src/model-routing.ts

Functions

Imports

It imports src/auto-merge-policy.ts, src/scope.ts. Imported by src/jobs-claim.ts, src/merge-class.ts, src/model-learning.ts, src/model-routing-pr.ts, src/tools/jobs.ts.

Source

1import { AUTO_MERGE_REFUSED_PATHS } from "./auto-merge-policy";
2import { isMoneyPath } from "./scope";
3
4// AUTOMATIC MODEL ROUTING (capsid/research/design-model-routing.md). Capsid picks the
5// model for every job from its kind and its risk, so nobody chooses a model by hand. The
6// recommendation is a function of the job and the rules below; the rules are data, and
7// they change only through a seat-approved edit here, never from the evidence alone
8// (proposeRuleChanges only proposes).
9//
10// What this module does NOT do: start a session on the model. That is the driver's step
11// (capsid/conventions.md, "Model routing"): a launch passes --model, and an interactive
12// driver runs the job's work in a subagent on the recommended model.
13
14export const JOB_KINDS = ["watcher", "design", "security", "build", "maintenance", "docs", "mechanical", "other"] as const;
15export type JobKind = (typeof JOB_KINDS)[number];
16
17export const isJobKind = (value: unknown): value is JobKind => typeof value === "string" && (JOB_KINDS as readonly string[]).includes(value);
18
19// Claude Code's model aliases (code.claude.com/docs/en/model-config): opusplan is Opus in
20// plan mode and Sonnet for execution. Ordered cheapest first, which is the order the
21// learning step reads "cheaper" and "more capable" in.
22export const MODELS = ["haiku", "sonnet", "opusplan", "opus"] as const;
23type RoutedModel = (typeof MODELS)[number];
24
25const EFFORTS = ["low", "medium", "high"] as const;
26type Effort = (typeof EFFORTS)[number];
27
28// Bumped when ROUTING_RULES, TRIAL_ARMS or KIND_RULES change, and stored with each recommendation's
29// reason, so an outcome can be read against the rules that chose its model.
30export const ROUTING_RULES_VERSION = 2;
31
32// THE WATCHER'S ACTOR, as src/watcher.ts defines it. A literal here so this module does
33// not import the watcher; test/model-routing.test.ts holds the two together.
34export const WATCHER_ACTOR_NAME = "agent:watcher";
35
36// How a job's kind is read when the poster gave none. First match wins. The title is
37// read, never the body: a body is long, and almost every Capsid body mentions backups,
38// secrets and docs.
39const KIND_RULES: ReadonlyArray<{ kind: JobKind; title: RegExp; why: string }> = [
40  { kind: "watcher", title: /^Watcher:/, why: "a watcher finding" },
41  { kind: "design", title: /^Design\b/i, why: "a design job" },
42  { kind: "security", title: /\b(security|OWASP|credential|secret|JWT|authentication)\b/i, why: "names a security surface" },
43  { kind: "build", title: /^Build\b/i, why: "a build job" },
44  { kind: "docs", title: /^(docs?|documentation)\b|^(update|write|fix|rewrite) (the )?(docs?|documentation|readme|changelog)\b/i, why: "documentation" },
45  { kind: "maintenance", title: /^(re-?pin|pin|update|bump)\b|\b(dependenc(y|ies)|renovate|backups?|allotment|allowance|prun(e|ing))\b/i, why: "routine maintenance" },
46  { kind: "mechanical", title: /\b(rename|typo|reformat|find and replace)\b/i, why: "a mechanical edit" },
47];
48
49export interface KindVerdict {
50  kind: JobKind;
51  // "given" (the poster set it), "title" (a KIND_RULES match), "default" (nothing matched).
52  source: "given" | "watcher" | "title" | "default";
53}
54
55export function deriveKind(job: { title: string; posted_by: string; kind?: string | null }): KindVerdict {
56  if (isJobKind(job.kind)) return { kind: job.kind, source: "given" };
57  if (job.posted_by === WATCHER_ACTOR_NAME) return { kind: "watcher", source: "watcher" };
58  const hit = KIND_RULES.find((rule) => rule.title.test(job.title));
59  return hit ? { kind: hit.kind, source: "title" } : { kind: "other", source: "default" };
60}
61
62// RISK.
63
64// Namespaces whose work is risky by what they are: foxhound takes payments
65// (capsid/conventions.md leaves its parity-first rule in force).
