audit-tools 0.34.3 → 0.34.6

package/dist/shared/providers/sharedProviderConfirmation.js

@@ -47,8 +47,10 @@ import { auditToolsDir } from "../io/auditToolsPaths.js";
 import { readJsonFile, writeJsonFile } from "../io/json.js";
 import { withFileLock } from "../quota/fileLock.js";
 import { discoverProviders, annotateConfirmedPool, representativeModelId, } from "./providerConfirmation.js";
-import { backendIdentity, transportRoute } from "./identity.js";
+import { backendIdentity, exclusionPattern, serviceExclusionPattern, } from "./identity.js";
 import { resolveConfirmedCostPositions } from "../dispatch/costRank.js";
+import { gatherDispatchableSources } from "../quota/apiPool.js";
+import { resolveFreshSessionProviderName } from "./providerFactory.js";
 import { PROVIDER_CONFIRMATION_INPUT_VERSION } from "../types/providerConfirmation.js";
 // ---------------------------------------------------------------------------
 // Version + on-disk location
@@ -98,6 +100,10 @@ function toPersistedPoolEntry(entry) {
         name: entry.name,
         ...(entry.model_id !== undefined ? { model_id: entry.model_id } : {}),
         ...(entry.cost_order !== undefined ? { cost_order: entry.cost_order } : {}),
+        // The capability-evidence decision persists (it is a DECISION, not reach) — and it
+        // must be carried explicitly: this builder reconstructs field-by-field, so a field
+        // absent here is silently dropped on every round-trip.
+        ...(entry.capability_rank !== undefined ? { capability_rank: entry.capability_rank } : {}),
     };
 }
 function sortNames(names) {
@@ -144,9 +150,24 @@ function sortStrings(values) {
  *   passed via the dedicated params above (the executor forwards them from the
  *   same input), so this arg governs ordering + host roster only.
  */
-export function buildProviderConfirmationRender(sessionConfig = {}, env = process.env, exclude = [], include = [], detectCommand, input, sources = []) {
+export function buildProviderConfirmationRender(sessionConfig = {}, env = process.env, exclude = [], include = [], detectCommand, input, sources = [], 
+/**
+ * Gate-authored fail-closed patterns, kept SEPARATE from the operator's `exclude`
+ * so provenance survives to disk (see {@link ConfirmedDispatchPolicy.auto_exclude}).
+ * Both kinds mark a pool entry excluded in the render — the split governs lifetime,
+ * not enforcement — so the two are unioned for the display/routing decision below
+ * and only split again when the policy is persisted.
+ */
+autoExclude = [], 
+/**
+ * R3-3: the FINAL `capability_order_llm_ranked` set for this promotion (already
+ * advanced across rule 1/2 by the caller — {@link advanceCapabilityOrderLlmRanked}).
+ * Persisted verbatim into the policy; empty for the display-only "suggested"
+ * render nextStepCommand builds (that call never persists, so provenance is moot).
+ */
+capabilityOrderLlmRanked = []) {
     const discovered = discoverProviders(sessionConfig, env, detectCommand);
-    const operatorExcluded = buildExclusion(exclude);
+    const operatorExcluded = buildExclusion(migrateExclusionPatterns([...exclude, ...autoExclude]));
     const includeSet = new Set(include);
     // Evaluate a pool entry against the operator's rules at the SAME key the routing
     // filter uses — `representativeModelId` is what `computeNewlyReachableBackends`
@@ -212,7 +233,11 @@ export function buildProviderConfirmationRender(sessionConfig = {}, env = proces
         ...(clampDispatchBias(input?.dispatch_bias) != null
             ? { dispatch_bias: clampDispatchBias(input?.dispatch_bias) }
             : {}),
-        ...(buildConfirmedDispatchPolicy(exclude, include) ?? {}),
+        ...(buildConfirmedDispatchPolicy(exclude, include, autoExclude, 
+        // The operator's RAW capability answer, persisted verbatim so the next
+        // carry-forward reads back what they SAID rather than re-deriving it from the
+        // ranks it produced (which cannot distinguish it from external evidence).
+        input?.capability_order ?? [], capabilityOrderLlmRanked) ?? {}),
     };
 }
 /**
@@ -220,13 +245,28 @@ export function buildProviderConfirmationRender(sessionConfig = {}, env = proces
  * persisted policy half. Returns `undefined` when the operator named neither list
  * (so the field stays absent rather than persisting an empty shell).
  */
-function buildConfirmedDispatchPolicy(exclude, include) {
-    if (exclude.length === 0 && include.length === 0)
+function buildConfirmedDispatchPolicy(exclude, include, autoExclude = [], capabilityOrder = [], capabilityOrderLlmRanked = []) {
+    if (exclude.length === 0 &&
+        include.length === 0 &&
+        autoExclude.length === 0 &&
+        capabilityOrder.length === 0 &&
+        capabilityOrderLlmRanked.length === 0) {
         return undefined;
+    }
     return {
         policy: {
             ...(exclude.length > 0 ? { exclude: sortStrings(exclude) } : {}),
+            // Sorted like its sibling — an auto-exclusion is a set membership, order-free.
+            ...(autoExclude.length > 0 ? { auto_exclude: sortStrings(autoExclude) } : {}),
             ...(include.length > 0 ? { include: sortNames(include) } : {}),
+            // NOT sorted, NOT deduped by sortStrings: this is a positional ORDERING, and
+            // sorting it would destroy the operator's answer outright.
+            ...(capabilityOrder.length > 0 ? { capability_order: [...capabilityOrder] } : {}),
+            // An AUTHORSHIP SET, not an ordering — sorted like `exclude`/`auto_exclude` so
+            // an incidentally-ordered array never churns the artifact's content hash.
+            ...(capabilityOrderLlmRanked.length > 0
+                ? { capability_order_llm_ranked: sortStrings(capabilityOrderLlmRanked) }
+                : {}),
         },
     };
 }
@@ -332,7 +372,8 @@ export function computeNewlyReachableBackends(confirmation, sessionConfig, sourc
     // source distinguishes them. The identity keys on the backend, the rule on the
     // transport — see `backendIdentity`.
     const record = (modelId, provider, backendProvider) => {
-        const identity = backendIdentity(modelId, backendProvider ?? provider);
+        const service = backendProvider ?? provider;
+        const identity = backendIdentity(modelId, service);
         // First writer wins: when a proxied lane and a direct lane resolve to the SAME
         // backend identity, they are one backend reached two ways, and the rule kept is
         // the one that rules out the lane already recorded.
