diff --git a/PERF.md b/PERF.md
index e6b9c9bfb2..a0bb07078b 100644
--- a/PERF.md
+++ b/PERF.md
@@ -1136,8 +1136,8 @@ and an explicit zero temperature or output limit is preserved.
 Explicit choices remain explicit. `CODEAF_REASONING`,
 `CODEAF_EXEC_REASONING`, a model or crew value with `:low`, `:medium` or
 `:high`, a saved task or standing-work rung, and an embedder's `ai.Option` still
-travel. The three shipped crew presets contain bare model ids and add no effort
-level. `cmd/harness-design` is a development command with explicit CLI-sized
+travel. A crew seat nobody pinned is routed to a bare model id and adds no
+effort level. `cmd/harness-design` is a development command with explicit CLI-sized
 requests and retains its caps.
 
 The local process remains bounded independently of provider generation:
diff --git a/README.md b/README.md
index dee128d01d..6866074014 100644
--- a/README.md
+++ b/README.md
@@ -149,22 +149,27 @@ repository.
 
 ## The right model for each call
 
-One session, many models. The model you talk to is one seat. Five more, the
-crew, take the calls you did not type:
+One session, many models. The model you talk to is one seat. Every task you hand
+off runs on a crew of three more, picked for that task from what kind of work it
+is — a bug fix, a complex fix, open-ended work, or something else:
 
-| seat | what it answers |
+| seat | what it does |
 | --- | --- |
-| reflex | memory, titles, the safety gate. Near free, reads every turn. |
-| small work | digests, task names, yes-or-no checks |
-| worker | every task you hand off. Most of the bill. |
-| careful work | checks on finished work, the brief a task is shaped into, vision |
-| mastermind | plans runs and designs subharnesses |
-
-`/crew frugal`, `balanced` or `max` sets all five in one word. Any seat can be
-pinned.
-
-Every finished task is graded by the check it already had to pass. Work that
-keeps failing on the worker seat moves up to careful work on its own, and each
+| worker | does the work. Most of the bill. |
+| planner | plans runs and designs subharnesses |
+| checker | checks finished work before it lands |
+
+The crew is auto by default. Each seat is scored from its catalog metadata by
+learned weights, moved by how this install's own tasks ended, over every model your
+connected providers serve. `/crew` shows it: the seats, the allowed models, the
+providers, a per-task limit ($5 unless set) and an optional daily cap, and today's
+spend. `/crew pin checker <model>` pins one seat, `/crew models open` limits every
+seat to open-weight models, and `/task --best` or `/task --cheap` moves one task.
+Each task says its crew and what it cost against the estimate, and `/redo
+stronger` runs it again a step up. Two cheap rows, reflex and small work, take
+the small calls you did not type: memory, titles, digests, the safety gate.
+
+Every finished task is graded by the check it already had to pass, and each
 request goes to the provider that has been fastest for that kind of call.
 `codeaf models` prints the ratings.
 
@@ -175,7 +180,7 @@ ChatGPT plan, Ollama and any OpenAI-compatible endpoint.
 
 ## Model Pool
 
-The picker can choose models from what other installs have found. It is on by
+Installs can pool what they have measured about models. It is on by
 default: what an install sends is computed, text-free numbers about the models
 it ran (role, model, a number, which model judged, door, size bucket, day) under
 a per-install nonce, never code,
@@ -183,7 +188,7 @@ prompts, paths or an identity, and `codeaf pool status` shows exactly what is
 waiting to go. Turn it off with `model_pool = off` on the settings sheet or
 `CODEAF_MODEL_POOL=off`; `read` uses the pool and sends nothing, and
 `CODEAF_TELEMETRY=off` caps it at `read` along with the usage counts. The relay
-publishes a signed index the crew picker reads under `picked from = learn`. The index is mirrored on the `model-pool` branch at
+publishes a signed index of what the installs measured. The index is mirrored on the `model-pool` branch at
 `pool/index.json`. The design is [Pareto Crewing](docs/design/model-pool/pareto-crewing.pdf);
 the relay's code is under `relay/`, with a [runbook](docs/design/model-pool/RUNBOOK.md)
 that includes running your own.
diff --git a/audit-notes/settings-inventory.md b/audit-notes/settings-inventory.md
index 21ab4cc0a9..4a087e071c 100644
--- a/audit-notes/settings-inventory.md
+++ b/audit-notes/settings-inventory.md
@@ -39,7 +39,7 @@ sentence of the registry's own Hint (`settings.go:663`).
   rows; a search → every tab's matches under faint headings, and the tab bar
   follows the first match.
 - Providers is led by `modelsSection` (`settings.go:700`): your model,
-  provider, speed guard, routing, prompt profile, crew, then the five tier
+  provider, speed guard, routing, prompt profile, then the five tier
   rows in `roles.Tiers` order (reflex, low, worker, high, mastermind), then
   pinned roles. Every other row follows in registry order
   (`tabRows`, `settings.go:1430`). The registry builds the 10 model rows
@@ -229,12 +229,11 @@ rows land between the roles section and "looking"):
 | lane.guard | speed guard | toggle | bool | on (settings.go:935) | "an answer that is slow to start is asked of the next-best provider as well, and you read whichever replies first. One extra call, under a tenth of spend." | registry `settings.go:2055`, skin `settings.go:703` |
 | routing | routing | cycle | choice: simple/latency/price/off | simple | "one model is served by many providers. simple is the one it ships with and sends no preference of ours — no pinned provider means the router's own default answers, and a pinned provider is the whole request; latency asks for the fastest and demotes one that keeps being slow; price asks for the cheapest; off asks for nothing, measures nothing, and leaves the two rows above it with no provider to name. a change here takes effect on your next message." | registry `settings.go:1999`, skin `settings.go:779` |
 | prompt.profile | prompt profile | cycle | choice: auto/lean/full | auto | "how much codeaf tells the model before you type. auto reads the model's context window and goes lean under 32,000 tokens; lean and full say so yourself, for a provider that reports a window its model does not really have." | registry `settings.go:2022`, skin `settings.go:710` |
-| models.crew | crew | cycle | choice: frugal/balanced/max (+ reads custom) | balanced — derived; the five shipped tiers are exactly the balanced preset (`settings.go:1017-1031`) | dynamic, built by `crewAbout` (`settings.go:716`): "the five below, chosen as one word: frugal — …; balanced — …; max — …. Answer one yourself and this reads custom." (the preset sentences come from `config.CrewLineFor`) | registry `settings.go:2269`, skin `settings.go:322` |
 | models.tiers.reflex | reflex | select | model | mistralai/mistral-nemo (shipped, settings.go:1017) | "near-free · reads every turn — memory, titles, safety" | registry `settings.go:2297`, skin `settings.go:334` |
 | models.tiers.low | small work | select | model | deepseek/deepseek-v4-flash-0731 (shipped) | "cheap · the small calls — names, digests, the safety gate" | registry `settings.go:2306`, skin `settings.go:364` |
-| models.tiers.worker | worker | select | model | z-ai/glm-5.3-flash (shipped) | "does the work · every task, its parts, every run node — most of the bill" | registry `settings.go:2317`, skin `settings.go:368` |
-| models.tiers.high | careful work | select | model | moonshotai/kimi-k3 (shipped) | "careful · checks what must not be wrong — audits, briefs, vision" | registry `settings.go:2327`, skin `settings.go:372` |
-| models.tiers.mastermind | mastermind | text | model, may carry :low/:medium/:high | moonshotai/kimi-k3 (shipped) | "thinks · plans runs and designs harnesses — add :low, :medium or :high" | registry `settings.go:2338`, skin `settings.go:380` |
+| models.tiers.worker | worker | select | model | empty — auto, routed per task | "does the work · every task, its parts, every run node — most of the bill" | registry `settings.go:2317`, skin `settings.go:368` |
+| models.tiers.high | checker | select | model | empty — auto, routed per task | "checks what must not be wrong — audits, briefs, vision" | registry `settings.go:2327`, skin `settings.go:372` |
+| models.tiers.mastermind | planner | text | model, may carry :low/:medium/:high | empty — auto, routed per task | "plans runs and designs harnesses — add :low, :medium or :high" | registry `settings.go:2338` |
 | models.roles | pinned roles | text | text (role:model pairs) | none | "exceptions to the five rows above, one per role: title:openai/gpt-5-mini." | registry `settings.go:2347`, skin `settings.go:386` |
 | model.plan | planning | select | model | blank, "follows execution" | firstSentence of hint: "the model that plans and reviews the work." (full hint `settings.go:2965`: "the model that plans and reviews the work. Empty follows the work model.") | registry `settings.go:2686` (modelRow), skin `settings.go:683` (init) |
 | model.work | execution | select | model | the work model | "the model that does the work." (full hint: "the model that does the work. It changes on the next job.") | registry modelRow; skin init |
@@ -249,7 +248,6 @@ rows land between the roles section and "looking"):
 | effort | thinking | cycle | choice: auto + the effort rungs (auto, plus five explicit levels; `EffortChoices`, `config/effort.go:29`) | auto (effort.Ship = None, `effort/effort.go:63`) | "how hard the model thinks, unless something nearer the work says otherwise. ctrl+v moves the rung of whatever you stand on — the rung beside the model above the message box for one conversation, a task, or a standing item — and ctrl+t in /model dials one model. This row answers for everything nobody dialled." | registry `settings.go:1789`, skin `settings.go:757` |
 | document_engine | reading | cycle | choice: auto/local/free/ocr | auto (config.go:62) | "which rung reads your documents. auto walks local, then free, then paid OCR." | registry `settings.go:1798`, skin `settings.go:680` |
 | api_key | openrouter key | text | text, secret | not set | "the key codeaf talks to models with. A missing default key opens connect openrouter in your browser; paste a replacement here if needed. A change lands on this conversation at once." | registry `settings.go:1829`, skin `settings.go:476` |
-| models.crew.source | model family | cycle | choice: open/all | open (crew.go:86) | "which models the crew word draws from: open weights, or the whole catalog with closed and frontier models in it. Open is the default." | registry `settings.go:2284`, skin `settings.go:341` |
 | reply.guard | reply guard | cycle | choice: on/off | on | "on cuts a reply that has come apart — one line or one letter repeated, alphabets mixed inside words — throws it away and asks once more. Code blocks are never judged." | registry `settings.go:2417`, skin `settings.go:427` |
 
 ### The roles section (generated, not registry rows)
@@ -266,8 +264,8 @@ registered from internal/session init functions. 23 rows in 5 groups:
 | roles · reflex | reflex |
 | roles · small work | title, caption, router, consolidate, task-name, job-name, intake, guardian, sentinel, spellout |
 | roles · worker | worker |
-| roles · careful work | careful, auditor, repair, shaper, vision |
-| roles · mastermind | planner, designer, mark-reader, handoff, division, router-confirm |
+| roles · checker | careful, auditor, repair, shaper, vision |
+| roles · planner | planner, designer, mark-reader, handoff, division, router-confirm |
 
 Each row shows the model the role resolves to right now; a pinned row also says
 "pinned". The one line under a row (verbatim): unpinned → "<description> ·
@@ -378,12 +376,11 @@ branch can, because its registry tops out at 77 (78 with split_pct).
 |---|---|---|
 | model_pool | CategoryModels, choice, label "model pool" (dev settings.go:1911) | fde49a587, #1194 |
 | models.pool.public_key | CategoryModels, text, label "pool key" (dev settings.go:1926) | fde49a587, #1194 |
-| models.crew.pick | CategoryModels, choice, label "picked from" (dev settings.go:2400) | fde49a587, #1194 |
 | telemetry | CategoryInterface, bool, label "telemetry", default on (dev settings.go:2627) | cc8bea7e9, #1095 |
 
-The `Key:` diff between this branch's build and dev's is exactly those four
+The `Key:` diff between this branch's build and dev's is exactly those three
 rows and nothing else: every key this branch has, dev has too, and no key dev
-has is missing here but those four. The four-row difference is fixed rows that
+has is missing here but those three. The three-row difference is fixed rows that
 landed on dev after the fork, not conditional rows and not rows this branch
 retired. The deletion comment at settings.go:3046 names two rows gone outright
 (`practice_demand_pct`, `propose_new_skills`), and an earlier draft of this
@@ -465,16 +462,9 @@ for the word "budget" will not find it — though the search does match the key
   the panel moved the row to Spending as "per conversation" — a person reading
   the Session tab's promise ("this conversation and only this conversation")
   will not find the row that bounds this conversation.
-- THE CREW ROW'S NEIGHBOUR MOVED. The skin comment on "model family"
-  (models.crew.source) claims "it sits directly under the crew word"
-  (settings.go:337), but `modelsSection` does not lead it, so on the drawn
-  Providers tab it reads after the openrouter-key row (and after the roles and
-  services sections when they stand), ~25 rows below the crew word it changes.
-  The comment describes registry order, not the tab's reading order — a
-  redesign should either lead it or fix the comment.
-- "thinking" (effort) vs mastermind's ":high". Two rows both about how hard a
+- "thinking" (effort) vs the planner row's ":high". Two rows both about how hard a
   model thinks; effort's about says it "answers for everything nobody dialled"
-  and names ctrl+v and /model's ctrl+t, and the mastermind row's about says
+  and names ctrl+v and /model's ctrl+t, and the planner row's about says
   "add :low, :medium or :high". The distinction (install-wide rung vs one
   tier's level) is stated only in the about lines.
 - The Connections tab name does double duty: it is the accounts tab, and the
diff --git a/cmd/codeaf/chat.go b/cmd/codeaf/chat.go
index c6b2774801..bb24b413f0 100644
--- a/cmd/codeaf/chat.go
+++ b/cmd/codeaf/chat.go
@@ -166,14 +166,14 @@ func buildBrain(w *chatWindow, session string, opts brainOptions) (*chatBrain, e
 		// then let the machine form print underneath, which said one fact twice.
 		return nil, err
 	}
-	// A tier row that says auto is answered from this catalog (config.AutoModels),
-	// so the word is wired BEFORE the seats handed in are applied — a door whose
-	// ladder answered the word before this line resolved it from nothing. The
-	// read is the same non-blocking one, never a fetch.
+	// The crew router picks its seats from this catalog (config.CrewCatalog),
+	// so it is wired BEFORE the seats handed in are applied — a door whose
+	// ladder routed before this line would have routed from nothing. The read
+	// is the same non-blocking one, never a fetch.
 	modelCatalog := catalog.LoadLazy(context.Background(), catalog.Options{
 		BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: settings.ProfileDir,
 	})
-	config.AutoModels = modelCatalog.ModelsNow
+	seatCrewRows(modelCatalog.ModelsNow)
 	wirePoolIndex(settings.ProfileDir)
 	if opts.seats != nil {
 		applySeats(&settings, *opts.seats)
diff --git a/cmd/codeaf/chatv3.go b/cmd/codeaf/chatv3.go
index ea05abd537..e3d8a35132 100644
--- a/cmd/codeaf/chatv3.go
+++ b/cmd/codeaf/chatv3.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"io"
 	"os"
 	"path/filepath"
@@ -937,7 +938,7 @@ func openV3Launch(proc *v3Process, opts v3Options) (*v3Launch, error) {
 	// engine's own nothing. The ask is built once and a client is made from it
 	// per call, each billed to the judge's own seat.
 	taskLanded := poolJudgeHook(settings, settings.ProfileDir, workspace,
-		config.AutoModels, poolJudgeAsk(settings, settings.ProfileDir), time.Now, "task")
+		config.CrewCatalog, poolJudgeAsk(settings, settings.ProfileDir), time.Now, "task")
 	// The runs a live process would have judged but a process death left unjudged,
 	// and the headless doors that never had this hook: at start, on a goroutine
 	// nobody waits on, judge the resumed session's own final-state nodes and the
@@ -945,7 +946,7 @@ func openV3Launch(proc *v3Process, opts v3Options) (*v3Launch, error) {
 	// process tracker cancels and joins it at close.
 	poolErrandGoCtx(settings.ProfileDir, "pool/judge-sweep", func(ctx context.Context) {
 		poolJudgeSweepRun(ctx, settings, settings.ProfileDir, found.Place.Tasks(),
-			config.AutoModels, poolJudgeAsk(settings, settings.ProfileDir), time.Now)
+			config.CrewCatalog, poolJudgeAsk(settings, settings.ProfileDir), time.Now)
 	})
 
 	cfg := session.Config{
@@ -1627,6 +1628,16 @@ func applyV3Governance(cfg session.Config, profileDir string, yolo, oneModel boo
 	cfg.ApprovalPolicy = policy
 	cfg.RolesSource = source
 	cfg.OneModel = oneModel
+	// EVERY TASK THIS CONVERSATION STARTS IS ROUTED ITS OWN CREW — worker,
+	// planner, checker picked for that task from the profile's allowed models
+	// and pins (internal/config's RouteCrew, internal/session's taskcrew.go).
+	// Under `--one-model` there is no crew: every call rides the conversation's
+	// model, which is what the flag says, so no router is handed over.
+	if !oneModel {
+		cfg.RouteCrew = func(ask config.CrewAsk) (crewroute.Decision, error) {
+			return config.RouteCrew(profileDir, ask)
+		}
+	}
 	cfg.SpendRailUSD = rail
 	// The fallback chain reads PROFILE-ONLY, like the search keys below and
 	// unlike the three rows above it. A repository that could answer this could
@@ -2129,7 +2140,7 @@ func v3SearchSeam(brain *store.Store) tui3.SearchStore {
 // IT IS LIVE. It used to be resolved once, at boot, on the argument that two
 // calls in one conversation must not answer to different settings — and the
 // crew is what makes that argument the wrong way round. A person who types
-// `/crew max` because the planner is not thinking hard enough has said something
+// `/crew pin planner …` because the planner is not thinking hard enough has said something
 // about the run they are about to start, not about the next launch, and a source
 // that made them restart to be heard would be a knob that does nothing on the
 // surface that offers it.
@@ -2260,6 +2271,12 @@ func (c *v3Crew) snapshot() (map[string]string, error) {
 	// the cheapest question in it. The mastermind tier: it plans adaptive runs
 	// and designs saved harnesses, and a repository that could point it at a
 	// model would be spending a visitor's credit on the run it asked for.
+	// A CHECKER NO PROJECT NAMED IS THE CREW'S: its pin, or the router's
+	// standing pick ([config.TierModelAt]) — never an empty row that would
+	// fall to the conversation's model.
+	if strings.TrimSpace(high) == "" {
+		high = config.TierModelAt(c.profileDir, config.ModelTierHigh)
+	}
 	values := map[string]string{
 		roles.TierKey(roles.TierReflex):     config.TierModelAt(c.profileDir, config.ModelTierReflex),
 		roles.TierKey(roles.TierMastermind): config.TierModelAt(c.profileDir, config.ModelTierMastermind),
diff --git a/cmd/codeaf/chatv3_crew_test.go b/cmd/codeaf/chatv3_crew_test.go
index dd9300eec2..adf8b5493f 100644
--- a/cmd/codeaf/chatv3_crew_test.go
+++ b/cmd/codeaf/chatv3_crew_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/roles"
 )
 
@@ -17,8 +18,9 @@ import (
 //
 // It used to be resolved once at boot, on the argument that two calls in one
 // conversation must not answer to different settings. /crew is what makes that
-// the wrong way round — somebody who types `/crew max` because the planner is not
-// thinking hard enough has said something about the run they are about to start.
+// the wrong way round — somebody who types `/crew pin planner …` because the
+// planner is not thinking hard enough has said something about the run they
+// are about to start.
 
 func TestAMidSessionCrewChangeIsHonoredByTheNextCall(t *testing.T) {
 	dir := t.TempDir()
@@ -27,28 +29,16 @@ func TestAMidSessionCrewChangeIsHonoredByTheNextCall(t *testing.T) {
 		t.Fatalf("v3RolesSource: %v", err)
 	}
 
-	// The shipped crew, resolved once. Everything after this is a change made
-	// under a source that is already in use.
-	before, err := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation")
-	if err != nil {
-		t.Fatal(err)
-	}
-	shipped, _ := roles.SplitEffort(config.DefaultMastermindModel)
-	if before != shipped {
-		t.Fatalf("the planner started on %q, want the shipped mastermind's %q", before, shipped)
-	}
-
-	if err := config.ApplyCrew(dir, config.CrewFrugal); err != nil {
-		t.Fatalf("setting the crew to frugal: %v", err)
+	// A pin written under a source that is already in use.
+	if err := config.SetCrewPin(dir, crewroute.Planner, "vendor/first-planner"); err != nil {
+		t.Fatalf("pinning the planner: %v", err)
 	}
 	after, err := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation")
 	if err != nil {
 		t.Fatal(err)
 	}
-	frugal, _ := config.CrewModels(config.CrewFrugal)
-	want, _ := roles.SplitEffort(frugal[config.ModelTierMastermind])
-	if after != want {
-		t.Fatalf("after /crew frugal the planner resolves to %q, want %q", after, want)
+	if after != "vendor/first-planner" {
+		t.Fatalf("after /crew pin the planner resolves to %q, want vendor/first-planner", after)
 	}
 
 	// A single class answered by hand is seen the same way, and so is a pin —
@@ -71,7 +61,7 @@ func TestAMidSessionCrewChangeIsHonoredByTheNextCall(t *testing.T) {
 		t.Fatal(err)
 	}
 	if call.Model != "vendor/thinker" || call.Effort != "high" {
-		t.Fatalf("after a hand-set mastermind the planner resolves to %+v", call)
+		t.Fatalf("after a hand-set planner row the planner resolves to %+v", call)
 	}
 
 	pins, found := registry.Row(config.KeyModelRoles)
@@ -109,7 +99,7 @@ func TestABrokenRowLeavesTheLastGoodCrewInPlace(t *testing.T) {
 	// is then moved by an unrelated write, so the source does rebuild and does
 	// meet the broken row.
 	handEdit(t, dir, "models.roles", "planner")
-	if err := config.ApplyCrew(dir, config.CrewMax); err != nil {
+	if err := config.SetCrewPin(dir, crewroute.Planner, "vendor/max-planner"); err != nil {
 		t.Fatal(err)
 	}
 	if model, _ := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation"); model != "vendor/pinned" {
@@ -119,13 +109,11 @@ func TestABrokenRowLeavesTheLastGoodCrewInPlace(t *testing.T) {
 	// And once the row parses again, the new crew is picked up — a refusal is not
 	// a latch.
 	handEdit(t, dir, "models.roles", "")
-	if err := config.ApplyCrew(dir, config.CrewMax); err != nil {
+	if err := config.SetCrewPin(dir, crewroute.Planner, "vendor/max-planner"); err != nil {
 		t.Fatal(err)
 	}
-	want, _ := config.CrewModels(config.CrewMax)
-	if model, _ := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation"); model != want[config.ModelTierMastermind] {
-		t.Fatalf("after the row parsed again the planner resolves to %q, want the max crew's %q",
-			model, want[config.ModelTierMastermind])
+	if model, _ := roles.Resolve(roles.Source(source), roles.RolePlanner, "vendor/conversation"); model != "vendor/max-planner" {
+		t.Fatalf("after the row parsed again the planner resolves to %q, want the pinned vendor/max-planner", model)
 	}
 }
 
@@ -178,8 +166,8 @@ func TestTheCrewSourceIsSafeUnderConcurrentTurns(t *testing.T) {
 	wait.Add(1)
 	go func() {
 		defer wait.Done()
-		for _, preset := range []string{config.CrewFrugal, config.CrewMax, config.CrewBalanced} {
-			if err := config.ApplyCrew(dir, preset); err != nil {
+		for _, pin := range []string{"vendor/a", "vendor/b", "vendor/c"} {
+			if err := config.SetCrewPin(dir, crewroute.Worker, pin); err != nil {
 				t.Error(err)
 				return
 			}
diff --git a/cmd/codeaf/chatv3_host.go b/cmd/codeaf/chatv3_host.go
index 7e9b8c6257..b5a3f4de88 100644
--- a/cmd/codeaf/chatv3_host.go
+++ b/cmd/codeaf/chatv3_host.go
@@ -620,11 +620,11 @@ func hostOptions(fleet *engineFleet, welcome remote.Welcome, pick bool) (tui3.Op
 	// lets go (#1274): its fetch writes a cache when it lands, and one nobody
 	// joined could write after this window had closed.
 	fleet.own(models.Close)
-	// A tier row that says auto is answered from this catalog (config.AutoModels):
+	// The crew router picks its seats from this catalog (config.CrewCatalog):
 	// the same non-blocking read, never a fetch, and set once at start-up.
-	config.AutoModels = models.ModelsNow
-	// The pool's index is seated beside it, read once here and refreshed in the
-	// background, against the same profile the catalog was read from.
+	seatCrewRows(models.ModelsNow)
+	// The pool's errands start beside it, against the same profile the catalog
+	// was read from.
 	wirePoolIndex(profileDir)
 	// The refresh key in /model asks the same router THIS machine's list came
 	// from, and refills the same shelf — the list is this laptop's list of
diff --git a/cmd/codeaf/chatv3_process.go b/cmd/codeaf/chatv3_process.go
index 7376fe4a71..93c78d8d34 100644
--- a/cmd/codeaf/chatv3_process.go
+++ b/cmd/codeaf/chatv3_process.go
@@ -244,9 +244,9 @@ func openV3ProcessWith(door string, askKey bool) (*v3Process, error) {
 	}
 	processCtx, processStop := context.WithCancel(context.Background())
 	models := catalog.LoadLazy(processCtx, discovery)
-	// A tier row that says auto is answered from this catalog (config.AutoModels):
+	// The crew router picks its seats from this catalog (config.CrewCatalog):
 	// the same non-blocking read, never a fetch, and set once at start-up.
-	config.AutoModels = models.ModelsNow
+	seatCrewRows(models.ModelsNow)
 	wirePoolIndex(settings.ProfileDir)
 	shelf := newV3ModelShelf(models, discovery)
 	shelf.setSources(settings.Sources)
diff --git a/cmd/codeaf/chatv3_roles_test.go b/cmd/codeaf/chatv3_roles_test.go
index 7c07bcaff8..d41a41830d 100644
--- a/cmd/codeaf/chatv3_roles_test.go
+++ b/cmd/codeaf/chatv3_roles_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/roles"
 )
 
@@ -59,21 +60,31 @@ func TestTheDoorsRoleLadderCarriesEveryTier(t *testing.T) {
 		t.Fatalf("the reflex role resolves to %q after the tier was pinned to vendor/tiny", reflex)
 	}
 
-	// EVERY CLASS IS WIRED, each to its own shipped model. The failure this holds
-	// shut is a class the door forgot: a role on it would resolve to the
-	// conversation's model, which is the mistake the reflex arm was added for.
-	// The mastermind's value may carry a level, and Resolve hands back the id
-	// alone — a colon in a model field is a request for a model nobody serves.
-	mastermind, _ := roles.SplitEffort(config.DefaultMastermindModel)
+	// EVERY CLASS IS WIRED. The two small rows ship pointed at a model; the
+	// three crew seats are the crew's — a pin when one is written, the
+	// router's pick otherwise — so pinning them here makes every class answer
+	// with its own model and none with the conversation's. The planner's value
+	// may carry a level, and Resolve hands back the id alone.
+	for seat, pin := range map[crewroute.Seat]string{
+		crewroute.Worker: "vendor/worker", crewroute.Checker: "vendor/checker", crewroute.Planner: "vendor/planner:high",
+	} {
+		if err := config.SetCrewPin(dir, seat, pin); err != nil {
+			t.Fatalf("pinning the %s: %v", seat, err)
+		}
+	}
+	source, err = v3RolesSource(t.TempDir(), dir)
+	if err != nil {
+		t.Fatalf("v3RolesSource: %v", err)
+	}
 	for _, c := range []struct {
 		role roles.Role
 		want string
 	}{
 		{roles.RoleTitle, config.DefaultLowModel},
-		{roles.RoleWorker, config.DefaultWorkerModel},
-		{roles.RoleAuditor, config.DefaultHighModel},
-		{roles.RolePlanner, mastermind},
-		{roles.RoleDesigner, mastermind},
+		{roles.RoleWorker, "vendor/worker"},
+		{roles.RoleAuditor, "vendor/checker"},
+		{roles.RolePlanner, "vendor/planner"},
+		{roles.RoleDesigner, "vendor/planner"},
 	} {
 		model, err := roles.Resolve(roles.Source(source), c.role, "vendor/conversation")
 		if err != nil || model != c.want {
@@ -82,8 +93,8 @@ func TestTheDoorsRoleLadderCarriesEveryTier(t *testing.T) {
 	}
 	// And the level reaches the caller as its own half.
 	call, err := roles.ResolveCall(roles.Source(source), roles.RolePlanner, "vendor/conversation")
-	if _, level := roles.SplitEffort(config.DefaultMastermindModel); err != nil || call.Effort != level {
-		t.Fatalf("the planner resolved to %+v (%v), want the shipped level %q", call, err, level)
+	if err != nil || call.Effort != "high" {
+		t.Fatalf("the planner resolved to %+v (%v), want the pinned level high", call, err)
 	}
 }
 
diff --git a/cmd/codeaf/crewword_door_test.go b/cmd/codeaf/crewword_door_test.go
deleted file mode 100644
index 1a28b3b4bb..0000000000
--- a/cmd/codeaf/crewword_door_test.go
+++ /dev/null
@@ -1,96 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/roles"
-)
-
-// THE TASK DOOR HONORS THE CONFIGURED CREW WORD.
-//
-// The worker seat of every task a proposal hands off is read through
-// internal/roles ([session]'s defaultTaskModel asks for [roles.TierWorker]) off
-// the key map this door builds ([v3RolesSource]). A run that wrote ONE word —
-// `models.crew=frugal`, `models.crew=max` — into config.json used to read the
-// balanced crew for every arm, because the word was never read: the preset is
-// derived from the five tier rows, and the run wrote none of them. The worker
-// and the checker (the careful-work seat) must answer the word the run asked
-// for, not the default it fell to.
-func TestTheTaskDoorHonorsTheConfiguredCrewWord(t *testing.T) {
-	for _, preset := range []string{config.CrewFrugal, config.CrewMax} {
-		dir := t.TempDir()
-		handEdit(t, dir, config.KeyCrew, preset)
-
-		read, err := v3RolesSource(t.TempDir(), dir)
-		if err != nil {
-			t.Fatalf("building the door's key map for crew=%s: %v", preset, err)
-		}
-		row, ok := config.CrewModelsForSource(config.CrewSourceAt(dir), preset)
-		if !ok {
-			t.Fatalf("there is no %s preset in the family the profile names", preset)
-		}
-		// The door's own two questions, in its own words.
-		worker, ok := roles.TierModel(roles.Source(read), roles.TierWorker)
-		if !ok || worker != row[config.ModelTierWorker] {
-			t.Errorf("crew=%s: the door's worker seat reads %q, want the preset's own %q",
-				preset, worker, row[config.ModelTierWorker])
-		}
-		checker, ok := roles.TierModel(roles.Source(read), roles.TierHigh)
-		if !ok || checker != row[config.ModelTierHigh] {
-			t.Errorf("crew=%s: the door's checker seat reads %q, want the preset's own %q",
-				preset, checker, row[config.ModelTierHigh])
-		}
-	}
-}
-
-// AND A PIN THE RUN WROTE SURVIVES THE LEARNED PICK AT THE SAME DOOR. The knee
-// arm pins the crew table's own ids and runs under `models.crew.pick=learn`;
-// the pick used to recompute both seats. The door must answer exactly the ids
-// the run pinned.
-func TestTheTaskDoorKeepsAPinnedSeatUnderLearn(t *testing.T) {
-	balanced, ok := config.CrewModelsForSource(config.DefaultCrewSource, config.CrewBalanced)
-	if !ok {
-		t.Fatalf("there is no %s preset in the %s family", config.CrewBalanced, config.DefaultCrewSource)
-	}
-	// A catalog is held, so the learned pick has something to recompute with —
-	// the shape the benchmark ran, where the pick overrode the pin.
-	previous := config.AutoModels
-	config.AutoModels = func() []catalog.Model { return seatPickRows() }
-	defer func() { config.AutoModels = previous }()
-
-	for _, tc := range []struct {
-		name     string
-		withWord bool
-	}{
-		{"with the stored crew word", true},
-		{"with the pins alone", false},
-	} {
-		dir := t.TempDir()
-		handEdit(t, dir, config.KeyCrewPick, config.CrewPickLearn)
-		if tc.withWord {
-			handEdit(t, dir, config.KeyCrew, config.CrewBalanced)
-		}
-		handEdit(t, dir, config.KeyTierWorkerModel, balanced[config.ModelTierWorker])
-		handEdit(t, dir, config.KeyTierHighModel, balanced[config.ModelTierHigh])
-
-		read, err := v3RolesSource(t.TempDir(), dir)
-		if err != nil {
-			t.Fatalf("%s: building the door's key map: %v", tc.name, err)
-		}
-		for _, seat := range []struct {
-			tier roles.Tier
-			want string
-		}{
-			{roles.TierWorker, balanced[config.ModelTierWorker]},
-			{roles.TierHigh, balanced[config.ModelTierHigh]},
-		} {
-			got, ok := roles.TierModel(roles.Source(read), seat.tier)
-			if !ok || got != seat.want {
-				t.Errorf("%s: the door's %s seat under %s reads %q, want the pin %q",
-					tc.name, seat.tier, config.CrewPickLearn, got, seat.want)
-			}
-		}
-	}
-}
diff --git a/cmd/codeaf/do.go b/cmd/codeaf/do.go
index 50ed45e609..8dc512df8c 100644
--- a/cmd/codeaf/do.go
+++ b/cmd/codeaf/do.go
@@ -7,6 +7,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/router"
 	"io"
 	"log"
 	"os"
@@ -170,7 +172,7 @@ type headlessOutcome struct {
 	Learned []string `json:"learned,omitempty"`
 	// Model and PlanModel are the two seats this errand ran on, and the two
 	// Source fields name the rung that chose each — `--model`, `CODEAF_MODEL`,
-	// `crew frugal`, `default` (config.ResolveSeats). They are here because the
+	// `pinned`, `routed` (config.ResolveSeats). They are here because the
 	// defect that produced them was invisible from outside: a campaign that
 	// believed its profile's crew was in force had no way to read back that the
 	// run had resolved its models somewhere else entirely (#166). A caller
@@ -184,6 +186,14 @@ type headlessOutcome struct {
 	PlanModel       string `json:"plan_model"`
 	ModelSource     string `json:"model_source"`
 	PlanModelSource string `json:"plan_model_source"`
+	// crew is the router's decision for this run — the class it read the task
+	// as, every seat's pick and the estimate — and nil when nothing routed.
+	// The envelope carries it as `class`, `crew`, `est_usd` beside `spend`,
+	// which is the actual (envelope.go's [legacyErrandFields]).
+	crew *crewroute.Decision
+	// checkModel and checkModelSource are the third seat, beside the two
+	// above.
+	checkModel, checkModelSource string
 	// Subharness is the worker that took the deliverable, read back from the
 	// durable row rather than from what was asked for. It is always present and
 	// never empty, because an absent key is indistinguishable from an older
@@ -322,6 +332,14 @@ func runDo(args []string) error {
 	model := flags.String("model", "", modelFlagHelp)
 	planModel := flags.String("plan-model", "", planModelFlagHelp)
 	checkModel := flags.String("check-model", "", checkModelFlagHelp)
+	// HOW HARD TO TRY THIS ONE TASK, said on the command line and sticking to
+	// nothing: --best puts the strongest crew the allowed models make on it,
+	// --cheap the cheapest, and --pin seats one seat for this run alone. The
+	// three seat flags above are one-task pins too (config.ResolveSeats).
+	best := flags.Bool("best", false, "run this task on the strongest crew your allowed models make")
+	cheap := flags.Bool("cheap", false, "run this task on the cheapest crew your allowed models make")
+	var pins pinFlags
+	flags.Var(&pins, "pin", "use one model for this run only: worker=model[@provider], planner=… or checker=… (repeatable)")
 	// A FLAG IS DOCUMENTED BY WHAT IT DOES, NOT BY WHAT IT SETS. These two said
 	// "…; sets CODEAF_CONTEXT_FILL_PCT for this run", which is the
 	// implementation, and hard-coded their defaults in prose while their own
@@ -364,7 +382,18 @@ func runDo(args []string) error {
 	if err != nil {
 		return err
 	}
+	if *best && *cheap {
+		return fmt.Errorf("--best and --cheap ask for two different crews · say one")
+	}
+	effort := crewroute.EffortKnee
+	switch {
+	case *best:
+		effort = crewroute.EffortBest
+	case *cheap:
+		effort = crewroute.EffortCheap
+	}
 	return doErrand(doRequest{
+		effort: effort, pins: pins.pins,
 		task: task, run: run, database: *database, keep: *keep, workspace: *workspace,
 		timeout: wall.wall, asJSON: *asJSON,
 		yesSpend: *yesSpend, model: *model, planModel: *planModel, checkModel: *checkModel,
@@ -390,6 +419,10 @@ type doRequest struct {
 	model      string
 	planModel  string
 	checkModel string
+	// effort and pins are the one-task crew words: --best or --cheap, and
+	// every --pin. They move this run's crew and nothing after it.
+	effort crewroute.Effort
+	pins   map[crewroute.Seat]config.CrewPin
 	// contextFill and completionReserve are this run's two dials on the window
 	// law (internal/ctxbudget). They are integers rather than a struct because
 	// zero has to mean "not asked for": the law's own defaults are the answer
@@ -499,17 +532,66 @@ func doErrand(request doRequest) error {
 	if err == nil {
 		useAutoSeats(settings)
 	}
-	seats := config.ResolveSeats(config.ProfileDir(), request.model, request.planModel)
-	// THE CHECK SEAT RESOLVES AT THE DOOR: its flag, its environment, a plan
-	// seat pinned by flag or environment, then the crew's careful row.
-	seats.Check = config.CheckSeat(request.checkModel, seats.Plan)
+	profileDir := config.ProfileDir()
+	// A PROFILE WRITTEN BEFORE CREWS WERE ROUTED IS MIGRATED ONCE, and the one
+	// line saying so is said here, on stderr, where a person reads the models
+	// line (internal/config's crewmigrate.go).
+	if line, _ := config.MigrateCrew(profileDir); line != "" {
+		fmt.Fprintln(request.stderr, line)
+	}
+	// THE CREW IS ROUTED FOR THIS TASK: the flags and the environment are
+	// one-task pins, a --pin is one too, and every seat nothing named is picked
+	// for what the task reads as (config.ResolveSeats). THE CHECK SEAT IS ITS
+	// OWN SEAT and never inherits the planner's model.
+	repo := request.workspace
+	if repo == "" {
+		repo, _ = os.Getwd()
+	}
+	if abs, err := filepath.Abs(repo); err == nil {
+		repo = abs
+	}
+	seats, err := config.ResolveSeats(profileDir, config.SeatFlags{
+		Model: request.model, PlanModel: request.planModel, CheckModel: request.checkModel,
+	}, config.CrewAsk{
+		Task: crewroute.Task{Text: request.task}, Effort: request.effort, Pins: request.pins, Repo: repo,
+	})
+	if err != nil && !errors.Is(err, config.ErrCrewAtCap) {
+		// A SEAT NOTHING ALLOWED CAN SIT, or a pin that will not route, is said
+		// before anything is opened: there is no crew to run on.
+		if !request.asJSON {
+			return err
+		}
+		outcome := failedErrand(err, started)
+		outcome.run = request.run
+		return reportErrand(request, outcome)
+	}
+	if errors.Is(err, config.ErrCrewAtCap) && !request.yesSpend {
+		// AT THE DAILY CAP A HEADLESS RUN REFUSES: nobody is there to ask, and a
+		// cap that spends anyway is not a cap. -yes-spend is the one way past.
+		capErr := fmt.Errorf("today's crew spend has reached the daily cap of %s · raise it with `/crew cap`, run with --cheap, or pass -yes-spend",
+			crewroute.Money(config.CrewCapAt(profileDir)))
+		if !request.asJSON {
+			return capErr
+		}
+		outcome := failedErrand(capErr, started)
+		outcome.seated(seats)
+		outcome.run = request.run
+		return reportErrand(request, outcome)
+	}
 	fmt.Fprintln(request.stderr, seats.Report())
+	call := router.CrewCallID(request.run)
+	if seats.Crew != nil {
+		config.LogCrewDecision(profileDir, call, *seats.Crew, repo, crewTitle(request.task))
+	}
 	outcome, err := errandRun(request, seats, started)
 	if err != nil {
 		if !request.asJSON {
 			if outcome.recordKept != "" {
 				fmt.Fprintf(request.stderr, "record kept at %s\n", outcome.recordKept)
 			}
+			if seats.Crew != nil {
+				config.LogCrewOutcome(profileDir, call, *seats.Crew, repo, crewTitle(request.task), router.CrewNotKept, 0)
+			}
 			return err
 		}
 		recordKept := outcome.recordKept
@@ -517,6 +599,17 @@ func doErrand(request doRequest) error {
 		outcome.recordKept = recordKept
 	}
 	outcome.seated(seats)
+	// THE CREW'S OUTCOME, beside its decision in the router's log: accepted
+	// when the run came home done, not kept otherwise — and the summary line
+	// with the actual beside the estimate.
+	if seats.Crew != nil {
+		settled := router.CrewNotKept
+		if outcome.resolvedStop() == stopDone {
+			settled = router.CrewAccepted
+		}
+		config.LogCrewOutcome(profileDir, call, *seats.Crew, repo, crewTitle(request.task), settled, outcome.Spend)
+		fmt.Fprintln(request.stderr, "crew: "+seats.Crew.Line(config.PinMark, outcome.Spend))
+	}
 	// THE RUN NAMES ITSELF ON EVERY PATH, including the one where nothing
 	// worked: the id is what joins this object to the rows the model-call log
 	// wrote and to the debug record's folder, and a run that fell over after
@@ -555,6 +648,56 @@ func (o *headlessOutcome) seated(seats config.Seats) {
 	o.PlanModel = seats.Plan.Model
 	o.ModelSource = seats.Work.Rung()
 	o.PlanModelSource = seats.Plan.Rung()
+	o.checkModel, o.checkModelSource = seats.Check.Model, seats.Check.Rung()
+	o.crew = seats.Crew
+}
+
+// crewTitle is the first line of a task, cut short: what the router's log
+// names a headless task by.
+func crewTitle(task string) string {
+	line, _, _ := strings.Cut(strings.TrimSpace(task), "\n")
+	if runes := []rune(line); len(runes) > 80 {
+		line = string(runes[:80]) + "…"
+	}
+	return line
+}
+
+// pinFlags is the repeatable --pin: seat=model[@provider], one per flag.
+type pinFlags struct {
+	pins map[crewroute.Seat]config.CrewPin
+}
+
+func (p *pinFlags) String() string {
+	if p == nil || len(p.pins) == 0 {
+		return ""
+	}
+	var said []string
+	for _, seat := range crewroute.Seats {
+		if pin, ok := p.pins[seat]; ok {
+			said = append(said, string(seat)+"="+pin.String())
+		}
+	}
+	return strings.Join(said, ",")
+}
+
+func (p *pinFlags) Set(raw string) error {
+	seatWord, value, ok := strings.Cut(raw, "=")
+	seat, known := config.ParseCrewSeat(seatWord)
+	if !ok || !known {
+		return fmt.Errorf("--pin takes seat=model[@provider], and the seat is worker, planner or checker")
+	}
+	pin, auto, err := config.ParseCrewPin(value)
+	if err != nil {
+		return err
+	}
+	if auto {
+		return fmt.Errorf("--pin %s=auto pins nothing · leave the flag off to have the seat routed", seat)
+	}
+	if p.pins == nil {
+		p.pins = map[crewroute.Seat]config.CrewPin{}
+	}
+	p.pins[seat] = pin
+	return nil
 }
 
 // errandRun is the errand itself: everything from opening a store to composing
@@ -3529,6 +3672,13 @@ func runErrand(request doRequest, seats config.Seats) (outcome headlessOutcome,
 		}
 		completerFor = crewCompleters(settings, newClient)
 	}
+	// EVERY SEAT CALL IS PRICED BEFORE IT IS MADE (internal/session's
+	// spendguard.go): the day's cap — the daily spending limit too unless
+	// -yes-spend lifted it — the per-task limit, and the checker's own
+	// ceiling on this run.
+	guard := doSpendGuard(config.ProfileDir(), seats.Crew, spendPreauthorized(request.yesSpend, env.Value))
+	unguarded := completerFor
+	completerFor = func(model string) session.Completer { return guard.Wrap(model, unguarded(model)) }
 	// THE REVIEW ROUND IS ON for every `do` run: a leaf that lands done is
 	// checked against its acceptance, and a check that does not hold becomes a
 	// fix task under the leaf's parent the run waits on.
@@ -3720,6 +3870,16 @@ type runSpend struct {
 	refused bool
 }
 
