agent-nuvira 3.3.12 → 3.3.14

package/dist/learning/auto-router.js

@@ -40,12 +40,14 @@ import { analyzeComplexity } from './hybrid-router.js';
 import { getTaskType } from './model-router.js';
 import { getBenchmarkRuns } from './benchmark.js';
 import { getAgentStats } from './agent-stats.js';
-import { getRouterBandit, DEFAULT_MIN_SAMPLES } from './router-bandit.js';
+import { getRouterBandit, DEFAULT_MIN_SAMPLES, } from './router-bandit.js';
 import { getRouterPromotion, DEFAULT_MIN_PROMOTION_DECISIONS } from './router-promotion.js';
 import { getMlRouter, DEFAULT_ML_K, DEFAULT_ML_MIN_SAMPLES, DEFAULT_ML_STRENGTH } from './ml-router.js';
 import { buildModelCandidates } from './model-first-router.js';
 import { pickBestModel, topModelCandidates } from './model-scoring.js';
 import { getModelRegistry } from './model-registry.js';
+import { areTwins, classifyPairEntitlement } from './pair-entitlement.js';
+import { effectiveParameter } from './capability-evidence.js';
 // R4: the agentic capability floor needs the same "too small to hold a tool
 // loop" judgement the harness uses. model-harness.ts imports nothing, so this
 // adds no cycle risk to the router.
@@ -62,6 +64,7 @@ import { CATALOG_PROVIDER_IDS, getCatalogProvider, getDefaultModel, isCatalogKey
 import { isContentArtifactAsk } from '../nlu/intent.js';
 import { ProviderFactory } from '../inference/factory.js';
 import { logger } from '../utils/logger.js';
+import { getQuotaLedger } from './quota-ledger.js';
 // ─── Constants ──────────────────────────────────────────────────────────────
 /** The special model value that triggers automatic per-task routing. */
 export const AUTO_MODEL = 'auto';
@@ -242,6 +245,48 @@ export function governanceVerdict(configManager, provider, opts = {}) {
     }
     return { allowed: true };
 }
+export function adminBudgetVerdict(configManager, provider, opts = {}) {
+    if (!configManager)
+        return { allowed: true };
+    // 1. Declared window budget (tokens / requests).
+    try {
+        if (getQuotaLedger().isOverConfiguredLimit(configManager, provider)) {
+            return {
+                allowed: false,
+                control: 'quota',
+                reason: `'${provider}' is over the daily budget you set in ` +
+                    `routing.quota.${provider} (tokens or requests for the current window). ` +
+                    'Raise the limit in the dashboard 💰 Daily Budget panel (or `nuvira model quota set`), ' +
+                    'or wait for the window to reset.',
+            };
+        }
+    }
+    catch {
+        // Best-effort — an unreadable ledger must never block a run.
+    }
+    // 2. Admin cost cap — strictest of the routing + governance caps.
+    try {
+        const routing = configManager.getAll?.()?.routing;
+        const caps = [routing?.maxCostUsd, routing?.governance?.maxCostUsd].filter((c) => c !== undefined);
+        if (caps.length > 0) {
+            const cap = Math.min(...caps);
+            const typical = estimateCallCostUsd(provider);
+            if (typical > cap) {
+                return {
+                    allowed: false,
+                    control: 'cost',
+                    reason: `'${provider}' costs ~$${typical}/call, over the admin cap of $${cap} per call ` +
+                        '(routing.maxCostUsd / routing.governance.maxCostUsd). ' +
+                        'Raise the cap in the dashboard Budget panel, or pick a cheaper provider.',
+                };
+            }
+        }
+    }
+    catch {
+        // Best-effort.
+    }
+    return { allowed: true };
+}
 // ─── Provider Capability Profiles ───────────────────────────────────────────
 //
 // Static baseline profiles for the built-in providers. These encode the
@@ -556,6 +601,36 @@ export function isAutoModel(model) {
 export function isAutoProvider(provider) {
     return provider === AUTO_PROVIDER;
 }
+/**
+ * A CONCRETE provider pinned with the `auto` model sentinel means THAT
+ * provider's OWN auto routing — an OmniRoute gateway combo, say — not
+ * agent-nuvira's provider/model selection.
