has(defaultRef.provider)) {
       trace.ordered_candidates.push(candidateDecision(defaultRef, 'harness-default', 'skipped', {
         reasonCode: MODEL_SELECTION_REASON_CODES.HARNESS_DEFAULT_PROVIDER_UNAVAILABLE,
       }));
     } else {
-      const fallbackReason = traceContext.candidateSet === 'escalation'
-        ? MODEL_SELECTION_REASON_CODES.ESCALATION_CANDIDATES_EXHAUSTED
-        : MODEL_SELECTION_REASON_CODES.PRIMARY_CANDIDATES_EXHAUSTED;
-      const healthReason = healthAdmissionReason(defaultRef, { healthStore, healthGate, tombstones });
-      if (healthReason) {
-        trace.ordered_candidates.push(candidateDecision(defaultRef, 'harness-default', 'skipped', {
-          reasonCode: healthReason,
-        }));
-        if (allowFallback === false) return blockedSelection(trace, defaultRef, 'harness-default', healthReason);
-      } else {
-      selectTrace(trace, defaultRef, 'harness-default', { fallbackReason });
-      return {
+      const fallbackReason = traceContext.candidateSet === 'escalation'
+        ? MODEL_SELECTION_REASON_CODES.ESCALATION_CANDIDATES_EXHAUSTED
+        : MODEL_SELECTION_REASON_CODES.PRIMARY_CANDIDATES_EXHAUSTED;
+      const healthReason = healthAdmissionReason(defaultRef, { healthStore, healthGate, tombstones });
+      const peak = healthReason ? null : peakAdmission(schedule, defaultRef, selectionAt);
+      const blockReason = healthReason ?? (peak?.mode === 'block' ? MODEL_SELECTION_REASON_CODES.PEAK_RESTRICTED : null);
+      if (blockReason) {
+        trace.ordered_candidates.push(candidateDecision(defaultRef, 'harness-default', 'skipped', {
+          reasonCode: blockReason,
+        }));
+        if (allowFallback === false) return blockedSelection(trace, defaultRef, 'harness-default', blockReason);
+      } else {
+      selectTrace(trace, defaultRef, 'harness-default', {
+        fallbackReason,
+        reasonCode: peak?.mode === 'warn' ? MODEL_SELECTION_REASON_CODES.PEAK_ADVISORY : null,
+      });
+      return {
         ok: true,
         ...defaultRef,
         source: 'harness-default',
+        ...(peak?.mode === 'warn' ? { peak_advisory: true } : {}),
         ...(typeof harnessDefault.reasoningEffort === 'string' && harnessDefault.reasoningEffort
           ? { reasoningEffort: harnessDefault.reasoningEffort }
           : {}),
-        selection_trace: trace,
-      };
-      }
-    }
+        selection_trace: trace,
+      };
+      }
+    }
   }
   trace.fallback_reason = MODEL_SELECTION_REASON_CODES.NO_AVAILABLE_MODEL;
   return {
@@ -435,18 +534,20 @@ export function resolveWorkerModel({
  * The output shape matches resolveWorkerModel (provider/model/source/...) plus
  * role + attempt so selection provenance lands in job metadata.
  */
-export function resolveModel({
+export function resolveModel({
   role = 'worker',
   attempt = 0,
   policy,
   catalog,
   harnessDefault,
-  adaptiveHealth,
-  healthStore,
-  healthGate,
-  allowFallback = true,
-  tombstones,
-} = {}) {
+  adaptiveHealth,
+  healthStore,
+  healthGate,
+  allowFallback = true,
+  tombstones,
+  schedule,
+  at,
+} = {}) {
   const p = policy && typeof policy === 'object' ? policy : {};
   const escalated = Number.isInteger(attempt) && attempt > 0;
   const candidates = escalated ? p.escalation_priority : p.priority;
@@ -464,12 +565,14 @@ export function resolveModel({
     harnessDefault,
     fallback: p.fallback === 'harness-default' ? 'harness-default' : 'harness-default',
     preferredModelId,
-    adaptive: p.adaptive,
-    adaptiveHealth,
-    healthStore,
-    healthGate,
-    allowFallback,
-    tombstones,
+    adaptive: p.adaptive,
+    adaptiveHealth,
+    healthStore,
+    healthGate,
+    allowFallback,
+    tombstones,
+    schedule,
+    at,
     traceContext: {
       role,
       logicalAttempt: attempt,