From 22455c051f1df3ac4aad564630abbc270071c82f Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 11:48:25 +0200
Subject: [PATCH 01/12] =?UTF-8?q?feat(model-router):=20wave=203-A=20?=
 =?UTF-8?q?=E2=80=94=20first-use=20route=20confirmation,=20decision=20memo?=
 =?UTF-8?q?ry,=20project=20exceptions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

routing.json (tracked, reached through the plugin directory) is now the
single source of the phase table and of every skill/agent row, plus the
decisions: confirmed rows/phases, changed rows (from/to) and projects
exceptions keyed by a normalized git remote (credentials never stored, no
machine paths). First use of a rowed typed skill, a rowed agent spawn or a
main-loop phase opens the engine's dialog (Later / Keep / two alternative
phases; Other = a phase name); a change asks Everywhere or This project
only. One dialog at a time, never in headless, never inside an agent,
never written by the model: only a dialog answer or /route ask writes,
serialized, size-capped, never creating the file. Layers: routing.json <
~/.claude/model-router.json; the project tree is never read. /route
pending, /route ask on|off. Census reads rows and phases from the file and
tolerates a user-changed row (WARN). Kit suite 86 → 190 tests.

Contract .claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md,
plan r4: 3 lenses + 1 confirmation, feater + 4 rounds, GATE 0 MET,
verifier CONFORME then re-verify after security, security BLOCK(1) fixed
then PASS. Live: T2 dialogs answered by the user from the hot-loaded mod.
---
 lib/effort-shift.md                      |    4 +
 lib/tests/effort-routing.test.sh         |  169 ++-
 mods/model-router/hooks/register.test.ts | 1347 +++++++++++++++++++++-
 mods/model-router/hooks/register.ts      |  809 +++++++++++--
 mods/model-router/routing.json           |  144 +++
 5 files changed, 2299 insertions(+), 174 deletions(-)
 create mode 100644 mods/model-router/routing.json

diff --git a/lib/effort-shift.md b/lib/effort-shift.md
index dc487d0..52f685c 100644
--- a/lib/effort-shift.md
+++ b/lib/effort-shift.md
@@ -48,6 +48,10 @@ Builtin `/effort` is NOT a lever inside a run: rows and routes outrank it.
   typed marker (unverified live 2026-10-10).
 - Headless (`-p`, SDK) runs the hooks, so routing works there too.
 - Mod off: typed agents fall back to their `model:`/`effort:` frontmatter.
+- First use of a row asks once (Keep, Later or another phase, then
+  Everywhere or this project only); the answer is kept in
+  `mods/model-router/routing.json`. `/route pending` lists what is still
+  unconfirmed, `/route ask off|on` toggles the dialog.
 
 Measure the split any time: `python3 ~/.claude/lib/effort-audit.py`
 (thinking/output/cache tokens per scope, model and effort).
diff --git a/lib/tests/effort-routing.test.sh b/lib/tests/effort-routing.test.sh
index e2b9214..3d7f855 100755
--- a/lib/tests/effort-routing.test.sh
+++ b/lib/tests/effort-routing.test.sh
@@ -1,12 +1,16 @@
 #!/usr/bin/env bash
 # lib/tests/effort-routing.test.sh — wave-2 census of the model-router rows.
-# Drift lock: every tracked skill/agent row in mods/model-router/hooks/
-# register.ts equals its frontmatter (the off-state floor), the D3 wiring
-# markers sit in the orchestrators, no shifter citer survives.
+# Drift lock: every tracked skill/agent row of mods/model-router/routing.json
+# equals its frontmatter (the off-state floor), except a row the user changed
+# through the first-use dialog (WARN floor drift: the floor may lag a
+# confirmed decision); the D3 wiring markers sit in the orchestrators, no
+# shifter citer survives.
 # shellcheck disable=SC2015,SC2016  # A && ok || ko is deliberate (ok/ko never fail)
 set -u
 R="$(cd "$(dirname "$0")/../.." && pwd)"
-REG="$R/mods/model-router/hooks/register.ts"
+MOD="$R/mods/model-router"
+RJ="$MOD/routing.json"
+REG="$MOD/hooks/register.ts"
 pass=0; fail=0
 ok() { pass=$((pass+1)); }
 ko() { fail=$((fail+1)); printf 'FAIL %s\n' "$1"; }
@@ -16,84 +20,145 @@ lacks() { if grep -qF "$2" "$R/$1"; then ko "$1 must NOT contain: $2"; else ok;
 fm() { awk 'NR==1&&/^---$/{p=1;next} p&&/^---$/{exit} p' "$1"; }
 fm_val() { fm "$1" | grep -E "^$2: [a-z]+$" | head -1 | cut -d' ' -f2; }
 
-# ── register.ts parsers (awk/sed on the DEFAULT_CONFIG literal) ──────────
-# rows <file> <agents|skills> -> "name phase" per row
-rows() {
-  awk -v s="$2" '$0 ~ "^  "s": \\{"{f=1;next} f&&/^  \},?$/{f=0} f' "$1" \
-    | grep -v '^ *//' | grep -oE "('[^']+'|[A-Za-z0-9_-]+): '[a-z]+'" \
-    | sed -E "s/'//g; s/: / /"
-}
-# phase_effort <file> <phase> -> "<tier> <effort>"
-phase_effort() {
-  awk '/^  phases: \{/{f=1;next} f&&/^  \},?$/{f=0} f' "$1" \
-    | sed -nE "s/^ *$2: \{ tier: '([a-z]+)', effort: '([a-z]+)' \},?$/\1 \2/p"
+# ── routing.json (rows, phases, decisions) and the tier heads ────────────
+# dump <routing.json> -> "skills|agents <name> <phase>", "phases <p> <tier>
+# <effort>", "changed <kind> <name> <from> <to>" lines
+dump() {
+  python3 -I - "$1" <<'PY'
+import json, sys
+d = json.load(open(sys.argv[1]))
+for kind in ("skills", "agents"):
+    for k, v in d.get(kind, {}).items():
+        print(kind, k, v)
+for k, v in d.get("phases", {}).items():
+    print("phases", k, v.get("tier", ""), v.get("effort", ""))
+for kind in ("skills", "agents"):
+    for k, v in d.get("changed", {}).get(kind, {}).items():
+        print("changed", kind, k, v["from"], v["to"])
+PY
 }
+# lookups on a dump text: row_of D kind name · phase_effort D phase ·
+# changed_of D kind name -> "from to"
+row_of()       { printf '%s\n' "$1" | awk -v k="$2" -v n="$3" '$1==k&&$2==n{print $3}'; }
+phase_effort() { printf '%s\n' "$1" | awk -v p="$2" '$1=="phases"&&$2==p{print $3, $4}'; }
+changed_of()   { printf '%s\n' "$1" | awk -v k="$2" -v n="$3" '$1=="changed"&&$2==k&&$3==n{print $4, $5}'; }
 # tier_head <file> <tier> -> first alias of the tier list
 tier_head() {
   awk '/^  tiers: \{/{f=1;next} f&&/^  \},?$/{f=0} f' "$1" \
     | sed -nE "s/^ *$2: \['([a-z]+)'.*$/\1/p"
 }
-row_of() { rows "$REG" "$1" | awk -v n="$2" '$1==n{print $2}'; }
+# the fallback copy of the phases inside the mod's code: "<tier> <effort>"
+code_phase() {
+  awk '/^  phases: \{/{f=1;next} f&&/^  \},?$/{f=0} f' "$REG" \
+    | sed -nE "s/^ *$1: \{ tier: '([a-z]+)', effort: '([a-z]+)' \},?$/\1 \2/p"
+}
+# field_of <dump> <phase> <effort|model> -> that phase's frontmatter value
+field_of() {
+  local pe tier
+  pe="$(phase_effort "$1" "$2")"
+  if [ "$3" = effort ]; then printf '%s\n' "${pe#* }"; return; fi
+  tier="${pe% *}"; tier_head "$REG" "$tier"
+}
+# verdict <dump> <kind> <name> <effort|model> <got> <phase>: ok when the
+# frontmatter equals the row's phase; warn when the row was changed through
+# the dialog (changed.from is the shipped phase, changed.to the row) and the
+# frontmatter still holds the shipped value; fail otherwise (a Keep alone,
+# an empty or unknown value, a hand edit after a change)
+verdict() {
+  local D="$1" kind="$2" name="$3" field="$4" got="$5" phase="$6" ch from fromval
+  [ -n "$got" ] || { echo fail; return; }
+  [ "$got" = "$(field_of "$D" "$phase" "$field")" ] && { echo ok; return; }
+  ch="$(changed_of "$D" "$kind" "$name")"; from="${ch% *}"
+  [ -n "$ch" ] && [ "${ch#* }" = "$phase" ] || { echo fail; return; }
+  fromval="$(field_of "$D" "$from" "$field")"
+  [ -n "$fromval" ] && [ "$got" = "$fromval" ] && echo warn || echo fail
+}
+# floor_check <dump> <kind> <name> <effort|model> <got> <phase> <label>
+floor_check() {
+  case "$(verdict "$1" "$2" "$3" "$4" "$5" "$6")" in
+    ok) ok;;
+    warn) printf 'WARN floor drift: %s %s vs row %s (%s)\n' "$7" "$5" "$6" "$4"; ok;;
+    *) ko "$7: $4 '$5' != row $6 ($(field_of "$1" "$6" "$4"))";;
+  esac
+}
+RD="$(dump "$RJ")"
 
-# ── flip-test: the parsers read a fixture, reject a missing key ──────────
+# ── flip-test: the readers parse a fixture and reject the wrong verdicts ──
 FIX="$(mktemp -d)"; trap 'rm -rf "$FIX"' EXIT
 cat > "$FIX/reg.ts" <<'FX'
   tiers: {
     big: ['opus', 'fable'],
   },
-  phases: {
-    judge: { tier: 'big', effort: 'xhigh' },
-  },
-  agents: {
-    // judge
-    Plan: 'judge', 'plan-challenger': 'judge',
-  },
-  skills: {
-    'ship-feature': 'plan', doc: 'apply',
-  },
 FX
-[ "$(rows "$FIX/reg.ts" agents | tr '\n' ,)" = "Plan judge,plan-challenger judge," ] \
-  && ok || ko "flip: agents rows misparsed"
-[ "$(rows "$FIX/reg.ts" skills | tr '\n' ,)" = "ship-feature plan,doc apply," ] \
-  && ok || ko "flip: skills rows misparsed"
-[ "$(phase_effort "$FIX/reg.ts" judge)" = "big xhigh" ] && ok || ko "flip: phase"
-[ -z "$(phase_effort "$FIX/reg.ts" nothere)" ] && ok || ko "flip: ghost phase"
+cat > "$FIX/routing.json" <<'FX'
+{
+  "phases": {
+    "judge": { "tier": "big", "effort": "xhigh" },
+    "reflect": { "tier": "best", "effort": "high" },
+    "implement": { "tier": "work", "effort": "medium" }
+  },
+  "skills": { "feat": "implement", "doc": "reflect" },
+  "agents": { "Plan": "judge" },
+  "changed": { "skills": { "feat": { "from": "reflect", "to": "implement" } } },
+  "ask": true
+}
+FX
+FD="$(dump "$FIX/routing.json")"
+[ "$(row_of "$FD" agents Plan)" = judge ] && ok || ko "flip: agents row misread"
+[ "$(row_of "$FD" skills feat)" = implement ] && ok || ko "flip: skills row misread"
+[ -z "$(row_of "$FD" skills ghost)" ] && ok || ko "flip: ghost row"
+[ "$(phase_effort "$FD" judge)" = "big xhigh" ] && ok || ko "flip: phase"
+[ -z "$(phase_effort "$FD" nothere)" ] && ok || ko "flip: ghost phase"
 [ "$(tier_head "$FIX/reg.ts" big)" = "opus" ] && ok || ko "flip: tier head"
-[ "$(rows "$REG" skills | wc -l)" -gt 40 ] && ok || ko "register.ts: skills rows not parsed"
-[ "$(rows "$REG" agents | wc -l)" -gt 15 ] && ok || ko "register.ts: agents rows not parsed"
+[ "$(changed_of "$FD" skills feat)" = "reflect implement" ] && ok || ko "flip: changed entry"
+[ -z "$(changed_of "$FD" skills doc)" ] && ok || ko "flip: ghost changed entry"
+# the drift verdicts (high = reflect's effort, medium = implement's)
+[ "$(verdict "$FD" skills doc effort high reflect)" = ok ] && ok || ko "flip: equal must pass"
+[ "$(verdict "$FD" skills doc effort medium reflect)" = fail ] && ok || ko "flip: a Keep-only drift must FAIL"
+[ "$(verdict "$FD" skills feat effort high implement)" = warn ] && ok || ko "flip: changed.from drift must WARN"
+[ "$(verdict "$FD" skills feat effort '' implement)" = fail ] && ok || ko "flip: an empty value must FAIL"
+[ "$(verdict "$FD" skills feat effort banana implement)" = fail ] && ok || ko "flip: an unknown value must FAIL"
+[ "$(verdict "$FD" skills feat effort low implement)" = fail ] && ok || ko "flip: a drift off the shipped value must FAIL"
+[ "$(verdict "$FD" skills feat effort high reflect)" = ok ] && ok || ko "flip: row back to its shipped phase passes"
+[ "$(verdict "$FD" skills feat effort high judge)" = fail ] && ok || ko "flip: a hand edit after a change must FAIL"
+[ "$(echo "$RD" | grep -c '^skills ')" -gt 40 ] && ok || ko "routing.json: skills rows not read"
+[ "$(echo "$RD" | grep -c '^agents ')" -gt 15 ] && ok || ko "routing.json: agents rows not read"
+
+# ── the code's fallback phases equal routing.json's (never a stale route) ─
+n_code="$(awk '/^  phases: \{/{f=1;next} f&&/^  \},?$/{f=0} f' "$REG" | grep -c "tier:")"
+n_json="$(echo "$RD" | grep -c '^phases ')"
+[ "$n_code" -eq "$n_json" ] && ok || ko "phases: $n_code in code vs $n_json in routing.json"
+while read -r _ p tier effort; do
+  [ "$(code_phase "$p")" = "$tier $effort" ] && ok \
+    || ko "phase $p: code '$(code_phase "$p")' != routing.json '$tier $effort'"
+done < <(echo "$RD" | grep '^phases ')
 
 # ── (b) tracked skills: row exists, frontmatter effort equals the row ────
 NO_ROW_SKILLS=" find-docs graphify impeccable model-router "
 check_skill() {
-  local f="$1" name phase want got
+  local f="$1" name phase
   name="$(basename "$(dirname "$f")")"
   case "$NO_ROW_SKILLS" in *" $name "*) return;; esac
-  phase="$(row_of skills "$name")"
-  [ -n "$phase" ] || { ko "skills/$name: no row in register.ts"; return; }
-  want="$(phase_effort "$REG" "$phase" | cut -d' ' -f2)"
-  got="$(fm_val "$R/$f" effort)"
-  [ -n "$got" ] || { ko "skills/$name: routed skill without effort:"; return; }
-  [ "$got" = "$want" ] && ok || ko "skills/$name: effort $got != row $phase ($want)"
+  phase="$(row_of "$RD" skills "$name")"
+  [ -n "$phase" ] || { ko "skills/$name: no row in routing.json"; return; }
+  [ -n "$(fm_val "$R/$f" effort)" ] || { ko "skills/$name: routed skill without effort:"; return; }
+  floor_check "$RD" skills "$name" effort "$(fm_val "$R/$f" effort)" "$phase" "skills/$name"
 }
 while IFS= read -r f; do check_skill "$f"; done < <(
   cd "$R" && git ls-files 'skills/*/SKILL.md' 'skills-external/*/SKILL.md')
 
 # ── (c) tracked agents with a row: tier head == model:, effort == effort: ─
 NO_ROW_AGENTS=" interviewer client-handover-writer "
-tier_alias() { tier_head "$REG" "$(phase_effort "$REG" "$1" | cut -d' ' -f1)"; }
 check_agent() {
-  local f="$1" name phase alias want got
+  local f="$1" name phase
   name="$(basename "$f" .md)"
   case "$NO_ROW_AGENTS" in *" $name "*) return;; esac
   case "$name" in impeccable-*) return;; esac
-  phase="$(row_of agents "$name")"
-  [ -n "$phase" ] || { ko "agents/$name: no row in register.ts"; return; }
-  alias="$(tier_alias "$phase")"; got="$(fm_val "$R/$f" model)"
-  [ "$got" = "$alias" ] && ok || ko "agents/$name: model $got != row $phase ($alias)"
-  [ "$alias" = haiku ] && return
-  want="$(phase_effort "$REG" "$phase" | cut -d' ' -f2)"
-  got="$(fm_val "$R/$f" effort)"
-  [ "$got" = "$want" ] && ok || ko "agents/$name: effort $got != row $phase ($want)"
+  phase="$(row_of "$RD" agents "$name")"
+  [ -n "$phase" ] || { ko "agents/$name: no row in routing.json"; return; }
+  floor_check "$RD" agents "$name" model "$(fm_val "$R/$f" model)" "$phase" "agents/$name"
+  [ "$(field_of "$RD" "$phase" model)" = haiku ] && return
+  floor_check "$RD" agents "$name" effort "$(fm_val "$R/$f" effort)" "$phase" "agents/$name"
 }
 while IFS= read -r f; do check_agent "$f"; done < <(
   cd "$R" && git ls-files 'agents/*.md' | grep -E '^agents/[^/]+\.md$' \
diff --git a/mods/model-router/hooks/register.test.ts b/mods/model-router/hooks/register.test.ts
index 7e8c9b4..8e0b884 100644
--- a/mods/model-router/hooks/register.test.ts
+++ b/mods/model-router/hooks/register.test.ts
@@ -1,5 +1,5 @@
 import { test, expect, mock } from 'claude-code/testing'
-import type { Engine, MockClock } from 'claude-code/testing'
+import type { Engine, MockClock, Plugin } from 'claude-code/testing'
 import type { On, TurnStepInput } from 'claude-code'
 
 const FABLE = 'claude-fable-5-1'
@@ -7,17 +7,202 @@ const OPUS = 'claude-opus-5-5'
 const SONNET = 'claude-sonnet-5-5'
 const HAIKU = 'claude-haiku-4-5-20251001'
 
+type Rec = Record<string, unknown>
+type Asked = { text: string; options: string[]; header: string }
+
+const HOME = '/home/t'
+const HOME_FILE = `${HOME}/.claude/model-router.json`
+const ROOT = '/work/app'
+const REAL_ROOT = '/real/work/app'
+const REMOTE = 'https://github.com/acme/app.git'
+const KEY = 'github.com/acme/app'
+const REJECT = '<rejected>' // an answer the dialog never gets: headless
+
+/** What the bottom `fs`, `env`, `session.repo` and dialog hooks serve. */
+type World = {
+  files: Map<string, string> // 'routing' (routing.json) or a full path
+  reads: string[] // every path fs.read got
+  written: string[] // every path fs.write got
+  asked: Asked[] // the dialogs, in order
+  answers: string[] // queued dialog answers (REJECT = headless)
+  gate: Promise<void> | undefined // holds a dialog open until it settles
+  writeGate: Promise<void> | undefined // holds an fs.write open
+  failWrite: boolean // fs.write rejects
+  onAsk: (() => void) | undefined // called when a dialog opens
+  onWrite: (() => void) | undefined // called when an fs.write starts
+  repo: { root: string; remote: string | null } | null | 'fail'
+}
+
+type Fixture = {
+  ask?: boolean // routing.json `ask` (default false: no dialog)
+  edit?: (file: Rec) => void // tweaks the inline routing.json
+  routing?: 'absent' | 'broken'
+  home?: Rec | 'broken' // ~/.claude/model-router.json
+  answers?: string[]
+  repo?: World['repo']
+}
+
+/**
+ * The phases as shipped and the rows the tests use; the real table is
+ * locked by the census.
+ */
+const baseRouting = (): Rec => ({
+  phases: {
+    plan: { tier: 'best', effort: 'xhigh' },
+    reflect: { tier: 'best', effort: 'high' },
+    orchestrate: { tier: 'best', effort: 'medium' },
+    escalate: { tier: 'best', effort: 'max' },
+    judge: { tier: 'big', effort: 'xhigh' },
+    implement: { tier: 'work', effort: 'medium' },
+    write: { tier: 'work', effort: 'high' },
+    verify: { tier: 'work', effort: 'xhigh' },
+    explore: { tier: 'work', effort: 'medium' },
+    apply: { tier: 'work', effort: 'low' },
+    mechanical: { tier: 'cheap', effort: 'low' },
+  },
+  skills: {
+    feat: 'reflect',
+    status: 'mechanical',
+    gitflow: 'implement',
+    'using-git-worktrees': 'mechanical',
+  },
+  agents: {
+    Explore: 'explore',
+    'plan-challenger': 'judge',
+    feater: 'implement',
+    verifier: 'verify',
+  },
+  projects: {},
+  confirmed: {},
+  changed: {},
+  ask: false,
+})
+
+function newWorld(fx: Fixture = {}): World {
+  const file = baseRouting()
+  file.ask = fx.ask ?? false
+  fx.edit?.(file)
+  const files = new Map<string, string>()
+  if (fx.routing === 'broken') files.set('routing', '{nope')
+  else if (fx.routing !== 'absent') {
+    files.set('routing', JSON.stringify(file, null, 2))
+  }
+  if (fx.home !== undefined) {
+    files.set(HOME_FILE,
+      fx.home === 'broken' ? '{nope' : JSON.stringify(fx.home))
+  }
+  return {
+    files,
+    reads: [],
+    written: [],
+    asked: [],
+    answers: [...(fx.answers ?? [])],
+    gate: undefined,
+    writeGate: undefined,
+    failWrite: false,
+    onAsk: undefined,
+    onWrite: undefined,
+    repo: fx.repo === undefined ? { root: ROOT, remote: REMOTE } : fx.repo,
+  }
+}
+
+const slot = (path: string): string =>
+  path.endsWith('/routing.json') ? 'routing' : path
+
+/** routing.json as the world holds it now. */
+const routingOf = (w: World): Rec =>
+  JSON.parse(w.files.get('routing') ?? '{}') as Rec
+
+/**
+ * A path-aware fs, HOME, project root and repo: the kit has none (an fs call
+ * no hook answers is refused, never sent to the disk: see "writes: kit").
+ */
+function installWorld(on: On, w: World): void {
+  on('env.get', () => ({ value: HOME }))
+  on('fs.exists', (_a, e) => ({
+    value: w.files.has(slot(e.path)) || e.path === ROOT,
+  }))
+  on('fs.stat', (_a, e) => {
+    const text = w.files.get(slot(e.path))
+    if (text === undefined && e.path !== ROOT) throw new Error('ENOENT')
+    return {
+      value: {
+        kind: text === undefined ? 'dir' as const : 'file' as const,
+        size: text?.length ?? 0,
+        mtimeMs: 0,
+        isLink: false,
+        ...(e.resolve ? { realPath: REAL_ROOT } : {}),
+      },
+    }
+  })
+  on('fs.read', (_a, e) => {
+    w.reads.push(e.path)
+    const text = w.files.get(slot(e.path))
+    if (text === undefined) throw new Error('ENOENT')
+    return { value: text }
+  })
+  installWrite(on, w)
+  on('session.root', () => ({ value: ROOT }))
+  on('session.repo', () => {
+    if (w.repo === 'fail') throw new Error('no repo')
+    return { value: w.repo === null ? null : {
+      ...w.repo, internal: false, name: null,
+    } }
+  })
+  on('classic.CwdChanged', () => ({}))
+  installDialog(on, w)
+}
+
+/**
+ * The world's fs.write. Loud: a write anywhere but the routing.json the mod
+ * read fails the test (never a project tree, never the machine override).
+ */
+function installWrite(on: On, w: World): void {
+  on('fs.write', async (_a, e) => {
+    expect(slot(e.path) === 'routing' && w.reads.includes(e.path),
+      `the world never served ${e.path}`).toBe(true)
+    w.written.push(e.path)
+    w.onWrite?.()
+    await w.writeGate
+    if (w.failWrite) throw new Error('EACCES')
+    w.files.set(slot(e.path), e.text)
+    return { value: undefined }
+  })
+}
+
+/** The AskUserQuestion tool beneath `$.ui.ask`: records, then answers. */
+function installDialog(on: On, w: World): void {
+  on('tool.call', { tool: 'AskUserQuestion' }, async (_a, e) => {
+    const q = (e as unknown as { questions: Rec[] }).questions[0] ?? {}
+    const options = (q.options as { label: string }[] | undefined) ?? []
+    w.asked.push({
+      text: String(q.question),
+      options: options.map(o => o.label),
+      header: String(q.header),
+    })
+    w.onAsk?.()
+    await w.gate
+    const answer = w.answers.shift() ?? REJECT
+    if (answer === REJECT) return { deny: 'no one to ask' }
+    return { result: {
+      questions: e.questions, answers: { [String(q.question)]: answer },
+    } } as never
+  })
+}
+
 /**
  * Fires session.start so the mod loads its config and registers /route.
  * The bottom hooks the router reads are in place before the first `$` call:
  * the session model, the classic failure and switch events, a mock clock,
- * a small context (`tokens`; null = usage unanswered, size unknown).
+ * a small context (`tokens`; null = usage unanswered, size unknown), and
+ * the `world` (fs, repo, dialog) serving an inline routing.json.
  */
 async function boot(
   $: Engine,
   on: On,
   model: string = FABLE,
   tokens: number | null = 1000,
+  world: World = newWorld(),
 ): Promise<MockClock> {
   const clock = mock.clock(on)
   on('session.model', () => ({ value: model }))
@@ -25,6 +210,7 @@ async function boot(
   on('classic.PostModelSwitch', () => ({}))
   on('skill.prompt', ($, e) => ({ text: e.text }))
   on('agent.offer', () => ({ isOffered: true }))
+  installWorld(on, world)
   if (tokens !== null) usageOf(on, tokens)
   on('session.start', ($, e) => ({ cwd: e.cwd }))
   await $.session.start({ cwd: '/tmp', surface: null, isInteractive: false })
@@ -364,8 +550,8 @@ test('floor: the route answer names the floor over a sticky', async (
   expect(text).toContain('/route clear')
 })
 
-// `enabled: false` in ~/.claude/model-router.json cannot be reached here (the
-// kit has no fs); the shared off path is covered through `/route off`.
+// `enabled: false` in ~/.claude/model-router.json has its own layers test;
+// this one covers the shared off path through `/route off`.
 test('floor: /route off keeps the floor from routing', async ($, on) => {
   const seen = await bootFloor($, on)
   await ultrathink($)
@@ -383,7 +569,7 @@ test('per axis: a model-only sticky keeps the turn route effort', async (
 })
 
 // The config-driven `offConfig` is re-applied in the same rebuild; only the
-// session-only off is reachable here (the kit has no fs).
+// session-only off is reached here (the config-driven one has its own test).
 test('session.end rebuild drops a session-only /route off', async (
   $, on) => {
   on('session.end', ($, e) => ({ sessionId: e.sessionId }))
@@ -397,11 +583,13 @@ test('session.end rebuild drops a session-only /route off', async (
   expect(await route($, 'show')).toContain('router: on')
 })
 
-// The kit has no fs: the reload read fails, so the previous cfg must stay.
+// The override breaks after the first load: the previous cfg must stay.
 test('reload with an unreadable override keeps the previous config', async (
   $, on) => {
-  await boot($, on)
+  const world = newWorld({ home: {} })
+  await boot($, on, FABLE, 1000, world)
   await route($, 'switch on')
+  world.files.set(HOME_FILE, '{nope')
   const out = await route($, 'reload')
   expect(out).toContain('switch: on')
   expect(await route($, 'show')).toContain('switch: on')
@@ -419,6 +607,7 @@ async function bootRig(
   on: On,
   model: string = FABLE,
   tokens: number | null = 1000,
+  world: World = newWorld(),
 ): Promise<Rig> {
   const seen: Seen[] = []
   const specs: (string | undefined)[] = []
@@ -438,7 +627,7 @@ async function bootRig(
       outputFile: '/tmp/o',
     },
   }))
-  const clock = await boot($, on, model, tokens)
+  const clock = await boot($, on, model, tokens, world)
   return { seen, clock, specs }
 }
 
@@ -787,11 +976,16 @@ const loadSkill = ($: Engine, skill: string, agentId?: string) =>
   })
 
 /** bootRig plus a bottom Skill tool, so a model-loaded skill goes through. */
-async function bootRun($: Engine, on: On, model: string = FABLE) {
+async function bootRun(
+  $: Engine,
+  on: On,
+  model: string = FABLE,
+  world: World = newWorld(),
+) {
   on('tool.call', { tool: 'Skill' }, () => ({
     result: { success: true, commandName: 'bottom' },
   }))
-  return bootRig($, on, model)
+  return bootRig($, on, model, 1000, world)
 }
 
 const spawnOf = (agent: string, extra: object = {}) =>
@@ -1060,13 +1254,8 @@ test('agent row: a project definition keeps its own model', async ($, on) => {
 })
 
 test('agent row: an override null drops the row', async ($, on) => {
-  on('env.get', () => ({ value: '/home/t' }))
-  on('fs.exists', () => ({ value: true }))
-  on('fs.stat', () => ({
-    value: { kind: 'file' as const, size: 40, mtimeMs: 0, isLink: false },
-  }))
-  on('fs.read', () => ({ value: '{"agents":{"verifier":null}}' }))
-  const rig = await bootRun($, on)
+  const world = newWorld({ home: { agents: { verifier: null } } })
+  const rig = await bootRun($, on, FABLE, world)
   await $.agent.spawn(spawnOf('verifier'))
   await $.agent.spawn(spawnOf('feater'))
   expect(rig.specs).toEqual([undefined, SONNET])
@@ -1228,3 +1417,1127 @@ test('spawning: a finished spawn no longer counts as a live loop', async (
   await skillPrompt($, 'status')
   expect(mainLine(await route($, 'show'))).toContain('skill mechanical')
 })
+
+// ---- wave 3-A: routing.json layers ---------------------------------------
+
+/** A ui.toast recorder, same shape as recordLogs. */
+function recordToasts(on: On): string[] {
+  const lines: string[] = []
+  on('ui.toast', async ($, e, next) => {
+    lines.push(e.text)
+    try {
+      await next(e)
+    } catch {
+      // nothing implements ui.toast below the recorder in the kit
+    }
+  })
+  return lines
+}
+
+const projectRows = (agents: Rec, key: string = KEY) => (file: Rec) => {
+  file.projects = { [key]: { agents } }
+}
+
+/** The model a `feater` spawn reaches the bottom hook with. */
+async function featerModel($: Engine, rig: Rig): Promise<string | undefined> {
+  await $.agent.spawn(spawnOf('feater'))
+  return rig.specs[rig.specs.length - 1]
+}
+
+test('layers: routing.json rows route a spawn', async ($, on) => {
+  const rig = await bootRun($, on)
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('layers: a projects[key] row beats the routing.json row', async (
+  $, on) => {
+  const w = newWorld({ edit: projectRows({ feater: 'judge' }) })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(OPUS)
+})
+
+test('layers: another repo key leaves the routing.json row', async (
+  $, on) => {
+  const w = newWorld({ edit: projectRows({ feater: 'judge' }, 'other/repo') })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('layers: the machine override beats the project row', async (
+  $, on) => {
+  const w = newWorld({
+    edit: projectRows({ feater: 'judge' }),
+    home: { agents: { feater: 'mechanical' } },
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(HAIKU)
+})
+
+test('layers: a .claude/model-router.json in the project is never read', async (
+  $, on) => {
+  const w = newWorld()
+  const tree = `${ROOT}/.claude/model-router.json`
+  w.files.set(tree, '{"agents":{"feater":"judge"}}')
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+  expect(w.reads).not.toContain(tree)
+})
+
+test('layers: the machine override\'s ask:false is honored', async (
+  $, on) => {
+  const w = newWorld({ ask: true, home: { ask: false } })
+  await bootRun($, on, FABLE, w)
+  await typed($, '/feat x')
+  await skillPrompt($, 'feat')
+  expect(w.asked).toEqual([])
+})
+
+test('layers: a row on a phase the table lacks is ignored, logged', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({
+    edit: f => { (f.agents as Rec).feater = 'ghost' },
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBeUndefined()
+  expect(logs.join('\n')).toContain('config agents.feater ignored')
+})
+
+test('layers: an invalid routing.json phase falls back by name', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({
+    edit: f => { f.phases = { reflect: { tier: 'nope' } } },
+  })
+  await bootRun($, on, FABLE, w)
+  const text = await route($, 'show')
+  expect(text).toContain('reflect=best→claude-fable-5-1/high')
+  expect(logs.join('\n')).toContain('config phases.reflect ignored')
+})
+
+test('layers: a valid routing.json phase replaces the default', async (
+  $, on) => {
+  const w = newWorld({
+    edit: f => { f.phases = { reflect: { tier: 'work', effort: 'low' } } },
+  })
+  await bootRun($, on, FABLE, w)
+  const text = await route($, 'show')
+  expect(text).toContain('reflect=work→claude-sonnet-5-5/low')
+})
+
+test('layers: a routing.json phase gone missing falls back, logged', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({ edit: f => { delete (f.phases as Rec).reflect } })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'show')).toContain('reflect=best→claude-fable-5-1/high')
+  expect(logs.filter(l => l.includes('lacks phases'))).toEqual([
+    'model-router: routing.json lacks phases reflect; code defaults kept',
+  ])
+})
+
+test('layers: a row may name a phase only the override defines', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({
+    edit: f => {
+      ;(f.skills as Rec).feat = 'custom'
+      projectRows({ feater: 'custom' })(f)
+    },
+    home: { phases: { custom: { tier: 'cheap', effort: 'low' } } },
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(await mainNow($)).toContain('skill custom')
+  expect(await featerModel($, rig)).toBe(HAIKU)
+  expect(logs.join('\n')).not.toContain('ignored')
+})
+
+test('layers: show names routing.json as the config', async ($, on) => {
+  await bootRun($, on)
+  expect(await route($, 'show')).toContain('config: routing.json')
+})
+
+test('layers: first load skips a broken override, keeps routing.json', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({ home: 'broken' })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+  expect(logs.join('\n')).toContain('model-router.json unreadable')
+})
+
+test('layers: a later broken override keeps the whole previous config', async (
+  $, on) => {
+  const w = newWorld({ home: { agents: { feater: 'mechanical' } } })
+  const rig = await bootRun($, on, FABLE, w)
+  w.files.set(HOME_FILE, '{nope')
+  expect(await route($, 'reload')).toContain('config reloaded')
+  expect(await featerModel($, rig)).toBe(HAIKU)
+})
+
+test('layers: a routing.json gone missing keeps the previous config', async (
+  $, on) => {
+  const w = newWorld()
+  const rig = await bootRun($, on, FABLE, w)
+  w.files.delete('routing')
+  await route($, 'reload')
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('layers: routing.json unreadable at start means defaults, no rows', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({ routing: 'broken', ask: true })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBeUndefined()
+  expect(await route($, 'show')).toContain('plan=best→claude-fable-5-1/xhigh')
+  const said = logs.filter(l => l.includes('routing.json unreadable'))
+  expect(said).toHaveLength(1)
+})
+
+test('layers: routing.json missing at start logs once, no rows', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = newWorld({ routing: 'absent' })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBeUndefined()
+  expect(logs.filter(l => l.includes('routing.json missing'))).toHaveLength(1)
+})
+
+test('layers: session toggles survive a rebuild', async ($, on) => {
+  await bootRun($, on)
+  await route($, 'switch on')
+  await route($, 'verbose on')
+  const out = await route($, 'reload')
+  expect(out).toContain('switch: on')
+  expect(out).toContain('verbose: on')
+})
+
+test('layers: /clear keeps the config, the next prompt re-reads it', async (
+  $, on) => {
+  on('session.end', ($, e) => ({ sessionId: e.sessionId }))
+  const w = newWorld()
+  const rig = await bootRun($, on, FABLE, w)
+  await clearOf($)
+  const before = w.reads.length
+  expect(await featerModel($, rig)).toBe(SONNET)
+  expect(w.reads.length).toBe(before)
+  const file = routingOf(w)
+  projectRows({ feater: 'judge' })(file)
+  w.files.set('routing', JSON.stringify(file))
+  await typed($, 'hello')
+  expect(await featerModel($, rig)).toBe(OPUS)
+})
+
+test('layers: /clear swaps nothing when the re-read fails', async ($, on) => {
+  on('session.end', ($, e) => ({ sessionId: e.sessionId }))
+  const w = newWorld()
+  const rig = await bootRun($, on, FABLE, w)
+  await clearOf($)
+  w.files.delete('routing')
+  await typed($, 'hello')
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('layers: a state that never saw session.start loads on first use', async (
+  $, on) => {
+  const w = newWorld()
+  installWorld(on, w)
+  on('agent.offer', () => ({ isOffered: true }))
+  const specs: (string | undefined)[] = []
+  on('agent.spawn', ($, e) => {
+    specs.push(e.model)
+    return { model: e.model ?? e.parentModel, agentId: 'a1' }
+  })
+  await $.agent.spawn(spawnOf('feater'))
+  expect(specs).toEqual([SONNET])
+})
+
+test('layers: a cwd change re-reads the layers for the new repo', async (
+  $, on) => {
+  const w = newWorld({
+    edit: projectRows({ feater: 'judge' }, 'github.com/o/two'),
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+  w.repo = { root: '/work/two', remote: 'git@GitHub.com:o/two.git' }
+  await $.classic.CwdChanged({ old_cwd: ROOT, new_cwd: '/work/two' })
+  expect(await featerModel($, rig)).toBe(OPUS)
+})
+
+test('layers: no remote gives no project key, no local: string', async (
+  $, on) => {
+  const w = asks(['implement', 'This project only'],
+    { repo: { root: ROOT, remote: null } })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+  expect(w.written).toEqual([])
+  expect(w.files.get('routing')).not.toContain('local:')
+  expect(w.files.get('routing')).not.toContain(REAL_ROOT)
+})
+
+test('layers: a failing repo read skips only the project layer', async (
+  $, on) => {
+  const w = newWorld({ edit: projectRows({ feater: 'judge' }), repo: 'fail' })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('layers: a remote with credentials keys without them', async ($, on) => {
+  const w = newWorld({
+    edit: projectRows({ feater: 'judge' }),
+    repo: { root: ROOT, remote: 'https://me:tok@GitHub.com/acme/app/' },
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(OPUS)
+})
+
+/** The project keys "This project only" stores for a remote. */
+async function keyedBy($: Engine, on: On, remote: string) {
+  const w = asks(['implement', 'This project only'],
+    { repo: { root: ROOT, remote } })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  return { w, keys: Object.keys(routingOf(w).projects as Rec) }
+}
+
+for (const bad of [
+  'https://user:p@ss@Host.com/a/b.git',
+  'https://user:pa/ss@host/a/b.git',
+]) {
+  test(`layers: credentials never become a key: ${bad}`, async ($, on) => {
+    const { w, keys } = await keyedBy($, on, bad)
+    expect(keys).toEqual([])
+    expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+    expect(w.files.get('routing')).not.toContain('ss@')
+  })
+}
+
+/** Remotes each rejected by exactly one guard of normalizeRemote. */
+for (const [guard, bad] of [
+  ['path @', 'https://user:12/ss@host/a/b.git'],
+  ['empty host', 'file:///srv/git/app.git'],
+  ['host [@:]', 'https://[::1]/a/b'],
+  ['non-URL', 'https:host/a/b'],
+  ['non-URL', 'weird remote'],
+] as const) {
+  test(`layers: ${guard} guard rejects ${bad}`, async ($, on) => {
+    const { w, keys } = await keyedBy($, on, bad)
+    expect(keys).toEqual([])
+    expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+    expect(w.files.get('routing')).not.toContain('/srv/')
+    expect(w.files.get('routing')).not.toContain('ss@')
+  })
+}
+
+for (const [remote, key] of [
+  ['https://tok@host/a/b', 'host/a/b'],
+  ['git@github.com:acme/app.git', KEY],
+  [REMOTE, KEY],
+] as const) {
+  test(`layers: ${remote} keys as ${key}`, async ($, on) => {
+    expect((await keyedBy($, on, remote)).keys).toEqual([key])
+  })
+}
+
+// ---- wave 3-A: first-use dialog -------------------------------------------
+
+/** A world with dialogs on and the answers queued. */
+const asks = (answers: string[], fx: Fixture = {}) =>
+  newWorld({ ask: true, answers, ...fx })
+
+/** The user types /feat; the engine then loads the skill's prompt. */
+async function typeFeat($: Engine): Promise<void> {
+  await typed($, '/feat add a thing')
+  await skillPrompt($, 'feat')
+}
+
+const mainNow = async ($: Engine) => mainLine(await route($, 'show'))
+const confirmedOf = (w: World): Rec => routingOf(w).confirmed as Rec
+
+test('T1: a typed skill asks once, with the real id and effort', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked).toHaveLength(1)
+  const first = w.asked[0] as Asked
+  expect(first.text).toContain('/feat')
+  expect(first.text).toContain('claude-fable-5-1 at high')
+  expect(first.options).toEqual(['Later', 'Keep', 'plan', 'implement'])
+  expect(first.header).toBe('model-router')
+})
+
+test('T1: the question follows the model main will really run on', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, SONNET, w)
+  await typeFeat($)
+  expect(w.asked[0]?.text).toContain('claude-fable-5-1 at high')
+})
+
+test('T1: Keep writes the row and its phase, then the skill never asks', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(confirmedOf(w)).toEqual({
+    skills: { feat: 'reflect' },
+    phases: { reflect: 'reflect' },
+  })
+  await typeFeat($)
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T1: Keep leaves the route as it was', async ($, on) => {
+  await bootRun($, on, FABLE, asks(['Keep']))
+  await typeFeat($)
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T1: an alt then Everywhere rewrites the row and routes at once', async (
+  $, on) => {
+  const w = asks(['implement', 'Everywhere'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const file = routingOf(w)
+  expect((file.skills as Rec).feat).toBe('implement')
+  expect((file.changed as Rec).skills).toEqual({
+    feat: { from: 'reflect', to: 'implement' },
+  })
+  expect(confirmedOf(w).skills).toEqual({ feat: 'implement' })
+  expect(await mainNow($)).toContain('skill implement')
+})
+
+test('T1: the scope question names the two scopes', async ($, on) => {
+  const w = asks(['implement', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[1]?.options).toEqual(['Everywhere', 'This project only'])
+})
+
+test('T1: This project only writes the exception, not the row', async (
+  $, on) => {
+  const w = asks(['implement', 'This project only'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const file = routingOf(w)
+  expect((file.skills as Rec).feat).toBe('reflect')
+  expect(file.projects).toEqual({ [KEY]: { skills: { feat: 'implement' } } })
+  expect(file.changed).toEqual({})
+  expect(confirmedOf(w).skills).toEqual({ feat: 'reflect' })
+  expect(await mainNow($)).toContain('skill implement')
+})
+
+test('T1: after a project exception no other project asks', async ($, on) => {
+  const w = asks(['implement', 'This project only'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  w.repo = { root: '/work/two', remote: 'https://github.com/acme/two.git' }
+  await $.classic.CwdChanged({ old_cwd: ROOT, new_cwd: '/work/two' })
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+/** /clear: a new conversation, the config kept and re-read at the prompt. */
+function clearOf($: Engine) {
+  return $.session.end({
+    reason: 'clear',
+    sessionId: 's1',
+    resume: { id: 's1' },
+  })
+}
+
+test('T1: a second change keeps the first shipped phase in changed', async (
+  $, on) => {
+  on('session.end', ($, e) => ({ sessionId: e.sessionId }))
+  const w = asks(['implement', 'Everywhere', 'apply', 'Everywhere'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const file = routingOf(w)
+  ;(file.confirmed as Rec).skills = {}
+  w.files.set('routing', JSON.stringify(file))
+  await clearOf($)
+  await typeFeat($)
+  expect(((routingOf(w).changed as Rec).skills as Rec).feat).toEqual({
+    from: 'reflect',
+    to: 'apply',
+  })
+})
+
+test('T1: a free-text phase counts as an alt', async ($, on) => {
+  const w = asks(['apply', 'Everywhere'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect((routingOf(w).skills as Rec).feat).toBe('apply')
+})
+
+test('T1: a free-text answer equal to the current phase is a Keep', async (
+  $, on) => {
+  const w = asks(['reflect'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(confirmedOf(w).skills).toEqual({ feat: 'reflect' })
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T1: Later applies the default, writes nothing, asks no more', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await typeFeat($)
+  expect(w.written).toEqual([])
+  expect(w.asked).toHaveLength(1)
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T1: a dismissed dialog is a Later', async ($, on) => {
+  const w = asks([REJECT])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await typeFeat($)
+  expect(w.written).toEqual([])
+  expect(w.asked).toHaveLength(1)
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T1: an unknown phase is a Later and says so', async ($, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['banana'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.written).toEqual([])
+  expect(toasts.join('\n')).toContain('unknown phase "banana"')
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T1: a scope answer that is not a label is a Later', async ($, on) => {
+  const w = asks(['implement', 'whenever'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.written).toEqual([])
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T1: without a repo key only Everywhere is offered', async ($, on) => {
+  const w = asks(['implement', 'This project only'], { repo: 'fail' })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+  expect(w.written).toEqual([])
+})
+
+test('T1: the model\'s own Skill call never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await loadSkill($, 'feat')
+  expect(w.asked).toEqual([])
+})
+
+test('T1: a skill without a row never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typed($, '/other')
+  await skillPrompt($, 'other')
+  expect(w.asked).toEqual([])
+})
+
+test('T1: a project row counts as decided', async ($, on) => {
+  const w = asks(['Keep'], {
+    edit: f => { f.projects = { [KEY]: { skills: { feat: 'plan' } } } },
+  })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+  expect(await mainNow($)).toContain('skill plan')
+})
+
+test('T1: a machine override row counts as decided', async ($, on) => {
+  const w = asks(['Keep'], { home: { skills: { feat: 'plan' } } })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('T1: another session\'s decision is seen before the dialog', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  const file = routingOf(w)
+  file.confirmed = { skills: { feat: 'reflect' } }
+  w.files.set('routing', JSON.stringify(file))
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('T1: `ask` turned off elsewhere is seen before the dialog', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  const file = routingOf(w)
+  file.ask = false
+  w.files.set('routing', JSON.stringify(file))
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('T1: a row edited by hand after a Keep asks again', async ($, on) => {
+  on('session.end', ($, e) => ({ sessionId: e.sessionId }))
+  const w = asks(['Keep', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const file = routingOf(w)
+  ;(file.skills as Rec).feat = 'plan'
+  w.files.set('routing', JSON.stringify(file))
+  await clearOf($)
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+})
+
+test('T1: ask false asks nothing', async ($, on) => {
+  const w = newWorld({ answers: ['Keep'] })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('T1: the router off asks nothing', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await route($, 'off')
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('T1: routing.json unreadable at the dialog asks nothing', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  w.files.delete('routing')
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+  expect(await mainNow($)).toContain('skill reflect')
+})
+
+test('T3: routing.json unreadable at the dialog asks nothing', async (
+  $, on) => {
+  const w = asks(['Keep'], { routing: 'broken' })
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.asked).toEqual([])
+})
+
+test('T1: a failed write applies the default, key left unasked', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = asks(['Keep', 'Later'])
+  await bootRun($, on, FABLE, w)
+  w.failWrite = true
+  await typeFeat($)
+  expect(await mainNow($)).toContain('skill reflect')
+  expect(logs.join('\n')).toContain('first-use dialog failed')
+  w.failWrite = false
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+})
+
+const failures = (logs: string[]): string[] =>
+  logs.filter(l => l.includes('first-use dialog failed'))
+
+test('T1: two failed writes log the failure once', async ($, on) => {
+  const logs = recordLogs(on)
+  const w = asks(['Keep', 'Keep'])
+  await bootRun($, on, FABLE, w)
+  w.failWrite = true
+  await typeFeat($)
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+  expect(failures(logs)).toHaveLength(1)
+})
+
+test('T1: a rebuild failing after the write leaves the key unasked', async (
+  $, on) => {
+  const logs = recordLogs(on)
+  const w = asks(['implement', 'Everywhere'])
+  await bootRun($, on, FABLE, w)
+  w.onWrite = () => { w.files.set(HOME_FILE, '{nope') }
+  await typeFeat($)
+  expect((routingOf(w).skills as Rec).feat).toBe('implement')
+  expect(await mainNow($)).toContain('skill reflect')
+  const pending = (await route($, 'pending')).split('\n')
+  expect(pending[1]).toBe('asked this session: none')
+  expect(failures(logs)).toHaveLength(1)
+  expect(failures(logs)[0]).toContain('rebuild failed after the write')
+})
+
+test('T1: a Keep toasts that routing.json changed', async ($, on) => {
+  const toasts = recordToasts(on)
+  await bootRun($, on, FABLE, asks(['Keep']))
+  await typeFeat($)
+  expect(toasts.join('\n')).toContain('routing.json updated: commit it')
+})
+
+test('writes: only routing.json, 2-space, keys in the documented order', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.written).toHaveLength(1)
+  expect(w.written[0]).toMatch(/\/mods\/model-router\/routing\.json$/)
+  expect(w.files.get('routing')).toMatch(/^\{\n {2}"phases"/)
+  expect(Object.keys(routingOf(w))).toEqual([
+    'phases', 'skills', 'agents', 'projects', 'confirmed', 'changed', 'ask',
+  ])
+})
+
+test('writes: a missing routing.json is never created', async ($, on) => {
+  const w = newWorld({ routing: 'absent' })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'ask off')
+  expect(out).toContain('missing or unreadable')
+  expect(w.written).toEqual([])
+})
+
+test('writes: two writers on one file both land', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const seen = deferred()
+  w.writeGate = held.gate
+  w.onWrite = seen.release
+  const first = typeFeat($)
+  await seen.gate
+  w.onWrite = undefined
+  const second = route($, 'ask off')
+  await new Promise(r => setTimeout(r, 20)) // let a second writer start
+  held.release()
+  await first
+  await second
+  expect(routingOf(w).ask).toBe(false)
+  expect(confirmedOf(w).skills).toEqual({ feat: 'reflect' })
+})
+
+test('writes: the route tool never writes', async ($, on) => {
+  const w = newWorld()
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'plan' })
+  await $.tool.call({ tool: ROUTE_TOOL, effort: 'low' })
+  expect(w.written).toEqual([])
+})
+
+/** An alt answer, then `scope`: the world after the typed /feat. */
+async function changeFeat($: Engine, on: On, scope: string) {
+  const w = asks(['implement', scope])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  return w
+}
+
+test('writes: an Everywhere change is one write', async ($, on) => {
+  const w = await changeFeat($, on, 'Everywhere')
+  expect(w.written).toHaveLength(1)
+  const file = routingOf(w)
+  expect((file.skills as Rec).feat).toBe('implement')
+  expect((file.changed as Rec).skills).toEqual({
+    feat: { from: 'reflect', to: 'implement' },
+  })
+  expect(confirmedOf(w).skills).toEqual({ feat: 'implement' })
+})
+
+test('writes: a This project only change is one write', async ($, on) => {
+  const w = await changeFeat($, on, 'This project only')
+  expect(w.written).toHaveLength(1)
+  const file = routingOf(w)
+  expect(file.projects).toEqual({ [KEY]: { skills: { feat: 'implement' } } })
+  expect(confirmedOf(w).skills).toEqual({ feat: 'reflect' })
+})
+
+/** Rebuilds the fixture in reverse key order: `ask` first, `phases` last. */
+function reverseKeys(file: Rec): void {
+  const copy = { ...file }
+  for (const key of Object.keys(copy)) delete file[key]
+  for (const key of Object.keys(copy).reverse()) file[key] = copy[key]
+}
+
+test('writes: an out-of-order routing.json is written back in order', async (
+  $, on) => {
+  const w = asks(['Keep'], { edit: reverseKeys })
+  expect(Object.keys(routingOf(w))).toEqual([
+    'ask', 'changed', 'confirmed', 'projects', 'agents', 'skills', 'phases',
+  ])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.written).toHaveLength(1)
+  expect(Object.keys(routingOf(w))).toEqual([
+    'phases', 'skills', 'agents', 'projects', 'confirmed', 'changed', 'ask',
+  ])
+})
+
+test('writes: an output over the cap is refused: a Later', async ($, on) => {
+  const toasts = recordToasts(on)
+  const pad = (f: Rec) => {
+    f.pad = 'x'.repeat(65536 - JSON.stringify(f, null, 2).length - 60)
+  }
+  const w = asks(['Keep'], { edit: pad })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(toasts.join('\n')).toContain(
+    'routing.json would exceed 65536 bytes: nothing saved')
+  expect(w.written).toEqual([])
+})
+
+const NOTHING_SAVED = 'routing.json is missing or unreadable: nothing saved'
+
+test('writes: routing.json gone at the save: a Later, kept asked', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Keep', 'Keep'])
+  await bootRun($, on, FABLE, w)
+  const saved = w.files.get('routing') ?? ''
+  w.onAsk = () => { w.files.delete('routing') }
+  await typeFeat($)
+  expect(toasts).toContain(NOTHING_SAVED)
+  expect(w.written).toEqual([])
+  expect(w.files.has('routing')).toBe(false)
+  expect(await mainNow($)).toContain('skill reflect')
+  w.onAsk = undefined
+  w.files.set('routing', saved)
+  await typeFeat($)
+  expect(w.asked).toHaveLength(1)
+  const pending = (await route($, 'pending')).split('\n')
+  expect(pending[1]).toBe('asked this session: skills:feat')
+})
+
+// The kit has no disk: an fs.write no hook answers, or whose mock throws
+// (the engine skips a failing hook), is refused by the kit's bottom. The
+// probe aims at /home/t, where nothing can be created: a real write would
+// fail there with a disk error, not this one.
+const REFUSED = 'no implementation for fs.write'
+
+/** An inline plugin: `/probe <path>` says what `$.fs.write` did. */
+const PROBE: Plugin = {
+  name: 'fs-probe',
+  register: on => {
+    on('command.run', { command: 'probe' }, async ($, e) => {
+      try {
+        await $.fs.write(e.args, 'x')
+        return { text: 'written' }
+      } catch (err) {
+        return { text: String(err) }
+      }
+    })
+  },
+}
+
+const probe = async ($: Engine): Promise<string> => (await $.command.run({
+  command: 'probe',
+  args: `${HOME}/never-written.json`,
+  origin: { kind: 'composer' },
+  presentation: { isFullscreen: false, columns: 80 },
+})).text ?? ''
+
+test('writes: kit: an fs.write no hook answers is refused', {
+  plugins: [PROBE],
+}, async $ => {
+  expect(await probe($)).toContain(REFUSED)
+})
+
+test('writes: kit: a throwing fs.write mock lands on the same refusal', {
+  plugins: [PROBE],
+}, async ($, on) => {
+  on('fs.write', () => {
+    throw new Error('EACCES')
+  })
+  expect(await probe($)).toContain(REFUSED)
+})
+
+// ---- wave 3-A: T2 agent spawns, T3 route tool ----------------------------
+
+test('T2: a rowed spawn asks with the model and effort it will get', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  const q = w.asked[0] as Asked
+  expect(q.text).toContain('First dispatch of feater')
+  expect(q.text).toContain('claude-sonnet-5-5 at medium')
+  expect(q.options).toEqual(['Later', 'Keep', 'judge', 'verify'])
+})
+
+test('T2: the question carries an explicit effort param', async ($, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({
+    tool: 'Agent',
+    description: 'd',
+    prompt: 'p',
+    effort: 'low',
+    tool_use_id: 't1',
+  })
+  await $.agent.spawn(spawnOf('feater'))
+  expect(w.asked[0]?.text).toContain('claude-sonnet-5-5 at low')
+})
+
+test('T2: Keep writes the agent row and the spawn goes on', async ($, on) => {
+  const w = asks(['Keep'])
+  const rig = await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  expect(confirmedOf(w)).toEqual({
+    agents: { feater: 'implement' },
+    phases: { implement: 'implement' },
+  })
+  expect(rig.specs).toEqual([SONNET])
+  await $.agent.spawn(spawnOf('feater'))
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T2: a change routes this very spawn with the new row', async (
+  $, on) => {
+  const w = asks(['judge', 'Everywhere'])
+  const rig = await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  expect(rig.specs).toEqual([OPUS])
+})
+
+test('T2: an explicit model param never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater', { model: 'opus' }))
+  expect(w.asked).toEqual([])
+})
+
+test('T2: a spawn inside an agent never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  const rig = await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater', { parentAgentId: 'a9' }))
+  expect(w.asked).toEqual([])
+  expect(rig.specs).toEqual([SONNET])
+})
+
+test('T2: a project-defined agent never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await offerOf($, 'verifier', 'projectSettings')
+  await $.agent.spawn(spawnOf('verifier'))
+  expect(w.asked).toEqual([])
+})
+
+test('T2: an agent without a row never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('stranger'))
+  expect(w.asked).toEqual([])
+})
+
+test('T2: a parallel spawn of the same agent is routed unasked', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  const rig = await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const open = deferred()
+  w.gate = held.gate
+  w.onAsk = open.release
+  const owner = $.agent.spawn(spawnOf('feater'))
+  await open.gate
+  await $.agent.spawn(spawnOf('feater'))
+  expect(rig.specs).toEqual([SONNET])
+  held.release()
+  await owner
+  expect(w.asked).toHaveLength(1)
+  expect(rig.specs).toEqual([SONNET, SONNET])
+})
+
+test('T2: a parallel spawn of another agent is routed unasked', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  const rig = await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const open = deferred()
+  w.gate = held.gate
+  w.onAsk = open.release
+  const owner = $.agent.spawn(spawnOf('feater'))
+  await open.gate
+  await $.agent.spawn(spawnOf('plan-challenger'))
+  expect(rig.specs).toEqual([OPUS])
+  held.release()
+  await owner
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T2: the unasked agent is asked at its next use', async ($, on) => {
+  const w = asks(['Keep', 'Keep'])
+  const rig = await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const open = deferred()
+  w.gate = held.gate
+  w.onAsk = open.release
+  const owner = $.agent.spawn(spawnOf('feater'))
+  await open.gate
+  await $.agent.spawn(spawnOf('plan-challenger'))
+  held.release()
+  await owner
+  w.gate = undefined
+  await $.agent.spawn(spawnOf('plan-challenger'))
+  expect(w.asked).toHaveLength(2)
+  expect(rig.specs).toEqual([OPUS, SONNET, OPUS])
+})
+
+test('T3: a phase declared through the route tool asks Keep or Later', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  const q = w.asked[0] as Asked
+  expect(q.text).toContain('First use of orchestrate on the main loop')
+  expect(q.text).toContain('claude-fable-5-1 at medium')
+  expect(q.options).toEqual(['Later', 'Keep'])
+})
+
+test('T3: Keep endorses the phase in routing.json', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(confirmedOf(w)).toEqual({ phases: { orchestrate: 'orchestrate' } })
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T3: no change is offered, a phase name answer is a Later', async (
+  $, on) => {
+  const w = asks(['plan'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.written).toEqual([])
+  expect(await mainNow($)).toContain('model orchestrate')
+})
+
+test('T3: a phase endorsed by a skill Keep is not asked again', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'reflect' })
+  expect(w.asked).toHaveLength(1)
+})
+
+test('T3: an effort-only call never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, effort: 'low' })
+  expect(w.asked).toEqual([])
+})
+
+test('T3: a route call inside an agent never asks', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'judge', agentId: 'a1' })
+  expect(w.asked).toEqual([])
+})
+
+test('a step never opens a dialog', async ($, on) => {
+  const w = asks(['Keep'])
+  const rig = await bootRig($, on, FABLE, 1000, w)
+  await runStep($, highStep())
+  expect(w.asked).toEqual([])
+  expect(rig.seen).toHaveLength(1)
+})
+
+// ---- wave 3-A: /route pending, ask, reload -------------------------------
+
+test('/route pending lists what is not confirmed, asked first', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const lines = (await route($, 'pending')).split('\n')
+  expect(lines[0]).toBe('pending confirmation: 19')
+  expect(lines[1]).toBe('asked this session: skills:feat')
+  expect(lines[2]).toContain('agents:feater')
+  expect(lines[2]).toContain('phases:plan')
+  expect(lines[2]).not.toContain('skills:feat')
+})
+
+test('/route pending drops a confirmed row', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const text = await route($, 'pending')
+  expect(text).toContain('pending confirmation: 17')
+  expect(text).not.toContain('phases:reflect')
+})
+
+test('/route ask off writes the flag and silences the dialog', async (
+  $, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'ask off')).toContain('ask off')
+  expect(routingOf(w).ask).toBe(false)
+  await typeFeat($)
+  expect(w.asked).toEqual([])
+})
+
+test('/route ask on turns the dialog back on', async ($, on) => {
+  const w = newWorld({ answers: ['Later'] })
+  await bootRun($, on, FABLE, w)
+  await route($, 'ask on')
+  expect(routingOf(w).ask).toBe(true)
+  await typeFeat($)
+  expect(w.asked).toHaveLength(1)
+})
+
+test('/route ask names a machine override that wins', async ($, on) => {
+  const w = newWorld({ home: { ask: false } })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'ask on')).toContain('sets ask off and wins')
+})
+
+test('/route ask wants on or off', async ($, on) => {
+  const w = newWorld()
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'ask maybe')).toContain('usage: /route ask on|off')
+  expect(w.written).toEqual([])
+})
+
+test('/route ask refuses a user-less origin like the rest of /route', async (
+  $, on) => {
+  const w = newWorld()
+  await bootRun($, on, FABLE, w)
+  const out = await $.command.run({
+    command: 'route',
+    args: 'ask off',
+    origin: { kind: 'plugin', name: 'x' },
+    presentation: { isFullscreen: false, columns: 80 },
+  })
+  expect(out.text).toContain('user-only')
+  expect(w.written).toEqual([])
+})
+
+test('/route reload re-reads routing.json and the override', async (
+  $, on) => {
+  const w = newWorld()
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(SONNET)
+  const file = routingOf(w)
+  ;(file.agents as Rec).feater = 'judge'
+  w.files.set('routing', JSON.stringify(file))
+  w.files.set(HOME_FILE, '{"agents":{"verifier":"mechanical"}}')
+  await route($, 'reload')
+  expect(await featerModel($, rig)).toBe(OPUS)
+  await $.agent.spawn(spawnOf('verifier'))
+  expect(rig.specs[rig.specs.length - 1]).toBe(HAIKU)
+})
+
+test('layers: enabled:false in the override survives /clear', async (
+  $, on) => {
+  on('session.end', ($, e) => ({ sessionId: e.sessionId }))
+  const w = newWorld({ home: { enabled: false } })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await route($, 'show')).toContain('router: off (config)')
+  await clearOf($)
+  expect(await route($, 'show')).toContain('router: off (config)')
+  expect(await featerModel($, rig)).toBeUndefined()
+})
diff --git a/mods/model-router/hooks/register.ts b/mods/model-router/hooks/register.ts
index a8ef430..732dbda 100644
--- a/mods/model-router/hooks/register.ts
+++ b/mods/model-router/hooks/register.ts
@@ -1,9 +1,10 @@
 // model-router: routes each model request (main loop and sub-agents) to the
 // model and effort its phase deserves. Phases name a TIER (an ordered list of
 // aliases, the first available wins); a circuit breaker fed by the engine's
-// own failure events marks a model down for a while. Phases, agents, skills
-// and prompt rules come from DEFAULT_CONFIG, overridable by
-// ~/.claude/model-router.json.
+// own failure events marks a model down for a while. Phases, skill and agent
+// rows come from routing.json (tracked next to this mod; the first use of a
+// row asks the user once, see "first use" below), the rest from
+// DEFAULT_CONFIG; ~/.claude/model-router.json overrides both per machine.
 // One writer per concern: the Agent tool's own params are never rewritten,
 // the spawn hook sets an agent's model once, turn.step sets efforts.
 import type { EngineInterface, On, Register, TurnStepInput } from 'claude-code'
@@ -77,6 +78,14 @@ type State = {
   logged: Set<string> // session-once log lines
   turnLogged: Set<string> // turn-once log lines
   warned: Set<string> // hooks whose fail-open was already logged
+  mem: Memory // what routing.json says about decisions, as last read
+  override: Rec | undefined // the machine override's data, if it loaded
+  loaded: boolean // the layers were read once (else: lazily, on first use)
+  rebuildDue: boolean // /clear: re-read the layers at the next prompt
+  toggles: { switch?: boolean; verbose?: boolean } // session toggles
+  asking: string | null // key of the one first-use dialog in flight
+  asked: Set<string> // keys answered (or failed) this session
+  writes: Promise<unknown> // the serialized routing.json write chain
 }
 type Log = (text: string) => void
 type StepIn = Readonly<TurnStepInput>
@@ -91,6 +100,20 @@ type Picked = { phase: string; route: Route }
 type Effort = StepIn['effort']
 type EffortBy = 'floor' | 'sticky' | 'turn' | 'engine'
 type Decision = { effort: Effort; by: EffortBy }
+type Rec = Record<string, unknown>
+type Table = Record<string, string>
+type Row = 'skills' | 'agents' // a table of rows in routing.json
+type Kind = Row | 'phases' // what a first-use decision is about
+/** What routing.json says about decisions, as last read. */
+type Memory = {
+  ok: boolean // the file was read: false = no dialog, no write
+  ask: boolean // dialogs on (the machine override wins over the file)
+  askLocal: boolean | undefined // the machine override's own `ask`
+  base: Record<Row, Table> // the file's rows, before any project layer
+  confirmed: Record<Kind, Table> // name -> the phase a Keep endorsed
+  local: Record<Row, Set<string>> // rows of projects[key] or the override
+  key: string | undefined // normalized repo key; undefined = no project layer
+}
 