66const HIGH_RISK_NAMESPACES: ReadonlyArray<{ namespace: string; why: string }> = [{ namespace: "foxhound", why: "a payments product" }];
67
68// A job that asks the driver for blast radius is risky however it is titled.
69const HIGH_RISK_FLAGS = new Set(["can_merge", "can_direct_write", "can_dispatch", "can_write_workflows", "can_touch_protected", "money_paths"]);
70
71export interface Risk {
72  level: "high" | "routine" | "unread";
73  reasons: string[];
74  // What was read, so "routine" over nothing cannot pass for "routine over a PR's files".
75  files_read: number;
76}
77
78/** Risk before a pull request exists, from what the job says about itself: its
79 *  namespace, the flags it requires and whether it already needs a human. */
80export function riskFromJob(job: { namespace: string; required_flags?: readonly string[]; gate_required?: boolean }): Risk {
81  const reasons: string[] = [];
82  const ns = HIGH_RISK_NAMESPACES.find((n) => n.namespace === job.namespace);
83  if (ns) reasons.push(`${job.namespace} is ${ns.why}`);
84  const flags = (job.required_flags ?? []).filter((f) => HIGH_RISK_FLAGS.has(f));
85  if (flags.length) reasons.push(`requires ${flags.join(", ")}`);
86  if (job.gate_required) reasons.push("needs a human confirmation (push, deploy, secret or merge)");
87  return { level: reasons.length ? "high" : "routine", reasons, files_read: 0 };
88}
89
90export interface ChangedFile {
91  filename: string;
92  previous_filename?: string;
93  status?: string;
94  deletions?: number;
95}
96
97// Deleted lines in one change above which the work is risky however the files are named.
98export const DELETION_LINES_HIGH = 300;
99const BACKUP_PATH = /(^|\/)(backups?|restore[-_a-z]*|dump[-_a-z]*)(\/|[-_.]|$)/i;
100
101/** Risk once a pull request exists, from its changed files: the money paths and the
102 *  refused paths that auto-merge already names, plus deletions and backups. A rename is
103 *  judged under both names. No files is "unread", never "routine". */
104export function riskOf(files: readonly ChangedFile[]): Risk {
105  if (files.length === 0) return { level: "unread", reasons: ["no changed files were read"], files_read: 0 };
106  const reasons = new Set<string>();
107  let deleted = 0;
108  for (const file of files) {
109    for (const path of file.previous_filename ? [file.previous_filename, file.filename] : [file.filename]) {
110      if (isMoneyPath(path)) reasons.add(`${path} is a billing or payment path`);
111      const refused = AUTO_MERGE_REFUSED_PATHS.find(({ pattern }) => pattern.test(path));
112      if (refused) reasons.add(`${path} is ${refused.why}`);
113      if (BACKUP_PATH.test(path)) reasons.add(`${path} is a backup or restore path`);
114    }
115    if (file.status === "removed") reasons.add(`${file.filename} is deleted`);
116    deleted += file.deletions ?? 0;
117  }
118  if (deleted >= DELETION_LINES_HIGH) reasons.add(`${deleted} lines are deleted, at or over ${DELETION_LINES_HIGH}`);
119  return { level: reasons.size ? "high" : "routine", reasons: [...reasons].slice(0, 12), files_read: files.length };
120}
121
122// WORTH A REVIEWER (D5, Dustin 2026-10-09, option b). riskOf stays as it is: it routes
123// models, and for that a dependency bump or a backup document is reason enough for the
124// stronger model. It is too broad to decide where a second reader of the diff earns
125// its cost: over the last 100 merged capsid PRs it flagged about 7 in 10, mostly
126// lockfile and package.json bumps, backup docs and a deleted screenshot. This narrower
127// test asks one question: does the change edit code that enforces something, where a
128// subtle mistake ships quietly? Nothing calls it yet. The advisory reviewer that would
129// is the seat's decision, after this measurement.
130//
131// Only code is judged. A document, an image, a test, a lockfile or a JSON manifest is
132// never the reason on its own: a reviewer reading a version bump or a prose edit adds
133// little that CI and the seat do not already see.
