@warmdrift/kgauto-compiler 2.0.0-alpha.83 → 2.0.0-alpha.86

package/dist/index.js

@@ -27,6 +27,8 @@ __export(index_exports, {
   ALT_STRATEGY_IDS: () => ALT_STRATEGY_IDS,
   ARCHETYPE_FAMILY_FITS: () => ARCHETYPE_FAMILY_FITS,
   ARCHETYPE_FLOOR_DEFAULT: () => ARCHETYPE_FLOOR_DEFAULT,
+  BLOCKED_MODEL_FAMILY_SIBLING_SERVED_CODE: () => BLOCKED_MODEL_FAMILY_SIBLING_SERVED_CODE,
+  BLOCKED_MODEL_NOT_IN_ROSTER_CODE: () => BLOCKED_MODEL_NOT_IN_ROSTER_CODE,
   BRAIN_READ_ENV_NAMES: () => BRAIN_READ_ENV_NAMES,
   BURST_SPAN_MS: () => BURST_SPAN_MS,
   COACH_CFG: () => COACH_CFG,
@@ -70,6 +72,7 @@ __export(index_exports, {
   applySectionRewrites: () => applySectionRewrites,
   attachCacheControlToStreamTextInput: () => attachCacheControlToStreamTextInput,
   awaitMeasuredFailureReady: () => awaitMeasuredFailureReady,
+  awaitPromotionsReady: () => awaitPromotionsReady,
   brainHealth: () => brainHealth,
   bucketContext: () => bucketContext,
   bucketHistory: () => bucketHistory,
@@ -156,6 +159,7 @@ __export(index_exports, {
   peekBrainDeadLetter: () => peekBrainDeadLetter,
   planDecomposition: () => planDecomposition,
   prefetchMeasuredFailure: () => prefetchMeasuredFailure,
+  prefetchPromotions: () => prefetchPromotions,
   probeShadow: () => probeShadow,
   profileToRow: () => profileToRow,
   profilesByProvider: () => profilesByProvider,
@@ -168,6 +172,7 @@ __export(index_exports, {
   resetTokenizer: () => resetTokenizer,
   resolveConventionsForProfile: () => resolveConventionsForProfile,
   resolveGoldenCaptureRate: () => resolveGoldenCaptureRate,
+  resolveModelAlias: () => resolveModelAlias,
   resolvePricingAt: () => resolvePricingAt,
   resolveProviderKey: () => resolveProviderKey,
   rowToAdvisory: () => rowToAdvisory,
@@ -969,9 +974,21 @@ var PROFILES_RAW = [
   },
   {
     id: "gemini-2.5-pro",
-    verifiedAgainstDocs: "2026-05-08",
+    verifiedAgainstDocs: "2026-08-08",
     provider: "google",
-    status: "current",
+    // alpha.86 — AVAILABILITY demotion, not a provider-lifecycle mirror.
+    // Google's docs still list 2.5-pro as Stable, but the serving layer
+    // disagrees per account cohort: tt-intel measured 4/4 refusals
+    // ("no longer available to new users", 2026-08-02, their bench), and
+    // kgauto's own key 429s on a FreeTier per-day quota (probed
+    // 2026-08-08). A chain anchor that hard-fails for whole account
+    // cohorts is not an anchor; `legacy` removes it from cost-ordered
+    // chains and new selection while keeping the profile resolvable for
+    // consumers who pass it explicitly. Re-promotion is one status flip
+    // if Google restores availability. The registry cannot yet express
+    // account-cohort availability as data — see interfaces/kgauto.md
+    // ## Requested 2026-08-02.
+    status: "legacy",
     maxContextTokens: 1048576,
     maxOutputTokens: 65535,
     maxTools: 128,
@@ -1001,7 +1018,7 @@ var PROFILES_RAW = [
       }
     ],
     strengths: ["reasoning", "1m_context", "structured_output", "tool_use"],
-    weaknesses: ["pricing_above_200k"],
+    weaknesses: ["pricing_above_200k", "availability_restricted_by_account_cohort"],
     // Master plan §3.3 anchor: tier-2 cross-provider in almost every chain.
     // Sits on the frontier at perf-9 — close to Sonnet but cheaper input.