 const LEVELS: readonly Level[] = ['low', 'medium', 'high', 'xhigh', 'max']
 const MODEL_ID = /^claude-[a-z0-9.-]+$/
@@ -109,6 +132,23 @@ const USER_SWITCH: ReadonlySet<string> = new Set([
   'command', 'picker', 'sdk',
 ])
 const OVERRIDE = '.claude/model-router.json'
+const ROUTING = 'routing.json' // next to plugin.json: the tracked source
+// Key order of a written routing.json; other keys follow, untouched.
+const ROUTING_ORDER: readonly string[] = [
+  'phases', 'skills', 'agents', 'projects', 'confirmed', 'changed', 'ask',
+]
+// First-use dialog: answers, and the phases offered as alternatives.
+const LATER = 'Later'
+const KEEP = 'Keep'
+const EVERYWHERE = 'Everywhere'
+const THIS_PROJECT = 'This project only'
+const ALTS: Record<Kind, readonly string[]> = {
+  skills: ['plan', 'reflect', 'implement', 'apply'],
+  agents: ['judge', 'implement', 'verify', 'apply'],
+  phases: [],
+}
+const ROWS: readonly Row[] = ['skills', 'agents']
+const KINDS: readonly Kind[] = ['skills', 'agents', 'phases']
 const HAIKU = 'claude-haiku'
 const MAX_PATTERN = 200 // chars of a prompt-rule pattern
 const MAX_PROMPT_SCAN = 4096 // chars of a prompt a rule is run against
@@ -157,63 +197,10 @@ const DEFAULT_CONFIG: Config = {
     apply: { tier: 'work', effort: 'low' },
     mechanical: { tier: 'cheap', effort: 'low' },
   },
-  // phase = role; one row per routed repo skill/agent (wave 2); a
-  // project-level agent of the same name shadows its row (see spawnRoute).
-  agents: {
-    // explore
-    Explore: 'explore',
-    // judge
-    Plan: 'judge', 'plan-challenger': 'judge', 'plugin-advisor': 'judge',
-    'seo-analyzer': 'judge', 'geo-analyzer': 'judge', analyzer: 'judge',
-    // implement
-    feater: 'implement', bugfixer: 'implement', 'code-cleaner': 'implement',
-    scaffolder: 'implement', onboarder: 'implement',
-    // write
-    'commit-changer': 'write', 'doc-syncer': 'write',
-    'handover-doc-writer': 'write', refactorer: 'write',
-    // apply
-    hotfixer: 'apply', 'release-executor': 'apply', 'plugin-probe': 'apply',
-    'validator-analyzer': 'apply',
-    // verify
-    verifier: 'verify', 'security-auditor': 'verify',
-    // mechanical
-    'status-reporter': 'mechanical',
-  },
-  skills: {
-    // plan
-    'ship-feature': 'plan', 'init-project': 'plan', onboard: 'plan',
-    tour: 'plan', 'audit-delta': 'plan', analyze: 'plan',
-    'code-clean': 'plan', 'client-handover': 'plan', brainstorming: 'plan',
-    'writing-plans': 'plan', 'requesting-code-review': 'plan',
-    '21st-ui-review': 'plan',
-    // reflect
-    feat: 'reflect', hotfix: 'reflect', bugfix: 'reflect',
-    refactor: 'reflect', 'web-validate': 'reflect', harden: 'reflect',
-    seo: 'reflect', geo: 'reflect', 'site-motion': 'reflect',
-    'frontend-design': 'reflect', 'emil-design-eng': 'reflect',
-    'design-motion-principles': 'reflect', '21st-ui-build': 'reflect',
-    'scroll-world-storytelling': 'reflect',
-    'build-threejs-scroll-worlds': 'reflect',
-    'scroll-scrubbed-visual-sequence': 'reflect',
-    'scroll-scrubbed-word-reveal': 'reflect',
-    'scroll-progress-timeline': 'reflect',
-    'subagent-driven-development': 'reflect', 'writing-skills': 'reflect',
-    'deprecation-and-migration': 'reflect', '21st-ai': 'reflect',
-    '21st-ui-explore': 'reflect',
-    // implement
-    gitflow: 'implement', 'prune-memory': 'implement',
-    'pdf-translate': 'implement', 'ci-cd-and-automation': 'implement',
-    'observability-and-instrumentation': 'implement',
-    'test-driven-development': 'implement',
-    // apply
-    'commit-change': 'apply', 'release-candidate': 'apply', doc: 'apply',
-    capitalize: 'apply', close: 'apply', reconcile: 'apply', deploy: 'apply',
-    // mechanical
-    status: 'mechanical', profile: 'mechanical', 'plugin-check': 'mechanical',
-    'skills-perso': 'mechanical', 'using-git-worktrees': 'mechanical',
-    '21st-cli-use': 'mechanical', '21st-registry': 'mechanical',
-    '21st-design-sync': 'mechanical',
-  },
+  // Rows (skill/agent -> phase) live in routing.json, the tracked source;
+  // a project-level agent of the same name shadows its row (see spawnRoute).
+  agents: {},
+  skills: {},
   // `floor` rules set the turn's minimum effort; `default` rules set the
   // turn's route, which a route call or a skill overrides. Neither lowers.
   prompt: [
@@ -479,9 +466,13 @@ function mergeRows(
   return rows
 }
 
-/** Defaults overlaid with the user's entries, each validated first. */
-function mergeConfig(user: unknown, log: Log): Config {
-  const base = structuredClone(DEFAULT_CONFIG)
+/** `seed` (the defaults) overlaid with the user's entries, each validated. */
+function mergeConfig(
+  user: unknown,
+  log: Log,
+  seed: Config = DEFAULT_CONFIG,
+): Config {
+  const base = structuredClone(seed)
   if (!isRecord(user)) {
     if (user !== undefined) log('model-router: config ignored: not an object')
     return base
@@ -512,10 +503,10 @@ function mergeConfig(user: unknown, log: Log): Config {
 async function readCapped(
   $: Api,
   path: string,
+  label: string,
   log: Log,
 ): Promise<string | undefined> {
-  const tooBig =
-    `model-router: ${OVERRIDE} over ${MAX_CONFIG_BYTES} bytes`
+  const tooBig = `model-router: ${label} over ${MAX_CONFIG_BYTES} bytes`
   if ((await $.fs.stat(path)).size > MAX_CONFIG_BYTES) {
     log(tooBig)
     return undefined
@@ -526,38 +517,240 @@ async function readCapped(
   return undefined
 }
 
-type Override = { path: string; data: unknown } | 'absent' | 'failed'
+type Layer = { path: string; data: Rec } | 'absent' | 'failed'
 
 /** 'absent': no file (defaults apply). 'failed': present but unusable. */
-async function readOverride($: Api, log: Log): Promise<Override> {
+async function readLayer(
+  $: Api,
+  path: string,
+  label: string,
+  log: Log,
+): Promise<Layer> {
   try {
-    const home = await $.env.get('HOME')
-    if (!home) return 'absent'
-    const path = `${home}/${OVERRIDE}`
     if (!(await $.fs.exists(path))) return 'absent'
-    const text = await readCapped($, path, log)
+    const text = await readCapped($, path, label, log)
     if (text === undefined) return 'failed'
     const data: unknown = JSON.parse(text)
     if (isRecord(data)) return { path, data }
-    log(`model-router: ${OVERRIDE} is not an object`)
+    log(`model-router: ${label} is not an object`)
     return 'failed'
+  } catch (err) {
+    log(`model-router: ${label} unreadable (${String(err)})`)
+    return 'failed'
+  }
+}
+
+const readRouting = ($: Api, log: Log): Promise<Layer> =>
+  readLayer($, `${$.plugin.root}/${ROUTING}`, ROUTING, log)
+
+async function readOverride($: Api, log: Log): Promise<Layer> {
+  try {
+    const home = await $.env.get('HOME')
+    if (!home) return 'absent'
+    return await readLayer($, `${home}/${OVERRIDE}`, OVERRIDE, log)
   } catch (err) {
     log(`model-router: ${OVERRIDE} unreadable (${String(err)})`)
     return 'failed'
   }
 }
 
-/** Never throws; undefined when the override exists but cannot be used. */
-async function loadConfig(
-  $: Api,
-  log: Log,
-): Promise<{ cfg: Config; source: string } | undefined> {
-  const found = await readOverride($, log)
-  if (found === 'failed') return undefined
-  if (found === 'absent') {
-    return { cfg: mergeConfig(undefined, log), source: 'defaults' }
+// ---- routing.json: decision memory and project exceptions --------------
+
+const strTable = (v: unknown): Table =>
+  isRecord(v)
+    ? Object.fromEntries(Object.entries(v).filter(
+      (entry): entry is [string, string] => typeof entry[1] === 'string'))
+    : {}
+
+const subRec = (v: unknown, key: string): Rec => {
+  const found = isRecord(v) && hasKey(v, key) ? v[key] : undefined
+  return isRecord(found) ? found : {}
+}
+
+/** The rows of `projects[key]`: this repo's exceptions. */
+function projectRows(file: Rec, key: string | undefined): Record<Row, Table> {
+  const mine = key === undefined ? {} : subRec(file.projects, key)
+  return { skills: strTable(mine.skills), agents: strTable(mine.agents) }
+}
+
+function emptyMemory(): Memory {
+  return {
+    ok: false,
+    ask: true,
+    askLocal: undefined,
+    base: { skills: {}, agents: {} },
+    confirmed: { skills: {}, agents: {}, phases: {} },
+    local: { skills: new Set(), agents: new Set() },
+    key: undefined,
   }
-  return { cfg: mergeConfig(found.data, log), source: found.path }
+}
+
+/** What the file and the machine override say about decisions. */
+function buildMemory(
+  file: Rec,
+  key: string | undefined,
+  override: Rec | undefined,
+): Memory {
+  const project = projectRows(file, key)
+  const flag = override?.ask
+  const askLocal = typeof flag === 'boolean' ? flag : undefined
+  const sure = subRec(file, 'confirmed')
+  const local = (row: Row): Set<string> => new Set([
+    ...Object.keys(project[row]), ...Object.keys(strTable(override?.[row])),
+  ])
+  return {
+    ok: true,
+    ask: askLocal ?? file.ask !== false,
+    askLocal,
+    base: { skills: strTable(file.skills), agents: strTable(file.agents) },
+    confirmed: {
+      skills: strTable(sure.skills),
+      agents: strTable(sure.agents),
+      phases: strTable(sure.phases),
+    },
+    local: { skills: local('skills'), agents: local('agents') },
+    key,
+  }
+}
+
+const SCP_REMOTE = /^[A-Za-z0-9._-]+@([A-Za-z0-9.-]+):([^:@]+)$/
+const URL_REMOTE = /^[a-z][a-z0-9+.-]*:\/\//i
+
+/** [host, path] of a remote, userinfo never read; undefined if unclear. */
+function remoteParts(url: string): [string, string] | undefined {
+  const scp = SCP_REMOTE.exec(url)
+  if (scp) return [scp[1] as string, scp[2] as string]
+  if (!URL_REMOTE.test(url)) return undefined
+  // a second `@` in the authority hides a secret in the userinfo
+  const authority = url.replace(URL_REMOTE, '').split('/')[0] ?? ''
+  if (authority.split('@').length > 2) return undefined
+  try {
+    const u = new URL(url)
+    return [u.host, u.pathname]
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * A repo's identity across clones and machines: its origin remote reduced to
+ * `host/path` (scheme, userinfo, `.git` and trailing slash dropped, host
+ * lowercased). A remote that cannot be read with certainty, or that leaves
+ * an `@` or `:` in the host or an `@` in the path, gives undefined: no
+ * credential ever reaches the tracked file.
+ */
+function normalizeRemote(url: string): string | undefined {
+  const parts = remoteParts(url.trim())
+  if (parts === undefined) return undefined
+  const host = parts[0].toLowerCase()
+  const path = parts[1].replace(/^\/+/, '').replace(/\/+$/, '')
+    .replace(/\.git$/i, '')
+  if (host === '' || path === '' || path.includes('@')) return undefined
+  return /[@:]/.test(host.replace(/:\d+$/, '')) ? undefined : `${host}/${path}`
+}
+
+async function projectKey($: Api): Promise<string | undefined> {
+  try {
+    const repo = await $.session.repo()
+    return repo?.remote ? normalizeRemote(repo.remote) : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** routing.json's phases and rows as a user table, this repo's rows last. */
+function routingTables(file: Rec, key: string | undefined): Rec {
+  const project = projectRows(file, key)
+  return {
+    phases: file.phases,
+    skills: { ...strTable(file.skills), ...project.skills },
+    agents: { ...strTable(file.agents), ...project.agents },
+  }
+}
+
+type Loaded = {
+  cfg: Config
+  source: string
+  mem: Memory
+  override: Rec | undefined
+}
+
+function sourceWord(file: Layer, over: Layer): string {
+  const fileWord = typeof file === 'string' ? undefined : ROUTING
+  const overWord = typeof over === 'string' ? undefined : over.path
+  if (fileWord && overWord) return `${fileWord} + ${overWord}`
+  return fileWord ?? overWord ?? 'defaults'
+}
+
+/** A phase routing.json lacks keeps the code default: one line names them. */
+function logMissingPhases(phases: unknown, log: Log): void {
+  if (phases !== undefined && !isRecord(phases)) return // mergeTable says it
+  const missing = Object.keys(DEFAULT_CONFIG.phases)
+    .filter(name => !isRecord(phases) || !hasKey(phases, name))
+  if (missing.length === 0) return
+  log(`model-router: ${ROUTING} lacks phases ${missing.join(', ')}; ` +
+    'code defaults kept')
+}
+
+/**
+ * Defaults < routing.json < the machine override. The phases of both files
+ * merge first; every layer's rows then validate against that final table,
+ * so a routing.json row may name a phase only the override defines.
+ */
+function layerConfig(
+  tables: Rec | undefined,
+  override: Rec | undefined,
+  log: Log,
+): Config {
+  const seeded = mergeConfig(tables && { phases: tables.phases }, log)
+  const cfg = mergeConfig(
+    override && { ...override, skills: undefined, agents: undefined },
+    log, seeded)
+  const ref = acceptPhaseRef(cfg.phases)
+  for (const row of ROWS) {
+    const base = mergeRows(cfg[row], tables?.[row], row, ref, log)
+    cfg[row] = mergeRows(base, override?.[row], row, ref, log)
+  }
+  return cfg
+}
+
+/** Defaults < routing.json (phases, rows, this repo's rows) < override. */
+async function assemble(
+  $: Api,
+  file: Layer,
+  over: Layer,
+  log: Log,
+): Promise<Loaded> {
+  const fileData = typeof file === 'string' ? undefined : file.data
+  const override = typeof over === 'string' ? undefined : over.data
+  if (file === 'absent') {
+    log(`model-router: ${ROUTING} missing; default phases, no rows, no asks`)
+  }
+  const key = fileData === undefined ? undefined : await projectKey($)
+  if (fileData !== undefined) logMissingPhases(fileData.phases, log)
+  const cfg = layerConfig(
+    fileData && routingTables(fileData, key), override, log)
+  const mem = fileData === undefined
+    ? emptyMemory()
+    : buildMemory(fileData, key, override)
+  return { cfg, source: sourceWord(file, over), mem, override }
+}
+
+/**
+ * Reads the layers. At the first load a failed layer is skipped (logged); in
+ * every later read any failure, or a routing.json gone missing, returns
+ * undefined so the caller keeps the whole previous config.
+ */
+async function loadLayers(
+  $: Api,
+  first: boolean,
+  log: Log,
+): Promise<Loaded | undefined> {
+  const file = await readRouting($, log)
+  const over = await readOverride($, log)
+  const broken = file === 'failed' || file === 'absent' || over === 'failed'
+  if (broken && !first) return undefined
+  return assemble($, file, over, log)
 }
 
 /** Compiles the prompt rules; one that fails to compile is dropped, logged. */
@@ -605,13 +798,23 @@ function newState(cfg: Config, source: string): State {
     logged: new Set(),
     turnLogged: new Set(),
     warned: new Set(),
+    mem: emptyMemory(),
+    override: undefined,
+    loaded: false,
+    rebuildDue: false,
+    toggles: {},
+    asking: null,
+    asked: new Set(),
+    writes: Promise.resolve(),
   }
 }
 
 /**
  * /clear rebuilds the state but keeps what is account- or process-wide:
- * the breaker (a model's quota outlives the conversation), the model and
- * the agent definitions' sources (the listing is not offered again).
+ * the breaker (a model's quota outlives the conversation), the model, the
+ * agent definitions' sources (the listing is not offered again), the config
+ * with its session toggles and the dialog in flight. The layers are read
+ * again at the next prompt; the config is swapped only if that read works.
  */
 function resetSession(st: State): void {
   const kept = {
@@ -620,8 +823,15 @@ function resetSession(st: State): void {
     agentModels: st.agentModels,
     sessionModel: st.sessionModel,
     offers: st.offers,
+    mem: st.mem,
+    override: st.override,
+    loaded: st.loaded,
+    toggles: st.toggles,
+    asking: st.asking,
+    writes: st.writes,
   }
   Object.assign(st, newState(st.cfg, st.source), kept)
+  st.rebuildDue = st.loaded
 }
 
 /** Logs a hook's fail-open once per session; never throws itself. */
@@ -1179,8 +1389,9 @@ async function toggle(
   arg: string | undefined,
 ): Promise<string> {
   if (arg !== 'on' && arg !== 'off') return `usage: /route ${what} on|off`
-  if (what === 'switch') st.cfg.mainModelSwitch = arg === 'on'
-  else st.cfg.verbose = arg === 'on'
+  if (what === 'switch') st.toggles.switch = arg === 'on'
+  else st.toggles.verbose = arg === 'on'
+  applyToggles(st)
   return show($, st)
 }
 
@@ -1192,22 +1403,49 @@ async function setUserRoute($: Api, st: State, args: string) {
   return show($, st)
 }
 
+/** Session toggles outlive any rebuild of the config. */
+function applyToggles(st: State): void {
+  const { switch: downgrade, verbose } = st.toggles
+  if (downgrade !== undefined) st.cfg.mainModelSwitch = downgrade
+  if (verbose !== undefined) st.cfg.verbose = verbose
+}
+
+function applyLoaded(st: State, loaded: Loaded, log: Log): void {
+  st.cfg = loaded.cfg
+  st.rules = compileRules(loaded.cfg, log)
+  st.source = loaded.source
+  st.mem = loaded.mem
+  st.override = loaded.override
+  st.loaded = true
+  st.rebuildDue = false
+  applyToggles(st)
+  applyEnabled(st, loaded.cfg.enabled)
+}
+
 /**
- * (Re)loads the config into the state and re-registers the route tool.
- * An unusable override keeps the previous config: the kill switch fails
- * closed, never back to the defaults.
+ * (Re)loads the layers into the state and re-registers the route tool.
+ * After the first load an unusable layer keeps the whole previous config:
+ * the kill switch fails closed, never back to the defaults. True when the
+ * new config was swapped in.
  */
-async function reloadConfig($: Api, st: State): Promise<void> {
-  const loaded = await loadConfig($, text => $.ui.log(text))
-  if (loaded) {
-    st.cfg = loaded.cfg
-    st.rules = compileRules(loaded.cfg, text => $.ui.log(text))
-    st.source = loaded.source
-    applyEnabled(st, loaded.cfg.enabled)
-  } else {
-    $.ui.log('model-router: override unreadable; keeping the previous config')
-  }
+async function reloadConfig($: Api, st: State): Promise<boolean> {
+  const log = (text: string): void => $.ui.log(text)
+  const loaded = await loadLayers($, !st.loaded, log)
+  if (loaded) applyLoaded(st, loaded, log)
+  else log('model-router: config unreadable; keeping the previous config')
   await registerTool($, st)
+  return loaded !== undefined
+}
+
+/**
+ * The layers are read at session.start; a state that never saw it (a
+ * /reload-plugins re-runs register) loads on its first use. /clear leaves
+ * a re-read due, taken by the next prompt only (`atPrompt`).
+ */
+async function ensureConfig($: Api, st: State, atPrompt = false) {
+  if (st.loaded && !(atPrompt && st.rebuildDue)) return
+  st.rebuildDue = false
+  await reloadConfig($, st)
 }
 
 /** The breaker is cleared first, whatever the config read then does. */
@@ -1240,6 +1478,10 @@ async function handleCommand($: Api, st: State, args: string): Promise<string> {
       return show($, st)
     case 'reload':
       return reloadCommand($, st)
+    case 'pending':
+      return pendingText(st)
+    case 'ask':
+      return askCommand($, st, rest[0])
     case 'switch':
     case 'verbose':
       return toggle($, st, head, rest[0])
@@ -1248,6 +1490,328 @@ async function handleCommand($: Api, st: State, args: string): Promise<string> {
   }
 }
 
+// ---- first use: one dialog per row, the answer kept in routing.json -----
+// The first time a row routes (a typed skill, an agent spawn, a phase
+// declared through the route tool) the user confirms it once, for every
+// project; a change can be a project exception. Only a dialog answer or
+// `/route ask` writes; nothing is asked on the step path or in an agent.
+
+const HEADER = 'model-router'
+const UPDATED = 'routing.json updated: commit it from the config repo ' +
+  '(chore branch)'
+
+type Req = { kind: Kind; name: string; phase: string }
+type RowReq = Req & { kind: Row }
+type Answer =
+  | { act: 'later' }
+  | { act: 'keep' }
+  | { act: 'change'; phase: string }
+type Scope = 'everywhere' | 'project' | 'later'
+type Patch = (file: Rec) => void
+
+const keyOf = (req: { kind: Kind; name: string }): string =>
+  `${req.kind}:${req.name}`
+const isRowReq = (req: Req): req is RowReq => req.kind !== 'phases'
+const own = (t: Table, name: string): string | undefined =>
+  hasKey(t, name) ? t[name] : undefined
+
+/** Decided: a Keep or change confirmed the row, or a layer set it. */
+function isDecided(mem: Memory, kind: Kind, name: string): boolean {
+  if (kind === 'phases') return own(mem.confirmed.phases, name) === name
+  if (mem.local[kind].has(name)) return true
+  const base = own(mem.base[kind], name)
+  return base !== undefined && own(mem.confirmed[kind], name) === base
+}
+
+const wantsAsk = (st: State, req: Req): boolean =>
+  !st.off && st.mem.ask && !st.asked.has(keyOf(req)) &&
+  !isDecided(st.mem, req.kind, req.name)
+
+/** The file as it is now: another live session may have decided since. */
+async function refreshMemory($: Api, st: State): Promise<boolean> {
+  const file = await readRouting($, text => $.ui.log(text))
+  if (typeof file === 'string') return false
+  st.mem = buildMemory(file.data, await projectKey($), st.override)
+  return true
+}
+
+async function askOr(
+  $: Api,
+  text: string,
+  options: readonly string[],
+): Promise<string> {
+  try {
+    return await $.ui.ask(text, { options, header: HEADER })
+  } catch {
+    return LATER // dismissed, or no one to ask (-p run)
+  }
+}
+
+function optionsFor(st: State, req: Req): string[] {
+  const alts = ALTS[req.kind]
+    .filter(p => p !== req.phase && hasKey(st.cfg.phases, p))
+  return req.kind === 'phases'
+    ? [LATER, KEEP]
+    : [LATER, KEEP, ...alts.slice(0, 2)]
+}
+
+/** Keep, a phase of the table (an alt or free text), else Later. */
+function decide($: Api, st: State, req: Req, answer: string): Answer {
+  if (answer === KEEP) return { act: 'keep' }
+  if (answer === LATER || req.kind === 'phases') return { act: 'later' }
+  if (!hasKey(st.cfg.phases, answer)) {
+    const shown = answer.slice(0, 40).replace(/[\u0000-\u001f]/g, ' ')
+    $.ui.toast(`unknown phase "${shown}", default kept`)
+    return { act: 'later' }
+  }
+  return answer === req.phase
+    ? { act: 'keep' }
+    : { act: 'change', phase: answer }
+}
+
+async function askScope(
+  $: Api,
+  st: State,
+  req: Req,
+  to: string,
+): Promise<Scope> {
+  const key = st.mem.key
+  const text = `Use ${to} for ${req.name} everywhere, or only in this project?`
+  const answer = await askOr($, text,
+    [EVERYWHERE, key === undefined ? LATER : THIS_PROJECT])
+  if (answer === EVERYWHERE) return 'everywhere'
+  return answer === THIS_PROJECT && key !== undefined ? 'project' : 'later'
+}
+
+function table(parent: Rec, key: string): Rec {
+  const found = isRecord(parent[key]) ? parent[key] : undefined
+  if (found) return found
+  const fresh: Rec = {}
+  parent[key] = fresh
+  return fresh
+}
+
+function setKey(target: Rec, key: string, value: unknown): void {
+  if (key !== '__proto__') target[key] = value
+}
+
+const confirmIn = (file: Rec, kind: Kind, name: string, phase: string) =>
+  setKey(table(table(file, 'confirmed'), kind), name, phase)
+
+/** A Keep endorses the row and its phase (no second ask at the route tool). */
+function keepPatch(req: Req): Patch {
+  return file => {
+    if (isRowReq(req)) confirmIn(file, req.kind, req.name, req.phase)
+    confirmIn(file, 'phases', req.phase, req.phase)
+  }
+}
+
+/**
+ * Everywhere: the row moves, `changed` keeps the FIRST shipped phase for
+ * the census. This project only: the row stays, the exception goes under
+ * the repo key and the base row counts as confirmed (nobody else asks).
+ */
+function changePatch(req: RowReq, to: string, scope: Scope, key?: string) {
+  return (file: Rec): void => {
+    const rows = table(file, req.kind)
+    const was = typeof rows[req.name] === 'string' ? rows[req.name] : req.phase
+    if (scope === 'project' && key !== undefined) {
+      const mine = table(table(file, 'projects'), key)
+      setKey(table(mine, req.kind), req.name, to)
+      confirmIn(file, req.kind, req.name, String(was))
+      return
+    }
+    const changed = table(table(file, 'changed'), req.kind)
+    const first = subRec(changed, req.name).from ?? was
+    setKey(rows, req.name, to)
+    setKey(changed, req.name, { from: first, to })
+    confirmIn(file, req.kind, req.name, to)
+  }
+}
+
+function serializeRouting(file: Rec): string {
+  const known = ROUTING_ORDER.filter(k => hasKey(file, k))
+  const extra = Object.keys(file).filter(k => !ROUTING_ORDER.includes(k))
+  const ordered = Object.fromEntries(
+    [...known, ...extra].map(k => [k, file[k]]))
+  return JSON.stringify(ordered, null, 2) + '\n'
+}
+
+/**
+ * Read-modify-write of routing.json, one at a time (a chain). Refuses a
+ * missing or unparsable file and never creates it; rebuilds the config
+ * after, swapped only if the read works.
+ */
+async function writeNow($: Api, st: State, patch: Patch): Promise<boolean> {
+  const file = await readRouting($, text => $.ui.log(text))
+  if (typeof file === 'string') {
+    $.ui.toast(`${ROUTING} is missing or unreadable: nothing saved`)
+    return false
+  }
+  patch(file.data)
+  const out = serializeRouting(file.data)
+  if (out.length > MAX_CONFIG_BYTES) {
+    $.ui.toast(`${ROUTING} would exceed ${MAX_CONFIG_BYTES} bytes: ` +
+      'nothing saved')
+    return false
+  }
+  await $.fs.write(file.path, out)
+  const rebuilt = await reloadConfig($, st)
+  $.ui.toast(UPDATED)
+  if (!rebuilt) throw new Error('rebuild failed after the write')
+  return true
+}
+
+function writeRouting($: Api, st: State, patch: Patch): Promise<boolean> {
+  const run = st.writes.then(() => writeNow($, st, patch))
+  st.writes = run.catch(() => undefined)
+  return run
+}
+
+async function saveAnswer($: Api, st: State, req: Req, ans: Answer) {
+  if (ans.act === 'keep') return writeRouting($, st, keepPatch(req))
+  if (ans.act !== 'change' || !isRowReq(req)) return false
+  const scope = await askScope($, st, req, ans.phase)
+  if (scope === 'later') return false
+  const patch = changePatch(req, ans.phase, scope, st.mem.key)
+  return writeRouting($, st, patch)
+}
+
+/** The dialog and what follows; true when routing.json was rewritten. */
+async function runDialog($: Api, st: State, req: Req, text: string) {
+  const answer = await askOr($, text, optionsFor(st, req))
+  st.asked.add(keyOf(req))
+  return saveAnswer($, st, req, decide($, st, req, answer))
+}
+
+function failOnce($: Api, st: State, err: unknown): void {
+  const text = `model-router: first-use dialog failed (${String(err)}); ` +
+    'default route kept'
+  if (st.logged.has(text)) return
+  st.logged.add(text)
+  $.ui.log(text)
+}
+
+/**
+ * Asks once whether `req.phase` is the right route for this row. At most
+ * one dialog is open per session: any other use finds `asking` set and
+ * routes unasked. The caller awaits it outside `safely` (it never throws).
+ * `say` builds the question from the real decision, only if one is asked.
+ * True when routing.json changed: the caller recomputes its route.
+ */
+async function confirmFirst(
+  $: Api,
+  st: State,
+  req: Req,
+  say: () => Promise<string>,
+): Promise<boolean> {
+  if (st.asking !== null || !wantsAsk(st, req)) return false
+  st.asking = keyOf(req)
+  try {
+    if (!(await refreshMemory($, st)) || !wantsAsk(st, req)) return false
+    return await runDialog($, st, req, await say())
+  } catch (err) {
+    st.asked.delete(keyOf(req))
+    failOnce($, st, err)
+    return false
+  } finally {
+    st.asking = null
+  }
+}
+
+/** First-use question text: the id and level the next step really gets. */
+async function mainQuestion($: Api, st: State, lead: string) {
+  const v = await snapshot($, st)
+  return `${lead} ${idWord(st, v.call.model)} at ${
+    effortWord(st, v)}. Keep it?`
+}
+
+function spawnQuestion(
+  $: Api,
+  st: State,
+  e: SpawnIn,
+  req: Req,
+  route: Route,
+): string {
+  const id = spawnTarget($, st, e, route) ?? 'its own model'
+  const effort = st.explicitEffort.get(e.tool_use_id) ?? route.effort
+  return `First dispatch of ${req.name}: ${req.phase}, ${id} at ${
+    effort ?? 'its own effort'}. Keep it?`
+}
+
+/** Typed skill: a changed row re-routes the turn at once. */
+async function confirmSkill($: Api, st: State, skill: string, row: Picked) {
+  const req: Req = { kind: 'skills', name: skill, phase: row.phase }
+  const lead = `First route for /${skill}: ${row.phase}, next step`
+  if (!(await confirmFirst($, st, req, () => mainQuestion($, st, lead)))) {
+    return
+  }
+  const after = skillRow(st, skill)
+  if (after === undefined) return
+  routeMainBySkill(st, after, true)
+  refresh($, st)
+}
+
+/** Rowed spawn: the route in force after the dialog (changed or not). */
+async function routeSpawn($: Api, st: State, e: SpawnIn) {
+  const frozen = e.fork || e.workflow !== undefined
+  const route = spawnRoute(st, e, frozen)
+  const phase = hasKey(st.cfg.agents, e.subagentType)
+    ? st.cfg.agents[e.subagentType]
+    : undefined
+  const inside = e.parentAgentId !== undefined || e.model !== undefined
+  if (!route || !phase || inside) return route
+  const req: Req = { kind: 'agents', name: e.subagentType, phase }
+  const say = async () => spawnQuestion($, st, e, req, route)
+  return (await confirmFirst($, st, req, say))
+    ? spawnRoute(st, e, frozen)
+    : route
+}
+
+/** A phase declared through the route tool: confirm-only. */
+async function confirmPhase($: Api, st: State, phase: string) {
+  const req: Req = { kind: 'phases', name: phase, phase }
+  const lead = `First use of ${phase} on the main loop:`
+  await confirmFirst($, st, req, () => mainQuestion($, st, lead))
+}
+
+// ---- first-use commands ----------------------------------------------
+
+/** Rows and phases not confirmed yet, those asked this session first. */
+function pendingText(st: State): string {
+  const m = st.mem
+  if (!m.ok) return `${ROUTING} missing or unreadable: nothing to confirm`
+  const names = (kind: Kind): string[] => Object.keys(
+    kind === 'phases' ? st.cfg.phases : m.base[kind])
+    .filter(name => !isDecided(m, kind, name))
+  const all = KINDS.flatMap(kind => names(kind).map(name => ({ kind, name })))
+    .map(keyOf)
+  const asked = all.filter(k => st.asked.has(k))
+  const rest = all.filter(k => !st.asked.has(k))
+  return [
+    `pending confirmation: ${all.length}` +
+      (m.ask ? '' : ' (asking is off: /route ask on)'),
+    `asked this session: ${asked.join(' ') || 'none'}`,
+    `not asked yet: ${rest.join(' ') || 'none'}`,
+  ].join('\n')
+}
+
+async function askCommand($: Api, st: State, arg: string | undefined) {
+  if (arg !== 'on' && arg !== 'off') return 'usage: /route ask on|off'
+  const patch: Patch = file => { file.ask = arg === 'on' }
+  try {
+    if (!(await writeRouting($, st, patch))) {
+      return `${ROUTING} missing or unreadable: ask unchanged`
+    }
+  } catch (err) {
+    return `ask not applied (${String(err)})`
+  }
+  const local = st.mem.askLocal
+  const note = local === undefined ? '' : `; ~/${OVERRIDE} sets ask ${
+    local ? 'on' : 'off'} and wins here`
+  return `ask ${arg}${note}`
+}
+
 // ---- route tool ------------------------------------------------------
 
 async function registerTool($: Api, st: State): Promise<void> {
@@ -1283,8 +1847,8 @@ async function registerCommand($: Api): Promise<void> {
       name: 'route',
       description: 'model-router: show or set the model and effort route',
       argumentHint:
-        '[show|clear|off|on|reload|<phase>|model=<alias|id> effort=<level>' +
-        '|switch on|off|verbose on|off]',
+        '[show|clear|off|on|reload|pending|ask on|off|<phase>|' +
+        'model=<alias|id> effort=<level>|switch on|off|verbose on|off]',
       immediate: true,
     })
   } catch (err) {
@@ -1372,6 +1936,9 @@ async function handleRouteTool($: Api, st: State, e: RouteInput) {
   const picked = pickRoute(st.cfg, e.phase, e.effort)
   if (typeof picked === 'string') return { deny: picked }
   applyRoute(st, e.agentId, picked)
+  if (e.agentId === undefined && typeof e.phase === 'string') {
+    await confirmPhase($, st, picked.phase)
+  }
   return { result: await routedText($, st, e.agentId, picked) }
 }
 