@@ -341,7 +382,9 @@ export function computeNewlyReachableBackends(confirmation, sessionConfig, sourc
         reachNow.set(identity, {
             key: identity,
             provider,
-            exclusion_pattern: transportRoute(modelId, provider),
+            service,
+            exclusion_pattern: exclusionPattern(modelId, provider),
+            service_exclusion_pattern: serviceExclusionPattern(modelId, service),
         });
     };
     for (const provider of discoverProviders(sessionConfig, env, detectCommand)) {
@@ -377,11 +420,17 @@ export function computeNewlyReachableBackends(confirmation, sessionConfig, sourc
  */
 export function resolveDispatchExclusion(policy, env = process.env) {
     const included = new Set(policy?.include ?? []);
-    // The local reach half: a self-spawn-blocked provider is ruled out at PROVIDER
-    // granularity (blockedness is a property of the provider, not of one of its
-    // models), recomputed against THIS process's env rather than inherited.
+    // The local reach half: a self-spawn-blocked provider is ruled out at the
+    // TRANSPORT axis (blockedness is a property of the process, not the vendor),
+    // recomputed against THIS process's env rather than inherited.
     const blocked = RESOLVED_PROVIDER_NAMES.filter((name) => !included.has(name) && isSelfSpawnBlocked(name, env));
-    return buildExclusion([...(policy?.exclude ?? []), ...blocked]);
+    // Both provenances are enforced identically — the split is about LIFETIME (which
+    // survives the next submission), never about which patterns bite at dispatch.
+    return buildExclusion(migrateExclusionPatterns([
+        ...(policy?.exclude ?? []),
+        ...(policy?.auto_exclude ?? []),
+        ...blocked.map((name) => `transport:${name}`),
+    ]));
 }
 /**
  * The pure-policy matcher: the operator's patterns and nothing else. Split out
@@ -391,44 +440,109 @@ export function resolveDispatchExclusion(policy, env = process.env) {
  * `excluded` verdict.
  */
 function buildExclusion(patterns) {
-    const rules = patterns.map(parseExclusionRule);
-    return { excludes: (backend) => rules.some((rule) => ruleMatches(rule, backend)) };
+    // Keep each rule beside the pattern it came from: the capacity guard reports the
+    // operator's ORIGINAL text, not a re-rendering of the parsed rule (a round-trip
+    // through `ExclusionRule` would show them a string they never wrote).
+    const rules = patterns.map((pattern) => ({ pattern, rule: parseExclusionRule(pattern) }));
+    const excludedBy = (backend) => rules.find(({ rule }) => ruleMatches(rule, backend))?.pattern ?? null;
+    // `excludes` is DERIVED, never a parallel implementation — the two verdicts cannot drift.
+    return { excludes: (backend) => excludedBy(backend) !== null, excludedBy };
 }
+/** The three recognized axis prefixes. */
+const VALID_EXCLUSION_AXES = new Set(["transport", "service", "host"]);
 function parseExclusionRule(pattern) {
     const colon = pattern.indexOf(":");
     if (colon === -1) {
+        // No axis prefix — invalid under the axis-explicit grammar.
+        return { kind: "invalid", raw: pattern };
+    }
+    const axis = pattern.slice(0, colon);
+    const rest = pattern.slice(colon + 1);
+    if (!VALID_EXCLUSION_AXES.has(axis) || rest.length === 0) {
+        return { kind: "invalid", raw: pattern };
+    }
+    switch (axis) {
+        case "transport": {
+            const slash = rest.indexOf("/");
+            if (slash === -1)
+                return { kind: "transport", transport: rest };
+            if (slash === rest.length - 1)
+                return { kind: "transport", transport: rest.slice(0, slash) };
+            return { kind: "transport_model", transport: rest.slice(0, slash), model: rest.slice(slash + 1) };
+        }
+        case "service": {
+            const slash = rest.indexOf("/");
+            if (slash === -1)
+                return { kind: "service", service: rest };
+            if (slash === rest.length - 1)
+                return { kind: "service", service: rest.slice(0, slash) };
+            return { kind: "service_model", service: rest.slice(0, slash), model: rest.slice(slash + 1) };
+        }
+        case "host":
+            return { kind: "host", host: rest.toLowerCase() };
+        default:
+            return { kind: "invalid", raw: pattern };
+    }
+}
+/**
+ * Migrate persisted bare-form exclusion patterns (pre-stage-4) to the
+ * axis-explicit grammar. The old grammar was unambiguous within its own rules
+ * (head token against the closed provider set), so the migration reproduces
+ * exactly what the old parser would have inferred, then emits the explicit form.
+ *
+ * Applied at read time in {@link resolveDispatchExclusion}. A re-confirmation
+ * (any Gate-0 delta) persists new-form patterns naturally because the pattern
+ * generator now emits prefixed strings.
+ */
+function migrateExclusionPatterns(patterns) {
+    return patterns.map(migrateExclusionPattern);
+}
+function migrateExclusionPattern(pattern) {
+    // Already axis-explicit — no migration needed.
+    if (VALID_EXCLUSION_AXES.has(pattern.slice(0, pattern.indexOf(":"))) && pattern.indexOf(":") > 0) {
+        return pattern;
+    }
+    const colon = pattern.indexOf(":");
+    if (colon === -1) {
+        // Bare token: `codex` → `transport:codex`, `localhost` → `host:localhost`
         return isResolvedProviderName(pattern)
-            ? { kind: "provider", provider: pattern }
-            : { kind: "endpoint", host: pattern.toLowerCase() };
+            ? `transport:${pattern}`
+            : `host:${pattern}`;
     }
     const head = pattern.slice(0, colon);
     const tail = pattern.slice(colon + 1);
-    if (!isResolvedProviderName(head)) {
-        return { kind: "endpoint", host: pattern.toLowerCase() };
+    if (isResolvedProviderName(head)) {
+        // `openai-compatible:model-a` → `transport:openai-compatible/model-a`
+        // `codex:` (empty tail) → `transport:codex`
+        return tail.length > 0
+            ? `transport:${head}/${tail}`
+            : `transport:${head}`;
     }
-    // The head decides the tier — an empty tail does NOT demote a provider-name head
-    // to the endpoint tier. `codex:` reads as "codex, every model"; classifying it as
-    // an (unmatchable) endpoint rule would silently drop the operator's intent, and
-    // the head-decides rule this type documents would not actually hold.
-    return tail.length > 0
-        ? { kind: "provider_model", provider: head, model: tail }
-        : { kind: "provider", provider: head };
+    // `integrate.api.nvidia.com` / `localhost:8000` → `host:<pattern>`
+    return `host:${pattern}`;
 }
 function isResolvedProviderName(value) {
     return RESOLVED_PROVIDER_NAMES.includes(value);
 }
 function ruleMatches(rule, backend) {
     switch (rule.kind) {
-        case "provider":
-            return backend.transport === rule.provider;
-        case "provider_model":
+        case "transport":
+            return backend.transport === rule.transport;
+        case "transport_model":
             // A model-granular rule matches ONLY that model. A backend of the same
-            // provider carrying no model (a CLI whose model arrives at the dispatch
+            // transport carrying no model (a CLI whose model arrives at the dispatch
             // handshake) is NOT matched: the operator ruled out one model, not the
-            // backend — the coarse `provider` tier is how they rule out the backend.