     archetypePerf: {
@@ -2024,6 +2041,9 @@ function _setProfileBrainHook(hook) {
 function canonicalId(id) {
   return brainHook.resolveAlias?.(id) ?? ALIASES[id] ?? id;
 }
+function resolveModelAlias(id) {
+  return canonicalId(id);
+}
 var PROFILE_INDEX = new Map(
   PROFILES_RAW.map((p) => [p.id, p])
 );
@@ -2523,6 +2543,17 @@ function resolveFamilyEntry(family, ctx) {
   return winner.id;
 }
 
+// src/policy-match.ts
+function canonicalPolicySet(ids) {
+  const set = /* @__PURE__ */ new Set();
+  for (const id of ids ?? []) set.add(resolveModelAlias(id));
+  return set;
+}
+function policySetHas(set, modelId) {
+  if (set.size === 0) return false;
+  return set.has(resolveModelAlias(modelId));
+}
+
 // src/tokenizer.ts
 var tokenizerImpl = defaultCharBasedCounter;
 function defaultCharBasedCounter(text) {
@@ -2831,9 +2862,12 @@ function passApplyCliffs(ir, profile, estimatedInputTokens) {
     if (!triggered) continue;
     switch (cliff.action) {
       case "drop_to_top_relevant": {
-        const targetCount = Math.min(
-          Math.floor(cliff.threshold * 0.75),
-          Math.max(1, Math.floor((nextIR.tools?.length ?? 0) / 2))
+        const targetCount = Math.max(
+          1,
+          Math.min(
+            Math.floor(cliff.threshold * 0.75),
+            Math.floor((nextIR.tools?.length ?? 0) / 2)
+          )
         );
         if (nextIR.tools && nextIR.tools.length > targetCount) {
           const intent = nextIR.intent.archetype;
@@ -2918,8 +2952,8 @@ function effectiveConventions(profile) {
 function passScoreTargets(ir, opts) {
   const constraints = ir.constraints ?? {};
   const policy = opts.policy ?? {};
-  const blockedSet = new Set(policy.blockedModels ?? []);
-  const preferredSet = new Set(policy.preferredModels ?? []);
+  const blockedSet = canonicalPolicySet(policy.blockedModels);
+  const preferredSet = canonicalPolicySet(policy.preferredModels);
   const scores = [];
   const policyMutations = [];
   const rawPromotion = opts.promotion;
@@ -2942,7 +2976,7 @@ function passScoreTargets(ir, opts) {
       continue;
     }
     const reasons = [];
-    if (blockedSet.has(modelId)) {
+    if (policySetHas(blockedSet, modelId)) {
       reasons.push(`blocked_by_policy (consumer gated this model \u2014 see CompilePolicy.blockedModels)`);
     }
     if (opts.estimatedInputTokens > profile.maxContextTokens * 0.9) {
@@ -2972,7 +3006,7 @@ function passScoreTargets(ir, opts) {
     const qualityScore = Math.max(0, baseQuality - qualityPenalty);
     const callerOrderBoost = (modelIds.length - modelIds.indexOf(modelId)) * 0.1;
     const costPenalty = estimatedCostUsd * 5;
-    const preferredBoost = preferredSet.has(modelId) ? 0.5 : 0;
+    const preferredBoost = policySetHas(preferredSet, modelId) ? 0.5 : 0;
     let latencyPenalty = 0;
     const maxLatencyMs = constraints.maxLatencyMs;
     if (typeof maxLatencyMs === "number" && maxLatencyMs > 0) {
@@ -3029,7 +3063,7 @@ function passScoreTargets(ir, opts) {
         description: `Model ${modelId} excluded \u2014 estimated cost $${estimatedCostUsd.toFixed(4)} exceeds policy ceiling $${policy.maxCostPerCallUsd.toFixed(4)}`
       });
     }
-    if (preferredSet.has(modelId) && reasons.length === 0) {
+    if (policySetHas(preferredSet, modelId) && reasons.length === 0) {
       policyMutations.push({
         id: `policy-preferred-${modelId}`,
         source: "compile_policy",
@@ -3911,8 +3945,14 @@ var STARTER_CHAINS_GROUNDED = {
   critique: [
     { id: "claude-opus-4-7", grounding: "judgment", reason: "Highest reasoning bar, no degradation tier \u2014 engineer pick, awaiting measured backing" },
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Same-provider walk-down from Opus on 429" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor in similar quality bracket" },
-    { id: "gpt-5.5", grounding: "judgment", reason: "alpha.16: third-provider frontier-tier floor (archetypePerf=9)" }
+    // alpha.86: gemini-2.5-pro dropped — availability-restricted (tt-intel
+    // measured 4/4 cohort refusal 2026-08-02; kgauto key free-tier-quota
+    // 429 2026-08-08). No current Google model clears the critique floor
+    // (3.5-flash critique=5; 3.1-pro-preview scores 10 but is preview —
+    // default chains carry promoted models only). deepseek-v4-pro takes the
+    // third-provider tail instead.
+    { id: "gpt-5.5", grounding: "judgment", reason: "alpha.16: third-provider frontier-tier floor (archetypePerf=9)" },
+    { id: "deepseek-v4-pro", grounding: "judgment", reason: "alpha.86: third-provider tail replacing availability-restricted gemini-2.5-pro \u2014 critique=6 clears the floor exactly; last-resort when Anthropic AND OpenAI are down, not a quality peer of the tiers above" }
   ],
   // alpha.62 (eval spine) — pairwise output comparison. Same reasoning-floor
   // posture as critique (a verdict from a weak judge is worse than no
@@ -3921,14 +3961,16 @@ var STARTER_CHAINS_GROUNDED = {
   judge: [
     { id: "claude-opus-4-8", grounding: "judgment", reason: "Highest reasoning bar for pairwise verdicts \u2014 current opus (s64 roster)" },
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Same-provider walk-down on 429" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor in similar quality bracket" },
-    { id: "gpt-5.5", grounding: "judgment", reason: "Third-provider frontier-tier floor" }
+    // alpha.86: gemini-2.5-pro dropped (availability-restricted; see critique
+    // note). gpt-5.5 remains the cross-provider frontier floor for verdicts.