+ *
+ * This is the distinction behind the `-p omniroute -m auto` collision: the
+ * sentinel was read as the agent's auto-route EVERYWHERE, so the request was
+ * re-routed by our router and never reached the gateway that was named. The
+ * sentinel is provider-owned ONLY when the provider is named and is not itself
+ * the `auto` directive; `-m auto` with no provider (or `-p auto`) stays our
+ * auto-route exactly as before.
+ */
+export function isProviderOwnAuto(provider, model) {
+    if (!provider || isAutoProvider(provider) || !isAutoModel(model))
+        return false;
+    // …and the provider must ACTUALLY expose its own `auto`. The first cut returned
+    // true for ANY concrete provider (`-p groq -m auto`, `-p local -m auto`, …),
+    // which left the sentinel unresolved and handed the literal string `auto` to a
+    // provider that has no such model — a live 400 waiting to happen, and the cause
+    // of a verify-probe + real call (the same request paid for twice). Only a
+    // gateway whose catalog default IS `auto` (OmniRoute, and anything configured
+    // the same way) owns the sentinel; every other provider gets a real model id.
+    return getDefaultModel(provider) === 'auto';
+}
+/** Agent-nuvira's OWN auto routing: the `auto` directive on either axis, minus
+ *  the provider-owned case — use this where a decision would otherwise
+ *  re-route a concretely pinned provider. */
+export function isAgentAutoRoute(provider, model) {
+    return !isProviderOwnAuto(provider, model) && (isAutoProvider(provider) || isAutoModel(model));
+}
 /**
  * Compute the effective dimension weights for a task.
  * Combines complexity baseline + preference-mode adjustments + user overrides,
@@ -630,7 +705,23 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['content (non-code) task detected'],
         };
     }
-    if (/migrat(e|ion)|upgrade|refactor|pipeline|deployment/.test(text)) {
+    // ── THE INTENT RULES MATCH WHOLE WORDS (B2 sweep) ───────────────────────
+    //
+    // These were unanchored alternations, so a FRAGMENT of an ordinary word
+    // decided the intent. Demonstrated against the built `dist`: "add a **prefix**
+    // constant to the config" and "create a **fixture** file for the tests" both
+    // classified as `debugging` (because `fix` is inside them), earning a
+    // verification pass and an openrouter escalation; "the provider **ecosystem**"
+    // classified as `architecture` (`system` inside it) with a gemini escalation;
+    // "**plant** a tree" classified as `planning`. It is the same class of defect
+    // as B2's `desc.includes('hi')` — a substring is not a word.
+    //
+    // The fix is a boundary PLUS the inflections the rule actually wants, because a
+    // bare `\b` does not help when the fragment sits at the START of a word:
+    // `\bfix\w*\b` still matches "fixture". So `fix` is spelled out
+    // (`fix|fixes|fixed|fixing|fixer|fixup`) and `plan` likewise (so `plant` is not
+    // a plan). Nothing else changed — same rules, same ORDER, same intents.
+    if (/\bmigrat(?:e|ion)\w*\b|\bupgrade\w*\b|\brefactor\w*\b|\bpipeline\w*\b|\bdeployment\w*\b/.test(text)) {
         return {
             intent: 'migration',
             requiresVerification: true,
@@ -638,7 +729,8 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['migration-related task detected'],
         };
     }
-    if (/architect|architecture|design|system|microservice|platform/.test(text) && !/outline|plan|roadmap|strategy/.test(text)) {
+    if (/\barchitect\w*\b|\bdesign\w*\b|\bsystem\w*\b|\bmicroservice\w*\b|\bplatform\w*\b/.test(text) &&
+        !/\b(?:outline|plan|roadmap|strategy)\w*\b/.test(text)) {
         return {
             intent: 'architecture',
             requiresVerification: true,
@@ -646,7 +738,15 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['architecture-focused task detected'],
         };
     }
-    if (/verify|verification|validate|rollout|deploy|production|launch|release/.test(text)) {
+    // `verif(?:y|ies|ying|ication|ications)` — the ASK forms — and deliberately NOT
+    // `verified`. Bounding this rule surfaced why: a bare `\bverif\w*\b` would also
+    // match the past participle, and "the build was verified" is a STATUS REPORT,
+    // not a verification task, so it must not buy a reviewer pass and an
+    // openrouter escalation. Measured: that narrower spelling changes the intent of
+    // ZERO of the 161 tasks in the local routing history, where `\bverif\w*\b`
+    // changed one (a past-tense status message) — so the conservative form is the
+    // one that fixes the fragment bug without moving any real decision.