@@ -1423,13 +1990,25 @@ function typedPath(st: State, skill: string): TypedPath | undefined {
   return st.promptAllowed && idle ? 'typed-fallback' : undefined
 }
 
-function applyTypedSkill($: Api, st: State, skill: string): void {
+/** Routes main by the typed skill's row; the row, for the first-use ask. */
+function armTypedSkill($: Api, st: State, skill: string) {
   const row = skillRow(st, skill)
   const path = typedPath(st, skill)
-  if (row === undefined || path === undefined) return
+  if (row === undefined || path === undefined) return undefined
   routeMainBySkill(st, row, true)
   refresh($, st)
   vlog($, st, `skill ${skill}: ${path} → ${row.phase}`)
+  return row
+}
+
+/** Bookkeeping that may fail without breaking the hook: fail-open. */
+function armed($: Api, st: State, skill: string): Picked | undefined {
+  try {
+    return armTypedSkill($, st, skill)
+  } catch {
+    warnOnce(st, $, 'skill.prompt', 'bookkeeping')
+    return undefined
+  }
 }
 
 // ---- agents ----------------------------------------------------------
@@ -1438,6 +2017,7 @@ type SpawnIn = {
   tool_use_id: string
   subagentType: string
   model?: string
+  parentAgentId?: string // set when the spawn happens inside an agent
   fork: boolean
   workflow?: unknown
 }
@@ -1736,11 +2316,23 @@ function registerBreaker(on: On, st: State): void {
   })
 }
 
+function registerCwd(on: On, st: State): void {
+  on('classic.CwdChanged', async ($, e, next) => {
+    // the repo key follows the directory: rebuild the layers
+    if (st.loaded) await reloadConfig($, st)
+    return next(e)
+  }).catch(($, e, next) => {
+    warnOnce(st, $, 'CwdChanged', next.error.kind)
+    return next(e)
+  })
+}
+
 function registerCommandHook(on: On, st: State): void {
   on('command.run', { command: 'route' }, async ($, e) => {
     if (e.origin.kind !== 'composer') {
       return { text: 'route: user-only command' }
     }
+    await ensureConfig($, st)
     return { text: await handleCommand($, st, e.args) }
   }).catch(($, e, next) => {
     warnOnce(st, $, 'command.run', next.error.kind)
@@ -1750,6 +2342,7 @@ function registerCommandHook(on: On, st: State): void {
 
 function registerRouteTool(on: On, st: State): void {
   on('tool.call', { tool: TOOL }, async ($, e) => {
+    await ensureConfig($, st)
     const out = await handleRouteTool($, st, e)
     refresh($, st)
     vlog($, st, `route ${e.agentId ?? 'main'}: ${JSON.stringify(out)}`)
@@ -1762,6 +2355,7 @@ function registerRouteTool(on: On, st: State): void {
 
 function registerSkills(on: On, st: State): void {
   on('tool.call', { tool: 'Skill' }, async ($, e, next) => {
+    await ensureConfig($, st)
     const skill = typeof e.skill === 'string' ? e.skill : undefined
     if (st.off || skill === undefined) return next(e)
     st.skillCalls += 1
@@ -1776,8 +2370,10 @@ function registerSkills(on: On, st: State): void {
     return next(e)
   })
   on('skill.prompt', async ($, e, next) => {
+    await ensureConfig($, st)
     if (st.off || st.skillCalls > 0) return next(e)
-    safely(st, $, 'skill.prompt', () => applyTypedSkill($, st, e.skill))
+    const row = armed($, st, e.skill)
+    if (row) await confirmSkill($, st, e.skill, row)
     return next(e)
   }).catch(($, e, next) => {
     warnOnce(st, $, 'skill.prompt', next.error.kind)
@@ -1829,11 +2425,12 @@ function registerSpawn(on: On, st: State): void {
     return next(e)
   })
   on('agent.spawn', async ($, e, next) => {
+    await ensureConfig($, st)
     if (st.off) return next(e)
     st.spawning += 1
     try {
       await prune($, st)
-      const route = spawnRoute(st, e, e.fork || e.workflow !== undefined)
+      const route = await routeSpawn($, st, e)
       const wanted = spawnTarget($, st, e, route)
       const started = await next(wanted === undefined
         ? e
@@ -1942,6 +2539,7 @@ function noteTyped(st: State, kind: string, text: string, midTurn: boolean) {
 
 function registerPrompt(on: On, st: State): void {
   on('prompt.submit', async ($, e, next) => {
+    await ensureConfig($, st, true)
     if (st.off) return next(e)
     const midTurn = e.turnId !== undefined
     noteTyped(st, e.origin.kind, e.text, midTurn)
@@ -1966,6 +2564,7 @@ export const register: Register = on => {
   const st = newState(mergeConfig(undefined, () => undefined), 'defaults')
   registerSession(on, st)
   registerBreaker(on, st)
+  registerCwd(on, st)
   registerCommandHook(on, st)
   registerRouteTool(on, st)
   registerSkills(on, st)
diff --git a/mods/model-router/routing.json b/mods/model-router/routing.json
new file mode 100644
index 0000000..5e2980c
--- /dev/null
+++ b/mods/model-router/routing.json
@@ -0,0 +1,144 @@
+{
+  "phases": {
+    "plan": {
+      "tier": "best",
+      "effort": "xhigh"
+    },
+    "reflect": {
+      "tier": "best",
+      "effort": "high"
+    },
+    "orchestrate": {
+      "tier": "best",
+      "effort": "medium"
+    },
+    "escalate": {
+      "tier": "best",
+      "effort": "max"
+    },
+    "judge": {
+      "tier": "big",
+      "effort": "xhigh"
+    },
+    "implement": {
+      "tier": "work",
+      "effort": "medium"
+    },
+    "write": {
+      "tier": "work",
+      "effort": "high"
+    },
+    "verify": {
+      "tier": "work",
+      "effort": "xhigh"
+    },
+    "explore": {
+      "tier": "work",
+      "effort": "medium"
+    },
+    "apply": {
+      "tier": "work",
+      "effort": "low"
+    },
+    "mechanical": {
+      "tier": "cheap",
+      "effort": "low"
+    }
+  },
+  "skills": {
+    "ship-feature": "plan",
+    "init-project": "plan",
+    "onboard": "plan",
+    "tour": "plan",
+    "audit-delta": "plan",
+    "analyze": "plan",
+    "code-clean": "plan",
+    "client-handover": "plan",
+    "brainstorming": "plan",
+    "writing-plans": "plan",
+    "requesting-code-review": "plan",
+    "21st-ui-review": "plan",
+    "feat": "reflect",
+    "hotfix": "reflect",
+    "bugfix": "reflect",
+    "refactor": "reflect",
+    "web-validate": "reflect",
+    "harden": "reflect",
+    "seo": "reflect",
+    "geo": "reflect",
+    "site-motion": "reflect",
+    "frontend-design": "reflect",
+    "emil-design-eng": "reflect",
+    "design-motion-principles": "reflect",
+    "21st-ui-build": "reflect",
+    "scroll-world-storytelling": "reflect",
+    "build-threejs-scroll-worlds": "reflect",
+    "scroll-scrubbed-visual-sequence": "reflect",
+    "scroll-scrubbed-word-reveal": "reflect",
+    "scroll-progress-timeline": "reflect",
+    "subagent-driven-development": "reflect",
+    "writing-skills": "reflect",
+    "deprecation-and-migration": "reflect",
+    "21st-ai": "reflect",
+    "21st-ui-explore": "reflect",
+    "gitflow": "implement",
+    "prune-memory": "implement",
+    "pdf-translate": "implement",
+    "ci-cd-and-automation": "implement",
+    "observability-and-instrumentation": "implement",
+    "test-driven-development": "implement",
+    "commit-change": "apply",
+    "release-candidate": "apply",
+    "doc": "apply",
+    "capitalize": "apply",
+    "close": "apply",
+    "reconcile": "apply",
+    "deploy": "apply",
+    "status": "mechanical",
+    "profile": "mechanical",
+    "plugin-check": "mechanical",
+    "skills-perso": "mechanical",
+    "using-git-worktrees": "mechanical",
+    "21st-cli-use": "mechanical",
+    "21st-registry": "mechanical",
+    "21st-design-sync": "mechanical"
+  },
+  "agents": {
+    "Explore": "explore",
+    "Plan": "judge",
+    "plan-challenger": "judge",
+    "plugin-advisor": "judge",
+    "seo-analyzer": "judge",
+    "geo-analyzer": "judge",
+    "analyzer": "judge",
+    "feater": "implement",
+    "bugfixer": "implement",
+    "code-cleaner": "implement",
+    "scaffolder": "implement",
+    "onboarder": "implement",
+    "commit-changer": "write",
+    "doc-syncer": "write",
+    "handover-doc-writer": "write",
+    "refactorer": "write",
+    "hotfixer": "apply",
+    "release-executor": "apply",
+    "plugin-probe": "apply",
+    "validator-analyzer": "apply",
+    "verifier": "verify",
+    "security-auditor": "verify",
+    "status-reporter": "mechanical"
+  },
+  "projects": {},
+  "confirmed": {
+    "agents": {
+      "verifier": "verify",
+      "feater": "implement"
+    },
+    "phases": {
+      "verify": "verify",
+      "implement": "implement"
+    }
+  },
+  "changed": {},
+  "ask": true
+}

From 304a02d70af0b4f75812369c15293d18e86f8e18 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 11:57:56 +0200
Subject: [PATCH 02/12] =?UTF-8?q?docs:=20README/USAGE=20first-use=20dialog?=
 =?UTF-8?q?,=20routing.json=20source=20+=20config=20layers,=20ARCHITECTURE?=
 =?UTF-8?q?,=20CHANGELOG=20Unreleased=20=E2=80=94=20feat=20model-router=20?=
 =?UTF-8?q?wave=203-A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ARCHITECTURE.md |  2 +-
 CHANGELOG.md    |  5 +++--
 README.md       | 17 +++++++++++------
 USAGE.md        | 10 ++++++----
 4 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 3a323e4..6fb3821 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -36,6 +36,6 @@ claude-config/
 
 - `skills/` = entry points you invoke via `/skill-name`
 - `agents/` = execution units called by skills (never invoked directly by user)
-- `mods/` = Claude Code mods (function-hooks plugins); each loads through the tracked symlink `skills/<name>` as `<name>@skills-dir`, live at the next session
+- `mods/` = Claude Code mods (function-hooks plugins); each loads through the tracked symlink `skills/<name>` as `<name>@skills-dir`, live at the next session; `mods/model-router/routing.json` (tracked) holds the phase table, every skill and agent row and the first-use decisions
 - `templates/` = symlinked to `~/.claude/templates/` — copy into projects via `/onboard` or manually
 - **Graphify** builds a knowledge graph of any codebase (`/graphify query`), producing a navigable wiki in `graphify-out/wiki/`. This map helps Claude understand project structure, find relevant code faster, and reason across files. Essential for large-scope tasks (multi-file features, complex bugs, architectural changes). Small tasks should skip it and read files directly. Proposed only from 200 tracked code files: the session-start banner informs, the user decides; nothing builds a graph without that go.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ec6fde..6225592 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,11 +7,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/) and this project
 ## [Unreleased]
 
 ### Added
-- **model-router mod**: `mods/model-router/`, a Claude Code mod (function-hooks plugin), routes every repo skill and agent from phase rows (`plan`, `reflect`, `orchestrate`, `escalate`, `judge`, `implement`, `write`, `verify`, `explore`, `apply`, `mechanical`; built-ins Explore on sonnet/medium, Plan on opus/xhigh). A typed skill routes the main loop to its row, and a best-tier row holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. Agents get their row's model at spawn (within the tier, upward only) and its effort on every step; explicit Agent params win. Orchestrators declare their phases through the `mcp__model-router__route` tool. `ultrathink` in a prompt sets the turn's minimum effort and `/route effort=max` holds until `/route clear`; the built-in `/effort` is not a lever inside a run. `/route show` names the run slot (`main: run <phase>`), and a `null` row in the override drops a default row. The model gets a `route` tool and the user a `/route` command (`show|clear|off|on|reload|<phase>|model=<alias|id> effort=<level>|switch on|off|verbose on|off`). Optional per-machine config `~/.claude/model-router.json`, where `"enabled": false` turns it off on that machine. The spinner suffix and the status line show the route in force. It loads in every session through the tracked symlink `skills/model-router` (`model-router@skills-dir`). `make doctor` gains a Mods section; suite `make test suite=lib/tests/mods.test.sh`. Known limits: the main loop switches model only with `mainModelSwitch` on (default off, one cold-cache step per switch into another model), and the hooks send full model ids, so the `models` table has to follow new versions.
+- **model-router mod**: `mods/model-router/`, a Claude Code mod (function-hooks plugin), routes every repo skill and agent from phase rows (`plan`, `reflect`, `orchestrate`, `escalate`, `judge`, `implement`, `write`, `verify`, `explore`, `apply`, `mechanical`; built-ins Explore on sonnet/medium, Plan on opus/xhigh). A typed skill routes the main loop to its row, and a best-tier row holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. Agents get their row's model at spawn (within the tier, upward only) and its effort on every step; explicit Agent params win. Orchestrators declare their phases through the `mcp__model-router__route` tool. `ultrathink` in a prompt sets the turn's minimum effort and `/route effort=max` holds until `/route clear`; the built-in `/effort` is not a lever inside a run. `/route show` names the run slot (`main: run <phase>`), and a `null` row in the override drops a default row. The model gets a `route` tool and the user a `/route` command (`show|clear|off|on|reload|pending|ask on|off|<phase>|model=<alias|id> effort=<level>|switch on|off|verbose on|off`). Optional per-machine config `~/.claude/model-router.json`, where `"enabled": false` turns it off on that machine. The spinner suffix and the status line show the route in force. It loads in every session through the tracked symlink `skills/model-router` (`model-router@skills-dir`). `make doctor` gains a Mods section; suite `make test suite=lib/tests/mods.test.sh`. Known limits: the main loop switches model only with `mainModelSwitch` on (default off, one cold-cache step per switch into another model), and the hooks send full model ids, so the `models` table has to follow new versions.
+- **model-router first-use confirmation**: `mods/model-router/routing.json` (tracked) is the single source of the phase table and of every skill and agent row, and keeps the decisions: `confirmed`, `changed` (`from`/`to`), `projects` exceptions keyed by the origin remote reduced to `host/path` (credentials and local paths never stored), and `ask`. The first use of a rowed typed skill, a rowed agent spawn or a main-loop phase declared through the `route` tool opens a dialog: Later, Keep or another phase, then Everywhere or This project only. One dialog at a time, never in headless (`-p`) runs or inside a sub-agent. Only a dialog answer or `/route ask on|off` writes the file (serialized, 64 KiB cap, never created when absent); each write asks you to commit it from the config repo. `/route pending` lists unconfirmed rows and phases. Layers: routing.json < `~/.claude/model-router.json` (its `ask` wins); a project's `.claude/model-router.json` is never read. Tests: `mods/model-router/hooks/register.test.ts`.
 - **Manual-push mode**: `git config gitflow.autopush false` (human-set) now stops every push the gitflow lib makes, not only the post-commit / post-merge hooks. `gitflow start` and `finish` branch, commit and merge locally and push nothing; `gitflow delete` leaves the `origin/` copy in place and prints `git push origin --delete <br>` for the user to run. `hooks/unpushed-guard.sh` stays silent at turn end in this mode and opens each session with one `ℹ manual push mode:` line counting the commits no remote holds across every local branch; an unparseable or unreadable `gitflow.autopush` value is treated as manual push mode too, and that line names it. `hooks/push-guard.sh` (PreToolUse, `Bash|Monitor`) refuses any `git push` Claude types while `gitflow.autopush` reads false in the session cwd or in a literal `-C`/`cd` directory the command names (global config counts outside a repo); the refusal tells the user to run it with `! git push`. It reads the mode through the same lib verb as every other reader and fails closed: an unparseable or unreadable value reads as manual, and an internal error, a missing `lib/gitflow.sh`, more than 20 distinct directory tokens in one command (capped before any token is classified), a `cd`/`-C` directory token mixing quoted and unquoted parts, or a payload jq cannot parse whose raw text looks like a push refuse the push (these pathological cases fire in auto mode too). Directory tokens are read as whole shell words, adjacent quoted segments and backslash escapes included. In manual mode it over-blocks any command where a `push` word follows a `git` token; the misses listed in its header fall to a new `autoMode.soft_deny` rule that no request in the turn clears. The session banner adds `🔒 push : manual (autopush=false) — ! git push` when the key reads false, and `🔒 push : manual (autopush bad) — ! git push` when the value is invalid. Skills read the mode through a new lib verb, `bash ~/.claude/lib/gitflow.sh push-mode`: it prints `auto`, `manual` or `invalid` (rc 0) and names an invalid value on stderr (printable characters only, 64 at most). It is the one reader a skill may call, since the `git config` read of the key is denied to Claude. Skills push nothing on their own, except the `/release-candidate` tag in auto-push mode on an explicit go. Every "on origin" or "not pushed" line they print comes from `git rev-list --count origin/<br>..<br>` read after the fact, with the complete `! git …` command when something is left for the user to push. An invalid value (anything but unset, true or false, or a read that fails) is manual push mode for every reader and is named where it is read (see Fixed). Tests: `lib/gitflow-test.sh` T11b (push-mode verb), T18m and T18q blocks, `lib/tests/unpushed-guard.test.sh` T10-T16, `lib/tests/push-guard.test.sh` (98 checks).
 
 ### Changed
-- `lib/model-gate.md` calls the model-router `route` tool and takes its answer as the witness; with the mod off the gate stops and names `/route on`. The `model:` / `effort:` frontmatter of agents and skills is now the off-state floor, census-locked equal to the rows (`lib/tests/effort-routing.test.sh`). `analyzer` effort goes from high to xhigh. Built-in judgment dispatches carry an explicit `effort=`.
+- `lib/model-gate.md` calls the model-router `route` tool and takes its answer as the witness; with the mod off the gate stops and names `/route on`. The `model:` / `effort:` frontmatter of agents and skills is now the off-state floor, census-locked equal to the rows (`lib/tests/effort-routing.test.sh`; a row changed through the first-use dialog passes with a `WARN floor drift` line while its frontmatter still holds the shipped value). `analyzer` effort goes from high to xhigh. Built-in judgment dispatches carry an explicit `effort=`.
 - `settings.json` denies every write form of the human-only `gitflow.*` keys (18 entries): any `git … config` spelling, section remove/rename, `git -c`, the git config env overrides, and Edit/Write of `.git/config`, `.gitconfig` and `~/.config/git/config`. Side effect: Claude can no longer read `gitflow.autopush` through `git config` either; hooks and `lib/gitflow.sh` still read it. The `hard_deny` rule on routing around a guardrail now names PreToolUse hook refusals.
 - `gitflow start` and `finish` warn on stderr when a base is behind origin and cannot fast-forward, instead of a silent `git pull --ff-only || true` (T18l, T18n).
 - `/close` (`/capitalize` STEP 5C) no longer runs its own push of develop: `gitflow finish` already pushes develop in auto-push mode (BDR-095). The closing line reports the real state, read after the merge: pushed, manual push mode with the `! git push origin develop` to run, not on origin, push failed, or an invalid `gitflow.autopush` value named and treated as manual push mode. A finish whose merge landed but whose branch delete failed (rc 5/2/6) still reports the push state.
diff --git a/README.md b/README.md
index 33fa880..afb7697 100644
--- a/README.md
+++ b/README.md
@@ -104,14 +104,17 @@ children are dispatched `model:"fable"` (they carry reflection).
 ## Effort routing (BDR-107, BDR-108)
 
 Second axis of the same table: how hard each phase thinks. Session default
-`high`. The model-router mod (below) holds the live source: one phase row
-per repo skill and agent, each phase naming a tier and an effort level
+`high`. The live source is `mods/model-router/routing.json`, tracked with the
+model-router mod (below): the phase table and one phase row per repo skill
+and agent, each phase naming a tier and an effort level
 (`plan` best/xhigh, `reflect` best/high, `orchestrate` best/medium,
 `escalate` best/max, `judge` big/xhigh, `implement` work/medium, `write`
 work/high, `verify` work/xhigh, `explore` work/medium, `apply` work/low,
 `mechanical` cheap/low). The `model:` and `effort:` frontmatter of every
 typed agent and user-invoked skill stays as the off-state floor, kept equal
-to the rows by the census `lib/tests/effort-routing.test.sh`: low
+to the rows by the census `lib/tests/effort-routing.test.sh` (a row
+changed through the first-use dialog passes with a `WARN floor drift` line
+until its frontmatter follows): low
 appliers, medium executors, high writers, xhigh judgment and gates (none
 on haiku, which rejects the parameter); `/status` low … `/ship-feature`
 xhigh. The vendored externals (design stack, superpowers, agent-skills,
@@ -131,10 +134,12 @@ effort, never version. Transcript audit `python3 lib/effort-audit.py`.
 - Main loop: every request gets the route in force. A typed skill with a row routes the main loop to it; a best-tier row (`plan`, `reflect`, `orchestrate`, `escalate`) holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. A skill without a row leaves the route as it is.
 - Sub-agents: a routed agent gets its row's model at spawn, within its tier and only upward from its frontmatter model, and the row's effort on every step. Explicit `model` / `effort` params on the Agent call win; a project-defined agent of the same name keeps its own definition. Built-ins: Explore runs on sonnet/medium, Plan on opus/xhigh.
 - Levers inside a run: `ultrathink` in a prompt sets the turn's minimum effort; `/route effort=max` holds until `/route clear`. The built-in `/effort` is not a lever inside a run, rows and routes outrank it.
-- `/route` (user command) shows or sets the route: `show`, `clear`, `off`, `on`, `reload`, a phase name, `model=<alias|id> effort=<level>`, `switch on|off`, `verbose on|off`. `/route show` names the run slot when one holds (`main: run <phase>`). The model sets routes through a `route` tool.
+- `/route` (user command) shows or sets the route: `show`, `clear`, `off`, `on`, `reload`, `pending` (rows and phases not confirmed yet), `ask on|off` (first-use dialog on or off), a phase name, `model=<alias|id> effort=<level>`, `switch on|off`, `verbose on|off`. `/route show` names the run slot when one holds (`main: run <phase>`). The model sets routes through a `route` tool.
+- First use: the first time a rowed skill is typed, a rowed agent is spawned or a phase is declared on the main loop through the `route` tool, the mod asks once whether the route is right. A row offers Later, Keep and two alternative phases (Other takes any phase name); a declared phase offers Later or Keep. Picking another phase then asks Everywhere or This project only. Everywhere moves the row and records the shipped phase under `changed`; This project only stores an exception under `projects`, keyed by the origin remote reduced to `host/path` (no credentials, no local paths; a remote that cannot be read that way offers no project choice). Keep lands under `confirmed`; Later asks again next session. One dialog at a time, never in a headless (`-p`) run, never inside a sub-agent.
+- Only a dialog answer or `/route ask on|off` writes `routing.json`, never the model. Writes are serialized, capped at 64 KiB, and refused when the file is missing (it is never created). Each write leaves the config repo dirty; a toast reminds you to commit it from there.
 - The spinner suffix and the status line under the prompt show the route in force.
 
-Optional per-machine config: `~/.claude/model-router.json`. Keys: `models` (alias → full id), `windows` (context window per full id), `phases`, `agents`, `skills`, `prompt` (rules), `mainModelSwitch` (default `false`), `verbose` (default `false`), `spinner` (default `true`), `enabled` (default `true`; `false` turns the mod off on that machine). A `null` value in `agents` or `skills` drops a default row. `/route reload` re-reads it.
+Config layers: `mods/model-router/routing.json` (tracked: phases, rows, decisions, `ask`), then the optional per-machine `~/.claude/model-router.json`, which wins. A `.claude/model-router.json` inside a project is never read. Machine keys: `models` (alias → full id), `windows` (context window per full id), `tiers` (ordered alias lists per tier: `best` fable>opus>sonnet, `big` opus>fable>sonnet, `work` sonnet>opus, `cheap` haiku>sonnet; the first alias not down is used), `fallback` (the rank order of the aliases, best first, used by the breaker), `cooldownMinutes` (how long a model stays marked down after an availability error, 15 by default, doubling per episode up to 300), `mainUpgrade` (default `true`: the main loop may move up to a phase's tier), `upgradeMaxTokens` (default 200000: no main-loop upgrade above this context size, since an upgrade re-reads the whole context cold), `phases`, `agents`, `skills`, `prompt` (rules), `mainModelSwitch` (default `false`), `verbose` (default `false`), `spinner` (default `true`), `enabled` (default `true`; `false` turns the mod off on that machine), `ask` (overrides routing.json's `ask` on that machine). A `null` value in `agents` or `skills` drops a row. Edit phases and rows by hand in routing.json; without it the mod runs the code's default phases, with no rows and no dialog. `/route reload` re-reads both files.
 
 Limits: the main loop changes model only with `mainModelSwitch` on, and each switch into another model costs one cold-cache step. The hooks send full model ids, so the `models` table has to follow new model versions.
 
@@ -228,7 +233,7 @@ a different package, ships its own conflicting `graphify` bin) — see
 | `/profile` | Activate a skill profile (web / seo / web-full / full / max / backend / design / dev / qa / audit / minimal) (default: full) |
 | `/tour` | Grouped all-axes sweep — cleanup + security + reconcile + doc, fix and loop until clean |
 | `/site-motion` | Site-level motion: scroll engine choice, page transitions, pin/scrub sequencing across a page or Astro route (design stack) |
-| `/route` | model-router mod: show or set the main-loop route (show, clear, off, on, reload, <phase>, model=… effort=…, switch on\|off, verbose on\|off) |
+| `/route` | model-router mod: show or set the main-loop route (show, clear, off, on, reload, pending, ask on\|off, <phase>, model=… effort=…, switch on\|off, verbose on\|off) |
 
 > This table lists personal skills. Gstack skills (investigate, review, retro,
 > office-hours, cso…) and marketplace plugins add many more — run
diff --git a/USAGE.md b/USAGE.md
index 15869b9..1e0edc4 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -163,7 +163,7 @@ Tu veux...
 | `/pdf-translate` | Traduire un PDF vers une autre langue | Sortie HTML fidèle (images, layout, style préservés) |
 | `/impeccable` | Audit/polish design + détecteur anti-slop déterministe | 23 verbes ; `npx impeccable detect` (exit 0/2) |
 | `/tour` | Sweep groupé sur un ou plusieurs projets | Sécu + nettoyage + reconcile + doc, boucle jusqu'à un pass propre |
-| `/route` | Voir ou fixer la route du mod model-router | show / clear / off / on / reload / <phase> / model=… effort=… / switch on\|off / verbose on\|off |
+| `/route` | Voir ou fixer la route du mod model-router | show / clear / off / on / reload / pending / ask on\|off / <phase> / model=… effort=… / switch on\|off / verbose on\|off |
 | `/profile` | Changer le profil de skills | web / seo / web-full / full / max / backend / design / dev / qa / audit / minimal |
 
 > Cette table couvre les skills personnels principaux. Les plugins (gstack,
@@ -174,8 +174,8 @@ Tu veux...
 
 ### Niveau d'effort
 
-Chaque commande a une ligne de phase dans le mod model-router
-(`mods/model-router/`, actif dans chaque session), qui fixe son niveau de
+Chaque commande a une ligne de phase dans `mods/model-router/routing.json`,
+le fichier suivi du mod model-router (actif dans chaque session), qui fixe son niveau de
 réflexion : low pour la tenue de registre (`/status`, `/close`,
 `/commit-change`), medium pour le courant (`/gitflow`, `/prune-memory`),
 high pour un fix ou un refactor (`/feat`, `/hotfix`, `/bugfix`,
@@ -187,7 +187,9 @@ l'outil `mcp__model-router__route` (`lib/effort-shift.md`). Les skills
 externes vendorés (pile design, superpowers, agent-skills, skills scroll
 MengTo, 21st) ont aussi leur ligne.
 
-Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). La config par machine, optionnelle, vit dans `~/.claude/model-router.json` ; `"enabled": false` y coupe le mod sur cette machine, et une ligne à `null` y retire une ligne par défaut.
+Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). Première utilisation : la première fois qu'un skill avec ligne est tapé, qu'un agent avec ligne est lancé ou qu'une phase est déclarée sur la boucle principale via l'outil `route`, le mod demande une fois si la route convient. Pour une ligne : Later, Keep ou deux phases alternatives (Other accepte un nom de phase) ; pour une phase déclarée : Later ou Keep. Un changement demande ensuite Everywhere ou This project only (exception rangée sous le remote origin du dépôt réduit à `host/path`, jamais d'identifiants). La réponse est écrite dans `routing.json` ; Later redemande à une session suivante. Un seul dialogue à la fois, jamais en headless (`-p`) ni dans un sous-agent, et le modèle n'écrit jamais ce fichier. Chaque réponse laisse le repo de config modifié : commite-le depuis ce repo. `/route pending` liste ce qui reste à confirmer, `/route ask off|on` coupe ou rallume le dialogue.
+
+La config par machine, optionnelle, vit dans `~/.claude/model-router.json` et passe devant `routing.json` ; `"enabled": false` y coupe le mod sur cette machine, `"ask": false` y coupe le dialogue, une ligne à `null` y retire une ligne. Un `.claude/model-router.json` dans un projet n'est jamais lu. Les phases et les lignes se modifient à la main dans `routing.json` ; `/route reload` relit les deux fichiers.
 
 ## Les plugins — décision rapide
 

From 5bab61e13adc71fe49f8f88e2c2f5419dee0f361 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 11:57:56 +0200
Subject: [PATCH 03/12] =?UTF-8?q?chore(model-router):=20routing.json=20dec?=
 =?UTF-8?q?ision=20=E2=80=94=20doc-syncer=20kept=20on=20write=20(live=20fi?=
 =?UTF-8?q?rst-use=20dialog,=20user=20Keep)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mods/model-router/routing.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mods/model-router/routing.json b/mods/model-router/routing.json
index 5e2980c..eeb81e2 100644
--- a/mods/model-router/routing.json
+++ b/mods/model-router/routing.json
@@ -132,11 +132,13 @@
   "confirmed": {
     "agents": {
       "verifier": "verify",
-      "feater": "implement"
+      "feater": "implement",
+      "doc-syncer": "write"
     },
     "phases": {
       "verify": "verify",
-      "implement": "implement"
+      "implement": "implement",
+      "write": "write"
     }
   },
   "changed": {},

From f2f404a00291969aef2e17ffb46fcea7642df518 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 11:57:56 +0200
Subject: [PATCH 04/12] =?UTF-8?q?chore(memory):=20BDR-116=20+=20LRN-212=20?=
 =?UTF-8?q?+=20EVAL-043=20+=20journal/TODO/contract=20w3a=20=E2=80=94=20fe?=
 =?UTF-8?q?at=20model-router=20wave=203-A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .claude/memory/decisions.md                   |   9 +
 .claude/memory/evals.md                       |   9 +
 .claude/memory/journal.md                     |   3 +
 .claude/memory/learnings.md                   |   5 +
 .claude/tasks/TODO.md                         |   7 +
 ...026-10-10-model-router-w3a-confirm-1201.md |  40 +++
 .claude/tasks/contracts/w3a-routing-file.sh   |  16 +
 ...026-10-10-model-router-w3a-confirm-1201.md | 288 ++++++++++++++++++
 8 files changed, 377 insertions(+)
 create mode 100644 .claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md
 create mode 100755 .claude/tasks/contracts/w3a-routing-file.sh
 create mode 100644 .claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md

diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index de2ecf2..a48bde7 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -133,6 +133,7 @@ rules:
 | BDR-109 | 2026-09-30 | Higgsfield pack: npm CLI `latest` + 8 upstream skills git-cloned into gitignored `skills-external/higgsfield-*`, OFF by default, in no profile; two toggles (`higgsfield` = allowlist of 7 media skills, `higgsfield-websites` = landing-page aid, never website create/deploy/publish); CLI presence by probe; routing on explicit ask | accepted |
 | BDR-110 | 2026-10-06 | Shell portability doctrine: native userland on macOS AND Linux, no Homebrew GNU tools on PATH; `lib/tests/portability-census.test.sh` locks deterministic GNU-only idioms | accepted |
 | BDR-115 | 2026-10-08 | model-router mod: pin = entry default, sub-tasks route finer; one writer per axis; full ids from the mod table; built-ins-only agents table until frontmatter pins go; state in closure | accepted |
+| BDR-116 | 2026-10-11 | model-router first-use confirmation: tracked routing.json = source of phases + rows + decisions; engine dialog at first use; project exceptions in user scope keyed by normalized remote; model never writes; census tolerates a decided row | accepted |
 
 ---
 
@@ -1403,3 +1404,11 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Refs**: plan `.claude/tasks/plans/2026-10-08-model-router-mod.md`, contract `.claude/tasks/contracts/2026-10-08-model-router-w1a-1533.md`, [[BDR-107]], [[BDR-108]], [[BLK-029]], [[LRN-205]], [[LRN-206]].
 - **Amendment (2026-10-09, user decisions 2026-10-08 evening)**: (a) LOAD supersedes the "Load:" line: tracked relative symlink `skills/model-router` → `../mods/model-router`, loaded in place as `model-router@skills-dir` wherever link.sh links `~/.claude/skills`; `CLAUDE_CODE_PLUGIN_DIRS` dropped (absolute path, settings `env` has no `$HOME` expansion, settings.json tracked), local marketplace dropped (`add` writes an absolute path into settings.json). Proven by fresh-process `claude plugin list --json`. (b) PRECEDENCE amended: `ultrathink` and a typed `/effort-<l>` are the main turn's DEFAULT and MINIMUM (floor slot `turnFloor`): sticky `/route` effort > turn route effort > floor > engine, then floored; per axis; mid-turn prompt floors the running turn and the next (`wait` ignored). Rationale: user "un choix explicite bat la phase déduite"; a pure floor made `/effort-low` a no-op (challenge finding). (c) Per-machine kill switch `"enabled": false` in the untracked `~/.claude/model-router.json` (survives `/clear`, a failed reload keeps the previous config); `enabledPlugins` would dirty the tracked settings.json on every machine. (d) Hardening: `/route` composer-only; agent loops effort-only (model fixed at spawn); config caps; typed slash attested at `prompt.submit`. Commits 346d6ae, 1ff608a, 6430ac6; contracts `2026-10-08-model-router-floor-1835`, `2026-10-08-model-router-wiring-1835`; residuals parked in TODO.
 - **Amendment 2 (2026-10-10, wave 2 closed, commits bb56f3e + 1f2d33b)**: (a) rule 4 closed: rows for every repo skill (56) + agent (21) + Explore/Plan, PHASES by role (plan/reflect/orchestrate/escalate best · judge big · implement/write/verify/explore/apply work · mechanical cheap; `write` work/high + `apply` work/low added). User: pins "deleted or reworked", not copied → rows are the live source, tracked `model:`/`effort:` frontmatter KEPT as off-state floor, census-locked equal to rows (`lib/tests/effort-routing.test.sh`). Robustness BLOCKER closed: mod off → agents would inherit parent model. (b) Rule 5 amended: unrowed skill load changes nothing; best-tier skill row lives in `runMain` slot surviving turn end (precedence userMain > turnMain > runMain > floor > engine), dropped by `/route clear`, `/route off`, user `/model`, typed non-best skill; turn writers (route tool, prompt rules) never touch it. (c) Agents: model written at spawn WITHIN tier, upward only (never below frontmatter alias); explicit Agent params win; project-defined agent (agent.offer source projectSettings|localSettings) skipped. (d) Typed slash: name-bound marker at prompt.submit (composer|sdk|bridge) + pending slot + idle fallback (no live/spawning loop). (e) Shifters `effort-*`, `effort-pins.*`, `model-check.sh` DELETED; orchestrators call `mcp__model-router__route` per phase; gate witness = route answer id, remedy `/route on`; builtin `/effort` not a lever inside a run (levers `ultrathink`, `/route effort=max`). (f) SemVer: typed `/effort-*` removal = breaking → next release 3.0.0. Plan `.claude/tasks/plans/2026-10-09-model-router-w2-1546.md` r4, contracts `2026-10-09-model-router-w2a-1546`, `2026-10-10-model-router-w2b-1045`. Links [[LRN-210]], [[LRN-211]], [[EVAL-042]].
+
+## BDR-116 — model-router first-use confirmation: tracked `routing.json` = source of phases, rows and decisions; engine dialog once per row/phase; project exceptions in user scope; model never writes [accepted] (2026-10-11)
+- **Decision**: (1) `mods/model-router/routing.json` (tracked, reached from every project through the plugin dir `$.plugin.root` = the existing `~/.claude/skills/model-router` link) is the single source: 11 phases (full routes), 56 skill rows, 23 agent rows, `confirmed` (kind/name → phase), `changed` (from/to for an Everywhere change), `projects[<key>]` exceptions, `ask`. `DEFAULT_CONFIG` keeps only the phases as fallback; rows `{}`. (2) First use of a rowed typed skill (T1), a rowed agent spawn with no explicit model (T2) or a main-loop phase declared via the route tool (T3) opens `$.ui.ask`: options Later / Keep / 2 alt phases (Other = phase name; T3 Later/Keep); a change asks Everywhere (row moved + `changed`) or This project only (`projects[key]`, confirmed = base row so no other project asks). Keep endorses the phase too. One dialog in flight; concurrent uses route unasked; headless/dismissed/garbage = Later; never inside a sub-agent; pre-ask re-read of the file (other sessions' decisions seen). (3) Project key = origin remote normalized (`new URL` host+path or strict scp regex; userinfo never read; any remaining `@`/`:`/empty host → no key); no `local:` path keys; no remote → Everywhere/Later only. The project tree's `.claude/model-router.json` is NEVER read (a cloned repo must not re-route the user's gate agents). (4) Writers = dialog answers + composer `/route ask on|off` only; serialized chain; output capped 64 KB; file never created; later unreadable → previous config kept (kill-switch rule); layers routing.json < `~/.claude/model-router.json` (its `ask` wins). (5) Census reads rows + phases from the file, locks DEFAULT phases == file, tolerates a drift only for a `changed` row whose frontmatter == `from` and row == `to` (WARN); Keep-only drift still FAILs. (6) `/route pending`, `/route ask on|off`; `set`/`confirm`/show suffix deferred.
+- **Why**: user 2026-10-10: see in practice whether routing fits ("prompt qui demande de confirmer… mémoire de ce qu'on décide… met à jour la table… exception pour ce projet… persistant sur tous les projets, se redéploie comme le mod"). Tracked file = deploys with the mod via git; user-scope exceptions = security (robustness lens: project-tree layer let a cloned repo downgrade security-auditor to haiku).
+- **Alternatives rejected**: `$.store` (machine-local, re-asks per machine); project file in the tree (security hole + writes into worktrees); shared-promise dedupe for parallel spawns (hook budget: awaiters time out); `confirmed` dates (git log dates them); dialog edits of phases (blast radius: a phase is shared by many rows); per-layer degrade after first load (one transient read failure wiped 79 rows + the kill switch); `local:<realpath>` keys (home path in a tracked file).
+- **Gates**: plan r1 → r4 (simplicity CONCERNS(3), correctness FATAL(8) with the census BLOCKER, robustness CONCERNS(8) after a network-killed first run, confirmation CONCERNS(6)); feater DONE + 4 rounds; GATE 0 MET; verifier ECARTS(3)/(2) → CONFORME, re-verify after security ECARTS(1) → fixtures; security BLOCK(1) real (password with `@`/`/` stored in the key) → fixed, PASS. Kit 86 → 190 tests. Live T2 dialogs answered by the user from the hot-loaded working-tree mod ([[LRN-212]]).
+- **Refs**: contract `.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md`, plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md`, commit 22455c0, [[BDR-115]], [[LRN-210]], [[LRN-211]], [[EVAL-043]].
+
diff --git a/.claude/memory/evals.md b/.claude/memory/evals.md
index 5fad2a1..7031b20 100644
--- a/.claude/memory/evals.md
+++ b/.claude/memory/evals.md
@@ -63,6 +63,7 @@ rules:
 | EVAL-040 | 2026-10-08 | model-router w1a plan: 3 challengers + 1 confirmation found 2 BLOCKER + 14 MAJOR on a plan judged closed; executor then passed every gate first time | keep the round, never dispatch a mod plan without it |
 | EVAL-041 | 2026-10-09 | model-router W1-C plan: 3 lenses FATAL (4 BLOCKER + 20 MAJOR) then 2 confirmations each FATAL with a NEW BLOCKER in my own revision; executor DONE first pass, 3 short text/hardening rounds | one confirmation is not enough when a revision removes a whole mechanism; the plan carried the risk, the code almost none |
 | EVAL-042 | 2026-10-10 | model-router W2 plan r1 → r4: 3 lenses (1 BLOCKER), 2 confirmations (1 BLOCKER then 0); W2-A verifier 3× ECARTS on coverage clauses only, W2-B ECARTS(7) → CONFORME; gate A→B read from engine records | second confirmation paid again (BLOCKER on my own r2 slot); compound coverage criterion = endless ECARTS; engine jsonl replaces the live log |
+| EVAL-043 | 2026-10-11 | model-router W3-A: 3 lenses + 1 confirmation (census BLOCKER, project-tree layer dropped), feater DONE + 4 rounds, verifier 3× then re-verify after a REAL security BLOCK (credential fragment in the tracked key) | challenge + security gates both earned their cost; coverage-shaped criteria still cost 3 verifier rounds; live mod side effects misread as a test leak |
 