-            return backend.transport === rule.provider && backend.model === rule.model;
-        case "endpoint":
+            // backend — the coarse `transport` tier is how they rule out the backend.
+            return backend.transport === rule.transport && backend.model === rule.model;
+        case "service":
+            return (backend.service ?? backend.transport) === rule.service;
+        case "service_model":
+            return ((backend.service ?? backend.transport) === rule.service &&
+                backend.model === rule.model);
+        case "host":
             return endpointHosts(backend.endpoint).includes(rule.host);
+        case "invalid":
+            return false;
     }
 }
 /**
@@ -643,12 +757,39 @@ function parseConfirmedDispatchPolicy(value) {
     // CLOSED provider-name set and stays membership-checked, so an unknown name cannot
     // type-assert its way into overriding a self-spawn block.
     const exclude = parseExclusionPatterns(obj.exclude);
+    const autoExclude = parseExclusionPatterns(obj.auto_exclude);
     const include = parseProviderNameList(obj.include);
-    if (!exclude?.length && !include?.length)
+    // Same open-grammar treatment as `exclude`: a capability key is a model id, not a
+    // member of any closed set, so it is kept verbatim and an unmatchable key is inert.
+    const capabilityOrder = Array.isArray(obj.capability_order)
+        ? obj.capability_order.filter((v) => typeof v === "string" && v.trim().length > 0)
+        : undefined;
+    // R3-3 provenance — same open-grammar, verbatim treatment: a set of model ids, not
+    // itself a positional ordering, so order within the parsed array is immaterial (the
+    // writer sorts it anyway). Must be reconstructed here explicitly like every other
+    // field on this parser: an unlisted field is silently dropped on every round-trip,
+    // and dropping this one is not a degrade — it reverts every LLM-ranked id to
+    // "unattributed" (still a valid rank, just an authorship the next operator
+    // repositioning would then wrongly discard-and-report as a moved anchor instead of
+    // silently honoring — see `capabilityOrderNonAnchors`).
+    const capabilityOrderLlmRanked = Array.isArray(obj.capability_order_llm_ranked)
+        ? obj.capability_order_llm_ranked.filter((v) => typeof v === "string" && v.trim().length > 0)
+        : undefined;
+    if (!exclude?.length &&
+        !autoExclude?.length &&
+        !include?.length &&
+        !capabilityOrder?.length &&
+        !capabilityOrderLlmRanked?.length) {
         return undefined;
+    }
     return {
         ...(exclude?.length ? { exclude } : {}),
+        ...(autoExclude?.length ? { auto_exclude: autoExclude } : {}),
         ...(include?.length ? { include } : {}),
+        ...(capabilityOrder?.length ? { capability_order: capabilityOrder } : {}),
+        ...(capabilityOrderLlmRanked?.length
+            ? { capability_order_llm_ranked: capabilityOrderLlmRanked }
+            : {}),
     };
 }
 // ---------------------------------------------------------------------------
@@ -681,9 +822,20 @@ export async function readSharedProviderConfirmation(root) {
     try {
         raw = await readJsonFile(sharedProviderConfirmationPath(root));
     }
-    catch {
-        // Absent (ENOENT) OR unreadable / invalid-JSON both degrade to the
-        // never-block path — a missing or corrupt artifact is never an error here.
+    catch (error) {
+        // Both degrade to the never-block path, but only ABSENCE is legitimately silent.
+        //
+        // A file that EXISTS and cannot be read (truncated, invalid JSON, permissions) used
+        // to return `null` with no warning, and that composed with two other
+        // individually-justified silences into TOTAL silence: no pool gets a rank ⇒
+        // `anyBanded === false`, which by design suppresses the capability fail-open
+        // reporter; and `resolveUnevidencedCapabilityPools` returns `[]` on a null
+        // confirmation ⇒ the obligation reports SATISFIED. Net effect on a corrupt file: the
+        // capability floor is globally inert, every `deep` packet routes anywhere, and not
+        // one path says a word — the exact case the loud path was built for.
+        if (error?.code !== "ENOENT") {
+            warnConfirmationUnreadable(error, root);
+        }
         return null;
     }
     // Malformed (wrong shape / version drift) → never-block, but never SILENT (D).
@@ -704,6 +856,25 @@ export async function readSharedProviderConfirmation(root) {
  * the same loud-degrade shape as `readQuotaStateOrDegrade` and the blind-dispatch
  * warning. Reached only on the rejection path, so it cannot become hot.
  */
+/**
+ * The sibling of {@link warnConfirmationRejected} for a file that exists but cannot be
+ * READ (truncated write, invalid JSON, permissions) — the case that used to degrade
+ * silently. Same never-block contract, same loud-degrade shape.
+ *
+ * The message names the CAPABILITY consequence explicitly because that is the one a
+ * corrupt file silences most dangerously: with no ranks, nothing bands, the fail-open
+ * reporter self-suppresses (it fires only when something else banded), and the
+ * capability obligation simultaneously reports satisfied. Nothing else would tell the
+ * operator their capability floor stopped existing.
+ */
+function warnConfirmationUnreadable(error, root) {
+    const why = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`WARNING: the provider confirmation at ${sharedProviderConfirmationPath(root)} exists ` +
+        `but could NOT be read (${why}). It is being treated as absent: the operator's ` +
+        `confirmed cost order, dispatch bias, and CAPABILITY RANKS are all unavailable, so ` +
+        `the admission capability floor is inert for this run and packets may route to pools ` +
+        `above their capability. Repair or delete the file and re-confirm at Gate-0.\n`);
+}
 function warnConfirmationRejected(raw, root) {
     const version = raw !== null && typeof raw === "object" && !Array.isArray(raw)
         ? raw.schema_version
@@ -779,6 +950,121 @@ export async function readConfirmedCostPositions(root) {
     }
     return positions;
 }
+/**
+ * THE enumeration of every persisted entry that can carry a `capability_rank`, across
+ * all three confirmation arrays.
+ *
+ * Single-sourced deliberately, and this is the fix for the round-3 critical defect: the
+ * rank JOIN read three arrays while the evidence OBLIGATION enumerated only two, so
+ * `provider_pool` was a rank SOURCE but never a delta SUBJECT — the conversation-first
+ * default (host pool, no volunteered roster) therefore banded `null` forever and the
+ * gate never once asked about it. Two independent walks over "the same" set is exactly
+ * the drift this project keeps paying for; with one walk, a new rank-bearing array is
+ * added HERE and both consumers follow automatically. Do not re-inline either walk.