134const CODE_FILE = /\.(ts|tsx|mts|cts|js|mjs|cjs|sql|sh)$/i;
135const WORKFLOW_FILE = /^\.github\/workflows\/[^/]+\.ya?ml$/i;
136const TEST_FILE = /(^|\/)(test|tests|test-integration|e2e|__tests__)\/|\.(test|spec)\.[cm]?[jt]sx?$/i;
137
138// The sources that hold this repo's invariants and credentials but are not on auto-merge's
139// refused list, because a green PR there may still merge (the snapshot, one enforcement
140// point and path mutation invariants, test/write-invariants.test.ts, test/scope.test.ts
141// and test/path-mutation.test.ts, and the login and key paths). The refused list covers the judges; this covers what they guard.
142const GUARD_SOURCES: ReadonlyArray<{ pattern: RegExp; why: string }> = [
143  { pattern: /^src\/store-guards\.ts$/i, why: "the snapshot and audit guard every overwrite and delete runs through" },
144  { pattern: /^src\/tools\/repo\.ts$/i, why: "guardedWrite, the one gate on repo mutations" },
145  { pattern: /^src\/tools\/docs\.ts$/i, why: "pathMutation, the only way a path changes" },
146  { pattern: /^src\/(access-jwt|access-login|ops-session-auth|portal-auth)\.ts$/i, why: "a login or session check" },
147  { pattern: /^src\/(job-signing)\.ts$/i, why: "a key or a signature" },
148  { pattern: /^src\/agents(-admin)?\.ts$/i, why: "the minting and grants of agent credentials" },
149];
150
151export interface ReviewWorthiness {
152  level: "worth" | "skip" | "unread";
153  reasons: string[];
154  files_read: number;
155}
156
157/** Whether a pull request's diff is worth a second reader: code that is money, a judge
158 *  on auto-merge's refused list, a guard or credential source, a migration, a workflow,
159 *  or backup and restore code. A rename is judged under both names. No files is
160 *  "unread", never "skip". Narrower than riskOf by design; see above. */
161export function worthReviewer(files: readonly ChangedFile[]): ReviewWorthiness {
162  if (files.length === 0) return { level: "unread", reasons: ["no changed files were read"], files_read: 0 };
163  const reasons = new Set<string>();
164  for (const file of files) {
165    for (const path of file.previous_filename ? [file.previous_filename, file.filename] : [file.filename]) {
166      const workflow = WORKFLOW_FILE.test(path);
167      if (!workflow && (!CODE_FILE.test(path) || TEST_FILE.test(path))) continue;
168      if (workflow) {
169        reasons.add(`${path} is a workflow, which holds CI's permissions and secrets`);
170        continue;
171      }
172      if (isMoneyPath(path)) reasons.add(`${path} is billing or payment code`);
173      const refused = AUTO_MERGE_REFUSED_PATHS.find(({ pattern }) => pattern.test(path));
174      if (refused) reasons.add(`${path} is ${refused.why}`);
175      const guard = GUARD_SOURCES.find(({ pattern }) => pattern.test(path));
176      if (guard) reasons.add(`${path} is ${guard.why}`);
177      // The Worker's and the scripts' backup code, not the Portal's Backups view.
178      if (BACKUP_PATH.test(path) && /^(src|scripts)\//i.test(path)) reasons.add(`${path} is backup or restore code`);
179    }
180  }
181  return { level: reasons.size ? "worth" : "skip", reasons: [...reasons].slice(0, 12), files_read: files.length };
182}
183
184// THE RULES, as data. First match wins; a high risk comes first, so a routine kind with a
185// risky shape is upgraded rather than left on the cheap model.
186export interface RoutingRule {
187  when: { risk?: "high"; kind?: JobKind };
188  model: RoutedModel;
189  effort: Effort;
190  why: string;
191}
192
193export const ROUTING_RULES: readonly RoutingRule[] = [
194  { when: { risk: "high" }, model: "opus", effort: "high", why: "risky work gets the strongest model" },
195  { when: { kind: "design" }, model: "opus", effort: "high", why: "design is judgment, not execution" },
196  { when: { kind: "security" }, model: "opus", effort: "high", why: "a security change is read as an attacker would" },
197  { when: { kind: "build" }, model: "opusplan", effort: "high", why: "a large build: Opus plans, Sonnet executes" },
198  { when: { kind: "watcher" }, model: "sonnet", effort: "medium", why: "a watcher finding is routine maintenance" },
199  { when: { kind: "maintenance" }, model: "sonnet", effort: "medium", why: "routine maintenance" },
200  { when: { kind: "docs" }, model: "sonnet", effort: "low", why: "documentation" },
201  { when: { kind: "mechanical" }, model: "haiku", effort: "low", why: "a mechanical edit" },
202  { when: {}, model: "opusplan", effort: "medium", why: "no rule names this kind, so the repo default" },
203];
204
205// TRIAL ARMS (job_aef34f6835cd, 2026-10-10). A trial arm sends a fixed share of a kind's
206// routine jobs to another model, so the learning table has outcomes on both models to
207// compare. It switches no kind: the kind's rule above still names its model, and moving
208// a kind is a seat-approved edit to that rule, made when trialStatus says the evidence
209// supports it. Claude Haiku 5.5 (claude-haiku-5-5, released 2026-10-07; the "haiku" alias
210// since Claude Code 2.1.293) costs $0.10 in and $0.50 out per million tokens for prompts
211// up to 100K tokens, against Sonnet 5.5's $2 and $10 (platform.claude.com models overview
212// and claude.com/pricing, read 2026-10-10). Mechanical edits already route to haiku, so
213// they have no arm.