 ---
 
@@ -394,3 +395,11 @@ Dogfood: 3 blind lenses attacked the v1 plan for the plan-challenge feature itse
 - **Method**: 3 blind lenses (simplicity CONCERNS(5), correctness CONCERNS(10), robustness FATAL(8) → BLOCKER: mod off = agents inherit parent model); confirmation 1 robustness FATAL(8) → BLOCKER introduced by r2 (route calls wiped the sticky slot); confirmation 2 correctness CONCERNS(3), no BLOCKER → r4. W2-A: feater DONE + 4 rounds (1 internal decision, 3 coverage), GATE 0 MET, verifier ECARTS(3)/(1)/(1) all coverage, user accepted at cap; security PASS. W2-B: feater DONE first pass, verifier ECARTS(7) (5 FLOOR items = planned deletions needing a CLARIFICATIONS line, 2 prose, 1 scope add) → CONFORME 10/10; security PASS; full `make test` once (env red only). Gate A→B: 3/4 probes answered from engine jsonl, probe 4 (typed skill with a live agent) unobserved, recorded as a limit.
 - **Anomaly**: the user's rework answer ("delete or rework, not copy") changed the design mid-plan; r2's own fix carried a BLOCKER again (as in EVAL-041). Coverage criterion: 3 verifiers, 0 defects. FLOOR guard needs the test deletions named in CLARIFICATIONS, not only in criteria.
 - **Action**: keep the "second confirmation after a mechanism change" rule; write coverage criteria one clause each (LRN-210); when a plan deletes tests, write the authorizing CLARIFICATIONS line BEFORE the first verifier. Links [[EVAL-041]], [[LRN-210]], [[LRN-211]], [[BDR-115]].
+
+## EVAL-043 — model-router W3-A: the gates caught two real defects, the coverage criteria still cost three verifier rounds
+- **Date**: 2026-10-11
+- **Output checked**: plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md` r1 → r4; diff 22455c0 (register.ts, routing.json, 190 kit tests, census).
+- **Method**: 3 lenses (simplicity CONCERNS(3), correctness FATAL(8): BLOCKER = an Everywhere decision turns the census red; robustness: first run died on a DNS error, fresh re-dispatch on r2 CONCERNS(8): project-tree layer = security hole, shared-promise dedupe burns hook budgets, per-layer degrade wipes rows); confirmation correctness CONCERNS(6) → r4. Feater DONE first pass (169 tests); verifier ECARTS(3) → feater → ECARTS(2) → feater → CONFORME; security BLOCK(1): `normalizeRemote` kept a password tail when it held `@` or `/` → fixed (strict URL/scp parsing, no `local:` keys, output cap) → re-verify ECARTS(1) (guard fixtures) → feater → re-scan PASS. Full `make test` once (env red only).
+- **Anomaly**: the live hot-loaded mod answered-by-user dialogs were first misread as a kit write leak (LRN-212). A GATE 0 CHECK written as a multi-line heredoc is not runnable by gates.sh (one line or a script). Criterion 3 again bundled ~15 clauses: three verifier rounds on coverage, zero code defects from them (LRN-210 not yet applied by me).
+- **Action**: write GATE 0 oracles as scripts from the start; split coverage criteria per clause BEFORE the first verifier; when a mod is under development, announce the live side effects at each dispatch. Links [[EVAL-042]], [[BDR-116]], [[LRN-212]].
+
diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md
index ac278f4..4d8ccc2 100644
--- a/.claude/memory/journal.md
+++ b/.claude/memory/journal.md
@@ -594,3 +594,6 @@ rules:
 
 ## 2026-10-10
 - model-router W2-B landed (1f2d33b) + gate A→B. User /reload-plugins + typed /status; I read the engine jsonl instead of the UI log: main low on typed /status, analyzer opus/xhigh at step 0 → ordering + row-over-frontmatter proven; probe 4 unobserved (user away), limit recorded. Route tool checked live (`mcp__model-router__route`, deferred → ToolSearch once; answer names the id); session itself routed through it (reflect → orchestrate). W2-B: contract 10 criteria, feater DONE first pass (43 files), verifier ECARTS(7): 5 FLOOR items (planned test deletions → CLARIFICATIONS line), `/route on` wording, false CLAUDE.global.md sentence, plan-challenger scope add → CONFORME 10/10; I folded 3 observations by hand (SDD sonnet implementers `effort="medium"`, run-slot droppers, 80-col). Security PASS (push-guard false positive on a grep pattern; it also bit my registry heredoc). Full make test green (env red only). Doc audit SIGNIFICANT → user: apply all P1-P8, SemVer BREAKING → 3.0.0, registries all → BDR-115 amendment 2, LRN-210/211, EVAL-042. Pending: doc commit, memory commit, user merge decision (gitflow finish, human signal), publish by hand.
+
+## 2026-10-11
+- model-router W3-A (first-use confirmation) landed 22455c0 on feature/model-router-confirm. User asked for it after the W2 merge; 3 pass-B answers. Plan r1→r4: correctness BLOCKER (Everywhere decision = census red → `changed` WARN exemption), robustness (first challenger killed by DNS, fresh one: project-tree layer dropped for security, single dialog in flight, keep-previous after first load), confirmation CONCERNS(6). Feater DONE (169 tests) + 4 rounds. Verifier ECARTS(3)/(2)/CONFORME; security BLOCK(1) REAL: password with `@`/`/` landed in the tracked key → strict parsing, no `local:` keys, output cap → re-verify ECARTS(1) fixtures → PASS. The working-tree mod was hot-loaded by the engine: my own dispatches opened T2 dialogs the user answered (verifier Keep, feater Keep, security-auditor → implement → user reset to verify); first misread as a test leak (LRN-212). GATE 0 oracle as heredoc not runnable → script. Full make test green (env red only). Docs P1-P13 user-approved (patch in flight); BDR-116, LRN-212, EVAL-043 written. Next: doc commit, memory commit, user merge + publish by hand; T1/T3 live checks open.
diff --git a/.claude/memory/learnings.md b/.claude/memory/learnings.md
index 34b18a7..78c4e5c 100644
--- a/.claude/memory/learnings.md
+++ b/.claude/memory/learnings.md
@@ -1784,3 +1784,8 @@ Rule: when editing a doctrine file under structure locks, grep the test's lock s
 ## LRN-211 — Typed-slash routing: name-bound marker + idle fallback; run slot separate from turn routes; engine records are the live oracle
 - **Context**: mod needs "user typed /feat" from `skill.prompt`, which carries no origin. `prompt.submit` sees the raw `/name` first (composer|sdk|bridge): store the NAME (not a boolean; a bare flag leaked to the next preload), pending slot when mid-turn, consume only on the matching `skill.prompt`; fallback = no live/spawning loop AND allowed origin. Sticky run route in the SAME slot as turn routes was wiped by the first `route()` call (confirmation BLOCKER) → separate `runMain`, best-tier rows only (work/cheap rows leak low effort across turns). Live facts read from `~/.claude/projects/<repo>/<session>.jsonl` (+ `subagents/agent-*.jsonl`): `effort` + `message.model` per step. Typed `/status` → main low; analyzer step 0 opus/xhigh with frontmatter high (spawn bookkeeping precedes step 0; row beats frontmatter).
 - **Apply**: hook-side user-intent markers: bind to a name, add a pending slot for mid-turn, keep an ordering-independent fallback. Two lifetimes = two slots, never one slot with a source tag. Verify engine behaviour in the transcript jsonl, not in `$.ui.log`. Links [[BDR-115]], [[LRN-206]].
+
+## LRN-212 — The engine hot-reloads a mod's hooks module from the working tree: unverified code runs live during its own feature run; dialogs answered there are facts; the kit never touches the disk
+- **Context**: W3-A, 2026-10-10. Mid-run, `routing.json` gained decisions nobody expected (verifier → judge, feater → judge). First read: a kit test wrote the real file. Truth (feater, transcript timestamps = file mtimes to the second): the engine had reloaded `register.ts` from the working tree through the `skills/model-router` link, the live mod opened the T2 dialog on MY verifier/feater spawns, the user answered them in the terminal. The kit cannot write: an unmocked `fs.write` is refused ("no implementation"), a throwing mock lands on the same refusal; the real file's sha was stable across 10+ suite runs.
+- **Apply**: while a mod is under development in this repo, its working-tree code is LIVE in every session (no `/reload-plugins` needed): expect its side effects (dialogs, writes) during the gates; tell the user what dialogs will pop and what to answer; reset the data file deliberately at the gate. Blame the kit last: check mtimes against the transcript before assuming a test leak. Live answers = criterion evidence (record them `[gated]`). Links [[BDR-116]], [[LRN-206]], [[LRN-211]].
+
diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index d7c3756..e6595d6 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -23,6 +23,13 @@ migration of shifters/pins/model-gate in wave 2 after proof; names model-router
 - [ ] (was) W2 gate A→B (user): `/reload-plugins`, then the live probe of plan § Gate (4 points: typed `/status` marker vs fallback in the verbose log; a real rowed spawn line + `step 0 agent` effort = spawn/first-step ordering; sonnet session typed `/feat` self-check + route answer; probe 1 again with a background agent alive). `typed-marker` never seen → W2-B blocked, A4 re-planned.
 - [x] (was) W2-B repo migration (plan § W2-B B0-B7 + STEP 6/7): bridge removal, `lib/effort-shift.md` rewrite, 15 citers → `route`, `effort=` on opus general-purpose dispatches, slim `lib/model-gate.md`, delete `model-check.sh` + `effort-pins.*` + their tests + install/update blocks, delete `skills/effort-*`, analyzer `effort: xhigh`, census rewrite (drift lock rows ↔ frontmatter), docs + registries (BDR-115 amendment, LRN typed-slash/run slot, EVAL)
 - [ ] W2-A residuals (security, accepted): first-load failure of the override activates the router despite `enabled:false` (fix = treat a failed first load as off); ReDoS on a self-authored prompt pattern (size-bounded); error text in the local log; model alias keys unvalidated (PHASE_KEY would do); `offers` map uncapped; `__proto__`/`constructor` override keys untested. Known limits: `skillCalls`/`spawning` counters are global; offers keyed by name only; builtin `/effort` is not a lever inside a run.
+## 2026-10-10 — model-router wave 3-A: first-use route confirmation + decision memory (feature/model-router-confirm)
+Plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md` r4, contract `2026-10-10-model-router-w3a-confirm-1201`. User decisions 2026-10-10: tracked routing.json reached through the plugin dir (no new link); blocking `$.ui.ask` dialog at first use; per skill row, agent row, main phase.
+- [x] W3-A landed (22455c0, 2026-10-11): routing.json = phases + rows + decisions; T1/T2/T3 dialogs; project exceptions `projects[<normalized remote>]` in the tracked file (project-tree layer dropped: security); writers = dialog + `/route ask`; `/route pending`; census from the file with the `changed` WARN exemption; kit 86 → 190. Gates: 3 lenses + 1 confirmation (BLOCKER census), feater + 4 rounds, verifier CONFORME + re-verify, security BLOCK(1) credential leak fixed → PASS, full make test green (design-tool-gate env red). Live: T2 dialogs answered by the user (verifier Keep, feater Keep, security-auditor → implement then reset to verify on user go).
+- [ ] W3-A live checks still open: T1 (typed `/feat` etc.) and T3 (first `route(phase=…)` call) dialogs; a parallel same-agent dispatch answered after > 10 s; what an unanswered dialog resolves to on the terminal (must be Later or nothing written). Record in the contract as `[gated]` when seen.
+- [ ] W3-A residuals (security LOW, accepted): non-atomic cross-process write (two sessions, crash mid-write → file reads as failed, previous config kept); `host/path` of a private remote in the tracked file; a persistent write failure re-asks every use (`asked.delete` in the catch); `out.length` vs byte size at the cap; `changePatch` scope 'project' with a vanished key writes Everywhere (cwd change mid-dialog). Deferred: `/route set`, `/route confirm`, `(unconfirmed)` in show, dialog edits of phases, frontmatter auto-alignment, session-start warning when routing.json is dirty, per-machine `projects`.
+- [ ] routing.json ships `confirmed` for verifier/feater (user Keeps) and phases verify/implement: every clone inherits them (by design: decisions travel). Revisit at release if unwanted.
+
 - [ ] W2 residuals: probe 4 unobserved (above); the push-guard hook denies a read-only grep (or a heredoc) whose TEXT contains the push verb next to `git` (security-auditor + orchestrator 2026-10-10, false positives, reworded); ~27 loose "sonnet pin"/"opus pin" shorthand sites kept (true by census); README config key list omits `tiers`/`fallback`/`cooldownMinutes`/`mainUpgrade`/`upgradeMaxTokens` (doc audit item 6, pre-existing); MIGRATION.md "Upgrading to 3.0.0" at release time; `skillCalls`/`spawning` counters global; offers keyed by name.
 - [ ] W3 optional: step heuristics, haiku classifier, quota-aware downgrade, A/B
 
diff --git a/.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md b/.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md
new file mode 100644
index 0000000..ba2c27f
--- /dev/null
+++ b/.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md
@@ -0,0 +1,40 @@
+# CONTRACT — model-router-w3a-confirm
+- date: 2026-10-10 | flow: feat | branch: feature/model-router-confirm (to start off develop)
+- status: active
+
+## REQUEST (verbatim — IMMUTABLE)
+une fois fini j'aimerais que pour les premiere fois, les premiers switch de model et de'effort, on est un prompt qui demqnde de confirmer si on utilise bien ce model ou si moi j'en recommande un autre. Ca permet de voir si le routing correspond bien a nos besoin dans la pratique. sois faire un truc qui se souvient en userscop (si ca demande de confirmer la route sur un autre projet pour tel tache, que ca ne ele redemande jamais sur un autre projet. une memoire de ce qu'on decide, et ca met a jour la table de routing existante si il y a des changements, et si on fait un changement demander si c'est une exception pour ce projet ou non. Faire un truc qui demande au debut, mais qui est persistant une fois demander sur tout les projet et qui se redploi automatiquement comment tout le mod.
+
+## CLARIFICATIONS
+Q: where does the decision memory live? / A: "le 1 [fichier suivi dans le repo], mais il faut qu'il soit lisible et écrivable par tous les projets, donc le déployer (ln -s) dans le .claude du home à l'install, comme le reste" → tracked `mods/model-router/routing.json`, reached from every project through the EXISTING link `~/.claude/skills/model-router` → `../mods/model-router` (no new link: the plugin's own directory, `$.plugin`, resolves to it) [gated 2026-10-10]
+Q: how is the question asked? / A: blocking dialog at the moment of the switch (`$.ui.ask`, the engine's AskUserQuestion), options Keep / Change / Later; never in headless; `/route ask off` cuts it [gated 2026-10-10]
+Q: granularity? / A: per skill row, per agent row, per main-loop phase declared through the route tool; each once, across projects [gated 2026-10-10]
+Q: public names (orchestrator default, user may veto): `/route pending`, `/route ask on|off` (`/route set` and `/route confirm` deferred after the simplicity lens); dialog texts in English like the rest of the mod; project exceptions live in `routing.json` under `projects[<normalized repo key>]` (r3: the project-tree file `<project>/.claude/model-router.json` was dropped after the robustness lens showed a cloned repo could re-route the user's gate agents and that writes would land in foreign trees) [stated 2026-10-10, user may veto]
+
+Q: live T2 dialogs answered during the run (verifier → judge, feater → judge, Everywhere; the working-tree mod was hot-loaded by the engine without /reload-plugins) / A: user "Restaurer les deux" → routing.json reset to the shipped rows, confirmed/changed emptied; criterion 9 evidence: T2 dialog seen and written twice (texts and scope question confirmed live) [gated 2026-10-10]
+
+Q: live decisions during the gates (verifier Keep, feater Keep, security-auditor → implement Everywhere) / A: user "Revenir à verify" for security-auditor (row reset, its confirmed/changed entries removed); the two Keeps stay. Criterion 9 evidence: T2 dialog seen 5 times live (Keep, Change + scope, dismissed/Later), the mod hot-loaded from the working tree by the engine [gated 2026-10-11]
+Q: security gate BLOCK(1) credential fragment in the remote key / A: fixed (strict URL/scp parsing, credentials never read), `local:` path keys removed (no remote → Everywhere/Later only), output size cap; re-verify ECARTS(1) on guard fixtures → closed; re-scan PASS [gated 2026-10-11]
+
+## ACCEPTANCE CRITERIA
+1. `mods/model-router/routing.json` (tracked) is the single source of the phase table (11 full routes) and of the skill and agent rows (56 skill rows, 21 agent rows + Explore/Plan of plan r4 § Row tables), plus `confirmed` (skills/agents/phases → the confirmed phase) and `ask` (boolean); every row value is a phase key of that table; `DEFAULT_CONFIG.skills` and `.agents` in `register.ts` are `{}` (its `phases` stay as the fallback when the file is unreadable); rows and phases arrive from the file at load (session.start, or lazily once after a `/reload-plugins`), on `/route reload`, after each write, after `/clear` and on a cwd change.
+   CHECK: bash .claude/tasks/contracts/w3a-routing-file.sh
+   EXPECT: W3A-ROUTING-FILE
+   EVIDENCE: MET exit=0 marker-found :: W3A-ROUTING-FILE
+2. Config layers, later wins: `routing.json` (phases, rows, then its `projects[<repo key>]` rows for the current repo) < `~/.claude/model-router.json` (machine override, its `ask: false` honored); a `.claude/model-router.json` inside the project tree is NEVER read; phases merge first (an invalid or missing routing.json phase falls back to the code default by name, logged), rows validate against the final table; a failed layer is skipped only at the first load, afterwards a failed read keeps the whole previous config; session toggles survive a rebuild; `/clear` keeps the config and re-reads at the next prompt. One kit test per clause.
+3. First use asks once, one dialog: a typed skill with a row (main, allowed origin), a rowed agent spawn without an explicit `model` (`parentAgentId` undefined), a main-loop phase declared through the route tool → `$.ui.ask` whose question carries the REAL next model id and effort (decideFor/mainEffort on main, spawnTarget + explicit effort on spawn) and the options Later / Keep / <alt phase> / <alt phase> (T3: Later / Keep, only for a phase-key call); the file is re-read right before the dialog and the key re-checked as decided (another session's decision is seen); Keep writes `confirmed.<kind>.<name> = phase` and `confirmed.phases[phase]` and applies the row; an alt or a valid "Other" phase asks the scope (Everywhere → `routing.json` row + `changed.<kind>.<name> = {from, to}`; This project only → `routing.json` `projects[<normalized repo key>]` row, base row untouched, `confirmed` = the base row so no other project asks; one serialized write; a key failure offers Everywhere only), the new route applies to the current decision at once; any other answer (Later, dismissed, rejected in headless, unknown phase) → default applied, nothing written, not asked again this session; at most one dialog in flight: a concurrent use (same or another key) applies its current route unasked; a phase endorsed by a Keep is not asked at T3; a row that exists in `projects[key]` or in the machine override counts as decided; never asked inside a sub-agent (`parentAgentId` set), with an explicit `model` param, with the mod off, with `ask` false, or while routing.json is unreadable. One kit test per clause.
+4. Writes happen only from a dialog answer or the composer `/route ask` command (never from the route tool, a prompt rule, or any model-originated event); only to `${$.plugin.root}/routing.json`, never into a project tree; the writer refuses when the file is absent or unparsable (toast, answer = Later) and never creates it; read-modify-write of the whole JSON (2-space, key order phases, skills, agents, projects, confirmed, changed, ask), serialized through one promise chain; a write or rebuild failure logs once, applies the default and leaves the key unasked; after a write the config is rebuilt (swapped only on a successful read) and a toast says "routing.json updated: commit it from the config repo (chore branch)". One kit test per clause + reading.
+5. `/route pending` lists the rows and phases not yet confirmed (asked this session first, then the rest); `/route ask on|off` toggles asking and writes `ask`; `/route reload` re-reads the three layers. (`set`, `confirm`, a show suffix: deferred.) One kit test per command.
+6. The kit suite and the mods suite are green; `claude plugin validate` passes.
+   CHECK: cd mods/model-router && out="$(claude plugin test . 2>&1)" && printf '%s\n' "$out" | grep -qE '[0-9]+ pass' && ! printf '%s\n' "$out" | grep -qE '[1-9][0-9]* fail' && claude plugin validate . 2>&1 | grep -q 'passed' && cd ../.. && make test suite=lib/tests/mods.test.sh 2>&1 | grep -q 'all suites green' && echo W3A-MOD-GREEN
+   EXPECT: W3A-MOD-GREEN
+   EVIDENCE: MET exit=0 marker-found :: W3A-MOD-GREEN
+7. `lib/tests/effort-routing.test.sh` reads rows AND phases from `routing.json` (only the tier heads still come from `register.ts`), locks `DEFAULT_CONFIG.phases` equal to the file's phases, keeps the drift lock except for a row with a `changed.<kind>.<name>` entry whose `from` route equals the frontmatter and whose `to` equals the row (then a `WARN floor drift` line, no FAIL; a Keep-only drift, an empty or unknown frontmatter value, a hand edit after a change still FAIL; flip-tested), and is green; `lib/effort-shift.md` names the first-use dialog, `/route pending` and `/route ask` in ≤ 6 added lines.
+   CHECK: grep -q 'routing.json' lib/tests/effort-routing.test.sh && [ "$(grep -c 'register.ts' lib/tests/effort-routing.test.sh)" -le 3 ] && grep -q 'floor drift' lib/tests/effort-routing.test.sh && bash lib/tests/effort-routing.test.sh >/dev/null 2>&1 && grep -q '/route pending' lib/effort-shift.md && [ "$(wc -l < lib/effort-shift.md)" -le 66 ] && echo W3A-CENSUS-DOC
+   EXPECT: W3A-CENSUS-DOC
+   EVIDENCE: MET exit=0 marker-found :: W3A-CENSUS-DOC
+8. Hook budget: no dialog or file write on the `turn.step` path; a `$.ui.ask` in flight never blocks a second, unrelated spawn of another agent name beyond the dialog itself; the ask is awaited outside `safely` in the owning hook with a `.catch` → Later. Judged by reading.
+9. Live checks after the user's `/reload-plugins` (EVIDENCE lines added by the orchestrator; the answers committed on the branch before finish): one dialog at each of the three sites; a parallel same-agent dispatch answered after more than 10 s routes the unowned spawn without a timeout; an unanswered dialog on the terminal resolves to "Later" or to nothing written.
+
+## FILE SCOPE
+mods/model-router/routing.json (new), mods/model-router/hooks/register.ts, mods/model-router/hooks/register.test.ts, lib/tests/effort-routing.test.sh, lib/effort-shift.md; .claude/tasks/contracts/w3a-routing-file.sh (oracle, orchestrator)
diff --git a/.claude/tasks/contracts/w3a-routing-file.sh b/.claude/tasks/contracts/w3a-routing-file.sh
new file mode 100755
index 0000000..df7ed23
--- /dev/null
+++ b/.claude/tasks/contracts/w3a-routing-file.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# GATE 0 oracle, contract 2026-10-10-model-router-w3a-confirm: routing.json
+# is the single source of phases + rows; register.ts rows are empty.
+set -u
+python3 - <<'PY'
+import json,re,sys
+r=json.load(open('mods/model-router/routing.json'))
+src=open('mods/model-router/hooks/register.ts').read()
+ph=set(re.findall(r"^\s+([a-z]+): \{ tier:", re.search(r"phases: \{(.*?)\n  \}", src, re.S).group(1), re.M))
+jp=set(r.get('phases',{}).keys())
+ok = jp==ph and len(r['skills'])==56 and len(r['agents'])==23
+ok = ok and all(v in jp for v in list(r['skills'].values())+list(r['agents'].values()))
+ok = ok and isinstance(r.get('confirmed'),dict) and isinstance(r.get('ask'),bool) and 'version' not in r
+ok = ok and bool(re.search(r"\n  skills: \{\},", src)) and bool(re.search(r"\n  agents: \{\},", src))
+print('W3A-ROUTING-FILE' if ok else 'W3A-ROUTING-BAD'); sys.exit(0 if ok else 1)
+PY
diff --git a/.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md b/.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md
new file mode 100644
index 0000000..e1188c3
--- /dev/null
+++ b/.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md
@@ -0,0 +1,288 @@
+# PLAN r4 — model-router wave 3-A: first-use route confirmation + decision memory + project exceptions (2026-10-10)
+
+r1 → r2 after simplicity CONCERNS(3) + correctness FATAL(8); r2 → r3 after
+robustness CONCERNS(8) (fresh dispatch on r2 after the first died on a
+network error); r3 → r4 after the confirmation pass (correctness
+CONCERNS(6), no BLOCKER). Precedence: r4 > r3 > r2 > r1 where they differ. Contract
+`.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md`.
+Facts (kit types, checked 2026-10-10): `$.ui.ask(question, {options,
+header})` opens the engine's AskUserQuestion dialog, resolves to the chosen
+label or the "Other" free text, REJECTS when dismissed and in a `-p` run;
+`$.fs.read/stat/exists/write` take absolute paths, write creates
+directories; `$.session.root()` = the project root (follows /cd);
+`$.plugin.root` = the plugin directory, absolute (routing.json =
+`${$.plugin.root}/routing.json`, reached through the existing
+`~/.claude/skills/model-router` link); `$.ui.toast`; `$` calls stop the
+hook budget clock. The kit has no fs: tests mock bottom `fs.*`, `env.get`,
+`session.root` and `tool.call AskUserQuestion` hooks.
+
+## Data (one tracked source for rows AND phases; r3)
+- `mods/model-router/routing.json` (tracked):
+  `{ "phases": {11 full routes}, "skills": {56}, "agents": {23},
+    "projects": { "<repo key>": { "skills": {}, "agents": {} } },
+    "confirmed": { "skills": {}, "agents": {}, "phases": {} },
+    "changed": { "skills": {}, "agents": {} }, "ask": true }`
+  `confirmed.<kind>.<name>` = the routing.json phase endorsed by a Keep;
+  `changed.<kind>.<name>` = `{ "from": <shipped phase>, "to": <phase> }` for
+  an "Everywhere" change (the census reads `from`). `projects[key]` = the
+  "This project only" exceptions. Key (r4) = the origin remote normalized:
+  scheme and userinfo stripped, host lowercased, `.git` and trailing slash
+  removed (`github.com/acme/app`); no remote → `local:<root realpath>`
+  (meaningful on that machine only, stated in the toast); `session.repo`
+  or the realpath failing → the `projects` layer is skipped and ASK2
+  offers Everywhere only. Resolved once per decision and re-resolved on
+  `classic.CwdChanged` (rebuild). No version key, no dates. Never a URL
+  with credentials in the file.
+- NEVER read from the project tree: `<root>/.claude/model-router.json` is
+  not a layer (a cloned repo must not route the user's agents). Layers,
+  later wins: routing.json (phases, rows, then `projects[key]` rows) <
+  `~/.claude/model-router.json` (machine override; its `ask: false` also
+  honored). Phases merge first, rows validate against the final table.
+- Phases: routing.json `phases` replaces `DEFAULT_CONFIG.phases` route by
+  route; an invalid or missing phase falls back to `DEFAULT_CONFIG.phases
+  [name]` with one log line (a typo never removes a phase); alts offered
+  by the dialog are filtered against the final table.
+- Loading: full read at session.start, and LAZILY once when the State was
+  never loaded (first prompt.submit / skill.prompt / agent.spawn / route
+  tool after a `/reload-plugins`, which re-runs register() without
+  session.start); a failed layer is skipped and logged at that first load
+  only; afterwards any failed read, and a routing.json that went missing,
+  keeps the WHOLE previous config (today's kill-switch rule), and no ask
+  runs while routing.json is unreadable. `/route show` prints `config:
+  routing.json` once loaded. `resetSession` keeps its current set (cfg
+  included); the layers are re-read at the next `prompt.submit` and the
+  cfg swapped only after a fully successful read. Session toggles
+  (`/route switch`, `verbose`) live in State, re-applied after any rebuild,
+  and added to resetSession's kept set (they survive /clear as today).
+- `DEFAULT_CONFIG.skills/.agents` = `{}`; the file is the source. A
+  missing routing.json → DEFAULT phases, no rows, one log, no asks, no
+  writes (the writer never creates the file).
+
+## Dialog (main loop only; `ask` true; mod on; never inside an agent)
+- Trigger sites and guards:
+  T1 typed skill with a row: `applyTypedSkill` made async, awaited in the
+     skill.prompt hook OUTSIDE `safely`: route FIRST (`routeMainBySkill`,
+     typed=true), build the text from the route now in force, ask, and on
+     a change re-run `routeMainBySkill` with the recomputed `skillRow`
+     (the model's `Skill` path never asks).
+  T2 rowed agent spawn: in `registerSpawn` before `spawnTarget`, awaited;
+     guards `e.parentAgentId === undefined`, not frozen, not shadowed, and
+     `e.model === undefined` (an explicit model is not a routing decision).
+  T3 route tool phase on main (`handleRouteTool`, no agentId, and only
+     when `e.phase` is a phase key — never for an effort-only call):
+     confirm-only.
+- One dialog (ASK1), 4 options: question text built from the REAL decision:
+  main → `decideFor`/`mainEffort` like `mainRoutedText` ("First route for
+  /feat: reflect, next step claude-fable-5-1 at high. Keep it?"); spawn →
+  `spawnTarget` + the explicit `effort` param when given ("First dispatch
+  of feater: implement, claude-sonnet-5-5 at medium. Keep it?"); T3 →
+  "First use of orchestrate on the main loop: claude-fable-5-1 at medium.
+  Keep it?" with options ["Later", "Keep"] only.
+  Options T1/T2: ["Later", "Keep", <altA>, <altB>] (Later FIRST: an idle
+  auto-pick, if any surface does one, must never write), header
+  "model-router";
+  alts = the first two of [plan, reflect, implement, apply] (skills) or
+  [judge, implement, verify, apply] (agents) minus the current phase;
+  "Other" free text = a phase key of the final table (else toast "unknown
+  phase <x>, default kept" → Later); an Other equal to the current phase
+  = Keep. Any answer that is not exactly Keep, an alt, or a valid Other →
+  Later (covers dismissed, rejected, auto-resolved idle answers). ASK2
+  accepts only its two labels; anything else = Later.
+  Before opening any dialog the mod re-reads routing.json (the pre-ask
+  read) and re-checks `ask` AND "decided" for the key from that fresh
+  content, so a decision taken in another live session is seen.
+- Keep → `confirmed.<kind>.<name> = <routing.json phase>` AND
+  `confirmed.phases[<phase>] = <phase>` (a Keep endorses the phase: no
+  duplicate T3 later); the row applies. "Decided" = `confirmed` equals the
+  routing.json row, OR a `projects[key]` / machine-override row exists for
+  that name (presence = decided; never compared across layers).
+- Change (alt/Other) → ASK2 scope ["Everywhere", "This project only"].
+  Everywhere → routing.json row + `changed.<kind>.<name> = {from, to}`
+  (`from` kept from the FIRST entry when one exists, `to` = the new row) +
+  `confirmed.<kind>.<name> = to`; This project only → `projects[key]
+  .<kind>.<name> = phase` (routing.json row untouched) + `confirmed.<kind>
+  .<name> = the BASE routing.json row` (so no other project asks again). One file, one serialized write.
+  Then rebuild; the new route applies to the current decision at once
+  (T1: recompute `skillRow`; T2: recompute `spawnRoute` and pass it to the
+  spawn bookkeeping). A write or rebuild failure → log once, default row
+  applied, key left unasked (never escapes to the hook's `.catch`).
+- Later → default applies, nothing written.
+- One dialog in flight per session, ever (`st.asking: string | null`):
+  a use that finds a dialog open (same key or another) applies its current
+  route and stays unasked (asked later); the owner alone runs ASK1, ASK2
+  and the write. A parallel spawn never awaits a promise it did not create
+  (hook budget: only the owner's `$` call stops the clock). Asked-this-
+  session = `Set<key>` in State, dropped by resetSession.
+- Never on `turn.step`. The ask is awaited in the owning hook with
+  `.catch(() => 'Later')`.
+
+## Commands (composer only, as `/route` today)
+- `/route pending` → keys not yet confirmed (asked-this-session first).
+- `/route ask on|off` → `ask` in routing.json (write path below); the
+  flag is re-read (one `$.fs.read`) right before each ask so another
+  session's change is seen.
+- `/route reload` → re-reads the three layers. (`set`, `confirm`, a show
+  suffix: deferred to TODO; the dialog is the writer.)
+
+## Writes
+- `writeRouting($, st, patch)`: read-modify-write of the whole JSON
+  (2-space; key order phases, skills, agents, projects, confirmed, changed,
+  ask), serialized through ONE promise chain in State; refuses (toast,
+  answer treated as Later) when routing.json is absent or unparsable:
+  never creates the file; size cap as the override, `readCapped` takes
+  the file label; after a write: rebuild (swap only on a successful read)
+  + toast "routing.json updated: commit it from the config repo (chore
+  branch, `gitflow.sh start chore …`)".
+- Writers: dialog answers and composer `/route ask` ONLY. The route tool
+  (model), prompt rules and sub-agents never write. Nothing is ever
+  written into a project tree.
+
+## Census and floors (BLOCKER closed)
+- `lib/tests/effort-routing.test.sh`: rows AND phases read from
+  routing.json (python3 json); tier heads still parsed from `register.ts`
+  `tiers` (unchanged by this wave; the only register.ts read left); a new
+  lock: `DEFAULT_CONFIG.phases` values == routing.json phases (the fallback
+  never applies a stale route). The drift lock stays for every row EXCEPT
+  one with a `changed.<kind>.<name>` entry whose `from` phase route equals
+  the frontmatter AND whose `to` equals the current row: then one `WARN
+  floor drift: <file> <value> vs row <to> (<value>)` line, no FAIL. A
+  Keep-only row, an empty or unknown frontmatter value, a hand edit after
+  a change (`to` ≠ row), or a drift not matching `from` still FAILs.
+- BDR-115 amendment 2(a) "census-locked equal" → amended to "equal unless
+  the row is a confirmed user decision (floor may lag; WARN)" at STEP 7.
+
+## Steps
+- [ ] S1 routing.json from the current DEFAULT_CONFIG (phases + rows +
+      Explore/Plan), `projects`/`confirmed`/`changed` empty, `ask` true;
+      DEFAULT rows → `{}`; `loadLayers` (two files + `projects[key]`),
+      first-load degrade then keep-previous rule, phase fallback by name,
+      session toggles in State, resetSession kept set unchanged + re-read
+      at the next prompt.submit.
+- [ ] S2 ask engine: `askFirst($, st, kind, name, text, options)` with the
+      single-dialog guard + asked set; `decide(answer)`; `applyDecision`
+      (Keep / change + scope) → serialized write → rebuild → recompute,
+      wrapped so a failure logs once and applies the default.
+- [ ] S3 wiring T1 (async applyTypedSkill), T2 (registerSpawn), T3
+      (handleRouteTool, confirm-only).
+- [ ] S4 commands `pending`, `ask on|off`; `reload` reads three layers.
+- [ ] S5 census (rows + phases from JSON, drift lock with the decision
+      exception) + `lib/effort-shift.md` ≤ 6 added lines (dialog, `/route
+      pending`, `/route ask`).
+- [ ] S6 kit tests. First: `boot()`/`bootRun()` gain a path-aware fixture
+      (bottom `fs.exists`/`fs.stat` (+ `realPath`)/`fs.read`/`fs.write`,
+      `env.get` HOME, `session.root`, `session.repo`) serving an inline
+      routing.json with `ask: false`
+      unless a test opts in (`boot($, on, {ask: true, project: {...},
+      home: {...}})`); the existing `{verifier: null}` test becomes
+      path-aware; all 86 tests green again. Then one test per clause:
+      layer precedence (routing.json rows < projects[key] < machine
+      override, null drop; a `.claude/model-router.json` in the project
+      tree is NEVER read; machine `ask:false` honored); typed `/feat` first use → AskUserQuestion mock
+      sees the id + "high" → "Keep" → fs.write of routing.json captured
+      with confirmed.skills.feat = reflect AND confirmed.phases.reflect →
+      second typed `/feat` → no ask; alt "implement" → ASK2 → "Everywhere"
+      → routing.json row + main routed implement now; "This project only"
+      → project file written, routing.json row untouched, confirmed in
+      routing.json; "Later"/reject/free text garbage → default, no write,
+      no second ask this session; agent first spawn → ask → Keep → model
+      written; explicit `model` param → no ask; two parallel spawns → one
+      ask, the second spawn routed on the current row without waiting; parentAgentId set → no ask; route tool phase first use → ask
+      (Keep/Later) → Keep → confirmed.phases; phase already endorsed by a
+      T1 Keep → no T3 ask; `/route ask off` → no asks + write; `/route
+      pending` text; routing.json unreadable at start → DEFAULT phases, empty
+      rows, one log, no asks; unreadable at a later rebuild → previous cfg
+      kept; missing file → `/route ask off` refused with a toast, file not
+      created; a phase typo in routing.json → DEFAULT phase by name + log,
+      alts filtered; `/route switch on` survives a rebuild; writes are
+      serialized (two decisions, one file, both present); row edited by
+      hand after a Keep → asked again; census flip-tests: confirmed-only
+      drift FAILs, `changed.from` drift WARNs, empty `model:` FAILs.
+- [ ] S7 live checks after the user's /reload-plugins (EVIDENCE lines,
+      answers committed on the branch before finish): `/route show`
+      prints `config: routing.json` right after the reload (lazy load);
+      one dialog at each of the three sites; a parallel same-agent dispatch answered after
+      more than 10 s (the unowned spawn must be routed, not timed out);
+      what an unanswered dialog resolves to on the terminal (and on sdk/
+      bridge if reachable): any auto-pick must land on "Later".
+- Disposition: honors BDR-115 (user writers only; full ids in texts;
+  amendment 2(a) to be amended), BDR-107/108 (phases unchanged), LRN-206
+  (kit facts), LRN-210 (one clause per test), LRN-211 (typed path only).
+- Deferred (TODO): `/route set`, `/route confirm`, show suffix, dialog
+  edits of phases, frontmatter auto-alignment, a session-start warning
+  when routing.json is dirty, per-machine `projects` (today one tracked
+  map keyed by repo).
+
+## Challenge ledger (r1 → r2)
+- correctness 1 BLOCKER + simplicity 3 (census red on a decision) → drift
+  lock with the confirmed-decision exception (WARN), BDR-115 2(a) amended.
+- correctness 2/5, simplicity 2 (partial phase overrides, blast radius) →
+  phases move to routing.json as a full table, dialog never edits phases,
+  T3 confirm-only, project layer rows only.
+- correctness 3, simplicity 10 (kit loses rows) → S6 path-aware fixture first.
+- correctness 4 (texts from the real decision) → ASK1 texts from
+  decideFor/mainEffort and spawnTarget; T2 skipped on explicit model.
+- correctness 6, simplicity 9 (sync site) → async applyTypedSkill awaited
+  in the hook.
+- correctness 7 (root == HOME) → layer 3 skipped, ASK2 skipped.
+- correctness 8/9/10/16/17 (layers, /clear, validation order, stale root,
+  concurrent writes) → re-read from disk on every rebuild, per-layer
+  degrade, phases first, root re-resolved, one write chain.
+- correctness 11/12 (Other, counts), simplicity 4/7 → one 4-option dialog,
+  2 alts, non-matching answers = Later.
+- correctness 13 (confirmed location) → always routing.json.
+- correctness 14/15 (parentAgentId, fs.stat label) → written in.
+- correctness 18 (no live proof) → S7.
+- simplicity 1 (commands) → pending + ask only; set/confirm deferred.
+- simplicity 5/6/8 → confirmed = phase, no version, one Map, Keep endorses
+  the phase.
+- simplicity 11 → project layer rows only.
+
+## Challenge ledger (r2 → r3, robustness)
+- rob 1/9 (shared promise burns the awaiters' budget; stacked dialogs) →
+  one dialog in flight, owner-only; concurrent uses apply the current
+  route unasked; S7 >10 s check.
+- rob 2 (per-layer degrade wipes rows, reopens the kill switch) → degrade
+  at first load only, then keep-previous; no asks while unreadable.
+- rob 3 (a phase typo removes the phase, gate STOPs everywhere) → fallback
+  to DEFAULT phase by name + log; alts filtered.
+- rob 4 (writer creates a missing file) → writer refuses, never creates.
+- rob 5 (global confirmed vs layered rows re-asks forever) → confirmed
+  compared with the routing.json row only; layer rows = decided by
+  presence; one file, one write.
+- rob 6 (project-tree layer = security hole + foreign writes) → layer
+  removed; exceptions in routing.json `projects[key]`; nothing written in
+  a project tree.
+- rob 7 (drift exception too wide) → exemption only for `changed.from`
+  matches; Keep-only, empty and unknown values FAIL.
+- rob 8 (/clear drops cfg/kill switch/breaker) → kept set unchanged;
+  re-read at next prompt.submit, swap on success.
+- rob 10 (session toggles reverted by rebuilds) → toggles in State.
+- rob 11 (dirty tracked repo, S7 answers) → toast names the chore flow;
+  S7 answers committed before finish; session-start warning deferred.
+- rob 12 (idle auto-pick) → "Later" first; S7 verifies.
+- rob 13 (`ask` only in the tracked file) → machine override `ask`
+  honored; flag re-read before each ask.
+- rob 14 (write failure escapes) → applyDecision wrapped.
+
+## Confirmation ledger (r3 → r4, correctness)
+- conf 1 (tier heads) → census keeps a tiers parser on register.ts; AC7
+  CHECK narrowed to the rows/phases parser.
+- conf 2 (rows lost after /reload-plugins) → lazy load once; S7 line.
+- conf 3 (T1 text before routing) → route first, text, ask, re-route.
+- conf 4 (exception re-asks elsewhere) → confirmed = base row on "This
+  project only"; test X then Y.
+- conf 5 (multi-session re-ask) → pre-ask read re-checks decided.
+- conf 6 (raw remote URL / machine path as key) → normalized key, no
+  userinfo, `local:` fallback, key failure skips projects only.
+- conf 7 (leftovers, un-gated move of the exception file) → S6/contract
+  fixed; named to the user at the gate.
+- conf 8 (fixture) → session.repo + realPath mocked; key failure scoped.
+- conf 9 (/cd) → rebuild on `classic.CwdChanged`.
+- conf 10 (changed.from on a second change) → first `from` kept, exempt
+  only when row == to.
+- conf 11 (unspecified answers) → ASK2 two labels only; Other == current
+  = Keep.
+- conf 12 (DEFAULT phases drift) → census lock DEFAULT == routing.json.
+- conf 13 (effort-only route call) → T3 only for a phase key.
+- conf 14 (later absence) → treated as failed, previous kept.
+- conf 15 (toggles across /clear) → added to the kept set.

From 604a6c441126a3e63e5c50c6cca3d258c3334b76 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 14:10:24 +0200
Subject: [PATCH 05/12] =?UTF-8?q?feat(model-router):=20wave=203-B=20?=
 =?UTF-8?q?=E2=80=94=20first-use=20dialog=20with=20context,=20model=20then?=
 =?UTF-8?q?=20effort=20on=20change?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The dialog now explains what it asks about: the skill's description (from
its SKILL.md frontmatter, five YAML forms, first sentence, cleaned), the
agent's description (from agent.offer), the phase's new 'about' line in
routing.json, and the real model id and effort the next step runs on.
Options Later / Keep / Change; Change asks the model (fable, opus, sonnet,
haiku with their tier role), then the effort among those the phases of
that model offer, then the scope; the pair maps to an existing phase (rows
stay phase names; the row's current phase wins a tie; same phase = Keep).
A main-loop phase (T3) is Later / Keep only. A main-row change toasts the
real decision and the /route switch hint when the pick is a downgrade.
Descriptions pass a hardened read (name allowlist, stat kind, size cap)
and clean(). Kit suite 190 → 232; W3-A dialog tests migrated.