+    if (/\bverif(?:y|ies|ying|ication|ications)\b|\bvalidat\w*\b|\brollout\w*\b|\bdeploy\w*\b|\bproduction\w*\b|\blaunch\w*\b|\brelease\w*\b/.test(text)) {
         return {
             intent: 'verification',
             requiresVerification: true,
@@ -654,7 +754,7 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['verification-related task detected'],
         };
     }
-    if (/security|audit|vulnerab|threat|exploit/.test(text)) {
+    if (/\bsecurit\w*\b|\baudit\w*\b|\bvulnerab\w*\b|\bthreat\w*\b|\bexploit\w*\b/.test(text)) {
         return {
             intent: 'security',
             requiresVerification: true,
@@ -662,7 +762,7 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['security-sensitive task detected'],
         };
     }
-    if (/debug|bug|error|fix|trace/.test(text)) {
+    if (/\bdebug\w*\b|\bbug\w*\b|\berror\w*\b|\bfix(?:es|ed|ing|er|up)?\b|\btrace\w*\b/.test(text)) {
         return {
             intent: 'debugging',
             // C4 — a debug/build-fix task is not done until the fix is OBSERVED to
@@ -676,7 +776,7 @@ export function analyzeTaskProfile(taskDescription) {
             notes: ['debugging task detected'],
         };
     }
-    if (/plan|outline|roadmap|strategy/.test(text)) {
+    if (/\bplan(?:s|ned|ning|ner)?\b|\boutline\w*\b|\broadmap\w*\b|\bstrateg\w*\b/.test(text)) {
         return {
             intent: 'planning',
             requiresVerification: false,
@@ -723,6 +823,14 @@ export function scoreProvider(provider, capabilities, weights) {
  */
 export class AutoModelRouter {
     profiles;
+    /**
+     * The attribution of the LAST recorded outcome, kept so a user correction that
+     * arrives with the next message ("still broken") can be applied to the turn it
+     * is actually about. The bandit's own `getLastProvider`/`getLastModel` are
+     * overwritten by the next resolve(), so the pair must be captured HERE, at
+     * record time — see `recordUserRejection`.
+     */
+    pendingOutcome = null;
     constructor(profiles) {
         this.profiles = profiles ? { ...DEFAULT_PROFILES, ...profiles } : { ...DEFAULT_PROFILES };
     }
@@ -754,97 +862,57 @@ export class AutoModelRouter {
     /**
      * MODEL-LEVEL capability refinement (model-first-router parity): the
      * provider's capability profile is a BASELINE — the model actually served
-     * may be much stronger or weaker. Refines the provider caps with evidence
-     * from the model id the router will serve for THIS task (resolveModel:
+     * may be much stronger or weaker. Refines the provider caps with MEASURED
+     * evidence about the model the router will serve for THIS task (resolveModel:
      * the configured pin, or the task-resolved best model via pickBestModel).
      *
-     * Evidence signals (all derived from the model id + registry measurements,
-     * no network):
-     *   - parameter-size hints: larger parameter counts (70b > 13b > 8b > 3b/1b)
-     *     raise reasoning; tiny param counts lower it;
-     *   - tier words: 'large'/'max'/'opus'/'70b'/… raise; 'mini'/'tiny'/'small'/
-     *     'instant'/'flash'/'nano'/'lite' lower reasoning (flash/instant also
-     *     RAISE speed — they are speed-optimized models);
-     *   - frontier-keyword families (gpt-4/5-class, claude-3/4-class,
-     *     gemini-2-class, deepseek-r1, llama-70b) raise reasoning;
-     *   - registry latency: a model measured much slower than its provider
-     *     baseline suggests a heavyweight (raises reasoning, lowers speed) and
-     *     vice versa.
+     * B1/B4 (Bundle 3b, 2026-10-07) — THE NAME NO LONGER CONTRIBUTES ANYTHING.
+     *
+     * What used to be here: a fast-tier word list (`mini`/`tiny`/`small`/`nano`/
+     * `lite`/`instant`/`flash`/`turbo`/`haiku`) SUBTRACTING 0.1 per word, a
+     * slow-tier list (`large`/`max`/`opus`/`pro`/`ultra`/`frontier`) adding 0.15, a
+     * parameter-size table (`70b` +0.45 … `≤4b` −0.2), and frontier-family
+     * keywords (+0.2). All of it is REMOVED, not capped: a capped name hint is
+     * still a name judgement, and the programme's own investigation fell into the
+     * trap — it called DeepSeek V4.1 Flash weak *because of the word "flash"*
+     * while that model served an 82-step build. It also made max mode's reasoning
+     * floor a spelling test, so `gemini-3.1-flash-lite` was excluded for its name
+     * and a 70B id on a weak provider was admitted for its name.