+    { id: "gpt-5.5", grounding: "judgment", reason: "Third-provider frontier-tier floor" },
+    { id: "deepseek-v4-pro", grounding: "judgment", reason: "alpha.86: third-provider tail replacing availability-restricted gemini-2.5-pro \u2014 native structured output per the judge contract; last-resort tier" }
   ],
   // Reasoning matters — Sonnet primary; walk UP to Opus on 429.
   plan: [
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Reasoning + cost balance \u2014 engineer pick" },
     { id: "claude-opus-4-7", grounding: "judgment", reason: 'Same-provider walk-UP on 429 (rare exception to "always cheaper")' },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor" },
+    { id: "gemini-3.5-flash", grounding: "judgment", reason: "alpha.86: cross-provider anchor \u2014 replaces availability-restricted gemini-2.5-pro (tt-intel 4/4 cohort refusal 2026-08-02; probed serving 200 on kgauto key 2026-08-08)" },
     { id: "deepseek-v4-pro", grounding: "judgment", reason: "Tier 3 cost floor \u2014 no brain evidence yet" },
     { id: "gpt-5.4", grounding: "judgment", reason: "alpha.33: third-provider tail (archetypePerf=7) \u2014 closes openai-in-default-fallback-chains" }
   ],
@@ -3936,7 +3978,7 @@ var STARTER_CHAINS_GROUNDED = {
   generate: [
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Quality + cost match \u2014 engineer pick" },
     { id: "claude-haiku-4-5", grounding: "judgment", reason: "Same-provider step-down" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor" },
+    { id: "gemini-3.5-flash", grounding: "judgment", reason: "alpha.86: cross-provider anchor \u2014 replaces availability-restricted gemini-2.5-pro (tt-intel 4/4 cohort refusal 2026-08-02; probed serving 200 on kgauto key 2026-08-08)" },
     { id: "gpt-5.4-mini", grounding: "judgment", reason: "alpha.16: third-provider tail (archetypePerf=7) \u2014 closes mono-Anthropic gap" }
   ],
   // ask::sonnet — STARTER_CHAINS calls this "Quality + cost match" but
@@ -3945,7 +3987,7 @@ var STARTER_CHAINS_GROUNDED = {
   ask: [
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Quality + cost match \u2014 engineer pick. NOTE: tt-intel s78 prod showed 27% empty rate; placement awaits measurement validation" },
     { id: "claude-haiku-4-5", grounding: "judgment", reason: "Same-provider step-down" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor" },
+    { id: "gemini-3.5-flash", grounding: "judgment", reason: "alpha.86: cross-provider anchor \u2014 replaces availability-restricted gemini-2.5-pro (tt-intel 4/4 cohort refusal 2026-08-02; probed serving 200 on kgauto key 2026-08-08)" },
     { id: "gpt-5.4-mini", grounding: "judgment", reason: "alpha.16: third-provider tail (archetypePerf=7)" }
   ],
   // Structured-output archetype — Flash skipped (alpha.8 MAX_TOKENS cliff,
@@ -3953,14 +3995,14 @@ var STARTER_CHAINS_GROUNDED = {
   extract: [
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Reliable structured-output anchor \u2014 engineer pick" },
     { id: "claude-haiku-4-5", grounding: "judgment", reason: "Same-provider step-down with native structured output" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor with structured-output support" },
+    { id: "gemini-3.5-flash", grounding: "judgment", reason: "alpha.86: cross-provider anchor with native structured output \u2014 replaces availability-restricted gemini-2.5-pro" },
     { id: "gpt-5.4", grounding: "capability-fact", reason: "alpha.16: third-provider floor \u2014 native structured-output capability (archetypePerf=8)" }
   ],
   // Forgiving archetype — Sonnet primary but Flash safely floors it.
   transform: [
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Quality anchor \u2014 engineer pick" },
     { id: "claude-haiku-4-5", grounding: "judgment", reason: "Same-provider step-down" },
-    { id: "gemini-2.5-pro", grounding: "judgment", reason: "Cross-provider anchor" },
+    { id: "gemini-3.5-flash", grounding: "judgment", reason: "alpha.86: cross-provider anchor \u2014 replaces availability-restricted gemini-2.5-pro (tt-intel 4/4 cohort refusal 2026-08-02; probed serving 200 on kgauto key 2026-08-08)" },
     { id: "gemini-2.5-flash", grounding: "judgment", reason: "Cost floor \u2014 forgiving archetype tolerates Flash" },
     { id: "gpt-5.4-mini", grounding: "judgment", reason: "alpha.33: third-provider tail (archetypePerf=7) \u2014 closes openai-in-default-fallback-chains" }
   ],
@@ -3968,7 +4010,7 @@ var STARTER_CHAINS_GROUNDED = {
   // (capability-fact: Flash 15-75 parallel calls/step vs DeepSeek 7-8).