Contract .claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md,
plan r3: 3 lenses (2 BLOCKERs: inline rows, phase edits) + 1 confirmation,
feater + 2 rounds, GATE 0 MET, verifier CONFORME (3rd pass), security PASS.
---
 lib/effort-shift.md                      |   4 +-
 mods/model-router/hooks/register.test.ts | 507 +++++++++++++++++++++--
 mods/model-router/hooks/register.ts      | 319 ++++++++++++--
 mods/model-router/routing.json           |  41 +-
 4 files changed, 769 insertions(+), 102 deletions(-)

diff --git a/lib/effort-shift.md b/lib/effort-shift.md
index 52f685c..db781a0 100644
--- a/lib/effort-shift.md
+++ b/lib/effort-shift.md
@@ -48,8 +48,8 @@ Builtin `/effort` is NOT a lever inside a run: rows and routes outrank it.
   typed marker (unverified live 2026-10-10).
 - Headless (`-p`, SDK) runs the hooks, so routing works there too.
 - Mod off: typed agents fall back to their `model:`/`effort:` frontmatter.
-- First use of a row asks once (Keep, Later or another phase, then
-  Everywhere or this project only); the answer is kept in
+- First use of a row asks once, with context (Later, Keep or Change: model,
+  then effort, then Everywhere or this project only); the answer is kept in
   `mods/model-router/routing.json`. `/route pending` lists what is still
   unconfirmed, `/route ask off|on` toggles the dialog.
 
diff --git a/mods/model-router/hooks/register.test.ts b/mods/model-router/hooks/register.test.ts
index 8e0b884..8c4b626 100644
--- a/mods/model-router/hooks/register.test.ts
+++ b/mods/model-router/hooks/register.test.ts
@@ -17,6 +17,13 @@ const REAL_ROOT = '/real/work/app'
 const REMOTE = 'https://github.com/acme/app.git'
 const KEY = 'github.com/acme/app'
 const REJECT = '<rejected>' // an answer the dialog never gets: headless
+// A Change answered to the end: model, effort (no scope yet). /feat is on
+// reflect (best, high); implement is the first work/medium phase, apply
+// the work/low one, judge the only big one (opus has one effort: skipped).
+const TO_IMPLEMENT = ['Change', 'sonnet (work)', 'medium']
+const TO_APPLY = ['Change', 'sonnet (work)', 'low']
+const TO_JUDGE = ['Change', 'opus (big)']
+const SCOPE_ASK = 3 // index of the scope question after a Change chain
 
 /** What the bottom `fs`, `env`, `session.repo` and dialog hooks serve. */
 type World = {
@@ -31,6 +38,8 @@ type World = {
   onAsk: (() => void) | undefined // called when a dialog opens
   onWrite: (() => void) | undefined // called when an fs.write starts
   repo: { root: string; remote: string | null } | null | 'fail'
+  env: string | undefined // HOME as env.get answers it (undefined = unset)
+  kinds: Map<string, 'file' | 'dir' | 'other'> // per-path stat kind override
 }
 
 type Fixture = {
@@ -40,6 +49,7 @@ type Fixture = {
   home?: Rec | 'broken' // ~/.claude/model-router.json
   answers?: string[]
   repo?: World['repo']
+  noHome?: boolean // HOME unset: env.get answers undefined
 }
 
 /**
@@ -103,11 +113,18 @@ function newWorld(fx: Fixture = {}): World {
     onAsk: undefined,
     onWrite: undefined,
     repo: fx.repo === undefined ? { root: ROOT, remote: REMOTE } : fx.repo,
+    env: fx.noHome ? undefined : HOME,
+    kinds: new Map(),
   }
 }
 
-const slot = (path: string): string =>
-  path.endsWith('/routing.json') ? 'routing' : path
+const slot = (path: string): string => {
+  if (path.endsWith('/routing.json')) return 'routing'
+  // the engine resolves a relative path against its cwd: `undefined/...`
+  // (a HOME read as unset and not guarded) comes back absolute
+  const rel = /\/(undefined\/\.claude\/.*)$/.exec(path)
+  return rel?.[1] ?? path
+}
 
 /** routing.json as the world holds it now. */
 const routingOf = (w: World): Rec =>
@@ -118,7 +135,7 @@ const routingOf = (w: World): Rec =>
  * no hook answers is refused, never sent to the disk: see "writes: kit").
  */
 function installWorld(on: On, w: World): void {
-  on('env.get', () => ({ value: HOME }))
+  on('env.get', () => ({ value: w.env }))
   on('fs.exists', (_a, e) => ({
     value: w.files.has(slot(e.path)) || e.path === ROOT,
   }))
@@ -127,7 +144,8 @@ function installWorld(on: On, w: World): void {
     if (text === undefined && e.path !== ROOT) throw new Error('ENOENT')
     return {
       value: {
-        kind: text === undefined ? 'dir' as const : 'file' as const,
+        kind: w.kinds.get(e.path) ??
+          (text === undefined ? 'dir' as const : 'file' as const),
         size: text?.length ?? 0,
         mtimeMs: 0,
         isLink: false,
@@ -991,10 +1009,15 @@ async function bootRun(
 const spawnOf = (agent: string, extra: object = {}) =>
   ({ ...spawnInput(), subagentType: agent, ...extra })
 
-const offerOf = ($: Engine, agent: string, source: string) =>
+const offerOf = (
+  $: Engine,
+  agent: string,
+  source: string,
+  description = 'd',
+) =>
   $.agent.offer({
     agent,
-    description: 'd',
+    description,
     source,
     provider: { plugin: 'engine', tier: 'core' },
   })
@@ -1668,11 +1691,11 @@ test('layers: a cwd change re-reads the layers for the new repo', async (
 
 test('layers: no remote gives no project key, no local: string', async (
   $, on) => {
-  const w = asks(['implement', 'This project only'],
+  const w = asks([...TO_IMPLEMENT, 'This project only'],
     { repo: { root: ROOT, remote: null } })
   await bootRun($, on, FABLE, w)
   await typeFeat($)
-  expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+  expect(w.asked[SCOPE_ASK]?.options).toEqual(['Everywhere', 'Later'])
   expect(w.written).toEqual([])
   expect(w.files.get('routing')).not.toContain('local:')
   expect(w.files.get('routing')).not.toContain(REAL_ROOT)
@@ -1696,7 +1719,7 @@ test('layers: a remote with credentials keys without them', async ($, on) => {
 
 /** The project keys "This project only" stores for a remote. */
 async function keyedBy($: Engine, on: On, remote: string) {
-  const w = asks(['implement', 'This project only'],
+  const w = asks([...TO_IMPLEMENT, 'This project only'],
     { repo: { root: ROOT, remote } })
   await bootRun($, on, FABLE, w)
   await typeFeat($)
@@ -1710,7 +1733,7 @@ for (const bad of [
   test(`layers: credentials never become a key: ${bad}`, async ($, on) => {
     const { w, keys } = await keyedBy($, on, bad)
     expect(keys).toEqual([])
-    expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+    expect(w.asked[SCOPE_ASK]?.options).toEqual(['Everywhere', 'Later'])
     expect(w.files.get('routing')).not.toContain('ss@')
   })
 }
@@ -1726,7 +1749,7 @@ for (const [guard, bad] of [
   test(`layers: ${guard} guard rejects ${bad}`, async ($, on) => {
     const { w, keys } = await keyedBy($, on, bad)
     expect(keys).toEqual([])
-    expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+    expect(w.asked[SCOPE_ASK]?.options).toEqual(['Everywhere', 'Later'])
     expect(w.files.get('routing')).not.toContain('/srv/')
     expect(w.files.get('routing')).not.toContain('ss@')
   })
@@ -1766,7 +1789,7 @@ test('T1: a typed skill asks once, with the real id and effort', async (
   const first = w.asked[0] as Asked
   expect(first.text).toContain('/feat')
   expect(first.text).toContain('claude-fable-5-1 at high')
-  expect(first.options).toEqual(['Later', 'Keep', 'plan', 'implement'])
+  expect(first.options).toEqual(['Later', 'Keep', 'Change'])
   expect(first.header).toBe('model-router')
 })
 
@@ -1797,9 +1820,9 @@ test('T1: Keep leaves the route as it was', async ($, on) => {
   expect(await mainNow($)).toContain('skill reflect')
 })
 
-test('T1: an alt then Everywhere rewrites the row and routes at once', async (
+test('T1: a Change then Everywhere rewrites the row, routes at once', async (
   $, on) => {
-  const w = asks(['implement', 'Everywhere'])
+  const w = asks([...TO_IMPLEMENT, 'Everywhere'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   const file = routingOf(w)
@@ -1812,15 +1835,15 @@ test('T1: an alt then Everywhere rewrites the row and routes at once', async (
 })
 
 test('T1: the scope question names the two scopes', async ($, on) => {
-  const w = asks(['implement', 'Later'])
+  const w = asks([...TO_IMPLEMENT, 'Later'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
-  expect(w.asked[1]?.options).toEqual(['Everywhere', 'This project only'])
+  expect(w.asked[SCOPE_ASK]?.options).toEqual(['Everywhere', 'This project only'])
 })
 
 test('T1: This project only writes the exception, not the row', async (
   $, on) => {
-  const w = asks(['implement', 'This project only'])
+  const w = asks([...TO_IMPLEMENT, 'This project only'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   const file = routingOf(w)
@@ -1832,13 +1855,13 @@ test('T1: This project only writes the exception, not the row', async (
 })
 
 test('T1: after a project exception no other project asks', async ($, on) => {
-  const w = asks(['implement', 'This project only'])
+  const w = asks([...TO_IMPLEMENT, 'This project only'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   w.repo = { root: '/work/two', remote: 'https://github.com/acme/two.git' }
   await $.classic.CwdChanged({ old_cwd: ROOT, new_cwd: '/work/two' })
   await typeFeat($)
-  expect(w.asked).toHaveLength(2)
+  expect(w.asked).toHaveLength(SCOPE_ASK + 1)
   expect(await mainNow($)).toContain('skill reflect')
 })
 
@@ -1854,7 +1877,7 @@ function clearOf($: Engine) {
 test('T1: a second change keeps the first shipped phase in changed', async (
   $, on) => {
   on('session.end', ($, e) => ({ sessionId: e.sessionId }))
-  const w = asks(['implement', 'Everywhere', 'apply', 'Everywhere'])
+  const w = asks([...TO_IMPLEMENT, 'Everywhere', ...TO_APPLY, 'Everywhere'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   const file = routingOf(w)
@@ -1868,22 +1891,6 @@ test('T1: a second change keeps the first shipped phase in changed', async (
   })
 })
 
-test('T1: a free-text phase counts as an alt', async ($, on) => {
-  const w = asks(['apply', 'Everywhere'])
-  await bootRun($, on, FABLE, w)
-  await typeFeat($)
-  expect((routingOf(w).skills as Rec).feat).toBe('apply')
-})
-
-test('T1: a free-text answer equal to the current phase is a Keep', async (
-  $, on) => {
-  const w = asks(['reflect'])
-  await bootRun($, on, FABLE, w)
-  await typeFeat($)
-  expect(confirmedOf(w).skills).toEqual({ feat: 'reflect' })
-  expect(w.asked).toHaveLength(1)
-})
-
 test('T1: Later applies the default, writes nothing, asks no more', async (
   $, on) => {
   const w = asks(['Later'])
@@ -1905,18 +1912,19 @@ test('T1: a dismissed dialog is a Later', async ($, on) => {
   expect(await mainNow($)).toContain('skill reflect')
 })
 
-test('T1: an unknown phase is a Later and says so', async ($, on) => {
+test('T1: an answer that is no label is a Later and says so', async (
+  $, on) => {
   const toasts = recordToasts(on)
   const w = asks(['banana'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   expect(w.written).toEqual([])
-  expect(toasts.join('\n')).toContain('unknown phase "banana"')
+  expect(toasts).toContain('answer not recognised, default kept')
   expect(await mainNow($)).toContain('skill reflect')
 })
 
 test('T1: a scope answer that is not a label is a Later', async ($, on) => {
-  const w = asks(['implement', 'whenever'])
+  const w = asks([...TO_IMPLEMENT, 'whenever'])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   expect(w.written).toEqual([])
@@ -1924,10 +1932,10 @@ test('T1: a scope answer that is not a label is a Later', async ($, on) => {
 })
 
 test('T1: without a repo key only Everywhere is offered', async ($, on) => {
-  const w = asks(['implement', 'This project only'], { repo: 'fail' })
+  const w = asks([...TO_IMPLEMENT, 'This project only'], { repo: 'fail' })
   await bootRun($, on, FABLE, w)
   await typeFeat($)
-  expect(w.asked[1]?.options).toEqual(['Everywhere', 'Later'])
+  expect(w.asked[SCOPE_ASK]?.options).toEqual(['Everywhere', 'Later'])
   expect(w.written).toEqual([])
 })
 
@@ -2062,7 +2070,7 @@ test('T1: two failed writes log the failure once', async ($, on) => {
 test('T1: a rebuild failing after the write leaves the key unasked', async (
   $, on) => {
   const logs = recordLogs(on)
-  const w = asks(['implement', 'Everywhere'])
+  const w = asks([...TO_IMPLEMENT, 'Everywhere'])
   await bootRun($, on, FABLE, w)
   w.onWrite = () => { w.files.set(HOME_FILE, '{nope') }
   await typeFeat($)
@@ -2129,9 +2137,9 @@ test('writes: the route tool never writes', async ($, on) => {
   expect(w.written).toEqual([])
 })
 
-/** An alt answer, then `scope`: the world after the typed /feat. */
+/** A Change chain, then `scope`: the world after the typed /feat. */
 async function changeFeat($: Engine, on: On, scope: string) {
-  const w = asks(['implement', scope])
+  const w = asks([...TO_IMPLEMENT, scope])
   await bootRun($, on, FABLE, w)
   await typeFeat($)
   return w
@@ -2265,7 +2273,7 @@ test('T2: a rowed spawn asks with the model and effort it will get', async (
   const q = w.asked[0] as Asked
   expect(q.text).toContain('First dispatch of feater')
   expect(q.text).toContain('claude-sonnet-5-5 at medium')
-  expect(q.options).toEqual(['Later', 'Keep', 'judge', 'verify'])
+  expect(q.options).toEqual(['Later', 'Keep', 'Change'])
 })
 
 test('T2: the question carries an explicit effort param', async ($, on) => {
@@ -2297,7 +2305,7 @@ test('T2: Keep writes the agent row and the spawn goes on', async ($, on) => {
 
 test('T2: a change routes this very spawn with the new row', async (
   $, on) => {
-  const w = asks(['judge', 'Everywhere'])
+  const w = asks([...TO_JUDGE, 'Everywhere'])
   const rig = await bootRun($, on, FABLE, w)
   await $.agent.spawn(spawnOf('feater'))
   expect(rig.specs).toEqual([OPUS])
@@ -2541,3 +2549,410 @@ test('layers: enabled:false in the override survives /clear', async (
   expect(await route($, 'show')).toContain('router: off (config)')
   expect(await featerModel($, rig)).toBeUndefined()
 })
+
+// ---- wave 3-B: a dialog with context, model then effort on a change ------
+
+const skillPath = (name: string) => `${HOME}/.claude/skills/${name}/SKILL.md`
+const skillMd = (front: string, body = '# body') =>
+  `---\nname: feat\n${front}\nallowed-tools: Read\n---\n${body}\n`
+const ROUTED = 'Routed to reflect: claude-fable-5-1 at high. OK?'
+
+/** A typed /feat with `md` served as its SKILL.md; the world after. */
+async function featWith(
+  $: Engine,
+  on: On,
+  md: string | undefined,
+  fx: Fixture = {},
+) {
+  const w = asks(['Later'], fx)
+  if (md !== undefined) w.files.set(skillPath('feat'), md)
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  return w
+}
+
+/** Edits one phase of the inline routing.json. */
+const setPhase = (phase: string, extra: Rec) => (file: Rec) => {
+  const phases = file.phases as Record<string, Rec>
+  phases[phase] = { ...phases[phase], ...extra }
+}
+
+for (const [form, front, desc] of [
+  ['plain', 'description: Builds a thing. Then more words.', 'Builds a thing'],
+  ['literal block', 'description: |\n  Line one\n  runs on. Second.',
+    'Line one runs on'],
+  ['folded block', 'description: >-\n  Folded one\n  two. Next.',
+    'Folded one two'],
+  ['single-quoted', "description: 'It''s here. More.'", "It's here"],
+  ['double-quoted', 'description: "Say \\"hi\\" now. More."', 'Say "hi" now'],
+] as const) {
+  test(`text: a ${form} SKILL.md description leads the skill question`, async (
+    $, on) => {
+    const w = await featWith($, on, skillMd(front))
+    expect(w.asked[0]?.text).toBe(`First route for /feat — ${desc}. ${ROUTED}`)
+  })
+}
+
+test('text: a skill without a SKILL.md is named alone', async ($, on) => {
+  const w = await featWith($, on, undefined)
+  expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+})
+
+test('text: a name outside the allowlist reads no file', async ($, on) => {
+  const w = asks(['Later'], {
+    edit: f => { (f.skills as Rec)['../x'] = 'reflect' },
+  })
+  const md = skillMd('description: Escaped. Bad.')
+  w.files.set(`${HOME}/.claude/skills/../x/SKILL.md`, md)
+  w.files.set(`${HOME}/.claude/x/SKILL.md`, md) // the folded spelling
+  await bootRun($, on, FABLE, w)
+  await typed($, 'hello')
+  await skillPrompt($, '../x')
+  expect(w.asked[0]?.text).toBe(`First route for /../x. ${ROUTED}`)
+  expect(w.reads.filter(p => p.includes('SKILL.md'))).toEqual([])
+})
+
+test('text: a SKILL.md that is not a regular file is not read', async (
+  $, on) => {
+  const w = asks(['Later'])
+  w.files.set(skillPath('feat'), skillMd('description: Hidden. No.'))
+  w.kinds.set(skillPath('feat'), 'dir')
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+  expect(w.reads).not.toContain(skillPath('feat'))
+})
+
+test('text: a SKILL.md over the size cap is named alone', async ($, on) => {
+  const big = skillMd('description: Too big. No.', 'x'.repeat(70000))
+  const w = await featWith($, on, big)
+  expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+})
+
+test('text: HOME unset names the skill alone, reads nothing', async (
+  $, on) => {
+  const w = asks(['Later'], { noHome: true })
+  w.files.set(skillPath('feat'), skillMd('description: Hidden. No.'))
+  // served where an unguarded `${undefined}/.claude/...` would land
+  for (const root of ['undefined', '']) {
+    w.files.set(`${root}/.claude/skills/feat/SKILL.md`,
+      skillMd('description: Unguarded. No.'))
+  }
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+  expect(w.reads.filter(p => p.includes('SKILL.md'))).toEqual([])
+})
+
+test('text: an empty HOME never reads from the root', async ($, on) => {
+  const w = asks(['Later'])
+  w.env = ''
+  w.files.set('/.claude/skills/feat/SKILL.md',
+    skillMd('description: Hidden. No.'))
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+  expect(w.reads.filter(p => p.includes('SKILL.md'))).toEqual([])
+})
+
+test('text: a long description with control chars is cut and cleaned', async (
+  $, on) => {
+  const raw = 'word \u0007‮
'.repeat(100)
+  const w = await featWith($, on, skillMd(`description: ${raw}`))
+  const text = w.asked[0]?.text ?? ''
+  const desc = text.slice(text.indexOf(' — ') + 3, text.indexOf('. Routed'))
+  expect([...desc]).toHaveLength(140)
+  expect(desc.endsWith('…')).toBe(true)
+  expect(text).not.toMatch(/[\p{Cc}\p{Cf}]/u)
+})
+
+test('text: an agent question carries the offered description', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await offerOf($, 'feater', 'userSettings', 'Writes the code.\nMore text.')
+  await $.agent.spawn(spawnOf('feater'))
+  expect(w.asked[0]?.text).toBe('First dispatch of feater — Writes the code. ' +
+    'Routed to implement: claude-sonnet-5-5 at medium. OK?')
+})
+
+test('text: an agent description is cleaned like a skill one', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await offerOf($, 'feater', 'userSettings', 'a‮b\u0007c'.repeat(100))
+  await $.agent.spawn(spawnOf('feater'))
+  const text = w.asked[0]?.text ?? ''
+  expect(text).not.toMatch(/[\p{Cc}\p{Cf}]/u)
+  expect(text.indexOf('. Routed') - text.indexOf(' — ') - 3).toBe(140)
+})
+
+test('text: the phase about shows in the skill question', async ($, on) => {
+  const w = await featWith($, on, undefined,
+    { edit: setPhase('reflect', { about: 'deep thinking' }) })
+  expect(w.asked[0]?.text).toBe('First route for /feat. Routed to reflect ' +
+    '(deep thinking): claude-fable-5-1 at high. OK?')
+})
+
+test('text: the about is cleaned before it enters a question', async (
+  $, on) => {
+  const w = await featWith($, on, undefined,
+    { edit: setPhase('reflect', { about: 'a‮b\nc' }) })
+  expect(w.asked[0]?.text).toContain('Routed to reflect (ab c):')
+})
+
+test('text: an astral description is cut by code point, not unit', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await offerOf($, 'feater', 'userSettings', '\u{1F600}'.repeat(200))
+  await $.agent.spawn(spawnOf('feater'))
+  const text = w.asked[0]?.text ?? ''
+  const desc = text.slice(text.indexOf(' — ') + 3, text.indexOf('. Routed'))
+  expect([...desc]).toHaveLength(140)
+  expect(desc.endsWith('…')).toBe(true)
+  expect(desc.isWellFormed()).toBe(true)
+})
+
+test('text: an agent question carries the phase about', async ($, on) => {
+  const w = asks(['Later'], {
+    edit: setPhase('implement', { about: 'writing code' }),
+  })
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  expect(w.asked[0]?.text).toContain('Routed to implement (writing code):')
+})
+
+test('change: the effort question lists four labels at most', async (
+  $, on) => {
+  const w = asks(['Change', 'sonnet (work)', 'Later'], {
+    edit: f => {
+      (f.phases as Rec).deep = { tier: 'work', effort: 'max' }
+    },
+  })
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  const q = w.asked.find(a => a.text.startsWith('Which effort'))
+  expect(q?.options).toEqual(['low', 'medium', 'high', 'xhigh'])
+})
+
+for (const [what, about] of [
+  ['an overlong', 'x'.repeat(121)],
+  ['a non-string', 5],
+] as const) {
+  test(`about: ${what} value is dropped and logged`, async ($, on) => {
+    const logs = recordLogs(on)
+    const w = await featWith($, on, undefined,
+      { edit: setPhase('reflect', { about }) })
+    expect(w.asked[0]?.text).toBe(`First route for /feat. ${ROUTED}`)
+    expect(logs.join('\n')).toContain('phases.reflect.about ignored')
+  })
+}
+
+test('text: a phase question names its about and its consumers', async (
+  $, on) => {
+  const w = asks(['Later'], {
+    edit: setPhase('orchestrate', { about: 'dispatch work' }),
+  })
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.asked[0]?.text).toBe('First use of orchestrate on the main loop — ' +
+    'dispatch work; used by 0 rows, the derived route of dispatches: ' +
+    'claude-fable-5-1 at medium. OK?')
+})
+
+test('text: a phase question counts rows and prompt rules', async ($, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'reflect' })
+  expect(w.asked[0]?.text).toBe('First use of reflect on the main loop — ' +
+    'used by 1 row, 1 prompt rule: claude-fable-5-1 at high. OK?')
+})
+
+test('text: a phase question names its floor rule', async ($, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'escalate' })
+  expect(w.asked[0]?.text).toBe('First use of escalate on the main loop — ' +
+    'used by 0 rows, 1 floor rule: claude-fable-5-1 at max. OK?')
+})
+
+test('T3: a Change answer changes nothing and is said', async ($, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Change'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.asked).toHaveLength(1)
+  expect(w.written).toEqual([])
+  expect(toasts).toContain('answer not recognised, default kept')
+})
+
+test('change: the model question offers the four tiered aliases', async (
+  $, on) => {
+  const w = asks(['Change', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(w.asked[1]?.text).toBe('Which model for feat?')
+  expect(w.asked[1]?.options).toEqual([
+    'fable (best)', 'opus (big)', 'sonnet (work)', 'haiku (cheap)',
+  ])
+})
+
+for (const [label, alias, efforts] of [
+  ['fable (best)', 'fable', ['medium', 'high', 'xhigh', 'max']],
+  ['sonnet (work)', 'sonnet', ['low', 'medium', 'high', 'xhigh']],
+] as const) {
+  test(`change: ${alias} offers the efforts of its phases, ascending`, async (
+    $, on) => {
+    const w = asks(['Change', label, 'Later'])
+    await bootRun($, on, FABLE, w)
+    await typeFeat($)
+    expect(w.asked[2]?.text).toBe(`Which effort on ${alias}?`)
+    expect(w.asked[2]?.options).toEqual(efforts)
+  })
+}
+
+for (const [label, phase] of [
+  ['opus (big)', 'judge'],
+  ['haiku (cheap)', 'mechanical'],
+] as const) {
+  test(`change: ${label} has one effort, the question is skipped`, async (
+    $, on) => {
+    const w = asks(['Change', label, 'Later'])
+    await bootRun($, on, FABLE, w)
+    await typeFeat($)
+    expect(w.asked).toHaveLength(3)
+    expect(w.asked[2]?.text).toContain(`Use ${phase} for feat`)
+    expect(w.asked[2]?.options).toEqual(['Everywhere', 'This project only'])
+  })
+}
+
+test('change: an alias no phase uses is a Later and says so', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Change', 'haiku (cheap)'], {
+    home: { phases: { mechanical: { tier: 'work', effort: 'low' } } },
+  })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(toasts).toContain('no phase uses haiku')
+  expect(w.asked).toHaveLength(2)
+  expect(w.written).toEqual([])
+})
+
+test('change: a dismissed model question is a silent Later', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Change', REJECT])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(toasts).toEqual([])
+  expect(w.written).toEqual([])
+})
+
+for (const [step, answers] of [
+  ['the first', ['whatever']],
+  ['the model', ['Change', 'mistral']],
+  ['the effort', ['Change', 'sonnet (work)', 'ludicrous']],
+] as const) {
+  test(`change: another answer at ${step} question is a Later, said`, async (
+    $, on) => {
+    const toasts = recordToasts(on)
+    const w = asks([...answers])
+    await bootRun($, on, FABLE, w)
+    await typeFeat($)
+    expect(toasts).toContain('answer not recognised, default kept')
+    expect(w.asked).toHaveLength(answers.length)
+    expect(w.written).toEqual([])
+    expect(toasts.join('\n')).not.toContain('mistral')
+  })
+}
+
+test('change: a Keep on a main row says nothing about a new route', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  await bootRun($, on, FABLE, asks(['Keep']))
+  await typeFeat($)
+  expect(toasts.join('\n')).not.toContain('now runs')
+})
+
+test('change: a downgrade names the real route and the switch', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  const w = asks([...TO_IMPLEMENT, 'Everywhere'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect((routingOf(w).skills as Rec).feat).toBe('implement')
+  expect(toasts).toContain('/feat now runs claude-fable-5-1 at medium, ' +
+    'main moves up only: /route switch on allows a downgrade')
+})
+
+test('change: with the switch on the toast carries no hint', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  await bootRun($, on, FABLE, asks([...TO_IMPLEMENT, 'Everywhere']))
+  await route($, 'switch on')
+  await typeFeat($)
+  expect(toasts).toContain('/feat now runs claude-sonnet-5-5 at medium')
+})
+
+test('change: an upgrade toast carries no hint', async ($, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Change', 'fable (best)', 'xhigh', 'Everywhere'])
+  await bootRun($, on, SONNET, w)
+  await typeFeat($)
+  expect(toasts).toContain('/feat now runs claude-fable-5-1 at xhigh')
+})
+
+test('change: an upgrade the config holds back carries no hint', async (
+  $, on) => {
+  const toasts = recordToasts(on)
+  const w = asks(['Change', 'fable (best)', 'xhigh', 'Everywhere'],
+    { home: { mainUpgrade: false } })
+  await bootRun($, on, SONNET, w)
+  await typeFeat($)
+  expect(toasts).toContain('/feat now runs claude-sonnet-5-5 at xhigh')
+})
+
+test('change: a project scope stores the derived phase, keeps the row', async (
+  $, on) => {
+  const w = asks([...TO_APPLY, 'This project only'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const file = routingOf(w)
+  expect((file.skills as Rec).feat).toBe('reflect')
+  expect(file.projects).toEqual({ [KEY]: { skills: { feat: 'apply' } } })
+})
+
+test('change: a security auditor moves to opus at xhigh, at once', async (
+  $, on) => {
+  const w = asks([...TO_JUDGE, 'Everywhere'], {
+    edit: f => { (f.agents as Rec)['security-auditor'] = 'verify' },
+  })
+  const rig = await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('security-auditor'))
+  expect(w.asked[0]?.text).toContain('claude-sonnet-5-5 at xhigh')
+  expect(rig.specs).toEqual([OPUS])
+  expect((routingOf(w).agents as Rec)['security-auditor']).toBe('judge')
+  await runStep($, { ...highStep('a1'), model: OPUS })
+  expect(rig.seen[rig.seen.length - 1]?.effort).toBe('xhigh')
+})
+
+test('change: an agent picks sonnet then high, the write phase', async (
+  $, on) => {
+  const w = asks(['Change', 'sonnet (work)', 'high', 'Everywhere'])
+  const rig = await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('feater'))
+  expect((routingOf(w).agents as Rec).feater).toBe('write')
+  expect(rig.specs).toEqual([SONNET])
+})
+
+test('change: the current phase wins a tie, and counts as a Keep', async (
+  $, on) => {
+  const w = asks(['Change', 'sonnet (work)', 'medium'])
+  await bootRun($, on, FABLE, w)
+  await $.agent.spawn(spawnOf('Explore'))
+  expect(w.asked).toHaveLength(3)
+  expect(routingOf(w).changed).toEqual({})
+  expect(confirmedOf(w).agents).toEqual({ Explore: 'explore' })
+})
diff --git a/mods/model-router/hooks/register.ts b/mods/model-router/hooks/register.ts
index 732dbda..2092106 100644
--- a/mods/model-router/hooks/register.ts
+++ b/mods/model-router/hooks/register.ts
@@ -62,6 +62,7 @@ type State = {
   pendingAllowed: boolean // same, for the mid-turn prompt
   spawning: number // agent.spawn hooks in flight (preloads fire inside)
   offers: Map<string, string> // subagentType -> definition source
+  descs: Map<string, string> // subagentType -> cleaned one-sentence offer line
   loops: Map<string, Loop> // agentId -> that loop's routing
   explicitEffort: Map<string, Level> // Agent tool_use_id -> effort param
   skillCalls: number // Skill tool calls in flight
@@ -111,6 +112,7 @@ type Memory = {
   askLocal: boolean | undefined // the machine override's own `ask`
   base: Record<Row, Table> // the file's rows, before any project layer
   confirmed: Record<Kind, Table> // name -> the phase a Keep endorsed
+  about: Table // phase -> its one-line meaning, shown in the dialog only
   local: Record<Row, Set<string>> // rows of projects[key] or the override
   key: string | undefined // normalized repo key; undefined = no project layer
 }
@@ -137,16 +139,17 @@ const ROUTING = 'routing.json' // next to plugin.json: the tracked source
 const ROUTING_ORDER: readonly string[] = [
   'phases', 'skills', 'agents', 'projects', 'confirmed', 'changed', 'ask',
 ]
-// First-use dialog: answers, and the phases offered as alternatives.
+// First-use dialog: the answers, and what a question may carry of the outside.
 const LATER = 'Later'
 const KEEP = 'Keep'
+const CHANGE = 'Change'
 const EVERYWHERE = 'Everywhere'
 const THIS_PROJECT = 'This project only'
-const ALTS: Record<Kind, readonly string[]> = {
-  skills: ['plan', 'reflect', 'implement', 'apply'],
-  agents: ['judge', 'implement', 'verify', 'apply'],
-  phases: [],
-}
+const CHOICE_ALIASES: readonly string[] = ['fable', 'opus', 'sonnet', 'haiku']
+const MAX_DESC = 140 // chars of a skill or agent description in a question
+const MAX_ABOUT = 120 // chars of a phase `about`
+const MAX_DESCS = 256 // agent descriptions kept (oldest dropped)
+const SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/
 const ROWS: readonly Row[] = ['skills', 'agents']
 const KINDS: readonly Kind[] = ['skills', 'agents', 'phases']
 const HAIKU = 'claude-haiku'
@@ -580,16 +583,34 @@ function emptyMemory(): Memory {
     askLocal: undefined,
     base: { skills: {}, agents: {} },
     confirmed: { skills: {}, agents: {}, phases: {} },
+    about: {},
     local: { skills: new Set(), agents: new Set() },
     key: undefined,
   }
 }
 
+/** The phases' `about` lines; a non-string or overlong one is dropped, said. */
+function aboutOf(phases: unknown, log: Log): Table {
+  const out: Table = {}
+  if (!isRecord(phases)) return out
+  for (const [name, phase] of Object.entries(phases)) {
+    const about = isRecord(phase) ? phase.about : undefined
+    if (about === undefined || name === '__proto__') continue
+    if (typeof about === 'string' && about.length <= MAX_ABOUT) {
+      out[name] = about
+    } else {
+      log(`model-router: ${ROUTING} phases.${name}.about ignored`)
+    }
+  }
+  return out
+}
+
 /** What the file and the machine override say about decisions. */
 function buildMemory(
   file: Rec,
   key: string | undefined,
   override: Rec | undefined,
+  log: Log,
 ): Memory {
   const project = projectRows(file, key)
   const flag = override?.ask
@@ -608,6 +629,7 @@ function buildMemory(
       agents: strTable(sure.agents),
       phases: strTable(sure.phases),
     },
+    about: aboutOf(file.phases, log),
     local: { skills: local('skills'), agents: local('agents') },
     key,
   }
@@ -732,7 +754,7 @@ async function assemble(
     fileData && routingTables(fileData, key), override, log)
   const mem = fileData === undefined
     ? emptyMemory()
-    : buildMemory(fileData, key, override)
+    : buildMemory(fileData, key, override, log)
   return { cfg, source: sourceWord(file, over), mem, override }
 }
 
@@ -782,6 +804,7 @@ function newState(cfg: Config, source: string): State {
     pendingAllowed: false,
     spawning: 0,
     offers: new Map(),
+    descs: new Map(),
     loops: new Map(),
     explicitEffort: new Map(),
     skillCalls: 0,
@@ -823,6 +846,7 @@ function resetSession(st: State): void {
     agentModels: st.agentModels,
     sessionModel: st.sessionModel,
     offers: st.offers,
+    descs: st.descs,
     mem: st.mem,
     override: st.override,
     loaded: st.loaded,
@@ -1531,7 +1555,8 @@ const wantsAsk = (st: State, req: Req): boolean =>
 async function refreshMemory($: Api, st: State): Promise<boolean> {
   const file = await readRouting($, text => $.ui.log(text))
   if (typeof file === 'string') return false
-  st.mem = buildMemory(file.data, await projectKey($), st.override)
+  st.mem = buildMemory(
+    file.data, await projectKey($), st.override, () => undefined)
   return true
 }
 
@@ -1547,26 +1572,217 @@ async function askOr(
   }
 }
 
-function optionsFor(st: State, req: Req): string[] {
-  const alts = ALTS[req.kind]
-    .filter(p => p !== req.phase && hasKey(st.cfg.phases, p))
-  return req.kind === 'phases'
-    ? [LATER, KEEP]
-    : [LATER, KEEP, ...alts.slice(0, 2)]
+// What a question says about its row. Everything read from outside (a
+// SKILL.md, an agent's listing line, routing.json) is cleaned and capped.
+
+/**
+ * Text safe in a question: every whitespace folded to a space, then control
+ * and format characters (bidi included) stripped, cut to `n` code points
+ * with an ellipsis (total <= n).
+ */
+function clean(text: string, n: number): string {
+  const flat = text.replace(/[\s\p{Z}]+/gu, ' ')
+    .replace(/[\p{Cc}\p{Cf}]/gu, '').replace(/ {2,}/g, ' ').trim()
+  const points = [...flat]
+  return points.length <= n ? flat : `${points.slice(0, n - 1).join('')}…`
 }
 
-/** Keep, a phase of the table (an alt or free text), else Later. */
-function decide($: Api, st: State, req: Req, answer: string): Answer {
-  if (answer === KEEP) return { act: 'keep' }
-  if (answer === LATER || req.kind === 'phases') return { act: 'later' }
-  if (!hasKey(st.cfg.phases, answer)) {
-    const shown = answer.slice(0, 40).replace(/[\u0000-\u001f]/g, ' ')
-    $.ui.toast(`unknown phase "${shown}", default kept`)
-    return { act: 'later' }
+/** The first sentence of a description, cleaned; undefined when empty. */
+function oneSentence(text: string): string | undefined {
+  const end = /\.(?:\s|$)/.exec(text)
+  const line = clean(end ? text.slice(0, end.index) : text, MAX_DESC)
+  return line === '' ? undefined : line
+}
+
+const FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/
+const BLOCK_HEAD = /^[|>][+-]?\d*$/
+
+/** A YAML scalar without its quotes: `''` and JSON escapes resolved. */
+function unquote(value: string): string {
+  const quote = value[0]
+  if (value.length < 2 || value[value.length - 1] !== quote) return value
+  if (quote === "'") return value.slice(1, -1).replace(/''/g, "'")
+  if (quote !== '"') return value
+  try {
+    const parsed: unknown = JSON.parse(value)
+    return typeof parsed === 'string' ? parsed : value.slice(1, -1)
+  } catch {
+    return value.slice(1, -1)
   }
-  return answer === req.phase
-    ? { act: 'keep' }
-    : { act: 'change', phase: answer }
+}
+
+/** `description:` of a SKILL.md frontmatter: plain, block or quoted. */
+function frontDescription(text: string): string | undefined {
+  const front = FRONTMATTER.exec(text)?.[1]
+  const lines = front === undefined ? [] : front.split(/\r?\n/)
+  const at = lines.findIndex(line => line.startsWith('description:'))
+  if (at < 0) return undefined
+  const head = (lines[at] ?? '').slice('description:'.length).trim()
+  const body: string[] = []
+  for (const line of lines.slice(at + 1)) {
+    if (line.trim() !== '' && !/^\s/.test(line)) break
+    body.push(line.trim())
+  }
+  const first = BLOCK_HEAD.test(head) ? '' : head
+  return unquote([first, ...body].filter(w => w !== '').join(' '))
+}
+
+/**
+ * A skill's description from ${HOME}/.claude/skills/<name>/SKILL.md: a
+ * regular file under the size cap, a name from the allowlist. Any failure
+ * gives undefined: the question names the skill alone.
+ */
+async function skillDesc($: Api, name: string): Promise<string | undefined> {
+  if (!SKILL_NAME.test(name)) return undefined
+  try {
+    const home = await $.env.get('HOME')
+    if (!home) return undefined
+    const path = `${home}/.claude/skills/${name}/SKILL.md`
+    if ((await $.fs.stat(path)).kind !== 'file') return undefined
+    const text = await readCapped($, path, 'SKILL.md', () => undefined)
+    const raw = text === undefined ? undefined : frontDescription(text)
+    return raw === undefined ? undefined : oneSentence(raw)
+  } catch {
+    return undefined
+  }
+}
+
+/** The agent listing line, cleaned once at offer time; oldest dropped. */
+function rememberOffer(
+  st: State,
+  e: { agent: string; source: string; description: string },
+): void {
+  st.offers.set(e.agent, e.source)
+  const given: unknown = e.description
+  const line = typeof given === 'string'
+    ? oneSentence(given.slice(0, 4096))
+    : undefined
+  st.descs.delete(e.agent)
+  if (line !== undefined) st.descs.set(e.agent, line)
+  if (st.descs.size <= MAX_DESCS) return
+  const oldest = st.descs.keys().next().value
+  if (oldest !== undefined) st.descs.delete(oldest)
+}
+
+const plural = (n: number, word: string): string =>
+  `${n} ${word}${n === 1 ? '' : 's'}`
+
+const withDesc = (lead: string, desc: string | undefined): string =>
+  desc === undefined ? lead : `${lead} — ${desc}`
+
+function aboutLine(st: State, phase: string): string | undefined {
+  const raw = own(st.mem.about, phase)
+  const line = raw === undefined ? '' : clean(raw, MAX_ABOUT)
+  return line === '' ? undefined : line
+}
+
+/** "Routed to <phase> (<about>)": the parenthesis only when about is set. */
+function routedTo(st: State, phase: string): string {
+  const about = aboutLine(st, phase)
+  return `Routed to ${phase}${about === undefined ? '' : ` (${about})`}`
+}
+
+/** Who uses a phase: its rows, the derived dispatch route, prompt rules. */
+function consumers(st: State, phase: string): string {
+  const { skills, agents, prompt } = st.cfg
+  const rows = [...Object.values(skills), ...Object.values(agents)]
+    .filter(p => p === phase).length
+  const rules = prompt.filter(r => r.phase === phase)
+  const floors = rules.filter(r => r.mode !== 'default').length
+  const parts = [plural(rows, 'row')]
+  if (phase === 'orchestrate') parts.push('the derived route of dispatches')
+  if (rules.length > floors) {
+    parts.push(plural(rules.length - floors, 'prompt rule'))
+  }
+  if (floors > 0) parts.push(plural(floors, 'floor rule'))
+  return `used by ${parts.join(', ')}`
+}
+
+// ---- the dialog's steps: ASK1 Later/Keep/Change, then model, effort, scope
+
+const optionsFor = (req: Req): string[] =>
+  isRowReq(req) ? [LATER, KEEP, CHANGE] : [LATER, KEEP]
+
+/**
+ * One step: the chosen label, or undefined (a Later). A dismissed or
+ * headless dialog is silent; any other answer is toasted, never echoed.
+ */
+async function askStep(
+  $: Api,
+  text: string,
+  labels: readonly string[],
+): Promise<string | undefined> {
+  const answer = await askOr($, text, labels)
+  if (answer === LATER) return undefined
+  if (labels.includes(answer)) return answer
+  $.ui.toast('answer not recognised, default kept')
+  return undefined
+}
+
+/** The alias a phase's route leads with: its tier's head, or its model. */
+function headAlias(cfg: Config, route: Route): string | undefined {
+  if (route.tier !== undefined) {
+    const list = hasKey(cfg.tiers, route.tier) ? cfg.tiers[route.tier] : []
+    return list?.[0]
+  }
+  if (route.model === undefined) return undefined
+  return hasKey(cfg.models, route.model)
+    ? route.model
+    : aliasOf(cfg, canonical(cfg, route.model))
+}
+
+/** "fable (best)": the alias and the tier it heads ("custom" if none). */
+function modelLabel(cfg: Config, alias: string): string {
+  const tier = Object.keys(cfg.tiers).find(t => cfg.tiers[t]?.[0] === alias)
+  return `${alias} (${tier ?? 'custom'})`
+}
+
+async function askModel($: Api, st: State, req: RowReq) {
+  const labels = CHOICE_ALIASES.map(a => modelLabel(st.cfg, a))
+  const label = await askStep($, `Which model for ${req.name}?`, labels)
+  return label === undefined ? undefined : CHOICE_ALIASES[labels.indexOf(label)]
+}
+
+/** The efforts of the phases headed by `alias`, ascending, four at most. */
+function effortsOf(cfg: Config, alias: string): Level[] {
+  const found = Object.values(cfg.phases)
+    .filter(r => headAlias(cfg, r) === alias).map(r => r.effort)
+  return LEVELS.filter(level => found.includes(level)).slice(0, 4)
+}
+
+/** One effort is no question; none is a Later, said. */
+async function askEffort($: Api, st: State, alias: string) {
+  const efforts = effortsOf(st.cfg, alias)
+  if (efforts.length === 0) $.ui.toast(`no phase uses ${alias}`)
+  if (efforts.length < 2) return efforts[0]
+  const label = await askStep($, `Which effort on ${alias}?`, efforts)
+  return efforts.find(effort => effort === label)
+}
+
+/** The row's current phase when it matches, else the first that does. */
+function targetPhase(cfg: Config, now: string, alias: string, effort: Level) {
+  const fits = (name: string): boolean => {
+    const route = phaseRoute(cfg, name)
+    return route?.effort === effort && headAlias(cfg, route) === alias
+  }
+  return fits(now) ? now : Object.keys(cfg.phases).find(fits)
+}
+
+/** Change: model, then effort, mapped to a phase of the table. */
+async function changeRoute($: Api, st: State, req: RowReq): Promise<Answer> {
+  const alias = await askModel($, st, req)
+  const effort = alias === undefined ? undefined : await askEffort($, st, alias)
+  if (alias === undefined || effort === undefined) return { act: 'later' }
+  const phase = targetPhase(st.cfg, req.phase, alias, effort)
+  if (phase === undefined) return { act: 'later' }
+  return phase === req.phase ? { act: 'keep' } : { act: 'change', phase }
+}
+
+async function decide($: Api, st: State, req: Req, text: string) {
+  const choice = await askStep($, text, optionsFor(req))
+  if (choice === KEEP) return { act: 'keep' } as const
+  if (choice === CHANGE && isRowReq(req)) return changeRoute($, st, req)
+  return { act: 'later' } as const
 }
 
 async function askScope(
@@ -1577,10 +1793,10 @@ async function askScope(
 ): Promise<Scope> {
   const key = st.mem.key
   const text = `Use ${to} for ${req.name} everywhere, or only in this project?`
-  const answer = await askOr($, text,
+  const choice = await askStep($, text,
     [EVERYWHERE, key === undefined ? LATER : THIS_PROJECT])
-  if (answer === EVERYWHERE) return 'everywhere'
-  return answer === THIS_PROJECT && key !== undefined ? 'project' : 'later'
+  if (choice === EVERYWHERE) return 'everywhere'
+  return choice === THIS_PROJECT && key !== undefined ? 'project' : 'later'
 }
 
 function table(parent: Rec, key: string): Rec {
@@ -1679,9 +1895,8 @@ async function saveAnswer($: Api, st: State, req: Req, ans: Answer) {
 
 /** The dialog and what follows; true when routing.json was rewritten. */
 async function runDialog($: Api, st: State, req: Req, text: string) {
-  const answer = await askOr($, text, optionsFor(st, req))
   st.asked.add(keyOf(req))
-  return saveAnswer($, st, req, decide($, st, req, answer))
+  return saveAnswer($, st, req, await decide($, st, req, text))
 }
 
 function failOnce($: Api, st: State, err: unknown): void {
@@ -1722,8 +1937,7 @@ async function confirmFirst(
 /** First-use question text: the id and level the next step really gets. */
 async function mainQuestion($: Api, st: State, lead: string) {
   const v = await snapshot($, st)
-  return `${lead} ${idWord(st, v.call.model)} at ${
-    effortWord(st, v)}. Keep it?`
+  return `${lead}: ${idWord(st, v.call.model)} at ${effortWord(st, v)}. OK?`
 }
 
 function spawnQuestion(
@@ -1735,21 +1949,44 @@ function spawnQuestion(
 ): string {
   const id = spawnTarget($, st, e, route) ?? 'its own model'
   const effort = st.explicitEffort.get(e.tool_use_id) ?? route.effort
-  return `First dispatch of ${req.name}: ${req.phase}, ${id} at ${
-    effort ?? 'its own effort'}. Keep it?`
+  const lead = withDesc(`First dispatch of ${req.name}`,
+    st.descs.get(req.name))
+  return `${lead}. ${routedTo(st, req.phase)}: ${id} at ${
+    effort ?? 'its own effort'}. OK?`
+}
+
+async function skillQuestion($: Api, st: State, skill: string, phase: string) {
+  const head = withDesc(`First route for /${skill}`, await skillDesc($, skill))
+  return mainQuestion($, st, `${head}. ${routedTo(st, phase)}`)
+}
+
+/** A downgrade the switch holds back: main keeps its model, said. */
+function downgradeHeld(st: State, v: Verdict, cur: string): boolean {
+  return v.wanted !== undefined && v.call.why === 'switch off' &&
+    !ranksAbove(st, v.wanted, canonical(st.cfg, cur))
+}
+
+/** After a Change: what main will really run, and the switch hint. */
+async function toastChange($: Api, st: State, skill: string) {
+  const cur = st.turnModel ?? st.sessionModel
+  const v = await decideFor($, st, cur)
+  const hint = downgradeHeld(st, v, cur)
+    ? ', main moves up only: /route switch on allows a downgrade'
+    : ''
+  $.ui.toast(`/${skill} now runs ${idWord(st, v.call.model)} at ${
+    effortWord(st, v)}${hint}`)
 }
 
 /** Typed skill: a changed row re-routes the turn at once. */
 async function confirmSkill($: Api, st: State, skill: string, row: Picked) {
   const req: Req = { kind: 'skills', name: skill, phase: row.phase }
-  const lead = `First route for /${skill}: ${row.phase}, next step`
-  if (!(await confirmFirst($, st, req, () => mainQuestion($, st, lead)))) {
-    return
-  }
+  const say = () => skillQuestion($, st, skill, row.phase)
+  if (!(await confirmFirst($, st, req, say))) return
   const after = skillRow(st, skill)
   if (after === undefined) return
   routeMainBySkill(st, after, true)
   refresh($, st)
+  if (after.phase !== row.phase) await toastChange($, st, skill)
 }
 
 /** Rowed spawn: the route in force after the dialog (changed or not). */
@@ -1771,7 +2008,9 @@ async function routeSpawn($: Api, st: State, e: SpawnIn) {
 /** A phase declared through the route tool: confirm-only. */
 async function confirmPhase($: Api, st: State, phase: string) {
   const req: Req = { kind: 'phases', name: phase, phase }
-  const lead = `First use of ${phase} on the main loop:`
+  const meaning = [aboutLine(st, phase), consumers(st, phase)]
+    .filter(part => part !== undefined).join('; ')
+  const lead = `First use of ${phase} on the main loop — ${meaning}`
   await confirmFirst($, st, req, () => mainQuestion($, st, lead))
 }
 