+     *
+     * What replaces it: the MEASURED scorecard (`learning/capability-evidence.ts`),
+     * stored per provider × model in the registry. `accuracy` replaces the id
+     * reasoning hints and `performance` replaces the id speed hints, both blended
+     * against this provider's declared baseline as the cold-start PRIOR:
+     *
+     *   - 0 samples → the provider baseline, byte-for-byte. Nothing that has never
+     *     been measured changes behaviour, and two ids differing only by a tier
+     *     word score IDENTICALLY (B1's acceptance) because the prior is
+     *     provider-level and cannot see the id;
+     *   - ≥ MIN_SAMPLES → the measured value, with the prior's weight decaying to
+     *     zero by `PRIOR_FULL_SAMPLES`.
      *
-     * Deliberately CONSERVATIVE: adjustments clamp to ±0.35 and never cross the
-     * 0..1 bounds; an unknown model id returns the provider baseline unchanged
-     * (the gate then behaves exactly as before — no behavior change for
-     * unresolvable evidence). Deterministic: same inputs → same caps.
+     * B4 follows from that: max mode's floor is now applied to measured accuracy,
+     * so a pair is excluded for what it has DONE, not for what it is called.
      */
     getModelCapabilities(provider, model) {
         const base = { ...this.getCapabilities(provider) };
         if (!model || model === 'default')
             return base;
-        const m = model.toLowerCase();
-        let reasoningAdj = 0;
-        let speedAdj = 0;
-        // Parameter-size evidence. The >=60B boost is deliberately large enough to
-        // lift a genuine 70B model on a WEAK provider baseline (local 0.30 + 0.45 =
-        // 0.75) over the C4 verification reasoning floor — otherwise a capable local
-        // 70B model would be dropped for a build-debug ask while a cloud fast-lite
-        // model slips through. It never affects SCORING (this method feeds the
-        // constraint gate only), just who is eligible.
-        const params = /(\d+(?:\.\d+)?)b(?:\b|-|$)/.exec(m);
-        if (params) {
-            const b = parseFloat(params[1]);
-            if (b >= 60)
-                reasoningAdj += 0.45;
-            else if (b >= 30)
-                reasoningAdj += 0.15;
-            else if (b >= 12)
-                reasoningAdj += 0.05;
-            else if (b <= 4) {
-                reasoningAdj -= 0.2;
-                speedAdj += 0.15; // tiny models are fast
-            }
-        }
-        // Tier-word evidence. A fast-tier word LOWERS reasoning and RAISES speed;
-        // STACKED fast-tier markers are penalized PER WORD, so `gemini-3.1-flash-lite`
-        // (flash + lite) lands below the C4 verification reasoning floor while a
-        // single `-flash` id stays above it. This stacked-token penalty is what makes
-        // "don't serve a flash-lite model for a build-debug ask" expressible as a
-        // reasoning floor rather than a brittle id denylist.
-        const SLOW_TIER = /\b(large|max|opus|pro|ultra|frontier)\b/;
-        const FAST_TIER = /\b(mini|tiny|small|nano|lite|instant|flash|turbo|haiku)\b/g;
-        if (SLOW_TIER.test(m))
-            reasoningAdj += 0.15;
-        const fastTierHits = m.match(FAST_TIER)?.length ?? 0;
-        if (fastTierHits > 0) {
-            reasoningAdj -= 0.1 * fastTierHits;
-            speedAdj += 0.15;
-        }
-        // Frontier-family evidence (keyword match on the id).