   hunt: [
     { id: "gemini-2.5-flash", grounding: "capability-fact", reason: "L-040 parallel-tool throughput champion (15-75 calls/step)" },
-    { id: "gemini-2.5-pro", grounding: "capability-fact", reason: "Cross-provider tier 1 with strong parallel-tool support" },
+    { id: "gemini-3.5-flash", grounding: "capability-fact", reason: "alpha.86: parallel-tool agentic tier (hunt archetypePerf 9, L-040 family) \u2014 replaces availability-restricted gemini-2.5-pro" },
     { id: "claude-sonnet-4-6", grounding: "judgment", reason: "Quality safety net for blocked-Flash case" },
     { id: "claude-haiku-4-5", grounding: "judgment", reason: "Reduced tool budget \u2014 cliff at 16 fires" },
     { id: "gpt-5.4-mini", grounding: "judgment", reason: "alpha.33: third-provider tail \u2014 OpenAI parallel-tool capable archetype" }
@@ -4016,9 +4058,9 @@ var STARTER_CHAINS_BY_MODE_GROUNDED = {
         reason: "Cross-provider safety net \u2014 Sonnet handles sequential agentic loops cleanly"
       },
       {
-        id: "gemini-2.5-pro",
+        id: "gemini-3.5-flash",
         grounding: "judgment",
-        reason: "Third-provider tail when no DeepSeek key reachable"
+        reason: "alpha.86: third-provider tail when no DeepSeek key reachable \u2014 replaces availability-restricted gemini-2.5-pro"
       }
     ]
   }
@@ -4071,8 +4113,8 @@ function getDefaultFallbackChain(opts) {
     chain = [...starter];
   }
   if (policy?.blockedModels && policy.blockedModels.length > 0) {
-    const blocked = new Set(policy.blockedModels);
-    chain = chain.filter((id) => !blocked.has(id));
+    const blocked = canonicalPolicySet(policy.blockedModels);
+    chain = chain.filter((id) => !policySetHas(blocked, id));
   }
   const seen = /* @__PURE__ */ new Set();
   const deduped = [];
@@ -4175,8 +4217,8 @@ function getDefaultFallbackChainWithGrounding(opts) {
     chain = [...starter];
   }
   if (policy?.blockedModels && policy.blockedModels.length > 0) {
-    const blocked = new Set(policy.blockedModels);
-    chain = chain.filter((e) => !blocked.has(e.id));
+    const blocked = canonicalPolicySet(policy.blockedModels);
+    chain = chain.filter((e) => !policySetHas(blocked, e.id));
   }
   const seen = /* @__PURE__ */ new Set();
   const deduped = [];
@@ -4584,6 +4626,40 @@ function defaultOnError4(err) {
     err
   );
 }
+function prefetchPromotions(appId) {
+  const rt = runtime4;
+  if (!rt || !appId) return void 0;
+  let snap = snapshots3.get(appId);
+  if (!snap) {
+    snap = { data: [], expiresAt: 0, refreshing: false };
+    snapshots3.set(appId, snap);
+  }
+  if (snap.expiresAt > Date.now()) return void 0;
+  const inflight = pendingRefreshes3.get(appId);
+  if (inflight) return inflight;
+  if (snap.refreshing) return void 0;
+  snap.refreshing = true;
+  void asyncRefresh4(rt, appId);
+  return pendingRefreshes3.get(appId);
+}
+async function awaitPromotionsReady(appId, timeoutMs) {
+  if (!runtime4 || !appId) return;
+  const pending = prefetchPromotions(appId) ?? pendingRefreshes3.get(appId);
+  if (!(timeoutMs > 0)) return;
+  if (!pending) return;
+  let timer;
+  try {
+    await Promise.race([
+      pending,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, timeoutMs);
+      })
+    ]);
+  } catch {
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 function _testResetPromotions() {
   runtime4 = void 0;
   snapshots3.clear();
@@ -5053,6 +5129,92 @@ function advisorRuleCrossFamilyFit(ctx) {
   ];
 }
 
+// src/advisor-rules/blocked-model-drift.ts
+var BLOCKED_MODEL_NOT_IN_ROSTER_CODE = "blocked-model-not-in-roster";
+var BLOCKED_MODEL_FAMILY_SIBLING_SERVED_CODE = "blocked-model-family-sibling-served";
+var DOCS_URL = "https://github.com/stue/command-center/blob/main/interfaces/kgauto.md#best-practice-advisories";
+function familyOf2(modelId, profile) {
+  return profile?.family ?? deriveFamilyFromModelId(modelId);
+}
+function isOnTheWayOut(status) {
+  return status === "legacy" || status === "deprecated";
+}
+function advisorRuleBlockedModelDrift(ctx) {
+  const blocked = ctx.policy?.blockedModels;
+  if (!blocked || blocked.length === 0) return [];
+  const resolve = ctx.resolveProfile ?? tryGetProfile;
+  const out = [];
+  const entries = [...new Set(blocked)].sort();
+  const selectedProfile = resolve(ctx.selectedModelId);
+  const selectedFamily = familyOf2(ctx.selectedModelId, selectedProfile);
+  const orphans = entries.filter((e) => resolve(e) === void 0);
+  if (orphans.length > 0) {
+    const list = orphans.map((o) => `\`${o}\``).join(", ");
+    const plural = orphans.length === 1 ? "entry" : "entries";