+// doSpendGuard is the guard a `do` run's calls are held to. preauthorized
+// (-yes-spend) lifts the daily spending limit from it and nothing else: the
+// per-task limit holds either way, with or without a routed crew.
+func doSpendGuard(profileDir string, crew *crewroute.Decision, preauthorized bool) *session.SpendGuard {
+	if crew == nil {
+		return session.TaskSpendGuard(profileDir)
+	}
+	return session.CrewSpendGuard(profileDir, *crew, !preauthorized)
+}
+
 // runSpendBound is THE SPENDING CONTRACT `--yes-spend` promises
 // ([yesSpendFlagHelp]): without it, a run stops at the plan-price question's
 // figure and at what is left of today's limit, whichever is nearer; with it,
diff --git a/cmd/codeaf/do_engine_contract_test.go b/cmd/codeaf/do_engine_contract_test.go
index 5db8b6677e..f9e640f9c5 100644
--- a/cmd/codeaf/do_engine_contract_test.go
+++ b/cmd/codeaf/do_engine_contract_test.go
@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/session"
 )
 
@@ -209,6 +210,11 @@ func TestDoOnTheRunEngineYesSpendRunsPastThePlanPrice(t *testing.T) {
 	t.Setenv("CODEAF_PLANDB_BIN", beltPlandbDoor(t))
 	t.Setenv("CODEAF_PLAN_CONSENT", "0.5")
 	t.Setenv("CODEAF_DAILY_BUDGET", "0.5")
+	// The per-task limit is not what this run is about, and --yes-spend does
+	// not lift it: it is raised past what the scripted calls are priced at.
+	if err := config.SetCrewTaskCap(config.ProfileDir(), "1000"); err != nil {
+		t.Fatal(err)
+	}
 	workspace := beltRepoWorkspace(t)
 
 	var stdout, stderr strings.Builder
diff --git a/cmd/codeaf/do_engine_test.go b/cmd/codeaf/do_engine_test.go
index a2a01bfca2..90df20d0dc 100644
--- a/cmd/codeaf/do_engine_test.go
+++ b/cmd/codeaf/do_engine_test.go
@@ -435,7 +435,7 @@ func TestDoOnTheRunEngineSeatsEveryLaunchOnTheDoorsModels(t *testing.T) {
 	var stdout, stderr strings.Builder
 	err = doErrand(doRequest{
 		task: "write out.txt and say what you did", workspace: workspace, asJSON: true,
-		timeout: 60 * time.Second, slots: bound(1), model: workModel, planModel: planModel,
+		timeout: 60 * time.Second, slots: bound(1), model: workModel, planModel: planModel, checkModel: planModel,
 		stdout: &stdout, stderr: &stderr, newBeltCompleter: newBelt,
 	})
 	if err != nil {
diff --git a/cmd/codeaf/do_lock_test.go b/cmd/codeaf/do_lock_test.go
index d0e8f1d5d3..d9c7ccdee5 100644
--- a/cmd/codeaf/do_lock_test.go
+++ b/cmd/codeaf/do_lock_test.go
@@ -31,6 +31,8 @@ func TestDoFailsFastWhenAnotherProcessHoldsTheResidentLock(t *testing.T) {
 	err = doErrand(doRequest{
 		task:     "write the release note",
 		database: path,
+		// Every seat is named, so the crew needs no router to reach the lock.
+		model: "test/model", planModel: "test/model", checkModel: "test/model",
 		// The wall is long and the bound is short on purpose: the thing under
 		// test is that the run leaves on the bound rather than on the wall.
 		timeout:      5 * time.Minute,
diff --git a/cmd/codeaf/do_machine_gate_test.go b/cmd/codeaf/do_machine_gate_test.go
index 2fe0989a01..d220f3a0dd 100644
--- a/cmd/codeaf/do_machine_gate_test.go
+++ b/cmd/codeaf/do_machine_gate_test.go
@@ -39,7 +39,7 @@ func TestDoRunHonoursProfileMachineFloor(t *testing.T) {
 	outcome, err := runErrand(doRequest{
 		task: "do the work", workspace: workspace, timeout: 120 * time.Millisecond,
 		stderr: &stderr, newBeltCompleter: func(string) session.Completer { return seat },
-	}, config.ResolveSeats(profile, "", ""))
+	}, stubErrandSeats())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,7 +55,7 @@ func TestDoRunHonoursProfileMachineFloor(t *testing.T) {
 	outcome, err = runErrand(doRequest{
 		task: "do the work", workspace: workspace, timeout: 30 * time.Second,
 		stderr: &stderr, newBeltCompleter: func(string) session.Completer { return seat },
-	}, config.ResolveSeats(profile, "", ""))
+	}, stubErrandSeats())
 	if err != nil || outcome.Nodes == 0 {
 		t.Fatalf("zeroed machine gate did not start: nodes=%d err=%v", outcome.Nodes, err)
 	}
@@ -88,7 +88,7 @@ func TestDoHeldByTheMachineSaysWhyOnStderrAndInItsStop(t *testing.T) {
 		asJSON: true, stdout: &stdout, stderr: &stderr,
 		newBeltCompleter: func(string) session.Completer { return seat },
 	}
-	outcome, err := runErrand(request, config.ResolveSeats(profile, "", ""))
+	outcome, err := runErrand(request, stubErrandSeats())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -167,3 +167,14 @@ func TestDoSaysAMachineHoldOnceAndItsEndOnce(t *testing.T) {
 		t.Fatal("no gate at all must reach the engine as nil, not as a wrapper around nothing")
 	}
 }
+
+// stubErrandSeats is the crew a stubbed errand runs on: three seats named
+// outright, as flags name them, so the run needs no catalog and no router —
+// the seat's completer is the test's own.
+func stubErrandSeats() config.Seats {
+	return config.Seats{
+		Work:  config.Seat{Role: config.SeatWork, Model: "stub/worker", Source: config.SeatFlag},
+		Plan:  config.Seat{Role: config.SeatPlan, Model: "stub/planner", Source: config.SeatFlag},
+		Check: config.Seat{Role: config.SeatCheck, Model: "stub/checker", Source: config.SeatFlag},
+	}
+}
diff --git a/cmd/codeaf/do_private_store_test.go b/cmd/codeaf/do_private_store_test.go
index f12581ab1f..3103f06934 100644
--- a/cmd/codeaf/do_private_store_test.go
+++ b/cmd/codeaf/do_private_store_test.go
@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/Agent-Field/agentfield/sdk/go/ai"
-	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/session"
 )
 
@@ -65,7 +64,7 @@ func TestDoRunRefusesFileDirectoryBeforeOpeningRecord(t *testing.T) {
 	}
 	seat := &beltSeat{}
 	_, err := runErrand(doRequest{task: "work", workspace: file, timeout: time.Second,
-		newBeltCompleter: func(string) session.Completer { return seat }}, config.ResolveSeats(config.ProfileDir(), "", ""))
+		newBeltCompleter: func(string) session.Completer { return seat }}, stubErrandSeats())
 	if err == nil || !strings.Contains(err.Error(), file) {
 		t.Fatalf("bad --dir error = %v", err)
 	}
@@ -98,7 +97,7 @@ func TestDoRunCreatesMissingDirectoryWithoutRepositoryRecord(t *testing.T) {
 	seat := finishingSeat(0)
 	var stderr strings.Builder
 	outcome, err := runErrand(doRequest{task: "work", workspace: want, timeout: 30 * time.Second,
-		stderr: &stderr, newBeltCompleter: func(string) session.Completer { return seat }}, config.ResolveSeats(config.ProfileDir(), "", ""))
+		stderr: &stderr, newBeltCompleter: func(string) session.Completer { return seat }}, stubErrandSeats())
 	if err != nil || outcome.Nodes == 0 {
 		t.Fatalf("missing --dir did not run: nodes=%d err=%v", outcome.Nodes, err)
 	}
diff --git a/cmd/codeaf/do_test.go b/cmd/codeaf/do_test.go
index 7f80c84bd1..1e076b466e 100644
--- a/cmd/codeaf/do_test.go
+++ b/cmd/codeaf/do_test.go
@@ -919,6 +919,7 @@ func TestJSONPrintsAnObjectWhenTheErrandCannotEvenStart(t *testing.T) {
 	var stdout, stderr strings.Builder
 	err := doErrand(doRequest{
 		task: "write the release note", database: filepath.Join(blocked, "graph.db"),
+		model: "test/model", planModel: "test/model", checkModel: "test/model",
 		asJSON: true, timeout: 10 * time.Second,
 		stdout: &stdout, stderr: &stderr,
 	})
@@ -964,6 +965,7 @@ func TestAFailedErrandWithoutJSONStillJustReturnsTheError(t *testing.T) {
 	var stdout, stderr strings.Builder
 	err := doErrand(doRequest{
 		task: "write the release note", database: filepath.Join(blocked, "graph.db"),
+		model: "test/model", planModel: "test/model", checkModel: "test/model",
 		timeout: 10 * time.Second, stdout: &stdout, stderr: &stderr,
 	})
 	if err == nil || !strings.Contains(err.Error(), "store directory") {
diff --git a/cmd/codeaf/envelope.go b/cmd/codeaf/envelope.go
index 20d8f16fa6..23a94c2297 100644
--- a/cmd/codeaf/envelope.go
+++ b/cmd/codeaf/envelope.go
@@ -550,6 +550,30 @@ func legacyErrandFields(outcome headlessOutcome) map[string]any {
 		"subharness":        outcome.Subharness,
 		"workspace":         outcome.workspace,
 	}
+	// THE CREW THE TASK WAS ROUTED TO, and the third seat beside the two
+	// above: the class the task was read as, each seat's model, route and
+	// whether it was pinned, and the estimate beside `spend`, which is the
+	// actual. Present on every run that was routed, absent on one that
+	// failed before a crew existed.
+	if strings.TrimSpace(outcome.checkModel) != "" {
+		fields["check_model"] = outcome.checkModel
+		fields["check_model_source"] = outcome.checkModelSource
+	}
+	if outcome.crew != nil {
+		fields["class"] = string(outcome.crew.Class)
+		fields["est_usd"] = outcome.crew.EstUSD
+		crew := map[string]any{}
+		for _, pick := range outcome.crew.Crew {
+			crew[string(pick.Seat)] = map[string]any{
+				"model": pick.Model, "provider": pick.Provider, "kind": string(pick.Kind),
+				"pinned": pick.Pinned, "est_usd": pick.CostUSD,
+			}
+		}
+		fields["crew"] = crew
+		if outcome.crew.Effort != "" {
+			fields["effort"] = string(outcome.crew.Effort)
+		}
+	}
 	if fields["artifacts"] == nil {
 		fields["artifacts"] = []string{}
 	}
diff --git a/cmd/codeaf/exec.go b/cmd/codeaf/exec.go
index 24adfb75ee..10f3e4c3af 100644
--- a/cmd/codeaf/exec.go
+++ b/cmd/codeaf/exec.go
@@ -117,7 +117,7 @@ func runExec(args []string) error {
 	// would be the parity it claims in name only. Only the work seat is printed,
 	// because only the work seat runs anything.
 	useAutoSeats(settings)
-	seats := config.ResolveSeats(settings.ProfileDir, *model, *planModel)
+	seats := doorSeats(settings, *model, *planModel, prompt)
 	applySeats(&settings, seats)
 	fmt.Fprintln(os.Stderr, seats.Work.Report())
 	modelCatalog := sharedCatalog(settings)
diff --git a/cmd/codeaf/logs_test.go b/cmd/codeaf/logs_test.go
index e1b1e4835b..ab034a15c9 100644
--- a/cmd/codeaf/logs_test.go
+++ b/cmd/codeaf/logs_test.go
@@ -13,6 +13,8 @@ import (
 	"time"
 
 	"github.com/Agent-Field/codeaf/internal/calllog"
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
 )
 
 // TestMain switches the model-call log OFF for this package and gives the
@@ -46,6 +48,14 @@ func TestMain(m *testing.M) {
 		os.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/v1/rows")
 	}
 	restore := isolateTestEnvironment()
+	// AND THE CREW ROUTER READS ONE FIXED CATALOG. The process's catalog is
+	// seated once, by whichever test first builds it, from whatever server that
+	// test stood up — so every later door would route its unpinned seats against
+	// a stranger's rows, or none. Two priced, tool-serving rows make routing
+	// deterministic for the whole binary; seatCrewCatalog still overrides it for
+	// a test that means a catalog of its own.
+	config.CrewCatalog = func() []catalog.Model { return crewDoorCatalog() }
+	seatCrewRows = func(func() []catalog.Model) {}
 	// AND THE TELEMETRY OFF SWITCH IS CLEARED, because since the pool learned
 	// to hear it (config.ModelPoolResolved) a shell that exports it quiets the
 	// pool to `read`, and every pool test here that means the default would
diff --git a/cmd/codeaf/main.go b/cmd/codeaf/main.go
index cb7154e89d..a1554d49d6 100644
--- a/cmd/codeaf/main.go
+++ b/cmd/codeaf/main.go
@@ -13,6 +13,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"io"
 	"log"
 	"os"
@@ -800,7 +801,7 @@ func runPlanNew(name string, args []string) error {
 		return err
 	}
 	useAutoSeats(settings)
-	seats := config.ResolveSeats(settings.ProfileDir, *model, *planModel)
+	seats := doorSeats(settings, *model, *planModel, goal)
 	applySeats(&settings, seats)
 	workClient, err := settings.Client()
 	if err != nil {
@@ -980,7 +981,7 @@ func runRevise(name string, args []string) error {
 		return err
 	}
 	useAutoSeats(settings)
-	seats := config.ResolveSeats(settings.ProfileDir, *model, *planModel)
+	seats := doorSeats(settings, *model, *planModel, graph.Goal+"\n\n"+event)
 	applySeats(&settings, seats)
 	workClient, err := settings.Client()
 	if err != nil {
@@ -1212,22 +1213,21 @@ func applyModelFlags(settings *config.Config, model, planModel string) {
 	}
 }
 
-// THE TWO MODEL FLAGS SAY THE SAME THING AT EVERY DOOR, so they say it once.
+// THE THREE MODEL FLAGS SAY THE SAME THING AT EVERY DOOR, so they say it once.
 //
-// The wording they replaced was `(default CODEAF_MODEL)`, which named one rung
-// of four and hid the two that decide most runs: a profile's crew, and this
-// build's own default when nobody has said anything at all. A help string that
-// names the whole ladder is the shortest place a person can learn that their
-// crew reaches this command (config.ResolveSeats).
+// Each is a ONE-TASK PIN: the flag, then its variable, then the crew — a pin
+// the profile holds (/crew pin) or the router's pick for this task
+// (config.ResolveSeats). The check seat never falls to the plan seat, and no
+// seat falls to a model this build chose for everybody.
 const (
-	workLadderHelp    = "flag › CODEAF_MODEL › crew › default"
-	planLadderHelp    = "flag › CODEAF_PLAN_MODEL › crew mastermind › the work model"
-	checkLadderHelp   = "flag › CODEAF_CHECK_MODEL › plan pinned by flag or environment › crew careful"
-	modelFlagHelp     = "work model for this run (" + workLadderHelp + ")"
-	planModelFlagHelp = "model that plans, when different from the work model (" + planLadderHelp + ")"
-	// The check seat's ladder names its environment rung and the resolved
-	// plan seat fallback before the crew's careful row.
-	checkModelFlagHelp = "model that checks finished work (" + checkLadderHelp + ")"
+	workLadderHelp    = "flag › CODEAF_MODEL › crew pin › crew routed per task"
+	planLadderHelp    = "flag › CODEAF_PLAN_MODEL › crew pin › crew routed per task"
+	checkLadderHelp   = "flag › CODEAF_CHECK_MODEL › crew pin › crew routed per task"
+	modelFlagHelp     = "work model for this run, a one-task pin (" + workLadderHelp + ")"
+	planModelFlagHelp = "model that plans, a one-task pin (" + planLadderHelp + ")"
+	// The check seat's ladder is its own: a pinned planner says something about
+	// planning and nothing about who grades the work.
+	checkModelFlagHelp = "model that checks finished work, a one-task pin (" + checkLadderHelp + ")"
 )
 
 // yesSpendFlagHelp is what `--yes-spend` MEANS, said once, on both doors that
@@ -1294,6 +1294,32 @@ func debugRecordRoot() string {
 // environment reading underneath. One assignment per seat, so the models a
 // door's receipt names and the clients it then builds cannot be different
 // models.
+// doorSeats is the crew every headless door that is not `codeaf do` runs on:
+// the flags as one-task pins, and every seat nothing named routed for the task
+// text the door has (empty reads as open-ended work, the router's safe
+// default). A profile written before crews were routed is migrated first, with
+// its one line.
+//
+// AT THE DAILY CAP THESE DOORS WARN AND GO ON. `codeaf do` refuses there
+// unless told -yes-spend, because it is the door campaigns run through; these
+// are a person at a terminal running one plan step or one program, and the
+// line on stderr is said before anything is spent. A seat nothing allowed can
+// sit is said too, and the seat is left for the door's own model to fill.
+func doorSeats(settings config.Config, model, planModel, task string) config.Seats {
+	if line, _ := config.MigrateCrew(settings.ProfileDir); line != "" {
+		fmt.Fprintln(os.Stderr, line)
+	}
+	seats, err := config.ResolveSeats(settings.ProfileDir, config.SeatFlags{Model: model, PlanModel: planModel},
+		config.CrewAsk{Task: crewroute.Task{Text: task}})
+	switch {
+	case errors.Is(err, config.ErrCrewAtCap):
+		fmt.Fprintln(os.Stderr, "note: today's crew spend has reached the daily cap · this run goes ahead; `codeaf do` would have stopped")
+	case err != nil:
+		fmt.Fprintln(os.Stderr, "note: "+err.Error())
+	}
+	return seats
+}
+
 func applySeats(settings *config.Config, seats config.Seats) {
 	settings.Model = seats.Work.Model
 	settings.PlanModel = seats.Plan.Model
diff --git a/cmd/codeaf/pool_test.go b/cmd/codeaf/pool_test.go
index 493289f07c..b9469e1538 100644
--- a/cmd/codeaf/pool_test.go
+++ b/cmd/codeaf/pool_test.go
@@ -17,8 +17,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
 	"github.com/Agent-Field/codeaf/internal/home"
 	"github.com/Agent-Field/codeaf/internal/pool/index"
 	"github.com/Agent-Field/codeaf/internal/pool/outbox"
@@ -1155,8 +1153,6 @@ func TestPoolVerifyRefusesADocumentItsKeyDoesNotTrust(t *testing.T) {
 	}
 }
 
-// ── THE SEATED INDEX ────────────────────────────────────────────────────────
-
 // writePoolDoc puts a document where poolIndexFor reads the cache: doc.json
 // under the profile's pool directory.
 func writePoolDoc(t *testing.T, dir, doc string) {
@@ -1170,58 +1166,6 @@ func writePoolDoc(t *testing.T, dir, doc string) {
 	}
 }
 
-// With no cache the reader answers the seed this build carries, and a worker
-// cell is in it — so `learn` has numbers on day one.
-func TestPoolIndexForAnswersTheSeedWithNoCache(t *testing.T) {
-	held := poolIndexFor(t.TempDir(), poolcfg.Resolve("", "", noEnv), poolClock(t))()
-	if held == nil {
-		t.Fatal("no cache and no seed: the reader answered nothing")
-	}
-	worker := false
-	for _, cell := range held.Cells("role_quality") {
-		if cell.Role == "worker" {
-			worker = true
-		}
-	}
-	if !worker {
-		t.Fatal("the seed answered no worker cell")
-	}
-}
-
-// A cached document whose generated day is newer than the seed's wins: the
-// reader hands back the cached numbers rather than the embedded ones.
-func TestPoolIndexForKeepsANewerCache(t *testing.T) {
-	dir := t.TempDir()
-	writePoolDoc(t, dir, `{
-		"schema": 1,
-		"generated": "2026-09-20",
-		"min_installs": 1,
-		"metrics": {"role_quality": {"kind": "gaussian", "dims": ["role", "model"]}},
-		"cells": [{"metric": "role_quality", "role": "worker", "model": "z-ai/glm-5.3", "mean": 75, "sd": 7, "n": 30}]
-	}`)
-	held := poolIndexFor(dir, poolcfg.Resolve("", "", noEnv), poolClock(t))()
-	if held == nil || held.Generated().Format("2006-01-02") != "2026-09-20" {
-		t.Fatalf("a newer cache did not win: %v", held)
-	}
-}
-
-// A cache that does not parse is not a cache: the seed stands in its place.
-func TestPoolIndexForIgnoresAnUnparsableCache(t *testing.T) {
-	dir := t.TempDir()
-	writePoolDoc(t, dir, "{ this is not a document")
-	held := poolIndexFor(dir, poolcfg.Resolve("", "", noEnv), poolClock(t))()
-	if held == nil || held.Generated().Format("2006-01-02") != seedDay(t) {
-		t.Fatalf("an unparsable cache did not fall back to the seed: %v", held)
-	}
-}
-
-// A mode that forbids reading answers no index at all.
-func TestPoolIndexForAnswersNothingWhenTheModeIsOff(t *testing.T) {
-	if held := poolIndexFor(t.TempDir(), poolcfg.Resolve("off", "", noEnv), poolClock(t))(); held != nil {
-		t.Fatal("a mode that forbids reading answered an index")
-	}
-}
-
 // No key in the build means no fetch: the refresh starts no goroutine, which
 // is every run on a build with no key compiled in. A key starts the one fetch,
 // and the mode still has to allow reading.
@@ -1711,77 +1655,6 @@ func TestPoolShowReadsAnUnparsableOwnSheetAsNone(t *testing.T) {
 	}
 }
 
-// The wired reader answers the own sheet's cells — the install's own evidence,
-// read once and parsed once — and an off mode seats nothing at all.
-func TestWirePoolIndexSeatsTheOwnSheetsCells(t *testing.T) {
-	prevIndex, prevOwn := config.AutoIndex, config.AutoOwnCells
-	t.Cleanup(func() { config.AutoIndex, config.AutoOwnCells = prevIndex, prevOwn })
-	stubPoolRefresh(t)
-
-	dir := t.TempDir()
-	seedOwnSheet(t, dir)
-	wirePoolIndex(dir)
-	if config.AutoOwnCells == nil {
-		t.Fatal("the own sheet was not seated")
-	}
-	own := config.AutoOwnCells()
-	want := []crewpick.Cell{
-		{Role: "worker", Model: "a/one", Mean: 85, N: 2},
-		{Role: "worker", Model: "b/two", Mean: 70, N: 1},
-	}
-	if len(own) != len(want) {
-		t.Fatalf("the seated cells are %+v, want %+v", own, want)
-	}
-	for i := range want {
-		if own[i] != want[i] {
-			t.Fatalf("cell %d is %+v, want %+v", i, own[i], want[i])
-		}
-	}
-	if config.AutoIndex == nil || config.AutoIndex() == nil {
-		t.Fatal("the index was not seated beside the own sheet")
-	}
-}
-
-// A mode that forbids reading seats nothing: the own sheet is the pool's own
-// reading, and off is off for the whole of it.
-func TestWirePoolIndexSeatsNothingWhenThePoolIsOff(t *testing.T) {
-	prevIndex, prevOwn := config.AutoIndex, config.AutoOwnCells
-	t.Cleanup(func() { config.AutoIndex, config.AutoOwnCells = prevIndex, prevOwn })
-	t.Setenv("CODEAF_MODEL_POOL", "off")
-	stubPoolRefresh(t)
-
-	dir := t.TempDir()
-	seedOwnSheet(t, dir)
-	wirePoolIndex(dir)
-	if config.AutoOwnCells != nil {
-		t.Fatal("a pool that forbids reading seated the own sheet")
-	}
-	if config.AutoIndex != nil && config.AutoIndex() != nil {
-		t.Fatal("a pool that forbids reading seated an index")
-	}
-}
-
-// An own sheet that does not parse is a loss, not a fault a pick stops for:
-// the wired reader answers nothing rather than a broken sheet's half.
-func TestWirePoolIndexSeatsNothingForAnUnparsableOwnSheet(t *testing.T) {
-	prevOwn := config.AutoOwnCells
-	t.Cleanup(func() { config.AutoOwnCells = prevOwn })
-	stubPoolRefresh(t)
-
-	dir := t.TempDir()
-	poolDir := filepath.Join(dir, "pool")
-	if err := os.MkdirAll(poolDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(poolDir, "own.json"), []byte("not a document"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	wirePoolIndex(dir)
-	if got := config.AutoOwnCells; got != nil && got() != nil {
-		t.Fatal("a broken own sheet was seated")
-	}
-}
-
 // ── THE MIRROR ──────────────────────────────────────────────────────────────
 
 // poolEnv is an environment holding exactly the names given, so a test pins
diff --git a/cmd/codeaf/poolindex.go b/cmd/codeaf/poolindex.go
index cdf8ce6432..1d588c5f38 100644
--- a/cmd/codeaf/poolindex.go
+++ b/cmd/codeaf/poolindex.go
@@ -1,18 +1,16 @@
-// The Model Pool's index, seated at start-up.
+// The Model Pool's index, kept fresh at start-up.
 //
-// The index is a measurement document the crew picker reads a seat's quality
-// from (config.PoolQualityMetric, through config.AutoIndex). A machine that
-// has fetched one keeps it under the profile's pool directory; a machine that
-// has never fetched one still has the index the binary carries
-// (internal/pool/index's Seed), so a tier row that says `auto` has numbers on
-// its first run rather than none.
+// The index is a measurement document the pool publishes: how each model did
+// in each seat across the installs that share their judged runs. A machine
+// that fetches one keeps it under the profile's pool directory, where
+// `codeaf pool` reads it. The one fetch this file makes runs in a goroutine
+// started where the pool is wired, and it never blocks a run: it writes the
+// puller's own cache and the change is read at the NEXT start.
 //
-// READ ONCE, NEVER ON THE RUN'S PATH. [poolIndexFor] parses the cache beside
-// the seed exactly once and hands back a function answering the value it
-// already has, so a pick asks no disk and no lock. The one fetch this file
-// makes runs in a goroutine started where the loader is seated, and it never
-// answers a pick: it writes the puller's own cache and the change is read at
-// the NEXT start. A run's picks must not move under it.
+// Nothing here seats a crew. The crew is routed per task from an evidence
+// table the build carries (internal/crewroute); reading the pool's cells into
+// that router as measured evidence is follow-up work, not something this file
+// half-does.
 package main
 
 import (
@@ -20,55 +18,16 @@ import (
 	"crypto/ed25519"
 	"errors"
 	"log"
-	"os"
-	"path/filepath"
 	"sync"
 	"time"
 
 	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
 	"github.com/Agent-Field/codeaf/internal/guard"
-	"github.com/Agent-Field/codeaf/internal/pool/index"
 	"github.com/Agent-Field/codeaf/internal/pool/poolcfg"
 	"github.com/Agent-Field/codeaf/internal/pool/pull"
-	"github.com/Agent-Field/codeaf/internal/pool/record"
 	"github.com/Agent-Field/codeaf/internal/trace"
 )
 
-// poolIndexFor builds this process's one index reader. The read is
-// start-up work and nothing on a run's path: the document is parsed here,
-// once, and the returned function answers the value already in hand, so a
-// pick over many tiers does no disk and no decode per call.
-//
-// THE CACHE WINS ONLY WHEN IT IS FRESHER. A cached doc.json is handed to
-// index.Fallback beside the embedded seed, which trusts whichever declares
-// the newer generated day — a young cache keeps its numbers, an old or
-// unparsable one leaves the seed in place. A mode that forbids reading
-// (poolcfg.Off) answers no index at all, which is the same nothing the seam
-// read before this file existed.
-//
-// THE ONE ERROR IT CANNOT RECOVER FROM is an embedded seed that does not
-// parse; that answers nil rather than panicking, though a test in the index
-// package parses the very bytes this build carries.
-func poolIndexFor(profileDir string, cfg poolcfg.Config, now func() time.Time) func() *index.Index {
-	if !cfg.CanRead() {
-		return func() *index.Index { return nil }
-	}
-	var cached []byte
-	if doc, err := os.ReadFile(filepath.Join(config.ProfilePath(profileDir, "pool"), "doc.json")); err == nil {
-		cached = doc
-	}
-	held, err := index.Fallback(cached, index.Seed())
-	if err != nil {
-		seed, seedErr := index.SeedIndex()
-		if seedErr != nil {
-			return func() *index.Index { return nil }
-		}
-		held = seed
-	}
-	return func() *index.Index { return held }
-}
-
 // poolRefreshGo is [guard.Go] behind a variable so a test can prove that no
 // goroutine is started when the build carries no key.
 var poolRefreshGo = func(scope string, fn func()) { guard.Go(scope, fn) }
@@ -244,17 +203,11 @@ func poolIndexPull(ctx context.Context, url, poolDir string, ttl time.Duration,
 	return err
 }
 
-// wirePoolIndex seats this process's pool readings beside its catalog: it
-// hands the index reader to seat resolution (config.AutoIndex), the install's
-// own judged scores beside them (config.AutoOwnCells, read off the own sheet
-// under the pool directory), and starts the refresh beside both. It is called
-// once at start-up, from the same places config.AutoModels is set, so a tier
-// row that says `auto` resolves against a prior on every door that resolves a
-// seat.
+// wirePoolIndex starts this process's pool errands: the index refresh, and
+// the push of rows a previous run judged and could not hand over. It is
+// called once at start-up, from the places the catalog is seated.
 func wirePoolIndex(profileDir string) {
 	cfg := config.ModelPoolAt(profileDir)
-	config.AutoIndex = poolIndexFor(profileDir, cfg, time.Now)
-	config.AutoOwnCells = poolOwnCellsFor(profileDir, cfg)
 	// The errands below run on this profile's tracker so the process that
 	// seated them can join them when it closes ([stopPoolErrands]).
 	held := poolErrandsStart(profileDir)
@@ -267,28 +220,3 @@ func wirePoolIndex(profileDir string) {
 		poolErrandGo(profileDir, "pool/push", func() { poolPush(held.ctx, profileDir, cfg, poolPushBudget) })
 	}
 }
-
-// poolOwnCellsFor builds this process's one reader of the install's own judged
-// scores. THE READ IS START-UP WORK AND NOTHING ON A RUN'S PATH, the same
-// posture the index reader keeps: the own sheet under the profile's pool
-// directory is read and parsed here, once, and the returned function answers
-// the cells already in hand, so a pick does no disk and no decode per call.
-// A mode that forbids reading answers nil — the same nothing the seam reads
-// before any sheet exists — and so does a sheet that does not parse, which is
-// said under the debug record's switch and read as absent rather than fatal:
-// an own sheet is the install's own evidence, and a broken one is a loss, not
-// a fault a pick should stop for.
-func poolOwnCellsFor(profileDir string, cfg poolcfg.Config) func() []crewpick.Cell {
-	if !cfg.CanRead() {
-		return nil
-	}
-	sheet, err := record.LoadSheet(record.OwnSheetPath(config.ProfilePath(profileDir, "pool")))
-	if err != nil {
-		if trace.Enabled() {
-			log.Printf("model pool: own sheet: %v", err)
-		}
-		return nil
-	}
-	cells := record.Cells(sheet)
-	return func() []crewpick.Cell { return cells }
-}
diff --git a/cmd/codeaf/pooljudge_close_test.go b/cmd/codeaf/pooljudge_close_test.go
index 00c05c18da..7cf45ae9a7 100644
--- a/cmd/codeaf/pooljudge_close_test.go
+++ b/cmd/codeaf/pooljudge_close_test.go
@@ -167,7 +167,6 @@ func TestJudgeLandingLeftUnjudgedWhenCancelledMidJudge(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolDir := config.ProfilePath(profileDir, "pool")
diff --git a/cmd/codeaf/poolrecord.go b/cmd/codeaf/poolrecord.go
index a463039294..b8cbeedd96 100644
--- a/cmd/codeaf/poolrecord.go
+++ b/cmd/codeaf/poolrecord.go
@@ -30,7 +30,6 @@ import (
 	"github.com/Agent-Field/agentfield/sdk/go/ai"
 	"github.com/Agent-Field/codeaf/internal/catalog"
 	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
 	"github.com/Agent-Field/codeaf/internal/guard"
 	"github.com/Agent-Field/codeaf/internal/lane"
 	"github.com/Agent-Field/codeaf/internal/pool/judge"
@@ -277,12 +276,6 @@ func poolJudgeLandingContext(ctx context.Context, settings config.Config, profil
 	// never judges it again. The live hook writes this but does not read it, so a
 	// resettle still re-judges; only the sweep reads it.
 	markJudged(poolDir, landing.ID, landing.Attempt)
-	// The next pick in this process reads the new cells at once, the same way
-	// the picker reads them at start-up (poolindex.go's poolOwnCellsFor): a
-	// closing one is the install's own evidence and is never held to the
-	// index's min_installs.
-	cells := record.Cells(sheet)
-	config.AutoOwnCells = func() []crewpick.Cell { return cells }
 	// The sheet is saved, so what the recorder appended is the install's own
 	// evidence now; the copies waiting in the outbox leave for the relay
 	// here, on this hook's own goroutine (the session runs TaskLanded on
diff --git a/cmd/codeaf/poolrecord_test.go b/cmd/codeaf/poolrecord_test.go
index e1ddaf1efa..6d1b763cd9 100644
--- a/cmd/codeaf/poolrecord_test.go
+++ b/cmd/codeaf/poolrecord_test.go
@@ -83,14 +83,6 @@ func poolTildeCatalog() []catalog.Model {
 	}
 }
 
-// restoreOwnCells puts the picker's own-cells seam back after a test that
-// repointed it, so no other test in the process reads this test's sheet.
-func restoreOwnCells(t *testing.T) {
-	t.Helper()
-	previous := config.AutoOwnCells
-	t.Cleanup(func() { config.AutoOwnCells = previous })
-}
-
 // TestPoolJudgeHookScoresALandedTaskIntoItsOwnSheetAndAnswersTheNewCells runs
 // one landing through the real hook and reads back the whole of it: one cell
 // per held seat in the install's own sheet, the seam answering those cells at
@@ -100,7 +92,6 @@ func TestPoolJudgeHookScoresALandedTaskIntoItsOwnSheetAndAnswersTheNewCells(t *t
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -132,13 +123,6 @@ func TestPoolJudgeHookScoresALandedTaskIntoItsOwnSheetAndAnswersTheNewCells(t *t
 		}
 	}
 
-	if config.AutoOwnCells == nil {
-		t.Fatal("the picker's own-cells seam was not repointed after the landing")
-	}
-	if answered := config.AutoOwnCells(); len(answered) != 2 {
-		t.Fatalf("the seam answers %d cells, want the 2 the sheet now holds", len(answered))
-	}
-
 	if len(asked) != 2 || asked[0] != "other/judge" || asked[1] != "other/judge" {
 		t.Fatalf("the judge asked %v, want only other/judge — never a model the crew held", asked)
 	}
@@ -174,7 +158,6 @@ func TestPoolJudgeHookSpellsASeatByItsBareModelID(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -265,7 +248,6 @@ func TestWritePendingLandingSpellsThePoolSeatsBare(t *testing.T) {
 // records locally only.
 func TestPoolJudgeHookAppendsOutboxRowsOnlyWhenTheModeSends(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	outboxFile := filepath.Join(config.ProfilePath(profileDir, "pool"), "outbox.jsonl")
@@ -319,7 +301,6 @@ func TestPoolJudgeHookAppendsOutboxRowsOnlyWhenTheModeSends(t *testing.T) {
 func TestPoolJudgeHookDoesNothingUnderModeOff(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "off")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -379,7 +360,6 @@ func TestPoolJudgeHookGivesEachSeatsQuestionItsOwnShareOfTheLandingTime(t *testi
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -462,7 +442,6 @@ func TestPoolJudgeHookStillScoresTheSecondSeatWhenTheFirstSeatsShareRunsOut(t *t
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -525,7 +504,6 @@ func TestPoolJudgeHookRecordsTheJudgeThatScoredTheLanding(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -564,7 +542,6 @@ func TestPoolJudgeHookRecordsTheCandidatesAndReasonWhenEveryJudgeFails(t *testin
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -594,7 +571,6 @@ func TestPoolJudgeHookRecordsTheDeclineWhenThereIsNoCandidate(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -689,7 +665,6 @@ func TestPoolJudgeHookMovesToTheNextCandidateWhenTheCheapestAnswersNothing(t *te
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -767,7 +742,6 @@ func TestPoolJudgeHookWritesNothingWhenEveryCandidateAnswersNothing(t *testing.T
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{}
@@ -839,7 +813,6 @@ func TestPoolJudgeSweepJudgesThePendingRowsAndLeavesARecordOfItself(t *testing.T
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{APIKey: "test-key"}
@@ -889,7 +862,6 @@ func TestPoolJudgeSweepCutByItsBudgetLeavesTheRestAndSaysSo(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	settings := config.Config{APIKey: "test-key"}
@@ -944,7 +916,6 @@ func TestPoolJudgeSweepCutByItsBudgetLeavesTheRestAndSaysSo(t *testing.T) {
 func TestPoolJudgeSweepLeavesNoRecordWhenThePoolCannotRead(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "off")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolJudgeSweep(config.Config{APIKey: "test-key"}, profileDir, "", poolTestCatalog, poolTestAsk(config.Config{}, new([]string)), time.Now)
diff --git a/cmd/codeaf/poolsweep_test.go b/cmd/codeaf/poolsweep_test.go
index dc71e7481e..1d5fdfcf51 100644
--- a/cmd/codeaf/poolsweep_test.go
+++ b/cmd/codeaf/poolsweep_test.go
@@ -25,7 +25,6 @@ func TestPoolJudgeSweepJudgesAPendingRowOnceThenNeverAgain(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolDir := config.ProfilePath(profileDir, "pool")
@@ -70,7 +69,6 @@ func TestPoolJudgeSweepWithNoKeyLeavesRowsWaiting(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolDir := config.ProfilePath(profileDir, "pool")
@@ -99,7 +97,6 @@ func TestPoolJudgeSweepToleratesATornPendingLine(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolDir := config.ProfilePath(profileDir, "pool")
@@ -155,7 +152,6 @@ func TestPoolJudgeSweepCutShortKeepsALeftoverClaimsRows(t *testing.T) {
 	t.Setenv("CODEAF_HOME", t.TempDir())
 	t.Setenv("CODEAF_MODEL_POOL", "on")
 	t.Setenv("CODEAF_MODEL_POOL_SUBMIT_URL", "http://127.0.0.1:1/submit")
-	restoreOwnCells(t)
 
 	profileDir := t.TempDir()
 	poolDir := config.ProfilePath(profileDir, "pool")
diff --git a/cmd/codeaf/role_ladder.go b/cmd/codeaf/role_ladder.go
index f4cfdded2c..d733b6c867 100644
--- a/cmd/codeaf/role_ladder.go
+++ b/cmd/codeaf/role_ladder.go
@@ -25,7 +25,7 @@ import (
 // never quietly undoes what somebody chose in the palette.
 //
 // planOrigin is who named it, in the words a person would recognize —
-// `CODEAF_PLAN_MODEL`, `--plan-model`, `crew frugal` — and it is passed in
+// `CODEAF_PLAN_MODEL`, `--plan-model`, `routed`, `pinned` — and it is passed in
 // rather than guessed at here, because since #166 the answer may have come from
 // the profile's crew and a seed that named a variable nobody set would be a
 // false record in the journal.
diff --git a/cmd/codeaf/role_ladder_test.go b/cmd/codeaf/role_ladder_test.go
index 993a1a3546..8b29319c41 100644
--- a/cmd/codeaf/role_ladder_test.go
+++ b/cmd/codeaf/role_ladder_test.go
@@ -86,7 +86,7 @@ func TestPlanKnobSeedsTheGlobalPlanBindingOnce(t *testing.T) {
 
 	// Another origin names itself instead, and a value the initializer has not
 	// said before does move the binding. The origin is whatever named the model
-	// — a flag here, a crew preset on a headless run (config.ResolveSeats).
+	// — a flag here, a crew pin or the router on a headless run (config.ResolveSeats).
 	installRoleLadder(graph, "talk/model", "flagged/model", "work/model", "flagged/model", "--plan-model")
 	binding, _, err = graph.RoleBindingAt(store.RolePlan, store.ScopeGlobal)
 	if err != nil {
diff --git a/cmd/codeaf/run.go b/cmd/codeaf/run.go
index c6fa7377c0..d3ca63dfba 100644
--- a/cmd/codeaf/run.go
+++ b/cmd/codeaf/run.go
@@ -191,7 +191,7 @@ func runGraph(name string, args []string) error {
 		return err
 	}
 	useAutoSeats(settings)
-	seats := config.ResolveSeats(settings.ProfileDir, *model, *planModel)
+	seats := doorSeats(settings, *model, *planModel, graph.Goal)
 	applySeats(&settings, seats)
 	// A graph may be loaded from disk and expanded again after an overrun, so
 	// run installs the measured ruler before any planning-capable work starts.
diff --git a/cmd/codeaf/seats_wiring_test.go b/cmd/codeaf/seats_wiring_test.go
index 81456400d0..0e2281a4e1 100644
--- a/cmd/codeaf/seats_wiring_test.go
+++ b/cmd/codeaf/seats_wiring_test.go
@@ -1,22 +1,17 @@
 package main
 
 import (
-	"context"
 	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
 	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
 	"time"
 
-	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/catalog"
 	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/roles"
-	"github.com/Agent-Field/codeaf/internal/store"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/router"
 )
 
 // ONE LADDER, EVERY HEADLESS DOOR, AND NO SECOND COPY OF IT.
@@ -25,112 +20,114 @@ import (
 // resolving their two models their own way, so a crew that reached the chat
 // reached none of them (#166). The next door will be written by copying one of
 // these, and the copy is only safe while the resolution is a call rather
-// than a paragraph worth of lookups. So this reads the source: every door asks
-// config.ResolveSeats, and no door reaches past it for the environment or the
-// build's default on its own.
+// than a paragraph worth of lookups. So this reads the source: `codeaf do`
+// asks config.ResolveSeats itself, every other door asks doorSeats (which asks
+// it once), and no door reaches past it for the environment on its own.
 func TestEveryHeadlessDoorResolvesItsSeatsThroughTheOneLadder(t *testing.T) {
-	// main.go carries two doors — plan and revise — and the other three files
-	// carry one each.
-	doors := map[string]int{
-		"do.go": 1, "exec.go": 1, "run.go": 1, "main.go": 2, "subharness_run.go": 1,
+	ladder := map[string]int{"do.go": 1, "main.go": 1}
+	doors := map[string]int{"exec.go": 1, "run.go": 1, "main.go": 3, "subharness_run.go": 1}
+	for name, wanted := range ladder {
+		raw, err := os.ReadFile(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := strings.Count(string(raw), "config.ResolveSeats("); got != wanted {
+			t.Errorf("%s climbs the ladder %d times, want %d", name, got, wanted)
+		}
 	}
 	for name, wanted := range doors {
 		raw, err := os.ReadFile(name)
 		if err != nil {
 			t.Fatal(err)
 		}
-		source := string(raw)
-		if got := strings.Count(source, "config.ResolveSeats("); got != wanted {
-			t.Errorf("%s climbs the ladder %d times, want %d — a door that resolves its models "+
+		if got := strings.Count(string(raw), "doorSeats("); got != wanted {
+			t.Errorf("%s asks doorSeats %d times, want %d — a door that resolves its models "+
 				"another way is a door the crew does not reach", name, got, wanted)
 		}
-		// A door either seats the answer on its own settings or hands it to the
-		// brain that does (brainOptions.seats). What it may not do is resolve
-		// the seats and then build its clients from something else.
-		if !strings.Contains(source, "applySeats(") && !strings.Contains(source, "seats:") {
+	}
+	for _, name := range []string{"do.go", "exec.go", "run.go", "main.go", "subharness_run.go"} {
+		raw, err := os.ReadFile(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		source := string(raw)
+		if !strings.Contains(source, "applySeats(") && !strings.Contains(source, "seats:") && !strings.Contains(source, "seats.Work.Model") {
 			t.Errorf("%s resolves the seats and never seats them", name)
 		}
 		for _, reach := range []string{
 			`os.Getenv("CODEAF_MODEL")`,
 			`os.Getenv("CODEAF_PLAN_MODEL")`,
+			`os.Getenv("CODEAF_CHECK_MODEL")`,
 			"os.Getenv(config.ModelEnv)",
 			"os.Getenv(config.PlanModelEnv)",
 		} {
 			if strings.Contains(source, reach) {
-				t.Errorf("%s reads %s for itself; the ladder reads the environment, "+
-					"and it is the only rung that can tell the environment from the default", name, reach)
+				t.Errorf("%s reads %s for itself; the ladder reads the environment", name, reach)
 			}
 		}
-	}
-
-	// The build's default is the ladder's bottom rung and nothing else's. It
-	// survives in main.go exactly once — in the usage table, where the row for
-	// CODEAF_MODEL prints the default it falls back to — and that is prose, not
-	// resolution.
-	for _, name := range []string{"do.go", "exec.go", "run.go", "subharness_run.go"} {
-		raw, err := os.ReadFile(name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(string(raw), "config.DefaultModel") {
-			t.Errorf("%s names the build's default model itself instead of falling to the ladder's last rung", name)
-		}
-	}
-	raw, err := os.ReadFile("main.go")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, line := range strings.Split(string(raw), "\n") {
-		if strings.Contains(line, "config.DefaultModel") && !strings.Contains(line, "CODEAF_MODEL") {
-			t.Errorf("main.go reads the build's default outside the usage table: %q", strings.TrimSpace(line))
+		// NO SEAT FALLS TO A MODEL THIS BUILD CHOSE FOR EVERYBODY.
+		if name != "main.go" && strings.Contains(source, "config.DefaultModel") {
+			t.Errorf("%s names the build's default model itself", name)
 		}
 	}
 }
 