-        if (/\b(gpt-[45]|o[134](?:-|$)|claude-[34]|gemini-2|deepseek-r1|qwen3|qwen-3)\b/.test(m) ||
-            /gpt-4|gpt-5|claude-3|claude-4|gemini-2/.test(m)) {
-            reasoningAdj += 0.2;
-        }
-        // Registry latency evidence: measured latency far from the provider
-        // baseline's implied speed. 0.5s ≈ fast tier, 10s+ ≈ heavyweight.
         try {
-            const entry = getModelRegistry().getEntry(provider, model);
-            if (entry?.latencyMs) {
-                if (entry.latencyMs >= 10_000) {
-                    reasoningAdj += 0.1;
-                    speedAdj -= 0.1;
-                }
-                else if (entry.latencyMs <= 800) {
-                    speedAdj += 0.1;
-                }
-            }
+            const record = getModelRegistry().getCapability(provider, model);
+            const accuracy = effectiveParameter(record, 'accuracy', base.reasoning);
+            const performance = effectiveParameter(record, 'performance', base.speed);
+            return {
+                ...base,
+                reasoning: Math.min(1, Math.max(0, accuracy.value)),
+                speed: Math.min(1, Math.max(0, performance.value)),
+            };
         }
         catch {
-            // Registry unavailable — id evidence only.
+            // Registry unavailable — the provider baseline stands (never a race for a
+            // capability read: the gate must behave exactly as it did before).
+            return base;
         }
-        return {
-            ...base,
-            reasoning: Math.min(1, Math.max(0, base.reasoning + reasoningAdj)),
-            speed: Math.min(1, Math.max(0, base.speed + speedAdj)),
-        };
     }
     /**
      * Default candidate providers — DYNAMIC (Issue 001): every provider the user
@@ -1548,6 +1616,17 @@ export class AutoModelRouter {
         let routedBy = 'heuristic';
         let banditEscalation = false;
         let escalatedProvider;
+        /**
+         * P6 (fix_model_routing) — did the bandit's data actually inform this pick?
+         *
+         * `routedBy = 'bandit'` is set the moment `useBandit` is on, and the
+         * explanation then says `bandit-learned` — even when the arm has no samples
+         * at all (a cold-start prior, whose constant 0.5 multiplier cannot reorder
+         * anything) and even when the whole store is stale. The label is a claim
+         * about evidence, so it is only made when there IS evidence: samples for the
+         * winning arm, or a real uncertainty-driven escalation.
+         */
+        let banditInformed = false;
         if (options.useBandit) {
             const bandit = getRouterBandit();
             // v3 — the learning bucket is task-INTENT-aware. Derive the intent from
@@ -1578,6 +1657,13 @@ export class AutoModelRouter {
             const minSamples = options.escalationMinSamples ?? DEFAULT_MIN_SAMPLES;
             const winner = scored.find((s) => !s.inCooldown) || scored[0];
             const winnerPrior = bandit.getPrior(winner.provider, complexity, analyzedProfile.intent);
+            // The concrete model is resolved LATER in this method (after the model-first
+            // override), so the verdict is made on the provider arm — the arm every
+            // provider-level sample lands in, and the one the pre-model-first pick is
+            // actually driven by.
+            banditInformed =
+                !bandit.isStale() &&
+                    bandit.hasLearnedData(winner.provider, complexity, analyzedProfile.intent);
             if (winnerPrior.alpha + winnerPrior.beta < minSamples) {
                 // S5: never escalate DOWNWARD in capability. The bandit's learned
                 // priors come from past sessions (often coding-heavy local usage), so
@@ -1597,6 +1683,9 @@ export class AutoModelRouter {
                     })());
                 if (learnedAlternative) {
                     banditEscalation = true;
+                    // An escalation IS learned behaviour by construction — it fired
+                    // BECAUSE the alternative has accumulated data.
+                    banditInformed = !bandit.isStale();
                     escalatedProvider = learnedAlternative.provider;
                     if (options.verbose) {
                         logger.info(`  🎲 Bandit uncertainty: ${winner.provider} has no learning data (α+β=${winnerPrior.alpha + winnerPrior.beta}) — escalating to learned ${learnedAlternative.provider} (win-rate ≥ ${ESCALATION_WIN_RATE_FLOOR})`);
@@ -1733,6 +1822,78 @@ export class AutoModelRouter {
         catch {
             // Best-effort — model-first must never break routing
         }
+        // ── PAIR ENTITLEMENT: is the pick ALLOWED to be called? (D7) ────────────
+        // The user's rule, verbatim: "suppose we have 4 providers and everyone
+        // provides deepseek — only one provider's key actually provides deepseek,
+        // where as the user has not purchased model access on the other providers or
+        // there is no free tokens offered by those providers… the rank of a model can
+        // be the same, but the agent should only pick, or only be allowed to access,
+        // the one which has a genuine token budget available, rather than going for
+        // rounds unnecessarily."