+    const verb = orphans.length === 1 ? "matches" : "match";
+    out.push({
+      level: "warn",
+      code: BLOCKED_MODEL_NOT_IN_ROSTER_CODE,
+      message: `CompilePolicy.blockedModels ${plural} ${list} ${verb} no model in the current roster, so ${orphans.length === 1 ? "it is" : "they are"} inert \u2014 \`blockedModels\` is matched by exact model id, and nothing kgauto can select carries ${orphans.length === 1 ? "that id" : "those ids"}. The block will never fire.`,
+      suggestion: `Check for a typo, or for an id that was retired from the roster since the block was written. This is how a block goes quiet without an error: tt-intel (2026-07-29) carried \`KGAUTO_BLOCKED_MODELS="claude-sonnet-4-6"\` across a roster retarget and the block stopped covering the traffic they believed it covered. Resolve the intended model id against the live roster \u2014 \`getRecommendedPrimary({ family, fallback })\` returns the id the family currently resolves to \u2014 and block that id, or drop the entry if it is no longer needed.`,
+      docsUrl: DOCS_URL
+    });
+  }
+  if (selectedFamily !== null) {
+    const siblings = entries.filter((e) => {
+      if (resolveModelAlias(e) === resolveModelAlias(ctx.selectedModelId)) return false;
+      const p = resolve(e);
+      if (familyOf2(e, p) !== selectedFamily) return false;
+      if (p && selectedProfile && p.provider !== selectedProfile.provider) {
+        return false;
+      }
+      return true;
+    });
+    if (siblings.length > 0) {
+      const list = siblings.map((s) => `\`${s}\``).join(", ");
+      const plural = siblings.length === 1 ? "" : "s";
+      const retargetShaped = siblings.some((s) => {
+        const p = resolve(s);
+        return isOnTheWayOut(p?.status) && selectedProfile?.status === "current";
+      });
+      const retargetNote = retargetShaped ? ` The blocked id${plural} ${siblings.length === 1 ? "is" : "are"} legacy/deprecated while \`${ctx.selectedModelId}\` is current \u2014 that is the signature of a roster lifecycle move rather than a deliberate per-generation block, so this is more likely to be drift than intent.` : "";
+      out.push({
+        level: "warn",
+        code: BLOCKED_MODEL_FAMILY_SIBLING_SERVED_CODE,
+        message: `\`${ctx.selectedModelId}\` was selected for this call. It is in the same family (\`${selectedFamily}\`) as blocked entr${siblings.length === 1 ? "y" : "ies"} ${list}, but its exact id differs \u2014 and \`CompilePolicy.blockedModels\` matches by exact id, so the block does not cover it.${retargetNote}`,
+        suggestion: `Two readings, and kgauto cannot tell them apart: (1) intentional \u2014 you meant to gate that specific id and \`${ctx.selectedModelId}\` is fine, in which case nothing needs doing and you can filter this code; (2) drift \u2014 you meant to gate the family, and a roster change moved traffic to a sibling your block never named. This happened to tt-intel: when the \`claude-sonnet\` family primary retargeted from \`claude-sonnet-4-6\` to \`claude-sonnet-5\`, their literal-id gate stopped matching the family's routed traffic (their fix was local family resolution). If you meant the family, add \`${ctx.selectedModelId}\` to \`blockedModels\` \u2014 kgauto deliberately does NOT widen exact-id blocks into family globs, because that would silently change what every existing block covers.`,
+        docsUrl: DOCS_URL
+      });
+    }
+  }
+  return out;
+}
+
+// src/advisor-rules/preferred-blocked-overlap.ts
+var PREFERRED_MODEL_BLOCKED_CODE = "preferred-model-blocked";
+var DOCS_URL2 = "https://github.com/stue/command-center/blob/main/interfaces/kgauto.md#best-practice-advisories";
+function advisorRulePreferredBlockedOverlap(ctx) {
+  const preferred = ctx.policy?.preferredModels;
+  const blocked = ctx.policy?.blockedModels;
+  if (!preferred?.length || !blocked?.length) return [];
+  const blockedSet = canonicalPolicySet(blocked);
+  const deadPins = [...new Set(preferred)].filter((p) => policySetHas(blockedSet, p)).sort();
+  if (deadPins.length === 0) return [];
+  const list = deadPins.map((p) => `\`${p}\``).join(", ");
+  const one = deadPins.length === 1;
+  const preferredSet = canonicalPolicySet(preferred);
+  const servedIsPinned = policySetHas(preferredSet, ctx.selectedModelId);
+  return [
+    {
+      level: "warn",
+      code: PREFERRED_MODEL_BLOCKED_CODE,