-// The help text is where a person learns that their crew reaches this command,
-// so it names the whole ladder rather than one rung of it.
+// The help text is where a person learns that the flag is a one-task pin and
+// that the crew is routed per task when nothing is pinned.
 func TestTheModelFlagsNameTheWholeLadder(t *testing.T) {
-	for _, name := range []string{"do.go", "exec.go", "run.go", "main.go", "subharness_run.go"} {
-		raw, err := os.ReadFile(name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(string(raw), "run (default CODEAF_MODEL)") {
-			t.Errorf("%s still says the work model defaults to CODEAF_MODEL, which was one rung of four", name)
+	for _, help := range []string{modelFlagHelp, planModelFlagHelp, checkModelFlagHelp} {
+		for _, want := range []string{"one-task pin", "crew pin", "routed per task"} {
+			if !strings.Contains(help, want) {
+				t.Errorf("a model flag's help does not say %q: %q", want, help)
+			}
 		}
 	}
-	for _, want := range []string{"CODEAF_MODEL", "crew", "default"} {
-		if !strings.Contains(modelFlagHelp, want) {
-			t.Errorf("--model's help does not mention %q: %q", want, modelFlagHelp)
-		}
+	if !strings.Contains(checkModelFlagHelp, "CODEAF_CHECK_MODEL") {
+		t.Errorf("--check-model's help does not name its variable: %q", checkModelFlagHelp)
 	}
-	if !strings.Contains(planModelFlagHelp, "CODEAF_PLAN_MODEL") || !strings.Contains(planModelFlagHelp, "crew") {
-		t.Errorf("--plan-model's help does not name its own ladder: %q", planModelFlagHelp)
+	// THE CHECK SEAT'S LADDER NEVER PASSES THROUGH THE PLAN SEAT.
+	if strings.Contains(checkLadderHelp, "plan") {
+		t.Errorf("the check seat's ladder still names the plan seat: %q", checkLadderHelp)
 	}
-	for _, want := range []string{"CODEAF_CHECK_MODEL", "plan", "crew"} {
-		if !strings.Contains(checkModelFlagHelp, want) {
-			t.Errorf("--check-model's help does not mention %q: %q", want, checkModelFlagHelp)
-		}
+}
+
+// crewDoorCatalog is a catalog the router can price: a cheap model and a
+// dear, better one, both open and both serving tools.
+func crewDoorCatalog() []catalog.Model {
+	return []catalog.Model{
+		{ID: "vendor/cheap", PromptPrice: 0.1e-6, CompletionPrice: 0.4e-6, CodingIndex: 40, AgenticIndex: 40, IntelligenceIndex: 40,
+			Parameters: []string{"tools"}, ContextLength: 200000, OpenWeights: true},
+		{ID: "vendor/strong", PromptPrice: 3e-6, CompletionPrice: 15e-6, CodingIndex: 70, AgenticIndex: 70, IntelligenceIndex: 70,
+			Parameters: []string{"tools"}, ContextLength: 200000, OpenWeights: true},
 	}
 }
 
-// THE ACCEPTANCE CASE, END TO END: a profile that says `frugal` and a command
-// line that says nothing.
+// seatCrewCatalog points the router at a catalog for one test.
+func seatCrewCatalog(t *testing.T, rows []catalog.Model) {
+	t.Helper()
+	previous, seat := config.CrewCatalog, seatCrewRows
+	config.CrewCatalog = func() []catalog.Model { return rows }
+	seatCrewRows = func(func() []catalog.Model) {}
+	t.Cleanup(func() { config.CrewCatalog, seatCrewRows = previous, seat })
+}
+
+// THE ACCEPTANCE CASE, END TO END: a command line that says nothing, on a
+// profile that pinned only the checker.
 //
-// The errand must plan on the profile's mastermind and work on its working tier
-// — the two seats the chat's planner and worker ride (roles.DefaultAssignment)
-// — and it must SAY SO, on the opening line and in the object a harness reads.
-// Both halves matter: a benchmark that cannot read back which crew ran is the
-// position this issue was reported from.
-func TestAnErrandWithNoFlagsRunsTheProfilesCrewAndSaysSo(t *testing.T) {
+// The worker and the planner are ROUTED for this task and the checker is the
+// pin, and the run says so — on the opening lines, in the summary line with the
+// actual beside the estimate, and in the object a harness reads (`class`,
+// `crew`, `est_usd`, `check_model`). The decision and its outcome land in the
+// router's log.
+func TestAnErrandWithNoFlagsRunsARoutedCrewAndSaysSo(t *testing.T) {
 	script := newScriptedBrain(t)
 	defer script.close()
-	// The variables are cleared rather than left to the shell this suite runs
-	// in: the rung under test is the one below them.
 	t.Setenv(config.ModelEnv, "")
 	t.Setenv(config.PlanModelEnv, "")
-	if err := config.ApplyCrew(script.dir, config.CrewFrugal); err != nil {
-		t.Fatalf("writing the frugal crew: %v", err)
+	t.Setenv(config.CheckModelEnv, "")
+	seatCrewCatalog(t, crewDoorCatalog())
+	if err := config.SetCrewPin(script.dir, crewroute.Checker, "vendor/strong"); err != nil {
+		t.Fatalf("pinning the checker: %v", err)
 	}
 
 	var mu sync.Mutex
@@ -138,6 +135,7 @@ func TestAnErrandWithNoFlagsRunsTheProfilesCrewAndSaysSo(t *testing.T) {
 	var stdout, stderr strings.Builder
 	err := doErrand(doRequest{
 		task:    "write the release note and include the migration steps",
+		run:     "crew-door-run",
 		timeout: 60 * time.Second,
 		asJSON:  true,
 		stdout:  &stdout,
@@ -152,63 +150,48 @@ func TestAnErrandWithNoFlagsRunsTheProfilesCrewAndSaysSo(t *testing.T) {
 	if err != nil {
 		t.Fatalf("the errand did not settle cleanly: %v\nstderr:\n%s", err, stderr.String())
 	}
-
-	// THE WORK SEAT IS THE WORKER ROW, which is what [config.ResolveSeats] fills
-	// it from. It used to be read off the small-work row here and pass anyway,
-	// because the frugal preset happened to put one id on both.
-	work := config.TierModelAt(script.dir, config.ModelTierWorker)
-	plan := config.TierModelAt(script.dir, config.ModelTierMastermind)
-	for _, model := range []string{work, plan} {
-		found := false
-		mu.Lock()
-		for _, built := range built {
-			found = found || built == model
-		}
-		models := append([]string(nil), built...)
-		mu.Unlock()
-		if !found {
-			t.Fatalf("no client was built on %q; the run used %v", model, models)
-		}
+	if !strings.Contains(stderr.String(), "crew: ") || !strings.Contains(stderr.String(), config.PinMark+" strong") {
+		t.Fatalf("the run never said its crew with the pinned checker marked:\n%s", stderr.String())
 	}
 
-	if line := config.ResolveSeats(script.dir, "", "").Line(); !strings.Contains(stderr.String(), line) {
-		t.Fatalf("the opening lines never named the crew:\nwant %q\nstderr:\n%s", line, stderr.String())
+	var fields map[string]any
+	if err := json.Unmarshal([]byte(stdout.String()), &fields); err != nil {
+		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
 	}
-	if !strings.Contains(stderr.String(), "crew frugal") {
-		t.Fatalf("the receipt did not name the preset:\n%s", stderr.String())
+	for _, key := range []string{"class", "crew", "est_usd", "check_model", "model_source"} {
+		if _, ok := fields[key]; !ok {
+			t.Fatalf("--json carries no %q:\n%s", key, stdout.String())
+		}
 	}
-
-	var outcome headlessOutcome
-	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
-		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
+	if fields["check_model"] != "vendor/strong" || fields["check_model_source"] != "pinned" {
+		t.Fatalf("--json named the checker %v (%v), want the pin", fields["check_model"], fields["check_model_source"])
 	}
-	if outcome.Model != work || outcome.PlanModel != plan {
-		t.Fatalf("--json named model %q and plan_model %q, want %q and %q",
-			outcome.Model, outcome.PlanModel, work, plan)
+	if fields["model_source"] != "routed" {
+		t.Fatalf("--json named the worker's rung %v, want routed", fields["model_source"])
 	}
-	if outcome.ModelSource != "crew frugal" || outcome.PlanModelSource != "crew frugal" {
-		t.Fatalf("--json named the rungs %q and %q, want the crew for both",
-			outcome.ModelSource, outcome.PlanModelSource)
+
+	log := router.ReadCrewLog(config.ProfilePath(script.dir, ""), time.Now())
+	if len(log.Recent) != 1 || !log.Recent[0].Settled {
+		t.Fatalf("the router's log holds %+v, want one settled crew", log.Recent)
 	}
 }
 
-// The flag still wins, and the receipt still says which rung answered — the two
-// halves of the ladder that a benchmark pinning one seat depends on.
-func TestAFlaggedSeatOutranksTheCrewAndTheReceiptSaysWhich(t *testing.T) {
+// The flag still wins, and it is a ONE-TASK PIN: the receipt says which rung
+// answered, and the check seat does not inherit a flagged planner.
+func TestAFlaggedPlannerNeverSeatsTheChecker(t *testing.T) {
 	script := newScriptedBrain(t)
 	defer script.close()
 	t.Setenv(config.ModelEnv, "")
 	t.Setenv(config.PlanModelEnv, "")
-	if err := config.ApplyCrew(script.dir, config.CrewFrugal); err != nil {
-		t.Fatal(err)
-	}
+	t.Setenv(config.CheckModelEnv, "")
+	seatCrewCatalog(t, crewDoorCatalog())
 
 	var stdout, stderr strings.Builder
 	err := doErrand(doRequest{
 		task:      "write the release note and include the migration steps",
 		timeout:   60 * time.Second,
 		asJSON:    true,
-		model:     "vendor/pinned-worker",
+		planModel: "vendor/flagged-planner",
 		stdout:    &stdout,
 		stderr:    &stderr,
 		newClient: script.client,
@@ -220,346 +203,59 @@ func TestAFlaggedSeatOutranksTheCrewAndTheReceiptSaysWhich(t *testing.T) {
 	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
 		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
 	}
-	if outcome.Model != "vendor/pinned-worker" || outcome.ModelSource != "--model" {
-		t.Fatalf("the flagged seat reads %q (%s)", outcome.Model, outcome.ModelSource)
+	if outcome.PlanModel != "vendor/flagged-planner" || outcome.PlanModelSource != "--plan-model" {
+		t.Fatalf("the flagged seat reads %q (%s)", outcome.PlanModel, outcome.PlanModelSource)
 	}
-	// And the seat nobody flagged still climbs to the crew.
-	if outcome.PlanModelSource != "crew frugal" {
-		t.Fatalf("the plan seat reads %q (%s)", outcome.PlanModel, outcome.PlanModelSource)
+	var fields map[string]any
+	_ = json.Unmarshal([]byte(stdout.String()), &fields)
+	if fields["check_model"] == "vendor/flagged-planner" {
+		t.Fatal("the check seat inherited the flagged planner")
 	}
 }
 
-// A crew preset fills the run and durable role binding with its bare model id.
-// Presets choose models and leave generation behavior to them.
-func TestACrewsBareModelReachesTheRunWhole(t *testing.T) {
+// AT THE DAILY CAP `codeaf do` REFUSES, and -yes-spend is the one way past.
+func TestAnErrandAtTheDailyCapRefusesUnlessToldToSpend(t *testing.T) {
 	script := newScriptedBrain(t)
 	defer script.close()
 	t.Setenv(config.ModelEnv, "")
 	t.Setenv(config.PlanModelEnv, "")
-	if err := config.ApplyCrew(script.dir, config.CrewBalanced); err != nil {
+	t.Setenv(config.CheckModelEnv, "")
+	seatCrewCatalog(t, crewDoorCatalog())
+	if err := config.SetCrewCap(script.dir, "1"); err != nil {
 		t.Fatal(err)
 	}
-	written := config.TierModelAt(script.dir, config.ModelTierMastermind)
-	if _, level := roles.SplitEffort(written); level != "" {
-		t.Fatalf("the balanced mastermind reads %q and imposes level %q", written, level)
-	}
+	previous := config.CrewHistory
+	config.CrewHistory = func(string) config.CrewDay { return config.CrewDay{SpentUSD: 2} }
+	t.Cleanup(func() { config.CrewHistory = previous })
 
-	// A durable store, because the plan role's binding is the record under test
-	// and an ephemeral one evaporates with the run.
-	database := filepath.Join(t.TempDir(), "graph.db")
-	var mu sync.Mutex
-	var built []string
 	var stdout, stderr strings.Builder
 	err := doErrand(doRequest{
-		task:     "write the release note and include the migration steps",
-		database: database,
-		timeout:  60 * time.Second,
-		asJSON:   true,
-		stdout:   &stdout,
-		stderr:   &stderr,
-		newClient: func(settings config.Config, model string) (*liveClient, error) {
-			mu.Lock()
-			built = append(built, model)
-			mu.Unlock()
-			return script.client(settings, model)
-		},
+		task: "write the release note and include the migration steps", timeout: 60 * time.Second,
+		stdout: &stdout, stderr: &stderr, newClient: script.client,
 	})
-	if err != nil {
-		t.Fatalf("the errand did not settle cleanly: %v\nstderr:\n%s", err, stderr.String())
-	}
-
-	mu.Lock()
-	models := append([]string(nil), built...)
-	mu.Unlock()
-	found := false
-	for _, model := range models {
-		found = found || model == written
-	}
-	if !found {
-		t.Fatalf("the plan seat was filled with %v, none of them the crew's own %q", models, written)
-	}
-
-	// The binding the ladder resolves calls through carries the level, and says
-	// the crew put it there rather than naming a variable nobody set.
-	graph, err := store.Open(database)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer graph.Close()
-	binding, ok, err := graph.RoleBindingAt(store.RolePlan, store.ScopeGlobal)
-	if err != nil || !ok {
-		t.Fatalf("plan binding: found=%t err=%v", ok, err)
-	}
-	if binding.Value != written {
-		t.Fatalf("the plan role is bound to %q, want the crew's %q", binding.Value, written)
-	}
-	if binding.Origin != store.RoleSeedOriginPrefix+"crew balanced" {
-		t.Fatalf("the binding says %q named the model", binding.Origin)
-	}
-
-	// And what the run reports is what the person wrote in the sheet.
-	var outcome headlessOutcome
-	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
-		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
-	}
-	if outcome.PlanModel != written {
-		t.Fatalf("--json named plan_model %q, want %q", outcome.PlanModel, written)
-	}
-	if !strings.Contains(stderr.String(), "plan "+written+" (crew balanced)") {
-		t.Fatalf("the receipt did not print the value as the sheet holds it:\n%s", stderr.String())
-	}
-}
-
-// The plan seat resolved from an unoverridden balanced profile sends its bare
-// model on both contexts a headless run uses, with no reasoning object.
-func TestACrewsBareModelReachesTheHeadlessWire(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-	if err := config.ApplyCrew(dir, config.CrewBalanced); err != nil {
-		t.Fatal(err)
-	}
-
-	type requestShape struct {
-		Model     string          `json:"model"`
-		Reasoning json.RawMessage `json:"reasoning"`
+	if err == nil || !strings.Contains(err.Error(), "daily cap") {
+		t.Fatalf("an errand at the cap was not refused: %v", err)
 	}
-	var received []requestShape
-	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
-		if request.Method != http.MethodPost {
-			writer.Header().Set("Content-Type", "application/json")
-			_, _ = io.WriteString(writer, `[]`)
-			return
-		}
-		raw, err := io.ReadAll(request.Body)
-		if err != nil {
-			t.Errorf("read request: %v", err)
-			http.Error(writer, `{"error":"unreadable"}`, http.StatusBadRequest)
-			return
-		}
-		var body requestShape
-		if err := json.Unmarshal(raw, &body); err != nil {
-			t.Errorf("decode request: %v", err)
-			http.Error(writer, `{"error":"invalid"}`, http.StatusBadRequest)
-			return
-		}
-		received = append(received, body)
-		writer.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(writer, `{"model":"stub","choices":[{"index":0,"finish_reason":"stop","message":{"role":"assistant","content":"ok"}}],"usage":{"prompt_tokens":1,"completion_tokens":1}}`)
-	}))
-	defer server.Close()
-
-	settings := config.Config{
-		APIKey:        "test-key",
-		BaseURL:       server.URL,
-		Timeout:       config.DefaultTimeout,
-		Reasoning:     config.DefaultReasoning,
-		ExecReasoning: config.DefaultExecReasoning,
-		ProfileDir:    dir,
-	}
-	seats := config.ResolveSeats(dir, "", "")
-	applySeats(&settings, seats)
-	client, err := settings.ClientFor(settings.PlanModelResolved())
-	if err != nil {
-		t.Fatal(err)
-	}
-	contexts := []context.Context{
-		settings.Context(context.Background(), "plan this"),
-		settings.ExecContext(settings.Context(context.Background(), "do this")),
-	}
-	for _, ctx := range contexts {
-		if _, err := client.CompleteWithMessages(ctx,
-			[]ai.Message{{Role: "user", Content: []ai.ContentPart{{Type: "text", Text: "hello"}}}}); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	wantModel, wantEffort := roles.SplitEffort(config.DefaultMastermindModel)
-	if wantEffort != "" {
-		t.Fatalf("shipped mastermind %q imposes effort %q", config.DefaultMastermindModel, wantEffort)
-	}
-	if seats.Plan.Model != config.DefaultMastermindModel {
-		t.Fatalf("balanced plan seat = %q, want %q", seats.Plan.Model, config.DefaultMastermindModel)
-	}
-	if len(received) != len(contexts) {
-		t.Fatalf("provider received %d requests, want %d", len(received), len(contexts))
-	}
-	for index, body := range received {
-		if body.Model != wantModel || len(body.Reasoning) != 0 {
-			t.Errorf("call %d carried model %q and reasoning %s, want bare %q and no reasoning object",
-				index, body.Model, body.Reasoning, wantModel)
-		}
+	if script.count("chat") != 0 {
+		t.Fatal("an errand at the cap spent before it refused")
 	}
 }
 
-// THE WHOLE ROAD, ON A PROFILE OLDER THAN THE WORKER SEAT (#302).
-//
-// The unit test pins the rung; this pins what a person actually gets: a config
-// written before the worker row existed — the four keys and no fifth — must send
-// every client the errand builds to the crew's own models, never to the build's
-// default, and the run must SAY on its way past that the seat was inherited. The
-// second half is the part that makes the first half checkable from outside,
-// which is the property the defect took away.
-func TestAnErrandOnACrewOlderThanTheWorkerSeatNeverTouchesTheBuildsDefault(t *testing.T) {
-	script := newScriptedBrain(t)
-	defer script.close()
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-
-	// The pre-#278 crew shape, written as a profile of that vintage holds it.
-	pinned := "vendor/pinned-small-work"
-	profile := map[string]string{
-		config.KeyTierReflexModel:     "vendor/pinned-reflex",
-		config.KeyTierLowModel:        pinned,
-		config.KeyTierHighModel:       "vendor/pinned-careful",
-		config.KeyTierMastermindModel: "vendor/pinned-thinking",
-	}
-	raw, err := json.Marshal(profile)
-	if err != nil {
+// --pin is repeatable, names a seat, and refuses what is not a pin.
+func TestThePinFlagReadsSeatEqualsModel(t *testing.T) {
+	var pins pinFlags
+	if err := pins.Set("checker=moonshotai/kimi-k3@openrouter"); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(config.BudgetConfigPath(script.dir), raw, 0o600); err != nil {
+	if err := pins.Set("worker=z-ai/glm-5.3-flash"); err != nil {
 		t.Fatal(err)
 	}
-
-	var mu sync.Mutex
-	var built []string
-	var stdout, stderr strings.Builder
-	if err := doErrand(doRequest{
-		task:    "write the release note and include the migration steps",
-		timeout: 60 * time.Second,
-		asJSON:  true,
-		stdout:  &stdout,
-		stderr:  &stderr,
-		newClient: func(settings config.Config, model string) (*liveClient, error) {
-			mu.Lock()
-			built = append(built, model)
-			mu.Unlock()
-			return script.client(settings, model)
-		},
-	}); err != nil {
-		t.Fatalf("the errand did not settle cleanly: %v\nstderr:\n%s", err, stderr.String())
+	if got := pins.pins[crewroute.Checker]; got.Model != "moonshotai/kimi-k3" || got.Provider != "openrouter" {
+		t.Fatalf("the checker pin reads %+v", got)
 	}
-
-	mu.Lock()
-	models := append([]string(nil), built...)
-	mu.Unlock()
-	for _, model := range models {
-		if model == config.DefaultModel {
-			t.Fatalf("a client was built on the build's default %q; the run used %v",
-				config.DefaultModel, models)
+	for _, bad := range []string{"judge=vendor/x", "worker", "worker=auto"} {
+		if err := (&pinFlags{}).Set(bad); err == nil {
+			t.Errorf("--pin %q was accepted", bad)
 		}
 	}
-	worked := false
-	for _, model := range models {
-		worked = worked || model == pinned
-	}
-	if !worked {
-		t.Fatalf("nothing ran on the small-work model the crew pinned; the run used %v", models)
-	}
-
-	// The receipt: the work seat says the crew answered and that the row was
-	// inherited, and the one line saying why is printed ONCE.
-	seats := config.ResolveSeats(script.dir, "", "")
-	if !strings.Contains(stderr.String(), "work "+pinned+" (crew custom, inherited)") {
-		t.Fatalf("the opening line does not name the inherited seat:\n%s", stderr.String())
-	}
-	if strings.Contains(stderr.String(), "work "+config.DefaultModel) {
-		t.Fatalf("the opening line still seats the build's default:\n%s", stderr.String())
-	}
-	notice := seats.Notice()
-	if notice == "" {
-		t.Fatal("the seats resolved by inheritance and the run has nothing to say about it")
-	}
-	if got := strings.Count(stderr.String(), notice); got != 1 {
-		t.Fatalf("the run said the line %d times, want once:\n%s", got, stderr.String())
-	}
-
-	// And the object a script reads carries the same fact.
-	var outcome headlessOutcome
-	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
-		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
-	}
-	if outcome.Model != pinned || outcome.ModelSource != "crew custom, inherited" {
-		t.Fatalf("--json named model %q (%s), want the inherited crew row",
-			outcome.Model, outcome.ModelSource)
-	}
-}
-
-// AND THE CONVERSATION SEATS THE SAME ROW (#312).
-//
-// The chat resolves its five classes through [v3RolesSource], which is a
-// different road from [config.ResolveSeats] on purpose — a conversation has no
-// flag and no campaign variable for its crew, only a profile — but it must end
-// at the same model, or a person's crew means one thing in `codeaf do` and
-// another in the window they actually work in. This is the ladder read the way
-// the door reads it: the key internal/roles asks for, on a profile older than
-// the worker seat.
-func TestTheChatRoleMapSeatsTheInheritedWorkerRow(t *testing.T) {
-	pinned := "vendor/pinned-small-work"
-	dir := writeVintageProfile(t, map[string]string{
-		config.KeyTierReflexModel:     "vendor/pinned-reflex",
-		config.KeyTierLowModel:        pinned,
-		config.KeyTierHighModel:       "vendor/pinned-careful",
-		config.KeyTierMastermindModel: "vendor/pinned-thinking",
-	})
-
-	read, err := v3RolesSource(t.TempDir(), dir)
-	if err != nil {
-		t.Fatalf("building the conversation's role map: %v", err)
-	}
-	worker, ok := read(roles.TierKey(roles.TierWorker))
-	if !ok || worker != pinned {
-		t.Fatalf("the conversation's worker class reads %q (held=%t), want the small-work model the crew pinned",
-			worker, ok)
-	}
-	if worker == config.DefaultWorkerModel {
-		t.Fatalf("the conversation's worker class fell to the build's default %q", config.DefaultWorkerModel)
-	}
-	// The rows the profile does hold are untouched by any of it.
-	if got, _ := read(roles.TierKey(roles.TierMastermind)); got != "vendor/pinned-thinking" {
-		t.Fatalf("the thinking class reads %q", got)
-	}
-
-	// A row written by hand wins over the lineage, and a row cleared on purpose
-	// still means "follow the conversation" — which on this surface is a class
-	// the role ladder does not hold at all.
-	own := writeVintageProfile(t, map[string]string{
-		config.KeyTierLowModel:    pinned,
-		config.KeyTierWorkerModel: "vendor/my-own-worker",
-	})
-	read, err = v3RolesSource(t.TempDir(), own)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, _ := read(roles.TierKey(roles.TierWorker)); got != "vendor/my-own-worker" {
-		t.Fatalf("a pinned worker row reads %q", got)
-	}
-	cleared := writeVintageProfile(t, map[string]string{
-		config.KeyTierLowModel:    pinned,
-		config.KeyTierWorkerModel: "",
-	})
-	read, err = v3RolesSource(t.TempDir(), cleared)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, held := read(roles.TierKey(roles.TierWorker)); held {
-		t.Fatalf("a worker row cleared on purpose is held as %q instead of following the conversation", got)
-	}
-}
-
-// writeVintageProfile writes a profile holding exactly these rows: a value for a
-// row somebody wrote, the empty string for one they cleared, and no key at all
-// for a class of a vintage that never had one.
-func writeVintageProfile(t *testing.T, rows map[string]string) string {
-	t.Helper()
-	dir := t.TempDir()
-	raw, err := json.Marshal(rows)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), raw, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	return dir
 }
diff --git a/cmd/codeaf/seatsrows_test.go b/cmd/codeaf/seatsrows_test.go
deleted file mode 100644
index cdcfbdc440..0000000000
--- a/cmd/codeaf/seatsrows_test.go
+++ /dev/null
@@ -1,409 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/config"
-)
-
-// THE HEADLESS DOORS WAIT FOR THE ROWS A PICK NEEDS.
-//
-// A pick taken off the table, and a tier row that says auto, are answered from
-// the rows the process holds (config.AutoModels) — and before the doors waited,
-// every cold start read that seam while the warm was still in flight, so the
-// seat fell to the family's table row on a machine whose catalog was sitting in
-// its own cache file. The chat surface never met the defect because its picks
-// happen after the warm has landed. These tests run the doors' own two calls —
-// useAutoSeats and config.ResolveSeats, the same sequence `codeaf exec` and
-// `codeaf do` climb — against a profile whose catalog is cached, absent and
-// unpickable, and read the rung word off the receipt either way.
-
-// seatPickRows is the small catalog a test cache holds: three priced rows,
-// spread across the bill and across three vendors — a crew's worker and its
-// careful seat may not share a vendor, and a candidate below 80% of the seat's
-// best falls off its shortlist — so the rows sit close in quality, far apart in
-// price, and each able to sit every seat (a window of 200k, tools, images).
-// None of them is a family's table id.
-func seatPickRows() []catalog.Model {
-	return []catalog.Model{
-		{ID: "north/penny", Name: "Penny", ContextLength: 262144,
-			PromptPrice: 0.00001, CompletionPrice: 0.00002, CacheReadPrice: 0.000001,
-			IntelligenceIndex: 85, CodingIndex: 85, AgenticIndex: 85,
-			InputModalities: []string{"text", "image"}, OutputModalities: []string{"text"}, Parameters: []string{"tools"}},
-		{ID: "south/pound", Name: "Pound", ContextLength: 262144,
-			PromptPrice: 0.002, CompletionPrice: 0.004, CacheReadPrice: 0.0002,
-			IntelligenceIndex: 86, CodingIndex: 86, AgenticIndex: 86,
-			InputModalities: []string{"text", "image"}, OutputModalities: []string{"text"}, Parameters: []string{"tools"}},
-		{ID: "east/crown", Name: "Crown", ContextLength: 262144,
-			PromptPrice: 0.05, CompletionPrice: 0.1, CacheReadPrice: 0.005,
-			IntelligenceIndex: 100, CodingIndex: 100, AgenticIndex: 100,
-			InputModalities: []string{"text", "image"}, OutputModalities: []string{"text"}, Parameters: []string{"tools"}},
-	}
-}
-
-// blockedCatalogServer is a stand-in base whose /models fetch never returns:
-// the cold cache behind a slow network, reduced to the one fact that matters —
-// the warm does not land within any bound a test is willing to spend. The
-// handler is let go exactly once, because the server refuses to close behind a
-// wedged request.
-func blockedCatalogServer(t *testing.T) string {
-	t.Helper()
-	release := make(chan struct{})
-	var once sync.Once
-	letGo := func() { once.Do(func() { close(release) }) }
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		<-release
-	}))
-	t.Cleanup(server.Close)
-	t.Cleanup(letGo)
-	return server.URL
-}
-
-// seatTheTestCatalog replaces the process's memoised catalog with a fresh one
-// and restores the seams it seats when the test ends. The once is inside the
-// accessor, so tests in one process would otherwise share a catalog pointed at
-// whichever of them called first — which is the memoising this file is not
-// about.
-func seatTheTestCatalog(t *testing.T) {
-	t.Helper()
-	// The pool's refresh reaches the relay over the network and writes its
-	// own cache into the profile as it lands — exactly the late write a
-	// TempDir cleanup races. These tests read no measurements, so the pool is
-	// off for them: the same off nothing a row saying auto can read, which is
-	// the answer the seam already holds when there is no index at all.
-	t.Setenv("CODEAF_MODEL_POOL", "off")
-	previous := sharedCatalog
-	models, index, ownCells := config.AutoModels, config.AutoIndex, config.AutoOwnCells
-	sharedCatalog = newSharedCatalog()
-	t.Cleanup(func() {
-		sharedCatalog = previous
-		config.AutoModels, config.AutoIndex, config.AutoOwnCells = models, index, ownCells
-	})
-}
-
-// boundTheSeatWait shortens [autoSeatRowsBound] for one test and restores it,
-// so the bound can be watched without spending the three seconds it carries.
-func boundTheSeatWait(t *testing.T, bound time.Duration) {
-	t.Helper()
-	previous := autoSeatRowsBound
-	autoSeatRowsBound = bound
-	t.Cleanup(func() { autoSeatRowsBound = previous })
-}
-
-// cachedRowHeld fails the test unless the seat resolved to one of the cached
-// rows — the brief's "a model from the catalog rows, not the table row".
-func cachedRowHeld(t *testing.T, modelID string) {
-	t.Helper()
-	for _, row := range seatPickRows() {
-		if row.ID == modelID {
-			return
-		}
-	}
-	t.Fatalf("the seat resolved %q, which is not one of the cached rows", modelID)
-}
-
-// A pick off the table is computed from the cached rows, and the receipt says
-// which rung answered: `computed from the catalog` under the catalog word,
-// `learned` under learn. Both doors resolve through this exact pair of calls,
-// and `codeaf exec` prints the work seat's line as its whole report.
-func TestADoorWithAPickWaitsForTheCachedRowsAndSaysTheRung(t *testing.T) {
-	for _, pick := range []string{config.CrewPickCatalog, config.CrewPickLearn} {
-		t.Run(pick, func(t *testing.T) {
-			dir := t.TempDir()
-			if err := catalog.Remember(catalog.Options{Dir: dir}, seatPickRows()); err != nil {
-				t.Fatal(err)
-			}
-			if err := config.SetCrewPick(dir, pick); err != nil {
-				t.Fatal(err)
-			}
-			seatTheTestCatalog(t)
-			t.Setenv(config.ModelEnv, "")
-			t.Setenv(config.PlanModelEnv, "")
-
-			useAutoSeats(config.Config{ProfileDir: dir})
-			seats := config.ResolveSeats(dir, "", "")
-
-			want := "crew balanced, computed from the catalog"
-			if pick == config.CrewPickLearn {
-				want = "crew balanced, learned"
-			}
-			for _, seat := range []config.Seat{seats.Work, seats.Plan} {
-				if seat.Rung() != want {
-					t.Fatalf("the %s seat reads %q (%s), want the %q rung", seat.Role, seat.Model, seat.Rung(), want)
-				}
-				cachedRowHeld(t, seat.Model)
-			}
-			// And not the family's table row: [config.TierModelAt] climbs the same
-			// ladder and would answer the computed id here too, so the table is read
-			// straight off the family.
-			table, ok := config.CrewModelsForSource(config.CrewSourceAt(dir), config.DefaultCrew)
-			if !ok || seats.Work.Model == table[config.ModelTierWorker] {
-				t.Fatalf("the work seat fell to the family's table row %q over a catalog it holds", table[config.ModelTierWorker])
-			}
-			// And the one line the exec door prints names the rung too.
-			if !strings.Contains(seats.Work.Report(), want) {
-				t.Fatalf("the work seat's report does not name the rung:\n%s", seats.Work.Report())
-			}
-		})
-	}
-}
-
-// A tier row that says auto is the other way a seat needs the rows, and the
-// door waits for them with no pick row in the profile at all.
-func TestADoorWithAnAutoRowWaitsForTheCachedRows(t *testing.T) {
-	dir := t.TempDir()
-	if err := catalog.Remember(catalog.Options{Dir: dir}, seatPickRows()); err != nil {
-		t.Fatal(err)
-	}
-	rows, err := json.Marshal(map[string]string{config.KeyTierWorkerModel: config.AutoValue})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), rows, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-
-	useAutoSeats(config.Config{ProfileDir: dir})
-	seats := config.ResolveSeats(dir, "", "")
-
-	if seats.Work.Rung() != "crew balanced, computed from the catalog" {
-		t.Fatalf("an auto row resolved to %q (%s), want the computed rung", seats.Work.Model, seats.Work.Rung())
-	}
-	cachedRowHeld(t, seats.Work.Model)
-	table, ok := config.CrewModelsForSource(config.CrewSourceAt(dir), config.DefaultCrew)
-	if !ok || seats.Work.Model == table[config.ModelTierWorker] {
-		t.Fatalf("the auto row fell to the family's table row %q over a catalog it holds", table[config.ModelTierWorker])
-	}
-}
-
-// A pick left at the table reads no rows at all, and waits for nothing — not
-// even for a warm this test never lets land. The bound is raised to five
-// seconds so that a wrongly added wait cannot pass by timing out quietly
-// first: the door must be back in under a second.
-func TestADoorAtTheTablePickWaitsForNothing(t *testing.T) {
-	url := blockedCatalogServer(t)
-	dir := t.TempDir()
-	if err := config.ApplyCrew(dir, config.CrewBalanced); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-	boundTheSeatWait(t, 5*time.Second)
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-
-	started := time.Now()
-	useAutoSeats(config.Config{ProfileDir: dir, BaseURL: url})
-	if waited := time.Since(started); waited > time.Second {
-		t.Fatalf("a door with no pick and no auto row waited %s for rows it does not read", waited)
-	}
-	seats := config.ResolveSeats(dir, "", "")
-	for _, seat := range []config.Seat{seats.Work, seats.Plan} {
-		if seat.Rung() != "crew balanced" {
-			t.Fatalf("the %s seat reads %q, want the crew's own table row", seat.Role, seat.Rung())
-		}
-	}
-	if seats.Work.Model != config.TierModelAt(dir, config.ModelTierWorker) {
-		t.Fatalf("the work seat read %q, want the table row %q", seats.Work.Model, config.TierModelAt(dir, config.ModelTierWorker))
-	}
-}
-
-// A cold cache behind a network that never answers falls to the table row
-// within the bound, and the receipt says so: `table` is a rung word on purpose,
-// so a run that fell says it fell.
-func TestADoorOnAColdCacheFallsToTheTableRowAndSaysSo(t *testing.T) {
-	url := blockedCatalogServer(t)
-	dir := t.TempDir()
-	if err := config.SetCrewPick(dir, config.CrewPickCatalog); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-	boundTheSeatWait(t, 250*time.Millisecond)
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-
-	started := time.Now()
-	useAutoSeats(config.Config{ProfileDir: dir, BaseURL: url})
-	seats := config.ResolveSeats(dir, "", "")
-	if waited := time.Since(started); waited > 2*time.Second {
-		t.Fatalf("the door waited %s, past the bound it was given", waited)
-	}
-	if !strings.Contains(seats.Report(), "(crew balanced, table)") {
-		t.Fatalf("a run that fell to the table row must say so:\n%s", seats.Report())
-	}
-	if seats.Work.Model != config.TierModelAt(dir, config.ModelTierWorker) {
-		t.Fatalf("the work seat read %q, want the table row %q", seats.Work.Model, config.TierModelAt(dir, config.ModelTierWorker))
-	}
-}
-
-// A KEY FROM THE ENVIRONMENT IS THE KEY THE SEAT IS RESOLVED WITH. The
-// provider key is supplied through the environment, never written into the
-// profile, and the seat must still be computed off the cached rows: the run's
-// catalog is the same one every door shares, and a key the environment holds
-// is a key [config.LoadKeyless] holds too. The seat names the `learned` rung
-// under the learn pick, and it is the id the run actually sits somebody in.
-func TestAnErrandWhoseKeyComesFromTheEnvironmentNamesTheLearnedRung(t *testing.T) {
-	script := newScriptedBrain(t)
-	defer script.close()
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-	// The key is in the ENVIRONMENT and nowhere in the profile — which is the
-	// one arrangement the seat has to survive.
-	t.Setenv(config.APIKeyEnv, "sk-env-only")
-	if err := config.SetCrewPick(script.dir, config.CrewPickLearn); err != nil {
-		t.Fatal(err)
-	}
-	if err := catalog.Remember(catalog.Options{Dir: script.dir, BaseURL: script.server.URL}, seatPickRows()); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-
-	var mu sync.Mutex
-	var built []string
-	var stdout, stderr strings.Builder
-	err := doErrand(doRequest{
-		task:    "write the release note and include the migration steps",
-		timeout: 60 * time.Second,
-		asJSON:  true,
-		stdout:  &stdout,
-		stderr:  &stderr,
-		newClient: func(settings config.Config, model string) (*liveClient, error) {
-			mu.Lock()
-			built = append(built, model)
-			mu.Unlock()
-			return script.client(settings, model)
-		},
-	})
-	if err != nil {
-		t.Fatalf("the errand did not settle cleanly: %v\nstderr:\n%s", err, stderr.String())
-	}
-
-	if !strings.Contains(stderr.String(), "(crew balanced, learned)") {
-		t.Fatalf("the opening lines never named the learned rung:\n%s", stderr.String())
-	}
-	var outcome headlessOutcome
-	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
-		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
-	}
-	if outcome.ModelSource != "crew balanced, learned" {
-		t.Fatalf("--json named the rung %q, want the learned rung", outcome.ModelSource)
-	}
-	cachedRowHeld(t, outcome.Model)
-
-	mu.Lock()
-	models := append([]string(nil), built...)
-	mu.Unlock()
-	for _, model := range models {
-		if model == outcome.Model {
-			return
-		}
-	}
-	t.Fatalf("no client was built on the learned seat %q; the run used %v", outcome.Model, models)
-}
-
-// AND WITH NO KEY ANYWHERE. The seat line is part of the door's promise: it is
-// printed before the run reaches a provider, so a profile with no key still
-// says which models it meant to use — and the seats still come off the cached
-// rows, which need no key to read. The keyless read is the second rung here,
-// under the run's own settings, so the ordering this pins is exactly the one
-// the seating picked.
-func TestAnErrandWithNoKeySeatsTheCachedRowsThenSaysTheKeyIsMissing(t *testing.T) {
-	script := newScriptedBrain(t)
-	defer script.close()
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-	t.Setenv(config.APIKeyEnv, "")
-	t.Setenv("OPENAI_API_KEY", "")
-	if err := config.SetCrewPick(script.dir, config.CrewPickLearn); err != nil {
-		t.Fatal(err)
-	}
-	if err := catalog.Remember(catalog.Options{Dir: script.dir, BaseURL: script.server.URL}, seatPickRows()); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-
-	var stdout, stderr strings.Builder
-	err := doErrand(doRequest{
-		task:    "write the release note and include the migration steps",
-		timeout: 60 * time.Second,
-		stdout:  &stdout,
-		stderr:  &stderr,
-	})
-	if err == nil || !strings.Contains(err.Error(), config.APIKeyEnv) {
-		t.Fatalf("a keyless errand must end on the missing-key sentence, got %v", err)
-	}
-	if !strings.Contains(stderr.String(), "(crew balanced, learned)") {
-		t.Fatalf("the seat line must be printed before the key is missed:\n%s", stderr.String())
-	}
-}
-
-// THE ERRAND'S RECEIPT IS THE PART A HARNESS READS. A profile with the pick
-// off the table and a catalog cached beside it runs on the computed ids, and
-// both places the run names its rungs — the opening stderr lines and the
-// --json object — say `computed from the catalog`.
-func TestAnErrandNamesTheRungTheCatalogAnswered(t *testing.T) {
-	script := newScriptedBrain(t)
-	defer script.close()
-	t.Setenv(config.ModelEnv, "")
-	t.Setenv(config.PlanModelEnv, "")
-	if err := config.SetCrewPick(script.dir, config.CrewPickCatalog); err != nil {
-		t.Fatal(err)
-	}
-	if err := catalog.Remember(catalog.Options{Dir: script.dir, BaseURL: script.server.URL}, seatPickRows()); err != nil {
-		t.Fatal(err)
-	}
-	seatTheTestCatalog(t)
-
-	var mu sync.Mutex
-	var built []string
-	var stdout, stderr strings.Builder
-	err := doErrand(doRequest{
-		task:    "write the release note and include the migration steps",
-		timeout: 60 * time.Second,
-		asJSON:  true,
-		stdout:  &stdout,
-		stderr:  &stderr,
-		newClient: func(settings config.Config, model string) (*liveClient, error) {
-			mu.Lock()
-			built = append(built, model)
-			mu.Unlock()
-			return script.client(settings, model)
-		},
-	})
-	if err != nil {
-		t.Fatalf("the errand did not settle cleanly: %v\nstderr:\n%s", err, stderr.String())
-	}
-
-	if !strings.Contains(stderr.String(), "(crew balanced, computed from the catalog)") {
-		t.Fatalf("the opening lines never named the computed rung:\n%s", stderr.String())
-	}
-	var outcome headlessOutcome
-	if err := json.Unmarshal([]byte(stdout.String()), &outcome); err != nil {
-		t.Fatalf("--json did not print one object: %v\n%s", err, stdout.String())
-	}
-	if outcome.ModelSource != "crew balanced, computed from the catalog" {
-		t.Fatalf("--json named the rung %q, want the computed rung", outcome.ModelSource)
-	}
-	cachedRowHeld(t, outcome.Model)
-
-	// And the computed id is the one the run actually sat somebody in.
-	mu.Lock()
-	models := append([]string(nil), built...)
-	mu.Unlock()
-	for _, model := range models {
-		if model == outcome.Model {
-			return
-		}
-	}
-	t.Fatalf("no client was built on the computed seat %q; the run used %v", outcome.Model, models)
-}
diff --git a/cmd/codeaf/subharness.go b/cmd/codeaf/subharness.go
index 3c6db1b44b..eff94bcc56 100644
--- a/cmd/codeaf/subharness.go
+++ b/cmd/codeaf/subharness.go
@@ -441,52 +441,41 @@ func newSharedCatalog() func(config.Config) *catalog.Catalog {
 			resolved = catalog.LoadLazy(context.Background(), catalog.Options{
 				BaseURL: settings.BaseURL, APIKey: settings.APIKey, Dir: settings.ProfileDir,
 			})
-			// A tier row that says auto is answered from this catalog (config.AutoModels):
-			// the same non-blocking read, never a fetch, and set once at start-up so every
-			// headless door resolves the word against the list it already holds.
-			config.AutoModels = resolved.ModelsNow
-			// and the pool's index beside it, in the same one-time manner: a tier
-			// row that says auto is answered from the index this process was seated
-			// with, the seed when no cache is fresher, and the one fetch it makes
-			// runs in the background and never blocks this read.
+			// The crew router picks its seats from this catalog
+			// (config.CrewCatalog): the same non-blocking read, never a fetch,
+			// and set once at start-up so every headless door routes against
+			// the list it already holds.
+			seatCrewRows(resolved.ModelsNow)
+			// and the pool's errands beside it, in the same one-time manner.
 			wirePoolIndex(settings.ProfileDir)
 		})
 		return resolved
 	}
 }
 