+        //
+        // Ranking cannot express that, and it should not try: rank is a property of
+        // the MODEL, while access is a property of the ACCOUNT serving it. So the
+        // pick made above is re-checked against the registry's OWN evidence for
+        // exactly this pair, and when that evidence is a refusal the router looks for
+        // the same model on a provider that can actually serve it. Two ordered
+        // attempts, then out:
+        //   1. a FUNDED TWIN of the same model (the reported case: identical rank,
+        //      one funded account) — chosen through `getAllUsablePairs()`, which is
+        //      built on the SAME `isUsable()` gate routing uses, so this can never
+        //      name a pair the router would itself reject;
+        //   2. otherwise the top-ranked provider whose served pair is not refused, so
+        //      a dead pin on one provider does not cost a round trip before the
+        //      fallback walk starts.
+        // If neither exists the original pick stands — a refusal we cannot route
+        // around must not become "return no route at all".
+        let entitlementRescue;
+        try {
+            const registry = getModelRegistry();
+            if (classifyPairEntitlement(registry.getEntry(provider, model)) === 'refused') {
+                const from = `${provider}/${model}`;
+                const fundedTwin = registry
+                    .getAllUsablePairs()
+                    .find((p) => p.provider !== provider && areTwins(p.model, model));
+                if (fundedTwin) {
+                    provider = fundedTwin.provider;
+                    model = fundedTwin.model;
+                    entitlementRescue = {
+                        from,
+                        to: `${provider}/${model}`,
+                        why: 'the pinned pair is refused by its account; the same model is funded here',
+                    };
+                }
+                else {
+                    const alternative = scored.find((s) => {
+                        if (s.inCooldown)
+                            return false;
+                        if (s.provider === provider)
+                            return false;
+                        try {
+                            return (classifyPairEntitlement(registry.getEntry(s.provider, this.resolveModel(s.provider, agentType, configManager, taskDescription))) !== 'refused');
+                        }
+                        catch {
+                            return false;
+                        }
+                    });
+                    if (alternative) {
+                        provider = alternative.provider;
+                        model = this.resolveModel(provider, agentType, configManager, taskDescription);
+                        entitlementRescue = {
+                            from,
+                            to: `${provider}/${model}`,
+                            why: 'the selected pair is refused by its account; this provider is not',
+                        };
+                    }
+                }
+                if (entitlementRescue && options.verbose) {
+                    logger.warn(`  ⛔ Pair entitlement: ${entitlementRescue.from} cannot serve this model — using ${entitlementRescue.to} (${entitlementRescue.why})`);
+                }
+            }
+        }
+        catch {
+            // Best-effort — the entitlement gate must never break routing.
+        }
         // Note the decision so outcome recording (recordOutcome) can reward the
         // provider that actually served the task.
         if (options.useBandit) {
@@ -1766,22 +1927,76 @@ export class AutoModelRouter {
         // burning through all of its fallbacks.
         const fallbackChain = [];
         const seenFallback = new Set();
+        /**
+         * D6 — THE OFFERED CHAIN OBEYS THE SAME GATE THE PICK DOES.
+         *
+         * "Every provider contributes MULTIPLE models" is right, but the models it
+         * contributed were never asked whether they could work. Measured on a live
+         * `model explain`: the chain offered `openrouter/~deepseek/deepseek-pro-latest`
+         * and `openrouter/~deepseek/deepseek-flash-latest` — both `unverified` alias
+         * ids — with the same confident `Fallback (alternate model on openrouter)`
+         * label as a proven model. A pair the registry has already proven dead
+         * (`unavailable` — a 404, a dead key, an unfunded account) was offered the
+         * same way, and `model list`/`models explain` are where an operator decides
+         * what to pin next.
+         *
+         * Two different verdicts, two different treatments, and the distinction is
+         * the product's own doctrine (`model-reachability.ts`):
+         *   - `unavailable` is a NO. It is not offered at all — recommending a pair a
+         *     real call already established cannot work is telling the operator to
+         *     walk into a wall.
+         *   - `unverified` is an UNKNOWN, not a failure. It stays (a weak candidate
+         *     beats no candidate, and "nothing tried yet" is exactly what a reserve
+         *     pool is for) but it is LABELLED as unproven, so the confidence in the
+         *     label matches the evidence behind it.