+ */
+function* capabilitySubjects(confirmation) {
+    for (const entry of confirmation.provider_pool ?? []) {
+        yield { modelId: entry.model_id, rank: entry.capability_rank, excluded: entry.excluded === true };
+    }
+    for (const entry of confirmation.host_model_cost_order ?? []) {
+        yield { modelId: entry.model_id, rank: entry.capability_rank, excluded: false };
+    }
+    // `SourcePoolCostEntry.capability_rank` has existed and been WRITTEN since the Gate-0
+    // source fold (providerConfirmation.ts) with no reader at all. This is that reader.
+    for (const entry of confirmation.source_pool_cost_order ?? []) {
+        yield { modelId: entry.model_id, rank: entry.capability_rank, excluded: false };
+    }
+}
+/**
+ * Is this a usable capability rank? A rank is a position in a relative ordering: finite
+ * and non-negative. Shared by the join and the delta so "evidenced" means the same thing
+ * to both — a predicate they disagreed on would re-create the drift above in miniature.
+ */
+function isUsableRank(rank) {
+    return rank !== undefined && Number.isFinite(rank) && rank >= 0;
+}
+export async function readConfirmedCapabilityRanks(root) {
+    if (!root)
+        return new Map();
+    const confirmation = await readSharedProviderConfirmation(root);
+    if (!confirmation)
+        return new Map();
+    const ranks = new Map();
+    for (const subject of capabilitySubjects(confirmation)) {
+        // An entry without a model_id is display-only and contributes no dispatch rank (it
+        // is unjoinable by the model-keyed lookup — the infinite-re-prompt trap).
+        if (!subject.modelId || !isUsableRank(subject.rank))
+            continue;
+        ranks.set(subject.modelId, subject.rank);
+    }
+    return ranks;
+}
+/**
+ * The capability-evidence delta: dispatchable models with NO resolvable capability
+ * rank. Computed once per invocation (it reads the confirmation + gathers sources)
+ * and threaded by reference on the gate, exactly like the reach delta.
+ *
+ * "Evidenced" is deliberately defined as **the dispatch join resolves** — the same
+ * lookup the pool constructors take ({@link readConfirmedCapabilityRanks} keyed on the
+ * pool's model), never a parallel predicate. Two consequences, both load-bearing:
+ *   - a pool with NO model is skipped entirely. It is unjoinable, so pinning it could
+ *     never clear the delta and it would re-prompt forever.
+ *   - external evidence (`source.capability_rank`) counts, so a fully-ranked roster
+ *     never fires the gate at all.
+ *
+ * Returns [] when no confirmation exists yet — the first-time `missing` case already
+ * pauses for the operator, and reporting a delta against a pool they have never seen
+ * would fold a second question into a prompt that has not asked the first one yet.
+ *
+ * Lives HERE, beside {@link readConfirmedCapabilityRanks}, rather than in the audit CLI
+ * command it is called from: its failure mode is a LIVELOCK (wrongly admitting an
+ * unrankable pool re-prompts `provider_confirmation` forever), and a delta computation
+ * with that failure mode must be reachable by a test.
+ */
+export async function resolveUnevidencedCapabilityPools(root, effectiveConfig) {
+    const confirmation = await readSharedProviderConfirmation(root);
+    if (!confirmation)
+        return [];
+    const primaryProviderName = resolveFreshSessionProviderName(undefined, effectiveConfig, { env: process.env });
+    const sources = await gatherDispatchableSources(effectiveConfig, primaryProviderName);
+    const confirmedRanks = await readConfirmedCapabilityRanks(root);
+    const unevidenced = new Set();
+    for (const source of sources) {
+        // Unjoinable ⇒ unpinnable ⇒ never admitted to the delta (see above).
+        if (!source.model)
+            continue;
+        if (source.capability_rank != null)
+            continue;
+        if (confirmedRanks.has(source.model))
+            continue;
+        unevidenced.add(source.model);
+    }
+    // Every PERSISTED rank-bearing entry, walked through the SAME enumeration the join
+    // uses ({@link capabilitySubjects}) so the two can never disagree about what the
+    // subjects are. Host models are ranked exactly like any other model — the host is not
+    // a special case, it was simply never looked up — and `provider_pool` is included
+    // here, which it previously was not (the round-3 critical defect: the default
+    // conversation-first pool was unrankable AND unpinnable, so the fail-open it caused
+    // had no road to a fix).
+    for (const subject of capabilitySubjects(confirmation)) {
+        // Unjoinable ⇒ unpinnable ⇒ never admitted to the delta, same rule as sources.
+        if (!subject.modelId)
+            continue;
+        // An excluded pool never dispatches, so it needs no capability evidence — asking
+        // about it would be a question whose answer changes nothing.
+        if (subject.excluded)
+            continue;
+        if (isUsableRank(subject.rank))
+            continue;
+        if (confirmedRanks.has(subject.modelId))
+            continue;
+        unevidenced.add(subject.modelId);
+    }
+    // Stable, content-derived order (never gather/iteration order) — this string list
+    // reaches the obligation's reason text and the prompt, and an incidentally-ordered
+    // array churns downstream content hashes.
+    return [...unevidenced].sort();
+}
 /**
  * Read the operator-confirmed cost↔speed dispatch bias (λ ∈ [0,1]) from the shared
  * Gate-0 confirmation for the dispatch build sites (spec/dispatch-cost-speed-dial.md).
@@ -821,33 +1107,524 @@ export function parseProviderConfirmationInput(value) {
         ? v
         : undefined;
     const costOrder = stringArray(obj.cost_order);
+    // The capability-evidence answer. MUST be reconstructed here explicitly: this parser
+    // is field-by-field, so an unlisted field is silently dropped — and dropping THIS one
+    // is not a degrade, it is a livelock. The operator answers the prompt, the answer
+    // never reaches `annotateConfirmedPool`, no `capability_rank` is written, the delta
+    // recomputes identical, and `provider_confirmation` (PRIORITY[0]) re-prompts the same
+    // question forever. Any future field on ProviderConfirmationInput needs a line here.
+    const capabilityOrder = stringArray(obj.capability_order);
     // No cast: `exclude` is the OPEN exclusion grammar, so asserting the operator's
     // raw strings into the closed provider-name union would be a lie — and the exact
     // type-assert-your-way-in move the policy parser refuses for `include`.
     const exclude = stringArray(obj.exclude);
     const include = stringArray(obj.include);
     const dispatchBias = clampDispatchBias(obj.dispatch_bias);
+    // An EXPLICIT empty array is preserved, not dropped to absent. `[]` is the
+    // operator deliberately emptying their host roster; omission is them saying
+    // nothing about it. `carryForwardConfirmationInput` reseeds only the second case,
+    // so collapsing the two here would resurrect a roster the operator deleted — and
+    // there would be no way left to express the deletion at all.
     const hostModels = Array.isArray(obj.host_models)
         ? obj.host_models
             .filter((m) => m !== null &&
             typeof m === "object" &&
             typeof m.model_id === "string")
-            .map((m) => ({
-            model_id: m.model_id,
-            ...(typeof m.tier === "string"
-                ? { tier: m.tier }
-                : {}),
-        }))
+            .map((m) => ({ model_id: m.model_id }))
         : undefined;
     return {
         schema_version: PROVIDER_CONFIRMATION_INPUT_VERSION,
         ...(costOrder ? { cost_order: costOrder } : {}),
+        ...(capabilityOrder ? { capability_order: capabilityOrder } : {}),
         ...(exclude ? { exclude } : {}),
         ...(include ? { include } : {}),
-        ...(hostModels && hostModels.length > 0 ? { host_models: hostModels } : {}),
+        ...(hostModels ? { host_models: hostModels } : {}),
         ...(dispatchBias != null ? { dispatch_bias: dispatchBias } : {}),
     };
 }
+/**
+ * Seed an incoming Gate-0 submission from the PRIOR confirmation, field by field.