214//
215// An arm keeps the rule's effort, so the comparison is of the model alone. A risky job,
216// or one whose body names its model, never takes an arm. Which jobs take it is a stable
217// hash of the job id, so post and claim agree, and a job's arm never changes.
218export interface TrialArm {
219  kind: JobKind;
220  model: RoutedModel;
221  // The share of the kind's routine jobs the arm takes, in whole percent.
222  percent: number;
223}
224
225export const TRIAL_ARMS: readonly TrialArm[] = [
226  { kind: "watcher", model: "haiku", percent: 25 },
227  { kind: "maintenance", model: "haiku", percent: 25 },
228  { kind: "docs", model: "haiku", percent: 25 },
229];
230
231/** The job's place, 0 to 99, in every trial: FNV-1a over the id. Deterministic and
232 *  synchronous, so the post and every later claim of the job read the same number. */
233export function trialBucket(id: string): number {
234  let hash = 0x811c9dc5;
235  for (let i = 0; i < id.length; i++) {
236    hash ^= id.charCodeAt(i);
237    hash = Math.imul(hash, 0x01000193) >>> 0;
238  }
239  return hash % 100;
240}
241
242export interface Routing {
243  kind: JobKind;
244  kind_source: KindVerdict["source"];
245  model: RoutedModel;
246  effort: Effort;
247  risk: Risk["level"];
248  // The trial arm's model this job was sent to, or null when the rule's model holds.
249  trial: RoutedModel | null;
250  // One line, stored with the job: why this model, under which rules.
251  reason: string;
252  rules_version: number;
253}
254
255// A model a job names for itself, "model: opus" on a line of its own in the body. Read
256// from the body's own text, which the signature covers, so it is the poster's word.
257const NAMED_MODEL = /^\s*model\s*[:=]\s*(haiku|sonnet|opusplan|opus)\s*$/im;
258
259export function routeJob(job: {
260  // The job id, which places the job in a trial arm. Absent, no arm is taken.
261  id?: string | null;
262  title: string;
263  body?: string | null;
264  namespace: string;
265  posted_by: string;
266  kind?: string | null;
267  required_flags?: readonly string[];
268  gate_required?: boolean;
269  // A pull request's risk, where one was read (claim on a job that already carries a PR).
270  pr_risk?: Risk | null;
271}): Routing {
272  const k = deriveKind(job);
273  const fromJob = riskFromJob(job);
274  const risk: Risk = job.pr_risk && job.pr_risk.level === "high" ? job.pr_risk : fromJob;
275  const rule = ROUTING_RULES.find((r) => (r.when.risk ? risk.level === r.when.risk : r.when.kind ? r.when.kind === k.kind : true))!;
276  // A named model may raise a risky job's model, never lower it below the risk rule's.
277  const asked = job.body ? (NAMED_MODEL.exec(job.body)?.[1]?.toLowerCase() as RoutedModel | undefined) : undefined;
278  const overruled = asked !== undefined && rule.when.risk !== undefined && MODELS.indexOf(asked) < MODELS.indexOf(rule.model);
279  const named = overruled ? undefined : asked;
280  // The risk rule comes first, so a rule matched by kind means the job is routine.