+      message: `CompilePolicy.preferredModels entr${one ? "y" : "ies"} ${list} ${one ? "is" : "are"} also in \`blockedModels\` (matched canonically, aliases included). A blocked model is hard-rejected before preference boosts apply, so ${one ? "this pin" : "these pins"} can never serve. ` + (servedIsPinned ? `This call was served by \`${ctx.selectedModelId}\`, which is itself a live pin \u2014 the dead entr${one ? "y is" : "ies are"} latent, not currently rerouting traffic.` : `Substitution is your steady state: this call landed on \`${ctx.selectedModelId}\`, which you did not pin.`),
+      suggestion: `Two readings, and kgauto cannot tell them apart: (1) intentional \u2014 your spend gate deliberately outranks the pin, in which case nothing needs doing and you can filter this code; (2) misconfiguration \u2014 the pin and the block were written at different times and the overlap is an accident. tt-intel hit reading (2) on 2026-08-01: a summarize site pinned \`claude-sonnet\` while \`KGAUTO_BLOCKED_MODELS\` carried the same family, and every call silently substituted a reasoning model whose reasoning burn exceeded the site's \`maxOutputTokens\` \u2014 100% empty payloads under HTTP 200. If the block should win, remove the pin so the policy says what it does. If the pin should win, remove ${one ? "the blocking entry" : "the blocking entries"} or re-scope the block to the exact ids you mean. Check what the substitute costs at your input shape while you are here \u2014 a spend gate that lands traffic on a pricier model than the one it blocked is a cost inversion, not a saving.`,
+      docsUrl: DOCS_URL2
+    }
+  ];
+}
+
 // src/advisor.ts
 var QUALITY_FLOOR_FOR_RECOMMENDATION = 6;
 var TIER_DOWN_COST_RATIO = 0.5;
@@ -5071,6 +5233,18 @@ function runAdvisor(ir, result, profile, policy, phase2) {
   out.push(...detectToolBloat(ir, result));
   out.push(...detectHistoryUncached(ir, profile));
   out.push(...detectSingleModelArray(ir, policy));
+  out.push(
+    ...advisorRuleBlockedModelDrift({
+      policy,
+      selectedModelId: profile.id
+    })
+  );
+  out.push(
+    ...advisorRulePreferredBlockedOverlap({
+      policy,
+      selectedModelId: profile.id
+    })
+  );
   if (policy?.posture !== "locked") {
     out.push(...detectCostMismatchedArchetype(ir, profile, phase2));
     out.push(...detectModelStaleEvidence(ir, profile));
@@ -5182,18 +5356,27 @@ function detectHistoryUncached(ir, profile) {
 function detectSingleModelArray(ir, policy) {
   if (ir.models.length !== 1) return [];
   if (policy?.posture === "locked") return [];
-  const only = ir.models[0];
+  const entry = ir.models[0];
+  const only = typeof entry === "string" ? entry : `family:${entry.family}`;
+  const blocked = canonicalPolicySet(policy?.blockedModels);
+  let alternatives = [];
+  try {
+    alternatives = getDefaultFallbackChain({
+      archetype: ir.intent.archetype,
+      primary: only,
+      posture: "preferred",
+      policy
+    }).filter((id) => resolveModelAlias(id) !== resolveModelAlias(only)).filter((id) => !policySetHas(blocked, id)).filter((id) => getModelCompatibility(id, { archetype: ir.intent.archetype }).status !== "reject");
+  } catch {
+  }
+  const hasAlternative = alternatives.length > 0;
+  const remedy = "Widen the chain AND pin your primary: `compile({ ...ir, models: getDefaultFallbackChain({ archetype: ir.intent.archetype, primary: '" + only + "', posture: 'preferred' }) }, { policy: { preferredModels: ['" + only + "'] } })`. The chain is a CANDIDATE SET \u2014 compile() scores it and does not honour its order, so without the `preferredModels` pin the extra entries can retarget your primary (and with it your cost profile). With the pin, `" + only + "` stays primary and the added entries serve only as the safety net. Note `posture` has no effect once `primary` is passed. If you gate models by spend, re-verify `policy.blockedModels` against the widened set before shipping. If single-model is intentional (compliance/brand promise), set `policy.posture = 'locked'` to silence this rule.";
   return [
     {
-      level: "warn",
+      level: hasAlternative ? "critical" : "warn",
       code: "single-model-array",
-      message: `\`ir.models\` has length 1 (only "${only}") and posture is not 'locked'. A single-model chain has no safety net \u2014 the first 429 / 5xx / cliff hits the user as a failure. Master plan \xA71.2 closes the reliability gap with a 2-step minimum.`,
-      // alpha.80: `posture: 'preferred'` keeps the consumer's current model at
-      // position 0 and is therefore cost-neutral; `'open'` re-picks the
-      // primary and is NOT. This rule is about reliability, not cost, so both
-      // stay on offer — but the cost consequence of the second is now stated,
-      // since a reliability fix should not silently become a repricing.