@@ -2418,7 +2657,7 @@ function afterSpawn(
 
 function registerSpawn(on: On, st: State): void {
   on('agent.offer', async ($, e, next) => {
-    if (!st.off) st.offers.set(e.agent, e.source)
+    if (!st.off) rememberOffer(st, e)
     return next(e)
   }).catch(($, e, next) => {
     warnOnce(st, $, 'agent.offer', next.error.kind)
diff --git a/mods/model-router/routing.json b/mods/model-router/routing.json
index eeb81e2..8760498 100644
--- a/mods/model-router/routing.json
+++ b/mods/model-router/routing.json
@@ -2,47 +2,58 @@
   "phases": {
     "plan": {
       "tier": "best",
-      "effort": "xhigh"
+      "effort": "xhigh",
+      "about": "design and architecture: the deepest thinking, before any code exists"
     },
     "reflect": {
       "tier": "best",
-      "effort": "high"
+      "effort": "high",
+      "about": "analysis, review and synthesis: reasoning about what already exists"
     },
     "orchestrate": {
       "tier": "best",
-      "effort": "medium"
+      "effort": "medium",
+      "about": "dispatching and coordinating sub-agents: mostly handing out work"
     },
     "escalate": {
       "tier": "best",
-      "effort": "max"
+      "effort": "max",
+      "about": "a stuck problem or a judged need: maximum effort, diagnosis only"
     },
     "judge": {
       "tier": "big",
-      "effort": "xhigh"
+      "effort": "xhigh",
+      "about": "independent judgment of work: audits, challenges and verdicts"
     },
     "implement": {
       "tier": "work",
-      "effort": "medium"
+      "effort": "medium",
+      "about": "writing the code of an already planned change"
     },
     "write": {
       "tier": "work",
-      "effort": "high"
+      "effort": "high",
+      "about": "writing prose and docs, or a careful edit that needs polish"
     },
     "verify": {
       "tier": "work",
-      "effort": "xhigh"
+      "effort": "xhigh",
+      "about": "checking a result against its spec: tests, security review, gates"
     },
     "explore": {
       "tier": "work",
-      "effort": "medium"
+      "effort": "medium",
+      "about": "reading and searching the codebase to answer a question"
     },
     "apply": {
       "tier": "work",
-      "effort": "low"
+      "effort": "low",
+      "about": "bookkeeping: commits, memory entries and other small edits"
     },
     "mechanical": {
       "tier": "cheap",
-      "effort": "low"
+      "effort": "low",
+      "about": "scripted or trivial work needing no judgment, on the cheapest model"
     }
   },
   "skills": {
@@ -125,7 +136,7 @@
     "plugin-probe": "apply",
     "validator-analyzer": "apply",
     "verifier": "verify",
-    "security-auditor": "verify",
+    "security-auditor": "judge",
     "status-reporter": "mechanical"
   },
   "projects": {},
@@ -133,12 +144,14 @@
     "agents": {
       "verifier": "verify",
       "feater": "implement",
-      "doc-syncer": "write"
+      "doc-syncer": "write",
+      "security-auditor": "judge"
     },
     "phases": {
       "verify": "verify",
       "implement": "implement",
-      "write": "write"
+      "write": "write",
+      "orchestrate": "orchestrate"
     }
   },
   "changed": {},

From 32b71d25b56468d50986a79ee62b3acbb73be0c5 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 14:11:08 +0200
Subject: [PATCH 06/12] =?UTF-8?q?chore(model-router):=20routing.json=20dec?=
 =?UTF-8?q?ision=20=E2=80=94=20security-auditor=20on=20judge=20(opus/xhigh?=
 =?UTF-8?q?),=20user's=20answer=20to=20the=20new=20first-use=20dialog;=20c?=
 =?UTF-8?q?hanged.from=20restored?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mods/model-router/routing.json | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mods/model-router/routing.json b/mods/model-router/routing.json
index 8760498..4683590 100644
--- a/mods/model-router/routing.json
+++ b/mods/model-router/routing.json
@@ -154,6 +154,13 @@
       "orchestrate": "orchestrate"
     }
   },
-  "changed": {},
+  "changed": {
+    "agents": {
+      "security-auditor": {
+        "from": "verify",
+        "to": "judge"
+      }
+    }
+  },
   "ask": true
 }

From 938c3d1a675b03bed44919e4b99f76a7183c7708 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 14:25:45 +0200
Subject: [PATCH 07/12] chore(agents): security-auditor floor aligned to its
 judge row (model: opus); model-routing lock updated

---
 agents/security-auditor.md      | 2 +-
 lib/tests/model-routing.test.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/agents/security-auditor.md b/agents/security-auditor.md
index 5f1b586..01af0a3 100644
--- a/agents/security-auditor.md
+++ b/agents/security-auditor.md
@@ -2,7 +2,7 @@
 name: security-auditor
 description: 'SAST security gate — runs the pinned semgrep rulesets + the CLAUDE.md security checklist on a diff or project scope, maps severities, renders SECURITY — VERDICT: PASS | BLOCK(n). Blocks HIGH/CRITICAL only, reports the rest. Never fixes code. Fresh dispatch, no iteration history.'
 tools: Read, Grep, Glob, Bash, Write
-model: sonnet
+model: opus
 effort: xhigh
 ---
 
diff --git a/lib/tests/model-routing.test.sh b/lib/tests/model-routing.test.sh
index 740dac5..76d3f19 100755
--- a/lib/tests/model-routing.test.sh
+++ b/lib/tests/model-routing.test.sh
@@ -21,7 +21,7 @@ done
 has "agents/feater.md"          'model: sonnet'
 has "agents/hotfixer.md"        'model: sonnet'
 has "agents/verifier.md"        'model: sonnet'
-has "agents/security-auditor.md" 'model: sonnet'
+has "agents/security-auditor.md" 'model: opus'  # judge row since 2026-10-11 (user first-use decision)
 has "agents/analyzer.md"        'model: opus'
 # 4) /feat executor shape
 has "skills/feat/SKILL.md" 'subagent_type="feater"'

From 70416222b157d036f679c34c8d5ff947b9a1ed5f Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 14:25:53 +0200
Subject: [PATCH 08/12] =?UTF-8?q?docs:=20first-use=20dialog=20with=20conte?=
 =?UTF-8?q?xt=20(README,=20USAGE,=20ARCHITECTURE,=20CHANGELOG),=20security?=
 =?UTF-8?q?-auditor=20on=20opus=20=E2=80=94=20feat=20model-router=20wave?=
 =?UTF-8?q?=203-B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ARCHITECTURE.md | 2 +-
 CHANGELOG.md    | 3 ++-
 README.md       | 7 ++++---
 USAGE.md        | 2 +-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 6fb3821..e3a16d8 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -36,6 +36,6 @@ claude-config/
 
 - `skills/` = entry points you invoke via `/skill-name`
 - `agents/` = execution units called by skills (never invoked directly by user)
-- `mods/` = Claude Code mods (function-hooks plugins); each loads through the tracked symlink `skills/<name>` as `<name>@skills-dir`, live at the next session; `mods/model-router/routing.json` (tracked) holds the phase table, every skill and agent row and the first-use decisions
+- `mods/` = Claude Code mods (function-hooks plugins); each loads through the tracked symlink `skills/<name>` as `<name>@skills-dir`, live at the next session; `mods/model-router/routing.json` (tracked) holds the phase table (tier, effort and the `about` line the first-use dialog shows), every skill and agent row and the first-use decisions
 - `templates/` = symlinked to `~/.claude/templates/` — copy into projects via `/onboard` or manually
 - **Graphify** builds a knowledge graph of any codebase (`/graphify query`), producing a navigable wiki in `graphify-out/wiki/`. This map helps Claude understand project structure, find relevant code faster, and reason across files. Essential for large-scope tasks (multi-file features, complex bugs, architectural changes). Small tasks should skip it and read files directly. Proposed only from 200 tracked code files: the session-start banner informs, the user decides; nothing builds a graph without that go.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6225592..e1151b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,10 +8,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/) and this project
 
 ### Added
 - **model-router mod**: `mods/model-router/`, a Claude Code mod (function-hooks plugin), routes every repo skill and agent from phase rows (`plan`, `reflect`, `orchestrate`, `escalate`, `judge`, `implement`, `write`, `verify`, `explore`, `apply`, `mechanical`; built-ins Explore on sonnet/medium, Plan on opus/xhigh). A typed skill routes the main loop to its row, and a best-tier row holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. Agents get their row's model at spawn (within the tier, upward only) and its effort on every step; explicit Agent params win. Orchestrators declare their phases through the `mcp__model-router__route` tool. `ultrathink` in a prompt sets the turn's minimum effort and `/route effort=max` holds until `/route clear`; the built-in `/effort` is not a lever inside a run. `/route show` names the run slot (`main: run <phase>`), and a `null` row in the override drops a default row. The model gets a `route` tool and the user a `/route` command (`show|clear|off|on|reload|pending|ask on|off|<phase>|model=<alias|id> effort=<level>|switch on|off|verbose on|off`). Optional per-machine config `~/.claude/model-router.json`, where `"enabled": false` turns it off on that machine. The spinner suffix and the status line show the route in force. It loads in every session through the tracked symlink `skills/model-router` (`model-router@skills-dir`). `make doctor` gains a Mods section; suite `make test suite=lib/tests/mods.test.sh`. Known limits: the main loop switches model only with `mainModelSwitch` on (default off, one cold-cache step per switch into another model), and the hooks send full model ids, so the `models` table has to follow new versions.
-- **model-router first-use confirmation**: `mods/model-router/routing.json` (tracked) is the single source of the phase table and of every skill and agent row, and keeps the decisions: `confirmed`, `changed` (`from`/`to`), `projects` exceptions keyed by the origin remote reduced to `host/path` (credentials and local paths never stored), and `ask`. The first use of a rowed typed skill, a rowed agent spawn or a main-loop phase declared through the `route` tool opens a dialog: Later, Keep or another phase, then Everywhere or This project only. One dialog at a time, never in headless (`-p`) runs or inside a sub-agent. Only a dialog answer or `/route ask on|off` writes the file (serialized, 64 KiB cap, never created when absent); each write asks you to commit it from the config repo. `/route pending` lists unconfirmed rows and phases. Layers: routing.json < `~/.claude/model-router.json` (its `ask` wins); a project's `.claude/model-router.json` is never read. Tests: `mods/model-router/hooks/register.test.ts`.
+- **model-router first-use confirmation**: `mods/model-router/routing.json` (tracked) is the single source of the phase table and of every skill and agent row, and keeps the decisions: `confirmed`, `changed` (`from`/`to`), `projects` exceptions keyed by the origin remote reduced to `host/path` (credentials and local paths never stored), and `ask`. The first use of a rowed typed skill, a rowed agent spawn or a main-loop phase declared through the `route` tool opens a dialog with context: the skill's description (first sentence of its `SKILL.md` frontmatter) or the agent's, the phase with its `about` line (a new field on each of the 11 phases) and the model id and effort the next step really runs on. A row offers Later, Keep or Change; a main-loop phase Later or Keep. Change asks the model (fable, opus, sonnet, haiku with their tier), then the effort among those the phases of that model use (skipped when there is only one), then Everywhere or This project only; the pair maps to an existing phase (rows stay phase names, the same phase counts as Keep, a pair no phase offers is added by hand as a new phase). A skill-row change toasts the model and effort it now runs on, with the `/route switch on` hint when the main loop holds back a downgrade; a free-text answer counts as Later. One dialog at a time, never in headless (`-p`) runs or inside a sub-agent. Only a dialog answer or `/route ask on|off` writes the file (serialized, 64 KiB cap, never created when absent); each write asks you to commit it from the config repo. `/route pending` lists unconfirmed rows and phases. Layers: routing.json < `~/.claude/model-router.json` (its `ask` wins); a project's `.claude/model-router.json` is never read. Tests: `mods/model-router/hooks/register.test.ts`.
 - **Manual-push mode**: `git config gitflow.autopush false` (human-set) now stops every push the gitflow lib makes, not only the post-commit / post-merge hooks. `gitflow start` and `finish` branch, commit and merge locally and push nothing; `gitflow delete` leaves the `origin/` copy in place and prints `git push origin --delete <br>` for the user to run. `hooks/unpushed-guard.sh` stays silent at turn end in this mode and opens each session with one `ℹ manual push mode:` line counting the commits no remote holds across every local branch; an unparseable or unreadable `gitflow.autopush` value is treated as manual push mode too, and that line names it. `hooks/push-guard.sh` (PreToolUse, `Bash|Monitor`) refuses any `git push` Claude types while `gitflow.autopush` reads false in the session cwd or in a literal `-C`/`cd` directory the command names (global config counts outside a repo); the refusal tells the user to run it with `! git push`. It reads the mode through the same lib verb as every other reader and fails closed: an unparseable or unreadable value reads as manual, and an internal error, a missing `lib/gitflow.sh`, more than 20 distinct directory tokens in one command (capped before any token is classified), a `cd`/`-C` directory token mixing quoted and unquoted parts, or a payload jq cannot parse whose raw text looks like a push refuse the push (these pathological cases fire in auto mode too). Directory tokens are read as whole shell words, adjacent quoted segments and backslash escapes included. In manual mode it over-blocks any command where a `push` word follows a `git` token; the misses listed in its header fall to a new `autoMode.soft_deny` rule that no request in the turn clears. The session banner adds `🔒 push : manual (autopush=false) — ! git push` when the key reads false, and `🔒 push : manual (autopush bad) — ! git push` when the value is invalid. Skills read the mode through a new lib verb, `bash ~/.claude/lib/gitflow.sh push-mode`: it prints `auto`, `manual` or `invalid` (rc 0) and names an invalid value on stderr (printable characters only, 64 at most). It is the one reader a skill may call, since the `git config` read of the key is denied to Claude. Skills push nothing on their own, except the `/release-candidate` tag in auto-push mode on an explicit go. Every "on origin" or "not pushed" line they print comes from `git rev-list --count origin/<br>..<br>` read after the fact, with the complete `! git …` command when something is left for the user to push. An invalid value (anything but unset, true or false, or a read that fails) is manual push mode for every reader and is named where it is read (see Fixed). Tests: `lib/gitflow-test.sh` T11b (push-mode verb), T18m and T18q blocks, `lib/tests/unpushed-guard.test.sh` T10-T16, `lib/tests/push-guard.test.sh` (98 checks).
 
 ### Changed
+- `security-auditor` runs on the `judge` row (opus/xhigh) by a first-use decision; its frontmatter floor is aligned (`model: opus`).
 - `lib/model-gate.md` calls the model-router `route` tool and takes its answer as the witness; with the mod off the gate stops and names `/route on`. The `model:` / `effort:` frontmatter of agents and skills is now the off-state floor, census-locked equal to the rows (`lib/tests/effort-routing.test.sh`; a row changed through the first-use dialog passes with a `WARN floor drift` line while its frontmatter still holds the shipped value). `analyzer` effort goes from high to xhigh. Built-in judgment dispatches carry an explicit `effort=`.
 - `settings.json` denies every write form of the human-only `gitflow.*` keys (18 entries): any `git … config` spelling, section remove/rename, `git -c`, the git config env overrides, and Edit/Write of `.git/config`, `.gitconfig` and `~/.config/git/config`. Side effect: Claude can no longer read `gitflow.autopush` through `git config` either; hooks and `lib/gitflow.sh` still read it. The `hard_deny` rule on routing around a guardrail now names PreToolUse hook refusals.
 - `gitflow start` and `finish` warn on stderr when a base is behind origin and cannot fast-forward, instead of a silent `git pull --ff-only || true` (T18l, T18n).
diff --git a/README.md b/README.md
index afb7697..3a1a880 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,8 @@ inherits silently: typed agents run on their model-router row, their
 | Agent | Model | Tier |
 |---|---|---|
 | feater, hotfixer, bugfixer | sonnet (pinned) | executors — code from a closed plan (feat), fix from a closed diagnosis (bugfix), fix-bundle appliers |
-| verifier, security-auditor | sonnet (pinned) | fresh gates (≤3×/loop) |
+| verifier | sonnet (pinned) | fresh gate (≤3×/loop) |
+| security-auditor | opus (judge row: opus/xhigh, the user's first-use decision; frontmatter floor aligned) | fresh gate (≤3×/loop) |
 | commit-changer, release-executor, code-cleaner | sonnet (pinned) | dispatched execution — grouping+commit / release spans / approved cleanup (audit + approval gates stay in the dispatcher) |
 | onboarder, scaffolder, refactorer, validator-analyzer, plugin-probe | sonnet (pinned) | workers — config generation, scaffold, refactor, deterministic W3C/WCAG runner, mechanical plugin probe |
 | status-reporter | haiku (pinned) | mechanical collector |
@@ -135,11 +136,11 @@ effort, never version. Transcript audit `python3 lib/effort-audit.py`.
 - Sub-agents: a routed agent gets its row's model at spawn, within its tier and only upward from its frontmatter model, and the row's effort on every step. Explicit `model` / `effort` params on the Agent call win; a project-defined agent of the same name keeps its own definition. Built-ins: Explore runs on sonnet/medium, Plan on opus/xhigh.
 - Levers inside a run: `ultrathink` in a prompt sets the turn's minimum effort; `/route effort=max` holds until `/route clear`. The built-in `/effort` is not a lever inside a run, rows and routes outrank it.
 - `/route` (user command) shows or sets the route: `show`, `clear`, `off`, `on`, `reload`, `pending` (rows and phases not confirmed yet), `ask on|off` (first-use dialog on or off), a phase name, `model=<alias|id> effort=<level>`, `switch on|off`, `verbose on|off`. `/route show` names the run slot when one holds (`main: run <phase>`). The model sets routes through a `route` tool.
-- First use: the first time a rowed skill is typed, a rowed agent is spawned or a phase is declared on the main loop through the `route` tool, the mod asks once whether the route is right. A row offers Later, Keep and two alternative phases (Other takes any phase name); a declared phase offers Later or Keep. Picking another phase then asks Everywhere or This project only. Everywhere moves the row and records the shipped phase under `changed`; This project only stores an exception under `projects`, keyed by the origin remote reduced to `host/path` (no credentials, no local paths; a remote that cannot be read that way offers no project choice). Keep lands under `confirmed`; Later asks again next session. One dialog at a time, never in a headless (`-p`) run, never inside a sub-agent.
+- First use: the first time a rowed skill is typed, a rowed agent is spawned or a phase is declared on the main loop through the `route` tool, the mod asks once whether the route is right. The question gives context: the skill's description (first sentence of its `SKILL.md` frontmatter) or the agent's, the phase with its `about` line, and the model id and effort the next step really runs on; a declared phase also says what uses it (rows, prompt rules). A row offers Later, Keep or Change; a declared phase offers Later or Keep. Change asks the model (fable, opus, sonnet, haiku, each shown with the tier it heads), then the effort among those the phases on that model use (shipped table: fable medium, high, xhigh or max; sonnet low, medium, high or xhigh; opus and haiku have one level each, so no question), then Everywhere or This project only. Rows stay phase names, so the pair maps to an existing phase: the row's current phase wins a tie and the same phase counts as Keep; a pair no phase offers needs a new phase added by hand in routing.json. Everywhere moves the row and records the shipped phase under `changed`; This project only stores an exception under `projects`, keyed by the origin remote reduced to `host/path` (no credentials, no local paths; a remote that cannot be read that way offers no project choice). Keep lands under `confirmed`; Later, a dismissed dialog or a free-text answer asks again next session. After a skill row changes, a toast names the model and effort that skill now runs on, plus the `/route switch on` hint when the main loop holds back a downgrade. One dialog at a time, never in a headless (`-p`) run, never inside a sub-agent.
 - Only a dialog answer or `/route ask on|off` writes `routing.json`, never the model. Writes are serialized, capped at 64 KiB, and refused when the file is missing (it is never created). Each write leaves the config repo dirty; a toast reminds you to commit it from there.
 - The spinner suffix and the status line under the prompt show the route in force.
 
-Config layers: `mods/model-router/routing.json` (tracked: phases, rows, decisions, `ask`), then the optional per-machine `~/.claude/model-router.json`, which wins. A `.claude/model-router.json` inside a project is never read. Machine keys: `models` (alias → full id), `windows` (context window per full id), `tiers` (ordered alias lists per tier: `best` fable>opus>sonnet, `big` opus>fable>sonnet, `work` sonnet>opus, `cheap` haiku>sonnet; the first alias not down is used), `fallback` (the rank order of the aliases, best first, used by the breaker), `cooldownMinutes` (how long a model stays marked down after an availability error, 15 by default, doubling per episode up to 300), `mainUpgrade` (default `true`: the main loop may move up to a phase's tier), `upgradeMaxTokens` (default 200000: no main-loop upgrade above this context size, since an upgrade re-reads the whole context cold), `phases`, `agents`, `skills`, `prompt` (rules), `mainModelSwitch` (default `false`), `verbose` (default `false`), `spinner` (default `true`), `enabled` (default `true`; `false` turns the mod off on that machine), `ask` (overrides routing.json's `ask` on that machine). A `null` value in `agents` or `skills` drops a row. Edit phases and rows by hand in routing.json; without it the mod runs the code's default phases, with no rows and no dialog. `/route reload` re-reads both files.
+Config layers: `mods/model-router/routing.json` (tracked: phases with their tier, effort and `about` line, rows, decisions, `ask`), then the optional per-machine `~/.claude/model-router.json`, which wins. A `.claude/model-router.json` inside a project is never read. Machine keys: `models` (alias → full id), `windows` (context window per full id), `tiers` (ordered alias lists per tier: `best` fable>opus>sonnet, `big` opus>fable>sonnet, `work` sonnet>opus, `cheap` haiku>sonnet; the first alias not down is used), `fallback` (the rank order of the aliases, best first, used by the breaker), `cooldownMinutes` (how long a model stays marked down after an availability error, 15 by default, doubling per episode up to 300), `mainUpgrade` (default `true`: the main loop may move up to a phase's tier), `upgradeMaxTokens` (default 200000: no main-loop upgrade above this context size, since an upgrade re-reads the whole context cold), `phases`, `agents`, `skills`, `prompt` (rules), `mainModelSwitch` (default `false`), `verbose` (default `false`), `spinner` (default `true`), `enabled` (default `true`; `false` turns the mod off on that machine), `ask` (overrides routing.json's `ask` on that machine). A `null` value in `agents` or `skills` drops a row. Edit phases and rows by hand in routing.json (a phase's `about`, 120 characters at most, is read from there only and shown in the dialog; a model and effort pair no phase offers needs a new phase there); without it the mod runs the code's default phases, with no rows and no dialog. `/route reload` re-reads both files.
 
 Limits: the main loop changes model only with `mainModelSwitch` on, and each switch into another model costs one cold-cache step. The hooks send full model ids, so the `models` table has to follow new model versions.
 
diff --git a/USAGE.md b/USAGE.md
index 1e0edc4..ac9fe55 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -187,7 +187,7 @@ l'outil `mcp__model-router__route` (`lib/effort-shift.md`). Les skills
 externes vendorés (pile design, superpowers, agent-skills, skills scroll
 MengTo, 21st) ont aussi leur ligne.
 
-Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). Première utilisation : la première fois qu'un skill avec ligne est tapé, qu'un agent avec ligne est lancé ou qu'une phase est déclarée sur la boucle principale via l'outil `route`, le mod demande une fois si la route convient. Pour une ligne : Later, Keep ou deux phases alternatives (Other accepte un nom de phase) ; pour une phase déclarée : Later ou Keep. Un changement demande ensuite Everywhere ou This project only (exception rangée sous le remote origin du dépôt réduit à `host/path`, jamais d'identifiants). La réponse est écrite dans `routing.json` ; Later redemande à une session suivante. Un seul dialogue à la fois, jamais en headless (`-p`) ni dans un sous-agent, et le modèle n'écrit jamais ce fichier. Chaque réponse laisse le repo de config modifié : commite-le depuis ce repo. `/route pending` liste ce qui reste à confirmer, `/route ask off|on` coupe ou rallume le dialogue.
+Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). Première utilisation : la première fois qu'un skill avec ligne est tapé, qu'un agent avec ligne est lancé ou qu'une phase est déclarée sur la boucle principale via l'outil `route`, le mod demande une fois si la route convient. La question donne le contexte : la description du skill (première phrase du frontmatter de son `SKILL.md`) ou celle de l'agent, la phase avec sa ligne `about` (champ de la phase dans `routing.json`), puis le modèle et le niveau réels de l'étape suivante ; une phase déclarée dit aussi qui l'utilise. Pour une ligne : Later, Keep ou Change ; pour une phase déclarée : Later ou Keep. Change demande le modèle (fable, opus, sonnet, haiku, chacun avec son tier), puis le niveau parmi ceux des phases de ce modèle (fable : medium, high, xhigh ou max ; sonnet : low, medium, high ou xhigh ; opus et haiku n'en ont qu'un, la question est sautée), puis Everywhere ou This project only (exception rangée sous le remote origin du dépôt réduit à `host/path`, jamais d'identifiants). Une ligne reste un nom de phase : le couple modèle et niveau désigne une phase existante, et la même phase qu'avant vaut Keep. Un couple qu'aucune phase n'offre s'ajoute à la main comme nouvelle phase dans `routing.json`. Après un changement sur un skill, un toast donne le modèle et le niveau réels, et rappelle `/route switch on` quand la boucle principale refuse de descendre. La réponse est écrite dans `routing.json` ; Later, un texte libre (Other) ou un dialogue fermé redemande à une session suivante. Un seul dialogue à la fois, jamais en headless (`-p`) ni dans un sous-agent, et le modèle n'écrit jamais ce fichier. Chaque réponse laisse le repo de config modifié : commite-le depuis ce repo. `/route pending` liste ce qui reste à confirmer, `/route ask off|on` coupe ou rallume le dialogue.
 
 La config par machine, optionnelle, vit dans `~/.claude/model-router.json` et passe devant `routing.json` ; `"enabled": false` y coupe le mod sur cette machine, `"ask": false` y coupe le dialogue, une ligne à `null` y retire une ligne. Un `.claude/model-router.json` dans un projet n'est jamais lu. Les phases et les lignes se modifient à la main dans `routing.json` ; `/route reload` relit les deux fichiers.
 

From 563a15444640566139c0f73aa4b6f7e08312136e Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 14:25:53 +0200
Subject: [PATCH 09/12] =?UTF-8?q?chore(memory):=20BDR-116=20amendment=20+?=
 =?UTF-8?q?=20EVAL-044=20+=20journal/TODO/contract=20w3b=20=E2=80=94=20fea?=
 =?UTF-8?q?t=20model-router=20wave=203-B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .claude/memory/decisions.md                   |   1 +
 .claude/memory/evals.md                       |   8 +
 .claude/memory/journal.md                     |   1 +
 .claude/tasks/TODO.md                         |   5 +-
 ...2026-10-11-model-router-w3b-dialog-1240.md |  38 ++++
 .claude/tasks/contracts/w3b-about.sh          |   9 +
 ...2026-10-11-model-router-w3b-dialog-1240.md | 170 ++++++++++++++++++
 7 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 .claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md
 create mode 100755 .claude/tasks/contracts/w3b-about.sh
 create mode 100644 .claude/tasks/plans/2026-10-11-model-router-w3b-dialog-1240.md

diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index a48bde7..1f14a51 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -1411,4 +1411,5 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Alternatives rejected**: `$.store` (machine-local, re-asks per machine); project file in the tree (security hole + writes into worktrees); shared-promise dedupe for parallel spawns (hook budget: awaiters time out); `confirmed` dates (git log dates them); dialog edits of phases (blast radius: a phase is shared by many rows); per-layer degrade after first load (one transient read failure wiped 79 rows + the kill switch); `local:<realpath>` keys (home path in a tracked file).
 - **Gates**: plan r1 → r4 (simplicity CONCERNS(3), correctness FATAL(8) with the census BLOCKER, robustness CONCERNS(8) after a network-killed first run, confirmation CONCERNS(6)); feater DONE + 4 rounds; GATE 0 MET; verifier ECARTS(3)/(2) → CONFORME, re-verify after security ECARTS(1) → fixtures; security BLOCK(1) real (password with `@`/`/` stored in the key) → fixed, PASS. Kit 86 → 190 tests. Live T2 dialogs answered by the user from the hot-loaded working-tree mod ([[LRN-212]]).
 - **Refs**: contract `.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md`, plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md`, commit 22455c0, [[BDR-115]], [[LRN-210]], [[LRN-211]], [[EVAL-043]].
+- **Amendment (2026-10-11, wave 3-B, commit 604a6c4)**: clause (2) superseded: the dialog carries CONTEXT (skill description = first sentence of its SKILL.md frontmatter, five YAML forms, hardened read: name allowlist, stat kind file, size cap, `clean()` Cc/Cf + code points; agent description from `agent.offer`, bounded cache; phase `about` line, new 120-char field on the 11 routing.json phases, kept in memory not on Route) and the REAL next model id + effort. Options Later / Keep / Change (T3 Later / Keep). Change = model (4 fixed alias labels with tier role) → effort among those the phases headed by that alias offer (ascending, ≤ 4, one → skipped, zero → Later) → scope; the pair maps to an existing PHASE (rows stay phase names; row's current phase wins a tie; same phase = Keep); a pair no phase offers = a new phase by hand. Other anywhere = Later + toast (no echo). A main-row change toasts the real decision + `/route switch on` hint on a held downgrade. Three lenses rejected inline-route rows and dialog phase edits (2 BLOCKERs). First real use: user moved security-auditor to `judge` (opus/xhigh) through it; floor aligned (`model: opus`, 2026-10-11). Links [[EVAL-044]].
 
diff --git a/.claude/memory/evals.md b/.claude/memory/evals.md
index 7031b20..1d0222e 100644
--- a/.claude/memory/evals.md
+++ b/.claude/memory/evals.md
@@ -64,6 +64,7 @@ rules:
 | EVAL-041 | 2026-10-09 | model-router W1-C plan: 3 lenses FATAL (4 BLOCKER + 20 MAJOR) then 2 confirmations each FATAL with a NEW BLOCKER in my own revision; executor DONE first pass, 3 short text/hardening rounds | one confirmation is not enough when a revision removes a whole mechanism; the plan carried the risk, the code almost none |
 | EVAL-042 | 2026-10-10 | model-router W2 plan r1 → r4: 3 lenses (1 BLOCKER), 2 confirmations (1 BLOCKER then 0); W2-A verifier 3× ECARTS on coverage clauses only, W2-B ECARTS(7) → CONFORME; gate A→B read from engine records | second confirmation paid again (BLOCKER on my own r2 slot); compound coverage criterion = endless ECARTS; engine jsonl replaces the live log |
 | EVAL-043 | 2026-10-11 | model-router W3-A: 3 lenses + 1 confirmation (census BLOCKER, project-tree layer dropped), feater DONE + 4 rounds, verifier 3× then re-verify after a REAL security BLOCK (credential fragment in the tracked key) | challenge + security gates both earned their cost; coverage-shaped criteria still cost 3 verifier rounds; live mod side effects misread as a test leak |
+| EVAL-044 | 2026-10-11 | model-router W3-B (dialog with context): 3 lenses converged on 2 BLOCKERs of my r1 (inline rows, phase edits) + 1 confirmation; feater DONE + 2 coverage rounds; verifier 3× to CONFORME; security PASS; user's first real decision through the new dialog | the lenses pay most when the plan adds a data shape; coverage criteria still cost rounds; live dialogs during the gates must be announced and their data reconciled before commit |
 
 ---
 
@@ -403,3 +404,10 @@ Dogfood: 3 blind lenses attacked the v1 plan for the plan-challenge feature itse
 - **Anomaly**: the live hot-loaded mod answered-by-user dialogs were first misread as a kit write leak (LRN-212). A GATE 0 CHECK written as a multi-line heredoc is not runnable by gates.sh (one line or a script). Criterion 3 again bundled ~15 clauses: three verifier rounds on coverage, zero code defects from them (LRN-210 not yet applied by me).
 - **Action**: write GATE 0 oracles as scripts from the start; split coverage criteria per clause BEFORE the first verifier; when a mod is under development, announce the live side effects at each dispatch. Links [[EVAL-042]], [[BDR-116]], [[LRN-212]].
 
+## EVAL-044 — model-router W3-B: the lenses killed a second row format before it existed; the live dialog answered the request's own example
+- **Date**: 2026-10-11
+- **Output checked**: plan `.claude/tasks/plans/2026-10-11-model-router-w3b-dialog-1240.md` r1 → r3; diff 604a6c4 (232 kit tests), data commits 32b71d2 (security-auditor → judge) and the floor alignment.
+- **Method**: simplicity CONCERNS(3), robustness FATAL(5), correctness FATAL(8): all three rejected inline `{model, effort}` rows (string tables everywhere, breaker semantics, PHASE_KEY on row names) and dialog edits of phases (census lock, blast radius, BDR-116) → r2 phases-only with efforts derived from the alias's phases; confirmation CONCERNS(2) → r3 (test migration list, read-hardening tests, ordering, clean() order). Feater DONE first pass (229 tests, 26 migrated, 41 new, 9 mutation proofs); verifier ECARTS(2) coverage → ECARTS(1) non-discriminating HOME test (the engine resolves a relative path against the plugin root) → CONFORME; security PASS (4 LOW). GATE 0 heredoc CHECK again not runnable → script (second time: write oracles as scripts from the start).
+- **Anomaly**: my r1 proposed a second row shape to satisfy "model then effort" literally; the derived-effort list satisfies it with zero new data shapes. During the gates the user answered the NEW dialog live: security-auditor → opus/xhigh (the request's example), plan-challenger → verify (reset on user go); my reset of `changed` wiped a legitimate entry and left the committed file census-red for one commit.
+- **Action**: when a request says "choose X then Y", look for the existing shape that already encodes (X, Y) before adding one; reconcile routing.json decisions one by one (never `changed = {}`), and run the census before every data commit. Links [[EVAL-043]], [[BDR-116]], [[LRN-212]].
+
diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md
index 4d8ccc2..066af3f 100644
--- a/.claude/memory/journal.md
+++ b/.claude/memory/journal.md
@@ -597,3 +597,4 @@ rules:
 
 ## 2026-10-11
 - model-router W3-A (first-use confirmation) landed 22455c0 on feature/model-router-confirm. User asked for it after the W2 merge; 3 pass-B answers. Plan r1→r4: correctness BLOCKER (Everywhere decision = census red → `changed` WARN exemption), robustness (first challenger killed by DNS, fresh one: project-tree layer dropped for security, single dialog in flight, keep-previous after first load), confirmation CONCERNS(6). Feater DONE (169 tests) + 4 rounds. Verifier ECARTS(3)/(2)/CONFORME; security BLOCK(1) REAL: password with `@`/`/` landed in the tracked key → strict parsing, no `local:` keys, output cap → re-verify ECARTS(1) fixtures → PASS. The working-tree mod was hot-loaded by the engine: my own dispatches opened T2 dialogs the user answered (verifier Keep, feater Keep, security-auditor → implement → user reset to verify); first misread as a test leak (LRN-212). GATE 0 oracle as heredoc not runnable → script. Full make test green (env red only). Docs P1-P13 user-approved (patch in flight); BDR-116, LRN-212, EVAL-043 written. Next: doc commit, memory commit, user merge + publish by hand; T1/T3 live checks open.
+- model-router W3-B (dialog with context) landed 604a6c4 + data 32b71d2 + floor chore. User asked after W3-A: explain what is decided, OK/change/later, model then effort then scope. Plan r1→r3: all three lenses killed my inline-row format and the T3 phase edit (2 BLOCKERs avoided); efforts derived from the phases of the chosen model. Feater DONE first pass (229 tests), verifier ECARTS(2)→(1)→CONFORME, security PASS. GATE 0 heredoc CHECK not runnable again → script. Live during the gates: user answered the NEW dialog for security-auditor → opus/xhigh (the request's example; kept, floor aligned to opus, model-routing lock updated), plan-challenger → verify (reset on user go), orchestrate Keep (T3 check done). My `changed = {}` reset wiped a legit entry → census red for one commit → restored. Docs P1-P6 approved (patch in flight), BDR-116 amendment + EVAL-044 written. Next: doc commit, memory commit, user merge of feature/model-router-confirm (W3-A + W3-B) + publish by hand; T1 live check still open.
diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index e6595d6..91412fc 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -26,7 +26,10 @@ migration of shifters/pins/model-gate in wave 2 after proof; names model-router
 ## 2026-10-10 — model-router wave 3-A: first-use route confirmation + decision memory (feature/model-router-confirm)
 Plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md` r4, contract `2026-10-10-model-router-w3a-confirm-1201`. User decisions 2026-10-10: tracked routing.json reached through the plugin dir (no new link); blocking `$.ui.ask` dialog at first use; per skill row, agent row, main phase.
 - [x] W3-A landed (22455c0, 2026-10-11): routing.json = phases + rows + decisions; T1/T2/T3 dialogs; project exceptions `projects[<normalized remote>]` in the tracked file (project-tree layer dropped: security); writers = dialog + `/route ask`; `/route pending`; census from the file with the `changed` WARN exemption; kit 86 → 190. Gates: 3 lenses + 1 confirmation (BLOCKER census), feater + 4 rounds, verifier CONFORME + re-verify, security BLOCK(1) credential leak fixed → PASS, full make test green (design-tool-gate env red). Live: T2 dialogs answered by the user (verifier Keep, feater Keep, security-auditor → implement then reset to verify on user go).
-- [ ] W3-A live checks still open: T1 (typed `/feat` etc.) and T3 (first `route(phase=…)` call) dialogs; a parallel same-agent dispatch answered after > 10 s; what an unanswered dialog resolves to on the terminal (must be Later or nothing written). Record in the contract as `[gated]` when seen.
+- [x] W3-B dialog with context (2026-10-11, 604a6c4, contract `2026-10-11-model-router-w3b-dialog-1240`, plan r3): descriptions (skill frontmatter / agent.offer / phase `about`), real id + effort in the question, Later / Keep / Change, model → effort (derived from the phases of that model) → scope, rows stay phases, T3 Later/Keep. 3 lenses (2 BLOCKERs on my r1 avoided) + 1 confirmation, feater + 2 rounds, verifier CONFORME (3rd), security PASS (4 LOW: symlinked SKILL.md read, TOCTOU, raw key in a log, any plugin hooking AskUserQuestion could answer). Live decisions: security-auditor → judge (kept, floor aligned `model: opus`), plan-challenger → verify (reset on user go), orchestrate Keep (T3 live check done).
+- [ ] W3-B residuals: a Change answered Everywhere can store a machine-only phase name (defined in `~/.claude/model-router.json`) into the tracked file (security note, correctness); SKILL.md symlink follow (LOW); `descs` cap and "(custom)" label untested; the security-auditor's `changed.from = verify` entry stays in routing.json although the floor now equals the row (harmless; prune at release).
+- [ ] trace the "auto mode: use Bash/sed instead of Edit/Write" instruction block that sub-agents see attributed to the model-router MCP instructions (security-auditor 2026-10-11): it is NOT in mods/model-router source; likely the harness's own auto-mode text rendered next to the mod's MCP block. Confirm the origin.
+- [ ] W3-A live checks still open: T1 (typed `/feat` etc.) dialog (T3 seen live 2026-10-11: orchestrate Keep); a parallel same-agent dispatch answered after > 10 s; what an unanswered dialog resolves to on the terminal (must be Later or nothing written). Record in the contract as `[gated]` when seen.
 - [ ] W3-A residuals (security LOW, accepted): non-atomic cross-process write (two sessions, crash mid-write → file reads as failed, previous config kept); `host/path` of a private remote in the tracked file; a persistent write failure re-asks every use (`asked.delete` in the catch); `out.length` vs byte size at the cap; `changePatch` scope 'project' with a vanished key writes Everywhere (cwd change mid-dialog). Deferred: `/route set`, `/route confirm`, `(unconfirmed)` in show, dialog edits of phases, frontmatter auto-alignment, session-start warning when routing.json is dirty, per-machine `projects`.
 - [ ] routing.json ships `confirmed` for verifier/feater (user Keeps) and phases verify/implement: every clone inherits them (by design: decisions travel). Revisit at release if unwanted.
 