+ *
+ * **The defect class this closes.** `buildProviderConfirmationRender` rebuilds the
+ * whole confirmation from the submission ALONE — every operator decision it persists
+ * (`cost_order`, `capability_rank`, the host roster, λ, and the `policy` exclusions) is
+ * reconstructed from `input` and from nothing else. So *any* field a submission omits
+ * is not "left alone", it is DESTROYED. That is one defect with six faces, and fixing
+ * it per-field is what let three of them survive a review round: the prompt's capability
+ * example is `{ "capability_order": [...] }`, so an operator answering exactly what was
+ * asked omits all five other fields and silently wipes them.
+ *
+ * Two rules, both load-bearing:
+ *
+ * 1. **`undefined` means "said nothing"; an explicit empty array means "delete".** A
+ *    submission that never mentions host models is not a decision to remove them; an
+ *    explicit `"host_models": []` is. `parseProviderConfirmationInput` therefore
+ *    PRESERVES an empty array rather than dropping it to absent — without that the two
+ *    cases are indistinguishable here and the carry-forward resurrects a roster the
+ *    operator deleted.
+ * 2. **It applies with `input === null` too.** The autonomous/headless path promotes
+ *    with no submission at all, and the capability delta is a brand-new trigger for
+ *    that path — so short-circuiting on `input &&` would let an unattended re-promotion
+ *    wipe the operator's entire persisted decision and then report convergence.
+ *
+ * Returns `null` only when there is nothing on either side. A prior confirmation with
+ * no incoming submission still yields a synthesized input carrying it forward.
+ */
+/**
+ * The gate-authored exclusions that SURVIVE this promotion.
+ *
+ * Round-3 defect (high, fail-OPEN): `auto_exclude` was rebuilt on every promotion from
+ * `gate.newlyReachable` alone. But `confirmedBackendKeys` counts an excluded entry as
+ * CONFIRMED, so once the gate fail-closed-excludes backend X and folds it into the pool,
+ * the reach delta is empty forever — and the very next promotion rebuilt `auto_exclude`
+ * from that empty delta and dropped X, making a backend the operator never confirmed
+ * dispatchable. The docstring's "a submission supersedes it" was true; the code
+ * superseded it on EVERY promotion, including the no-submission one.
+ *
+ * The rule is therefore narrower than "any submission clears it". A submission
+ * supersedes an auto-exclusion only when it actually ADDRESSES that backend:
+ *   - the operator re-stated the pattern in `exclude` — it is now operator-authored and
+ *     lives there, so retaining an `auto_exclude` copy would double-record it; or
+ *   - the operator named that provider in `include` — an explicit opt-back-IN.
+ * Anything else is SILENCE, and silence is not confirmation ("the operator confirms
+ * model choices"). A capability-only answer must not lift an exclusion the operator was
+ * never even shown — the reach section does not render once the backend is a confirmed
+ * key, so they cannot see what they would be lifting.
+ *
+ * Fail-CLOSED by construction: the uncertain case retains the exclusion.
+ */
+export function retainAutoExclusions(priorAuto, input) {
+    if (priorAuto.length === 0)
+        return [];
+    const restated = new Set(input?.exclude ?? []);
+    const optedIn = input?.include ?? [];
+    const addressed = (pattern) => {
+        if (restated.has(pattern))
+            return true;
+        // `provider` and `provider:model` tiers both belong to the named provider.
+        return optedIn.some((provider) => pattern === provider || pattern.startsWith(`${provider}:`));
+    };
+    return priorAuto.filter((pattern) => !addressed(pattern));
+}
+export function carryForwardConfirmationInput(input, prior, 
+/**
+ * R3-3: true when THIS submission is LLM-authored (tool-derived — see
+ * `runProviderConfirmationAutoComplete`'s `authoredByLlm`). Governs which
+ * previously-ranked ids the capability merge below treats as fixed anchors:
+ * an LLM submission anchors every previously-ranked id (operator's and prior
+ * LLM's alike — rule 1); an operator submission does NOT anchor ids already in
+ * `capability_order_llm_ranked` (rule 2 — they interpolate like new models).
+ * Also gates the total-replacement escape in `mergeCapabilityOrder` (operator
+ * only — see its docstring). Defaults `false` (today's operator behavior) so
+ * every pre-existing call site is unaffected.
+ */
+authoredByLlm = false) {
+    if (!prior)
+        return input;
+    const base = input ?? {
+        schema_version: PROVIDER_CONFIRMATION_INPUT_VERSION,
+    };
+    const priorHostModels = (prior.host_model_cost_order ?? []).map((entry) => ({
+        model_id: entry.model_id,
+    }));
+    const priorCostOrder = priorConfirmedCostOrder(prior);
+    // The operator's RAW answer, read back verbatim — never reconstructed from the
+    // resulting `capability_rank`s. Reconstruction could not tell an operator-authored
+    // rank from EXTERNAL evidence, so it laundered external numbers into the operator's
+    // ordering and made the laundered model read as evidenced forever.
+    const priorCapabilityOrder = prior.policy?.capability_order ?? [];
+    // `exclude` ONLY — `auto_exclude` is deliberately NOT carried. It is the gate's
+    // placeholder for an answer the operator never gave, and a submission supersedes it.
+    const priorExclude = prior.policy?.exclude ?? [];
+    const priorInclude = prior.policy?.include ?? [];
+    return {
+        ...base,
+        // `=== undefined` at every field, never a truthiness/length test: that is the
+        // said-nothing-vs-delete distinction, and a `!length` test collapses them.
+        ...(base.cost_order === undefined && priorCostOrder.length > 0
+            ? { cost_order: priorCostOrder }
+            : {}),
+        // The capability answer is the ONE field that does not follow the plain
+        // said-nothing/carry rule, because its PROMPT is delta-scoped: it renders only the
+        // unevidenced models, so a submission is a partial answer BY CONSTRUCTION and
+        // taking it as the whole ordering erases every rank the operator gave before —
+        // the `PRIORITY[0]` livelock. It is therefore MERGED by anchored insertion rather
+        // than replacing or being replaced (see {@link mergeCapabilityOrder}).