+// seatCrewRows hands the router the catalog's rows. It is a variable so a
+// test that seats a catalog of its own is not overwritten by the first door
+// that warms the shared one.
+var seatCrewRows = func(rows func() []catalog.Model) { config.CrewCatalog = rows }
+
 // autoSeatRowsBound is how long a headless door waits for the catalog's rows
-// when the profile's pick or a tier row needs them. It is sized to cover the
-// disk read of a cached catalog and nothing more. It is a variable because the
-// test of the bound must not spend three seconds proving the bound is honoured.
+// before it routes its crew. It is sized to cover the disk read of a cached
+// catalog and nothing more. It is a variable because the test of the bound must
+// not spend three seconds proving the bound is honoured.
 var autoSeatRowsBound = 3 * time.Second
 
-// useAutoSeats seats this process's catalog under the seat ladder, and is what
+// useAutoSeats seats this process's catalog under the crew router, and is what
 // a headless door calls BEFORE it resolves its seats.
 //
-// The order is the whole of it. A tier row that says `auto` is answered from
-// the rows already in hand ([config.AutoModels]), and every headless door
-// climbed the ladder before it asked for a catalog at all — so the word read
-// against nothing and landed on the family's table row on every run, on a
-// machine whose catalog was sitting in its own cache file. It is the same lazy,
-// memoised catalog every one of those doors goes on to use; asking for it a few
-// lines earlier waits for nothing.
-//
-// AND WHEN THE ANSWER NEEDS THE ROWS, THE DOOR WAITS FOR THEM, within
-// [autoSeatRowsBound]: a pick taken off the table ([config.CrewPickAt]) and a
-// tier row that says auto ([config.AnyTierAutoAt]) are both computed from those
-// rows, and the chat surface never met the defect because its picks happen after
-// the warm has landed. The bound is a bound on the wait, not on the fetch — when
-// it runs out the warm carries on in the background, the resolver falls to the
-// family's table row exactly as it did before, and the seat's receipt names the
-// rung that answered (`table`), so a run that fell says it fell. A profile with
-// neither a pick nor an auto row reads no rows at all, and waits for nothing,
-// the way it always has.
+// THE ORDER IS THE WHOLE OF IT. Every seat nobody pinned is routed per task
+// from the catalog's rows ([config.CrewCatalog]), and a door that climbed the
+// ladder before it asked for a catalog would route from nothing. So the door
+// waits for the rows, within [autoSeatRowsBound]: the bound is a bound on the
+// wait, not on the fetch — when it runs out the warm carries on in the
+// background and the router works from the models it can still price (a pin, a
+// flag), and says so in the error it answers when it cannot seat a seat.
 func useAutoSeats(settings config.Config) {
 	resolved := sharedCatalog(settings)
-	if config.CrewPickAt(settings.ProfileDir) == config.CrewPickTable && !config.AnyTierAutoAt(settings.ProfileDir) {
-		return
-	}
 	ctx, cancel := context.WithTimeout(context.Background(), autoSeatRowsBound)
 	defer cancel()
 	resolved.Warmed(ctx)
diff --git a/cmd/codeaf/subharness_run.go b/cmd/codeaf/subharness_run.go
index d0f332a326..e614b9eac6 100644
--- a/cmd/codeaf/subharness_run.go
+++ b/cmd/codeaf/subharness_run.go
@@ -118,7 +118,7 @@ func runSubharnessCommand(args []string) error {
 	// same ladder every other headless door climbs, so a profile's crew reaches
 	// this one too (config.ResolveSeats).
 	useAutoSeats(settings)
-	seats := config.ResolveSeats(settings.ProfileDir, *model, "")
+	seats := doorSeats(settings, *model, "", "")
 	applySeats(&settings, seats)
 	fmt.Fprintln(os.Stderr, seats.Work.Report())
 	// The measured ruler is seated for the same reason `run` seats it: this is a
diff --git a/cmd/codeaf/taskcap_test.go b/cmd/codeaf/taskcap_test.go
new file mode 100644
index 0000000000..f08aba2fa9
--- /dev/null
+++ b/cmd/codeaf/taskcap_test.go
@@ -0,0 +1,60 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/session"
+)
+
+// costlyCompleter answers every call at a fixed provider-reported cost.
+type costlyCompleter struct {
+	usd   float64
+	calls int
+}
+
+func (c *costlyCompleter) CompleteWithMessages(context.Context, []ai.Message, ...ai.Option) (*ai.Response, error) {
+	c.calls++
+	cost := c.usd
+	return &ai.Response{Choices: []ai.Choice{{Message: ai.Message{Role: "assistant"}}},
+		Usage: &ai.Usage{PromptTokens: 100, CompletionTokens: 10, Cost: &cost}}, nil
+}
+
+// -YES-SPEND DOES NOT LIFT THE PER-TASK LIMIT: the guard a `do` run is held
+// to carries it with and without the flag, with and without a routed crew,
+// and a run under the flag stops at it.
+func TestYesSpendKeepsThePerTaskLimit(t *testing.T) {
+	dir := t.TempDir()
+	crew := &crewroute.Decision{}
+	for _, c := range []struct {
+		crew          *crewroute.Decision
+		preauthorized bool
+	}{{crew, true}, {crew, false}, {nil, true}, {nil, false}} {
+		guard := doSpendGuard(dir, c.crew, c.preauthorized)
+		if guard.TaskCap != 5 || guard.TaskAction != config.CrewTaskCapAction(5) {
+			t.Fatalf("crew=%v yes-spend=%v: per-task limit %v, %q", c.crew != nil, c.preauthorized, guard.TaskCap, guard.TaskAction)
+		}
+	}
+
+	guard := doSpendGuard(dir, crew, true)
+	guard.Price = func(string) (float64, float64, float64, bool) { return 1e-6, 1e-5, 0, true }
+	guard.Day = session.NewSpendDay(0)
+	seat := &costlyCompleter{usd: 2}
+	wrapped := guard.Wrap("vendor/worker", seat)
+	var stopped session.ErrSpendStopped
+	var err error
+	for i := 0; i < 10 && err == nil; i++ {
+		_, err = wrapped.CompleteWithMessages(t.Context(), []ai.Message{{Role: "user"}})
+	}
+	if !errors.As(err, &stopped) || stopped.Action != "this task reached its $5 limit · raise it in /crew" {
+		t.Fatalf("a run under -yes-spend ended on %v", err)
+	}
+	if seat.calls != 2 {
+		t.Fatalf("%d calls were made under a $5 limit at $2 a call, want 2", seat.calls)
+	}
+}
diff --git a/docs/DESIGN-LANGUAGE.md b/docs/DESIGN-LANGUAGE.md
index 4660e1f8b0..4c71ce1b94 100644
--- a/docs/DESIGN-LANGUAGE.md
+++ b/docs/DESIGN-LANGUAGE.md
@@ -386,10 +386,10 @@ opposite ends.
 This surface says a great deal on its own account — a note, a hint, a legend, an
 announcement — and every word of it was written in the reading tiers, because
 none of it is the conversation. That is right about the LINE and it was wrong
-about what the line is for. `crew → balanced · brain kimi-k3:low · hands
-deepseek-v4-flash · checks qwen3.8-27b` was one flat dim run from end to end:
-the words a person already knew, and the four model ids they typed the command
-to learn, at exactly the same weight. The sentence was legible and the ANSWER
+about what the line is for. `checker ⌖ moonshotai/kimi-k3 · every task until
+you unpin it · you are still talking to deepseek-v4-flash` was one flat dim run
+from end to end: the words a person already knew, and the two model ids they
+typed the command to learn, at exactly the same weight. The sentence was legible and the ANSWER
 inside it was not.
 
 So the prose of an informational line stays where it is, and **each load-bearing
@@ -441,8 +441,8 @@ mentioned would have spent the budget forty times a minute.
 a line is bright then nothing in it is, and a rule that lifted every noun would
 have bought back the flat line it started from. So the hint slot lifts the key
 and never the verb beside it; `/status` lifts the figure and never its label;
-the crew line lifts the three ids and leaves `crew →`, the preset word the
-person has just typed, and the three role words where they were — those are the
+the `/crew` panel lifts the model ids and leaves the seat words, `auto · now`
+and the words the person has just typed where they were — those are the
 question, and the ids are the answer.
 
 **A datum is named, never guessed.** `internal/tui3/payload.go` holds the whole
diff --git a/docs/GUIDE.md b/docs/GUIDE.md
index 91f927d48d..5664b0e263 100644
--- a/docs/GUIDE.md
+++ b/docs/GUIDE.md
@@ -303,7 +303,7 @@ sign in once in your browser. openrouter makes the default service's key for thi
 Where it is not, the same page is headed `your openrouter key` and reads `codeaf talks
 to models on its default service through openrouter, on your key and your card. nothing
 is sent until you do.` Either way the foot takes a pasted key and `esc` skips setup.
-The second page is `Daily limit`, `Chat model` and `Work crew`.
+The second page is `Daily limit` and `Chat model`.
 
 </details>
 
@@ -320,7 +320,7 @@ object, while a pinned call asks for exactly that lane. `latency` and `price` re
 opt-in settings.
 
 The default daily rail is `$500`; setting that row to `0` removes it. First run asks for
-`Daily limit`, `Chat model`, and `Work crew`.
+`Daily limit` and `Chat model`; a task's crew is picked per task, and `/crew` shows it.
 
 State lives under `$CODEAF_HOME`, or `~/.codeaf` when it is unset or empty: settings and credentials
 in `config.json`, memory in `graph.db`, and project sessions under `v3/projects/`.
diff --git a/docs/HEADLESS.md b/docs/HEADLESS.md
index 3b10d0c88e..2c4f55acc3 100644
--- a/docs/HEADLESS.md
+++ b/docs/HEADLESS.md
@@ -17,6 +17,7 @@ schema, and a person needs to know which command actually thinks.
 ```
 codeaf do "<task>" [--dir dir] [--db path] [--keep] [--timeout D]
                    [--json] [--yes-spend] [--model slug] [--plan-model slug]
+                   [--check-model slug] [--best|--cheap] [--pin seat=model[@provider]]
                    [--context-fill N] [--completion-reserve N]
 ```
 
@@ -40,9 +41,13 @@ work done.
 | `--keep` | off | Keep the private store instead of deleting it; the path is printed to stderr. |
 | `--timeout D` | `15m` | Hard wall, as a duration with a unit: `5m`, `2h`, `90s`. A bare number is still read as seconds for one release, so `--timeout 900` keeps working. A wall, not a schedule — the length of rope at which a wedged run is more useful dead. |
 | `--json` | off | Print one machine-readable object instead of the prose deliverable. |
-| `--yes-spend` | off | Spend past today's limit and past the plan-price question, without stopping to ask. The same flag with the same one sentence on `codeaf plan run`. Equivalent to `CODEAF_PREAUTHORIZE_SPEND=1`. |
-| `--model slug` | the ladder below | The work model for this run. |
-| `--plan-model slug` | the ladder below | Model that plans, replans, writes contracts, and runs the delivery gate, when it should differ from the model executing leaves. |
+| `--yes-spend` | off | Spend past today's limit and past the plan-price question, without stopping to ask. The same flag with the same one sentence on `codeaf plan run`. Equivalent to `CODEAF_PREAUTHORIZE_SPEND=1`. It does not lift the per-task limit (`/crew cap task`, $5 unless set). |
+| `--model slug` | the ladder below | The worker for this run — a one-task pin. |
+| `--plan-model slug` | the ladder below | The planner for this run — a one-task pin: plans, replans, writes contracts, and runs the delivery gate. |
+| `--check-model slug` | the ladder below | The checker for this run — a one-task pin. It never inherits the planner. |
+| `--best` | off | Run this task on the strongest crew your allowed models make. |
+| `--cheap` | off | Run this task on the cheapest crew your allowed models make. |
+| `--pin seat=model[@provider]` | none | Pin one seat for this run only — `worker=`, `planner=` or `checker=`. Repeatable, once per seat. |
 | `--context-fill N` | `60` | How full a model's context window may get before it is compacted, in percent; the law clamps it to 10–90. Setting it is what makes it govern a conversation's fold line as well — unset, that line follows the model's window. |
 | `--completion-reserve N` | `65536` | Tokens every call keeps free for its visible answer *and its reasoning*. Raise it for a reasoning-heavy model that truncates; lower it to buy prompt room on a small window. |
 
@@ -118,47 +123,66 @@ question was not the compiler's to answer at all.
 The corollary for a harness: put the answer in the ask. Anything you leave
 implicit is something `do` will decide for you and tell you it decided.
 
-### Which models a run uses — one ladder, four rungs
+### Which models a run uses — three seats, one ladder each
 
-The two seats — the model that **works** and the model that **plans** — resolve
-the same way at every headless door (`do`, `exec`, `run`, `plan new`,
-`plan revise`, `plan run`). First rung that answers wins, per seat:
+A run has a crew of three seats — the **worker** that does the work, the
+**planner** that plans it and the **checker** that reads the result — and every
+headless door (`do`, `exec`, `run`, `plan new`, `plan revise`, `plan run`)
+resolves them the same way. First rung that answers wins, per seat:
 
-| | work seat | plan seat |
-| --- | --- | --- |
-| 1 | `--model slug` | `--plan-model slug` |
-| 2 | `CODEAF_MODEL` | `CODEAF_PLAN_MODEL` |
-| 3 | the profile's crew — the **small work** row | the profile's crew — the **mastermind** row |
-| 4 | the build's default (`codeaf --help`) | empty: the work model plans too |
-
-**Rung 3 is what `/crew` writes** (`models.tiers.*` in the profile's
-`config.json`), and it is the rung that used to be missing: until #166 a headless
-run read the flags and the environment and never opened the profile, so a machine
-told `frugal` in the chat ran something else the moment the same brain ran
-headless. The two rows are the ones the chat's own planner and worker ride, so
-the crew now means the same thing on both surfaces.
-
-The crew answers only where a crew was actually **written**. A profile nobody has
-touched falls to rung 4 — the four shipped tier values are the `balanced` row, so
-reading them as a crew would make rung 4 unreachable and change the default work
-model for everybody. `CODEAF_HOME` / `CODEAF_PROFILE_DIR` decide which profile is
+| | worker | planner | checker |
+| --- | --- | --- | --- |
+| 1 | `--model slug` | `--plan-model slug` | `--check-model slug` |
+| 2 | `CODEAF_MODEL` | `CODEAF_PLAN_MODEL` | `CODEAF_CHECK_MODEL` |
+| 3 | a `/crew pin` in the profile | a `/crew pin` | a `/crew pin` |
+| 4 | routed for this task | routed for this task | routed for this task |
+
+**Rungs 1 and 2 are one-task pins.** They are handed to the router as pins for
+this run, so the crew line, the estimate and the logged decision describe the
+crew that actually ran. **The checker never inherits the planner**: a pinned
+planner says something about planning and nothing about who grades the work.
+`codeaf do --pin checker=moonshotai/kimi-k3@openrouter` is the same pin spelled
+per seat, with the route after `@`.
+
+**Rung 3 is what `/crew pin` writes** in the chat, so a checker pinned there is
+the checker here. `CODEAF_HOME` / `CODEAF_PROFILE_DIR` decide which profile is
 asked, so an isolated run is isolated here too.
 
-A crew row may carry a thinking level (`moonshotai/kimi-k3:low`), and so may a
-flag or a variable. The value travels whole and the level is applied per call by
-the role ladder, exactly as it is in the chat; the slug sent to the provider is
-the model alone. (Until this landed it was sent whole, so `--plan-model
-kimi-k3:low` asked OpenRouter for a model id nobody publishes.)
+**Rung 4 is the router.** Every seat nothing named is picked for this task: the
+task text is read as a class of work (`bugfix`, `openended` or `other`), and each
+seat gets the model that serves that class best for its cost among the models
+the profile allows (`/crew models` — `all` when nothing was written). `--best`
+and `--cheap` move one run to the strongest or the cheapest crew allowed.
+
+A seat's value may carry a thinking level (`moonshotai/kimi-k3:low`). The value
+travels whole and the level is applied per call by the role ladder, exactly as
+it is in the chat; the slug sent to the provider is the model alone.
 
-**Every run says which rung answered**, on stderr, before anything else:
+**Every run says which rung answered**, on stderr, before anything else, and
+under it the crew line — the class, the worker and its route, the checker (📌
+on a pinned seat) and the estimate:
 
 ```
-models: work z-ai/glm-5.3-flash (crew frugal) · plan z-ai/glm-5.3-flash (crew frugal)
-models: work anthropic/whatever (--model) · plan follows the work model (default)
+models: worker z-ai/glm-5.3-flash (routed) · planner z-ai/glm-5.3-flash (routed) · checker moonshotai/kimi-k3 (pinned)
+crew: bugfix · worker glm-5.3-flash (openrouter) · checker 📌 kimi-k3 · est $0.023
 ```
 
+When the run ends the `crew:` line is said again with the actual beside the
+estimate — `$0.021 (est $0.023)`.
+
+**The daily cap.** `/crew cap` sets what crews may spend in a day. At the cap
+`codeaf do` refuses before spending anything — `today's crew spend has reached
+the daily cap of $5.00 · raise it with `/crew cap`, run with --cheap, or pass
+-yes-spend` — and `--yes-spend` is the one way past. The other doors warn on
+stderr and go on.
+
+**The per-task limit.** Every run is held to the most one task may spend, $5
+unless `/crew cap task` set another. A call that would take the run past it is
+not made, and the run stops on `this task reached its $5 limit · raise it in
+/crew`. `--yes-spend` does not lift it.
+
 so a campaign can verify what actually ran instead of trusting the shell it
-launched from. `do --json` carries the same four facts as fields.
+launched from. `do --json` carries the same facts as fields.
 
 ### Exit codes — one ladder, and it is the same one on all three commands
 
@@ -269,13 +293,19 @@ there now. Test its value, or read `ok`.
 Fields that belong to `do` and stay: `spend_work` and `spend_overhead` — what
 the work cost against what it cost to decide what the work should be —
 `blocked_on`, `learned`, `plan_model`, `model_source`, `plan_model_source`,
+`check_model`, `check_model_source`, `class`, `crew`, `est_usd`, `effort`,
 `subharness` and `workspace`.
 
 | Field | Contract |
 | --- | --- |
 | `blocked_on` | The question it could not answer, verbatim. Non-empty **only** alongside a non-zero exit and an empty `answer`. |
 | `learned` | The job's blackboard: discoveries, pitfalls, a sibling's failure and why. On an ephemeral store this is the only piece of what the run understood that would otherwise die with it — capture it if you care about the run's reasoning. |
-| `model_source` / `plan_model_source` | Which rung of the ladder above chose each: `--model`, `CODEAF_MODEL`, `crew frugal`, `default`. Pin these in a campaign's records — they are the only way to tell two cells apart that were launched from different profiles. |
+| `model_source` / `plan_model_source` / `check_model_source` | Which rung of the ladder above chose each seat: the flag (`--model`, `--plan-model`, `--check-model`), the variable (`CODEAF_MODEL`, …), `pinned` or `routed`. Pin these in a campaign's records — they are the only way to tell two cells apart that were launched from different profiles. |
+| `check_model` | The checker's model. Present whenever a checker was seated. |
+| `class` | The class of work the task was read as: `bugfix`, `openended` or `other`. Present on a routed run. |
+| `crew` | Each seat — `worker`, `planner`, `checker` — as `{model, provider, kind, pinned, est_usd}`; `kind` is how the route bills: `metered`, `plan` or `local`. |
+| `est_usd` | The crew's estimate for the task, beside `spend_usd`, which is the actual. |
+| `effort` | `best` or `cheap` when `--best` or `--cheap` was given; absent otherwise. |
 | `workspace` | The directory the run worked in, absolute, edited in place. Always present; empty on a run that never opened one or was handed to an existing resident whose workspace this invocation cannot establish. |
 
 ### Stream discipline
@@ -739,8 +769,9 @@ The full list is `codeaf help env`. What matters headless:
 | Variable | Default | Why a harness cares |
 | --- | --- | --- |
 | `OPENROUTER_API_KEY` | — | Required. |
-| `CODEAF_MODEL` | see `--help` | The work model. `--model` overrides per run; unset, the profile's crew answers before the built-in default — see the ladder in section 1. |
-| `CODEAF_PLAN_MODEL` | unset | Plans, replans, contracts, and the gate on a stronger model while a smaller one executes leaves. Unset, the profile's crew mastermind answers; with no crew written, the work model plans too. |
+| `CODEAF_MODEL` | unset | Pins the worker for every run it is set on. `--model` overrides per run; unset, a `/crew pin` or the router answers — see the ladder in section 1. |
+| `CODEAF_PLAN_MODEL` | unset | Pins the planner: plans, replans, contracts and the delivery gate. Unset, a `/crew pin` or the router answers. |
+| `CODEAF_CHECK_MODEL` | unset | Pins the checker. Unset, a `/crew pin` or the router answers — never the planner. |
 | `CODEAF_MODELS` | unset | A panel instead of one model: calls cascade cheapest-first and escalate when a verifier catches a failure. Comma-separated slugs or a JSON path. **Changes what a run costs and how it fails — pin it when measuring.** |
 | `CODEAF_DAILY_BUDGET` | `20.0` | The day's spending limit in dollars; `0` is unlimited. A run that reaches it stops. |
 | `CODEAF_PREAUTHORIZE_SPEND` | unset | `1` is `--yes-spend` for every run. |
@@ -783,15 +814,16 @@ Rules that came from getting them wrong:
 - **`--model` alone does not pin a chat cell to one model.** The tier rows and
   role pins answer the auxiliary calls, so a campaign attributing spend and
   quality to a named model must pass `--one-model` — or measure a profile it
-  did not record. `do` takes its two seats from the same tier rows when nothing
-  else names them, so a headless cell is pinned by passing both flags (or both
-  variables), and `model_source` in the `--json` object says whether they took.
+  did not record. `do` routes every seat nothing names, so a headless cell is
+  pinned by passing all three flags (or all three variables, or `--pin` per seat),
+  and `model_source`, `plan_model_source` and `check_model_source` in the `--json`
+  object say whether they took.
   A run whose numbers are compared across the two shapes should say which is
   which. Verify rather than assume: the `usage` records in the session
   transcript name the model that actually served each call.
 - **The profile is part of the measurement.** Two cells run from two profiles
-  with different crews are two configurations, not one. Record `model_source`
-  and `plan_model_source` beside the score, or point every cell at one
+  with different pins or allowed models are two configurations, not one. Record
+  `model_source`, `plan_model_source`, `check_model_source` and `crew` beside the score, or point every cell at one
   `CODEAF_PROFILE_DIR`.
 - **`--timeout` is part of the result.** A cell that hit the wall measured the
   wall as much as the work. Report the timeout rate beside the score or the
diff --git a/docs/LIMITS.md b/docs/LIMITS.md
index 1e94d7d591..a246613637 100644
--- a/docs/LIMITS.md
+++ b/docs/LIMITS.md
@@ -42,6 +42,14 @@ today's spend beside the word: `no limit · $4.25 today`.
 spell "practice without a bound" — self-origin work runs while nobody is
 watching, so it is the one pocket that always has a bottom.
 
+**The crew's two limits live on `/crew`, not on this tab.** The **per task** row
+here reads the per-task limit and opens nothing new: it is set with
+`/crew cap task <dollars>` or on the panel's cap row (`per task $5 · daily none`).
+It is the second rail where `0` is not "no limit" — a task always has a limit, so
+`0` and `none` are refused and an emptied box is $5 again. The crew's **daily
+cap** beside it is unset until somebody sets it with `/crew cap <dollars>`, and
+`/crew cap off` takes it away.
+
 ## Every rail in the build
 
 | # | Rail | Where the number lives | Was | Now | Unit | What it blocks | `0` = no limit |
@@ -57,6 +65,9 @@ watching, so it is the one pocket that always has a bottom.
 | 9 | workflow ceiling | `internal/craft/types.go` `MaxRunBudgetUSD` | 10 | **500** | USD | the most a workflow file may grant itself | n/a |
 | 10 | workflow wall | `internal/craft/types.go` `DefaultWallClock` / `MaxWallClock` | 30m / 2h | **6h / 24h** | time | stops opening new rounds; running leaves finish | no |
 | 11 | discard consent gate | `internal/store/surgery.go` `SurgerySpendGateUSD` | 0.25 | **5** | USD already spent | asks before throwing running work away — raising it asks **less** | n/a |
+| 12 | per-task limit | `internal/config/crew.go` `CrewTaskCapDefault` | none | **5** | USD per task | the call that would pass it is not made; the task stops on `this task reached its $5 limit · raise it in /crew`. `-yes-spend` does not lift it | **no — a task always has one** |
+| 13 | crew daily cap | `internal/config/crew.go` `CrewCapAt` (`models.crew.cap`) | none | **none** | USD/day of crew spend | a task does not start, and a call that would cross it is not made; `codeaf do` refuses unless `-yes-spend` | yes (`off`) |
+| 14 | checker ceiling | `internal/config/crewspend.go` `crewCheckCeilingTimes` / `crewCheckCeilingFloor` | none | **3× the checker's estimate, at least $0.05** | USD per check | the check stops and the task ends unchecked | n/a |
 
 ### Rails that already shipped unbounded, and stay that way
 
@@ -71,8 +82,8 @@ watching, so it is the one pocket that always has a bottom.
 `CODEAF_NODE_BUDGET` (60 nodes) and `--budget` on `codeaf run` / `codeaf exec`
 (150 000 **tokens**) are counts. A task's own bounds are steps and time —
 `taskDeadline` 60m renewable four times, `taskMaxSteps` 200, `taskNoProgress` 6
-— and a task carries **no dollar cap of its own**: its money bound is whatever
-rail the conversation that started it carries. `costHintUSD` (10¢) is the point
+— and a task's dollar cap is the per-task limit set in `/crew` (`models.crew.task_cap`,
+$5 by default), inside whatever rail the conversation that started it carries. `costHintUSD` (10¢) is the point
 at which a first-run tip arms, not a ceiling.
 
 ## Where each number is set, in the order it wins
@@ -92,6 +103,8 @@ explicit instruction and still errors.
 | standing per-firing | — | `per_run_usd` on the `stand` tool, per item |
 | adaptive-run tank | — | the composer's third line, per run |
 | unattended budget | `CODEAF_MAX_COST` / `CODEAF_MAX_HOURS` | no — flags |
+| per-task limit | — | `/crew cap task` (`models.crew.task_cap`) |
+| crew daily cap | — | `/crew cap` (`models.crew.cap`) |
 
 ## One source of truth
 
diff --git a/docs/TELEMETRY.md b/docs/TELEMETRY.md
index a0d1e1a665..3551ea7e52 100644
--- a/docs/TELEMETRY.md
+++ b/docs/TELEMETRY.md
@@ -110,7 +110,8 @@ The usage counts are not the only thing this binary sends to AgentField. With
 `model_pool` set to `on` — the default — a judge scores each crew seat after a
 task lands, and one row per seat leaves for
 `https://codeaf.agentfield.ai/pool/v1/rows`: the model slug that held the
-seat, the judge's slug, the seat (worker, high or mastermind), a 0-100 score,
+seat, the judge's slug, the seat (the worker, checker or planner, spelled on the wire as `worker`,
+`high` and `mastermind`), a 0-100 score,
 the door the run came in by (task, do, exec or run), the crew size and the UTC
 day, under a random per-install nonce in an `X-Codeaf-Install` header. No prompt, code, path or name rides in a row. **Every way of turning the
 counts off turns this stream off too** — `CODEAF_TELEMETRY=off`,
diff --git a/docs/changes/unreleased/1436-crew-routed-per-task.md b/docs/changes/unreleased/1436-crew-routed-per-task.md
new file mode 100644
index 0000000000..80ccc77049
--- /dev/null
+++ b/docs/changes/unreleased/1436-crew-routed-per-task.md
@@ -0,0 +1,79 @@
+---
+kind: changed
+title: a task's crew is routed per task, and /crew is the panel of what is allowed and pinned
+pr: 1436
+surface: [engine, chat, docs]
+invalidates:
+  - "The crew was a preset word — `frugal`, `balanced`, `max` — that wrote all five tier rows at once, with a family row (`models.crew.source`: `open` or `all`) and a pick row (`models.crew.pick`: `table`, `catalog`, `learn`) beside it, and a tier row could say `auto`. None of those words exists now: every seat nobody pinned is picked per task by internal/crewroute. `/crew <preset>` is refused with the four forms the command does take."
+  - "The preset tables, the catalog picker package, `config/auto.go` and its catalog, index and own-cells seams, and the three shipped crew-seat default models are gone. The router's catalog seam is `config.CrewCatalog`; the Model Pool's index is no longer a crew picker."
+  - "The check seat inherited the plan seat's model when only the planner was named by flag or environment. It never does: `--check-model`, `CODEAF_CHECK_MODEL`, a pin, or the router's checker."
+  - "A seat nothing pinned fell to a model this build chose for everybody. It is routed; a seat nothing allowed can sit is an error that says so."
+  - "A worker row a profile never wrote was read as inherited from the small-work row, with a one-time notice. There is no inheritance and no notice: an unwritten crew row is auto."
+  - "The onboarding controls screen asked for a crew. It asks for the daily limit and the chat model; the crew asks nothing up front."
+  - "The settings rows for the working, careful and planning tiers are one `seats` row that opens the `/crew` panel. The `crew`, `model family` and `picked from` rows are gone."
+  - "`codeaf do`'s `model_source`/`plan_model_source` read `crew <preset>` or `default`. They read `--model`, the variable, `pinned` or `routed`, and `-json` also carries `class`, `crew`, `est_usd`, `check_model` and `check_model_source`."
+  - "A task carried no dollar limit of its own, and the Spending tab's `per task` row read `no limit of its own`. A task is held to the per-task limit set in `/crew` ($5 by default), and the row reads that figure."
+  - "On an OpenRouter balance read as low, the five tier rows nobody set read a hand-picked free crew and `/status` called that crew `free`. Only reflex and small work read free models now; the three crew seats see the OpenRouter account as out of credit before any call and are routed to free pools, and the crew line says `free routes in use (may log prompts) · credit unavailable on openrouter`."
+  - "Remote protocol version 17 is replaced by 18: `Task.Start` carries the one-task effort word and `Task.RedoStronger` runs a task again on a stronger crew. An older engine refuses at the handshake rather than starting the task on the crew the person asked it not to use."
+---
+A task's crew — the worker that does the work, the planner that structures it
+and the checker that reads the result — is picked for that task. The router
+classifies the task as a bugfix, a complex fix (a bugfix whose report shows
+reach), open-ended work or other, prices every
+allowed model on every connected route (a subscription plan or a local model
+costs nothing to route to), and sits each seat where quality minus λ times cost
+is highest, λ at the knee of the curve. `--best` and `--cheap` (on `/task`, on
+the conversation's hand-off as `effort`, and on `codeaf do`) move λ for one task
+only. The design behind the defaults is in
+`docs/design/model-pool/pareto-crewing.pdf`.
+
+**Every model in the catalog is scored from its catalog row.** Fitted weights
+shipped in `internal/crewroute/prior.json` turn a row into a quality per seat
+and class with its variance. A row that publishes any index (the AA indexes or
+arena Elo) is scored on its indexes alone, so a model no dearer and at least as
+good on every shared index never ranks below another; a row with none is
+scored from context, release date (the catalog's `created` field, now read),
+licence and family, never above the population mean. Price is never read as
+ability. Seats weigh a model at its score less one standard deviation of
+ability; a worker's and a checker's mean ability must reach the floor when any
+allowed model's does. On open-ended and other work at the knee a support
+upgrade goes to the checker, the planner staying on the base model; `--cheap`
+takes a stronger worker within 1.5× the cheapest one's cost. A model whose row is too thin for a finite score is not picked unless
+pinned. Reach is read over a one-paragraph ask's whole text, a security fix is
+a reach signal, and "wrongly", "rejected", "instead of" and a rename or version
+bump read as fixes. No per-model table ships, and
+estimates come from catalog prices times each seat's token profile times the
+install's own cost factor. Each task's outcome — accepted, kept, redone,
+failed — moves that model's score in that seat by a small bounded step,
+recorded on the decision row.
+
+**What persists is what the panel says.** `/crew` opens an interactive panel:
+the three seats (`auto · usually <model>` or a pin), the allowed-models rule
+stepped in place (`all`, `open`, a price ceiling typed into two boxes, or a
+custom checklist of providers and models), the daily cap typed in place, and a
+line for today's spend. A seat's list starts with auto and the suggested model,
+opens a model's routes, and offers to widen the rule when the pick is outside
+it. Every change saves at once, ticks its row and can be undone with `z` for a
+few seconds. `/crew pin <seat> <model[@provider]>`, `/crew unpin <seat|all>`,
+`/crew models <rule>` and `/crew cap <dollars|off>` write the same state and
+open the panel on the changed row. In `/settings` → Providers the three seat
+rows are one `seats` row that opens the panel. A pin outside the allowed models is refused. At the cap a chat task
+does not start and `codeaf do` refuses unless given `-yes-spend`.
+
+**No task may cost more than its limit**, $5 unless set on the panel's cap row
+(`per task $5 · daily none`, `tab` between the two) or with `/crew cap task <dollars>`.
+Every priced call of the task — each seat and the helpers made for it — is held
+to one tally before it is made; the call that would pass the limit is not made
+and the task stops on `this task reached its $5 limit · raise it in /crew`.
+`-yes-spend` does not lift it, and `codeaf do` holds every run to it.
+
+**Redo is how a crew learns.** `/redo stronger` runs the last task again with
+every unpinned seat one step stronger, and the router's log records that this
+class of work in this repository was under-served, so the next such task starts
+a step higher, at most three steps; each accepted task of that kind takes a
+step back off. Nothing escalates on
+its own.
+
+**Old profiles migrate once**, with one line: preset, pick and `auto` rows
+become auto, the ids a person wrote stay pinned, and the `open` family becomes
+the allowed rule `open`.
diff --git a/docs/changes/unreleased/1501-crew-pinned-checker-gap.md b/docs/changes/unreleased/1501-crew-pinned-checker-gap.md
new file mode 100644
index 0000000000..644747ef16
--- /dev/null
+++ b/docs/changes/unreleased/1501-crew-pinned-checker-gap.md
@@ -0,0 +1,8 @@
+---
+kind: fixed
+title: the /crew panel's weak-checker warning counts a pinned checker
+pr: 1501
+surface: [chat, docs]
+invalidates:
+  - "The `/crew` panel's `no strong checker among the models you allow` warning was asked of the allowed models only. A strong checker pinned over a weak set left the warning on screen, and a weak checker pinned over a strong set had none. A pinned checker is now the one asked: a strong pin clears the warning, and a weak pin reads `checker pinned to <model> · open-ended work will be checked weakly`."
+---
diff --git a/docs/design/home-rethink/DATA-AUDIT.md b/docs/design/home-rethink/DATA-AUDIT.md
index 6c610b6988..8bf6dd050d 100644
--- a/docs/design/home-rethink/DATA-AUDIT.md
+++ b/docs/design/home-rethink/DATA-AUDIT.md
@@ -511,7 +511,7 @@ Display (:77), Providers (:80), Connections (`connectcaps.go:109`). The other
 concepts are **separate overlays** with their own commands: `/connect` →
 `openConnect` (`connectpanel.go:463`), `/permissions` → `openPermissions`
 (`permissions.go:265`), `/harness` → `openHarness` (`harnesspanel.go:209`),
-`/crew` → `crewPicker` (`crew.go:183`). `/fixes` and `/accounts` do not exist.
+`/crew` → the crew chooser of the time (`crew.go:183`; since replaced by the `/crew` panel). `/fixes` and `/accounts` do not exist.
 