diff --git a/.claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md b/.claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md
new file mode 100644
index 0000000..465eb04
--- /dev/null
+++ b/.claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md
@@ -0,0 +1,38 @@
+# CONTRACT — model-router-w3b-dialog
+- date: 2026-10-11 | flow: feat | branch: feature/model-router-confirm (continues W3-A before its merge)
+- status: active
+
+## REQUEST (verbatim — IMMUTABLE)
+j'aimerais qu'on vois pour que quand je le prompt de demande de confirmation ou changement pour un model et un effort, il faudrait qu'il soit un peu plus complet. par exemple expliquer brievement ce que fait ce pour quoi on demqnde de choisir plutot que juste le nom. car juste verifier en vrai ca peut etre pleins de chose, ou dire feature : auditor. car c'est pas tres clair on sait pas pour quoi on prend la decision. Surtout que lam auditor security je croism ca proposait sonnet alors que nonm un audit securite ca devrait etre le plus performant du model. bref metre un peu de contextm dire oui ca me vam ou changer et si on choisis de changerm proposer quel model puis quel effort, puis pour userscope et projet ca c'est bien, et l'enregistrer.
+
+## CLARIFICATIONS
+(pass A: none — outcome, scope and flow given in the request; W3-A contract and plan r4 give the base)
+Q: public shape (orchestrator default after three lenses, user may veto): ASK1 options Later / Keep / Change; ASK2 model = the four aliases labelled with their tier role (`fable (best)`, `opus (big)`, `sonnet (work)`, `haiku (cheap)`; Other = Later); ASK3 effort = the efforts offered by the phases headed by that model (fable: medium high xhigh max; opus: xhigh, skipped; sonnet: low medium high xhigh; haiku: low, skipped); the pair maps to that phase (rows stay phase names; a pair no phase offers is added by hand as a new phase in routing.json); ASK4 scope as W3-A; T3 (main-loop phase) = Later / Keep with context, no edit (BDR-116) [stated 2026-10-11]
+
+Q: live decisions during this run (plan-challenger judge → verify Everywhere; orchestrate phase Keep = the T3 live check) / A: user "Revenir à judge" → row reset, its confirmed/changed entries removed; orchestrate Keep kept [gated 2026-10-11]
+Q: live W3-B dialog answered during the security scan: security-auditor → Change → opus → xhigh → Everywhere = row `judge` (the request's own example; the first T2 answer through the new dialog) / A: kept; my reset of `changed` had wiped its from/to entry (census red at 604a6c4) → restored in the follow-up data commit [gated 2026-10-11]
+Q: GATE 1 ran 3 verifiers (ECARTS(2) coverage → ECARTS(1) one non-discriminating test → CONFORME), security PASS (4 LOW) [recorded 2026-10-11]
+
+## ACCEPTANCE CRITERIA
+1. ASK1 text carries context: for a skill row "`/<name>` — <description ≤ 140 chars from the SKILL.md frontmatter, five YAML forms, first sentence>. Routed to <phase> (<about>): <model id> at <effort>. OK?"; for an agent row "`<name>` — <description from agent.offer ≤ 140 chars>. Routed to …"; for a phase "Phase `<name>` — <about>; used by <n> rows [+ its non-row consumers]: <model id> at <effort>. OK?"; descriptions and `about` pass `clean()` (Cc/Cf stripped, newlines folded, code-point truncation with "…"); a missing or unreadable description, an unset HOME or a name outside `^[A-Za-z0-9][A-Za-z0-9._:-]*$` degrades to the name alone (never blocks, never reads outside `${HOME}/.claude/skills/<name>/SKILL.md`, stat kind `file`, size-capped). Options: Later / Keep / Change (T3: Later / Keep); Other at ASK1 = Later + toast. One kit test per clause.
+2. Change flow (rows only): ASK2 model = four fixed labels (Other or unknown = Later + toast); ASK3 effort = the efforts of the phases headed by the chosen alias, sorted ascending by level (≤ 4 labels, one → skipped, zero → Later + toast; Other = Later); target phase = the row's current phase when it matches, else the first matching phase in `cfg.phases` order; same phase as now = Keep (no `changed` entry); ASK4 as W3-A ([Everywhere, This project only], or [Everywhere, Later] with no repo key); any non-matching answer = Later, nothing written; storage as W3-A (`changed` from/to strings, `confirmed` = to); the new route applies to the current decision at once; after a main-row change the toast reports the real decision and the `/route switch on` hint when the pick is a downgrade. T3 never changes anything. One kit test per clause.
+3. Rows stay phase names in every layer; `ALTS`, the alt options and the free-text phase branch of the W3-A dialog are removed (no dead code); the W3-A dialog tests are migrated to the new answers and every existing test stays green.
+   CHECK: ! grep -qE 'ALTS\b' mods/model-router/hooks/register.ts && echo W3B-NO-ALTS
+   EXPECT: W3B-NO-ALTS
+   EVIDENCE: MET exit=0 marker-found :: W3B-NO-ALTS
+4. `routing.json` phases gain an `about` string (≤ 120 chars) for the 11 phases, loaded into a separate map (never on `Route`, never in `DEFAULT_CONFIG`), a non-string or overlong value dropped + logged once; descriptions never read from the project tree.
+   CHECK: bash .claude/tasks/contracts/w3b-about.sh
+   EXPECT: W3B-ABOUT
+   EVIDENCE: MET exit=0 marker-found :: W3B-ABOUT
+5. Census unchanged and green (rows are phases; the DEFAULT == file phase lock keeps matching with `about` present); `lib/effort-shift.md` dialog lines updated (≤ 4 lines changed, Later/Keep/Change and the model-then-effort flow named).
+   CHECK: bash lib/tests/effort-routing.test.sh >/dev/null 2>&1 && grep -q 'Change' lib/effort-shift.md && [ "$(wc -l < lib/effort-shift.md)" -le 66 ] && echo W3B-CENSUS
+   EXPECT: W3B-CENSUS
+   EVIDENCE: MET exit=0 marker-found :: W3B-CENSUS
+6. Kit suite, mods suite and validate green.
+   CHECK: cd mods/model-router && out="$(claude plugin test . 2>&1)" && printf '%s\n' "$out" | grep -qE '[0-9]+ pass' && ! printf '%s\n' "$out" | grep -qE '[1-9][0-9]* fail' && claude plugin validate . 2>&1 | grep -q 'passed' && cd ../.. && make test suite=lib/tests/mods.test.sh 2>&1 | grep -q 'all suites green' && echo W3B-MOD-GREEN
+   EXPECT: W3B-MOD-GREEN
+   EVIDENCE: MET exit=0 marker-found :: W3B-MOD-GREEN
+7. Security posture unchanged: writers, paths, caps, no model-originated write; descriptions truncated and control characters stripped before they enter a question. Judged by reading + one kit test (a description with control characters and 500 chars → ≤ 140 clean chars).
+
+## FILE SCOPE
+mods/model-router/routing.json, mods/model-router/hooks/register.ts, mods/model-router/hooks/register.test.ts, lib/tests/effort-routing.test.sh, lib/effort-shift.md; .claude/tasks/contracts/w3b-about.sh (oracle, orchestrator)
diff --git a/.claude/tasks/contracts/w3b-about.sh b/.claude/tasks/contracts/w3b-about.sh
new file mode 100755
index 0000000..3b22101
--- /dev/null
+++ b/.claude/tasks/contracts/w3b-about.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# GATE 0 oracle, contract w3b: every routing.json phase carries a 1-120 char `about`.
+set -u
+python3 -I - <<'PY'
+import json,sys
+r=json.load(open('mods/model-router/routing.json'))
+ok=all(isinstance(v.get('about'),str) and 0<len(v['about'])<=120 for v in r['phases'].values())
+print('W3B-ABOUT' if ok else 'W3B-ABOUT-MISSING'); sys.exit(0 if ok else 1)
+PY
diff --git a/.claude/tasks/plans/2026-10-11-model-router-w3b-dialog-1240.md b/.claude/tasks/plans/2026-10-11-model-router-w3b-dialog-1240.md
new file mode 100644
index 0000000..5ac657d
--- /dev/null
+++ b/.claude/tasks/plans/2026-10-11-model-router-w3b-dialog-1240.md
@@ -0,0 +1,170 @@
+# PLAN r3 — model-router wave 3-B: a dialog with context, model then effort on change (2026-10-11)
+
+r1 → r2 after simplicity CONCERNS(3), robustness FATAL(5), correctness
+FATAL(8): all three rejected inline-route rows and dialog edits of phases.
+r2 → r3 after the confirmation (correctness CONCERNS(2)). Precedence r3 > r2 > r1. Contract `.claude/tasks/contracts/2026-10-11-model-router-w3b-dialog-1240.md`.
+Base = W3-A (22455c0, plan r4, BDR-116). Facts: `agent.offer` payload carries
+`description` and `source`; `$.ui.ask` takes 2-4 labels + Other; `cfg.models`
+maps the four aliases to ids; each default alias heads one tier (best fable,
+big opus, work sonnet, cheap haiku); `readCapped` exists (size cap, stat).
+
+## Decisions
+- D1 rows stay PHASE NAMES everywhere (routing.json, projects, override).
+  No inline route rows. The dialog's model+effort choice maps to a phase.
+- D2 the dialog never edits a phase: T3 offers Later / Keep only, with
+  context. Phases change by hand in routing.json + DEFAULT_CONFIG (census
+  lock kept). BDR-116 unchanged.
+- D3 one description rule for every kind, hardened read, no cache.
+
+## Texts (ASK1)
+- `clean(s, n)`: FIRST fold every `\s` and `\p{Z}` (incl. U+2028/2029) to
+  a space, THEN strip `\p{Cc}` and `\p{Cf}`, collapse spaces, trim; when
+  longer than n code points keep n-1 and append "…" (total ≤ n). Applied to
+  every description and `about` (no answer echo anywhere).
+- Leads are KEPT as the first words (existing assertions stay valid):
+  "First route for /feat — <desc>. Routed to reflect (<about>): claude-fable-5-1
+  at high. OK?", "First dispatch of security-auditor — <desc>. Routed to
+  verify (<about>): claude-sonnet-5-5 at xhigh. OK?", "First use of
+  orchestrate on the main loop — <about>; used by …: … OK?". Without a
+  description the " — <desc>" part is omitted; without `about` the
+  parenthesis is omitted.
+- Skill row desc = `skillDesc($, st, name)`: name must match
+  `^[A-Za-z0-9][A-Za-z0-9._:-]*$` (else name only); `readCapped` of
+  `${HOME}/.claude/skills/<name>/SKILL.md` (stat kind must be `file`, size
+  cap as the override; HOME from `$.env.get`, unset → name only); parse the
+  frontmatter `description:` in its five forms (plain, `|`, `>`/`>-`,
+  single-quoted with `''`, double-quoted): unquote, join the block lines
+  with spaces, cut at the first sentence end (`. ` / `.` at end), then
+  clean(…, 140); any failure → name only. Read at ask time, once (the key
+  is asked at most once per session). The kind check lives in a
+  skill-specific wrapper around `readCapped` (config reads untouched).
+- Agent row: the offer description goes through the SAME rule (sentence
+  cut + clean 140) WHEN STORED at `agent.offer` (bounded cache
+  `Map<type, {source, description}>`); absent → name only.
+- Phase (T3): "First use of orchestrate on the main loop — <about>; used by
+  <n> rows[, the derived route of dispatches][, <k> prompt rule(s)]:
+  claude-fable-5-1 at medium. OK?"; consumers derived: `orchestrate` →
+  "the derived route of dispatches" (hardcoded, pushOrchestrate), prompt
+  rules counted from `cfg.prompt.filter(r => r.phase === name)` (floor
+  rules named "floor rule"). Options ["Later", "Keep"].
+- Row options: ["Later", "Keep", "Change"]. At EVERY step the `askOr` LATER
+  (dismissed, headless) is checked first and is silent; any other
+  non-label answer = Later + toast "answer not recognised, default kept"
+  (no echo). `ALTS`, the alt slice in `optionsFor` and the free-text phase
+  branch of `decide` are removed.
+- Main-row texts keep the real-decision rule (decideFor/mainEffort); spawn
+  texts keep spawnTarget + explicit effort.
+
+## Change flow (rows only)
+- ASK2 "Which model for `<name>`?": four FIXED labels from the default
+  aliases, each with its tier role ("fable (best)", "opus (big)", "sonnet
+  (work)", "haiku (cheap)"; role = the tier headed by the alias in
+  `cfg.tiers`, "(custom)" when none); Other or an unknown label = Later +
+  toast.
+- ASK3 "Which effort on <alias>?": the efforts of the phases (in
+  `cfg.phases`) whose tier head is the chosen alias, deduplicated and
+  sorted ASCENDING by LEVELS (fable: medium high xhigh max; opus: xhigh;
+  sonnet: low medium high xhigh; haiku: low) → at most 4 labels (the
+  first 4); exactly one → ASK3 skipped; zero → Later + toast "no phase
+  uses <alias>"; Other = Later.
+- Target phase = the row's CURRENT phase when it matches (alias, effort),
+  else the first matching phase in `cfg.phases` order. Same phase as now →
+  treated as Keep (no `changed` entry).
+- ASK4 scope as W3-A: ["Everywhere", "This project only"], or ["Everywhere",
+  "Later"] when there is no repo key.
+- After a CHANGE on a MAIN row (T1, never on Keep), computed in
+  `confirmSkill` from `skillRow` + `decideFor`: toast "`/<name>` now runs
+  <id> at <effort>" plus ", main moves up only: `/route switch on` allows
+  a downgrade" when the chosen alias ranks below the session model and the
+  switch is off; the new route is re-picked into the current decision
+  (T1/T2 as W3-A).
+- Storage unchanged from W3-A: `changed.<kind>.<name> = {from (first), to}`,
+  `confirmed.<kind>.<name> = to` (strings), `projects[key]` rows.
+
+## `about`
+- routing.json: `phases.<name>.about` (≤ 120 chars, clean) on the 11
+  phases; loaded into `mem.about: Record<phase, string>` (part of the
+  memory rebuilt with the config, so it survives /clear with cfg; never on
+  `Route`, never in DEFAULT_CONFIG; the census `code_phase` regex
+  untouched); a non-string or overlong `about` is dropped + logged once;
+  a phase without `about` → no parenthesis. acceptPhase ignores the key.
+
+## Steps
+- [ ] S1 routing.json `about` ×11 (one line each from the W2 phase table);
+      loader + map + validation.
+- [ ] S2 descriptions: offer cache `{source, description}`; `skillDesc`
+      (allowlist, readCapped, kind check, YAML forms, sentence cut); `clean`.
+- [ ] S3 ASK1 texts + options Later/Keep/Change; Other → Later + toast;
+      dead code removed (`ALTS`, alt slice, free-text branch).
+- [ ] S4 change flow ASK2 → ASK3 (derived efforts) → ASK4; target-phase
+      rule; same-phase = Keep; main toast with the real decision.
+- [ ] S5 `lib/effort-shift.md` dialog lines (≤ 4 changed).
+- [ ] S6a migrate the W3-A dialog tests: every `asks([...])` answering a
+      phase name at ASK1 becomes Keep or a Change chain (ASK1 → ASK2 →
+      [ASK3] → ASK4; the `asked[n]` indexes shift accordingly); option-list
+      assertions become Later/Keep/Change (T3 Later/Keep); the lead-text
+      assertions (:2266 "First dispatch of feater", :2395 "First use of
+      orchestrate on the main loop") stay valid by construction; :1914
+      expects the new toast "answer not recognised, default kept"; the two
+      free-text tests (:1871 "a free-text phase counts as an alt", :1878
+      "equal to the current phase is a Keep") are DELETED (authorized:
+      they test the removed branch); "a phase name answer is a Later" kept.
+      World/helper extensions: `offerOf` takes a description; the World
+      gains a per-path stat `kinds` override and a HOME override (unset).
+- [ ] S6b new tests, one per clause: skill text with each YAML form (plain,
+      `|`, `>-`, 'sq' with `''`, "dq"), missing SKILL.md → name only, a bad
+      name (`../x`) → name only, stat kind ≠ file → name only, a SKILL.md
+      over the cap → name only, HOME unset → name only, a 500-char
+      description with control, bidi and U+2028 chars → ≤ 140 clean code
+      points ending in "…"; a Keep on a main row → no "now runs" toast;
+      a Change → the toast with the switch hint; zero-effort alias → Later
+      + toast; dismissed ASK2 → silent Later; agent text from the offer
+      description; T3 text with `about` and consumers; ASK2 labels; ASK3
+      derived efforts per alias (fable 4, opus → skipped, sonnet 4, haiku →
+      skipped); security-auditor Change → opus → (skipped) → Everywhere →
+      row `judge`, spawn on claude-opus-5-5 at xhigh now; feater Change →
+      sonnet → high → `write`; Explore Change → sonnet → medium → stays
+      `explore` (current phase wins) → treated as Keep, no `changed`;
+      `/feat` Change → sonnet → medium → `implement`, toast names "moves up
+      only" with the switch off; Other at ASK1/ASK2/ASK3 → Later + toast,
+      nothing written; project scope with the derived phase; `about`
+      overlong → dropped + logged.
+- Disposition: honors BDR-116 rules (1), (3)-(6) unchanged (rows = phases,
+  dialog never edits phases, writers/paths/caps as is); AMENDS its clause
+  (2): options become Later/Keep/Change with a model-then-effort chain,
+  Other = Later (successor amendment written at CAPITALIZE, append-only); BDR-115 (full ids from `cfg.models`),
+  LRN-210 (one clause per test), LRN-212 (live mod: announce dialogs).
+- Docs (README/USAGE/CHANGELOG lines on the dialog) drift after this wave:
+  STEP 6 doc-sync, out of this contract's scope.
+
+## Challenge ledger (r1 → r2)
+- simp 1/2, rob 2/3/4/7/11/12, corr 1/2/3/9/10/12 (inline rows) → D1:
+  rows stay phases; efforts derived from the alias's phases; target-phase
+  rule with tie-break; same-phase = Keep.
+- simp 3, rob 1 BLOCKER/5/6/13, corr 4/5 (T3 phase edits) → D2: T3
+  Later/Keep with context; BDR-116 unchanged.
+- simp 6, rob 8/9, corr 8 (descriptions) → D3 single rule, five YAML
+  forms, hardened read, allowlist, clean() with Cc/Cf and code points.
+- simp 7, corr 14 (`about` on Route) → separate map, validated at load.
+- simp 8, corr 13 (ASK2 Other, aliases) → fixed four labels, Other = Later.
+- simp 9 (dead code) → S3 removal.
+- rob 10, corr 6 (main model pick is a placebo) → toast with the real
+  decision and the switch hint.
+- corr 7 (W3-A tests) → S6a migration step.
+- corr 11 (no-key scope) → W3-A behaviour kept ([Everywhere, Later]).
+- corr 15 (docs, AC5 oracle) → doc-sync noted; contract AC5 reworded.
+
+## Confirmation ledger (r2 → r3)
+- conf 1 (S6a under-listed) → leads kept by construction; toast text,
+  deleted free-text tests, `asked[n]` shifts listed.
+- conf 2 (read-hardening clauses untested) → S6b tests + World extensions.
+- conf 3 (ASK3 order) → ascending by LEVELS; tie-break in `cfg.phases` order.
+- conf 4 (clean order, length) → fold first, strip, n-1 + "…".
+- conf 5 (dismissed ASK2/3 toasted) → LATER checked first, silent.
+- conf 6 (zero efforts, texts, echo) → Later + toast; ASK2/ASK3 texts; no echo.
+- conf 7 (toast on Keep) → Change only, computed in confirmSkill.
+- conf 8 (BDR-116 clause 2) → amendment at CAPITALIZE.
+- conf 9 (`about` across /clear) → in `mem`, rebuilt with cfg.
+- conf 10 (agents vs skills rule) → same rule at offer time, bounded.
+- conf 11 (hardcoded consumers) → derived from cfg.prompt.
+- conf 12 (kind check placement) → skill wrapper around readCapped.

From cd8d72f01fd9e904595298c53dbd0529d8590916 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 16:14:59 +0200
Subject: [PATCH 10/12] =?UTF-8?q?feat(model-router):=20wave=203-C=20?=
 =?UTF-8?q?=E2=80=94=20/route=20forget=20<name|all|projects>?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clears first-use decisions from the tracked routing.json through the
existing writer: a name is forgotten in every table (confirmed, changed
with the row restored to its recorded shipped phase under guards, project
exceptions pruned) and asked again; all and projects ask a confirmation in
the engine dialog (Cancel first) and hold the single-dialog slot; nothing
is written when there is nothing to forget; the answer names what was
restored and the frontmatter floor to realign when one was aligned; the
route tool has no forget path. Docs name the new writer. Kit suite 232 → 284.

Contract .claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md,
plan r3: 3 lenses + 1 confirmation, feater + 3 rounds (one real defect),
GATE 0 MET, verifier at the cap on coverage (user-accepted), security PASS.
---
 CHANGELOG.md                             |   4 +-
 README.md                                |   4 +-
 USAGE.md                                 |   2 +-
 lib/effort-shift.md                      |   3 +-
 mods/model-router/hooks/register.test.ts | 574 +++++++++++++++++++++++
 mods/model-router/hooks/register.ts      | 270 ++++++++++-
 6 files changed, 847 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1151b9..f9b619d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/) and this project
 ## [Unreleased]
 
 ### Added
-- **model-router mod**: `mods/model-router/`, a Claude Code mod (function-hooks plugin), routes every repo skill and agent from phase rows (`plan`, `reflect`, `orchestrate`, `escalate`, `judge`, `implement`, `write`, `verify`, `explore`, `apply`, `mechanical`; built-ins Explore on sonnet/medium, Plan on opus/xhigh). A typed skill routes the main loop to its row, and a best-tier row holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. Agents get their row's model at spawn (within the tier, upward only) and its effort on every step; explicit Agent params win. Orchestrators declare their phases through the `mcp__model-router__route` tool. `ultrathink` in a prompt sets the turn's minimum effort and `/route effort=max` holds until `/route clear`; the built-in `/effort` is not a lever inside a run. `/route show` names the run slot (`main: run <phase>`), and a `null` row in the override drops a default row. The model gets a `route` tool and the user a `/route` command (`show|clear|off|on|reload|pending|ask on|off|<phase>|model=<alias|id> effort=<level>|switch on|off|verbose on|off`). Optional per-machine config `~/.claude/model-router.json`, where `"enabled": false` turns it off on that machine. The spinner suffix and the status line show the route in force. It loads in every session through the tracked symlink `skills/model-router` (`model-router@skills-dir`). `make doctor` gains a Mods section; suite `make test suite=lib/tests/mods.test.sh`. Known limits: the main loop switches model only with `mainModelSwitch` on (default off, one cold-cache step per switch into another model), and the hooks send full model ids, so the `models` table has to follow new versions.
-- **model-router first-use confirmation**: `mods/model-router/routing.json` (tracked) is the single source of the phase table and of every skill and agent row, and keeps the decisions: `confirmed`, `changed` (`from`/`to`), `projects` exceptions keyed by the origin remote reduced to `host/path` (credentials and local paths never stored), and `ask`. The first use of a rowed typed skill, a rowed agent spawn or a main-loop phase declared through the `route` tool opens a dialog with context: the skill's description (first sentence of its `SKILL.md` frontmatter) or the agent's, the phase with its `about` line (a new field on each of the 11 phases) and the model id and effort the next step really runs on. A row offers Later, Keep or Change; a main-loop phase Later or Keep. Change asks the model (fable, opus, sonnet, haiku with their tier), then the effort among those the phases of that model use (skipped when there is only one), then Everywhere or This project only; the pair maps to an existing phase (rows stay phase names, the same phase counts as Keep, a pair no phase offers is added by hand as a new phase). A skill-row change toasts the model and effort it now runs on, with the `/route switch on` hint when the main loop holds back a downgrade; a free-text answer counts as Later. One dialog at a time, never in headless (`-p`) runs or inside a sub-agent. Only a dialog answer or `/route ask on|off` writes the file (serialized, 64 KiB cap, never created when absent); each write asks you to commit it from the config repo. `/route pending` lists unconfirmed rows and phases. Layers: routing.json < `~/.claude/model-router.json` (its `ask` wins); a project's `.claude/model-router.json` is never read. Tests: `mods/model-router/hooks/register.test.ts`.
+- **model-router mod**: `mods/model-router/`, a Claude Code mod (function-hooks plugin), routes every repo skill and agent from phase rows (`plan`, `reflect`, `orchestrate`, `escalate`, `judge`, `implement`, `write`, `verify`, `explore`, `apply`, `mechanical`; built-ins Explore on sonnet/medium, Plan on opus/xhigh). A typed skill routes the main loop to its row, and a best-tier row holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. Agents get their row's model at spawn (within the tier, upward only) and its effort on every step; explicit Agent params win. Orchestrators declare their phases through the `mcp__model-router__route` tool. `ultrathink` in a prompt sets the turn's minimum effort and `/route effort=max` holds until `/route clear`; the built-in `/effort` is not a lever inside a run. `/route show` names the run slot (`main: run <phase>`), and a `null` row in the override drops a default row. The model gets a `route` tool and the user a `/route` command (`show|clear|off|on|reload|pending|ask on|off|forget <name|all|projects>|<phase>|model=<alias|id> effort=<level>|switch on|off|verbose on|off`). Optional per-machine config `~/.claude/model-router.json`, where `"enabled": false` turns it off on that machine. The spinner suffix and the status line show the route in force. It loads in every session through the tracked symlink `skills/model-router` (`model-router@skills-dir`). `make doctor` gains a Mods section; suite `make test suite=lib/tests/mods.test.sh`. Known limits: the main loop switches model only with `mainModelSwitch` on (default off, one cold-cache step per switch into another model), and the hooks send full model ids, so the `models` table has to follow new versions.
+- **model-router first-use confirmation**: `mods/model-router/routing.json` (tracked) is the single source of the phase table and of every skill and agent row, and keeps the decisions: `confirmed`, `changed` (`from`/`to`), `projects` exceptions keyed by the origin remote reduced to `host/path` (credentials and local paths never stored), and `ask`. The first use of a rowed typed skill, a rowed agent spawn or a main-loop phase declared through the `route` tool opens a dialog with context: the skill's description (first sentence of its `SKILL.md` frontmatter) or the agent's, the phase with its `about` line (a new field on each of the 11 phases) and the model id and effort the next step really runs on. A row offers Later, Keep or Change; a main-loop phase Later or Keep. Change asks the model (fable, opus, sonnet, haiku with their tier), then the effort among those the phases of that model use (skipped when there is only one), then Everywhere or This project only; the pair maps to an existing phase (rows stay phase names, the same phase counts as Keep, a pair no phase offers is added by hand as a new phase). A skill-row change toasts the model and effort it now runs on, with the `/route switch on` hint when the main loop holds back a downgrade; a free-text answer counts as Later. One dialog at a time, never in headless (`-p`) runs or inside a sub-agent. Only a dialog answer, `/route ask on|off` or `/route forget` (which takes decisions back; a changed row returns to its shipped phase, the frontmatter floors stay yours to realign) writes the file (serialized, 64 KiB cap, never created when absent); each write asks you to commit it from the config repo. `/route pending` lists unconfirmed rows and phases. Layers: routing.json < `~/.claude/model-router.json` (its `ask` wins); a project's `.claude/model-router.json` is never read. Tests: `mods/model-router/hooks/register.test.ts`.
 - **Manual-push mode**: `git config gitflow.autopush false` (human-set) now stops every push the gitflow lib makes, not only the post-commit / post-merge hooks. `gitflow start` and `finish` branch, commit and merge locally and push nothing; `gitflow delete` leaves the `origin/` copy in place and prints `git push origin --delete <br>` for the user to run. `hooks/unpushed-guard.sh` stays silent at turn end in this mode and opens each session with one `ℹ manual push mode:` line counting the commits no remote holds across every local branch; an unparseable or unreadable `gitflow.autopush` value is treated as manual push mode too, and that line names it. `hooks/push-guard.sh` (PreToolUse, `Bash|Monitor`) refuses any `git push` Claude types while `gitflow.autopush` reads false in the session cwd or in a literal `-C`/`cd` directory the command names (global config counts outside a repo); the refusal tells the user to run it with `! git push`. It reads the mode through the same lib verb as every other reader and fails closed: an unparseable or unreadable value reads as manual, and an internal error, a missing `lib/gitflow.sh`, more than 20 distinct directory tokens in one command (capped before any token is classified), a `cd`/`-C` directory token mixing quoted and unquoted parts, or a payload jq cannot parse whose raw text looks like a push refuse the push (these pathological cases fire in auto mode too). Directory tokens are read as whole shell words, adjacent quoted segments and backslash escapes included. In manual mode it over-blocks any command where a `push` word follows a `git` token; the misses listed in its header fall to a new `autoMode.soft_deny` rule that no request in the turn clears. The session banner adds `🔒 push : manual (autopush=false) — ! git push` when the key reads false, and `🔒 push : manual (autopush bad) — ! git push` when the value is invalid. Skills read the mode through a new lib verb, `bash ~/.claude/lib/gitflow.sh push-mode`: it prints `auto`, `manual` or `invalid` (rc 0) and names an invalid value on stderr (printable characters only, 64 at most). It is the one reader a skill may call, since the `git config` read of the key is denied to Claude. Skills push nothing on their own, except the `/release-candidate` tag in auto-push mode on an explicit go. Every "on origin" or "not pushed" line they print comes from `git rev-list --count origin/<br>..<br>` read after the fact, with the complete `! git …` command when something is left for the user to push. An invalid value (anything but unset, true or false, or a read that fails) is manual push mode for every reader and is named where it is read (see Fixed). Tests: `lib/gitflow-test.sh` T11b (push-mode verb), T18m and T18q blocks, `lib/tests/unpushed-guard.test.sh` T10-T16, `lib/tests/push-guard.test.sh` (98 checks).
 
 ### Changed
diff --git a/README.md b/README.md
index 3a1a880..421ea41 100644
--- a/README.md
+++ b/README.md
@@ -135,9 +135,9 @@ effort, never version. Transcript audit `python3 lib/effort-audit.py`.
 - Main loop: every request gets the route in force. A typed skill with a row routes the main loop to it; a best-tier row (`plan`, `reflect`, `orchestrate`, `escalate`) holds across turns in a run slot until `/route clear`, `/route off`, a user `/model` or a typed skill on a non-best row. A skill without a row leaves the route as it is.
 - Sub-agents: a routed agent gets its row's model at spawn, within its tier and only upward from its frontmatter model, and the row's effort on every step. Explicit `model` / `effort` params on the Agent call win; a project-defined agent of the same name keeps its own definition. Built-ins: Explore runs on sonnet/medium, Plan on opus/xhigh.
 - Levers inside a run: `ultrathink` in a prompt sets the turn's minimum effort; `/route effort=max` holds until `/route clear`. The built-in `/effort` is not a lever inside a run, rows and routes outrank it.
-- `/route` (user command) shows or sets the route: `show`, `clear`, `off`, `on`, `reload`, `pending` (rows and phases not confirmed yet), `ask on|off` (first-use dialog on or off), a phase name, `model=<alias|id> effort=<level>`, `switch on|off`, `verbose on|off`. `/route show` names the run slot when one holds (`main: run <phase>`). The model sets routes through a `route` tool.
+- `/route` (user command) shows or sets the route: `show`, `clear`, `off`, `on`, `reload`, `pending` (rows and phases not confirmed yet), `ask on|off` (first-use dialog on or off), `forget <name|all|projects>` (takes decisions back: a changed row returns to its shipped phase; `all` and `projects` ask first), a phase name, `model=<alias|id> effort=<level>`, `switch on|off`, `verbose on|off`. `/route show` names the run slot when one holds (`main: run <phase>`). The model sets routes through a `route` tool.
 - First use: the first time a rowed skill is typed, a rowed agent is spawned or a phase is declared on the main loop through the `route` tool, the mod asks once whether the route is right. The question gives context: the skill's description (first sentence of its `SKILL.md` frontmatter) or the agent's, the phase with its `about` line, and the model id and effort the next step really runs on; a declared phase also says what uses it (rows, prompt rules). A row offers Later, Keep or Change; a declared phase offers Later or Keep. Change asks the model (fable, opus, sonnet, haiku, each shown with the tier it heads), then the effort among those the phases on that model use (shipped table: fable medium, high, xhigh or max; sonnet low, medium, high or xhigh; opus and haiku have one level each, so no question), then Everywhere or This project only. Rows stay phase names, so the pair maps to an existing phase: the row's current phase wins a tie and the same phase counts as Keep; a pair no phase offers needs a new phase added by hand in routing.json. Everywhere moves the row and records the shipped phase under `changed`; This project only stores an exception under `projects`, keyed by the origin remote reduced to `host/path` (no credentials, no local paths; a remote that cannot be read that way offers no project choice). Keep lands under `confirmed`; Later, a dismissed dialog or a free-text answer asks again next session. After a skill row changes, a toast names the model and effort that skill now runs on, plus the `/route switch on` hint when the main loop holds back a downgrade. One dialog at a time, never in a headless (`-p`) run, never inside a sub-agent.
-- Only a dialog answer or `/route ask on|off` writes `routing.json`, never the model. Writes are serialized, capped at 64 KiB, and refused when the file is missing (it is never created). Each write leaves the config repo dirty; a toast reminds you to commit it from there.
+- Only a dialog answer, `/route ask on|off` or `/route forget` writes `routing.json`, never the model. Writes are serialized, capped at 64 KiB, and refused when the file is missing (it is never created). Each write leaves the config repo dirty; a toast reminds you to commit it from there.
 - The spinner suffix and the status line under the prompt show the route in force.
 
 Config layers: `mods/model-router/routing.json` (tracked: phases with their tier, effort and `about` line, rows, decisions, `ask`), then the optional per-machine `~/.claude/model-router.json`, which wins. A `.claude/model-router.json` inside a project is never read. Machine keys: `models` (alias → full id), `windows` (context window per full id), `tiers` (ordered alias lists per tier: `best` fable>opus>sonnet, `big` opus>fable>sonnet, `work` sonnet>opus, `cheap` haiku>sonnet; the first alias not down is used), `fallback` (the rank order of the aliases, best first, used by the breaker), `cooldownMinutes` (how long a model stays marked down after an availability error, 15 by default, doubling per episode up to 300), `mainUpgrade` (default `true`: the main loop may move up to a phase's tier), `upgradeMaxTokens` (default 200000: no main-loop upgrade above this context size, since an upgrade re-reads the whole context cold), `phases`, `agents`, `skills`, `prompt` (rules), `mainModelSwitch` (default `false`), `verbose` (default `false`), `spinner` (default `true`), `enabled` (default `true`; `false` turns the mod off on that machine), `ask` (overrides routing.json's `ask` on that machine). A `null` value in `agents` or `skills` drops a row. Edit phases and rows by hand in routing.json (a phase's `about`, 120 characters at most, is read from there only and shown in the dialog; a model and effort pair no phase offers needs a new phase there); without it the mod runs the code's default phases, with no rows and no dialog. `/route reload` re-reads both files.
diff --git a/USAGE.md b/USAGE.md
index ac9fe55..b4d37f2 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -187,7 +187,7 @@ l'outil `mcp__model-router__route` (`lib/effort-shift.md`). Les skills
 externes vendorés (pile design, superpowers, agent-skills, skills scroll
 MengTo, 21st) ont aussi leur ligne.
 
-Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). Première utilisation : la première fois qu'un skill avec ligne est tapé, qu'un agent avec ligne est lancé ou qu'une phase est déclarée sur la boucle principale via l'outil `route`, le mod demande une fois si la route convient. La question donne le contexte : la description du skill (première phrase du frontmatter de son `SKILL.md`) ou celle de l'agent, la phase avec sa ligne `about` (champ de la phase dans `routing.json`), puis le modèle et le niveau réels de l'étape suivante ; une phase déclarée dit aussi qui l'utilise. Pour une ligne : Later, Keep ou Change ; pour une phase déclarée : Later ou Keep. Change demande le modèle (fable, opus, sonnet, haiku, chacun avec son tier), puis le niveau parmi ceux des phases de ce modèle (fable : medium, high, xhigh ou max ; sonnet : low, medium, high ou xhigh ; opus et haiku n'en ont qu'un, la question est sautée), puis Everywhere ou This project only (exception rangée sous le remote origin du dépôt réduit à `host/path`, jamais d'identifiants). Une ligne reste un nom de phase : le couple modèle et niveau désigne une phase existante, et la même phase qu'avant vaut Keep. Un couple qu'aucune phase n'offre s'ajoute à la main comme nouvelle phase dans `routing.json`. Après un changement sur un skill, un toast donne le modèle et le niveau réels, et rappelle `/route switch on` quand la boucle principale refuse de descendre. La réponse est écrite dans `routing.json` ; Later, un texte libre (Other) ou un dialogue fermé redemande à une session suivante. Un seul dialogue à la fois, jamais en headless (`-p`) ni dans un sous-agent, et le modèle n'écrit jamais ce fichier. Chaque réponse laisse le repo de config modifié : commite-le depuis ce repo. `/route pending` liste ce qui reste à confirmer, `/route ask off|on` coupe ou rallume le dialogue.
+Taper un skill qui a une ligne route la boucle principale dessus. Une ligne du tier best (plan, reflect, orchestrate, escalate) tient d'un tour à l'autre pendant tout le run, jusqu'à `/route clear`, `/route off`, un `/model` tapé ou un skill d'un autre tier tapé. Pour relancer un tour bloqué : `ultrathink` dans le prompt (plancher du tour) ou `/route effort=max` (tient jusqu'à `/route clear`). Le `/effort` intégré n'a pas d'effet dans un run : les lignes et les routes passent devant. Les sous-agents reçoivent le modèle de leur ligne au lancement (dans leur tier, jamais en dessous de leur frontmatter) et son niveau à chaque étape ; un `model` ou `effort` explicite sur l'appel gagne. Explore tourne en sonnet/medium, Plan en opus/xhigh. `/route show` affiche la route en cours, slot de run compris (`main: run <phase>`). Première utilisation : la première fois qu'un skill avec ligne est tapé, qu'un agent avec ligne est lancé ou qu'une phase est déclarée sur la boucle principale via l'outil `route`, le mod demande une fois si la route convient. La question donne le contexte : la description du skill (première phrase du frontmatter de son `SKILL.md`) ou celle de l'agent, la phase avec sa ligne `about` (champ de la phase dans `routing.json`), puis le modèle et le niveau réels de l'étape suivante ; une phase déclarée dit aussi qui l'utilise. Pour une ligne : Later, Keep ou Change ; pour une phase déclarée : Later ou Keep. Change demande le modèle (fable, opus, sonnet, haiku, chacun avec son tier), puis le niveau parmi ceux des phases de ce modèle (fable : medium, high, xhigh ou max ; sonnet : low, medium, high ou xhigh ; opus et haiku n'en ont qu'un, la question est sautée), puis Everywhere ou This project only (exception rangée sous le remote origin du dépôt réduit à `host/path`, jamais d'identifiants). Une ligne reste un nom de phase : le couple modèle et niveau désigne une phase existante, et la même phase qu'avant vaut Keep. Un couple qu'aucune phase n'offre s'ajoute à la main comme nouvelle phase dans `routing.json`. Après un changement sur un skill, un toast donne le modèle et le niveau réels, et rappelle `/route switch on` quand la boucle principale refuse de descendre. La réponse est écrite dans `routing.json` ; Later, un texte libre (Other) ou un dialogue fermé redemande à une session suivante. Un seul dialogue à la fois, jamais en headless (`-p`) ni dans un sous-agent, et le modèle n'écrit jamais ce fichier. Chaque réponse laisse le repo de config modifié : commite-le depuis ce repo. `/route pending` liste ce qui reste à confirmer, `/route ask off|on` coupe ou rallume le dialogue, `/route forget <nom|all|projects>` efface une décision (une ligne changée revient à la phase livrée ; `all` et `projects` demandent d'abord).
 
 La config par machine, optionnelle, vit dans `~/.claude/model-router.json` et passe devant `routing.json` ; `"enabled": false` y coupe le mod sur cette machine, `"ask": false` y coupe le dialogue, une ligne à `null` y retire une ligne. Un `.claude/model-router.json` dans un projet n'est jamais lu. Les phases et les lignes se modifient à la main dans `routing.json` ; `/route reload` relit les deux fichiers.
 
diff --git a/lib/effort-shift.md b/lib/effort-shift.md
index db781a0..84c099c 100644
--- a/lib/effort-shift.md
+++ b/lib/effort-shift.md
@@ -51,7 +51,8 @@ Builtin `/effort` is NOT a lever inside a run: rows and routes outrank it.
 - First use of a row asks once, with context (Later, Keep or Change: model,
   then effort, then Everywhere or this project only); the answer is kept in
   `mods/model-router/routing.json`. `/route pending` lists what is still
-  unconfirmed, `/route ask off|on` toggles the dialog.
+  unconfirmed, `/route ask off|on` toggles the dialog, `/route forget
+  <name|all|projects>` takes a decision back.
 
 Measure the split any time: `python3 ~/.claude/lib/effort-audit.py`
 (thinking/output/cache tokens per scope, model and effort).
diff --git a/mods/model-router/hooks/register.test.ts b/mods/model-router/hooks/register.test.ts
index 8c4b626..55824c0 100644
--- a/mods/model-router/hooks/register.test.ts
+++ b/mods/model-router/hooks/register.test.ts
@@ -2956,3 +2956,577 @@ test('change: the current phase wins a tie, and counts as a Keep', async (
   expect(routingOf(w).changed).toEqual({})
   expect(confirmedOf(w).agents).toEqual({ Explore: 'explore' })
 })
+
+// ---- wave 3-C: /route forget -----------------------------------------------
+
+const TWO = 'github.com/acme/two'
+const FORGET_NOTE = 'other live sessions see it after /route reload'
+const MODEL_LOCK = 'lib/tests/model-routing.test.sh'
+
+/** A feater moved to judge, as a Change Everywhere would have left it. */
+const movedFeater = (file: Rec): void => {
+  (file.agents as Rec).feater = 'judge'
+  file.changed = { agents: { feater: { from: 'implement', to: 'judge' } } }
+  file.confirmed = { agents: { feater: 'judge' } }
+}
+
+/** Edits the inline routing.json with `extra` keys laid over it. */
+const decisions = (extra: Rec) => (file: Rec): void => {
+  Object.assign(file, extra)
+}
+
+/** A world with decisions in the file, for the forget tests. */
+const forgetWorld = (extra: Rec, answers: string[] = []) =>
+  newWorld({ edit: decisions(extra), answers })
+
+test('forget: a confirmed skill is removed and asked again', async ($, on) => {
+  const w = asks(['Keep', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  expect(await route($, 'forget feat')).toContain('forgot feat: 1 confirmed')
+  expect(confirmedOf(w).skills).toBeUndefined()
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+})
+
+test('forget: /route pending lists a forgotten key again', async ($, on) => {
+  const w = asks(['Keep'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await route($, 'forget feat')
+  const lines = (await route($, 'pending')).split('\n')
+  expect(lines[1]).toBe('asked this session: none')
+  expect(lines[2]).toContain('skills:feat')
+})
+
+test('forget: the answer closes on the other sessions\' reload', async (
+  $, on) => {
+  const w = forgetWorld({ confirmed: { skills: { feat: 'reflect' } } })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget feat')).toMatch(new RegExp(`${FORGET_NOTE}$`))
+})
+
+test('forget: a changed agent goes back to its shipped phase', async (
+  $, on) => {
+  const w = newWorld({ edit: movedFeater })
+  const rig = await bootRun($, on, FABLE, w)
+  expect(await featerModel($, rig)).toBe(OPUS)
+  await route($, 'forget feater')
+  const file = routingOf(w)
+  expect((file.agents as Rec).feater).toBe('implement')
+  expect(file.changed).toEqual({})
+  expect(file.confirmed).toEqual({})
+  expect(await featerModel($, rig)).toBe(SONNET)
+})
+
+test('forget: a restored row names the frontmatter to realign', async (
+  $, on) => {
+  await bootRun($, on, FABLE, newWorld({ edit: movedFeater }))
+  expect(await route($, 'forget feater')).toContain(
+    ' (agents.feater → implement: sonnet at medium; if agents/feater.md ' +
+    'was aligned to judge, set model: sonnet, effort: medium and its lock in ' +
+    `${MODEL_LOCK}, then \`make test\`)`)
+})
+
+test('forget: a built-in agent restored names no file', async ($, on) => {
+  const w = forgetWorld({
+    agents: { Explore: 'write' },
+    changed: { agents: { Explore: { from: 'explore', to: 'write' } } },
+  })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget Explore')
+  expect(out).toContain('(agents.Explore → explore: sonnet at medium)')
+})
+
+test('forget: the built-in Plan agent restored names no file', async (
+  $, on) => {
+  const w = forgetWorld({
+    agents: { Plan: 'write' },
+    changed: { agents: { Plan: { from: 'judge', to: 'write' } } },
+  })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget Plan')
+  expect(out).toContain('(agents.Plan → judge:')
+  expect(out).not.toContain('agents/Plan.md')
+})
+
+test('forget all: a refused restore is kept, the rest removed', async (
+  $, on) => {
+  const w = forgetWorld({
+    agents: { Explore: 'judge' },
+    changed: { agents: { Explore: { from: 'explore', to: 'write' } } },
+    confirmed: { skills: { feat: 'reflect' } },
+  }, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget all')
+  expect(out).toContain('1 restore(s) kept: agents.Explore: the row differs')
+  expect(confirmedOf(w).skills).toBeUndefined()
+  expect(routingOf(w).changed).toEqual(
+    { agents: { Explore: { from: 'explore', to: 'write' } } })
+})
+
+test('forget: a phase is removed and the route tool asks again', async (
+  $, on) => {
+  const w = asks(['Keep', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(await route($, 'forget orchestrate')).toContain('1 confirmed')
+  expect(confirmedOf(w).phases).toBeUndefined()
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'orchestrate' })
+  expect(w.asked).toHaveLength(2)
+})
+
+const twoRepos = {
+  projects: {
+    [KEY]: { skills: { feat: 'plan' } },
+    [TWO]: { skills: { feat: 'apply' }, agents: { feater: 'judge' } },
+  },
+}
+
+test('forget: a name loses its exception in every repo', async ($, on) => {
+  const w = forgetWorld(twoRepos)
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget feat')
+  expect(out).toContain('2 project exception(s) removed')
+  expect(routingOf(w).projects).toEqual({
+    [TWO]: { agents: { feater: 'judge' } },
+  })
+})
+
+test('forget: an undecided row has nothing to forget, no write', async (
+  $, on) => {
+  const w = newWorld()
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget status')).toBe('nothing to forget for status')
+  expect(w.written).toEqual([])
+})
+
+test('forget: an unknown name has nothing to forget, no write', async (
+  $, on) => {
+  const w = newWorld()
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget zzz')).toContain('nothing to forget for zzz')
+  expect(w.written).toEqual([])
+})
+
+test('forget: a key only asked this session is reset, no write', async (
+  $, on) => {
+  const w = asks(['Later', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  const out = await route($, 'forget feat')
+  expect(out).toContain('asked again at the next use, nothing was saved')
+  expect(w.written).toEqual([])
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+})
+
+test('forget: an asked key the override decides is said so', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  w.files.set(HOME_FILE, '{"skills":{"feat":"plan"}}')
+  await route($, 'reload')
+  const out = await route($, 'forget feat')
+  expect(out).toContain('still decided by ~/.claude/model-router.json')
+})
+
+for (const args of ['forget', 'forget a b']) {
+  test(`forget: "${args}" is a usage line, no write`, async ($, on) => {
+    const w = newWorld()
+    await bootRun($, on, FABLE, w)
+    expect(await route($, args)).toBe(
+      'usage: /route forget <name|all|projects>')
+    expect(w.written).toEqual([])
+  })
+}
+
+test('forget: a row named all is reserved, said', async ($, on) => {
+  const w = newWorld({ edit: f => { (f.skills as Rec).all = 'plan' } })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget all')
+  expect(out).toContain('named all is reserved here: edit routing.json by hand')
+})
+
+/** `/route forget <args>` typed while a first-use dialog is held open. */
+async function forgetDuringDialog($: Engine, w: World, args: string) {
+  const held = deferred()
+  const seen = deferred()
+  w.gate = held.gate
+  w.onAsk = seen.release
+  const typing = typeFeat($)
+  await seen.gate
+  const out = await route($, args)
+  held.release()
+  await typing
+  return out
+}
+
+test('forget: refused while a dialog is open, nothing written', async (
+  $, on) => {
+  const w = asks(['Later'])
+  await bootRun($, on, FABLE, w)
+  const out = await forgetDuringDialog($, w, 'forget feat')
+  expect(out).toBe('answer the open dialog first')
+  expect(w.written).toEqual([])
+})
+
+const confirmedFeat = { confirmed: { skills: { feat: 'reflect' } } }
+
+test('forget all asks first: Cancel, then Forget', async ($, on) => {
+  const w = forgetWorld({ ...confirmedFeat, ...twoRepos }, ['Cancel'])
+  await bootRun($, on, FABLE, w)
+  await route($, 'forget all')
+  expect(w.asked[0]?.options).toEqual(['Cancel', 'Forget'])
+  expect(w.asked[0]?.header).toBe('model-router')
+})
+
+test('forget all: the question counts what it removes', async ($, on) => {
+  const w = forgetWorld({ ...confirmedFeat, ...twoRepos }, ['Cancel'])
+  await bootRun($, on, FABLE, w)
+  await route($, 'forget all')
+  expect(w.asked[0]?.text).toBe('Forget 4 decisions: 0 row(s) restored, ' +
+    '3 project exception(s) in 2 repos?')
+})
+
+test('forget all: Cancel writes nothing', async ($, on) => {
+  const w = forgetWorld(confirmedFeat, ['Cancel'])
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget all')).toContain('cancelled, nothing written')
+  expect(w.written).toEqual([])
+})
+
+for (const [what, answer] of [
+  ['a dismissed dialog', REJECT],
+  ['another answer', 'whenever'],
+] as const) {
+  test(`forget all: ${what} is a cancel`, async ($, on) => {
+    const w = forgetWorld(confirmedFeat, [answer])
+    await bootRun($, on, FABLE, w)
+    expect(await route($, 'forget all')).toContain('cancelled')
+    expect(w.written).toEqual([])
+  })
+}
+
+test('forget all: nothing to forget skips the question', async ($, on) => {
+  const w = newWorld({ answers: ['Forget'] })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget all')).toBe('nothing to forget')
+  expect(w.asked).toEqual([])
+})
+
+test('forget all: empties confirmed, changed and projects', async ($, on) => {
+  const w = forgetWorld({
+    agents: { feater: 'judge' },
+    confirmed: { skills: { feat: 'reflect' }, agents: { feater: 'judge' } },
+    changed: movedChange(),
+    projects: twoRepos.projects,
+  }, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  await route($, 'forget all')
+  const file = routingOf(w)
+  expect([file.confirmed, file.changed, file.projects]).toEqual([{}, {}, {}])
+})
+
+/** The `changed` table of a feater moved to judge. */
+function movedChange(): Rec {
+  return { agents: { feater: { from: 'implement', to: 'judge' } } }
+}
+
+test('forget all: the rows come back, the counts are said', async ($, on) => {
+  const w = forgetWorld({
+    agents: { feater: 'judge' },
+    confirmed: { skills: { feat: 'reflect' }, agents: { feater: 'judge' } },
+    changed: movedChange(),
+    projects: { [KEY]: { skills: { feat: 'plan' } } },
+  }, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget all')
+  expect(out).toContain('forgot all: 2 confirmed, 1 row(s) restored, ' +
+    '1 project exception(s) removed')
+  expect((routingOf(w).agents as Rec).feater).toBe('implement')
+})
+
+test('forget all: the asked set is cleared', async ($, on) => {
+  const w = asks(['Keep', 'Forget', 'Later'])
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await route($, 'forget all')
+  await typeFeat($)
+  expect(w.asked).toHaveLength(3)
+})
+
+test('forget all: the plan is recomputed on the file the write reads', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  w.onAsk = () => {
+    const file = routingOf(w)
+    file.confirmed = {
+      skills: { feat: 'reflect' },
+      agents: { verifier: 'verify' },
+    }
+    w.files.set('routing', JSON.stringify(file))
+  }
+  const out = await route($, 'forget all')
+  expect(out).toContain('2 confirmed')
+  expect(routingOf(w).confirmed).toEqual({})
+})
+
+test('forget all: the file vanishing during the question saves nothing', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  w.onAsk = () => { w.files.delete('routing') }
+  expect(await route($, 'forget all')).toBe('forget refused: nothing saved')
+  expect(w.written).toEqual([])
+})
+
+test('forget all: holds the dialog slot while it asks', async ($, on) => {
+  const w = asks(['Forget'], { edit: decisions(confirmedFeat) })
+  await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const seen = deferred()
+  w.gate = held.gate
+  w.onAsk = seen.release
+  const forgetting = route($, 'forget all')
+  await seen.gate
+  w.onAsk = undefined
+  await typed($, '/status')
+  await skillPrompt($, 'status')
+  expect(w.asked).toHaveLength(1)
+  held.release()
+  await forgetting
+})
+
+test('forget all: a second forget is refused while the first asks', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat, ['Cancel'])
+  await bootRun($, on, FABLE, w)
+  const held = deferred()
+  const seen = deferred()
+  w.gate = held.gate
+  w.onAsk = seen.release
+  const first = route($, 'forget all')
+  await seen.gate
+  expect(await route($, 'forget feat')).toBe('answer the open dialog first')
+  held.release()
+  await first
+})
+
+test('forget projects: only the project exceptions go', async ($, on) => {
+  const w = forgetWorld({ ...confirmedFeat, ...twoRepos }, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  await route($, 'forget projects')
+  expect(routingOf(w).projects).toEqual({})
+  expect(routingOf(w).confirmed).toEqual(confirmedFeat.confirmed)
+})
+
+test('forget projects: nothing to forget skips the question', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat, ['Forget'])
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget projects')).toBe('nothing to forget')
+  expect(w.asked).toEqual([])
+})
+
+/** A moved feater whose recorded change no longer matches the file. */
+const brokenRestore = (changed: Rec, row = 'judge') => (file: Rec) => {
+  (file.agents as Rec).feater = row
+  file.changed = { agents: { feater: changed } }
+}
+
+for (const [why, changed, row, text] of [
+  ['the row differs', { from: 'implement', to: 'judge' }, 'write',
+    'differs from the recorded change'],
+  ['from is no phase', { from: 'nosuch', to: 'judge' }, 'judge',
+    'nosuch is not a known phase'],
+  ['from is not a string', { from: 5, to: 'judge' }, 'judge',
+    'no phase recorded'],
+] as const) {
+  test(`forget: a restore is refused when ${why}, entry kept`, async (
+    $, on) => {
+    const w = newWorld({ edit: brokenRestore(changed, row) })
+    await bootRun($, on, FABLE, w)
+    expect(await route($, 'forget feater')).toContain(text)
+    expect(w.written).toEqual([])
+    expect(routingOf(w).changed).toEqual({ agents: { feater: changed } })
+  })
+}
+
+test('forget: a refused restore reports it next to what was removed', async (
+  $, on) => {
+  const w = newWorld({ edit: f => {
+    brokenRestore({ from: 'implement', to: 'judge' }, 'write')(f)
+    f.confirmed = { agents: { feater: 'write' } }
+  } })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget feater')
+  expect(out).toContain('1 confirmed, 0 row(s) restored')
+  expect(out).toContain('1 restore(s) kept: agents.feater:')
+})
+
+test('forget: the override still setting the row is said', async ($, on) => {
+  const w = newWorld({
+    edit: movedFeater,
+    home: { agents: { feater: 'judge' } },
+  })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget feater')).toContain(
+    '; ~/.claude/model-router.json still sets feater and wins here')
+})
+
+test('forget: a restored skill the run still holds says /route clear', async (
+  $, on) => {
+  const w = newWorld({ edit: f => {
+    (f.skills as Rec).feat = 'plan'
+    f.changed = { skills: { feat: { from: 'reflect', to: 'plan' } } }
+    f.confirmed = { skills: { feat: 'plan' } }
+  } })
+  await bootRun($, on, FABLE, w)
+  await typed($, '/feat add a thing')
+  await skillPrompt($, 'feat')
+  expect(await route($, 'forget feat')).toContain(
+    '; current run may keep plan: /route clear to apply')
+})
+
+/** A feat moved to plan, as a Change Everywhere would have left it. */
+const movedFeat = (file: Rec): void => {
+  (file.skills as Rec).feat = 'plan'
+  file.changed = { skills: { feat: { from: 'reflect', to: 'plan' } } }
+  file.confirmed = { skills: { feat: 'plan' } }
+}
+
+const KEEPS = 'current run may keep'
+
+for (const answer of ['Cancel', REJECT]) {
+  test(`forget projects asks first: ${answer} saves nothing`, async (
+    $, on) => {
+    const w = forgetWorld(twoRepos, [answer])
+    await bootRun($, on, FABLE, w)
+    expect(await route($, 'forget projects')).toContain('cancelled')
+    expect(w.asked[0]?.options).toEqual(['Cancel', 'Forget'])
+    expect(w.written).toEqual([])
+  })
+}
+
+test('forget: a restored agent or other-phase skill keeps no run', async (
+  $, on) => {
+  const w = newWorld({ edit: f => {
+    movedFeat(f)
+    f.changed = { ...(f.changed as Rec), agents: {
+      feater: { from: 'implement', to: 'plan' } } }
+    ;(f.agents as Rec).feater = 'plan'
+    ;(f.skills as Rec).status = 'apply'
+    ;(f.changed as Rec).skills = { ...((f.changed as Rec).skills as Rec),
+      status: { from: 'mechanical', to: 'apply' } }
+  } })
+  await bootRun($, on, FABLE, w)
+  await typed($, '/feat add a thing')
+  await skillPrompt($, 'feat')
+  expect(await route($, 'forget feater')).not.toContain(KEEPS)
+  expect(await route($, 'forget status')).not.toContain(KEEPS)
+})
+
+test('forget: a phase the model routed is not a run to keep', async (
+  $, on) => {
+  const w = newWorld({ edit: f => {
+    (f.skills as Rec).status = 'plan'
+    f.changed = { skills: { status: { from: 'mechanical', to: 'plan' } } }
+    f.confirmed = { skills: { status: 'plan' } }
+  } })
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, phase: 'plan' })
+  expect(await route($, 'forget status')).not.toContain(KEEPS)
+})
+
+test('forget: no machine pin on the name, no "wins here"', async ($, on) => {
+  const w = newWorld({
+    edit: decisions(confirmedFeat),
+    home: { skills: { hotfix: 'plan' } },
+  })
+  await bootRun($, on, FABLE, w)
+  const out = await route($, 'forget feat')
+  expect(out).toContain('forgot feat: 1 confirmed')
+  expect(out).not.toContain('wins here')
+})
+
+test('forget: a restored skill row names its SKILL.md to realign', async (
+  $, on) => {
+  await bootRun($, on, FABLE, newWorld({ edit: movedFeat }))
+  expect(await route($, 'forget feat')).toContain(
+    'if skills/feat/SKILL.md was aligned to plan, set model: ')
+})
+
+test('forget: a missing routing.json saves nothing', async ($, on) => {
+  const w = newWorld({ routing: 'absent' })
+  await bootRun($, on, FABLE, w)
+  expect(await route($, 'forget feat')).toContain('nothing saved')
+  expect(w.written).toEqual([])
+})
+
+test('forget: a rebuild failing after the write is said', async ($, on) => {
+  const w = forgetWorld(confirmedFeat)
+  await bootRun($, on, FABLE, w)
+  w.onWrite = () => { w.files.set(HOME_FILE, '{nope') }
+  expect(await route($, 'forget feat')).toBe(
+    'saved, config not rebuilt: /route reload')
+  expect(routingOf(w).confirmed).toEqual({})
+})
+
+test('forget: a failing write is not applied', async ($, on) => {
+  const w = forgetWorld(confirmedFeat)
+  await bootRun($, on, FABLE, w)
+  w.failWrite = true
+  expect(await route($, 'forget feat')).toContain('forget not applied')
+  expect(routingOf(w).confirmed).toEqual(confirmedFeat.confirmed)
+})
+
+test('forget: the route tool cannot forget', async ($, on) => {
+  const w = forgetWorld(confirmedFeat)
+  await bootRun($, on, FABLE, w)
+  await $.tool.call({ tool: ROUTE_TOOL, clear: true })
+  expect(w.written).toEqual([])
+  expect(routingOf(w).confirmed).toEqual(confirmedFeat.confirmed)
+})
+
+test('forget: a forget input to the route tool is refused', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat)
+  await bootRun($, on, FABLE, w)
+  for (const input of [{ forget: 'feat' }, { phase: 'forget' }]) {
+    const out = await $.tool.call({ tool: ROUTE_TOOL, ...input })
+    expect(JSON.stringify(out)).toContain('"deny"')
+  }
+  expect(w.written).toEqual([])
+  expect(routingOf(w).confirmed).toEqual(confirmedFeat.confirmed)
+})
+
+test('forget projects: the asked set is kept, no re-ask', async ($, on) => {
+  const w = newWorld({
+    ask: true,
+    edit: decisions({ projects: { [TWO]: twoRepos.projects[TWO] } }),
+    answers: ['Later', 'Forget'],
+  })
+  await bootRun($, on, FABLE, w)
+  await typeFeat($)
+  await route($, 'forget projects')
+  await typeFeat($)
+  expect(w.asked).toHaveLength(2)
+  expect(w.asked[1]?.options).toEqual(['Cancel', 'Forget'])
+})
+
+test('forget: a non-composer origin is refused, nothing written', async (
+  $, on) => {
+  const w = forgetWorld(confirmedFeat)
+  await bootRun($, on, FABLE, w)
+  const out = await $.command.run({
+    command: 'route',
+    args: 'forget feat',
+    origin: { kind: 'plugin', name: 'x' },
+    presentation: { isFullscreen: false, columns: 80 },
+  })
+  expect(out.text).toContain('user-only')
+  expect(w.written).toEqual([])
+})
diff --git a/mods/model-router/hooks/register.ts b/mods/model-router/hooks/register.ts
index 2092106..a73739f 100644
--- a/mods/model-router/hooks/register.ts
+++ b/mods/model-router/hooks/register.ts
@@ -1506,6 +1506,8 @@ async function handleCommand($: Api, st: State, args: string): Promise<string> {
       return pendingText(st)
     case 'ask':
       return askCommand($, st, rest[0])
+    case 'forget':
+      return forgetCommand($, st, rest)
     case 'switch':
     case 'verbose':
       return toggle($, st, head, rest[0])
@@ -1517,8 +1519,9 @@ async function handleCommand($: Api, st: State, args: string): Promise<string> {
 // ---- first use: one dialog per row, the answer kept in routing.json -----
 // The first time a row routes (a typed skill, an agent spawn, a phase
 // declared through the route tool) the user confirms it once, for every
-// project; a change can be a project exception. Only a dialog answer or
-// `/route ask` writes; nothing is asked on the step path or in an agent.
+// project; a change can be a project exception. Only a dialog answer,
+// `/route ask` or `/route forget` writes; nothing is asked on the step path
+// or in an agent.
 