281  const arm = !named && rule.when.kind && job.id ? TRIAL_ARMS.find((a) => a.kind === k.kind && a.model !== rule.model) : undefined;
282  const trial = arm && job.id && trialBucket(job.id) < arm.percent ? arm.model : null;
283  const model = named ?? trial ?? rule.model;
284  const why = named
285    ? `the job names ${named}`
286    : risk.level === "high" && rule.when.risk
287      ? `${rule.why}${overruled ? `, not the ${asked} the job names` : ""}: ${risk.reasons.join("; ")}`
288      : trial
289        ? `trial arm: ${trial} on ${arm!.percent} percent of routine ${k.kind} jobs, measured against ${rule.model} (kind ${k.kind}, ${k.source})`
290        : `${rule.why} (kind ${k.kind}, ${k.source})`;
291  return {
292    kind: k.kind,
293    kind_source: k.source,
294    model,
295    effort: rule.effort,
296    risk: risk.level,
297    trial,
298    reason: why.slice(0, 300),
299    rules_version: ROUTING_RULES_VERSION,
300  };
301}
302
303// LEARNING.
304
305// A cell (kind, model) is read only from this many outcomes. Below it a rate is noise: a
306// single merged job reads as 100 percent.
307export const MIN_SAMPLE = 10;
308// A model whose merged-with-green rate for a kind is under this, with enough outcomes,
309// is a reason to propose a more capable one.
310export const RATE_FLOOR = 0.6;
311// How much better a more capable model's rate must be before it is proposed.
312export const RATE_GAIN = 0.1;
313
314export interface OutcomeFact {
315  kind: string | null;
316  // The model Capsid chose (job_outcomes.model_chosen). The session's own model_id only
317  // leaves an outcome out when it names another model (src/model-learning.ts).
318  model: string | null;
319  prs_merged: number | null;
320  ci_green: number | null;
321  corrections: number | null;
322  cost_usd: number | null;
323  tokens: number | null;
324  // Its pull request was later reverted, or its deploy rolled back (src/model-learning.ts).
325  undone?: boolean;
326}
327
328export interface Cell {
329  kind: string;
330  model: string;
331  n: number;
332  // Jobs with a verified merge and green CI that was not later reverted or rolled back, over n.
333  merged_green: number;
334  rate: number;
335  corrections_mean: number | null;
336  cost_mean_usd: number | null;
337  cost_n: number;
338  // Below MIN_SAMPLE: shown, never acted on.
339  enough: boolean;
340}
341
342/** The alias a model id reduces to: "claude-opus-5-5" and "opus" are both opus. A
343 *  model it does not recognise is kept as reported, so it shows as its own cell. */
344export function modelAlias(id: string | null): string | null {
345  if (!id) return null;
346  const lower = id.toLowerCase();
347  for (const alias of ["opusplan", "opus", "sonnet", "haiku"] as const) if (lower.includes(alias)) return alias;
348  return lower.slice(0, 64);
349}
350
351export function cellsOf(facts: readonly OutcomeFact[]): Cell[] {
352  const groups = new Map<string, OutcomeFact[]>();
353  for (const f of facts) {
354    const model = modelAlias(f.model);
355    if (!f.kind || !model) continue;
356    const key = `${f.kind}\u0000${model}`;
357    groups.set(key, [...(groups.get(key) ?? []), { ...f, model }]);
358  }
359  const cells: Cell[] = [];
360  for (const [key, rows] of groups) {
361    const [kind, model] = key.split("\u0000") as [string, string];
362    const good = rows.filter((r) => (r.prs_merged ?? 0) >= 1 && r.ci_green === 1 && !r.undone).length;
363    const corr = rows.filter((r) => r.corrections !== null);
364    const costed = rows.filter((r) => r.cost_usd !== null);
365    cells.push({
366      kind,
367      model,
368      n: rows.length,
369      merged_green: good,
370      rate: good / rows.length,
371      corrections_mean: corr.length ? corr.reduce((s, r) => s + (r.corrections ?? 0), 0) / corr.length : null,
372      cost_mean_usd: costed.length ? costed.reduce((s, r) => s + (r.cost_usd ?? 0), 0) / costed.length : null,
373      cost_n: costed.length,
374      enough: rows.length >= MIN_SAMPLE,
375    });
376  }
377  return cells.sort((a, b) => a.kind.localeCompare(b.kind) || MODELS.indexOf(a.model as RoutedModel) - MODELS.indexOf(b.model as RoutedModel));
378}
379
380export interface Proposal {