 | Section | Verdict |
 | --- | --- |
diff --git a/docs/design/model-pool/Makefile b/docs/design/model-pool/Makefile
deleted file mode 100644
index 08d0fd4ade..0000000000
--- a/docs/design/model-pool/Makefile
+++ /dev/null
@@ -1,27 +0,0 @@
-# Builds pareto-crewing.pdf: the figures from data/*.csv, then the paper.
-#   make          stale figures + pdf
-#   make figures  redraw every figure and table
-#   make clean    remove build products but keep the pdf
-
-FIGURES := fig-front.pdf fig-cells.pdf fig-shrink.pdf fig-regret.pdf fig-semibandit.pdf tab-regret.tex tab-semibandit.tex
-
-all: pareto-crewing.pdf
-
-figures:
-	python3 figures.py
-
-# One run of the script writes every figure and table; the stamp is what make
-# dates them by, so old makes without grouped targets work too.
-$(FIGURES): figures.stamp
-figures.stamp: figures.py data/measured-crews.csv data/seed-cells.csv
-	python3 figures.py
-	touch $@
-
-pareto-crewing.pdf: pareto-crewing.tex $(FIGURES)
-	latexmk -pdf -interaction=nonstopmode -halt-on-error pareto-crewing.tex
-
-clean:
-	latexmk -c pareto-crewing.tex
-	rm -f pareto-crewing.bbl figures.stamp
-
-.PHONY: all figures clean
diff --git a/docs/design/model-pool/REVIEW-2.md b/docs/design/model-pool/REVIEW-2.md
deleted file mode 100644
index d18220d551..0000000000
--- a/docs/design/model-pool/REVIEW-2.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# Second review of docs/design/model-pool/pareto-crewing.tex
-
-Referee report on the revision; the first is `REVIEW.md` (written against the draft then called `learn.tex`), the authors' answer `REVIEW-RESPONSE.md`. Every check below was made against this branch's code and data: `internal/pool/{index,judge,record,tally,outbox,pull,poolcfg}`, `internal/crewpick`, `cmd/codeaf/pool*.go`, `internal/config/{settings,auto}.go`, `relay/src/*.js`, `relay/wrangler.toml`, `.github/workflows/pool-mirror.yml`, `docs/design/model-pool/{figures.py,RUNBOOK.md,data/*.csv}`, `README.md` and the settings hint in `internal/tui3/settings.go`. Nothing was executed; no test suite, no `figures.py`.
-
-## Verdict
-
-**Minor revision.** The central mathematics is now right: Proposition 4's capped posterior derives correctly from the stated hierarchy including the bias term (checked end to end below), the drift moment no longer halves the estimate, and Proposition 3's statement is repaired. Every number quoted in Section 8 matches the committed tables exactly, the experiments run on all 23 chat-door crews, the row schema matches `record.Row` and the relay's validator field for field, and the Status paragraph is for the first time an accurate map of the branch — every claim in it checks against the tree except one word. What remains is a set of sentences that describe the relay as more merged and more complete than the code under `relay/` is (the join on the write path, drift and the constants in the hourly job, pool status's relay line, the read-side installs floor), one false sentence left inside a corrected proof, and one provenance number (72 runs over nine tasks) with no source in the repository. Each is a sentence or a small patch; none touches the paper's results. Minor revision.
-
-**Checks that passed.** (i) *Proposition 4* (:331–338). Under hierarchy (6), pool rows carry marginal variance $\sigma^2+\tau_1^2$ about $\mu_{rm}$, so their effective count at variance $\sigma^2$ is $\tilde n=n^{\mathrm{pool}}\sigma^2/(\sigma^2+\tau_1^2)=n^{\mathrm{pool}}\ell/(\ell+1)$; the posterior of $\mu_{rm}$ has precision $K/\sigma^2$, $K=k+\tilde n$, mean the $k{:}\tilde n$ weighted average of $\hat q_r(m)+b$ and $\bar y^{\mathrm{pool}}$; integrating $\mu_{rm}$ out gives $\mu^u$ an external precision $1/(\sigma^2/K+\tau_1^2)=W/\sigma^2$ with $W=K\ell/(K+\ell)\le\ell$, and combining with the own rows yields exactly (15)–(16) with $k^{\ast}+n^{\ast}=W$ in the ratio $k{:}\tilde n$. The Corollary is the $\ell=\infty$ limit ($W\to k+n^{\mathrm{pool}}$, $b=0$) and matches `crewpick.blendQuality` with `PriorWeightAt = 30` (crewpick.go:479) and the fold in internal/config/auto.go:169–176. (ii) *Drift* (:264): adjacent-day means have variance $\omega^2+\sigma^2(1/n_d+1/n_{d-1})$; the bracket subtracts exactly that, so (13) now estimates $\omega^2$, and the steady-state relation is untouched. (iii) *Section 8 against the tables*: Thompson 0.64 vs table 0.97 at $N=400$ (gap \$0.33, a third of 0.97), $\varepsilon$-greedy 0.76 (\$0.12 behind), crew-mean-score 0.31, crew-clean-bit 0.54, role 0.15 (half of 0.31, a third of 0.54) — all match `tab-regret.tex` and `tab-semibandit.tex` exactly; 23 chat-door crews (data/measured-crews.csv), 200 replicates, $k{=}30$, $H{=}\$10$, noise $0.15^2$ all match figures.py; 16 unknowns (6 workers + 4 checkers + 6 planners) behind 138 crews (one same-vendor worker/checker pair removes 6 of 144) match `role_truth`. (iv) *Row fields*: paper :199–201 = `record.Row` (record.go:106–116) = `schema.js` payload, nonce on the batch not the row (:201; outbox envelope, `X-Codeaf-Install`). (v) *Status* (:550) against the tree — see defect 4. (vi) README and the settings hint — see new defect 8.
-
-## The seventeen defects and the overstated claims
-
-1. **Prop 4, capped counts — fixed.** One capped external $W=K\ell/(K+\ell)$, $K=k+\tilde n$, split $k/K$ and $\tilde n/K$ (:331–333, proof :338); the "at most $\ell$ own rows" sentence now scopes to catalog and pool together (:345). Derivation verified, including the $b$ term and the $\sigma^2+\tau_1^2$ pool variance the first report found missing.
-2. **Drift $\tfrac12$ — fixed.** (13) at :264 carries the matching $\sigma^2(1/n_d+1/n_{d-1})$ noise term; no factor of one half.
-3. **Additive sheet vs max-join — partly fixed.** §5.2 (:224) now names both stores and the own sheet's description matches `tally.Merge` (tally.go:227) and its cell key (tally.go:123); but "The relay's store is the sheet of Definition 2, keyed by install and day and merged by (11)" is false of the code — the relay folds rows additively (relay/src/worker.js:160) and the join has no caller outside its test — see new defect 1. The abstract's join-semilattice sentence (:64) inherits the gap.
-4. **Status vs tree — fixed.** The judge hook is wired to chat landings (cmd/codeaf/poolrecord.go:46–66, the `session.TaskLanding` seam), rows are recorded into the own sheet and the outbox and pushed (record.go, cmd/codeaf/poolinstall.go:71–99), the built-in key is compiled in (cmd/codeaf/pool.go:31), the blend is the Corollary's at $k{=}30$, and the relay and mirror exist. One word overstates: "the join" in the relay clause — new defect 1.
-5. **Relay code — fixed.** `relay/` lands with `src/{worker,schema,sheet,index}.js`, tests and `verify.mjs`; `wrangler.toml` binds the `/pool/*` route. Residual: the ten-step runbook is at `docs/design/model-pool/RUNBOOK.md`, not "in that directory" (:493) — new defect 6.
-6. **Public key — fixed.** `poolPublicKeys` carries the signer's key (cmd/codeaf/pool.go:31, matching relay/wrangler.toml's `POOL_PUBLIC_KEY`), a stored key overrides it (`poolTrustedKeys`, cmd/codeaf/pool.go:44–53), and the background refresh starts under it (cmd/codeaf/poolindex.go:75–81).
-7. **Run counts — partly fixed.** The abstract no longer quotes a number (:64); Figure 6's "14 cells from 120 scored runs" (:478) is the defensible reading (data/seed-cells.csv: 14 cells, $n$ sums to 225, about 120 judged runs at ~1.9 scored roles). But the new number, "fitted by a ridge model on 72 scored runs over nine tasks" (:186, :442), is unverifiable on this branch: the runs column of measured-crews.csv sums to 1224, and `figures.py` reads the fitted columns without fitting anything, so nothing in the repository produces 72 or nine.
-8. **Role-level ratio — fixed.** :445 and :461 state both comparisons and every number matches: 0.54 clean bit, 0.31 mean score, 0.15 role at $N{=}400$; "half" and "a third" hold.
-9. **Prop 3 — partly fixed.** The statement is corrected (:243: one constant and one constraint per component; when $G$ is connected the single constraint identifies everything), but the proof still ends "With the single centring constraint, exactly one component is fully identified" (:246) — the removed falsehood, still false for $c\ge2$ (one constraint leaves a $(c{-}1)$-dimensional gauge; no component is pinned) — new defect 2.
-10. **Subset of crews — fixed.** "all 23 chat-door crews" (:445); `figures.py` `fig_regret` takes every `door=="task"` row, and the CSV holds 23; the `[:12]` slice is gone.
-11. **`min_installs` — partly fixed.** The relay computes and publishes a distinct-install count per cell (relay/src/sheet.js `aggregate` → `installs`; relay/src/index.js `buildIndex`), and §5.4's robustness claim is reduced to "a minority of installs that are broken or adversarial" (:253). But "A cell backed by fewer than three installs is published but not read" is still false of the code: both readers floor on the observation count (internal/pool/index/index.go:265 `n < x.minInstalls`; crewpick.go:235 `c.N < minInstalls`), `index.Cell` never reads a cell's `installs` field, and the seed ships `min_installs: 1` with no `installs` fields (internal/pool/index/seed.json:4). §9's flood sentence survives unchanged (:499) — the response says it was reduced; only the §5.4 half was.
-12. **Row fields — fixed.** Row (role, model, score, judge, door, size, day) (:199–201) = `record.Row` (record.go:106–116) = `schema.js`'s validated payload; nonce drawn once per profile, on the batch header not the row (:201; outbox.go, cmd/codeaf/poolinstall.go:44–69); no price or duration anywhere in a row; Definition 2's cell (:206), the relay's `cellKey` (sheet.js:24) and §9's "one triple per (install, cell, day)" (:493) now spell the cell one way.
-13. **Abstract — fixed.** The constants sentence scopes itself to statistical constants and names the two user prices (:64), matching Table 2 up to its last clause (new defect 5); the modes read as the code behaves (off reads nothing: cmd/codeaf/poolindex.go `poolIndexFor`).
-14. **`explore` — fixed.** "specified, not on this head" (:542); no such key exists in internal/config, consistently.
-15. **$E$ as surrogate — fixed.** :176 derives (3) as (2) at $r=1$, states the regime, and allows (2) directly where a delivered rate is measured.
-16. **Imputation — fixed.** :110 describes the implemented rule (crewpick.go `fill`: per present index, median ratio over at least three donors, offers averaged, capped at the pool's maximum; scale-proportional standing below three donors).
-17. **Loader — fixed.** :490 "the fresher of the cached index and the embedded seed index, by generated day" matches `index.Fallback` (index.go:96–104).
-
-Overstated claims:
-
-- **Abstract privacy — fixed** (:64 states what a row contains, not what can be inferred).
-- **Prop 5 — fixed** (product posterior; the proof names the ignored dependence and scopes exactness to the product approximation, :424).
-- **Exploration tax — partly fixed** (:445). Thompson is no longer the worst row (greedy is), but "no better than the table" is contradicted by `tab-regret.tex` at $N{=}10$ (0.97 vs 1.01) and $N{=}40$ (0.93 vs 0.95); only at $N{=}20$ is Thompson worse (0.97 vs 0.95). The differences are small; the sentence should say "within noise of the table" or quote the numbers.
-- **figures.py — partly fixed** (:482). The constants at its head are $H$, $\lambda$, $K$, REPS; fig-shrink's catalog 80, measured 65 and $\sigma{=}15$, and fig-front's iso-line anchors, are function-local, so "from the two CSV files it reads and the constants written at its head" still overstates two figures.
-- **pool status/show — partly fixed** (:546). `pool show` matches the code (each address with its source, the index summary); status counts pending, but "says whether the relay answered" is not implemented — status never reaches the network and prints the mode-derived can-send/can-read (cmd/codeaf/pool.go:213). New defect 7.
-- **Rollback — fixed in part** (:496). The version refusal is real (internal/pool/pull/pull.go `good`); the join clause leans on the unwired join — new defect 1.
-- **Judge floor — fixed** (:195, absolute; judge.go:45, applied absolutely in `Pick`).
-- **"cents per run" — fixed** (:195, "one short completion per role").
-
-## New defects
-
-1. **§5.2 (:224) and §9 (:496) claim the relay's store merges by the join (11); it does not.** The worker folds each received row additively into the per-(install, day, cell) triple (`fold`, relay/src/worker.js:160; relay/src/sheet.js:34–42), and `join` (relay/src/sheet.js:35) is called by no file except relay/test/sheet.test.js. The outbox marks a batch sent only on a 2xx (internal/pool/outbox/outbox.go, `sendHTTP`), so a batch whose response is lost after the server folded it is re-sent and folded twice: Proposition 2(iii)'s "with any duplication" and "the join of Section 5.2 makes a replayed old publication harmless" do not hold of the wire as shipped, and Status's word "the join" (:550) overstates with them. Fix: have `POST /v1/rows` carry the sender's running totals per cell and merge by `join`, or add batch-level idempotency.
-2. **Proof of Proposition 3 (:246), last sentence.** "With the single centring constraint, exactly one component is fully identified" is false when $G$ has $c\ge2$ components: the constraint $\sum_C w_C\delta_C=0$ (weights $w_C$ = judge mass per component) leaves a $(c{-}1)$-dimensional gauge, so *no* component's levels are pinned under a single constraint. Delete the sentence or write what the statement's last line already says.
-3. **"The relay centres $\beta$ within each component" (:249).** relay/src/sheet.js's `judgeSeverity` (:57) re-centres $\beta$ by one global weighted mean each sweep (:76–86), so the sentence does not describe the shipped fit, and on a disconnected judge–cell graph the alternating fit's fixed point remains initialisation-dependent — the first report's note, still true of the code.
-4. **§9's hourly job and Figure 2 (:286, :493).** The scheduled job runs the judge-effect fit and the Huber aggregation and no drift estimate (relay/src/sheet.js; Status :550 itself defers (13)), yet §9 says the job "runs the judge-effect, robust-aggregation and drift estimates" and the figure's relay node prints "drift (13)". The mirroring is not the job's either: it is a separate GitHub workflow on a six-hour cron (.github/workflows/pool-mirror.yml:11), while the relay's own cron is hourly (relay/wrangler.toml:17).
-5. **§6 (:355) and Table 2's caption (:391).** "These are published in the index beside the cells ... re-estimated at every relay cycle", and the ten-degrees-of-freedom withholding rule, are not on the branch: the relay's index document carries only schema, version, generated, min_installs, judges, rubrics, aliases, metrics and cells (relay/src/index.js `buildIndex`), no estimator lives in relay/src, and Status defers the moment estimators (:550). The caption also counts $v_r$ — measured from token accounting, not estimated — among "the rest are empirical-Bayes estimates". State these as specified-not-landed, as Status does.
-6. **§9 (:493): "the runbook in that directory is ten steps."** The runbook has ten steps (docs/design/model-pool/RUNBOOK.md, Deploy 1–10) but lives beside this document, not in `relay/`; relay/README.md carries no steps.
-7. **§10 (:546): "pool status counts the rows waiting in the outbox and says whether the relay answered."** The count is real (cmd/codeaf/pool.go:213, `pending %d`), but nothing in status contacts the relay; can-send/can-read are the mode's permissions (cfg.CanSend/CanRead), not an answer. Only `pool verify` reaches the network.
-8. **README vs the paper on what leaves an install.** The README's Model Pool section enumerates "(role, model, a number, a day)" (README.md:201–203); the paper's row also carries judge, door and size (:199–201). The settings hint avoids the enumeration and is consistent (internal/tui3/settings.go:680–683). Name the row's fields in the README or point at the paper's list, so the two surfaces say the same thing.
-
-## For a camera-ready version
-
-- Make the relay's write path match §5.2 — snapshot triples merged by the join, or batch ids — so Proposition 2(iii) holds of the wire and Status's "the join" stands.
-- Delete Proposition 3's proof-final sentence; implement per-component centring in the relay's fit or move the sentence to the design.
-- Land or reword the four present-tense relay claims: drift in the hourly job (§9, :286), the constants and ten-DOF rule (§6, Table 2 caption), pool status's relay line (§10).
-- Carry the distinct-install count through the readers (an `installs` field on `index.Cell`, the crewpick floor) so §5.4's three-install sentence is true of the code; revisit §9's flood sentence once fabricated installs can be bounded.
-- Give "72 scored runs over nine tasks" a checkable home (state how the CSV's runs column, 1224 over 56 crews, relates to it, and that `rows[1]` — ds-v4.1-flash with qwen3.8-max — is the shipped balanced pick), and make §5.6's $\hat b=-15.7$, 75 and 231 reproducible from `figures.py` and the committed CSVs, which today carry no catalog indexes.
-- Align the README's field list with the row's seven fields.
diff --git a/docs/design/model-pool/REVIEW-RESPONSE.md b/docs/design/model-pool/REVIEW-RESPONSE.md
deleted file mode 100644
index af8e3e7221..0000000000
--- a/docs/design/model-pool/REVIEW-RESPONSE.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# Response to the referee
-
-The report in `REVIEW.md` was written against the draft at the head before this one. The paper was `learn.tex` then and is `pareto-crewing.tex` now; each numbered defect is answered below with what changed; the section numbers are the revised document's.
-
-## Defects
-
-1. **Proposition 4, the split of the cap.** Corrected. The external count is now one capped quantity `W = Kℓ/(K+ℓ)` with `K = k + ñ`, `ñ = n_pool·ℓ/(ℓ+1)`, shared between catalog and pool as `k/K` and `ñ/K` of `W`; the proof integrates `μ_rm` out once and states the precision-weighted mean. The corollary's statement ("worth at most ℓ own rows") now applies to catalog and pool together, and the sentence that follows says which form the shipped pick is (`ℓ = ∞`, `b = 0`).
-2. **Drift estimator.** The factor ½ is gone from (13); the difference of adjacent day means has variance `ω² + σ²(1/n_d + 1/n_{d-1})`.
-3. **Additive local sheet versus max-join.** Section 5.2 now names both stores: the install's own sheet (`internal/pool/tally`) merges by addition because each row is folded once; the relay's store is keyed by (install, day, cell) and merges by the join.
-4. **Status paragraph.** Rewritten for the head this document ships with (judge hook, install nonce, push, relay, mirror) and lists what is specified but not landed.
-5. **Relay code.** `relay/` lands on this head; Section 9 describes it as present.
-6. **Public key.** Compiled into the binary on this head; the private-relay setting overrides it.
-7. **Run counts.** The crew table is "56 combinations fitted by a ridge model on 72 scored runs over nine tasks" (caption of Figure 1 and Section 8); the seed cells come from the ledger's 120 runs (Figure 6). The abstract no longer quotes a number.
-8. **Role-level ratio.** Section 8 and the abstract now state both comparisons: the role-level learner sits at half the crew-level learner fed the same scores and a third of the one fed the clean bit.
-9. **Proposition 3.** Restated: identified up to one constant per connected component, one centring constraint per component; proof names the kernel.
-10. **Subset of crews.** The regret experiment now runs on all 23 chat-door crews; the table and figure were regenerated and the text quotes the new numbers.
-11. **`min_installs`.** Section 5.4 says the relay publishes a distinct-install count per cell and that the reader's floor applies to it; the flood claim is reduced to what the design bounds (a minority of broken or hostile installs) and says what it does not (fabricated majorities).
-12. **Row fields.** The row is (role, model, score, judge, door, size, day); the install nonce is on the batch; dollars and minutes are stated to stay in the install's ledger. The cell is spelled the same way in Definition 2, the join and the row.
-13. **Abstract.** The constants sentence says what the user still sets (the price of a defect and of time); "stay out and still learn" is replaced by the three modes as they behave.
-14. **`explore`.** Marked "specified, not on this head" in the settings table.
-15. **`E` as a surrogate.** Section 4 states that (3) is `E_H` at `r = 1`, when the ranking agrees, and that the picker can use `E_H` directly where a delivered rate is measured.
-16. **Imputation.** Section 3 describes the implemented rule (median ratio over at least three donors per present index, averaged, capped at the pool's maximum, scale-proportional standing below three donors).
-17. **Loader.** Section 9 says the fresher of cache and seed is read, by generated day.
-
-## Overstated claims
-
-- Privacy in the abstract is now a statement of what a row contains, not of what can be inferred.
-- Proposition 5 is stated for the product posterior and says which dependence the draw ignores.
-- The exploration tax is stated as forty runs in which Thompson is no better than the table.
-- `figures.py` is said to reproduce the figures from the CSVs and the constants at its head.
-- `pool status` and `pool show` are described as they print.
-- Rollback is caught by the version; the join makes a replayed old publication harmless.
-- The judge floor is stated as absolute.
-- "Cents per run" is replaced by "one short completion per role".
-
-## What the referee asked for and is not in this revision
-
-- A catalog bias term `b` is added to the hierarchy with its estimator, and the seed's own `b̂ = −13.7`, `τ̂₀² = 0` are reported with the reason the day-one `k = 30` stands.
-- Experiments on judge effects, drift, the settled probability and the pair term, and a flood analysis, remain future work; the Status paragraph lists them among what is specified but not landed.
-
-## Second round (`REVIEW-2.md`)
-
-Verdict was minor revision; the eight new defects are answered here.
-
-1. The relay folds rows additively; the paper said the join. §5.2 now says which merge is which: addition within a store (own sheet, relay), the join between copies of sheets, and names the retry double-count and the quota that bounds it. Status and §9 no longer say the relay's store is join-merged.
-2. Proposition 3's proof: the sentence the referee quotes is not in the revised proof; the proof ends at the kernel and the per-component constraint.
-3. §5.3 now says the reference relay centres by one global weighted mean and that per-component levels are a convention on a disconnected graph.
-4. Drift is out of §9's job description and both figures' relay nodes; it stays in Status as next to land.
-5. §6 now states the constants' publication and the ten-degrees-of-freedom rule as the design, and that this head's index carries the cells and the day-one constants.
-6. "the runbook beside this document".
-7. `pool status` reaches the relay on this head (client B, after the referee's clone); the sentence stands.
-8. README's field list now names the row's seven fields.
-
-Camera-ready items not taken here: join-merged relay writes or batch ids; per-component centring in the relay; the distinct-install count through the readers; a checkable home for the 72 runs; the seed's offset numbers computed by `figures.py`.
diff --git a/docs/design/model-pool/REVIEW.md b/docs/design/model-pool/REVIEW.md
deleted file mode 100644
index b91c6fa63d..0000000000
--- a/docs/design/model-pool/REVIEW.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# Review of docs/design/model-pool/learn.tex
-
-## Summary
-
-The paper builds the crew picker in three layers: a catalog-only pick (a pareto front in bill and quality with a log-scale knee), a privacy-preserving measurement pool that replaces the catalog's proxy for quality, and a Thompson-sampling learner over role-level posteriors. The first layer is implemented and matches the prose in every particular checked: (1) is `crewpick.SeatCost` (crewpick.go:258), (2) is `quality` (crewpick.go:463) with the same pool-normalised scale, (3) is the shortlist at `Floor = 0.80` (crewpick.go:183, 454), (4)–(5) are `FrontWith`/`Presets`/`AtKnob`/`knee` (crewpick.go:315, 376, 388, 407) including the id tie order and the epsilon, the seat shapes and the vendor rule match `DefaultShapes` and the crew loop, and the Corollary's blend with `k = 30` is `blendQuality` with `PriorWeightAt = 30` (crewpick.go:479, 189). The judge rule of 5.1 matches `judge.Pick` (judge.go:159) with floor 60 (judge.go:45), the pool modes match `poolcfg`, the signed pull with version refusal matches `internal/pool/pull`, and the seed index matches Figure 3's construction exactly: its 14 cells are Beta(1,1) posterior means and sds of a no-major-defect bit times 100 (verified against `internal/pool/index/seed.json` and `data/seed-cells.csv`, e.g. worker/glm-5.3-flash n=62, mean 65.6, sd 5.9). Lemmas 1 and 2, Propositions 1, 2 and 5, the ICC formula of 5.4, estimators (17) and (18), and the steady-state Kalman relation of 5.5 are correct as mathematics. The central statistical claim is not: the capped counts of Proposition 4 are not the posterior its own proof derives, the drift estimator (14) returns half of what it estimates, and Proposition 3's closing sentence is false. Against the branch, the Status section overstates the wiring in six places, and two of the quoted experiment numbers do not match the committed tables. Major revision.
-
-## Defects, by severity
-
-1. **Proposition 4, eq (15)–(16) (learn.tex:325–335). The capped counts are not the posterior the proof derives.** The proof computes the catalog-and-pool precision about $\mu^u$ as $(k+n^{\mathrm{pool}})\ell/(k+n^{\mathrm{pool}}+\ell)$ and then claims this "splits into the two terms of (16) in proportion to $k$ and $n^{\mathrm{pool}}$". It does not: $k\ell/(k+\ell) + n\ell/(n+\ell) \ne (k+n)\ell/(k+n+\ell)$ for any positive $k, n, \ell$. The correct split under the proof's own model is $k\ell/(k+n^{\mathrm{pool}}+\ell)$ on the catalog and $n^{\mathrm{pool}}\ell/(k+n^{\mathrm{pool}}+\ell)$ on the pool. With $k=30$, $n^{\mathrm{pool}}=100$, $\ell=30$ the printed weights sum to 38.1 against the proof's 24.4, and as $k$ and $n^{\mathrm{pool}}$ grow the printed formula lets catalog and pool together approach $2\ell$ own rows, breaking the proof's own bound of $\ell$ and the text's claim after (16) that the pool's evidence is "worth at most $\ell$ own rows" (true only of the sum). A second error sits in the proof's first stage: precision $(k+n^{\mathrm{pool}})/\sigma^2$ treats pool rows as $\sigma^2$-noise observations of $\mu_{rm}$, but under the hierarchy (6) they are other installs' rows with marginal variance $\sigma^2+\tau_1^2$, so their contribution is $n^{\mathrm{pool}}/(\sigma^2+\tau_1^2)$ — the same inconsistency biases (19). Fix: state the posterior precision as one external term, $W = K\ell/(K+\ell)$ with $K = k + n^{\mathrm{pool}}\sigma^2/(\sigma^2+\tau_1^2)$ (or $K = k+n^{\mathrm{pool}}$ under the stated simplification), weight the catalog and pool as $k/K$ and $n^{\mathrm{pool}}/K$ of $W$, keep "external evidence $\le \ell$" for the sum, and make (19)'s noise term match. The Corollary is unaffected (it is the $\ell=\infty$ limit, which both forms share).
-
-2. **Eq (14) (learn.tex:264). The drift estimator carries a spurious factor of one half.** For adjacent-day means, $\operatorname{Var}(\bar y_d - \bar y_{d-1}) = \omega^2 + \sigma^2(1/n_d + 1/n_{d-1})$; the bracket subtracts exactly that noise, so (14) returns $\hat\omega^2/2$ and the filter forgets at half the rate the data show. The $\tfrac12$ is correct only for differences taken at lag two. Fix: drop it, or difference at lag 2 with the matching noise term. The steady-state relation in the same paragraph, $\alpha^2/(1-\alpha) = \bar n\,\omega^2/\sigma^2$, is correct.
-
-3. **Eq (13)/Proposition 2 (learn.tex:209–219) against `internal/pool/tally/tally.go`: the shipped sheet does not merge by the join.** `Sheet.Merge` adds ("adds other into s", tally.go:201; "Merging a sheet into itself doubles it", tally.go:199) — commutative and associative but not idempotent — and the cell address (metric, role, model, dims) carries no install key (tally.go:123). Proposition 2 itself is correct mathematics for per-install running totals; addition is safe only for pairwise-disjoint sheets, so a re-delivered or duplicated publication double-counts and claim (iii)'s "with any duplication" does not hold of the shipped merge. The abstract's "sufficient statistics that form a join-semilattice, so any number of installs and a relay can merge them in any order and reach the same state" is a design, not a description of anything on the branch, and the Status paragraph (learn.tex:548) puts "the outbox and the sheet" on the branch. Fix: either say the shipped sheet is additive and duplicate safety is the outbox's per-node sent markers (a guarantee that does not federate), or land the install-keyed store with the max-join before making the federation claims.
-
-4. **Status (learn.tex:548). The judge, the sheet and the outbox are on the branch as libraries with no call sites.** `internal/pool/judge` is imported by nothing (no caller of `judge.Judge` or `judge.Pick` outside the package), `internal/pool/tally` is imported by nothing, and `outbox.Append` has no caller — `cmd/codeaf/pool.go` only reads `Pending`. No run is judged, no row is written, no sheet accrues, so the closing sentence "Until the relay exists the pool is the seed index plus each install's own sheet" is false: on the branch the pool is the seed or cached index alone, blended through `config.autoPrior` (internal/config/auto.go:144). Fix: say the three packages exist unwired and that *learn* on the branch means catalog plus index.
-
-5. **"The relay's code is in this repository" (learn.tex:544, with the deploy sentence at 492). There is no `relay/` directory.** Status (learn.tex:548) itself lists the relay as "specified here and next to land"; sections 9 and "What the user controls" contradict it in the present tense. Fix: future tense, or land the directory.
-
-6. **"The signing key's public half is compiled into the binary" (learn.tex:495, 544). It is not.** `var poolPublicKeys []ed25519.PublicKey` is empty, with the comment "EMPTY ON THIS BRANCH" (cmd/codeaf/pool.go:37); `pool verify` refuses without `--key` (cmd/codeaf/pool.go, `verifyPool`), and the background refresh never starts because `startPoolIndexRefresh` returns when the key list is empty (cmd/codeaf/poolindex.go:77) — so "a refresh runs in the background" (learn.tex:489) is inert on this branch. Fix: say the mechanism is in place and the key ships beside the first published index, or compile a key.
-
-7. **"120 scored runs" (abstract, learn.tex:64; section 8, learn.tex:441; captions at 186 and 477). The number matches neither committed dataset where it is used.** The `runs` column of `data/measured-crews.csv` sums to 1224 across the 56 crews, and the seed's 14 cells carry n summing to 225 role-level scores (consistent with about 120 judged runs at 1.9 roles each — Figure 3's usage is the defensible one). But the abstract, the Figure 1 caption and section 8 attach the 120 to the 56-crew table, whose rows are backed by 1224 runs, and the section 8 experiments take that table as ground truth. Fix: say what the 120 counts (judged runs) and correct the three locations that attach it to the fitted-crew table.
-
-8. **Section 8 (learn.tex:460). "at four hundred runs the role-level learner's regret is about a third of the crew-level learner's on the same scores."** `tab-semibandit.tex` at $N=400$ reads 0.15 (role), 0.31 (crew, mean judge score), 0.54 (crew, clean bit). Against the learner the sentence names — fed the same scores — the ratio is about one half. A third holds only against the clean-bit learner, which is not "on the same scores"; the abstract's "factor of three" matches that other comparison. Fix: name the baseline and quote it; as written the sentence is wrong against its own table.
-
-9. **Proposition 3 (learn.tex:246). "With the single centring constraint, exactly one component is fully identified."** False when $G$ has $c \ge 2$ components: the kernel of the two-way design is $c$-dimensional and the single constraint $\sum_j n_{\cdot\cdot j}\beta_j = 0$ leaves an $(c{-}1)$-dimensional gauge that shifts $\mu$ in every component jointly (shifts weighted by $\sum_C N_C\delta_C = 0$), so no component's levels are pinned — only the within-component contrasts, as the preceding sentence correctly says. Identifying a component's levels needs one centring constraint per component. Note also that the alternating re-centring (learn.tex:235–239) is global, so on a disconnected $G$ its fixed point depends on the initialisation. Fix: one constraint per component, or state that identification holds only when $G$ is connected.
-
-10. **Section 8 (learn.tex:444). "the twelve chat-door crews" — the data has 23; `figures.py` keeps the first 12 in file order (figures.py:136, `[:12]`).** No criterion for the twelve is stated anywhere; which twelve they are sets the oracle ($1.94 all-in) and every number in `tab-regret.tex`. Fix: state the subset rule, or use all 23.
-
-11. **Section 5.4 (learn.tex:253). "A cell backed by fewer than three installs is published but not read" — nothing on the branch counts installs.** The index reader drops a cell when its n — an observation count — falls below the document's `min_installs` (internal/pool/index/index.go:265), `crewpick.PriorFromCells` applies the same test to a count (crewpick.go:231), and the shipped seed sets `min_installs` to 1 (internal/pool/index/seed.json:4); one install contributing three rows passes. The related claim in section 9 (learn.tex:498) that "the min-installs and robust-aggregation rules bound what a flood of fabricated nonces can move" is unsupported: the Huber rule's breakdown point of 1/2 is in installs, fabricated installs are unauthenticated, and a flood that outnumbers genuine installs passes the breakdown point while each nonce clears any rows-per-install cap at trivial cost. Fix: carry a distinct-install count per cell in the published document, set the shipped floor to it, and either analyse the flood bound or drop the claim.
-
-12. **Section 5.1 (learn.tex:199–201). The row fields exist nowhere; the shipped row is an envelope.** The outbox stores `{schema, day, nonce, payload}` with a fresh 16-byte nonce per row (internal/pool/outbox/outbox.go:49, 135) and an opaque payload that nothing builds; the per-profile install nonce of learn.tex:201 exists in no file; the sheet's cell is (metric, role, model, dims) with the triple (n, sum, sumsq) (internal/pool/tally/tally.go:123, 266), which can carry judge/day/size/door as dims but carries none today. Relatedly, Definition 2 (learn.tex:203) puts day inside the cell and section 5.5 says "The day is a cell dimension", while section 9 (learn.tex:492) says the store holds "one triple per (install, cell, day)" — the two spellings of cell differ. Fix: present the row schema as specified and add it to Status, and pick one spelling of the cell.
-
-13. **Abstract (learn.tex:64), two claims contradicted by the paper's own later sections.** "every constant except the user's price of a defect is an empirical-Bayes estimate" — Table 2 says $\lambda$ is the user's, $\phi=0.8$ and the judge floor 60 are structural, and $v_r$ is measured; only $\sigma$, $k$, $\ell_f$, $\omega^2$ and $\beta$ are estimated. "stay out, and still learns from its own runs" — with the pool off the code reads no index at all (cmd/codeaf/poolindex.go:50) and the paper itself says "with it off, only the catalog prior remains" (learn.tex:544). Fix both sentences.
-
-14. **"What the user controls" (learn.tex:540). The `explore` setting does not exist.** `internal/config` carries `model_pool` (settings.go:119), the pick words and the crew presets, but no `explore` key anywhere; nothing toggles a draw. Fix: mark the row "next to land", as Status does for the draw.
-
-15. **Section 4 (learn.tex:171–173). The working objective $E$ is neither derived form.** $E = c+\lambda t + H(1-p_{\mathrm{clean}})$ equals $E_H$ with $r$ set to 1 and $p$ replaced by $p_{\mathrm{clean}}$: non-deliveries are priced as shipped defects, and the rerun term $(1-r)(c_f+\lambda t_f)/r$ — and $E_0$'s $1/(rp)$ factor — are gone. For a cheap but flaky crew with $r$ well below 1, $E$ can rank it above what $E_0$ or $E_H$ would; the paper never states the surrogate. Fix: one sentence deriving $E$ as $E_H$ under $r=1$ (or adding the rerun term), and the regime where the surrogate is safe ($H$ large next to run cost, $r$ not far below 1).
-
-16. **Section 3 (learn.tex:110). The imputation sentence does not describe the implemented imputation.** `crewpick` uses the donor median only with three or more donors, averages the offers from every present index, caps the estimate at the pool's largest measured value of the missing index, and falls back to scale-proportional standing below three donors (crewpick.go:525, 582). The sentence describes none of this. Fix: describe the implemented rule, or mark the sentence as simplified.
-
-17. **Section 9 (learn.tex:489). "The loader reads the cached index if one is present and the embedded seed index otherwise."** The cache wins only when it is not older than the seed: `index.Fallback` compares the generated days and prefers the seed on an older cache (internal/pool/index/index.go:96–104). Fix: "the fresher of the cache and the seed by generated day."
-
-## Correct but overstated
-
-- Abstract (learn.tex:64): "nothing an install sends can be read back into what it was working on." Absence of text is not unlinkability: a row's (dollars, minutes, size, door, day, role, model) is a quasi-identifying tuple against anyone who knows the task schedule. Section 9's store-scoped claim (learn.tex:498) is the defensible form; the abstract goes further than it.
-- Proposition 5 (learn.tex:420): "is exactly Thompson sampling over the crews' posterior costs." Exact only if the per-(role, model) posteriors are independent; 5.3's judge-effect fit and 5.5's drift model both induce cross-cell dependence that the independent draw ignores. It is Thompson sampling on a product approximation to the posterior.
-- Section 8 (learn.tex:444): "Thompson pays a small exploration tax in the first twenty runs." `tab-regret.tex` puts Thompson at 0.98 and 0.97 at $N=10$ and 20 — the worst row of the table, above even the fixed table (0.91, 0.93). The tax is real; "small" is not.
-- Section 8 (learn.tex:481): "reproduces every figure and table from the two CSV files it reads." Figure 5's constants (catalog 80, measured 65, $\sigma=15$) and Figure 1's iso-line anchors are hardcoded in `figures.py`.
-- Sections 9 and "What the user controls" (learn.tex:489, 544): `pool status` prints a pending count ("pending %d", cmd/codeaf/pool.go:172), not the rows; `pool show` prints the index's generated day and counts, not its cells.
-- Section 9 (learn.tex:495): "(Section 5.2's join makes a rollback detectable)." A rollback is detected by the version number the puller compares (`Puller.good`, internal/pool/pull/pull.go); the join makes old data harmless, not detectable.
-- Section 5.1 (learn.tex:195): "The floor exists because a judge below the worker's class rubber-stamps." The rule is an absolute floor of 60 (judge.go:45), not a floor at the worker's class: a coding-61 judge over a coding-90 worker passes it. The rationale is relative, the rule absolute.
-- Section 5.1 (learn.tex:195): "at present prices it is cents per run" — not checkable from anything in the repository.
-
-## What a reader would still want
-
-- The posterior under the full hierarchy (pool rows at variance $\sigma^2+\tau_1^2$): the corrected (16) and (19), and a first $\hat k$ computed from the seed's own 14 cells — the paper's data can produce one and never does.
-- The regime in which (7) ranks crews as $E_0$ and $E_H$ do: a worked example with $r<1$ and a cheap, flaky crew.
-- Experiments for the untested sections: the judge-effect fit of 5.3 (the seed carries a single judge id, so the shipped data cannot exercise it), the drift model of 5.5, and the settled probability $\pi^\ast$ of section 7 — no trajectory is shown for any of them.
-- The pair and interaction term of 6.1: specified with an estimator, never simulated.
-- The subset rule behind "the twelve chat-door crews" and the identity of the "fixed table row" (the second line of `data/measured-crews.csv`: glm-5.3-flash with qwen3.8-max, all-in regret \$0.96 against the subset oracle), with `tab-regret.tex`'s sensitivity to both choices.
-- The fabricated-install flood analysed rather than asserted (defect 11): what the Huber rule bounds once fabricated installs are the majority, and the cost per nonce to get there.
-- Instance-dependent gaps: the paper's own caption says a dozen crews sit within cents; the whole regret scale (\$0.96 for the table against a \$1.94 oracle all-in) is governed by gaps the paper never reports, so "a third" and "factor of three" are dataset-specific with no gap structure given.
-- Where the day-one constants come from: $\sigma=15$ and $\ell_f=30$ in Table 2 have no derivation.
-
-## Verdict
-
-Major revision. The catalog half of the paper is sound and matches the code line for line, and the CRDT, fixed-effects and robustness designs are right as designs. But the central estimator is wrong as printed (defect 1), one moment estimator is off by a factor of two (defect 2), one proposition's closing claim is false (defect 9), and the paper's account of what is implemented overstates the branch in six places (defects 3–6, 12, 14). The experiments support the direction of every claim they are attached to, but two quoted numbers do not match the committed tables (defects 7–8). Fix the mathematics, reconcile the Status paragraph with the tree, and re-derive or re-run the affected numbers; the architecture is worth publishing once every claim is as accurate as the catalog section already is.
diff --git a/docs/design/model-pool/data/measured-crews.csv b/docs/design/model-pool/data/measured-crews.csv
deleted file mode 100644
index 75e0f98120..0000000000
--- a/docs/design/model-pool/data/measured-crews.csv
+++ /dev/null
@@ -1,57 +0,0 @@
-door,worker,planner,checker,delivered,clean,usd,minutes,runs
-task,ds-v4.1-flash,-,qwen3.8-max,0.75,0.69,0.13,0,5
-task,glm-5.3-flash,-,qwen3.8-max,0.95,0.78,0.27,4,17
-task,ds-v4.1-flash,-,kimi-k3,0.75,0.69,0.24,2,7
-task,glm-5.3,-,qwen3.8-max,0.91,0.85,0.53,1,11
-task,ds-v4.1-flash,-,fable-5.1,0.75,0.87,0.45,0,8
-task,glm-5.3-flash,-,kimi-k3,0.95,0.79,0.50,11,21
-do,ds-v4.1-flash,opus-5,-,0.67,0.9,0.46,1,12
-do,ds-v4.1-flash,glm-5.3-flash,-,0.67,0.84,0.36,0,16
-task,ds-v4.1-flash,-,opus-5,0.75,0.64,0.40,0,7
-do,ds-v4.1-flash,qwen3.8-max,-,0.67,0.56,0.22,0,11
-do,ds-v4.1-flash,glm-5.3,-,0.67,0.51,0.23,0,9
-task,muse-spark-1.3,-,qwen3.8-max,0.5,0.95,0.41,0,16
-task,glm-5.3-flash,-,fable-5.1,0.95,0.95,0.95,1,25
-task,glm-5.3,-,kimi-k3,0.91,0.85,0.98,6,14
-task,glm-5.3-flash,-,opus-5,0.95,0.74,0.84,4,20
-do,muse-spark-1.3,qwen3.8-max,-,0.75,0.82,0.72,0,32
-do,ds-v4.1-flash,kimi-k3,-,0.67,0.39,0.18,0,11
-do,muse-spark-1.3,glm-5.3,-,0.75,0.77,0.75,0,26
-do,glm-5.3,qwen3.8-max,-,0.92,0.72,0.93,2,22
-task,muse-spark-1.3,-,kimi-k3,0.5,0.95,0.76,0,19
-do,muse-spark-1.3,kimi-k3,-,0.75,0.65,0.59,0,32
-do,glm-5.3-flash,opus-5,-,0.64,0.95,0.96,1,37
-do,glm-5.3-flash,qwen3.8-max,-,0.64,0.66,0.47,2,34
-do,glm-5.3-flash,glm-5.3,-,0.64,0.6,0.49,1,27
-do,glm-5.3,kimi-k3,-,0.92,0.55,0.76,1,23
-do,ds-v4.1-flash,fable-5.1,-,0.67,0.71,0.89,0,13
-do,muse-spark-1.3,glm-5.3-flash,-,0.75,0.95,1.16,0,48
-do,glm-5.3,glm-5.3-flash,-,0.92,0.95,1.50,1,33
-do,muse-spark-1.3,opus-5,-,0.75,0.95,1.45,0,35
-task,glm-5.3,-,fable-5.1,0.91,0.95,1.87,1,16
-do,glm-5.3-flash,kimi-k3,-,0.64,0.49,0.39,3,34
-do,glm-5.3,opus-5,-,0.92,0.95,1.88,2,24
-task,glm-5.3,-,opus-5,0.91,0.8,1.65,1,13
-task,muse-spark-1.3,-,opus-5,0.5,0.9,1.28,0,19
-task,qwen3.8-max,-,kimi-k3,0.83,0.69,1.31,2,22
-task,muse-spark-1.3,-,fable-5.1,0.5,0.95,1.44,0,24
-do,qwen3.8-max,glm-5.3-flash,-,0.86,0.84,2.01,1,55
-do,glm-5.3-flash,fable-5.1,-,0.64,0.81,1.87,5,41
-task,qwen3.8-max,-,fable-5.1,0.83,0.87,2.50,2,27
-do,qwen3.8-max,glm-5.3,-,0.86,0.5,1.30,1,29
-task,ds-v4-pro-0813,-,qwen3.8-max,0.5,0.35,0.47,0,7
-do,qwen3.8-max,opus-5,-,0.86,0.9,2.53,2,40
-do,muse-spark-1.3,fable-5.1,-,0.75,0.95,2.84,2,39
-do,ds-v4-pro-0813,glm-5.3-flash,-,0.67,0.5,1.32,0,20
-do,ds-v4-pro-0813,opus-5,-,0.67,0.56,1.66,0,14
-do,qwen3.8-max,kimi-k3,-,0.86,0.39,1.02,0,37
-task,qwen3.8-max,-,opus-5,0.83,0.64,2.22,0,22
-task,ds-v4-pro-0813,-,fable-5.1,0.5,0.54,1.64,0,10
-task,ds-v4-pro-0813,-,kimi-k3,0.5,0.36,0.86,0,8
-do,glm-5.3,fable-5.1,-,0.92,0.87,3.68,4,27
-do,ds-v4-pro-0813,qwen3.8-max,-,0.67,0.23,0.82,0,13
-task,ds-v4-pro-0813,-,opus-5,0.5,0.3,1.46,0,8
-do,ds-v4-pro-0813,glm-5.3,-,0.67,0.17,0.85,0,11
-do,qwen3.8-max,fable-5.1,-,0.86,0.71,4.94,1,44
-do,ds-v4-pro-0813,fable-5.1,-,0.67,0.38,3.24,1,16
-do,ds-v4-pro-0813,kimi-k3,-,0.67,0.06,0.67,0,13
diff --git a/docs/design/model-pool/fig-cells.pdf b/docs/design/model-pool/fig-cells.pdf
deleted file mode 100644
index 4ba5204fe9..0000000000
Binary files a/docs/design/model-pool/fig-cells.pdf and /dev/null differ
diff --git a/docs/design/model-pool/fig-front.pdf b/docs/design/model-pool/fig-front.pdf
deleted file mode 100644
index e6931cdfef..0000000000
Binary files a/docs/design/model-pool/fig-front.pdf and /dev/null differ
diff --git a/docs/design/model-pool/fig-regret.pdf b/docs/design/model-pool/fig-regret.pdf
deleted file mode 100644
index 16c0897db2..0000000000
Binary files a/docs/design/model-pool/fig-regret.pdf and /dev/null differ
diff --git a/docs/design/model-pool/fig-semibandit.pdf b/docs/design/model-pool/fig-semibandit.pdf
deleted file mode 100644
index 5cda759ece..0000000000
Binary files a/docs/design/model-pool/fig-semibandit.pdf and /dev/null differ
diff --git a/docs/design/model-pool/fig-shrink.pdf b/docs/design/model-pool/fig-shrink.pdf
deleted file mode 100644
index 981e0c5a5b..0000000000
Binary files a/docs/design/model-pool/fig-shrink.pdf and /dev/null differ
diff --git a/docs/design/model-pool/figures.py b/docs/design/model-pool/figures.py
deleted file mode 100644
index d33f7b1a2e..0000000000
--- a/docs/design/model-pool/figures.py
+++ /dev/null
@@ -1,288 +0,0 @@
-#!/usr/bin/env python3
-"""Draws the figures in pareto-crewing.tex from data/*.csv. Standard library, numpy and matplotlib only.
-
-    python3 figures.py            # writes fig-*.pdf and tab-*.tex beside this file
-
-The simulations are the ones the paper describes. Ground truth is the table of measured crews fitted
-from our own scored runs (data/measured-crews.csv). A learner picks a crew per run, sees the run's
-outcome and its dollars, and pays the all-in cost E = c + lambda*t + H*(1 - clean). Regret is E minus
-the oracle crew's, averaged over replicates. Every replicate draws its own noisy catalog prior.
-"""
-import csv, os, random
-import numpy as np
-import matplotlib
-matplotlib.use("Agg")
-import matplotlib.pyplot as plt
-
-HERE = os.path.dirname(os.path.abspath(__file__))
-TABLE_PROVENANCE = "% generated by figures.py from data/measured-crews.csv; do not edit\n"
-H, LAM, K = 10.0, 0.01, 30
-REPS = 200
-plt.rcParams.update({"font.size": 9, "font.family": "serif", "axes.spines.top": False, "axes.spines.right": False})
-
-
-def crews():
-    rows = list(csv.DictReader(open(os.path.join(HERE, "data", "measured-crews.csv"))))
-    for r in rows:
-        for k in ("delivered", "clean", "usd", "minutes"):
-            r[k] = float(r[k])
-        r["runs"] = int(r["runs"])
-        r["name"] = r["worker"] + ("+" + r["checker"] if r["checker"] != "-" else "") + ("/" + r["planner"] if r["planner"] != "-" else "")
-        r["run"] = r["usd"] + LAM * r["minutes"]
-        r["p"] = r["delivered"] * r["clean"]
-    return rows
-
-
-def allin(r, h=H):
-    return r["run"] + h * (1 - r["p"])
-
-
-def fig_front():
-    rows = crews()
-    fig, ax = plt.subplots(figsize=(5.4, 3.5))
-    for door, mark, label in (("task", "o", "chat door (worker + checker)"), ("do", "s", "headless door (worker + planner)")):
-        pts = [r for r in rows if r["door"] == door]
-        ax.scatter([r["run"] for r in pts], [100 * r["p"] for r in pts], s=18, marker=mark, alpha=.75, label=label)
-    front, best = [], -1
-    for r in sorted(rows, key=lambda r: r["run"]):
-        if r["p"] > best:
-            front.append(r)
-            best = r["p"]
-    ax.plot([r["run"] for r in front], [100 * r["p"] for r in front], "k-", lw=.8, label="pareto front")
-    for r in front:
-        ax.annotate(r["name"], (r["run"], 100 * r["p"]), fontsize=6, xytext=(4, -9), textcoords="offset points")
-    xs = np.linspace(0.05, 4, 100)
-    for h, e, x in ((1, 1.2, 1.0), (10, 3.0, 2.4), (50, 12.0, 3.2)):
-        ax.plot(xs, 100 * (1 - (e - xs) / h), color="#999", lw=.6, ls="--")
-        ax.text(x, 100 * (1 - (e - x) / h) + 1.5, f"E = \\${e:.0f} at H = \\${h}", fontsize=6, color="#777")
-    ax.set_xlim(0, 4)
-    ax.set_ylim(0, 100)
-    ax.set_xlabel("cost of one run, $ (dollars + λ · minutes)")
-    ax.set_ylabel("P(delivered and clean), %")
-    ax.legend(fontsize=7, loc="lower left")
-    fig.tight_layout()
-    fig.savefig(os.path.join(HERE, "fig-front.pdf"))
-
-
-def fig_cells():
-    rows = list(csv.DictReader(open(os.path.join(HERE, "data", "seed-cells.csv"))))
-    fig, axes = plt.subplots(1, 3, figsize=(6.2, 2.6))
-    for ax, role in zip(axes, ("worker", "high", "mastermind")):
-        cells = sorted([r for r in rows if r["role"] == role], key=lambda r: -float(r["mean"]))
-        names = [r["model"].split("/")[-1] for r in cells]
-        ax.barh(names, [float(r["mean"]) for r in cells], xerr=[float(r["sd"]) for r in cells], color="#8a8fb0", ecolor="#333", capsize=2)
-        for i, r in enumerate(cells):
-            ax.text(2, i, f"n={r['n']}", va="center", fontsize=6, color="white")
-        ax.set_title(role, fontsize=9)
-        ax.set_xlim(0, 100)
-        ax.invert_yaxis()
-        ax.tick_params(axis="y", labelsize=7)
-    axes[0].set_xlabel("role_quality, posterior mean ± sd")
-    fig.tight_layout()
-    fig.savefig(os.path.join(HERE, "fig-cells.pdf"))
-
-
-def fig_shrink():
-    q_cat, s_bar, sigma = 80.0, 65.0, 15.0
-    n = np.arange(0, 121)
-    mean = (K * q_cat + n * s_bar) / (K + n)
-    sd = sigma / np.sqrt(K + n)
-    fig, ax = plt.subplots(figsize=(5.2, 2.8))
-    ax.fill_between(n, mean - 1.96 * sd, mean + 1.96 * sd, color="#8a8fb0", alpha=.3, label="95% posterior band")
-    ax.plot(n, mean, "k-", label="posterior mean")
-    ax.axhline(q_cat, ls=":", color="#555", lw=.8)
-    ax.axhline(s_bar, ls="--", color="#555", lw=.8)
-    ax.text(2, q_cat + 0.8, "catalog prior", fontsize=7)
-    ax.text(100, s_bar + 0.8, "measured mean", fontsize=7)
-    ax.axvline(K, color="#a55", lw=.8)
-    ax.text(K + 1.5, 62, "n = k = 30: half weight each", fontsize=7, color="#a55")
-    ax.set_xlabel("effective observations n")
-    ax.set_ylabel("role quality")
-    ax.set_xlim(0, 120)
-    ax.set_ylim(60, 84)
-    ax.legend(fontsize=7, loc="upper right")
-    fig.tight_layout()
-    fig.savefig(os.path.join(HERE, "fig-shrink.pdf"))
-
-
-def simulate(strategy, N, seed, rows, oracle):
-    """Crew-level learners: every crew is one arm with one Beta posterior on P(clean)."""
-    rnd = random.Random(seed)
-    truth = {r["name"]: r["p"] for r in rows}
-    prior = {n: min(.99, max(.01, p + rnd.gauss(0, .15))) for n, p in truth.items()}
-    a = {n: 1 + K * prior[n] for n in truth}
-    b = {n: 1 + K * (1 - prior[n]) for n in truth}
-    fixed = {r["name"]: r["run"] for r in rows}
-    total, explored = 0.0, 0
-    for t in range(N):
-        mean_best = min(truth, key=lambda n: fixed[n] + H * (1 - a[n] / (a[n] + b[n])))
-        if strategy == "table":
-            pick = rows[1]["name"]
-        elif strategy == "catalog":
-            pick = min(truth, key=lambda n: fixed[n] + H * (1 - prior[n]))
-        elif strategy == "greedy":
-            pick = mean_best if rnd.random() >= 0.1 else rnd.choice(list(truth))
-        else:
-            pick = min(truth, key=lambda n: fixed[n] + H * (1 - rnd.betavariate(a[n], b[n])))
-        explored += pick != mean_best
-        clean = rnd.random() < truth[pick]
-        total += fixed[pick] + H * (1 - clean) - oracle
-        if strategy in ("greedy", "thompson"):
-            a[pick] += clean
-            b[pick] += not clean
-    return total / N, explored / N
-
-
-def fig_regret():
-    rows = [r for r in crews() if r["door"] == "task"]
-    oracle = min(allin(r) for r in rows)
-    Ns = [10, 20, 40, 70, 100, 150, 200, 300, 400]
-    fig, (ax, ax2) = plt.subplots(1, 2, figsize=(6.2, 2.8))
-    table = {}
-    for s, style in (("table", "k:"), ("catalog", "k--"), ("greedy", "C1-"), ("thompson", "C0-")):
-        reg, exp = [], []
-        for N in Ns:
-            rs = [simulate(s, N, seed, rows, oracle) for seed in range(REPS)]
-            reg.append(np.mean([r[0] for r in rs]))
-            exp.append(np.mean([r[1] for r in rs]))
-        table[s] = reg
-        ax.plot(Ns, reg, style, label={"table": "fixed table row", "catalog": "catalog only", "greedy": "ε-greedy, ε = 0.1", "thompson": "Thompson"}[s])
-        if s in ("greedy", "thompson"):
-            ax2.plot(Ns, [100 * e for e in exp], style, label=s)
-    ax.set_xlabel("runs N")
-    ax.set_ylabel("regret vs oracle, $ per task")
-    ax.set_ylim(0, None)
-    ax.legend(fontsize=7)
-    ax2.set_xlabel("runs N")
-    ax2.set_ylabel("runs off the posterior-mean pick, %")
-    ax2.set_ylim(0, None)
-    ax2.legend(fontsize=7)
-    fig.tight_layout()
-    fig.savefig(os.path.join(HERE, "fig-regret.pdf"))
-    with open(os.path.join(HERE, "tab-regret.tex"), "w") as f:
-        f.write(TABLE_PROVENANCE)
-        f.write("\\begin{tabular}{l" + "r" * len(Ns) + "}\\toprule\n$N$ & " + " & ".join(str(n) for n in Ns) + "\\\\\\midrule\n")
-        for s in ("table", "catalog", "greedy", "thompson"):
-            f.write(s + " & " + " & ".join(f"{v:.2f}" for v in table[s]) + "\\\\\n")
-        f.write("\\bottomrule\\end{tabular}\n")
-
-
-VENDOR = {"ds-v4.1-flash": "deepseek", "ds-v4-pro-0813": "deepseek", "ds-v4-flash-0731": "deepseek", "glm-5.3-flash": "z-ai",
-          "glm-5.3": "z-ai", "muse-spark-1.3": "meta", "qwen3.8-max": "qwen", "kimi-k3": "moonshot", "fable-5.1": "anthropic",
-          "opus-5": "anthropic"}
-
-
-def role_truth():
-    """A three-role ground truth read off the measured rows under the linear rule of the paper: a role quality
-    q_r(m) in [0, 100] per (role, model) and a dollar surcharge per (role, model); a crew's P(clean) is the mean of
-    its role qualities over 100 and its cost the sum of its surcharges. Workers and checkers come from the chat
-    rows (delivered is the worker's, clean the checker's), planners from the headless rows."""
-    rows = crews()
-    chat = [r for r in rows if r["door"] == "task"]
-    do = [r for r in rows if r["door"] == "do"]
-    mean = lambda xs: float(np.mean(xs))
-    q = {"worker": {}, "checker": {}, "planner": {}}
-    cost = {"worker": {}, "checker": {}, "planner": {}}
-    for w in sorted({r["worker"] for r in chat}):
-        mine = [r for r in chat if r["worker"] == w]
-        q["worker"][w] = 100 * mean([r["delivered"] for r in mine])
-        cost["worker"][w] = mean([r["run"] for r in mine])
-    base = mean([r["run"] for r in chat])
-    for c in sorted({r["checker"] for r in chat}):
-        mine = [r for r in chat if r["checker"] == c]
-        q["checker"][c] = 100 * mean([r["clean"] for r in mine])
-        cost["checker"][c] = mean([r["run"] for r in mine]) - base
-    dobase = mean([r["run"] for r in do])
-    for p in sorted({r["planner"] for r in do}):
-        mine = [r for r in do if r["planner"] == p]
-        q["planner"][p] = 100 * mean([r["clean"] for r in mine])
-        cost["planner"][p] = max(0.0, mean([r["run"] for r in mine]) - dobase)
-    grid = {}
-    for w in q["worker"]:
-        for c in q["checker"]:
-            if VENDOR.get(w) == VENDOR.get(c):
-                continue
-            for p in q["planner"]:
-                k = (w, c, p)
-                grid[k] = dict(p=(q["worker"][w] + q["checker"][c] + q["planner"][p]) / 300,
-                               run=cost["worker"][w] + cost["checker"][c] + cost["planner"][p])
-    return q, grid
-
-
-def simulate_roles(level, N, seed, q, grid, sigma=15.0):
-    """Thompson sampling under three kinds of feedback on the same truth: one Beta arm per crew fed the run's
-    clean/defect bit; one Gaussian arm per crew fed the mean of the judge's role scores; one Gaussian posterior per
-    (role, model) fed each role's own judge score (semi-bandit). Judge scores are the role quality plus N(0, sigma)."""
-    rnd = random.Random(seed)
-    arms = list(grid)
-    roles = ("worker", "checker", "planner")
-    oracle = min(grid[a]["run"] + H * (1 - grid[a]["p"]) for a in arms)
-    noise = lambda x: min(99.0, max(1.0, x + rnd.gauss(0, 15)))
-    prior_q = {r: {m: noise(q[r][m]) for m in q[r]} for r in roles}
-    prior_p = {a: sum(prior_q[r][a[i]] for i, r in enumerate(roles)) / 300 for a in arms}
-    if level == "crew-bit":
-        a_ = {a: 1 + K * prior_p[a] for a in arms}
-        b_ = {a: 1 + K * (1 - prior_p[a]) for a in arms}
-    elif level == "crew-score":
-        n_ = {a: float(K) for a in arms}
-        s_ = {a: K * 100 * prior_p[a] for a in arms}
-    else:
-        n_ = {(r, m): float(K) for r in roles for m in q[r]}
-        s_ = {(r, m): K * prior_q[r][m] for r in roles for m in q[r]}
-    total = 0.0
-    for t in range(N):
-        if level == "crew-bit":
-            pick = min(arms, key=lambda a: grid[a]["run"] + H * (1 - rnd.betavariate(a_[a], b_[a])))
-        elif level == "crew-score":
-            pick = min(arms, key=lambda a: grid[a]["run"] + H * (1 - rnd.gauss(s_[a] / n_[a], sigma / n_[a] ** .5) / 100))
-        else:
-            draw = {k: rnd.gauss(s_[k] / n_[k], sigma / n_[k] ** .5) for k in n_}
-            pick = min(arms, key=lambda a: grid[a]["run"] + H * (1 - sum(draw[(r, a[i])] for i, r in enumerate(roles)) / 300))
-        g = grid[pick]
-        clean = rnd.random() < g["p"]
-        total += g["run"] + H * (1 - clean) - oracle
-        scores = [q[r][pick[i]] + rnd.gauss(0, sigma) for i, r in enumerate(roles)]
-        if level == "crew-bit":
-            a_[pick] += clean; b_[pick] += not clean
-        elif level == "crew-score":
-            n_[pick] += 1; s_[pick] += float(np.mean(scores))
-        else:
-            for i, r in enumerate(roles):
-                n_[(r, pick[i])] += 1; s_[(r, pick[i])] += scores[i]
-    return total / N
-
-
-def fig_semibandit():
-    q, grid = role_truth()
-    Ns = [10, 20, 40, 70, 100, 150, 200, 300, 400]
-    fig, ax = plt.subplots(figsize=(4.8, 2.9))
-    table = {}
-    for level, style, label in (("crew-bit", "C0:", "one arm per crew, clean/defect bit"),
-                                ("crew-score", "C0--", "one arm per crew, mean judge score"),
-                                ("role", "C2-", "one posterior per (role, model), role scores")):
-        reg = [np.mean([simulate_roles(level, N, seed, q, grid) for seed in range(REPS)]) for N in Ns]
-        table[level] = reg
-        ax.plot(Ns, reg, style, label=label)
-    d = sum(len(q[r]) for r in q)
-    ax.set_title(f"{len(grid)} crews from {len(q['worker'])} workers × {len(q['checker'])} checkers × {len(q['planner'])} planners; {d} unknowns", fontsize=8)
-    ax.set_xlabel("runs N")
-    ax.set_ylabel("regret vs oracle, $ per task")
-    ax.set_ylim(0, None)
-    ax.legend(fontsize=7)
-    fig.tight_layout()
-    fig.savefig(os.path.join(HERE, "fig-semibandit.pdf"))
-    with open(os.path.join(HERE, "tab-semibandit.tex"), "w") as f:
-        f.write(TABLE_PROVENANCE)
-        f.write("\\begin{tabular}{l" + "r" * len(Ns) + "}\\toprule\n$N$ & " + " & ".join(str(n) for n in Ns) + "\\\\\\midrule\n")
-        for level, name in (("crew-bit", "crew, clean bit"), ("crew-score", "crew, mean score"), ("role", "role, semi-bandit")):
-            f.write(name + " & " + " & ".join(f"{v:.2f}" for v in table[level]) + "\\\\\n")
-        f.write("\\bottomrule\\end{tabular}\n")
-
-
-if __name__ == "__main__":
-    fig_front()
-    fig_cells()
-    fig_shrink()
-    fig_regret()
-    fig_semibandit()
-    print("figures written")
diff --git a/docs/design/model-pool/pareto-crewing.pdf b/docs/design/model-pool/pareto-crewing.pdf
index 7771ef6318..397dac7e62 100644
Binary files a/docs/design/model-pool/pareto-crewing.pdf and b/docs/design/model-pool/pareto-crewing.pdf differ
diff --git a/docs/design/model-pool/pareto-crewing.tex b/docs/design/model-pool/pareto-crewing.tex
deleted file mode 100644
index c57a7ac586..0000000000
--- a/docs/design/model-pool/pareto-crewing.tex
+++ /dev/null
@@ -1,567 +0,0 @@
-\documentclass[10pt,a4paper]{article}
-\usepackage[margin=2.54cm]{geometry}
-\usepackage{amsmath,amssymb,amsthm,mathtools}
-\usepackage{newtxtext,newtxmath}
-\usepackage{booktabs}
-\usepackage{graphicx}
-\usepackage{microtype}
-\usepackage{authblk}
-\usepackage{algorithm}
-\usepackage{algpseudocode}
-\usepackage{tikz}
-\usetikzlibrary{arrows.meta,positioning,shapes.geometric,calc,fit}
-\usepackage{fancyhdr}
-\usepackage[hidelinks]{hyperref}
-\usepackage{caption}
-\usepackage{float}
-\captionsetup{font=small,labelfont=bf,width=.92\textwidth}
-\usepackage{abstract}
-\renewcommand{\abstractnamefont}{\normalfont\bfseries}
-\setlength{\absleftindent}{1.2cm}\setlength{\absrightindent}{1.2cm}
-\setlength{\parskip}{2pt}
-
-\pagestyle{fancy}
-\fancyhf{}
-\fancyhead[L]{\small\textsc{Preprint}}
-\fancyhead[R]{\small Pareto Crewing}
-\fancyfoot[C]{\small\thepage}
-\renewcommand{\headrulewidth}{0.2pt}
-
-\newcommand{\E}{\mathbb{E}}
-\newcommand{\R}{\mathbb{R}}
-\newcommand{\N}{\mathbb{N}}
-\newcommand{\roles}{\mathcal{R}}
-\newcommand{\mods}{\mathcal{M}}
-\newcommand{\crews}{\mathcal{K}}
-\newcommand{\front}{\mathcal{F}}
-\newcommand{\seat}[1]{\mathrm{#1}}
-\newcommand{\code}[1]{\texttt{#1}}
-\newcommand{\pclean}{P_{\mathrm{c}}}
-\DeclareMathOperator*{\argmin}{arg\,min}
-\DeclareMathOperator*{\argmax}{arg\,max}
-\newtheorem{theorem}{Theorem}
-\newtheorem{proposition}{Proposition}
-\newtheorem{lemma}{Lemma}
-\newtheorem{corollary}{Corollary}
-\theoremstyle{definition}
-\newtheorem{definition}{Definition}
-\newtheorem{assumption}{Assumption}
-\theoremstyle{remark}
-\newtheorem{remark}{Remark}
-
-\title{\textbf{Pareto Crewing}\\[6pt]
-\large Decentralised, privacy-preserving measurement of language-model teams,\\ and a learner that picks them on the cost-quality front, per role and per task}
-\author{Santosh Kumar Radha}
-\affil{AgentField AI}
-\date{September 2026}
-
-\begin{document}
-\maketitle
-\thispagestyle{fancy}
-
-\begin{abstract}
-\noindent
-\emph{Pareto crewing} is the practice of picking the language-model team for a task on the cost-quality front, one model per role, from evidence about how models have performed in that role rather than from a fixed table. An agent harness runs a task through a \emph{crew}: an assignment of one language model to each of $n$ roles (in our instance a worker that does the work, a checker that reads it and a planner that cuts it). The crew that pays best is neither the cheapest nor the strongest on paper; it is the one that minimises the expected cost of one clean delivery once failed runs, wall time and shipped defects are priced. We give that objective in closed form, show how a crew is computed from a published catalog of prices and benchmark indexes alone (a pareto front in bill and quality, with a scale-free knee), and then how measurements from real runs replace the catalog's proxy. Runs are scored role by role by a model outside the crew. Each score becomes a row that carries no text, no file name, no price and no identity beyond a per-install nonce, so what an install sends is a handful of coarse fields about a model, not about the work; rows reduce to sufficient statistics that form a join-semilattice, so any number of installs and a relay can merge them in any order and reach the same state, the relay is a convenience rather than an authority, and the published index is signed so that every reader can check what it is blending in. Participation is a setting: an install can contribute, read and learn from its own runs without sending, or stay out. Judge severity is removed by a two-way fixed-effects fit on those statistics, drift by a local-level model whose forgetting rate is estimated rather than set, and heterogeneity between installs by a hierarchical prior whose variance is estimated by moments; every statistical constant is an empirical-Bayes estimate, and what remains for the user to set is the price of a defect and the price of time. The crew is chosen by Thompson sampling with semi-bandit feedback: because the objective is linear in role qualities and every role is scored separately, a run on one crew informs every crew that shares a model with it, and the sample complexity scales with the number of models rather than the number of crews. On a ground truth fitted to our own runs the learner beats a fixed table by a third of the remaining regret within a few hundred runs, and role-level feedback halves the regret of a crew-level learner fed the same scores at four hundred runs.
-\end{abstract}
-
-\vspace{4pt}
-\noindent\textbf{Keywords:} Pareto crewing, model selection, pareto front, empirical Bayes, Thompson sampling, combinatorial semi-bandits, CRDT, judge calibration, privacy, decentralised measurement.
-
-\section{Introduction}
-
-A harness that drives language models through software tasks has to decide, before every task, which model sits in which role. The decision is made under three kinds of information that arrive at different times and in different units: published prices and benchmark indexes, available for every model on the day it appears; the harness's own past runs, few but on the right distribution; and the runs of everyone else using the same harness, many but on other people's tasks and scored by other people's judges. This note is about turning the three into one decision.
-
-We call the resulting discipline \emph{Pareto crewing}: the crew is picked on the cost-quality front, per role and per task, from whatever evidence exists on the day, and the evidence is pooled across installs without any install giving up what it worked on. Our contributions are the following.
-\begin{enumerate}
-\item A closed-form objective for a crew, the expected cost of one clean delivery under reruns and a priced defect (Section~\ref{sec:objective}), and the observation that on a catalog alone the objective cannot be evaluated, which is why the catalog picker is a pareto front with a scale-free knee (Section~\ref{sec:catalog}).
-\item A decentralised measurement of role quality (Section~\ref{sec:pool}): text-free rows, sufficient statistics that form a state-based CRDT (Proposition~\ref{prop:crdt}), judge fixed effects identified from the connectivity of the judge-cell graph (Proposition~\ref{prop:ident}), robust aggregation across installs, and drift handled by a local-level model.
-\item An estimator with no tuned constant except the user's price of a defect (Section~\ref{sec:eb}): the catalog's prior weight, the between-install variance, the noise scale and the forgetting rate are all estimated from the pool by moments.
-\item A picker (Section~\ref{sec:decide}) that is Thompson sampling in a combinatorial semi-bandit: the crew objective is linear in role qualities, roles are scored separately, so one run updates every crew sharing a model with it.
-\item An empirical check on our own measured runs (Section~\ref{sec:exp}), reproducible from the script beside this document.
-\end{enumerate}
-
-\section{Setting}
-\label{sec:setting}
-
-\begin{definition}[Roles, crews]
-Let $\roles$ be a finite set of $n$ \emph{roles} and $\mods$ a finite set of models. A \emph{crew} is a map $\kappa:\roles\to\mods$. Each role $r$ carries a \emph{shape}: a token share $v_r\ge 0$ with $\sum_r v_r=1$, index weights $w_r\in\Delta^{2}$, a cache share $\gamma_r\in[0,1]$, an input-to-output ratio $\rho_r>0$, and a predicate $\mathrm{fit}_r(m)$ saying whether model $m$ can hold the role (tools, images, context). A symmetric relation $D\subseteq\roles\times\roles$ names the pairs of roles that may not be held by models of the same vendor.
-\end{definition}
-
-Our instance has $\roles=\{\seat{W},\seat{H},\seat{M}\}$ (worker, high, mastermind), token shares $(0.90,0.08,0.02)$, weights $(0.2,0.3,0.5)$, $(\tfrac13,\tfrac13,\tfrac13)$, $(0.6,0,0.4)$ on the indexes (intelligence, coding, agentic), cache shares $(0.75,0.75,0)$, ratios $(100,100,10)$ and $D=\{(\seat W,\seat H)\}$: the two roles that read the same work never share one shop. On the chat door the planner role is absent and $n=2$. Nothing below depends on $n=3$.
-
-A \emph{task} is one unit of work; a \emph{run} is one attempt at it by a crew. A run ends \emph{delivered} or not, and a delivered task is later found \emph{clean} (no major defect) or not. Money is in dollars and time is priced at $\lambda$ dollars per minute.
-
-The \emph{catalog} lists, per model, a prompt price $\pi_m$, a cache-read price $\pi^c_m$, a completion price $\kappa_m$ per million tokens, and benchmark indexes $I_m\in\R^3$. The \emph{pool} is the set of measurements described in Section~\ref{sec:pool}; the \emph{own sheet} is one install's part of it.
-
-\section{The crew computed from the catalog}
-\label{sec:catalog}
-
-\paragraph{Role cost and role quality.}
-Per million task tokens on role $r$, model $m$ costs
-\begin{equation}
-c_r(m) = (1-\gamma_r)\,\pi_m + \gamma_r\,\pi^{c}_m + \kappa_m/\rho_r ,
-\label{eq:seatcost}
-\end{equation}
-and its catalog quality is the weighted, pool-normalised index
-\begin{equation}
-\hat q_r(m) = 100 \sum_{i=1}^{3} w_{r,i}\,\frac{I_{m,i}}{\max_{m'\in\mods} I_{m',i}} .
-\label{eq:catq}
-\end{equation}
-A missing index is imputed from the models that publish it: for each index the model does publish, the median over at least three donor models of the ratio between the missing and the present index gives an offer, the offers are averaged, and the estimate is capped at the largest measured value of the missing index in the pool; with fewer than three donors the model takes the standing its present indexes give it on the pool's scale. An imputed quality is flagged and loses ties.
-
-\paragraph{Shortlists.}
-Role $r$'s shortlist is
-\begin{equation}
-S_r=\{m:\ \mathrm{fit}_r(m)\ \wedge\ \hat q_r(m)\ge \phi\max_{m'} \hat q_r(m')\},\qquad \phi=0.8,
-\label{eq:floor}
-\end{equation}
-the floor being the statement that a model which cannot do the job is not cheap at any price. The crew set is $\crews=\{\kappa\in\prod_r S_r:\ \mathrm{vendor}(\kappa(r))\ne\mathrm{vendor}(\kappa(r'))\ \forall (r,r')\in D\}$.
-
-\paragraph{Bill, quality, front.}
-\begin{equation}
-B(\kappa)=\sum_{r} v_r\,c_r(\kappa(r)),\qquad Q(\kappa)=\sum_{r}\nu_r\, q_r(\kappa(r)),\qquad \nu_r\ge0,\ \textstyle\sum_r\nu_r=1,
-\label{eq:crew}
-\end{equation}
-with $\nu$ uniform by default. The \emph{front} $\front\subseteq\crews$ is the set of crews not dominated in $(B,Q)$. Sorting $\crews$ by $(B\uparrow, Q\downarrow, \text{imputed count}\uparrow, \text{id}\uparrow)$ and keeping a crew when its $Q$ exceeds every kept crew's yields $\front$ in $O(|\crews|\log|\crews|)$, and the tie order makes $\front$ a function of the set $\crews$ rather than of any input order. In practice $|S_r|$ is a few dozen and $|\crews|$ a few thousand.
-
-\paragraph{Why a front and not a score.}
-The objective of Section~\ref{sec:objective} needs a probability of clean delivery. The catalog has none, so any scalarisation of $(B,Q)$ would fix an exchange rate between a price and a benchmark index that nobody has measured. Dominance is the only order that needs no such rate; every crew a user could sensibly want is on $\front$, which is small, and the remaining choice is one-dimensional along it.
-
-\paragraph{Knee and knob.}
-Index $\front$ by bill, $B_0\le\dots\le B_1$. The three named picks are \emph{frugal} $=\argmin_\front B$, \emph{max} $=\argmax_\front Q$, and \emph{balanced}, the crew farthest above the chord of the front in $(\ln B,Q)$:
-\begin{equation}
-\text{balanced}=\argmax_{\kappa\in\front}\ \Big[(Q(\kappa)-Q_0) - (Q_1-Q_0)\frac{\ln B(\kappa)-\ln B_0}{\ln B_1-\ln B_0}\Big].
-\label{eq:knee}
-\end{equation}
-\begin{proposition}[Scale invariance]
-The balanced crew is invariant under $B\mapsto aB$ for any $a>0$ and under $Q\mapsto Q+b$.
-\end{proposition}
-\begin{proof}
-$\ln(aB)-\ln(aB_0)=\ln B-\ln B_0$ and $\ln(aB_1)-\ln(aB_0)=\ln B_1-\ln B_0$; the bracket is unchanged. A shift of $Q$ cancels in both differences.
-\end{proof}
-The log scale is not cosmetic: catalog prices span two orders of magnitude, and the knee should not move when a currency changes or every vendor cuts prices by the same factor. A knob $k\in[0,1]$ picks the best crew with $B\le B_0(B_1/B_0)^k$, so equal steps in $k$ are equal ratios in the bill.
-
-\section{The objective: the cost of one clean delivery}
-\label{sec:objective}
-
-Let a run of crew $\kappa$ cost $c$ dollars and $t$ minutes, deliver with probability $r$, and let a delivered task be clean with probability $p$; a run that fails to deliver costs $c_f$ and $t_f$.
-
-\begin{lemma}[Rerun until clean]
-If every defect is caught and the task rerun, the expected cost to one clean delivery is
-\begin{equation}
-E_0(\kappa)=\frac{(1-r)(c_f+\lambda t_f)+r\,(c+\lambda t)}{r\,p}.
-\label{eq:E0}
-\end{equation}
-\end{lemma}
-\begin{proof}
-Attempts are i.i.d.\ with success probability $rp$; the count to the first success is geometric with mean $1/(rp)$, and by Wald's identity the expected total cost is the mean count times the expected cost of one attempt, which is the numerator.
-\end{proof}
-
-\begin{lemma}[Priced defect]
-If a shipped defect costs $H$ to find and mend and only non-deliveries are rerun,
-\begin{equation}
-E_H(\kappa)=\frac{(1-r)(c_f+\lambda t_f)}{r} + (c+\lambda t) + (1-p)\,H .
-\label{eq:EH}
-\end{equation}
-\end{lemma}
-\begin{proof}
-The count of failed attempts before the first delivery is geometric on $\{0,1,\dots\}$ with mean $(1-r)/r$; the delivering attempt costs $c+\lambda t$; the defect is paid once with probability $1-p$.
-\end{proof}
-
-$H$ is the one quantity that belongs to the user, and the budget word sets it: frugal $H=\$1$, balanced $\$10$, max $\$50$. Both forms are monotone in the same three quantities, the run's cost, its time and $\pclean=rp$, and the picker works with
-\begin{equation}
-E(\kappa)=c(\kappa)+\lambda\,t(\kappa)+H\,\big(1-\pclean(\kappa)\big).
-\label{eq:E}
-\end{equation}
-Equation~\eqref{eq:E} is~\eqref{eq:EH} with $r$ set to one: a run that fails to deliver is priced as a shipped defect rather than rerun. The surrogate ranks crews as $E_H$ does when $H$ is large next to a run's cost and $r$ is not far below one, which is the regime of every crew on the front of Figure~\ref{fig:front}; when a role's delivered rate is measured, as the worker's is, the picker can use~\eqref{eq:EH} directly and nothing below changes. Figure~\ref{fig:front} draws our measured crews with the iso-lines of~\eqref{eq:E}. The knob $k$ and the price $H$ parametrise the same trade-off; $k$ is what a catalog admits, $H$ is what measurements admit.
-
-\begin{assumption}[Linearity in roles]
-\label{ass:linear}
-$\pclean(\kappa)=\sum_r \nu_r\,q_r(\kappa(r))/100$, where $q_r(m)$ is the pool's role quality: the run's outcome credited to the role, on a 0--100 scale.
-\end{assumption}
-The assumption is what makes~\eqref{eq:E} linear in the role qualities, which Section~\ref{sec:decide} uses. It is a working rule rather than a law: a product over roles would count one outcome $n$ times, and a fitted interaction becomes available once judged scores separate the roles' contributions. Nothing in Sections~\ref{sec:pool}--\ref{sec:eb} depends on it.
-
-\begin{figure}[t]
-\centering\includegraphics{fig-front.pdf}
-\caption{Our measured crews: 56 (worker, checker or planner) combinations, each fitted by a ridge model on 72 scored runs over nine tasks; cost of one run against the probability that it delivers clean. Solid: the pareto front. Dashed: iso-cost lines of~\eqref{eq:E}; a larger $H$ tilts them so that quality buys more.}
-\label{fig:front}
-\end{figure}
-
-\section{The Model Pool: a decentralised measure of role quality}
-\label{sec:pool}
-
-\subsection{Judged runs and rows}
-
-After a run finishes, one model outside the crew reads the record (brief, deliverable, the checker's report and claim, the files touched) and answers one question per role with a score in $[0,100]$ and one sentence. The judge is chosen deterministically: the cheapest catalog model with coding index at least $60$ that can call tools, holds no role in the crew, and is not from the worker's vendor; a role the judge's own model holds is skipped. The floor is absolute, not relative to the worker; its reason is that a judge well below the class of the work it reads rubber-stamps. The judge's calls are billed to a role of their own, so learning is never free by accident; the cost is one short completion per role.
-
-One judged role of one run is one \emph{row}
-\[
-x=(\text{role},\ \text{model},\ \text{score},\ \text{judge},\ \text{door},\ \text{size}\in\{S,M,L\},\ \text{day}),
-\]
-sent under an \emph{install} nonce drawn once per profile and carried on the batch, not in the row. No text, no price and no duration is in a row; dollars and minutes stay in the install's own ledger. Rows wait in a local outbox, which can be inspected, until they are sent.
-
-\subsection{Sufficient statistics and order-free merging}
-
-\begin{definition}[Cell, sheet]
-A \emph{cell} is a tuple $\theta=(\text{role},\text{model},\text{judge},\text{door},\text{size})$. A \emph{sheet} is a map from (install, day, cell) to a triple $T=(n,S,S^2)\in\N\times\R_{\ge0}\times\R_{\ge0}$, the count, sum and sum of squares of the scores an install has produced in that cell.
-\end{definition}
-
-Every quantity computed below is a function of the sheet. Sheets are merged by the join
-\begin{equation}
-(A\sqcup B)(u,d,\theta)=\big(\max(n_A,n_B),\ \max(S_A,S_B),\ \max(S^2_A,S^2_B)\big)\quad\text{componentwise on } A(u,d,\theta),\,B(u,d,\theta),
-\label{eq:join}
-\end{equation}
-with a missing entry read as $(0,0,0)$.
-
-\begin{proposition}[The sheet is a state-based CRDT]
-\label{prop:crdt}
-Let each install $u$ only ever publish its own entries $(u,d,\theta)$ and let every published triple be the running total of $u$'s rows in $\theta$ on day $d$. Then (i) $\sqcup$ is commutative, associative and idempotent; (ii) an install's triples are monotone non-decreasing in time, so a later publication dominates an earlier one under $\sqcup$; (iii) any two nodes that have received the same set of publications, in any order and with any duplication, hold the same sheet.
-\end{proposition}
-\begin{proof}
-(i) is the componentwise max on a product of totally ordered sets. (ii) Scores lie in $[0,100]$, so $n$, $S$ and $S^2$ each grow by a non-negative amount per row. (iii) follows from (i) and (ii): the join of a set of publications is their least upper bound, which does not depend on order or multiplicity, and by (ii) the least upper bound of an install's publications is its latest.
-\end{proof}
-
-The cell means and pooled variances are functions of $\sum_u T(u,\theta)$, so by Proposition~\ref{prop:crdt} a relay and every install compute the same estimates from the same publications; there is no coordinator whose order of arrival matters, and a relay that is lost is rebuilt from any node that kept the publications. This is the sense in which the measure is decentralised: the relay is a convenience for bandwidth and signing, not a source of truth. Two kinds of merge exist, and the join is the law for one of them. Within a store, rows are folded by addition: the install's own sheet (\code{internal/pool/tally}) adds each of its rows once, as it is judged, and the reference relay adds each row it receives into the sender's triple for that cell and day. Addition is not idempotent, so a batch retried after a lost acknowledgement can be counted twice there; the relay bounds that by its daily row quota per install, and a relay that wants exactness keeps the batch's nonce. Between stores, when a relay, a mirror or an install holds a copy of another's sheet, the join~\eqref{eq:join} is the merge, and Proposition~\ref{prop:crdt} is what makes copies converge whatever the order.
-
-\subsection{Judges are not the same ruler}
-
-Let $y$ be a score of role $r$, model $m$, by judge $j$. We posit the two-way additive model
-\begin{equation}
-y=\mu_{rm}+\beta_j+\varepsilon,\qquad \E\varepsilon=0,\ \operatorname{Var}\varepsilon=\sigma^2,
-\label{eq:twoway}
-\end{equation}
-with $\mu_{rm}$ the quantity of interest and $\beta_j$ the judge's severity, constrained by $\sum_j n_{\cdot\cdot j}\beta_j=0$ (the judges' weighted mean is the ruler). Weighted least squares needs only the cell means $\bar y_{rmj}=S_{rmj}/n_{rmj}$ and counts. The normal equations are solved by alternating
-\begin{equation}
-\beta_j\leftarrow\frac{\sum_{r,m} n_{rmj}(\bar y_{rmj}-\mu_{rm})}{\sum_{r,m} n_{rmj}},\qquad
-\mu_{rm}\leftarrow\frac{\sum_{j} n_{rmj}(\bar y_{rmj}-\beta_j)}{\sum_{j} n_{rmj}},
-\label{eq:als}
-\end{equation}
-re-centring $\beta$ after each sweep. Each half-step minimises a convex quadratic in its block, so the residual is non-increasing and the iteration converges to the least-squares solution; five sweeps suffice in practice.
-
-\begin{proposition}[Identifiability]
-\label{prop:ident}
-Let $G$ be the bipartite graph with the judges on one side, the pairs $(r,m)$ on the other, and an edge where $n_{rmj}>0$. The parameters of~\eqref{eq:twoway} are identified up to one additive constant per connected component of $G$: within a component every contrast is identified, and one centring constraint per component fixes its levels. When $G$ is connected the single constraint identifies everything.
-\end{proposition}
-\begin{proof}
-The design matrix of a two-way additive model has rank equal to (number of vertices of $G$) minus (number of connected components), and its kernel is spanned by the vectors that shift $\mu$ up and $\beta$ down by one constant on one component; one linear constraint per component removes them. With the single centring constraint, exactly one component is fully identified.
-\end{proof}
-
-The reference relay centres $\beta$ by one weighted mean, which fixes the levels only when $G$ is connected; on a disconnected graph the between-component offsets are a convention of the fit, and the index says which judges each cell was scored by so a reader can tell. The judge rule of Section~5.1 makes $G$ connected quickly in practice: it sends most installs to the same few cheap judges. A model scored by a single judge so far has $\mu_{rm}$ equal to its own mean and the index says so.
-
-\subsection{Installs are not independent, and some are wrong}
-
-Rows from one install share a task mix, a codebase and a way of writing briefs. Under an intra-class correlation $\varrho$, $n_u$ rows from install $u$ carry the information of $n_u/(1+(n_u-1)\varrho)$ independent ones, which saturates at $1/\varrho$. The pool's cell estimate therefore treats installs, not rows, as the unit: it forms the install means $\bar y_{u\theta}$ and combines them with a location estimator that is robust to a minority of installs that are broken or adversarial. We use the Huber $M$-estimate with scale $s=1.4826\cdot\mathrm{MAD}$ and the conventional tuning constant $1.345$ (95\% efficiency at the normal), which has breakdown point $1/2$ in location, and fall back to the precision-weighted mean when a cell has fewer than five installs. A cell backed by fewer than three installs is published but not read.
-
-\subsection{Drift}
-
-Models change under the same name. Let $\bar y_d$ be a cell's day-$d$ mean over $n_d$ rows and model the true level as a random walk,
-\begin{equation}
-\mu_d=\mu_{d-1}+\eta_d,\quad \eta_d\sim\mathcal N(0,\omega^2);\qquad \bar y_d=\mu_d+\bar\varepsilon_d,\quad \bar\varepsilon_d\sim\mathcal N(0,\sigma^2/n_d).
-\label{eq:localevel}
-\end{equation}
-The Kalman filter for this local-level model is, in steady state with constant $n_d=\bar n$, an exponentially weighted average whose forgetting factor $1-\alpha$ solves $\alpha^2/(1-\alpha)=\bar n\omega^2/\sigma^2$; the effective memory is about $1/\alpha$ days. The drift variance is estimated by moments from the day-to-day differences,
-\begin{equation}
-\hat\omega^2=\Big[\widehat{\operatorname{Var}}(\bar y_d-\bar y_{d-1})-\sigma^2\big(\tfrac1{n_d}+\tfrac1{n_{d-1}}\big)\Big]_+,
-\label{eq:drift}
-\end{equation}
-pooled across cells. A cell with no evidence of drift ($\hat\omega^2=0$) keeps everything; a cell that drifts forgets at the rate the data show. The day is a cell dimension for exactly this reason.
-
-\begin{figure}[t]
-\centering
-\begin{tikzpicture}[x=1cm,y=1cm,
-  box/.style={draw,rounded corners=2pt,inner sep=4pt,font=\small,align=center,minimum height=8mm},
-  store/.style={box,fill=black!6},
-  net/.style={box,fill=blue!6},
-  arr/.style={-{Latex[length=2mm]},thick},
-  lbl/.style={font=\scriptsize,fill=white,inner sep=1.5pt}
-]
-\node[box]   (cat)   at (1.4,0)     {catalog\\prices, indexes};
-\node[store] (post)  at (4.7,0)     {posterior per\\(role, model)};
-\node[box]   (ts)    at (8.1,0)     {Thompson draw\\$\argmin_\kappa \tilde E(\kappa)$};
-\node[box]   (run)   at (10.7,0)    {run};
-\node[box]   (judge) at (13.3,0)    {judge\\outside the crew};
-\node[store] (outbox) at (10.7,-1.6) {outbox};
-\node[store] (own)   at (13.3,-1.6) {own sheet};
-\node[store] (index) at (4.7,-4.1)  {signed index\\(mirrored)};
-\node[net]   (relay) at (9.4,-4.1)  {relay: fold, judge effects \eqref{eq:als},\\Huber over installs, sign};
-\node[box,dashed] (others) at (13.3,-4.1) {other installs};
-\draw[arr] (cat) -- (post);
-\draw[arr] (post) -- (ts);
-\draw[arr] (ts) -- (run);
-\draw[arr] (run) -- (judge);
-\draw[arr] (judge) -- (own);
-\draw[arr] ([xshift=-7mm]judge.south) |- (outbox.east);
-\draw[arr] (own.south) -- ++(0,-0.45) -| node[lbl,pos=0.12,below]{at once} (post.south);
-\draw[arr] (outbox.south) -- node[lbl,right]{rows, no text} (outbox.south |- relay.north);
-\draw[arr] (relay) -- (index);
-\draw[arr] (index.north) -- node[lbl,pos=0.35,right]{read at start} (post.south);
-\draw[arr] (others.west) -- node[lbl,above]{rows} (relay.east);
-\draw[arr] (index.south) -- ++(0,-0.5) -| node[lbl,pos=0.25,below]{the same index} (others.south);
-\draw[dotted,thick] (-0.1,0.75) rectangle (14.9,-2.55);
-\node[font=\scriptsize] at (0.9,0.95) {one install};
-\end{tikzpicture}
-\caption{Where each step runs. Inside the dotted box is one install; the only thing that crosses it outward is a row without text. The relay merges publications with the join of Proposition~\ref{prop:crdt} and publishes a signed index; any install can host a relay, and any node that kept the publications can rebuild one.}
-\label{fig:flow}
-\end{figure}
-
-\section{Estimation with no tuned constant}
-\label{sec:eb}
-
-We now combine the three sources for one install $u$. Write $\hat q_r(m)$ for the catalog quality~\eqref{eq:catq}, $\bar y^{\mathrm{pool}}_{rm}$ and $n^{\mathrm{pool}}_{rm}$ for the pool's cell after Sections~5.3--5.5, and $\bar y^{u}_{rm}$, $n^{u}_{rm}$ for the own sheet.
-
-\begin{assumption}[Hierarchy]
-\begin{equation}
-\mu_{rm}\sim\mathcal N\big(\hat q_r(m)+b,\,\tau_0^2\big),\qquad
-\mu^{u}_{rm}\mid\mu_{rm}\sim\mathcal N\big(\mu_{rm},\,\tau_1^2\big),\qquad
-y\mid\mu^{u}_{rm}\sim\mathcal N\big(\mu^{u}_{rm},\,\sigma^2\big).
-\label{eq:hier}
-\end{equation}
-\end{assumption}
-The first line says the catalog predicts the population quality up to one offset $b$ shared by every model (the catalog's scale is not the judge's) and a noise $\tau_0$; the second that install $u$'s own quality for the model scatters around the population's; the third is judge noise after Section~5.3. The install cares about $\mu^u_{rm}$.
-
-\begin{proposition}[Posterior for the install]
-\label{prop:post}
-Under~\eqref{eq:hier}, with $k=\sigma^2/\tau_0^2$, $\ell=\sigma^2/\tau_1^2$ and $\tilde n=n^{\mathrm{pool}}\,\ell/(\ell+1)$ (pool rows are other installs' rows, so each carries variance $\sigma^2+\tau_1^2$ about $\mu_{rm}$), the posterior of $\mu^u_{rm}$ is normal with
-\begin{equation}
-\E[\mu^u_{rm}\mid\cdot]=\frac{k^{\ast}\,(\hat q_r(m)+b) + n^{\ast}\,\bar y^{\mathrm{pool}}_{rm} + n^u\,\bar y^u_{rm}}{k^{\ast}+n^{\ast}+n^u},\qquad
-\operatorname{Var}[\mu^u_{rm}\mid\cdot]=\frac{\sigma^2}{k^{\ast}+n^{\ast}+n^u},
-\label{eq:three}
-\end{equation}
-where the catalog and the pool share one \emph{capped} external count $W$ in proportion to what each contributed,
-\begin{equation}
-W=\frac{K\,\ell}{K+\ell}\ \le\ \ell,\qquad K=k+\tilde n,\qquad
-k^{\ast}=\frac{k}{K}\,W,\qquad n^{\ast}=\frac{\tilde n}{K}\,W .
-\label{eq:cap}
-\end{equation}
-\end{proposition}
-\begin{proof}
-Integrate out $\mu_{rm}$. The catalog and the pool inform $\mu^u_{rm}$ only through $\mu_{rm}$, whose posterior given them is normal with precision $K/\sigma^2$, $K=k+\tilde n$, and mean the $k:\tilde n$ precision-weighted average of $\hat q_r(m)+b$ and $\bar y^{\mathrm{pool}}_{rm}$; adding the between-install variance $\tau_1^2$ gives, for $\mu^u_{rm}$, a precision $1/(\sigma^2/K+\tau_1^2)=W/\sigma^2$ with the same mean. The own rows add precision $n^u/\sigma^2$ directly. Precision-weighting the two gives~\eqref{eq:three}, with the external count $W$ split as $k^{\ast}+n^{\ast}=W$ in the ratio $k:\tilde n$.
-\end{proof}
-
-\begin{corollary}
-With $\tau_1=0$ ($\ell=\infty$) the posterior mean is $(1-w)\hat q_r(m)+w\bar y$ with $w=n/(n+k)$, $n=n^{\mathrm{pool}}+n^u$: the plain shrinkage blend, which is what the picker applies today with $k=30$.
-\end{corollary}
-
-The cap~\eqref{eq:cap} is the point of the hierarchy. However many rows the pool holds, everything external to this install, catalog and pool together, is worth at most $\ell=\sigma^2/\tau_1^2$ own rows, because other installs' tasks are not this install's tasks; and the own rows are never capped. This replaces an ad hoc "own rows count triple" by a quantity with a meaning and an estimator. The pick shipped today is the Corollary's form: the pool's and the install's cells are folded together by observation count against the catalog at $k=30$, which is~\eqref{eq:three} at $\ell=\infty$ and $b=0$.
-
-\paragraph{Estimating the constants.}
-Every constant in~\eqref{eq:three} is estimated from the sheet by moments; none is set by hand.
-\begin{align}
-\hat\sigma^2 &= \frac{\sum_{u,\theta}\big(S^2_{u\theta}-S_{u\theta}^2/n_{u\theta}\big)}{\sum_{u,\theta}(n_{u\theta}-1)} &&\text{pooled within-cell variance,}\label{eq:sigma}\\
-\hat\tau_1^2 &= \Big[\,\widehat{\operatorname{Var}}_u\big(\bar y_{u\theta}\big)-\hat\sigma^2\,\overline{(1/n_{u\theta})}\,\Big]_+ &&\text{between-install variance, pooled over cells,}\label{eq:tau1}\\
-\hat b &= \overline{\bar y^{\mathrm{pool}}_{rm}-\hat q_r(m)} &&\text{the catalog's offset,}\label{eq:bias}\\
-\hat\tau_0^2 &= \Big[\,\widehat{\operatorname{Var}}_{(r,m)}\big(\bar y^{\mathrm{pool}}_{rm}-\hat q_r(m)\big)-\overline{(\hat\sigma^2+\hat\tau_1^2)/n^{\mathrm{pool}}_{rm}}\,\Big]_+ &&\text{how far the catalog misses,}\label{eq:tau0}
-\end{align}
-each a within-minus-noise moment estimator of the kind used by Efron and Morris~\cite{efron1975}. Then $k=\hat\sigma^2/\hat\tau_0^2$ and $\ell=\hat\sigma^2/\hat\tau_1^2$, and $\hat\omega^2$ of~\eqref{eq:drift} sets the forgetting. On the seed index alone the estimator already says something: its thirteen cells with a published intelligence index give $\hat b=-13.7$ (the judged scale sits 14 points below the catalog's) and a variance of the residuals, 109, below the noise they carry, 167, so $\hat\tau_0^2$ clips to zero: thirteen cells of bit-valued scores ($\hat\sigma\approx43$) cannot resolve a catalog error under about 13 points, and the day-one $k=30$ stands until judged scores, with their smaller $\sigma$, replace the bits. The design publishes them in the index beside the cells so that every install blends with the same constants, re-estimated at every relay cycle and withheld until each denominator has at least ten degrees of freedom, with the day-one values of Table~\ref{tab:const} until then; the index on this head carries the cells and the day-one constants, and the estimators are the next thing the relay's job runs.
-
-\subsection{Covariates, and why no row is ever wasted}
-\label{sec:covariates}
-
-A row carries more than (role, model, score): a door, a size bucket, a judge, a day, an install, and any field added later, such as the harness version or a task family. Call the vector of such fields the row's \emph{profile} $c\in\mathcal C=\prod_f L_f$, a product of factor levels. The hierarchy~\eqref{eq:hier} extends factor by factor:
-\begin{equation}
-\mu_{rm,c}=\mu_{rm}+\sum_{f}\delta^{f}_{rm,c_f},\qquad \delta^{f}_{rm,\cdot}\sim\mathcal N(0,\tau_f^2)\ \text{i.i.d.\ over levels},
-\label{eq:factors}
-\end{equation}
-so that a (role, model) has one population quality and one partially pooled offset per level of each factor. The install factor is the case $f=\text{install}$ of~\eqref{eq:factors}, and Proposition~\ref{prop:post} is its two-level instance; the same derivation gives, for a query profile $c$, a posterior mean that is a precision-weighted combination of the cell means at every level that shares a coordinate with $c$, each capped by its own $\ell_f=\sigma^2/\tau_f^2$, with $\hat\tau_f^2$ estimated by the between-level moment~\eqref{eq:tau1} applied to factor $f$. Two properties follow.
-
-\emph{Old rows keep their value when the harness changes.} If the door algorithm is rewritten, rows from the old door are a level of the door factor; they still inform $\mu_{rm}$ with the full weight the estimated $\tau_{\text{door}}^2$ allows, and the new door starts at $\mu_{rm}$ plus nothing and specialises as its own rows arrive. If the two doors turn out to differ little, $\hat\tau_{\text{door}}^2\approx 0$, $\ell_{\text{door}}\to\infty$, and the factor pools completely; if they differ a lot, the cap keeps the old door from speaking for the new one. The data decide, per factor, how much they transfer.
-
-\emph{The schema is open.} A row with a field absent (older rows, before the field existed) is at a level of its own, \emph{unknown}, which the estimator treats like any other level. Adding a field therefore invalidates nothing already collected, and the sheet's join in Proposition~\ref{prop:crdt} is unaffected because a cell key is only a tuple. What can be extracted from the rows is the set of contrasts the factors expose; a factor that is never recorded cannot be recovered later, which is why the row carries every cheap field now and the text of none.
-
-Regressors that are not factors, a task's token count for instance, enter the same way as a linear term with a partially pooled slope; the moment estimators are the same with a design column in place of an indicator.
-
-\paragraph{Interactions: the crew as a group.}
-Assumption~\ref{ass:linear} scores roles one at a time. Whether a particular worker and a particular checker do better \emph{together} than their role qualities predict is a question about the pair, and the same hierarchy answers it: a pair $(m_r,m_{r'})$ is a level of a factor over $\mods\times\mods$, with its own partially pooled offset $\delta^{rr'}_{(m_r,m_{r'})}\sim\mathcal N(0,\tau_{rr'}^2)$. A pair that has never been run sits at zero offset and the additive prediction stands; a pair with rows moves by exactly the amount its rows justify against $\hat\tau_{rr'}^2$; if pairs in general add nothing, $\hat\tau_{rr'}^2\to0$ and the term disappears. This is the whole difference between learning crews as groups and learning roles: the group term is there, but it is charged for. A crew-level learner with no structure has to visit each of $|\crews|$ crews to say anything about it; the additive model needs $\sum_r|S_r|$ observations to say something about every crew, and the pair term then spends further observations only where a pair is actually run. Some group effects are constraints rather than parameters: the vendor rule $D$ is one, and it is applied to $\crews$ before any learning happens.
-
-\begin{table}[h]
-\centering\small
-\begin{tabular}{p{2.0cm}p{5.2cm}p{4.0cm}p{2.6cm}}\toprule
-constant & meaning & estimator & day-one value\\\midrule
-$\sigma$ & judge noise & \eqref{eq:sigma} & 15\\
-$k=\sigma^2/\tau_0^2$ & weight of the catalog & \eqref{eq:tau0} & 30\\
-$\ell_f=\sigma^2/\tau_f^2$ & cap on evidence transferred across a factor (install, door, size, \dots) & \eqref{eq:tau1} per factor & 30\\
-$\omega^2$ & drift per day & \eqref{eq:drift} & 0 (no forgetting)\\
-$\beta_j$ & judge severity & \eqref{eq:als} & 0\\
-$v_r$ & role token shares & measured from run token accounting & $0.90/0.08/0.02$\\
-\midrule
-$H$ & price of a shipped defect & the user's, by budget word & \$1 / \$10 / \$50\\
-$\lambda$ & price of a minute & the user's & \$0.01\\
-$\phi$, judge floor & structural floors & fixed by design & $0.8$, $60$\\
-\bottomrule\end{tabular}
-\caption{Every constant with its estimator. Two are the user's by design; two are structural floors. The rest are empirical-Bayes estimates that the relay publishes with the index.}
-\label{tab:const}
-\end{table}
-
-\begin{figure}[t]
-\centering\includegraphics{fig-shrink.pdf}
-\caption{Shrinkage of one role quality from the catalog prior (80) toward the measured mean (65), $k=30$, $\sigma=15$. The band is what the Thompson draw of Section~\ref{sec:decide} samples from.}
-\label{fig:shrink}
-\end{figure}
-
-\section{Deciding: Thompson sampling with semi-bandit feedback}
-\label{sec:decide}
-
-Given a posterior $\mathcal N(\mu'_{rm},\sigma'^2_{rm})$ per role and model from~\eqref{eq:three}, the pick could minimise~\eqref{eq:E} at the posterior means. That never tries a crew the prior underrates, and the catalog prior is wrong by a lot for some models (Figure~\ref{fig:cells}). Thompson sampling~\cite{thompson1933,russo2018} draws one plausible world from the posterior and acts as if it were true: a crew is chosen with the probability that it is the best, exploration is proportional to what is unknown, and it stops on its own as the posteriors tighten. No exploration rate exists to be set.
-
-\begin{algorithm}[h]
-\caption{One pick under \emph{learn}}
-\begin{algorithmic}[1]
-\Require shortlists $S_r$ on the posterior means, budget word $\Rightarrow H$, task size bucket $\Rightarrow$ expected tokens $T$ and minutes $t(\kappa)$
-\For{each role $r$ and $m\in S_r$}
-  \State $\tilde q_{rm}\sim\mathcal N(\mu'_{rm},\sigma'^2_{rm})$ \Comment{one draw per run; never redrawn during the run}
-\EndFor
-\For{each $\kappa\in\crews$}
-  \State $\tilde E(\kappa)\gets T\,B(\kappa)+\lambda\,t(\kappa)+H\,\big(1-\sum_r\nu_r\tilde q_{r\kappa(r)}/100\big)$
-\EndFor
-\State \Return $\argmin_\kappa\tilde E(\kappa)$ \Comment{ties: fewer imputed indexes, then id order}
-\end{algorithmic}
-\end{algorithm}
-
-\begin{proposition}[Role draws are crew draws]
-Under Assumption~\ref{ass:linear}, drawing $\tilde q_{rm}$ independently per (role, model) and minimising $\tilde E$ over $\crews$ is Thompson sampling over the crews' posterior costs under the product posterior on role qualities.
-\end{proposition}
-\begin{proof}
-$\tilde E(\kappa)$ is an affine function of the vector $(\tilde q_{rm})$, so its joint law over $\crews$ is the push-forward of the posterior on role qualities; a sample of the latter is a sample of the former. The judge-effect fit of Section~5.3 and the drift model of Section~5.5 induce dependence between cells that the independent draw ignores; the draw is exact for the product approximation the index publishes.
-\end{proof}
-
-The structure that matters is the feedback. A run of crew $\kappa$ is judged role by role, so it yields one observation for each of its $n$ (role, model) pairs, and the posterior of every crew that shares a pair with $\kappa$ moves. This is a combinatorial bandit with semi-bandit feedback~\cite{chen2013,wen2015}: the unknowns are the $\sum_r|S_r|$ role qualities, not the $|\crews|$ crew values, and the regret of Thompson sampling scales with the former~\cite{wen2015}. Section~\ref{sec:exp} measures the difference on our runs. For Gaussian posteriors the Bayesian regret of Thompson sampling is $O(\sqrt{dT\log T})$ in the dimension $d$ of the unknowns over $T$ runs~\cite{russo2014}.
-
-\paragraph{The learned front.}
-Under \emph{learn} the front of Section~\ref{sec:catalog} is recomputed on the posterior: the bill $B(\kappa)$ is read at the run's expected tokens, and the quality is the posterior mean of $\pclean(\kappa)$, so the front is the pareto set in (expected dollars per task, expected probability of a clean delivery) with an interval on each point from~\eqref{eq:three}. The budget word's $H$ is a line of slope $-1/H$ in that plane and the pick is where the line first touches the front; Algorithm~1 is the same pick on one draw of the front rather than on its mean, which is what makes it explore. The pool command prints the mean front with its intervals, and the catalog front beside it, so that a user can see where measurement moved a pick and by how much.
-
-\paragraph{When is it settled.}
-The same posterior answers whether learning is done: the probability $\pi^\ast$ that the posterior-mean crew is the best, estimated by repeating the draw of Algorithm~1 a few hundred times. The pool command reports $\pi^\ast$; a value near one means further exploration is nearly free, a value near $1/|\front|$ means the ranking is still open. Costs enter as observed dollars per run and are not sampled; their noise is small next to the quality's.
-
-\begin{remark}[A new model]
-A model with no rows has $n=0$ and sits at its catalog prior with the prior variance $\sigma^2/k^{\ast}$. If that puts it near the front it is drawn into crews soon, judged, and confirmed or pushed down by its first rows. Nothing is done by hand when the catalog changes.
-\end{remark}
-
-\section{Experiments on our measured runs}
-\label{sec:exp}
-
-Ground truth is the table of Figure~\ref{fig:front}: 56 crews with $\pclean$, dollars and minutes fitted by a ridge model on 72 scored runs of our own over nine tasks. Each replicate draws a catalog prior per arm as the truth plus $\mathcal N(0,0.15^2)$ noise, roughly the disagreement between indexes and measurements in Figure~\ref{fig:cells}, holds it with $k=30$, and runs $N$ tasks; a strategy picks, observes the outcome and pays~\eqref{eq:E} with $H=\$10$. Regret is the excess over the oracle crew, averaged over 200 replicates.
-
-\paragraph{Crew-level learners.}
-Table~\ref{tab:regret} and Figure~\ref{fig:regret} compare, on all 23 chat-door crews of the table, a fixed table row (the shipped balanced crew), the catalog prior alone, $\varepsilon$-greedy and Thompson, all with one arm per crew. After 400 runs Thompson is \$0.33 per task under the fixed table, a third of the table's regret, and still falling; $\varepsilon$-greedy is \$0.12 behind it. Thompson pays an exploration tax in its first forty runs, when it is no better than the table; $k=30$ is what bounds it. $\varepsilon$-greedy pays more, because a tenth of its runs go to a random crew among 23, and its rate neither grows when a new model appears nor shrinks when the ranking is settled.
-
-\begin{table}[h]
-\centering\small
-\input{tab-regret.tex}
-\caption{Regret against the oracle, dollars per task after $N$ runs, one arm per crew.}
-\label{tab:regret}
-\end{table}
-
-\begin{figure}[h]
-\centering\includegraphics{fig-regret.pdf}
-\caption{Left: regret per task. Right: share of runs on a crew other than the current posterior-mean best. Thompson explores heavily while many crews sit within cents of each other and less as the posteriors separate; $\varepsilon$-greedy explores at its fixed rate.}
-\label{fig:regret}
-\end{figure}
-
-\paragraph{Role-level feedback.}
-Figure~\ref{fig:semibandit} and Table~\ref{tab:semibandit} isolate the structure of Section~\ref{sec:decide}. The ground truth is three-role: a role quality per (role, model) read off the measured rows (a worker's delivered rate, a checker's and a planner's clean rate), combined by the linear rule of Assumption~\ref{ass:linear} over every crew the vendor rule admits, with dollars additive over roles. Three learners run Thompson sampling with the same prior noise and the same $H$ and differ only in what they see after a run: one arm per crew fed the run's clean-or-defect bit; one arm per crew fed the mean of the judge's role scores; one posterior per (role, model) fed each role's own score, which is what the judge of Section~5.1 provides. The last is the semi-bandit. Richer feedback per run helps: the crew-level learner fed the mean score sits at \$0.31 after four hundred runs against \$0.54 for the one fed only the clean bit. The structure helps again as much: the role-level learner, fed the same scores as the second, sits at \$0.15, half of it and a third of the first, because every run updates the crews that share a model with the one that ran, and there are sixteen unknowns behind 138 crews.
-
-\begin{table}[h]
-\centering\small
-\input{tab-semibandit.tex}
-\caption{Regret against the oracle, dollars per task after $N$ runs, on the three-role truth; same prior noise and $H$ for all three learners.}
-\label{tab:semibandit}
-\end{table}
-
-\begin{figure}[h]
-\centering\includegraphics{fig-semibandit.pdf}
-\caption{Thompson sampling under three kinds of feedback on the same three-role truth. Dotted and dashed: one arm per crew, fed the clean bit and the mean role score respectively. Solid: one posterior per (role, model) fed the role scores, the combinatorial semi-bandit of Section~\ref{sec:decide}.}
-\label{fig:semibandit}
-\end{figure}
-
-\begin{figure}[t]
-\centering\includegraphics{fig-cells.pdf}
-\caption{The seed index shipped in the binary: 15 cells from 194 scored runs, \code{role\_quality} $=100\cdot P(\text{no major defect})$ under a Beta(1,1) posterior. The spread between models a catalog rates alike is why the pool exists.}
-\label{fig:cells}
-\end{figure}
-
-The truth in these experiments is our own fitted table from one team's tasks, so the size of the gain is the shape of the effect and not a promise for every install; the regret scale is set by how close the crews sit, which the front of Figure~\ref{fig:front} shows and no bound here uses. The script \code{figures.py} beside this document reproduces every figure and table from the two CSV files it reads and the constants written at its head.
-
-\section{System architecture}
-\label{sec:arch}
-
-The statistics of Sections~\ref{sec:pool}--\ref{sec:decide} fix what the system computes; this section fixes where the bytes live, so that the privacy claims can be checked against the deployment rather than taken on trust. Figure~\ref{fig:arch} shows the four components. The design rule is that the relay holds nothing worth stealing and nothing that cannot be rebuilt.
-
-\paragraph{The binary.}
-Everything that touches a task runs inside the install: the catalog read, the posterior, the draw, the run, the judge call, the own sheet and the outbox. The judge is an ordinary model call through the install's own provider credentials; the record it reads never leaves the machines the install already trusts with its work. The outbox is a newline-delimited file under the profile directory; \code{codeaf pool status} prints its pending rows, and a user who wants to see exactly what would be sent can read the file. The loader reads the fresher of the cached index and the embedded seed index, by generated day, once at start-up; a refresh runs in the background and takes effect at the next start, so a running task's picks never move under it.
-
-\paragraph{The relay.}
-The reference relay is a single edge function with an object store behind it, deployable in minutes on a commodity edge platform (\code{wrangler deploy} from \code{relay/} in the repository; the runbook beside this document is ten steps). It exposes two routes. \code{POST /v1/rows} accepts a batch of rows, validates the schema, folds each row into the sender's triple for its cell and day, and discards the row: the store holds the sheet of Definition~2 and nothing else, one triple per (install, cell, day), so its size is bounded by installs times cells times days and not by traffic, and a row that has been folded cannot be recovered from it. \code{GET /index.json} serves the last published index and its detached signature. An hourly scheduled job reads the sheet, runs the judge-effect fit and the robust aggregation of Section~5 (the drift estimate of Section~5.5 is specified and next to land), writes the index, signs it with an Ed25519 key held as a platform secret, and mirrors the pair of files to a public git branch so that they are browsable, diffable and forkable. The function keeps no request logs and stores no network address; the install nonce is the only identity in the store, and rate limiting is by nonce (a cap on rows per day) rather than by address.
-
-\paragraph{Priming, and one document at a time.}
-The pool does not start empty. The same measured runs the seed of Figure~\ref{fig:cells} encodes were loaded once as ordinary rows, by a committed script in \code{relay/tools}, under one install nonce per originating session and one judge id for the reviewer that scored them; so the first published index carries the cells the binary already knows, and an install that reaches the relay reads numbers on day one rather than an empty document. Nothing is counted twice, because an install holds exactly one index document at a time: the cached one when it parses and is not older, by its generated day, than the seed the binary carries, and the seed otherwise. The seed is the offline fallback, never a second source blended with the fetched one. That the priming rows were scored by review and later rows by a judge model is the judge-severity situation of Section~\ref{sec:pool} already: one more judge id, fitted like the others.
-
-\paragraph{Keys and verification.}
-The signing key's public half is compiled into the binary as a list, so a key can be rotated by shipping a binary that carries both; the private half exists only in the platform secret store. Verification is client-side: the binary checks the signature before it reads a single cell, refuses a version lower than the one it holds (a rollback is caught by the version; a replayed old index is refused the same way), and on any failure keeps the cached copy beside an error. Because verification is local, the index can be served from anywhere: the mirror, a static file host, or a directory on disk, which is what the \code{file://} address is for.
-
-\paragraph{Trust and failure.}
-What a compromised relay learns is the sheet: counts, sums and sums of squares of scores per (install nonce, role, model, judge, day, size, door). It learns no task, no code, no prompt, no user, and no address. What a compromised relay can do is publish a bad index, which the signature stops unless the key is also taken; a taken key is retired by shipping the next key, and the min-installs and robust-aggregation rules bound what a flood of fabricated nonces can move in the meantime. What an unreachable relay costs is nothing at all: the cache, then the seed, answer every read, and the outbox waits. Any install can run the same function against its own store and point its \code{CODEAF\_MODEL\_POOL\_URL} and \code{\_SUBMIT\_URL} at it; two relays that receive the same publications produce the same sheet (Proposition~\ref{prop:crdt}), so a private relay and the public one can be federated later by a one-way copy of publications with no reconciliation step.
-
-\begin{figure}[H]
-\centering
-\resizebox{\textwidth}{!}{%
-\begin{tikzpicture}[x=1cm,y=1cm,
-  box/.style={draw,rounded corners=2pt,inner sep=4pt,font=\small,align=center,minimum height=8mm},
-  store/.style={box,fill=black!6},
-  net/.style={box,fill=blue!6},
-  arr/.style={-{Latex[length=2mm]},thick},
-  lbl/.style={font=\scriptsize,fill=white,inner sep=1.5pt}
-]
-\node[box,text width=3.2cm]   (bin)    at (2.0,0)    {binary\\posterior, draw, run, judge};
-\node[store,text width=3.2cm] (outbox) at (2.0,-1.8) {outbox\\rows, local file};
-\node[store,text width=3.2cm] (cache)  at (2.0,-3.6) {index cache\\and embedded seed};
-\node[net,text width=6.1cm]   (fn)     at (8.2,-1.8) {edge function\\\code{POST /v1/rows}: fold a row into its triple\\\code{GET /index.json}: serve the last index};
-\node[store,text width=6.1cm] (kv)     at (8.2,-4.2) {object store\\one triple per (install, cell, day)};
-\node[net,text width=3.4cm]   (cron)   at (13.7,-4.2) {hourly job\\fold, \eqref{eq:als}, Huber, sign};
-\node[store,text width=3.4cm] (mirror) at (13.7,-1.8) {public mirror\\\code{index.json} + \code{.sig}};
-\node[box,dashed,text width=3.4cm] (secret) at (13.7,-6.0) {platform secret\\Ed25519 private key};
-\draw[arr] (bin) -- (outbox);
-\draw[arr] (cache.west) -- ++(-0.4,0) |- node[lbl,pos=0.25,left]{read at start} (bin.west);
-\draw[arr] (outbox.east) -- node[lbl,above]{https, batched} (fn.west |- outbox.east);
-\draw[arr] (fn) -- node[lbl,right]{fold} (kv);
-\draw[arr] (kv) -- node[lbl,above]{sheet} (cron);
-\draw[arr] (cron) -- node[lbl,right]{signed index} (mirror);
-\draw[arr] (secret) -- (cron);
-\draw[arr] (mirror.west) -- node[lbl,below,pos=0.6]{pull, verify} (fn.east |- mirror.west);
-\draw[arr] ([xshift=-2.2cm]fn.south) |- node[lbl,pos=0.75,above]{cached index} (cache.east);
-\node[font=\scriptsize] at (8.0,0.2) {no request logs, no addresses stored, rows discarded after folding};
-\end{tikzpicture}}
-\caption{Deployment. The relay is one edge function, one object store holding only the sheet, and one scheduled signing job; the install verifies every index locally and never blocks on the network. Any of the three network components can be replaced by a static file, a directory, or a self-hosted copy.}
-\label{fig:arch}
-\end{figure}
-
-\section{What the user controls}
-
-\begin{center}\small
-\begin{tabular}{p{2.1cm}p{4.3cm}p{8.0cm}}\toprule
-setting & values & meaning\\\midrule
-\code{crew} & frugal $\mid$ balanced $\mid$ max $\mid$ custom & how much to spend: $H$ and the knob $k$\\
-\code{picked from} & table $\mid$ catalog $\mid$ learn & the rows we measured; recomputed from today's catalog; catalog plus pool plus own sheet\\
-\code{model\_pool} & on $\mid$ read $\mid$ off & read the index and send rows (default); read only; neither\\
-\code{explore} & on $\mid$ off & Thompson draw (default) or the posterior mean; \emph{learn} only; specified, not on this head\\
-\bottomrule\end{tabular}
-\end{center}
-
-With the pool set to \emph{read}, the own sheet still accrues and enters~\eqref{eq:three}; with it \emph{off}, only the catalog prior remains and the pick is the catalog's. The index is a JSON document signed with an Ed25519 key whose public half is in the binary; \code{codeaf pool verify} checks it, \code{pool show} prints its summary and each address with its source, \code{pool status} counts the rows waiting in the outbox and says whether the relay answered. The binary carries a seed index of our own scored runs (Figure~\ref{fig:cells}) so that \emph{learn} has numbers on day one. The relay's code is in this repository; its addresses are settings, so an install can read from and send to a relay of its own, or to none.
-
-\section{Status}
-
-On the head this document ships with: the catalog crew of Section~\ref{sec:catalog}; the shrinkage blend of the Corollary with $k=30$; the \code{picked from} row and its ladder; the index document, its reader and signed pull with the built-in key; the outbox, the install nonce and the push; the judge, its deterministic choice, and the hook that calls it when a chat task lands; the own sheet, whose cells enter the prior beside the index's by observation count; the settings; the seed index; the relay of Section~\ref{sec:arch} with its store keyed by install and day, the join, the judge-effect fit and the Huber aggregation; the mirror workflow. Specified here and next to land: the drift estimate~\eqref{eq:drift}; the hierarchical cap~\eqref{eq:cap} with the moment estimators~\eqref{eq:sigma}--\eqref{eq:tau0} in place of the count fold; the Thompson draw with role-level updates, the \code{explore} setting and the settled probability $\pi^\ast$; the pair term of Section~6.1; the headless doors' hook. The referee's report on an earlier draft, and what changed in answer to it, are beside this file.
-
-\begin{thebibliography}{9}\small
-\bibitem{thompson1933} W.~R. Thompson. On the likelihood that one unknown probability exceeds another in view of the evidence of two samples. \emph{Biometrika} 25:285--294, 1933.
-\bibitem{russo2018} D.~Russo, B.~Van Roy, A.~Kazerouni, I.~Osband, Z.~Wen. A tutorial on Thompson sampling. \emph{Foundations and Trends in Machine Learning} 11(1):1--96, 2018.
-\bibitem{russo2014} D.~Russo, B.~Van Roy. Learning to optimize via posterior sampling. \emph{Mathematics of Operations Research} 39(4):1221--1243, 2014.
-\bibitem{chen2013} W.~Chen, Y.~Wang, Y.~Yuan. Combinatorial multi-armed bandit: general framework and applications. \emph{ICML}, 2013.
-\bibitem{wen2015} Z.~Wen, B.~Kveton, A.~Ashkan. Efficient learning in large-scale combinatorial semi-bandits. \emph{ICML}, 2015.
-\bibitem{efron1975} B.~Efron, C.~Morris. Data analysis using Stein's estimator and its generalizations. \emph{Journal of the American Statistical Association} 70(350):311--319, 1975.
-\bibitem{shapiro2011} M.~Shapiro, N.~Pregui\c{c}a, C.~Baquero, M.~Zawirski. Conflict-free replicated data types. \emph{SSS}, 2011.
-\bibitem{huber1964} P.~J. Huber. Robust estimation of a location parameter. \emph{Annals of Mathematical Statistics} 35(1):73--101, 1964.
-\bibitem{harvey1989} A.~C. Harvey. \emph{Forecasting, Structural Time Series Models and the Kalman Filter}. Cambridge University Press, 1989.
-\end{thebibliography}
-
-\end{document}
diff --git a/docs/design/model-pool/tab-regret.tex b/docs/design/model-pool/tab-regret.tex
deleted file mode 100644
index 463ceb71f2..0000000000
--- a/docs/design/model-pool/tab-regret.tex
+++ /dev/null
@@ -1,8 +0,0 @@
-% generated by figures.py from data/measured-crews.csv; do not edit
-\begin{tabular}{lrrrrrrrrr}\toprule
-$N$ & 10 & 20 & 40 & 70 & 100 & 150 & 200 & 300 & 400\\\midrule
-table & 1.01 & 0.95 & 0.95 & 0.93 & 0.95 & 0.93 & 0.94 & 0.96 & 0.97\\
-catalog & 0.99 & 0.94 & 0.94 & 0.91 & 0.92 & 0.88 & 0.88 & 0.90 & 0.91\\
-greedy & 1.20 & 1.10 & 1.01 & 0.99 & 0.94 & 0.90 & 0.86 & 0.80 & 0.76\\
-thompson & 0.97 & 0.97 & 0.93 & 0.87 & 0.88 & 0.84 & 0.79 & 0.71 & 0.64\\
-\bottomrule\end{tabular}
diff --git a/docs/design/model-pool/tab-semibandit.tex b/docs/design/model-pool/tab-semibandit.tex
deleted file mode 100644
index 5a7ac2a294..0000000000
--- a/docs/design/model-pool/tab-semibandit.tex
+++ /dev/null
@@ -1,7 +0,0 @@
-% generated by figures.py from data/measured-crews.csv; do not edit
-\begin{tabular}{lrrrrrrrrr}\toprule
-$N$ & 10 & 20 & 40 & 70 & 100 & 150 & 200 & 300 & 400\\\midrule
-crew, clean bit & 0.47 & 0.50 & 0.50 & 0.51 & 0.53 & 0.54 & 0.55 & 0.55 & 0.54\\
-crew, mean score & 0.29 & 0.43 & 0.39 & 0.38 & 0.36 & 0.35 & 0.34 & 0.34 & 0.31\\
-role, semi-bandit & 0.36 & 0.35 & 0.31 & 0.27 & 0.26 & 0.22 & 0.20 & 0.17 & 0.15\\
-\bottomrule\end{tabular}
diff --git a/internal/catalog/catalog.go b/internal/catalog/catalog.go
index 94775538e2..d73402fd00 100644
--- a/internal/catalog/catalog.go
+++ b/internal/catalog/catalog.go
@@ -123,6 +123,11 @@ type Model struct {
 	IntelligenceIndex float64 `json:"intelligence_index,omitempty"`
 	CodingIndex       float64 `json:"coding_index,omitempty"`
 	AgenticIndex      float64 `json:"agentic_index,omitempty"`
+	// Created is when the model was listed, in Unix seconds — the release date
+	// the crew router reads a model's age from. Zero means the row did not say
+	// or was cached before this field was kept; a reader then falls back to a
+	// date in the canonical slug, or to none.
+	Created int64 `json:"created,omitempty"`
 	// OpenWeights says the row's weights are published — OpenRouter's
 	// `hugging_face_id`, kept as the one-word answer to whether the weights are
 	// public. A row cached before this field existed reads false, which every
@@ -1157,6 +1162,7 @@ func fetch(ctx context.Context, options Options) ([]Model, error) {
 			CacheReadPrice:    cacheRead,
 			PriceUnknown:      !promptOK || !completionOK,
 			ArenaElo:          arenaElo(item.Benchmarks),
+			Created:           int64(item.Created),
 			IntelligenceIndex: analysisScore(item.Benchmarks, "intelligence_index"),
 			CodingIndex:       analysisScore(item.Benchmarks, "coding_index"),
 			AgenticIndex:      analysisScore(item.Benchmarks, "agentic_index"),
@@ -1177,7 +1183,7 @@ func fetch(ctx context.Context, options Options) ([]Model, error) {
 }
 