-      suggestion: "Use `getDefaultFallbackChain({ archetype: ir.intent.archetype, primary: '" + only + "', posture: 'preferred' })` for a user-anchored chain \u2014 this keeps `" + only + "` as your primary and only adds fallbacks, so your cost profile is unchanged. `getDefaultFallbackChain({ archetype, posture: 'open' })` instead lets the library pick the PRIMARY, ordered by archetype performance rather than cost \u2014 check what it returns before adopting it. If single-model is intentional (compliance/brand promise), set `policy.posture = 'locked'` to silence this rule.",
+      message: hasAlternative ? `\`ir.models\` has length 1 (only "${only}") for archetype "${ir.intent.archetype}" and posture is not 'locked'. A single-model chain has no safety net \u2014 the first 429 / 5xx / cliff hits the user as a failure \u2014 and a compatible, non-blocked alternative exists in the roster today (${alternatives[0]}), so this is critical: the missing safety net is adoptable now.` : `\`ir.models\` has length 1 (only "${only}") for archetype "${ir.intent.archetype}" and posture is not 'locked'. A single-model chain has no safety net \u2014 the first 429 / 5xx / cliff hits the user as a failure. No compatible non-blocked alternative is visible in the roster for this archetype, so this stays a warning.`,
+      suggestion: remedy,
       docsUrl: "https://github.com/stue/command-center/blob/main/interfaces/kgauto.md#single-model-array"
     }
   ];
@@ -5747,6 +5930,15 @@ function compile(ir, opts = {}) {
       sectionRewritesApplied
     }
   );
+  if (ir["policy"] !== void 0 && opts.policy === void 0) {
+    rawAdvisories.push({
+      level: "critical",
+      code: "policy-in-ir-ignored",
+      message: "The IR passed to compile() carries a `policy` field. `policy` belongs in the SECOND argument \u2014 `compile(ir, { policy })` \u2014 and inside the IR it is an unknown field that is completely ignored. If that policy names blockedModels, no block is being enforced on this call.",
+      suggestion: "Move it: `compile(ir, { policy: { ... } })`. If you also configure policy correctly elsewhere on this path, remove the IR copy so the next reader is not misled.",
+      docsUrl: "https://github.com/stue/command-center/blob/main/interfaces/kgauto.md#public-api"
+    });
+  }
   const advisories = rawAdvisories.map((a) => ({
     ...a,
     kgautoRequestId: handle,
@@ -5865,7 +6057,7 @@ function validateFinalFit(ir, profile, tokens) {
 }
 
 // src/version.ts
-var LIBRARY_VERSION = "2.0.0-alpha.83";
+var LIBRARY_VERSION = "2.0.0-alpha.86";
 
 // src/pricing-brain.ts
 function isPricingRow(x) {
@@ -5976,6 +6168,12 @@ function configureBrain(config) {
       fetchImpl: config.fetchImpl ?? fetch,
       onError: config.onError
     });
+    if (config.appId) {
+      try {
+        void prefetchPromotions(config.appId);
+      } catch {
+      }
+    }
   } else {
     configurePromotionsBrain(void 0);
   }
@@ -6347,6 +6545,7 @@ function buildPayload(input, reg) {
     latency_ms: input.latencyMs,
     success: input.success,
     empty_response: input.emptyResponse ?? input.tokensOut === 0,
+    source: input.source,
     error_type: input.errorType,
     tools_called: input.toolsCalled,
     oracle_score: input.oracleScore?.score,
@@ -7746,7 +7945,11 @@ async function call(ir, opts = {}) {
       )
     })
   );
-  await awaitMeasuredFailureReady(ir.appId, resolveGateWarmupMs(opts));
+  const warmupMs = resolveGateWarmupMs(opts);
+  await Promise.all([
+    awaitMeasuredFailureReady(ir.appId, warmupMs),
+    awaitPromotionsReady(ir.appId, warmupMs)
+  ]);
   const initial = compileAndRegister(ir, opts);
   safeEmit(
     () => emitCompileDone(traceId, ir.appId, {
@@ -7786,6 +7989,7 @@ async function call(ir, opts = {}) {
       const latencyMs2 = Date.now() - start;
       await record({
         handle: initial.handle,
+        source: opts.source,
         tokensIn: 0,
         tokensOut: 0,
         latencyMs: latencyMs2,
@@ -7820,11 +8024,11 @@ async function call(ir, opts = {}) {
   }
   let policyBlockedFiltered;
   if (opts.policy?.blockedModels && opts.policy.blockedModels.length > 0) {
-    const blocked = new Set(opts.policy.blockedModels);
+    const blocked = canonicalPolicySet(opts.policy.blockedModels);
     const filtered = [];
     const dropped = [];