+        //
+        // The MERGED order is what gets persisted, not the raw submission:
+        // `buildConfirmedDispatchPolicy` stores whatever `input.capability_order` holds, and
+        // `policy.capability_order` is the only thing the NEXT promotion reads back. Keeping
+        // the raw answer there instead would mean the prior answers exist nowhere on disk and
+        // the merge would have nothing to merge against on the third promotion — the livelock
+        // one round-trip later. This does NOT undo "store the operator's answer verbatim":
+        // that rule exists to keep EXTERNAL evidence out of the operator's ordering, and both
+        // operands here are operator answers. Nothing derived from a `capability_rank` (which
+        // cannot distinguish operator from external provenance) enters this list.
+        ...(base.capability_order === undefined
+            ? priorCapabilityOrder.length > 0
+                ? { capability_order: priorCapabilityOrder }
+                : {}
+            : {
+                capability_order: mergeCapabilityOrder(priorCapabilityOrder, base.capability_order, capabilityOrderNonAnchors(prior.policy?.capability_order_llm_ranked ?? [], authoredByLlm), authoredByLlm),
+            }),
+        ...(base.host_models === undefined && priorHostModels.length > 0
+            ? { host_models: priorHostModels }
+            : {}),
+        ...(base.exclude === undefined && priorExclude.length > 0
+            ? { exclude: [...priorExclude] }
+            : {}),
+        ...(base.include === undefined && priorInclude.length > 0
+            ? { include: [...priorInclude] }
+            : {}),
+        ...(base.dispatch_bias === undefined && prior.dispatch_bias !== undefined
+            ? { dispatch_bias: prior.dispatch_bias }
+            : {}),
+    };
+}
+/** How many already-ranked models the capability prompt shows as fixed reference points. */
+export const DEFAULT_CAPABILITY_ANCHOR_COUNT = 5;
+/**
+ * Pick a BOUNDED, spread sample of an already-confirmed capability ordering to show
+ * beside the unevidenced models as fixed reference points.
+ *
+ * The roster may be HUNDREDS of models, so the prompt must be O(new + constant) — it
+ * can never render the whole ordering. First, last, and evenly-spaced interior picks
+ * give the operator a usable coordinate space (top / middle / bottom of the confirmed
+ * ranking) at constant cost, which is exactly what {@link mergeCapabilityOrder}
+ * interpolates against.
+ *
+ * @param priorOrder - The confirmed ordering, most-capable-first.
+ * @param exclude    - Models already being asked about (the unevidenced delta); an
+ *   anchor must be a model whose rank is settled, never one under question.
+ * @param max        - Ceiling on the sample size.
+ */
+export function selectCapabilityAnchors(priorOrder, exclude = [], max = DEFAULT_CAPABILITY_ANCHOR_COUNT) {
+    const excluded = new Set(exclude);
+    const unique = [...new Set(priorOrder)].filter((id) => !excluded.has(id));
+    if (max <= 0)
+        return [];
+    if (unique.length <= max || max === 1)
+        return unique.slice(0, max);
+    // Evenly spaced, endpoints included. `Set` absorbs a repeated index when the
+    // ordering is barely longer than `max`, so the result is never padded with dupes.
+    const picks = new Set();
+    for (let i = 0; i < max; i++) {
+        picks.add(Math.round((i * (unique.length - 1)) / (max - 1)));
+    }
+    return [...picks].sort((a, b) => a - b).map((i) => unique[i]);
+}
+/**
+ * Whether `submitted` restates EVERY id in `priorOrder` — the one case
+ * {@link mergeCapabilityOrder} treats as a total, verbatim replacement rather than an
+ * anchored partial answer (OPERATOR path only — see that function's docstring for why
+ * the escape is authorship-gated). Single-sourced so it and
+ * {@link detectDiscardedCapabilityReorder} can never disagree about which case they
+ * are in (a mismatch there reports a phantom discard, or misses a real one).
+ */
+function isTotalCapabilitySubmission(priorOrder, submitted) {
+    const prior = [...new Set(priorOrder)];
+    if (prior.length === 0)
+        return false;
+    const answerSet = new Set(submitted);
+    return prior.every((id) => answerSet.has(id));
+}
+/**
+ * R3-3 — the submission's ANCHOR EXCLUSION set, single-sourced so
+ * {@link mergeCapabilityOrder} and {@link detectDiscardedCapabilityReorder} can never
+ * disagree about what counts as a fixed reference point for a given submission:
+ *
+ * - LLM-authored (`authoredByLlm`): every previously-ranked id — the operator's and
+ *   any prior LLM's alike — stays a fixed anchor (rule 1). Nothing is excluded.
+ * - Operator-authored: ids already in `capability_order_llm_ranked` are NOT anchors
+ *   (rule 2) — the operator may reposition them exactly like new models, and doing
+ *   so removes them from that set (see {@link advanceCapabilityOrderLlmRanked}).
+ */
+export function capabilityOrderNonAnchors(priorLlmRanked, authoredByLlm) {
+    return authoredByLlm ? new Set() : new Set(priorLlmRanked);
+}
+/**
+ * Advance the R3-3 `capability_order_llm_ranked` authorship SET across one
+ * promotion. Always a subset of the resulting `capability_order` — see
+ * {@link ConfirmedDispatchPolicy.capability_order_llm_ranked}.
+ *
+ * - LLM-authored submission: every id this submission newly ranked — i.e. not
+ *   already in `priorOrder` — is ADDED. `mergeCapabilityOrder` never lets an
+ *   LLM-authored submission move a previously-ranked id (its total-replacement
+ *   escape is operator-only), so a prior id is never repositioned on this path and
+ *   this function does not need to special-case "total" either: it is simply
+ *   `answer \ priorOrder`.
+ * - Operator-authored submission: every id the submission NAMES is REMOVED — naming
+ *   a previously LLM-ranked id (and, via {@link capabilityOrderNonAnchors}'s
+ *   non-anchor treatment, freely repositioning it) makes it operator-authored from
+ *   here on, exactly like a first-time rank.
+ * - No submission at all (`submitted` absent/empty): the running set is unchanged.
+ */
+export function advanceCapabilityOrderLlmRanked(priorLlmRanked, priorOrder, submitted, authoredByLlm) {
+    const running = new Set(priorLlmRanked);
+    const answer = submitted ? [...new Set(submitted)] : [];
+    if (answer.length === 0)
+        return [...running].sort();
+    if (!authoredByLlm) {
+        for (const id of answer)
+            running.delete(id);
+        return [...running].sort();
+    }
+    const priorSet = new Set(priorOrder);
+    for (const id of answer.filter((id) => !priorSet.has(id)))
+        running.add(id);
+    return [...running].sort();
+}
+/**
+ * The anchor ids whose relative order the submission changed but the merge will NOT
+ * honor — i.e. an operator reorder that is about to be silently discarded.