+         *
+         * The reserve passes below already label themselves this way; passes 1–3 did
+         * not, which is where the unproven ids leaked in.
+         *
+         * D7 (2026-10-07) — THE PAIR'S RIGHT TO BE CALLED, not just its status.
+         * The gate above reads `status`, and `status` cannot see the case the user
+         * reported: four providers offer the same model, one key has access to it,
+         * and the other three have no model access and no free tokens. A refusal like
+         * that does NOT demote a `verified` entry (the registry keeps the latch
+         * because a top-up repairs it), so such a pair reads `verified` with a `402`
+         * in `lastError` — offerable by the old check. `classifyPairEntitlement`
+         * decides from the EVIDENCE (this pair's own row) instead, and a refused pair
+         * is not offered at all while anything else can be. Read it per PAIR: twins
+         * on different providers are different ACCOUNTS with opposite verdicts, and
+         * neither inherits the other's.
+         */
         const pushFallback = (s, model, alternate) => {
             const key = `${s.provider}|${model}`;
             if (seenFallback.has(key))
                 return;
+            let entry;
+            try {
+                entry = getModelRegistry().getEntry(s.provider, model);
+            }
+            catch {
+                // Best-effort — the reachability gate must never break routing.
+            }
+            const entitlement = classifyPairEntitlement(entry);
+            // A refusal is a NO (D7); an `unavailable` entry for any other reason is
+            // the reachability NO the D6 gate already encoded.
+            if (entitlement === 'refused' || entry?.status === 'unavailable')
+                return;
             seenFallback.add(key);
+            const unproven = entitlement === 'unknown';
+            const stalledNote = entitlement === 'stalled' ? ' (stalled — proven once, not servable right now)' : '';
             fallbackChain.push({
                 provider: s.provider,
                 model,
                 estimatedCost: 0,
                 qualityScore: s.score,
                 contextWindowTokens: s.contextWindowTokens,
-                reason: alternate
-                    ? `Fallback (alternate model on ${s.provider})`
-                    : s.inCooldown
-                        ? `Fallback (in cooldown): ${s.provider}`
-                        : `Fallback: ${s.provider}`,
+                reason: unproven
+                    ? `Fallback (unverified — not yet proven${alternate ? `, alternate model on ${s.provider}` : `: ${s.provider}`})`
+                    : alternate
+                        ? `Fallback (alternate model on ${s.provider})${stalledNote}`
+                        : s.inCooldown
+                            ? `Fallback (in cooldown): ${s.provider}${stalledNote}`
+                            : `Fallback: ${s.provider}${stalledNote}`,
             });
         };
         const modelsFor = (s) => this.fallbackModelsFor(s.provider, agentType, configManager, taskDescription, complexity);
@@ -1880,7 +2095,19 @@ export class AutoModelRouter {
         }
         const explanation = this.buildExplanation(agentType, complexity, taskType, provider, decisionScore, mode, model, weights, taskProfile) +
             (weakModelForAgenticAsk ? ' | ⚠ weak-model fallback (no capable provider free)' : '') +
-            (routedBy === 'bandit' ? ' | bandit-learned' : '') +
+            (entitlementRescue
+                ? ` | ⛔ ${entitlementRescue.from} is refused by its account — served by ${entitlementRescue.to}`
+                : '') +
+            // P6 — say what actually happened. A cold-start or stale store gets NO
+            // claim of learning: the deterministic ranking stands, and the user is told
+            // that instead of being told "learned" about a prior nobody has ever
+            // updated. Silent-about-nothing would be worse still — the absence of the
+            // old label is only honest if the reason is named.
+            (routedBy === 'bandit'
+                ? banditInformed
+                    ? ' | bandit-learned'
+                    : ' | bandit cold-start (no learned samples for this task bucket — the deterministic ranking stands)'
+                : '') +
             (banditEscalation ? ' | escalated: winner unlearned' : '') +
             // ISSUE-002 explanation transparency: cite the registry data that
             // excluded providers from the candidate pool, so auto routing proves
@@ -1934,6 +2161,8 @@ export class AutoModelRouter {
             agenticCapable: isAgenticCapableModel(model, provider),
             overrideReason,
             banditEscalation,
+            // P6 — whether the bandit's data informed this pick (see `banditInformed`).