     for (const t of targetsToTry) {
-      if (blocked.has(t)) {
+      if (policySetHas(blocked, t)) {
         dropped.push(t);
       } else {
         filtered.push(t);
@@ -7838,6 +8042,7 @@ async function call(ir, opts = {}) {
       const latencyMs2 = Date.now() - start;
       await record({
         handle: initial.handle,
+        source: opts.source,
         tokensIn: 0,
         tokensOut: 0,
         latencyMs: latencyMs2,
@@ -7864,10 +8069,18 @@ async function call(ir, opts = {}) {
   const failedProviders = /* @__PURE__ */ new Map();
   const sameModelRetryEnabled = opts.sameModelRetry ?? isSameModelRetryEnabledFromEnv();
   let retriedSameModel = false;
+  const pushAttempt = (attempt) => {
+    attempts.push(attempt);
+    if (attempt.status === "success") return;
+    try {
+      opts.onFailedAttempt?.(attempt);
+    } catch {
+    }
+  };
   for (let i = 0; i < targetsToTry.length; i++) {
     const targetModel = targetsToTry[i];
     if (opts.abortSignal?.aborted) {
-      attempts.push({
+      pushAttempt({
         model: targetModel,
         status: "terminal",
         errorCode: "aborted",
@@ -7878,7 +8091,7 @@ async function call(ir, opts = {}) {
     const targetProfile = tryGetProfile(targetModel);
     const providerFailReason = targetProfile ? failedProviders.get(targetProfile.provider) : void 0;
     if (targetProfile && providerFailReason && !opts.noFallback) {
-      attempts.push({
+      pushAttempt({
         model: targetModel,
         status: "terminal",
         errorCode: `${providerFailReason}_inferred`,
@@ -7897,7 +8110,7 @@ async function call(ir, opts = {}) {
           opts
         );
       } catch (err) {
-        attempts.push({
+        pushAttempt({
           model: targetModel,
           status: "terminal",
           errorCode: "compile_error",
@@ -7935,7 +8148,7 @@ async function call(ir, opts = {}) {
     }
     if (!validated.ok && isStructuredContractViolation(validated.errorCode) && sameModelRetryEnabled && !retriedSameModel && !retrySuppressionNote) {
       retriedSameModel = true;
-      attempts.push({
+      pushAttempt({
         model: targetModel,
         status: validated.errorType,
         errorCode: validated.errorCode,
@@ -7950,7 +8163,7 @@ async function call(ir, opts = {}) {
       servedByRetry = true;
     }
     if (validated.ok) {
-      attempts.push({
+      pushAttempt({
         model: targetModel,
         status: "success",
         ...servedByRetry ? { sameModelRetry: true } : {}
@@ -7971,6 +8184,7 @@ async function call(ir, opts = {}) {
       const goldenShapeKey = goldenRate > 0 ? peekRegisteredShapeKey(initial.handle) : void 0;
       await record({
         handle: initial.handle,
+        source: opts.source,
         tokensIn: validated.response.tokens.input,
         tokensOut: validated.response.tokens.output,
         latencyMs: latencyMs2,
@@ -8068,7 +8282,7 @@ async function call(ir, opts = {}) {
         advisories: activeCompile.advisories
       };
     }
-    attempts.push({
+    pushAttempt({
       model: targetModel,
       status: validated.errorType,
       errorCode: validated.errorCode,
@@ -8093,6 +8307,7 @@ async function call(ir, opts = {}) {
   const latencyMs = Date.now() - start;
   await record({
     handle: initial.handle,
+    source: opts.source,
     tokensIn: lastErr?.tokens?.input ?? 0,
     tokensOut: lastErr?.tokens?.output ?? 0,
     latencyMs,
@@ -10588,6 +10803,8 @@ function compile2(ir, opts) {
   ALT_STRATEGY_IDS,
   ARCHETYPE_FAMILY_FITS,
   ARCHETYPE_FLOOR_DEFAULT,
+  BLOCKED_MODEL_FAMILY_SIBLING_SERVED_CODE,
+  BLOCKED_MODEL_NOT_IN_ROSTER_CODE,
   BRAIN_READ_ENV_NAMES,
   BURST_SPAN_MS,
   COACH_CFG,
@@ -10631,6 +10848,7 @@ function compile2(ir, opts) {
   applySectionRewrites,
   attachCacheControlToStreamTextInput,
   awaitMeasuredFailureReady,
+  awaitPromotionsReady,
   brainHealth,
   bucketContext,
   bucketHistory,
@@ -10717,6 +10935,7 @@ function compile2(ir, opts) {
   peekBrainDeadLetter,
   planDecomposition,
   prefetchMeasuredFailure,
+  prefetchPromotions,
   probeShadow,
   profileToRow,
   profilesByProvider,
@@ -10729,6 +10948,7 @@ function compile2(ir, opts) {
   resetTokenizer,
   resolveConventionsForProfile,
   resolveGoldenCaptureRate,
+  resolveModelAlias,
   resolvePricingAt,
   resolveProviderKey,
   rowToAdvisory,