 // modelWire is one row of OpenRouter's /models listing, in the shape this
-// package reads it. Everything absent from it — description, created,
+// package reads it. Everything absent from it — description,
 // per_request_limits, top_provider, links — is either prose nobody renders or
 // provider bookkeeping, and a field added here is a field something on screen
 // has to be able to explain.
@@ -1194,7 +1200,9 @@ type modelWire struct {
 	} `json:"alias_target"`
 	Name          string `json:"name"`
 	ContextLength int    `json:"context_length"`
-	Architecture  struct {
+	// Created is when the row was listed, in Unix seconds.
+	Created      float64 `json:"created"`
+	Architecture struct {
 		// Modality is the coarse "text->text" string. It is read for nothing:
 		// input_modalities and output_modalities say the same thing as lists,
 		// and a list is what every question this package answers is asked in.
diff --git a/internal/config/auto.go b/internal/config/auto.go
deleted file mode 100644
index 21b15d1a5e..0000000000
--- a/internal/config/auto.go
+++ /dev/null
@@ -1,513 +0,0 @@
-package config
-
-import (
-	"strings"
-
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
-	"github.com/Agent-Field/codeaf/internal/pool/index"
-)
-
-// THE WORD THAT ASKS THE CATALOG TO ANSWER A TIER ROW.
-//
-// A tier row names a model id, and a model id is a bet the person made one day
-// against a catalog that keeps moving under it. `auto` is the row that
-// declines to bet: the seat's model is computed from the catalog's own
-// published figures — the three capability indexes against the three prices,
-// under each seat's call shape (internal/crewpick) — every time the row is
-// read, through [autoRow], the one seam both ladders pass through.
-//
-// NOTHING IS REWRITTEN. The row stays `auto` on disk and the id is derived on
-// every read, so a catalog that moves moves the seat with it, and a profile
-// never holds a model id this build chose for somebody.
-
-// AutoValue is the bare word a tier row holds to have its seat computed from
-// the catalog.
-const AutoValue = "auto"
-
-// IsAuto reports whether a tier value is the bare word, case folded with the
-// surrounding space ignored. `auto:high` is not it: the rows own the
-// `:<level>` notation, and a suffixed word is a model id with a level, handed
-// on whole the way every other one is.
-func IsAuto(value string) bool {
-	return strings.ToLower(strings.TrimSpace(value)) == AutoValue
-}
-
-// AutoModels is how the catalog reaches seat resolution: the binary holding
-// the catalog sets it ONCE AT START-UP, from its non-blocking read, and never
-// a fetch — a tier row that says auto resolves from whatever the catalog
-// already holds, the same posture every other catalog reader here keeps. Nil,
-// and a func answering with no rows, are ordinary states rather than errors:
-// a row that says auto then reads the family's table row ([autoRow]), which
-// is the answer it had before this word existed.
-var AutoModels func() []catalog.Model
-
-// AutoIndex is how the Model Pool's measurement index reaches seat
-// resolution: the binary holding the index sets it ONCE AT START-UP, from
-// whatever read it already made, and never a fetch — a tier row that says
-// auto resolves from the index already in hand, the same posture AutoModels
-// keeps. Nil is an ordinary state, not an error: a row that says auto then
-// reads the catalog's own figures alone, which is what it read before this
-// seam existed.
-var AutoIndex func() *index.Index
-
-// AutoOwnCells is how an install's own judged scores reach seat resolution:
-// the binary holding the pool sets it ONCE AT START-UP, from the own sheet it
-// read from disk under the pool directory, the same posture AutoIndex keeps.
-// Nil is an ordinary state, not an error: the prior then reads the index's
-// cells alone, which is what it read before this seam existed. The cells are
-// never held to the index's min_installs — an install's own scores are its
-// own evidence, one observation of which is worth having.
-var AutoOwnCells func() []crewpick.Cell
-
-// PoolQualityMetric names the index metric the picker reads a measured seat
-// quality from: a gaussian metric whose mean is on the same 0-100 scale
-// crewpick scores a seat on, with one cell per role and model.
-const PoolQualityMetric = "role_quality"
-
-// AutoPick is the pick with the measured quality the Model Pool holds ALWAYS
-// carried as a prior: [AutoPickWith] with [autoPrior], whatever a profile's
-// pick word says. No seat resolves through it any more — the bare `auto` row
-// ([autoRow]) and the pick row's words ([pickedModel]) decide the prior
-// together in [priorFor] — and it stays for a caller that wants the measured
-// computation regardless of the pick word.
-func AutoPick(tier, family, preset string, models []catalog.Model) (modelID string, ok bool) {
-	return AutoPickWith(tier, family, preset, models, autoPrior(autoIndex()))
-}
-
-// AutoPickWith is the pick itself, with the measured quality NAMED: prior is
-// carried into the front as a rating seats read on top of the catalog's own
-// published scores, and a nil prior leaves every seat on those scores alone —
-// the answer the `catalog` pick word carries, where `learn` passes the pool's
-// measurements and the person's own judged runs ([autoPrior]).
-//
-// It is PURE: no disk, no network, the rows are only read, and the same rows
-// give the same answer however often it is asked and in whatever order they
-// arrive (crewpick breaks its ties by id, not by order). Each row is read as
-// a crewpick candidate — the three indexes, the three prices AS PUBLISHED (a
-// uniform scale changes no pick on a front sorted by bill), whether the
-// provider published a cache-read price at all, the window, the modalities
-// and the parameters — and a row whose price the provider did not publish is
-// left out, because a model that may cost anything has no place in a pick
-// that is about cost.
-//
-// tier names the seat the pick is read from: worker, high and mastermind have
-// answers, reflex and low and any other word do not. family narrows the
-// shelf: `open` picks off the open-weight rows, every other word off the
-// whole catalog. preset is one of the three crew words, and any other word
-// has no answer. No rows, an empty front or an empty id are no answer too;
-// no answer is ok false and an empty id, which is the caller's cue to read
-// the family's table row instead ([autoRow], [pickedSeat]).
-func AutoPickWith(tier, family, preset string, models []catalog.Model, prior crewpick.Prior) (modelID string, ok bool) {
-	seat, ok := autoSeat(tier)
-	if !ok || len(models) == 0 {
-		return "", false
-	}
-	fam := crewpick.All
-	if normalCrewSource(family) == CrewSourceOpen {
-		fam = crewpick.Open
-	}
-	candidates := autoCandidates(models)
-	if len(candidates) == 0 {
-		return "", false
-	}
-	frugal, balanced, max := crewpick.Presets(crewpick.FrontWith(candidates, crewpick.DefaultShapes(), fam, prior))
-	var pick crewpick.Crew
-	switch strings.ToLower(strings.TrimSpace(preset)) {
-	case CrewFrugal:
-		pick = frugal
-	case CrewBalanced:
-		pick = balanced
-	case CrewMax:
-		pick = max
-	default:
-		return "", false
-	}
-	var id string
-	switch seat {
-	case crewpick.Worker:
-		id = pick.Worker
-	case crewpick.High:
-		id = pick.High
-	case crewpick.Mastermind:
-		id = pick.Mastermind
-	}
-	return id, id != ""
-}
-
-// autoIndex is [AutoIndex] read with its ordinary absence folded into one
-// answer.
-func autoIndex() *index.Index {
-	if AutoIndex == nil {
-		return nil
-	}
-	return AutoIndex()
-}
-
-// autoPrior reads the measured quality of the index AND of this install's own
-// sheet into a crewpick prior. The index's cells of PoolQualityMetric are kept
-// only when the metric is declared gaussian — a mean on any other scale would
-// be blended against figures it does not share units with — and dropped by
-// PriorFromCells below the index's own min_installs, resolved through the
-// index's canonical ids so an alias meets its candidate. The own sheet's cells
-// are this install's own evidence: they are read through a second
-// PriorFromCells at a floor of one and folded into the index's prior seat by
-// seat, the means combined by observation count. Their scores are on the
-// 0-100 scale a judge answers on whatever the index's metric says, so they
-// are read even beside an index whose role_quality is not gaussian. A nil
-// index and a nil seam answer no prior, which leaves every seat on the
-// catalog quality.
-func autoPrior(idx *index.Index) crewpick.Prior {
-	canonical := autoCanonical(idx)
-	var indexPrior crewpick.Prior
-	if idx != nil {
-		if kind, ok := idx.Kind(PoolQualityMetric); ok && kind == "gaussian" {
-			cells := idx.Cells(PoolQualityMetric)
-			measured := make([]crewpick.Cell, 0, len(cells))
-			for _, c := range cells {
-				measured = append(measured, crewpick.Cell{Role: c.Role, Model: c.Model, Mean: c.Mean, N: c.N})
-			}
-			indexPrior = crewpick.PriorFromCells(measured, idx.MinInstalls(), idx.Canonical)
-		}
-	}
-	var ownPrior crewpick.Prior
-	if own := autoOwnCells(); len(own) > 0 {
-		ownPrior = crewpick.PriorFromCells(own, 1, canonical)
-	}
-	return crewpick.MergePriors(indexPrior, ownPrior)
-}
-
-// autoCanonical is the index's canonical ids, nil when there is no index. The
-// own sheet's ids are the ones this install resolved its seats to, and a nil
-// canonical leaves them as they stand.
-func autoCanonical(idx *index.Index) func(string) string {
-	if idx == nil {
-		return nil
-	}
-	return idx.Canonical
-}
-
-// autoOwnCells is [AutoOwnCells] read with its ordinary absence folded into
-// one answer.
-func autoOwnCells() []crewpick.Cell {
-	if AutoOwnCells == nil {
-		return nil
-	}
-	return AutoOwnCells()
-}
-
-// autoSeat is the tier word that names which of crewpick's three seats the
-// pick is read from. The two tiers that never vary — reflex and small work —
-// have no answer here, the same law their columns in the shipped tables keep.
-func autoSeat(tier string) (crewpick.Seat, bool) {
-	switch strings.ToLower(strings.TrimSpace(tier)) {
-	case ModelTierWorker:
-		return crewpick.Worker, true
-	case ModelTierHigh:
-		return crewpick.High, true
-	case ModelTierMastermind:
-		return crewpick.Mastermind, true
-	}
-	return 0, false
-}
-
-// autoCandidates reads every published row as a candidate. Rows with no
-// published price are dropped here, where the reason is nameable, rather than
-// being carried into the picker to fall out of its own candidacy law.
-func autoCandidates(models []catalog.Model) []crewpick.Candidate {
-	candidates := make([]crewpick.Candidate, 0, len(models))
-	for _, model := range models {
-		if model.PriceUnknown {
-			continue
-		}
-		candidates = append(candidates, crewpick.Candidate{
-			ID:              model.ID,
-			Open:            model.OpenWeights,
-			Intelligence:    model.IntelligenceIndex,
-			Coding:          model.CodingIndex,
-			Agentic:         model.AgenticIndex,
-			PromptPrice:     model.PromptPrice,
-			CompletionPrice: model.CompletionPrice,
-			CacheReadPrice:  model.CacheReadPrice,
-			HasCacheRead:    model.CacheReadPrice > 0,
-			Context:         model.ContextLength,
-			Images:          listHolds(model.InputModalities, "image"),
-			Tools:           listHolds(model.Parameters, "tools"),
-		})
-	}
-	return candidates
-}
-
-// listHolds says whether a row's own list carries the word, case folded — the
-// catalog cleans its lists, but a reader that folds is one fewer assumption.
-func listHolds(words []string, word string) bool {
-	for _, held := range words {
-		if strings.EqualFold(strings.TrimSpace(held), word) {
-			return true
-		}
-	}
-	return false
-}
-
-// ── the seam ────────────────────────────────────────────────────────────────
-
-// autoRow is THE ONE SEAM both ladders resolve a tier row that says auto
-// through — [tierSeatUnder], which the conversation, the settings sheet and
-// the crew word read, and [resolveSeat], which every headless door climbs. A
-// second copy in each would be a seat that means one thing in chat and
-// another headless, which is the defect this file exists to prevent one
-// ladder at a time.
-//
-// The answer is the computed id, on its own rung, when the catalog can
-// compute one; otherwise the family's table row FOR THE PRESET, on the table
-// rung — the same id a preset write would have landed, and never `auto` and
-// never empty.
-func autoRow(profileDir, family, tier string) (model string, source SeatSource, preset string) {
-	preset = crewPresetUnder(profileDir, family)
-	// THE ANSWER IS THE PICK WORD'S OWN ANSWER, computed the way a
-	// pick-computed seat's is ([pickedModel]): the prior is decided once, in
-	// [priorFor] — the pool's measurements under `learn`, the published
-	// figures alone under every other word — so the two seams cannot disagree
-	// about what `catalog` means, and the rung names the word that ran
-	// ([computedRung]) so they cannot name one computation two ways either.
-	pick := CrewPickAt(profileDir)
-	if id, ok := AutoPickWith(tier, family, preset, autoCatalogRows(), priorFor(pick)); ok {
-		return id, computedRung(pick), preset
-	}
-	if row, ok := CrewModelsForSource(family, preset); ok {
-		if id := strings.TrimSpace(row[tier]); id != "" {
-			return id, SeatTable, preset
-		}
-	}
-	// Unreachable for a tier this build knows — every preset row answers all
-	// five — but the never-empty law is carried rather than assumed: the
-	// family's default row is the last word.
-	return defaultTierModel(family, tier), SeatTable, preset
-}
-
-// pickedSeat is THE PICK ROW'S HALF OF THE LADDER: where a seat's model comes
-// from when the pick is off the table and the tier row does not name a model
-// of its own. Both ladders call it — [tierSeatUnder] for the conversation and
-// the settings sheet, [resolveSeat] for every headless door — so a pick
-// cannot mean one thing in chat and another headless.
-//
-// The rule, in the order it is applied:
-//
-//   - the two seats that read every turn are NOT asked: reflex and small work
-//     always read the table, the same law their columns in the shipped tables
-//     keep, and the caller decides which tiers reach here;
-//   - a WRITTEN dial row is a person's own model, and it wins — the pick answers
-//     for the seats nobody named, not over the names they typed. A written row
-//     is a pin when the profile's five tier rows are NOT all written (a `/crew`
-//     APPLY writes all five at once, a hand pin writes one), when the profile
-//     STORES its own crew word ([storedCrewWord]), or when the row's id is not
-//     the preset's own table value;
-//   - every other seat among worker, careful work and mastermind is computed
-//     at the crew's preset ([crewPresetUnder]), on the rung the pick names:
-//     [SeatComputed] under the `catalog` word, [SeatLearned] under `learn`;
-//   - when the catalog cannot compute one — no rows, no pick off the front —
-//     the preset's own table row is the answer, on the table rung, the same
-//     fallback [autoRow] keeps. Never `auto` and never empty.
-//
-// ok is false only when the pick has nothing to say — the pick row at its
-// default, a hand-typed id, or a tier that always reads the table — and the
-// caller answers with the row's own rung instead. The DEFAULT PICK IS THE
-// FIRST CHECK: a profile that has never answered the row reads every seat
-// exactly as it read before the row existed, which is what a default is for.
-func pickedSeat(profileDir, family, tier, model string, written bool) (Seat, bool) {
-	if CrewPickAt(profileDir) == CrewPickTable {
-		return Seat{}, false
-	}
-	if tier != ModelTierWorker && tier != ModelTierHigh && tier != ModelTierMastermind {
-		return Seat{}, false
-	}
-	// A WRITTEN DIAL ROW IS A PIN THE PICK DOES NOT RECOMPUTE when it is not the
-	// preset answering. The preset answering is a `/crew` APPLY, which writes all
-	// five tier rows at once ([ApplyCrew]); so a written row wins when the five
-	// rows are not all written (a person pinned one by hand), when the profile
-	// stores its own crew word ([storedCrewWord] — a run that named a budget and
-	// pinned the crew table's OWN ids, which the value rule below would
-	// recompute), or when the row's id is not the preset's own. A crew applied
-	// WHOLE with no stored word keeps the old rule: a row holding the preset's
-	// own table value is the preset answering and the pick computes it.
-	if written {
-		if _, worded := storedCrewWord(profileDir); worded || !allTiersWritten(profileDir) {
-			return Seat{}, false
-		}
-	}
-	preset := crewPresetUnder(profileDir, family)
-	if row, ok := CrewModelsForSource(family, preset); ok {
-		if model != "" && !strings.EqualFold(strings.TrimSpace(model), row[tier]) {
-			return Seat{}, false
-		}
-	}
-	id, source := pickedModel(tier, family, preset, CrewPickAt(profileDir))
-	return Seat{Role: tierSeatRole(tier), Model: id, Source: source, Crew: preset}, true
-}
-
-// allTiersWritten reports whether the profile's five tier rows were EACH WRITTEN
-// — every key held and non-empty. It is how the pick tells a crew APPLY, which
-// writes all five at once ([ApplyCrew]), from a person pinning one model by
-// hand: only a whole crew is the preset answering, and a partial write is the
-// person's own rows.
-func allTiersWritten(profileDir string) bool {
-	for _, tier := range ModelTiers {
-		model, _, source, cleared := crewRow(profileDir, tier)
-		if cleared || source != SeatCrew || strings.TrimSpace(model) == "" {
-			return false
-		}
-	}
-	return true
-}
-
-// unwrittenSeat is what an UNWRITTEN tier row reads when the profile STORES a
-// crew word: that word's own table row, under the family named, on the table
-// rung. It is shared by both ladders — [tierSeatUnder] for the conversation and
-// the settings sheet, [resolveSeat] for every headless door — so a word that
-// seats one surface seats the other, and a profile that stores no word answers
-// nothing here and keeps its own bottom rung.
-func unwrittenSeat(profileDir, family, tier string) (Seat, bool) {
-	word, ok := storedCrewWord(profileDir)
-	if !ok {
-		return Seat{}, false
-	}
-	row, ok := CrewModelsForSource(family, word)
-	if !ok {
-		return Seat{}, false
-	}
-	id := strings.TrimSpace(row[tier])
-	if id == "" {
-		return Seat{}, false
-	}
-	return Seat{Role: tierSeatRole(tier), Model: id, Source: SeatTable, Crew: word}, true
-}
-
-// priorFor is the prior a seat computed at the crew's preset carries, read
-// from the pick word alone: [autoPrior] under `learn` — the Model Pool's
-// measurements and this install's own judged runs — and nil under every other
-// word, which leaves each seat on the published figures alone. The bare
-// `auto` row ([autoRow]) and the pick word's own seat ([pickedModel]) both
-// answer through it, so the two seams cannot disagree again about what
-// `catalog` means.
-func priorFor(pick string) crewpick.Prior {
-	if normalCrewPick(pick) == CrewPickLearn {
-		return autoPrior(autoIndex())
-	}
-	return nil
-}
-
-// pickedModel is the pick word's own answer for one tier: the catalog's pick
-// at the preset, on the rung the word names; and, when nothing can be
-// computed, the preset's own table row on the table rung — the id a preset
-// write would have landed, and never `auto` and never empty.
-func pickedModel(tier, family, preset, pick string) (modelID string, source SeatSource) {
-	pick = normalCrewPick(pick)
-	if id, ok := AutoPickWith(tier, family, preset, autoCatalogRows(), priorFor(pick)); ok {
-		return id, computedRung(pick)
-	}
-	if row, ok := CrewModelsForSource(family, preset); ok {
-		if id := strings.TrimSpace(row[tier]); id != "" {
-			return id, SeatTable
-		}
-	}
-	// Unreachable for a tier this build knows — every preset row answers all
-	// five — but the never-empty law is carried rather than assumed, the same
-	// last word [autoRow] keeps.
-	return defaultTierModel(family, tier), SeatTable
-}
-
-// computedRung is the rung a seat computed at the crew's preset answers on,
-// read from the pick word alone: [SeatLearned] under `learn`, whose pick
-// carries the Model Pool's measurements and this install's own judged runs
-// ([autoPrior]), and [SeatComputed] under `catalog` — and under the table word,
-// which computes nothing of its own. IT ASKS WHICH PICK RAN, never whether the
-// prior moved the id: [SeatLearned]'s own comment says the rung names the
-// computation, and a rung that reported an actual move would be a second rule.
-// The pick's own seat ([pickedModel]) and a bare `auto` row ([autoRow]) both
-// answer through it, so the two seams cannot name one computation two ways.
-func computedRung(pick string) SeatSource {
-	if normalCrewPick(pick) == CrewPickLearn {
-		return SeatLearned
-	}
-	return SeatComputed
-}
-
-// autoCatalogRows is [AutoModels] read with its two ordinary absences folded
-// into one answer.
-func autoCatalogRows() []catalog.Model {
-	if AutoModels == nil {
-		return nil
-	}
-	return AutoModels()
-}
-
-// crewPresetUnder is the preset the profile's five STORED rows make, in the
-// family given — read from the rows and never through seat resolution, so
-// the seam cannot ask the ladder that is asking it.
-//
-// Each stored tier value is read through the ladder's own row reader
-// ([crewRow]), which is what keeps a row reached through the lineage saying
-// it the same way. A row the reader cannot answer — cleared, or never held —
-// reads the family's default-preset id, which is what that tier runs until
-// somebody writes it. A row that says auto matches WHICHEVER preset is being
-// compared, because auto is the one row with no opinion of its own: it is
-// asking to be computed at the budget the other four rows name.
-//
-// The answer is the first preset whose every row matches, the default preset
-// tried first and then the crew's own order; when none matches, the default —
-// the budget an undecided profile runs at is the budget an auto seat runs at.
-//
-// THE DEFAULT PRESET WINS EVERY TIE, and ties are ordinary rather than rare:
-// the presets differ in only a few cells, so an auto row on a seat the two
-// presets share leaves the rest of the rows matching both. Max differs from
-// balanced only in the worker seat today, which makes a crew with an auto
-// worker and the shipped rows elsewhere exactly that tie — it reads balanced.
-// Trying the default first is what decides it, so the order above is the rule
-// and not an accident of iteration.
-func crewPresetUnder(profileDir, family string) string {
-	// A STORED CREW WORD IS THE BUDGET, not the rows under it. A run that wrote
-	// one word into config.json instead of the five rows ([storedCrewWord])
-	// named its budget directly, so the computed seats read at that budget
-	// whether or not the rows were written — this is the seam the word reaches
-	// the task door's seats through.
-	if word, ok := storedCrewWord(profileDir); ok {
-		return word
-	}
-	defaults := crewTableFor(family)[DefaultCrew]
-	read := make(map[string]string, len(ModelTiers))
-	for _, tier := range ModelTiers {
-		value, _, source, cleared := crewRow(profileDir, tier)
-		switch {
-		case cleared || source == "":
-			read[tier] = strings.ToLower(strings.TrimSpace(defaults[tier]))
-		case IsAuto(value):
-			read[tier] = AutoValue
-		default:
-			read[tier] = strings.ToLower(strings.TrimSpace(value))
-		}
-	}
-	matches := func(preset string) bool {
-		row, ok := CrewModelsForSource(family, preset)
-		if !ok {
-			return false
-		}
-		for _, tier := range ModelTiers {
-			if read[tier] == AutoValue {
-				continue
-			}
-			if read[tier] != strings.ToLower(strings.TrimSpace(row[tier])) {
-				return false
-			}
-		}
-		return true
-	}
-	if matches(DefaultCrew) {
-		return DefaultCrew
-	}
-	for _, preset := range CrewPresets {
-		if preset != DefaultCrew && matches(preset) {
-			return preset
-		}
-	}
-	return DefaultCrew
-}
diff --git a/internal/config/auto_test.go b/internal/config/auto_test.go
deleted file mode 100644
index 08131c91ab..0000000000
--- a/internal/config/auto_test.go
+++ /dev/null
@@ -1,599 +0,0 @@
-package config
-
-import (
-	"encoding/json"
-	"math"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
-	"github.com/Agent-Field/codeaf/internal/pool/index"
-)
-
-// THE WORD, AND WHAT IS NOT THE WORD. `auto` is a bare word a tier row holds,
-// and everything that only resembles one is a model id: a suffixed word is the
-// rows' own `:<level>` notation, a slashed one is a vendor's namespace, and
-// `automatic` is somebody's model that happens to begin with it.
-func TestIsAutoReadsTheBareWordAlone(t *testing.T) {
-	for word, want := range map[string]bool{
-		"auto": true, " AUTO ": true, "Auto": true, "\tauto\n": true,
-		"": false, "auto:high": false, "vendor/auto": false, "automatic": false,
-	} {
-		if got := IsAuto(word); got != want {
-			t.Errorf("IsAuto(%q) = %t, want %t", word, got, want)
-		}
-	}
-}
-
-// autoTestRows is a small catalog with every fact a pick reads, and one row
-// the provider priced "-1" on — which is not a candidate, for the reason a
-// pick that is about cost cannot count a model whose cost nobody published.
-func autoTestRows() []catalog.Model {
-	return []catalog.Model{
-		{ID: "a/cheap", OpenWeights: true, IntelligenceIndex: 30, CodingIndex: 35, AgenticIndex: 40,
-			PromptPrice: 0.0000002, CompletionPrice: 0.0000009, CacheReadPrice: 0.00000002,
-			ContextLength: 200_000, InputModalities: []string{"text", "image"}, Parameters: []string{"tools"}},
-		{ID: "a/mid", OpenWeights: true, IntelligenceIndex: 45, CodingIndex: 50, AgenticIndex: 48,
-			PromptPrice: 0.000001, CompletionPrice: 0.000003, CacheReadPrice: 0.0000001,
-			ContextLength: 200_000, InputModalities: []string{"text"}, Parameters: []string{"tools"}},
-		{ID: "b/care", IntelligenceIndex: 60, CodingIndex: 55, AgenticIndex: 50,
-			PromptPrice: 0.000004, CompletionPrice: 0.00002, CacheReadPrice: 0.0000004,
-			ContextLength: 400_000, InputModalities: []string{"text", "image"}, Parameters: []string{"tools"}},
-		{ID: "c/mind", IntelligenceIndex: 75, CodingIndex: 70, AgenticIndex: 65,
-			PromptPrice: 0.00001, CompletionPrice: 0.00005, ContextLength: 200_000,
-			InputModalities: []string{"text"}, Parameters: []string{"tools"}},
-		{ID: "r/router", PriceUnknown: true, IntelligenceIndex: 80, CodingIndex: 80, AgenticIndex: 80,
-			PromptPrice: -1, CompletionPrice: -1, ContextLength: 200_000},
-	}
-}
-
-// THE PICK IS PURE AND ITS ANSWER IS THE FRONT'S. The same rows give the same
-// id however often it is asked, the rows are never touched, and a row whose
-// price nobody published is in no seat. The front is read the way the shipped
-// tables were (crew.go owns the method), so the pick answers exactly what
-// crewpick answers for these rows — asserted here against crewpick itself
-// rather than against a figure copied out of one.
-func TestAutoPickAnswersTheFront(t *testing.T) {
-	rows := autoTestRows()
-	workers := make([]string, 0, 3)
-	for i := 0; i < 3; i++ {
-		id, ok := AutoPick(ModelTierWorker, CrewSourceAll, CrewFrugal, rows)
-		if !ok || id == "" {
-			t.Fatalf("AutoPick answered ok=%t id=%q", ok, id)
-		}
-		workers = append(workers, id)
-	}
-	for i := 1; i < len(workers); i++ {
-		if workers[i] != workers[0] {
-			t.Fatalf("the same rows answered %q then %q — the pick is not pure", workers[0], workers[i])
-		}
-	}
-	_ = workers
-	if rows[4].ID != "r/router" || !rows[4].PriceUnknown {
-		t.Fatal("AutoPick modified the rows it was handed")
-	}
-
-	frugal, _, maxCrew := crewpick.Presets(crewpick.Front(autoCandidates(rows), crewpick.DefaultShapes(), crewpick.All))
-	if len(frugal.Worker) == 0 {
-		t.Fatal("the test rows field no crew — the rows are broken")
-	}
-	if got, _ := AutoPick(ModelTierWorker, CrewSourceAll, CrewFrugal, rows); got != frugal.Worker {
-		t.Fatalf("worker frugal = %q, want the front's own %q", got, frugal.Worker)
-	}
-	if got, _ := AutoPick(ModelTierMastermind, CrewSourceAll, CrewMax, rows); got != maxCrew.Mastermind {
-		t.Fatalf("mastermind max = %q, want the front's own %q", got, maxCrew.Mastermind)
-	}
-}
-
-// THE TWO TIERS THAT NEVER VARY HAVE NO ANSWER HERE, the same law their
-// columns in the shipped tables keep — reflex and small work are the same
-// near-free models in all three presets, and a word that computes for them
-// would be a second opinion about a row that has none.
-func TestAutoPickRefusesTheTiersWithoutOpinions(t *testing.T) {
-	for _, tier := range []string{ModelTierReflex, ModelTierLow, "", "banana"} {
-		if id, ok := AutoPick(tier, CrewSourceAll, CrewFrugal, autoTestRows()); ok || id != "" {
-			t.Errorf("AutoPick(%q) answered %q, want no answer", tier, id)
-		}
-	}
-}
-
-// THE THREE WORDS ARE THE ONLY PRESETS, `open` IS THE ONLY OTHER FAMILY, AND
-// NOTHING IS AN ERROR: no answer is ok false and an empty id, on no rows,
-// on an empty front, on a word that is not a preset, and on a tier the
-// catalog cannot field.
-func TestAutoPickAnswersNothingWhenNothingCanBePicked(t *testing.T) {
-	if id, ok := AutoPick(ModelTierWorker, CrewSourceAll, "banana", autoTestRows()); ok || id != "" {
-		t.Errorf("an unknown preset answered %q", id)
-	}
-	if id, ok := AutoPick(ModelTierWorker, CrewSourceAll, CrewFrugal, nil); ok || id != "" {
-		t.Errorf("no rows answered %q", id)
-	}
-	if id, ok := AutoPick(ModelTierHigh, CrewSourceAll, CrewFrugal, []catalog.Model{{ID: "a/cheap", PromptPrice: 1}}); ok || id != "" {
-		t.Errorf("rows that field no crew answered %q", id)
-	}
-	// A family word this build does not know reads as the default family,
-	// the way [CrewSourceAt] reads one — and that family answers here.
-	if _, ok := AutoPick(ModelTierWorker, "misplaced", CrewFrugal, autoTestRows()); !ok {
-		t.Error("an unknown family word read as no family at all")
-	}
-}
-
-// ── the ladder ──────────────────────────────────────────────────────────────
-
-// A ROW THAT SAYS AUTO RESOLVES THROUGH THE ONE SEAM, ON BOTH LADDERS, to the
-// computed id with the rung that says so — and with the catalog absent, to
-// the family's table row for the preset the other four rows name, on the
-// table rung. It never resolves to `auto` and never to empty.
-func TestAnAutoRowResolvesOnBothLadders(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	rows := writeProfileRows(t, map[string]string{
-		KeyTierWorkerModel:     " auto ",
-		KeyTierMastermindModel: "AUTO",
-	})
-	for _, seat := range []Seat{
-		TierSeatAt(rows, ModelTierWorker),
-		ResolveSeats(rows, "", "").Work,
-	} {
-		if seat.Source != SeatComputed {
-			t.Errorf("conversation ladder: the seat reads %s, want computed", seat.Rung())
-		}
-		if strings.TrimSpace(seat.Model) == "" || IsAuto(seat.Model) {
-			t.Errorf("conversation ladder: the seat reads %q, want a computed id", seat.Model)
-		}
-	}
-	plan := ResolveSeats(rows, "", "").Plan
-	if plan.Source != SeatComputed {
-		t.Errorf("headless ladder: the plan seat reads %s, want computed", plan.Rung())
-	}
-
-	// The catalog reaches nothing: the family's table row answers, on the
-	// table rung, at the preset the stored rows make. These rows pin nothing
-	// else, so they are the default crew — and the worker column of that
-	// preset in the DEFAULT family is the answer the table owes.
-	AutoModels = nil
-	table, _ := CrewModelsForSource(DefaultCrewSource, DefaultCrew)
-	want := table[ModelTierWorker]
-	for name, seat := range map[string]Seat{
-		"conversation": TierSeatAt(rows, ModelTierWorker),
-		"headless":     ResolveSeats(rows, "", "").Work,
-	} {
-		if seat.Model != want || seat.Source != SeatTable {
-			t.Errorf("%s ladder with no catalog: %q (%s), want %q (table)", name, seat.Model, seat.Rung(), want)
-		}
-	}
-}
-
-// A REACHED-THROUGH-THE-LINEAGE ROW SAYS AUTO THE SAME WAY. The worker row
-// landed after profiles held only the small-work row, and a profile of that
-// vintage whose small-work row says auto hands its work seat the same answer
-// the conversation hands it — computed when the catalog can, and never the
-// bare word.
-func TestAnInheritedAutoRowResolvesTheSameWay(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	dir := writeProfileRows(t, map[string]string{KeyTierLowModel: AutoValue})
-	for name, seat := range map[string]Seat{
-		"conversation": TierSeatAt(dir, ModelTierWorker),
-		"headless":     ResolveSeats(dir, "", "").Work,
-	} {
-		if seat.Model == AutoValue || seat.Model == "" {
-			t.Errorf("%s ladder: the seat reads %q, want what the row was reached through", name, seat.Model)
-		}
-	}
-}
-
-// THE FLAG AND THE VARIABLE STILL OUTRANK A ROW THAT SAYS AUTO, and a flag
-// whose text is the word is handed on whole — a person who named a model
-// called auto got a model called auto, exactly as they did before this rung
-// existed.
-func TestTheInvocationRungsStillOutrankAnAutoRow(t *testing.T) {
-	t.Setenv(ModelEnv, "vendor/from-the-environment")
-	t.Setenv(PlanModelEnv, "vendor/plans-from-the-environment")
-	dir := writeProfileRows(t, map[string]string{KeyTierWorkerModel: AutoValue})
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Model != "vendor/from-the-environment" || seats.Work.Source != SeatEnv {
-		t.Errorf("the environment rung read %q (%s)", seats.Work.Model, seats.Work.Rung())
-	}
-	if seats.Plan.Model != "vendor/plans-from-the-environment" || seats.Plan.Source != SeatEnv {
-		t.Errorf("the plan seat read %q (%s)", seats.Plan.Model, seats.Plan.Rung())
-	}
-	seats = ResolveSeats(dir, AutoValue, "")
-	if seats.Work.Model != AutoValue || seats.Work.Source != SeatFlag {
-		t.Errorf("a flag that says auto read %q (%s), want the word handed on whole", seats.Work.Model, seats.Work.Rung())
-	}
-}
-
-// THE PRESET AN AUTO SEAT RUNS AT IS READ FROM THE STORED ROWS, never through
-// seat resolution — the seam cannot ask the ladder that is asking it — and a
-// row that says auto matches whichever preset the other rows name.
-//
-// MAX DIFFERS FROM BALANCED ONLY IN THE WORKER SEAT NOW, so an auto row on the
-// worker can no longer tell the two apart — balanced, the default preset, wins
-// that tie — and the identifying shape is the other way round: the worker
-// pinned to max's own id, which only max names, with the auto row on a seat
-// above it.
-func TestThePresetAnAutoSeatRunsAtIsReadFromTheStoredRows(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	models, _ := CrewModelsForSource(DefaultCrewSource, CrewMax)
-	rows := map[string]string{KeyTierMastermindModel: AutoValue}
-	for _, tier := range ModelTiers {
-		if tier != ModelTierMastermind {
-			rows[tierKeyFor(tier)] = models[tier]
-		}
-	}
-	dir := writeProfileRows(t, rows)
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	seat := TierSeatAt(dir, ModelTierMastermind)
-	AutoModels = restore
-	if seat.Crew != CrewMax {
-		t.Errorf("max's rows and an auto row read as %q", seat.Crew)
-	}
-	if seat.Rung() != "crew "+CrewMax+", computed from the catalog" {
-		t.Errorf("the rung reads %q, want crew max, computed from the catalog", seat.Rung())
-	}
-	// A profile with no auto row anywhere reads as it always read — the
-	// default rung, no crew word — which is the unchanged-behaviour law: the
-	// seam fires only on a row that says the word.
-	seat = TierSeatAt(t.TempDir(), ModelTierWorker)
-	if seat.Rung() != "default" || seat.Crew != "" {
-		t.Errorf("an untouched profile reads %q (%s), want the default rung as before", seat.Rung(), seat.Crew)
-	}
-}
-
-// THE DEFAULT PRESET WINS EVERY TIE. An auto row matches whichever preset is
-// being compared, so a profile whose OTHER rows match two presets at once has
-// no single answer from the rows alone — and the answer is the default preset,
-// balanced, the budget an undecided profile already runs at.
-//
-// The tie is built here rather than assumed: the worker holds auto and the
-// other four rows are taken from max, and the test first states that those
-// four are balanced's rows too, which is what makes this a tie at all. Should
-// the tables move so the two presets differ somewhere above the worker, that
-// first check fails and says so, rather than the test quietly pinning nothing.
-func TestTheDefaultPresetWinsWhenTheStoredRowsMatchTwoPresets(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	balanced, ok := CrewModelsForSource(DefaultCrewSource, CrewBalanced)
-	if !ok {
-		t.Fatalf("there is no %s preset in the %s family", CrewBalanced, DefaultCrewSource)
-	}
-	max, ok := CrewModelsForSource(DefaultCrewSource, CrewMax)
-	if !ok {
-		t.Fatalf("there is no %s preset in the %s family", CrewMax, DefaultCrewSource)
-	}
-	rows := map[string]string{KeyTierWorkerModel: AutoValue}
-	for _, tier := range ModelTiers {
-		if tier == ModelTierWorker {
-			continue
-		}
-		if balanced[tier] != max[tier] {
-			t.Fatalf("the %s seat differs between balanced (%s) and max (%s), so an auto worker is no longer a tie",
-				tier, balanced[tier], max[tier])
-		}
-		rows[tierKeyFor(tier)] = max[tier]
-	}
-	if balanced[ModelTierWorker] == max[ModelTierWorker] {
-		t.Fatalf("balanced and max name the same worker, so the two presets are not two")
-	}
-
-	dir := writeProfileRows(t, rows)
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	seat := TierSeatAt(dir, ModelTierWorker)
-	AutoModels = restore
-
-	if seat.Crew != CrewBalanced {
-		t.Errorf("rows matching both presets read as %q, want %s, the default preset", seat.Crew, CrewBalanced)
-	}
-	if seat.Rung() != "crew "+CrewBalanced+", computed from the catalog" {
-		t.Errorf("the rung reads %q, want crew %s, computed from the catalog", seat.Rung(), CrewBalanced)
-	}
-	// And the same tie on the table rung, with nothing to compute from: the
-	// default preset decides the fallback id too, not just the budget word.
-	dir = writeProfileRows(t, rows)
-	seat = TierSeatAt(dir, ModelTierWorker)
-	if seat.Crew != CrewBalanced || seat.Source != SeatTable {
-		t.Errorf("with no catalog the tie reads %q (%s), want balanced on the table rung", seat.Crew, seat.Rung())
-	}
-	if seat.Model != balanced[ModelTierWorker] {
-		t.Errorf("the tie's table id is %q, want balanced's own worker %q", seat.Model, balanced[ModelTierWorker])
-	}
-}
-
-// A SETTINGS ROW SHOWS THE MODEL RUNNING, because it reads through the
-// resolver — and a profile that says auto nowhere is untouched by any of
-// this: the same rows, the same ids, the same rungs.
-func TestAutoNowhereChangesNothing(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	dir := t.TempDir()
-	if err := ApplyCrew(dir, CrewBalanced); err != nil {
-		t.Fatal(err)
-	}
-	before := map[string]string{}
-	for _, tier := range ModelTiers {
-		before[tier] = TierModelAt(dir, tier)
-	}
-	raw, err := os.ReadFile(BudgetConfigPath(dir))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var stored map[string]any
-	if err := json.Unmarshal(raw, &stored); err != nil {
-		t.Fatal(err)
-	}
-	if len(stored) == 0 {
-		t.Fatal("the write stored nothing")
-	}
-	for tier, want := range before {
-		if got := TierModelAt(dir, tier); got != want {
-			t.Errorf("%s read %q then %q — a read rewrote a row", tier, want, got)
-		}
-	}
-	if got := CrewAt(dir); got != CrewBalanced {
-		t.Errorf("the crew word reads %q, want balanced", got)
-	}
-}
-
-// THE SEAM'S TABLE RUNG IS THE PRESET'S OWN ID, not merely a non-empty
-// answer: with the catalog gone, an auto row under rows that pin max reads
-// to that preset's id for the tier, not to the default preset's. The worker
-// is the pinned seat — it is the one cell where max differs from balanced —
-// and the auto row rides the mastermind.
-func TestTheTableRungAnswersThePresetTheRowsName(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	models, _ := CrewModelsForSource(DefaultCrewSource, CrewMax)
-	rows := map[string]string{KeyTierMastermindModel: AutoValue}
-	for _, tier := range ModelTiers {
-		if tier != ModelTierMastermind {
-			rows[tierKeyFor(tier)] = models[tier]
-		}
-	}
-	dir := writeProfileRows(t, rows)
-	seat := TierSeatAt(dir, ModelTierMastermind)
-	if seat.Model != models[ModelTierMastermind] || seat.Source != SeatTable {
-		t.Errorf("with no catalog the seat reads %q (%s), want max's own mastermind id on the table rung",
-			seat.Model, seat.Rung())
-	}
-}
-
-// mustIndex parses a measurement document or fails the test.
-func mustIndex(t *testing.T, doc string) *index.Index {
-	t.Helper()
-	x, err := index.Parse([]byte(doc))
-	if err != nil {
-		t.Fatalf("parse index: %v", err)
-	}
-	return x
-}
-
-// priorDocument is the smallest index document that rates one catalog row on
-// the worker seat: a gaussian role_quality metric and a cell well above the
-// document's min_installs.
-const priorDocument = `{
-	"schema": 1,
-	"generated": "2026-09-17",
-	"min_installs": 5,
-	"metrics": {"role_quality": {"kind": "gaussian", "dims": ["role", "model"]}},
-	"cells": [
-		{"metric": "role_quality", "role": "worker", "model": "a/cheap", "mean": 95, "sd": 5, "n": 1000}
-	]
-}`
-
-// THE INDEX REACHES THE PICK THROUGH THE PRIOR. An index whose role_quality
-// metric rates one catalog row well above its published worker quality moves
-// AutoPick's worker answer to that row, and with no index the pick answers
-// exactly what the front answers, as before.
-func TestAutoPickReadsAMeasuredQualityPrior(t *testing.T) {
-	restore := AutoIndex
-	defer func() { AutoIndex = restore }()
-
-	rows := autoTestRows()
-
-	AutoIndex = nil
-	frugal, _, _ := crewpick.Presets(crewpick.Front(autoCandidates(rows), crewpick.DefaultShapes(), crewpick.All))
-	before, ok := AutoPick(ModelTierWorker, CrewSourceAll, CrewFrugal, rows)
-	if !ok || before != frugal.Worker {
-		t.Fatalf("with no index the worker pick reads %q, want the front's own %q", before, frugal.Worker)
-	}
-
-	AutoIndex = func() *index.Index { return mustIndex(t, priorDocument) }
-	after, ok := AutoPick(ModelTierWorker, CrewSourceAll, CrewFrugal, rows)
-	if !ok {
-		t.Fatal("the pick answers nothing with the index in hand")
-	}
-	if after == before {
-		t.Fatalf("the rated row left the worker pick at %q; the index never reached the quality", after)
-	}
-	if after != "a/cheap" {
-		t.Fatalf("the rated row did not take the worker seat: got %q", after)
-	}
-}
-
-// THE PRIOR IS THE ARGUMENT, AND NOTHING HIDES IT. AutoPickWith carries
-// whatever prior it is given: nil leaves the worker on the front's own
-// answer, and the same measured cell the AutoPick test reads moves it — which
-// is exactly the difference between the `catalog` and `learn` pick words
-// (crew.go's [CrewPickAt]).
-func TestAutoPickWithCarriesThePriorItIsGiven(t *testing.T) {
-	rows := autoTestRows()
-	front, _, _ := crewpick.Presets(crewpick.Front(autoCandidates(rows), crewpick.DefaultShapes(), crewpick.All))
-	bare, ok := AutoPickWith(ModelTierWorker, CrewSourceAll, CrewFrugal, rows, nil)
-	if !ok || bare != front.Worker {
-		t.Fatalf("with no prior the worker pick reads %q, want the front's own %q", bare, front.Worker)
-	}
-	measured, ok := AutoPickWith(ModelTierWorker, CrewSourceAll, CrewFrugal, rows, autoPrior(mustIndex(t, priorDocument)))
-	if !ok {
-		t.Fatal("the pick answers nothing with the prior in hand")
-	}
-	if measured == bare {
-		t.Fatalf("the measured cell left the worker pick at %q; the prior never reached the front", measured)
-	}
-	if measured != "a/cheap" {
-		t.Fatalf("the rated row did not take the worker seat: got %q", measured)
-	}
-}
-
-// ── the two seams ───────────────────────────────────────────────────────────
-
-// A BARE AUTO ROW AND THE PICK WORD'S OWN SEAT ANSWER ONE CATALOG THE SAME
-// WAY. Under `picked from = catalog` both read the catalog's published
-// figures alone — the Model Pool's measurements enter neither seat — and
-// under `learn` both carry them, on the learned rung. The fixture still
-// splits the two answers, asserted rather than assumed, so rows or a prior
-// that stop moving the worker pick fail here saying so instead of pinning
-// nothing.
-func TestABareAutoRowAnswersTheCatalogThePickWordNames(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	restoreModels, restoreIndex := AutoModels, AutoIndex
-	defer func() { AutoModels, AutoIndex = restoreModels, restoreIndex }()
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	AutoIndex = func() *index.Index { return mustIndex(t, priorDocument) }
-
-	published, ok := AutoPickWith(ModelTierWorker, DefaultCrewSource, DefaultCrew, autoTestRows(), nil)
-	if !ok || published == "a/cheap" {
-		t.Fatalf("the fixture does not split the two answers: the published pick reads %q (ok %t), so the assertions below cannot tell them apart", published, ok)
-	}
-
-	dir := writeProfileRows(t, map[string]string{
-		KeyTierWorkerModel: AutoValue,
-		KeyCrewPick:        CrewPickCatalog,
-	})
-	model, source, preset := autoRow(dir, DefaultCrewSource, ModelTierWorker)
-	want, _ := pickedModel(ModelTierWorker, DefaultCrewSource, preset, CrewPickCatalog)
-	if model != want {
-		t.Fatalf("under picked from = catalog the bare auto row answers %q and the pick word's own seat answers %q — the two seams disagreed about what the catalog means", model, want)
-	}
-	if source != SeatComputed {
-		t.Errorf("under picked from = catalog the bare row's rung reads %q, want computed", source)
-	}
-
-	dir = writeProfileRows(t, map[string]string{
-		KeyTierWorkerModel: AutoValue,
-		KeyCrewPick:        CrewPickLearn,
-	})
-	model, source, preset = autoRow(dir, DefaultCrewSource, ModelTierWorker)
-	want, _ = pickedModel(ModelTierWorker, DefaultCrewSource, preset, CrewPickLearn)
-	if model != want || model != "a/cheap" {
-		t.Errorf("under picked from = learn the bare auto row answers %q and the pick word's own seat answers %q, want the measured pick a/cheap", model, want)
-	}
-	if source != SeatLearned {
-		t.Errorf("under picked from = learn the bare row's rung reads %q, want learned", source)
-	}
-}
-
-// ── the install's own sheet ─────────────────────────────────────────────────
-
-// ownCells is the install's own evidence for the prior tests: one cell the
-// index document also carries, one it does not, both on the worker seat.
-func ownCells() []crewpick.Cell {
-	return []crewpick.Cell{
-		{Role: "worker", Model: "a/cheap", Mean: 90, N: 3},
-		{Role: "worker", Model: "b/only", Mean: 40, N: 1},
-	}
-}
-
-// With no index in hand the own sheet's cells are the whole prior — and a
-// one-observation cell of this install's own is worth having, where an
-// index's min_installs would have dropped it.
-func TestAutoPriorReadsTheOwnCellsAloneWithNoIndex(t *testing.T) {
-	restore := AutoOwnCells
-	defer func() { AutoOwnCells = restore }()
-	AutoOwnCells = ownCells
-
-	prior := autoPrior(nil)
-	if len(prior[crewpick.Worker]) != 2 {
-		t.Fatalf("the own cells made a prior of %d worker ratings, want two: %v", len(prior[crewpick.Worker]), prior)
-	}
-	if r := prior[crewpick.Worker]["b/only"]; r.Mean != 40 || r.N != 1 {
-		t.Fatalf("a one-observation own cell did not survive: %v", r)
-	}
-	if r := prior[crewpick.Worker]["a/cheap"]; r.Mean != 90 || r.N != 3 {
-		t.Fatalf("the shared cell came back %v, want mean 90 over 3", r)
-	}
-}
-
-// A model both the index and the own sheet rate folds by observation count:
-// the counts add, the mean is the mean of the means weighted by them, and the
-// cells either one holds alone are carried beside it.
-func TestAutoPriorFoldsTheOwnCellsIntoTheIndexByObservationCount(t *testing.T) {
-	restoreIndex, restoreOwn := AutoIndex, AutoOwnCells
-	defer func() { AutoIndex, AutoOwnCells = restoreIndex, restoreOwn }()
-	AutoIndex = func() *index.Index { return mustIndex(t, priorDocument) }
-	AutoOwnCells = ownCells
-
-	prior := autoPrior(AutoIndex())
-	shared := prior[crewpick.Worker]["a/cheap"]
-	wantMean := (1000*95.0 + 3*90.0) / 1003
-	if shared.N != 1003 {
-		t.Fatalf("the shared cell folded to N %d, want 1003", shared.N)
-	}
-	if math.Abs(shared.Mean-wantMean) > 1e-9 {
-		t.Fatalf("the shared cell folded to mean %v, want %v", shared.Mean, wantMean)
-	}
-	if r := prior[crewpick.Worker]["b/only"]; r.Mean != 40 || r.N != 1 {
-		t.Fatalf("the own-only cell did not survive the fold: %v", r)
-	}
-}
-
-// A nil seam changes nothing: the index's prior is exactly what it was, and
-// with no index there is no prior at all.
-func TestANilOwnCellsSeamLeavesThePriorAlone(t *testing.T) {
-	restoreIndex, restoreOwn := AutoIndex, AutoOwnCells
-	defer func() { AutoIndex, AutoOwnCells = restoreIndex, restoreOwn }()
-	AutoIndex = func() *index.Index { return mustIndex(t, priorDocument) }
-	AutoOwnCells = nil
-
-	prior := autoPrior(AutoIndex())
-	if len(prior[crewpick.Worker]) != 1 || prior[crewpick.Worker]["a/cheap"] != (crewpick.Rating{Mean: 95, N: 1000}) {
-		t.Fatalf("a nil seam changed the index prior: %v", prior)
-	}
-	if prior := autoPrior(nil); prior != nil {
-		t.Fatalf("a nil seam and no index made a prior: %v", prior)
-	}
-}
-
-// The own sheet's scores are on the 0-100 scale a judge answers on whatever
-// the index's metric says, so they are read even beside an index whose
-// role_quality is not gaussian — while the index's own cells are not.
-func TestAutoPriorReadsTheOwnCellsBesideANonGaussianIndex(t *testing.T) {
-	restoreIndex, restoreOwn := AutoIndex, AutoOwnCells
-	defer func() { AutoIndex, AutoOwnCells = restoreIndex, restoreOwn }()
-	AutoIndex = func() *index.Index {
-		return mustIndex(t, `{
-		"schema": 1,
-		"generated": "2026-09-17",
-		"min_installs": 1,
-		"metrics": {"role_quality": {"kind": "tally", "dims": ["role", "model"]}},
-		"cells": [{"metric": "role_quality", "role": "worker", "model": "a/cheap", "mean": 5, "n": 900}]
-	}`)
-	}
-	AutoOwnCells = ownCells
-
-	prior := autoPrior(AutoIndex())
-	if r, ok := prior[crewpick.Worker]["a/cheap"]; !ok || r.Mean != 90 || r.N != 3 {
-		t.Fatalf("the own cell was not read beside a non-gaussian index: %v ok %v", prior[crewpick.Worker]["a/cheap"], ok)
-	}
-	if _, ok := prior[crewpick.Worker]["b/only"]; !ok {
-		t.Fatalf("the second own cell did not survive: %v", prior)
-	}
-}
diff --git a/internal/config/budget.go b/internal/config/budget.go
index 5a2ac90638..d60e4bc4b4 100644
--- a/internal/config/budget.go
+++ b/internal/config/budget.go
@@ -117,6 +117,17 @@ func writeProfileValue(profileDir, key string, value any) error {
 // still exactly one place that knows how a setting reaches the disk.
 var profileWriteMu sync.Mutex
 