+            banditInformed,
             governanceBlocked,
             registryExcluded,
             contextPreflight,
@@ -2004,6 +2233,15 @@ export class AutoModelRouter {
      * @param outcome    success | failure | escalated
      * @param configManager Optional — used to resolve per-provider pricing
      *                       overrides when computing the cost-adjusted reward
+     * @param outcomeData   The MEASURED outcome telemetry for the reward model —
+     *                       `testPassed` / `userAccepted` / `verificationPassed` /
+     *                       `qualityScore`. Typed as the bandit's own
+     *                       `Partial<BanditOutcomeData>` so the harness cannot
+     *                       collect a signal this path has no parameter for: the
+     *                       three honesty fields previously had nowhere to go, so
+     *                       every caller passed `undefined` and the reward model
+     *                       they feed — the ONLY measured-quality input the router
+     *                       has — was dead on the real path.
      */
     recordOutcome(agentType, taskDescription, outcome, configManager, outcomeData, complexityHint) {
         const bandit = getRouterBandit();
@@ -2017,20 +2255,20 @@ export class AutoModelRouter {
         // versa. Mirrors the select-time derivation exactly.
         const learnIntent = analyzeTaskProfile(taskDescription).intent;
         if (complexityHint) {
-            bandit.recordOutcomeWithComplexity(provider, complexityHint, outcome, costScore, undefined, learnIntent);
+            bandit.recordOutcomeWithComplexity(provider, complexityHint, outcome, costScore, outcomeData, learnIntent);
         }
         else {
-            bandit.recordOutcome(provider, taskDescription, outcome, costScore, undefined, learnIntent);
+            bandit.recordOutcome(provider, taskDescription, outcome, costScore, outcomeData, learnIntent);
         }
         // Per-modelId learning: attribute the same outcome to the concrete model
         // that served the task (ruflo ADR-149 mirror) so the model choice learns.
         const model = bandit.getLastModel(agentType);
         if (model) {
             if (complexityHint) {
-                bandit.recordModelOutcomeWithComplexity(model, complexityHint, outcome, costScore, undefined, learnIntent);
+                bandit.recordModelOutcomeWithComplexity(model, complexityHint, outcome, costScore, outcomeData, learnIntent);
             }
             else {
-                bandit.recordModelOutcome(model, taskDescription, outcome, costScore, undefined, learnIntent);
+                bandit.recordModelOutcome(model, taskDescription, outcome, costScore, outcomeData, learnIntent);
             }
         }
         // Promotion gate: finalize the parallel A/B decision with the real outcome
@@ -2053,6 +2291,46 @@ export class AutoModelRouter {
         catch {
             // Best-effort — ML recording must never break outcome handling.
         }
+        // Remember WHAT this outcome was attributed to, so a correction arriving with
+        // the NEXT user message lands on the turn it is about rather than on whoever
+        // serves the next turn. Overwritten by the next recordOutcome, which is exactly
+        // right: a correction speaks about the most recent judged turn.
+        this.pendingOutcome = {
+            agentType,
+            provider,
+            model: bandit.getLastModel(agentType),
+            complexity: complexityHint ?? analyzeComplexity(taskDescription),
+            intent: analyzeTaskProfile(taskDescription).intent,
+            outcome,
+        };
+    }
+    /**
+     * Apply the user's verdict on the PREVIOUS turn.
+     *
+     * A regression report in the user's next message ("still broken", "no change",
+     * "doesn't work") IS `userAccepted: false` for the turn that just ran — the one
+     * measured-quality input the reward model has that nothing on the real path ever
+     * filled in. It cannot be part of that turn's own observation (it does not exist
+     * until the user speaks again), so it is applied here, to the pair captured at
+     * record time, as the exact deferred delta (see `RouterBandit.recordUserRejection`).
+     *
+     * @returns True when a correction was applied to a still-pending outcome.
+     */
+    recordUserRejection(agentType) {
+        const pending = this.pendingOutcome;
+        if (!pending || pending.agentType !== agentType)
+            return false;
+        // Clear FIRST: one correction must never be applied twice, even if the bandit
+        // write throws.
+        this.pendingOutcome = null;
+        try {
+            getRouterBandit().recordUserRejection(pending.provider, pending.complexity, pending.outcome, pending.intent, pending.model);
+        }
+        catch {
+            // Learning is best-effort — never break a turn on a bandit error.
+            return false;
+        }
+        return true;
     }
     /**
      * Choose the concrete model within the selected provider using per-model