381  kind: string;
382  from: string;
383  to: string;
384  why: string;
385}
386
387const rank = (model: string): number => MODELS.indexOf(model as RoutedModel);
388
389/** Rule changes the evidence supports, never applied: the seat approves each (the rules
390 *  are code). Only cells with MIN_SAMPLE outcomes count. A cheaper model is proposed when
391 *  it did as well as the current one; a more capable one when the current one is under the
392 *  floor and the other is clearly better. The current model for a kind is the one its
393 *  routine rule names. */
394export function proposeRuleChanges(cells: readonly Cell[]): Proposal[] {
395  const out: Proposal[] = [];
396  for (const kind of JOB_KINDS) {
397    const rule = ROUTING_RULES.find((r) => r.when.kind === kind) ?? ROUTING_RULES[ROUTING_RULES.length - 1]!;
398    const current = cells.find((c) => c.kind === kind && c.model === rule.model && c.enough);
399    if (!current) continue;
400    const others = cells.filter((c) => c.kind === kind && c.model !== rule.model && c.enough);
401    const cheaper = others.filter((c) => rank(c.model) >= 0 && rank(c.model) < rank(rule.model) && c.rate >= current.rate).sort((a, b) => rank(a.model) - rank(b.model))[0];
402    if (cheaper) {
403      out.push({ kind, from: rule.model, to: cheaper.model, why: `${cheaper.model} merged green ${cheaper.merged_green}/${cheaper.n} against ${current.merged_green}/${current.n} on ${rule.model}` });
404      continue;
405    }
406    const stronger = others.filter((c) => rank(c.model) > rank(rule.model) && c.rate >= current.rate + RATE_GAIN).sort((a, b) => b.rate - a.rate)[0];
407    if (current.rate < RATE_FLOOR && stronger) {
408      out.push({ kind, from: rule.model, to: stronger.model, why: `${rule.model} merged green ${current.merged_green}/${current.n}, under ${RATE_FLOOR * 100} percent, and ${stronger.model} ${stronger.merged_green}/${stronger.n}` });
409    }
410  }
411  return out;
412}
413
414export interface TrialStatus {
415  kind: string;
416  model: string;
417  // The model the kind's rule names, which the arm is measured against.
418  against: string;
419  percent: number;
420  n: number;
421  against_n: number;
422  // "collecting" until both cells hold MIN_SAMPLE outcomes; then whether the evidence
423  // supports moving the kind's rule to the arm's model. Never applied here.
424  verdict: "collecting" | "supports" | "does not support";
425  why: string;
426}
427
428const money = (usd: number | null): string => (usd === null ? "no cost recorded" : `$${usd.toFixed(2)} a job`);
429
430/** Each trial arm read against its kind's rule: what it has collected and whether the
431 *  evidence supports the rule change. "supports" holds exactly when proposeRuleChanges
432 *  proposes that change; the seat makes the edit. */
433export function trialStatus(cells: readonly Cell[]): TrialStatus[] {
434  const proposals = proposeRuleChanges(cells);
435  return TRIAL_ARMS.map((arm) => {
436    const rule = ROUTING_RULES.find((r) => r.when.kind === arm.kind)!;
437    const mine = cells.find((c) => c.kind === arm.kind && c.model === arm.model);
438    const theirs = cells.find((c) => c.kind === arm.kind && c.model === rule.model);
439    const base = { kind: arm.kind, model: arm.model, against: rule.model, percent: arm.percent, n: mine?.n ?? 0, against_n: theirs?.n ?? 0 };
440    if (!mine?.enough || !theirs?.enough) {
441      return { ...base, verdict: "collecting" as const, why: `${base.n} of ${MIN_SAMPLE} outcomes on ${arm.model} and ${base.against_n} of ${MIN_SAMPLE} on ${rule.model}; nothing is read from fewer` };
442    }
443    const scores = `${arm.model} merged green ${mine.merged_green}/${mine.n} at ${money(mine.cost_mean_usd)}, ${rule.model} ${theirs.merged_green}/${theirs.n} at ${money(theirs.cost_mean_usd)}`;
444    const proposed = proposals.some((p) => p.kind === arm.kind && p.to === arm.model);
445    return proposed
446      ? { ...base, verdict: "supports" as const, why: `${scores}: the evidence supports moving ${arm.kind} to ${arm.model}, for the seat to approve` }
447      : { ...base, verdict: "does not support" as const, why: `${scores}: ${arm.kind} stays on ${rule.model}` };
448  });
449}