+// removeProfileKey, as a value in [writeProfileValues], takes the key OUT of
+// the file rather than writing it. It exists for the rows whose absence is an
+// answer of its own — an unpinned crew seat is a row that is not there, and
+// writing an empty string would be the different answer "cleared" — so the
+// same one transaction can remove one row while it writes another.
+var removeProfileKey = profileKeyRemoval{}
+
+// profileKeyRemoval is [removeProfileKey]'s type, unexported so no caller can
+// spell a removal any other way.
+type profileKeyRemoval struct{}
+
 func writeProfileValues(profileDir string, updates map[string]any) error {
 	if len(updates) == 0 {
 		return nil
@@ -126,7 +137,12 @@ func writeProfileValues(profileDir string, updates map[string]any) error {
 	// failure nobody could search for.
 	key := errorKey(updates)
 	encodedUpdates := make(map[string]json.RawMessage, len(updates))
+	var removed []string
 	for name, value := range updates {
+		if _, remove := value.(profileKeyRemoval); remove {
+			removed = append(removed, name)
+			continue
+		}
 		encodedValue, err := json.Marshal(value)
 		if err != nil {
 			return fmt.Errorf("write config %s: %w", name, err)
@@ -165,6 +181,9 @@ func writeProfileValues(profileDir string, updates map[string]any) error {
 	for name, encodedValue := range encodedUpdates {
 		values[name] = encodedValue
 	}
+	for _, name := range removed {
+		delete(values, name)
+	}
 	encoded, err := json.MarshalIndent(values, "", "  ")
 	if err != nil {
 		return fmt.Errorf("write config %s: %w", key, err)
diff --git a/internal/config/config.go b/internal/config/config.go
index 9ce82f04aa..68188c2d42 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -372,6 +372,17 @@ var nonSettingProfileFields = []string{
 	// [LaneBorrowAt] reads it. Left off this list, every launch after the row
 	// was saved told the person their profile carried an ignored key.
 	LaneBorrowKey(LaneSlotTalk),
+	// THE CREW'S STANDING ROWS. They are written by /crew's shortcuts and
+	// panel and read by the router (crew.go), and no settings-registry row owns
+	// them: the panel is where a rule, a cap and the providers turned off are
+	// read beside the day's spend.
+	KeyCrewAllowed,
+	KeyCrewCap,
+	KeyCrewTaskCap,
+	// And the free-routes switch beside them, which the crew's providers list
+	// turns on and off.
+	KeyCrewFreeRoutes,
+	KeyCrewProvidersOff,
 }
 