 const HEADER = 'model-router'
 const UPDATED = 'routing.json updated: commit it from the config repo ' +
@@ -1853,6 +1856,9 @@ function serializeRouting(file: Rec): string {
   return JSON.stringify(ordered, null, 2) + '\n'
 }
 
+/** The write landed but the config could not be rebuilt from it. */
+class RebuildFailed extends Error {}
+
 /**
  * Read-modify-write of routing.json, one at a time (a chain). Refuses a
  * missing or unparsable file and never creates it; rebuilds the config
@@ -1874,7 +1880,7 @@ async function writeNow($: Api, st: State, patch: Patch): Promise<boolean> {
   await $.fs.write(file.path, out)
   const rebuilt = await reloadConfig($, st)
   $.ui.toast(UPDATED)
-  if (!rebuilt) throw new Error('rebuild failed after the write')
+  if (!rebuilt) throw new RebuildFailed('rebuild failed after the write')
   return true
 }
 
@@ -2051,6 +2057,261 @@ async function askCommand($: Api, st: State, arg: string | undefined) {
   return `ask ${arg}${note}`
 }
 
+// ---- /route forget: the user takes decisions back -------------------------
+// Removes `confirmed` and `projects` entries and restores a `changed` row to
+// its shipped phase. The frontmatter floors are never touched. `all` and
+// `projects` ask first. Reserved words: a row named like them is edited by
+// hand.
+
+type Target = { label: string; name?: string; only?: 'projects' }
+type Restore = { kind: Kind; name: string; from: string; to: string }
+type ForgetPlan = {
+  confirmed: [Kind, string][]
+  restores: Restore[]
+  kept: string[] // refused restores, with the reason
+  projects: [string, Kind, string][] // repo key, kind, name
+}
+
+const REFUSED = 'forget refused: nothing saved'
+const FORGET_USAGE = 'usage: /route forget <name|all|projects>'
+const BUILTIN_AGENTS: ReadonlySet<string> = new Set(['Explore', 'Plan'])
+const isKind = (v: string): v is Kind => KINDS.some(kind => kind === v)
+
+function targetOf(arg: string): Target {
+  if (arg === 'all') return { label: 'all' }
+  if (arg === 'projects') return { label: 'projects', only: 'projects' }
+  return { label: arg, name: arg }
+}
+
+/** The [kind, name, value] entries of a kind-keyed table the target picks. */
+function decided(tables: unknown, t: Target): [Kind, string, unknown][] {
+  if (!isRecord(tables)) return []
+  return Object.entries(tables).filter(([kind]) => isKind(kind))
+    .flatMap(([kind, rows]) => isRecord(rows) ? Object.keys(rows)
+      .filter(name => t.name === undefined || name === t.name)
+      .map(name => [kind as Kind, name, rows[name]] as [Kind, string, unknown])
+      : [])
+}
+
+/** The restore a `changed` entry allows, or why it is refused. */
+function restoreOf(
+  file: Rec,
+  kind: Kind,
+  name: string,
+  entry: unknown,
+): Restore | string {
+  const { from, to } = isRecord(entry) ? entry : ({} as Rec)
+  if (typeof from !== 'string') return 'no phase recorded to return to'
+  const rows = subRec(file, kind)
+  if (typeof to !== 'string' || !hasKey(rows, name) || rows[name] !== to) {
+    return 'the row differs from the recorded change, edit routing.json'
+  }
+  if (!hasKey(subRec(file, 'phases'), from) &&
+      !hasKey(DEFAULT_CONFIG.phases, from)) {
+    return `${from} is not a known phase`
+  }
+  return { kind, name, from, to }
+}
+
+/** What the target removes from this file, and what it must keep. */
+function forgetPlan(file: Rec, t: Target): ForgetPlan {
+  const plan: ForgetPlan = {
+    confirmed: [], restores: [], kept: [], projects: [],
+  }
+  if (t.only !== 'projects') {
+    for (const [kind, name] of decided(file.confirmed, t)) {
+      plan.confirmed.push([kind, name])
+    }
+    for (const [kind, name, entry] of decided(file.changed, t)) {
+      const done = restoreOf(file, kind, name, entry)
+      if (typeof done === 'string') plan.kept.push(`${kind}.${name}: ${done}`)
+      else plan.restores.push(done)
+    }
+  }
+  const repos = isRecord(file.projects) ? file.projects : {}
+  for (const [repo, tables] of Object.entries(repos)) {
+    for (const [kind, name] of decided(tables, t)) {
+      plan.projects.push([repo, kind, name])
+    }
+  }
+  return plan
+}
+
+const removals = (plan: ForgetPlan): number =>
+  plan.confirmed.length + plan.restores.length + plan.projects.length
+const repoCount = (plan: ForgetPlan): number =>
+  new Set(plan.projects.map(entry => entry[0])).size
+
+/** Deletes one entry; an emptied kind table goes with it. */
+function dropEntry(parent: Rec, kind: string, name: string): void {
+  const rows = subRec(parent, kind)
+  delete rows[name]
+  if (Object.keys(rows).length === 0) delete parent[kind]
+}
+
+function applyPlan(file: Rec, plan: ForgetPlan): void {
+  const changed = subRec(file, 'changed')
+  const projects = subRec(file, 'projects')
+  for (const [kind, name] of plan.confirmed) {
+    dropEntry(subRec(file, 'confirmed'), kind, name)
+  }
+  for (const r of plan.restores) {
+    setKey(subRec(file, r.kind), r.name, r.from)
+    dropEntry(changed, r.kind, r.name)
+  }
+  for (const [repo, kind, name] of plan.projects) {
+    const mine = subRec(projects, repo)
+    dropEntry(mine, kind, name)
+    if (Object.keys(mine).length === 0) delete projects[repo]
+  }
+}
+
+/** Keys of this session's asked set the target covers. */
+function askedKeys(st: State, t: Target): string[] {
+  if (t.only === 'projects') return []
+  if (t.name === undefined) return [...st.asked]
+  const name = t.name
+  return KINDS.map(kind => keyOf({ kind, name })).filter(k => st.asked.has(k))
+}
+
+/** The machine override still sets the row: no forget reaches it. */
+function heldBy(st: State, t: Target): string | undefined {
+  const name = t.name
+  if (name === undefined) return undefined
+  return ROWS.some(kind => hasKey(strTable(st.override?.[kind]), name))
+    ? `~/${OVERRIDE}`
+    : undefined
+}
+
+/** The answer when nothing is written, or undefined when there is work. */
+function idleAnswer(
+  st: State,
+  t: Target,
+  plan: ForgetPlan,
+): string | undefined {
+  if (removals(plan) > 0) return undefined
+  if (plan.kept.length > 0) {
+    return `nothing restored for ${t.label}: ${plan.kept.join('; ')}`
+  }
+  const keys = askedKeys(st, t)
+  if (keys.length === 0) {
+    return t.name === undefined ? 'nothing to forget'
+      : `nothing to forget for ${t.name}`
+  }
+  keys.forEach(key => st.asked.delete(key))
+  const held = heldBy(st, t)
+  return `${t.label}: ${held === undefined
+    ? 'asked again at the next use'
+    : `still decided by ${held}`}, nothing was saved`
+}
+
+async function confirmForget($: Api, plan: ForgetPlan): Promise<boolean> {
+  const text = `Forget ${plural(removals(plan), 'decision')}: ` +
+    `${plan.restores.length} row(s) restored, ${plan.projects.length} ` +
+    `project exception(s) in ${plural(repoCount(plan), 'repo')}?`
+  return (await askOr($, text, ['Cancel', 'Forget'])) === 'Forget'
+}
+
+/** Where a restored row's frontmatter lives; none for a built-in agent. */
+function floorFile(r: Restore): string | undefined {
+  if (r.kind === 'skills') return `skills/${r.name}/SKILL.md`
+  return r.kind === 'agents' && !BUILTIN_AGENTS.has(r.name)
+    ? `agents/${r.name}.md`
+    : undefined
+}
+
+function restoreClause(st: State, r: Restore): string {
+  const route = phaseRoute(st.cfg, r.from) ?? phaseRoute(DEFAULT_CONFIG, r.from)
+  const alias = (route && headAlias(DEFAULT_CONFIG, route)) ?? 'its own model'
+  const values = `${alias} at ${route?.effort ?? 'its own effort'}`
+  const file = floorFile(r)
+  const realign = file === undefined ? '' : `; if ${file} was aligned to ${
+    r.to}, set model: ${alias}, effort: ${route?.effort ?? '-'} and its ` +
+    'lock in lib/tests/model-routing.test.sh, then `make test`'
+  return ` (${r.kind}.${r.name} → ${r.from}: ${values}${realign})`
+}
+
+/** Restored skill rows whose old phase the current run still holds. */
+function runKeeps(st: State, plan: ForgetPlan): string {
+  const live = [st.runMain, st.turnMain].filter(slot =>
+    slot !== null && (slot.source === 'run' || slot.source === 'skill'))
+  const kept = plan.restores.find(r => r.kind === 'skills' &&
+    live.some(slot => slot?.phase === r.to))
+  return kept === undefined ? '' :
+    `; current run may keep ${kept.to}: /route clear to apply`
+}
+
+/** The one answer of every form, from the counts really applied. */
+function forgetAnswer(st: State, t: Target, plan: ForgetPlan): string {
+  const kept = plan.kept.length === 0 ? '' :
+    `, ${plan.kept.length} restore(s) kept: ${plan.kept.join('; ')}`
+  const name = t.name
+  const wins = name !== undefined &&
+    ROWS.some(kind => st.mem.local[kind].has(name))
+    ? `; ~/${OVERRIDE} still sets ${name} and wins here`
+    : ''
+  return `forgot ${t.label}: ${plan.confirmed.length} confirmed, ${
+    plan.restores.length} row(s) restored, ${plan.projects.length} project ` +
+    `exception(s) removed${kept}` +
+    plan.restores.map(r => restoreClause(st, r)).join('') + wins +
+    runKeeps(st, plan) + '; other live sessions see it after /route reload'
+}
+
+/** One writer patch; the plan is recomputed on the file it really holds. */
+async function forgetWrite($: Api, st: State, t: Target, seen: ForgetPlan) {
+  const out: { plan?: ForgetPlan } = {}
+  const patch: Patch = file => {
+    out.plan = forgetPlan(file, t)
+    applyPlan(file, out.plan)
+  }
+  try {
+    if (!(await writeRouting($, st, patch))) return REFUSED
+  } catch (err) {
+    return err instanceof RebuildFailed
+      ? 'saved, config not rebuilt: /route reload'
+      : `forget not applied (${String(err)})`
+  }
+  askedKeys(st, t).forEach(key => st.asked.delete(key))
+  return forgetAnswer(st, t, out.plan ?? seen)
+}
+
+/** A row or phase called `all` or `projects` cannot be reached by name. */
+function reservedNote(file: Rec, t: Target): string {
+  if (t.name !== undefined) return ''
+  const clash = KINDS.some(kind => hasKey(subRec(file, kind), t.label))
+  return clash ? `; a row or phase named ${t.label} is reserved here: ` +
+    `edit ${ROUTING} by hand` : ''
+}
+
+async function forgetFlow($: Api, st: State, t: Target): Promise<string> {
+  await st.writes
+  const file = await readRouting($, text => $.ui.log(text))
+  if (typeof file === 'string') {
+    return `${ROUTING} is missing or unreadable: nothing saved`
+  }
+  const plan = forgetPlan(file.data, t)
+  const idle = idleAnswer(st, t, plan)
+  const note = reservedNote(file.data, t)
+  if (idle !== undefined) return idle + note
+  if (t.name === undefined && !(await confirmForget($, plan))) {
+    return `forget ${t.label} cancelled, nothing written` + note
+  }
+  return (await forgetWrite($, st, t, plan)) + note
+}
+
+/** The forget holds the single-dialog slot: no first-use dialog under it. */
+async function forgetCommand($: Api, st: State, args: string[]) {
+  if (args.length !== 1) return FORGET_USAGE
+  if (st.asking !== null) return 'answer the open dialog first'
+  const target = targetOf(args[0] ?? '')
+  st.asking = `forget:${target.label}`
+  try {
+    return await forgetFlow($, st, target)
+  } finally {
+    st.asking = null
+  }
+}
+
 // ---- route tool ------------------------------------------------------
 
 async function registerTool($: Api, st: State): Promise<void> {
@@ -2086,7 +2347,8 @@ async function registerCommand($: Api): Promise<void> {
       name: 'route',
       description: 'model-router: show or set the model and effort route',
       argumentHint:
-        '[show|clear|off|on|reload|pending|ask on|off|<phase>|' +
+        '[show|clear|off|on|reload|pending|ask on|off|' +
+        'forget <name|all|projects>|<phase>|' +
         'model=<alias|id> effort=<level>|switch on|off|verbose on|off]',
       immediate: true,
     })

From e31db7b3f32ab9afc2b7d02412e318e65ce4e8c7 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 16:15:29 +0200
Subject: [PATCH 11/12] =?UTF-8?q?chore(model-router):=20routing.json=20dec?=
 =?UTF-8?q?ision=20=E2=80=94=20escalate=20phase=20kept=20(live=20first-use?=
 =?UTF-8?q?=20dialog,=20user=20Keep)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mods/model-router/routing.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mods/model-router/routing.json b/mods/model-router/routing.json
index 4683590..ea38391 100644
--- a/mods/model-router/routing.json
+++ b/mods/model-router/routing.json
@@ -151,7 +151,8 @@
       "verify": "verify",
       "implement": "implement",
       "write": "write",
-      "orchestrate": "orchestrate"
+      "orchestrate": "orchestrate",
+      "escalate": "escalate"
     }
   },
   "changed": {

From 119c2e2fc8797651b0dd1b57c002c082cd3f2188 Mon Sep 17 00:00:00 2001
From: bchanot <bchanot@gmail.fr>
Date: Sun, 11 Oct 2026 16:15:29 +0200
Subject: [PATCH 12/12] =?UTF-8?q?chore(memory):=20BDR-116=20amendment=20(f?=
 =?UTF-8?q?orget)=20+=20journal/TODO/contract=20w3c=20=E2=80=94=20feat=20m?=
 =?UTF-8?q?odel-router=20wave=203-C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .claude/memory/decisions.md                   |   1 +
 .claude/memory/journal.md                     |   1 +
 .claude/tasks/TODO.md                         |   2 +
 ...2026-10-11-model-router-w3c-forget-1457.md |  32 ++++
 ...2026-10-11-model-router-w3c-forget-1457.md | 155 ++++++++++++++++++
 5 files changed, 191 insertions(+)
 create mode 100644 .claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md
 create mode 100644 .claude/tasks/plans/2026-10-11-model-router-w3c-forget-1457.md

diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md
index 1f14a51..db80814 100644
--- a/.claude/memory/decisions.md
+++ b/.claude/memory/decisions.md
@@ -1412,4 +1412,5 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Gates**: plan r1 → r4 (simplicity CONCERNS(3), correctness FATAL(8) with the census BLOCKER, robustness CONCERNS(8) after a network-killed first run, confirmation CONCERNS(6)); feater DONE + 4 rounds; GATE 0 MET; verifier ECARTS(3)/(2) → CONFORME, re-verify after security ECARTS(1) → fixtures; security BLOCK(1) real (password with `@`/`/` stored in the key) → fixed, PASS. Kit 86 → 190 tests. Live T2 dialogs answered by the user from the hot-loaded working-tree mod ([[LRN-212]]).
 - **Refs**: contract `.claude/tasks/contracts/2026-10-10-model-router-w3a-confirm-1201.md`, plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md`, commit 22455c0, [[BDR-115]], [[LRN-210]], [[LRN-211]], [[EVAL-043]].
 - **Amendment (2026-10-11, wave 3-B, commit 604a6c4)**: clause (2) superseded: the dialog carries CONTEXT (skill description = first sentence of its SKILL.md frontmatter, five YAML forms, hardened read: name allowlist, stat kind file, size cap, `clean()` Cc/Cf + code points; agent description from `agent.offer`, bounded cache; phase `about` line, new 120-char field on the 11 routing.json phases, kept in memory not on Route) and the REAL next model id + effort. Options Later / Keep / Change (T3 Later / Keep). Change = model (4 fixed alias labels with tier role) → effort among those the phases headed by that alias offer (ascending, ≤ 4, one → skipped, zero → Later) → scope; the pair maps to an existing PHASE (rows stay phase names; row's current phase wins a tie; same phase = Keep); a pair no phase offers = a new phase by hand. Other anywhere = Later + toast (no echo). A main-row change toasts the real decision + `/route switch on` hint on a held downgrade. Three lenses rejected inline-route rows and dialog phase edits (2 BLOCKERs). First real use: user moved security-auditor to `judge` (opus/xhigh) through it; floor aligned (`model: opus`, 2026-10-11). Links [[EVAL-044]].
+- **Amendment (2026-10-11, wave 3-C, commit cd8d72f)**: clause (6) extended: `/route forget <name|all|projects>` (composer only) clears decisions in the tracked file through the same writer: a name in every table (`confirmed`, `changed` → row restored to its recorded `from` when it is a string, the row still equals `to` and `from` is a known phase; `projects[*]` pruned), asked again at once; `all`/`projects` confirm through the engine dialog (Cancel first, anything else = cancelled) and hold the single-dialog slot; nothing written when nothing to forget; the answer names a restored row's file + values to realign (a floor aligned to the decision makes the census FAIL after the restore). No per-user decisions file (user: "seulement le forget"): another user inherits the shared memory and may forget. Residuals (security LOW/MEDIUM): raw error text in the answer, file fragments unsanitized in the answer, `floorFile` name not allowlisted, `__proto__` plan/apply mismatch, `changed.phases` restorable. Links [[EVAL-044]].
 
diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md
index 066af3f..06772d6 100644
--- a/.claude/memory/journal.md
+++ b/.claude/memory/journal.md
@@ -598,3 +598,4 @@ rules:
 ## 2026-10-11
 - model-router W3-A (first-use confirmation) landed 22455c0 on feature/model-router-confirm. User asked for it after the W2 merge; 3 pass-B answers. Plan r1→r4: correctness BLOCKER (Everywhere decision = census red → `changed` WARN exemption), robustness (first challenger killed by DNS, fresh one: project-tree layer dropped for security, single dialog in flight, keep-previous after first load), confirmation CONCERNS(6). Feater DONE (169 tests) + 4 rounds. Verifier ECARTS(3)/(2)/CONFORME; security BLOCK(1) REAL: password with `@`/`/` landed in the tracked key → strict parsing, no `local:` keys, output cap → re-verify ECARTS(1) fixtures → PASS. The working-tree mod was hot-loaded by the engine: my own dispatches opened T2 dialogs the user answered (verifier Keep, feater Keep, security-auditor → implement → user reset to verify); first misread as a test leak (LRN-212). GATE 0 oracle as heredoc not runnable → script. Full make test green (env red only). Docs P1-P13 user-approved (patch in flight); BDR-116, LRN-212, EVAL-043 written. Next: doc commit, memory commit, user merge + publish by hand; T1/T3 live checks open.
 - model-router W3-B (dialog with context) landed 604a6c4 + data 32b71d2 + floor chore. User asked after W3-A: explain what is decided, OK/change/later, model then effort then scope. Plan r1→r3: all three lenses killed my inline-row format and the T3 phase edit (2 BLOCKERs avoided); efforts derived from the phases of the chosen model. Feater DONE first pass (229 tests), verifier ECARTS(2)→(1)→CONFORME, security PASS. GATE 0 heredoc CHECK not runnable again → script. Live during the gates: user answered the NEW dialog for security-auditor → opus/xhigh (the request's example; kept, floor aligned to opus, model-routing lock updated), plan-challenger → verify (reset on user go), orchestrate Keep (T3 check done). My `changed = {}` reset wiped a legit entry → census red for one commit → restored. Docs P1-P6 approved (patch in flight), BDR-116 amendment + EVAL-044 written. Next: doc commit, memory commit, user merge of feature/model-router-confirm (W3-A + W3-B) + publish by hand; T1 live check still open.
+- model-router W3-C `/route forget` landed cd8d72f (+ data commit: escalate Keep). User asked whether decisions can be cleared and what another user can do; chose the command only, no per-user file. Plan r1→r3: three lenses CONCERNS (false `st.mem` premise, kind order, docs scope, census red after restoring an aligned floor, no confirmation on `all`), confirmation CONCERNS(3). Feater DONE; verifier ECARTS(2) with a REAL typo (`ForgetPlan`), then coverage only ×2 → cap → user accepted; security PASS (1 MEDIUM + 4 LOW parked). My own `route(escalate)` call opened the T3 dialog the user Kept. Branch feature/model-router-confirm now carries W3-A/B/C (14 commits), unmerged, unpushed; merge on signal; full make test running.
diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md
index 91412fc..73b575e 100644
--- a/.claude/tasks/TODO.md
+++ b/.claude/tasks/TODO.md
@@ -29,6 +29,8 @@ Plan `.claude/tasks/plans/2026-10-10-model-router-w3a-confirm-1201.md` r4, contr
 - [x] W3-B dialog with context (2026-10-11, 604a6c4, contract `2026-10-11-model-router-w3b-dialog-1240`, plan r3): descriptions (skill frontmatter / agent.offer / phase `about`), real id + effort in the question, Later / Keep / Change, model → effort (derived from the phases of that model) → scope, rows stay phases, T3 Later/Keep. 3 lenses (2 BLOCKERs on my r1 avoided) + 1 confirmation, feater + 2 rounds, verifier CONFORME (3rd), security PASS (4 LOW: symlinked SKILL.md read, TOCTOU, raw key in a log, any plugin hooking AskUserQuestion could answer). Live decisions: security-auditor → judge (kept, floor aligned `model: opus`), plan-challenger → verify (reset on user go), orchestrate Keep (T3 live check done).
 - [ ] W3-B residuals: a Change answered Everywhere can store a machine-only phase name (defined in `~/.claude/model-router.json`) into the tracked file (security note, correctness); SKILL.md symlink follow (LOW); `descs` cap and "(custom)" label untested; the security-auditor's `changed.from = verify` entry stays in routing.json although the floor now equals the row (harmless; prune at release).
 - [ ] trace the "auto mode: use Bash/sed instead of Edit/Write" instruction block that sub-agents see attributed to the model-router MCP instructions (security-auditor 2026-10-11): it is NOT in mods/model-router source; likely the harness's own auto-mode text rendered next to the mod's MCP block. Confirm the origin.
+- [x] W3-C `/route forget` (2026-10-11, cd8d72f, contract `2026-10-11-model-router-w3c-forget-1457`, plan r3): name/all/projects, guarded restore, confirmation dialog for all/projects, no-write paths, docs. 3 lenses + 1 confirmation, feater + 3 rounds (1 real defect: `ForgetPlan` typo), verifier at the cap on coverage (user accepted), security PASS. Kit 232 → 284. Live: orchestrate + escalate T3 Keeps seen.
+- [ ] W3-C residuals (security, accepted): `forget not applied (${String(err)})` echoes the raw writer error (send to the log); file-sourced `from`/`to`/keys unsanitized in the answer (clean() them); `floorFile` builds a display path from an unvalidated key (SKILL_NAME check); `__proto__` accepted by `restoreOf` while `setKey` refuses it (plan/apply mismatch); `changed.phases` entries restorable (limit the scan to ROWS). Live smoke of `/route forget` from the terminal still unseen (criterion 7).
 - [ ] W3-A live checks still open: T1 (typed `/feat` etc.) dialog (T3 seen live 2026-10-11: orchestrate Keep); a parallel same-agent dispatch answered after > 10 s; what an unanswered dialog resolves to on the terminal (must be Later or nothing written). Record in the contract as `[gated]` when seen.
 - [ ] W3-A residuals (security LOW, accepted): non-atomic cross-process write (two sessions, crash mid-write → file reads as failed, previous config kept); `host/path` of a private remote in the tracked file; a persistent write failure re-asks every use (`asked.delete` in the catch); `out.length` vs byte size at the cap; `changePatch` scope 'project' with a vanished key writes Everywhere (cwd change mid-dialog). Deferred: `/route set`, `/route confirm`, `(unconfirmed)` in show, dialog edits of phases, frontmatter auto-alignment, session-start warning when routing.json is dirty, per-machine `projects`.
 - [ ] routing.json ships `confirmed` for verifier/feater (user Keeps) and phases verify/implement: every clone inherits them (by design: decisions travel). Revisit at release if unwanted.
diff --git a/.claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md b/.claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md
new file mode 100644
index 0000000..7267127
--- /dev/null
+++ b/.claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md
@@ -0,0 +1,32 @@
+# CONTRACT — model-router-w3c-forget
+- date: 2026-10-11 | flow: feat | branch: feature/model-router-confirm (continues W3-A/B before their merge)
+- status: active
+
+## REQUEST (verbatim — IMMUTABLE)
+d'ailleurs est-ce quil y a une comande pour clear les decision prise ? si jamais cest un user aure que moi si il peut clean me decisions de routage ?
+[orchestrator proposal: `/route forget <nom|all|projects>` + an optional per-user decisions file] → "seulement le forget"
+
+## CLARIFICATIONS
+Q: scope / A: `/route forget` only; no per-user decisions file (the tracked routing.json stays the shared memory; another user inherits and may forget) [gated 2026-10-11]
+Q: public shape (orchestrator default, user may veto): `/route forget <name>` (a skill row, an agent row or a phase), `/route forget all`, `/route forget projects`; forgetting a changed row RESTORES it to its shipped phase (`changed.from`); the frontmatter floors are never touched (the answer says so when a changed row is restored) [stated 2026-10-11]
+
+Q: GATE 1 cap (verifier ECARTS(2) incl. one real defect `ForgetPlan` → `Plan`, then ECARTS(2)/(2) coverage only; 284 kit tests) / A: user "Accepter et commiter"; security PASS (1 MEDIUM + 4 LOW parked in TODO); live T3 Keeps on orchestrate and escalate seen during the run [gated 2026-10-11]
+
+## ACCEPTANCE CRITERIA
+1. `/route forget <name>` (composer only, exactly one argument): for every kind (skills, agents, phases) removes `confirmed.<kind>.<name>`; restores a `changed` row to its `from` only when `from` is a string, the row exists, equals `changed.to` and `from` is a known phase (else the entry is kept and the answer says why); removes every `projects[*].<kind>.<name>` (emptied tables pruned); drops the key(s) from this session's asked set; nothing removed and nothing asked → "nothing to forget for <name>" with NO write; key only asked this session → reset, no write; refused while a dialog is open; two words → usage. One kit test per clause (folded where one setup proves two).
+2. `/route forget all` and `/route forget projects` ASK FIRST (engine dialog, options Cancel / Forget, Cancel first; anything else, dismissed or headless = cancelled, nothing written; skipped when there is nothing to forget; the forget holds the single-dialog slot while asking): `all` empties `confirmed`, `changed` (rows restored under the same guards) and `projects` and clears the asked set; `projects` empties only `projects`. One kit test per clause.
+3. Writes go through the existing writer only (`writeRouting`: serialized, size-capped, refused when the file is absent or unparsable with the existing toast, config rebuilt after the write); the model (route tool, prompt rules, sub-agents) can never trigger a forget; a non-composer origin is refused like the other `/route` writes. Judged by reading + one kit test (route tool cannot forget) + the existing origin test extended.
+4. One answer formatter: "forgot <label>: <c> confirmed, <m> row(s) restored, <k> project exception(s) removed"; a restored row adds "(<kind>.<name> → <from>: <alias> at <effort>; if <agents/<name>.md | skills/<name>/SKILL.md> was aligned to <to>, set model: <alias>, effort: <effort> and its lock in lib/tests/model-routing.test.sh, then `make test`)" (no file clause for a built-in agent: Explore, Plan); "; ~/.claude/model-router.json still sets <name> and wins here" when the machine override pins it; "; current run may keep <phase>: /route clear to apply" when the run slot came from a restored skill row [wording per plan r3, gated 2026-10-11]; write outcomes: refused → "nothing saved", rebuild failure after a landed write → "saved, config not rebuilt: /route reload". Write outcomes: refused → "nothing saved", rebuild failure after a landed write (dedicated error) → "saved, config not rebuilt: /route reload", any other failure → "forget not applied". One kit test per text.
+5. `lib/effort-shift.md` names `/route forget` in ≤ 2 changed lines; README.md, USAGE.md and CHANGELOG.md no longer claim that only a dialog answer or `/route ask` writes routing.json (one clause each naming `/route forget`); the register.ts writer comment says the same; `/route pending` lists a forgotten key again.
+   CHECK: grep -q 'forget <name|all|projects>' mods/model-router/hooks/register.ts && grep -q '/route forget' lib/effort-shift.md && [ "$(wc -l < lib/effort-shift.md)" -le 66 ] && grep -q 'route forget' README.md && grep -q 'route forget' USAGE.md && grep -q 'route forget' CHANGELOG.md && ! grep -q 'Only a dialog answer or `/route ask on|off` writes' README.md && echo W3C-DOC
+   EXPECT: W3C-DOC
+   EVIDENCE: MET exit=0 marker-found :: W3C-DOC
+6. Kit suite, mods suite and validate green; the census stays green on the shipped file.
+   CHECK: cd mods/model-router && out="$(claude plugin test . 2>&1)" && printf '%s\n' "$out" | grep -qE '[0-9]+ pass' && ! printf '%s\n' "$out" | grep -qE '[1-9][0-9]* fail' && claude plugin validate . 2>&1 | grep -q 'passed' && cd ../.. && make test suite=lib/tests/mods.test.sh 2>&1 | grep -q 'all suites green' && bash lib/tests/effort-routing.test.sh >/dev/null 2>&1 && echo W3C-GREEN
+   EXPECT: W3C-GREEN
+   EVIDENCE: MET exit=0 marker-found :: W3C-GREEN
+
+7. Live smoke (orchestrator + user, after the gates, recorded `[gated]`): one `/route forget` typed in the terminal opens its dialog (`$.ui.ask` from an immediate command) and the answer lands in routing.json.
+
+## FILE SCOPE
+mods/model-router/hooks/register.ts, mods/model-router/hooks/register.test.ts, lib/effort-shift.md, README.md (one clause), USAGE.md (one clause), CHANGELOG.md (one clause under Unreleased)
diff --git a/.claude/tasks/plans/2026-10-11-model-router-w3c-forget-1457.md b/.claude/tasks/plans/2026-10-11-model-router-w3c-forget-1457.md
new file mode 100644
index 0000000..22abbe7
--- /dev/null
+++ b/.claude/tasks/plans/2026-10-11-model-router-w3c-forget-1457.md
@@ -0,0 +1,155 @@
+# PLAN r3 — model-router wave 3-C: `/route forget` (2026-10-11)
+
+r1 → r2 after simplicity CONCERNS(3), correctness CONCERNS(4), robustness
+CONCERNS(4); r2 → r3 after the confirmation (correctness CONCERNS(3)).
+Precedence r3 > r2 > r1. Contract
+`.claude/tasks/contracts/2026-10-11-model-router-w3c-forget-1457.md`.
+Base W3-B (604a6c4 + 32b71d2 + 938c3d1). Corrected facts: `Memory` holds
+ok/ask/askLocal/base/confirmed/about/local/key only (no `changed`, no
+`projects`); the composer gate lives in `registerCommandHook`, not in
+`handleCommand`; `writeNow` always writes once the patch ran and toasts
+UPDATED, returns false on refusal, throws when the rebuild fails after a
+landed write; `show` prints no command list (the only visible list is the
+`argumentHint`); `routeMainBySkill` copies a route into `turnMain`/`runMain`
+and a rebuild never touches those slots; the shipped file holds one changed
+row (security-auditor verify → judge) whose frontmatter floor was aligned
+to `opus`: restoring it without re-aligning the floor makes the census
+FAIL (no `changed` entry = no WARN exemption).
+
+## Behaviour (composer `/route forget <arg>`, exactly ONE argument)
+- Parsing: no arg or more than one → "usage: /route forget <name|all|projects>".
+  Reserved words `all` and `projects`; a row or phase named like them
+  cannot be forgotten by name (answer says "edit routing.json by hand").
+- Guard: while a dialog is open (`st.asking !== null`) → "answer the open
+  dialog first", nothing written. The forget confirmation TAKES the slot
+  itself (`st.asking = 'forget:<target>'` in a try/finally around `askOr`)
+  so no first-use dialog opens under it and two forgets cannot stack.
+- The decision runs on the FRESH file, twice: a PRE-read (after awaiting
+  `st.writes`, so a landed Keep is visible) decides the no-write paths and
+  the confirmation counts; the PATCH itself re-runs `forgetPlan(file,
+  target)` on `writeNow`'s own freshly read `file` (the closure exports the
+  counts actually applied; the answer reports those). Pre-read missing or
+  unparsable → the writer's refusal path ("routing.json is missing or
+  unreadable: nothing saved"); nothing to remove, no refused restore and
+  the key(s) not in `st.asked` → "nothing to forget for <name>" / "nothing
+  to forget", NO write; only a refused restore → its reason, NO write;
+  key(s) only in `st.asked` → reset them, NO write, "asked again at the
+  next use, nothing was saved" (when the key is decided by the machine
+  override or a project row, say "still decided by …" instead).
+- `<name>`: for EVERY kind in KINDS (skills, agents, phases): delete
+  `confirmed.<kind>.<name>`; restore `changed.<kind>.<name>` → row =
+  `from` ONLY when `from` is a string, the row exists, the row equals
+  `changed.to`, and `from` is a phase of `file.phases` or
+  `DEFAULT_CONFIG.phases` (else the entry is kept and the answer says
+  why); delete `projects[k].<kind>.<name>` for every k, pruning an emptied
+  kind table then an emptied `projects[k]`; then `st.asked.delete(key)`.
+- `all`: the same over every entry of `confirmed`, `changed`, `projects`;
+  `projects`: only `projects` emptied. Both ASK FIRST through `askOr`:
+  "Forget <n> decision(s): <m> row(s) restored, <k> project exception(s)
+  in <r> repo(s)?" options ["Cancel", "Forget"] (Cancel first; any other
+  answer, a dismissed dialog or headless = cancelled, nothing written);
+  skipped when every count is zero ("nothing to forget").
+- Write: ONE `writeRouting` patch (the closure carries the counts out);
+  outcomes: false → "nothing saved" (the writer's toast already explains);
+  true → asked keys deleted, config rebuilt; a rebuild failure after a
+  landed write is signalled by a dedicated error class (`RebuildFailed`,
+  thrown by `writeNow` there and only there) → "saved, config not rebuilt:
+  /route reload" (asked keys untouched); any other throw (patch, fs.write)
+  → "forget not applied (<err kind>)", asked keys untouched.
+- Answer, one formatter (used by every form, per restored row): "forgot
+  <label>: <c> confirmed, <m> row(s) restored, <k> project exception(s)
+  removed[, <j> restore(s) kept: <reasons>]" + per restored row " (<kind>.
+  <name> → <from>: <alias> at <effort>; if <file> was aligned to <to>, set
+  model: <alias>, effort: <effort> and its lock in
+  lib/tests/model-routing.test.sh, then `make test`)" where `<file>` =
+  `agents/<name>.md` or `skills/<name>/SKILL.md` (no file clause for a
+  built-in agent such as Explore/Plan), alias = head of the phase's tier in
+  the SHIPPED `DEFAULT_CONFIG.tiers` (or the phase's model), effort from
+  the phase;
+  + "; ~/.claude/model-router.json still sets <name> and wins here" when
+  `mem.local` has it, checked only after a successful rebuild;
+  + "; current run may keep <phase>: /route clear to apply" when a
+  restored SKILL row's `to` phase equals the phase of `runMain` or
+  `turnMain` with source `run`/`skill`;
+  + "; other live sessions see it after /route reload".
+- `all` prunes emptied kind tables in `confirmed`, `changed`, `projects`
+  (a kept unrestorable `changed` entry stays and is reported).
+- `decisions` count = confirmed entries + changed entries + project rows
+  (an entry counted once per table it sits in).
+- The route tool has no `forget`; sub-agents cannot run commands; the
+  origin gate is the existing one in `registerCommandHook`.
+
+## Docs and comments (same commit)
+- `argumentHint` gains `forget <name|all|projects>` (locked by a grep in
+  the contract CHECK, not by a kit test); register.ts comment "Only a
+  dialog answer or `/route ask` writes" → "… or `/route ask` / `/route
+  forget` writes".
+- README.md: the `/route` subcommand list (~138) gains `forget
+  <name|all|projects>` and the writers sentence (~140) names it;
+  USAGE.md: the sentence "`/route pending` liste …, `/route ask off|on`
+  …" (~190) gains `/route forget <nom|all|projects>` (efface une
+  décision, la ligne revient à la phase livrée); CHANGELOG.md: the
+  argument form (~10) and the writers sentence (~11); `lib/effort-shift.md`
+  commands line.
+
+## Steps
+- [ ] S1 `forgetPlan(file, target)` (pure over the fresh file data:
+      removals, restores, counts, skipped restores with reasons) and
+      `forgetCommand($, st, args)` (arity, reserved words, asking guard,
+      read, no-write paths, confirmation for all/projects, write via
+      `writeRouting` with a patch that applies the plan, outcome branches,
+      asked reset, answer); `handleCommand` case `forget`; argumentHint.
+- [ ] S2 docs/comments above.
+- [ ] S3 kit tests, folded: forget a confirmed skill → entry gone, asked
+      again in the same session, `/route pending` lists it; forget a changed
+      agent → row restored, entry gone, the next spawn on the restored model,
+      answer carries the realign clause with the file and values; forget a
+      phase → confirmed.phases gone, T3 asks again; forget a name with a
+      project exception in two repos → both rows removed, emptied keys
+      pruned; undecided row → "nothing to forget", no write; asked-only key
+      → reset, no write; unknown name → "nothing to forget for", no write;
+      arity (two words → usage); reserved word collision answer; open dialog
+      → refused; `all` cancelled → nothing written; `all` confirmed →
+      everything empty, counts in the answer; `projects` → only projects
+      emptied; restore refused (row ≠ to / from unknown) → entry kept, reason;
+      override-pinned row → the "wins here" clause; restored skill with a run
+      slot → the "/route clear" clause; missing file → "nothing saved";
+      rebuild throw → "saved, config not rebuilt"; route tool `clear` leaves
+      decisions; the existing origin test extended with `forget x`;
+      `failWrite` → "forget not applied"; (argumentHint: grep lock in the
+      contract, no kit test).
+- [ ] S4 live smoke after the feater (orchestrator, user): one `/route
+      forget projects` (or a name) typed in the terminal with the dialog
+      answered → recorded `[gated]` in the contract (`$.ui.ask` from an
+      `immediate` command is unverified live).
+- Disposition: honors BDR-116 (user-only writers, same path/caps; the
+  shared tracked memory stays the user's choice), LRN-210 (one clause per
+  test, folded where one setup proves two clauses), LRN-212.
+
+## Challenge ledger (r1 → r2)
+- simp 1, corr 1, rob 2 (false `st.mem` premise) → plan over the fresh
+  file, closure counts, pre-read no-write paths.
+- simp 2, corr 2, rob 7 (kind order, reserved words, no-op writes) → all
+  kinds, removed-count rule, arity, reserved-word answer.
+- simp 3, corr 4/9/10, rob (docs) → docs/comment scope, AC4 = argumentHint.
+- simp 4 (projects form) → kept, one-liner, with the confirmation.
+- simp 5/6, corr 3/7, rob 3/9 (restore + floors + validation) → guarded
+  restore, realign clause with file + values, one formatter.
+- corr 5, rob 8 (override-pinned) → "wins here" clause.
+- corr 6, rob 6 (dialog in flight) → refuse while asking.
+- corr 8, rob 4 (run slot) → "/route clear" clause.
+- rob 1 (no confirmation) → askOr confirmation for all/projects, Cancel first.
+- rob 5 (three write outcomes) → branches.
+- simp 7 (test folds) → S3 folded.
+
+## Confirmation ledger (r2 → r3)
+- conf 1 (throw mapping) → `RebuildFailed` class; other throws "not applied".
+- conf 2 (slot not taken) → forget takes `st.asking` around its askOr.
+- conf 3 (stale plan at write) → patch recomputes on its own file; pre-read
+  awaits `st.writes`; applied counts reported.
+- conf 4 (run-slot rule) → kind skills, source run/skill, phase == `to`.
+- conf 5 (realign clause) → conditional, shipped tiers, no file for built-ins.
+- conf 6 (argumentHint test) → grep lock in the contract CHECK.
+- conf 7 (live dialog from a command) → S4 smoke.
+- conf 8 (ambiguities a-f) → sentences added.
+- conf 9 (docs anchors) → README list + USAGE anchor + CHANGELOG form.