+ *
+ * {@link mergeCapabilityOrder} treats every submitted id already present in
+ * `priorOrder` as a FIXED reference point, so a submission that swaps two of them
+ * returns the prior order unchanged. Without this, that is invisible: the promotion
+ * succeeds, the artifact is byte-identical, and nothing anywhere says the operator's
+ * decision was dropped. `unrankedOnPromotion` cannot catch it either — a reordered id
+ * IS present in `capability_order`, so it reports nothing.
+ *
+ * An accepted-then-discarded operator decision is the same defect class as laundering a
+ * tool guess into operator policy: not corruption, but SILENCE. The standing rule is
+ * that the operator must never have to notice — so the caller reports this loudly.
+ *
+ * Returns `[]` when the reorder will actually be honored: an OPERATOR-authored TOTAL
+ * submission (every prior id restated) is applied verbatim, and a submission with
+ * fewer than two anchors cannot express a reorder at all.
+ *
+ * NOTE this reports the LIMITATION, it does not lift it. Making a repositioning
+ * expressible without restating the whole roster needs the anchor-provenance split
+ * tracked in `docs/backlog.md`; this only ensures the drop is never silent.
+ */
+export function detectDiscardedCapabilityReorder(priorOrder, submitted, 
+/**
+ * R3-3: ids to exclude from anchor treatment — must be the SAME set passed to
+ * {@link mergeCapabilityOrder} for this submission ({@link capabilityOrderNonAnchors}),
+ * or the two disagree about what an "anchor" is and this reports a discard the
+ * merge actually honored (or misses one it silently dropped).
+ */
+nonAnchorIds = new Set(), 
+/**
+ * R3-3: mirrors the authorship-gated condition in {@link mergeCapabilityOrder} — the
+ * total-submission escape is OPERATOR-only, so an LLM-authored submission that
+ * happens to restate every prior id (a small roster's anchor sample can cover the
+ * whole ordering) still has its anchor reorder detected and reported, never
+ * silently honored via the escape.
+ */
+authoredByLlm = false) {
+    const prior = [...new Set(priorOrder)];
+    const answer = [...new Set(submitted)];
+    if (prior.length === 0 || answer.length === 0)
+        return [];
+    const priorPos = new Map(prior.map((id, index) => [id, index]));
+    // A total submission is honored verbatim — nothing is discarded. Mirrors the same
+    // authorship-gated condition in `mergeCapabilityOrder`; the two must agree or this
+    // reports phantoms.
+    if (!authoredByLlm && isTotalCapabilitySubmission(prior, answer))
+        return [];
+    const anchors = answer.filter((id) => priorPos.has(id) && !nonAnchorIds.has(id));
+    if (anchors.length < 2)
+        return [];
+    // Discarded iff the anchors' order in the SUBMISSION differs from their order in the
+    // PRIOR ordering — compare against the anchors sorted by prior position.
+    const asConfirmed = [...anchors].sort((a, b) => priorPos.get(a) - priorPos.get(b));
+    // Report only the anchors that actually MOVED, not every anchor in the submission.
+    // `["a","c","b"]` against `["a","b","c","d"]` moves `c` and `b`; naming `a` too would
+    // tell the operator their unchanged entry was dropped, which is false — and a warning
+    // that over-reports is one the operator learns to discount.
+    return anchors.filter((id, i) => id !== asConfirmed[i]);
+}
+/**
+ * Merge an operator's capability answer into the previously confirmed ordering by
+ * **ANCHORED INSERTION**.
+ *
+ * **The livelock this closes.** The capability prompt is DELTA-SCOPED — it renders only
+ * the models with no evidence — while `annotateConfirmedPool` built its positions from
+ * the submission ALONE, i.e. total replacement. So each answer erased the last: rank A,
+ * the delta asks C, rank C, A loses its rank, the delta asks A, forever. `PRIORITY[0]`
+ * never converges. Reproduced across three promotions.
+ *
+ * The fix cannot be "render the whole ordering" (the roster may be hundreds of models —
+ * the prompt must stay O(new + constant)) and it cannot be an absolute score or tier
+ * (only a RELATIVE ordering is representable, by standing decision). Anchored insertion
+ * is what remains: show a bounded, spread sample of the confirmed ordering
+ * ({@link selectCapabilityAnchors}) as fixed reference points, and interpolate the new
+ * models into the coordinate space those points define.
+ *
+ * Semantics, exactly:
+ *
+ * - **Anchors** = submitted entries that already appear in `priorOrder`. They are
+ *   REFERENCE POINTS: their prior positions define the coordinate space, and **a
+ *   reordering of anchors relative to each other is deliberately NOT honored** on a
+ *   partial submission. The operator saw at most a handful of them out of a possibly
+ *   enormous ordering, so a swap between two anchors carries no information about the
+ *   models BETWEEN them — honoring it would silently reshuffle models the operator
+ *   never saw.
+ * - **Exception — an OPERATOR-authored TOTAL submission is a total replacement.**
+ *   When the submission mentions every model in `priorOrder` there are no unmentioned
+ *   models, so the coordinate space is fully respecified and the answer is honored
+ *   verbatim. This is the only case where "reorder what you already confirmed" is a
+ *   well-defined request, and it is the pre-existing behavior for a complete
+ *   re-ranking. **R3-3: this escape is OPERATOR-only** (`authoredByLlm: false`,
+ *   the default) — on a SMALL roster the bounded anchor sample
+ *   ({@link selectCapabilityAnchors}) can cover the entire prior ordering, so an
+ *   LLM's answer over "new models + all the anchors it was shown" becomes total BY
+ *   ACCIDENT, not by the LLM's intent to reorder. Honoring it verbatim would let an
+ *   LLM silently reorder ranks an operator (or a prior LLM) set; an LLM-authored
+ *   submission therefore NEVER takes this exception — every previously-ranked id
+ *   stays a fixed anchor regardless of coverage, and an attempted reorder is
+ *   discarded and reported exactly like a partial submission's would be (see
+ *   {@link detectDiscardedCapabilityReorder}).
+ * - **New models** (not in `priorOrder`) interpolate to a fractional position between
+ *   the prior positions of the nearest preceding and following anchors IN THE SUBMITTED
+ *   LIST. Before the first anchor ⇒ just below it (more capable); after the last ⇒ just
+ *   above it. Consecutive new models keep their submitted relative order.
+ * - **Every model in `priorOrder` the submission does not mention keeps its prior
+ *   position.** THIS IS THE LIVELOCK FIX.
+ * - **No anchors at all** (a partial submission naming only unknown models): there is no
+ *   coordinate to interpolate against, so the new models are appended AFTER the whole
+ *   prior ordering — the conservative direction, since a higher rank is less capable and
+ *   therefore trusted with less.
+ * - **Duplicates**: first occurrence wins, matching `annotateConfirmedPool`'s rule that a
+ *   positional list is the operator's ordering and a later repeat must not re-rank it.
+ * - **Result** is every model sorted by resolved position, ties broken by model id.
+ *   Deterministic by construction: an incidentally-ordered array here would churn the
+ *   confirmation's content hash on every promotion and cascade phantom staleness.
+ *
+ * Degenerate cases: an empty `priorOrder` (the first-ever answer) returns the submission;
+ * an empty submission returns the prior ordering unchanged (an omitted answer is
+ * "said nothing" — there is no way to express "delete the whole ranking", and the
+ * un-delete direction is the one that cannot livelock).
+ *
+ * Pure — no I/O, no clock, no config. Exported so the merge that decides whether the
+ * gate converges is directly testable.
+ */
+export function mergeCapabilityOrder(priorOrder, submitted, 
+/**
+ * R3-3: ids to treat as NOT anchored even though they already appear in
+ * `priorOrder` — the operator-authored path passes the current
+ * `capability_order_llm_ranked` set here ({@link capabilityOrderNonAnchors}) so an
+ * operator may freely reposition a previously LLM-ranked id, exactly like a new
+ * model. Empty by default (today's behavior: every previously-ranked id anchors).
+ */
+nonAnchorIds = new Set(), 
+/**
+ * R3-3: true when THIS submission is LLM-authored. Gates the total-replacement
+ * escape below (OPERATOR-only — see the docstring's exception): an LLM-authored
+ * submission never takes it, so a previously-ranked id is NEVER repositioned on
+ * this path, regardless of how much of `priorOrder` the submission happens to
+ * cover.
+ */
+authoredByLlm = false) {
+    const prior = [...new Set(priorOrder)];
+    const answer = [...new Set(submitted)];
+    if (prior.length === 0)
+        return answer;
+    if (answer.length === 0)
+        return prior;
+    const priorPos = new Map(prior.map((id, index) => [id, index]));
+    // TOTAL submission ⇒ total replacement (see the docstring's exception) — OPERATOR
+    // path only. An LLM-authored submission never takes this escape, even when it
+    // happens to cover every prior id (a small roster's anchor sample can do that by
+    // accident): it would otherwise silently reorder ranks the LLM was never asked to
+    // move.
+    if (!authoredByLlm && isTotalCapabilitySubmission(prior, answer))
+        return answer;
+    // A non-anchor id still HOLDS its prior position (seeded below, so an unmentioned
+    // one keeps it) but cannot anchor a run boundary — it is swept into the
+    // surrounding run of new models and repositioned exactly like one (R3-3 rule 2).
+    const isAnchor = (id) => priorPos.has(id) && !nonAnchorIds.has(id);
+    /** Resolved position per model — seeded with every prior model, so an unmentioned one keeps its rank. */
+    const positions = new Map(priorPos);
+    const anchorCount = answer.filter(isAnchor).length;
+    if (anchorCount === 0) {
+        answer.forEach((id, index) => positions.set(id, prior.length + index));
+    }
+    else {
+        let i = 0;
+        while (i < answer.length) {
+            if (isAnchor(answer[i])) {
+                i++;
+                continue;
+            }
+            // A maximal run of NEW/non-anchor models, [i, j). `answer[i - 1]` is
+            // necessarily an anchor when `i > 0` — otherwise the run would have started
+            // earlier.
+            let j = i;
+            while (j < answer.length && !isAnchor(answer[j]))
+                j++;
+            const before = i > 0 ? priorPos.get(answer[i - 1]) : undefined;
+            const after = j < answer.length ? priorPos.get(answer[j]) : undefined;
+            let lo;
+            let hi;
+            if (before === undefined) {
+                hi = after;
+                lo = hi - 1;
+            }
+            else if (after === undefined) {
+                lo = before;
+                hi = lo + 1;
+            }
+            else {
+                lo = before;
+                // A reordered anchor pair yields an inverted or empty span. Anchor reordering
+                // is not honored, so degrade to "insert just after the preceding anchor"
+                // rather than emitting descending positions.
+                hi = after > lo ? after : lo + 1;
+            }
+            const run = j - i;
+            for (let t = 0; t < run; t++) {
+                positions.set(answer[i + t], lo + ((hi - lo) * (t + 1)) / (run + 1));
+            }
+            i = j;
+        }
+    }
+    return [...positions.entries()]
+        .sort((a, b) => a[1] - b[1] || a[0].localeCompare(b[0]))
+        .map(([id]) => id);
+}
+/**
+ * Reconstruct the operator's confirmed cost ordering as the `cost_order` KEY list a
+ * fresh submission would carry — i.e. the inverse of `resolveFinalCostOrder`'s
+ * index⇒position mapping.
+ *
+ * Keyspace is the CANDIDATE key (`annotateConfirmedPool`'s `CostCandidate.key`):
+ * provider NAME for a provider pool, `model_id` for a host tier, `source_id` for a
+ * source pool. Deliberately NOT the MODEL keyspace the capability ordering
+ * ({@link mergeCapabilityOrder}) uses — the two genuinely key differently on the write
+ * side (a provider entry is capability-ranked by its `model_id`, never by its provider
+ * name), and unifying
+ * them here would silently drop every provider pool's position.
+ */
+function priorConfirmedCostOrder(prior) {
+    const ranked = [];
+    for (const entry of prior.provider_pool ?? []) {
+        if (typeof entry.cost_order === "number") {
+            ranked.push({ key: entry.name, order: entry.cost_order });
+        }
+    }
+    for (const entry of prior.host_model_cost_order ?? []) {
+        ranked.push({ key: entry.model_id, order: entry.cost_order });
+    }
+    for (const entry of prior.source_pool_cost_order ?? []) {
+        ranked.push({ key: entry.source_id, order: entry.cost_order });
+    }
+    return sortRankedKeys(ranked);
+}
+/**
+ * Rank-ascending key list, de-duplicated first-occurrence-wins. The key tiebreak keeps
+ * the result deterministic when two pools share a position (a host tier defaulting to
+ * `cost_order: 0`, say) — an incidentally-ordered list here would churn the artifact's
+ * content hash on every promotion and cascade phantom staleness downstream.
+ */
+function sortRankedKeys(ranked) {
+    const seen = new Set();
+    return ranked
+        .sort((a, b) => a.order - b.order || a.key.localeCompare(b.key))
+        .filter((entry) => (seen.has(entry.key) ? false : (seen.add(entry.key), true)))
+        .map((entry) => entry.key);
+}
 /**
  * Read the operator's Gate-0 input from `<artifactsDir>/provider-confirmation.input.json`.
  * Returns `null` when the file is absent, unreadable, or malformed — the "operator