 // retiredProfileKeys are top-level config.json keys that a shipped version once
@@ -391,6 +402,12 @@ var retiredProfileKeys = map[string]bool{
 	"practice_demand_pct":  true, // reader removed by 84ba8503e
 	"propose_new_skills":   true, // reader removed by 84ba8503e
 	"attribution":          true, // reader removed on 2026-09-23: signing has no off
+	// The retired crew rows are read once more, by the migration that removes
+	// them and says so in its own line (crewmigrate.go's [MigrateCrew]); the
+	// unread check must not say it a second time in a worse sentence.
+	legacyKeyCrew:       true, // presets retired on 2026-09-24: seats are routed per task
+	legacyKeyCrewSource: true, // family row retired on 2026-09-24: `open` became the allowed rule
+	legacyKeyCrewPick:   true, // pick row retired on 2026-09-24
 }
 
 // retiredRowNotes are the retired keys a person set ON PURPOSE, each with the
diff --git a/internal/config/credits_law_test.go b/internal/config/credits_law_test.go
index 5cabb886bc..1dc15eb9ee 100644
--- a/internal/config/credits_law_test.go
+++ b/internal/config/credits_law_test.go
@@ -18,8 +18,8 @@ func TestEveryImplicitModelRungUsesTheBalanceCheck(t *testing.T) {
 		{"credits.go", "ChatDefaultAt", "useFreeDefaultsAt"},
 		{"freecrew.go", "freeTierModelAt", "useFreeDefaultsAt"},
 		{"config.go", "load", "ChatDefaultAt"},
-		{"seats.go", "tierSeatUnder", "freeTierModelAt"},
-		{"seats.go", "ResolveSeats", "ChatDefaultAt"},
+		{"seats.go", "TierSeatAt", "freeTierModelAt"},
+		{"crewhealth.go", "crewHealthAt", "useFreeDefaultsAt"},
 		{"../../internal/tui3/modelservices.go", "reachableModelAfterDisconnect", "ChatDefaultAt"},
 		{"../../cmd/codeaf/chatv3.go", "v3TalkModel", "ChatDefaultAt"},
 		{"../../cmd/codeaf/chatv3.go", "openV3Launch", "v3TalkModel"},
@@ -64,7 +64,6 @@ func TestNoUnlistedRuntimeReaderUsesThePaidDefault(t *testing.T) {
 		"cmd/codeaf/main.go:<package>":                   "prints the compile-time fallback in environment help",
 		"cmd/codeaf/competence.go:runCompetenceTo":       "the separate competence command has its own fallback",
 		"internal/config/credits.go:ChatDefaultAt":       "owns the paid side of the profile-aware bottom rung",
-		"internal/config/seats.go:resolveSeat":           "a deliberately cleared work row keeps its former fallback",
 		"internal/tui3/credits.go:refreshCreditWarnings": "recognises an untouched paid conversation before moving it",
 	}
 	seen := make(map[string]int)
diff --git a/internal/config/credits_test.go b/internal/config/credits_test.go
index 059a2f8da1..a6c49ee472 100644
--- a/internal/config/credits_test.go
+++ b/internal/config/credits_test.go
@@ -6,8 +6,11 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/Agent-Field/codeaf/internal/catalog"
 	"github.com/Agent-Field/codeaf/internal/credits"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/router"
 )
 
 func TestCreditsRecordChangesImplicitDefaultsWithoutSavingModels(t *testing.T) {
@@ -22,10 +25,10 @@ func TestCreditsRecordChangesImplicitDefaultsWithoutSavingModels(t *testing.T) {
 	if err := WriteCreditsReading(dir, "secret-key", credits.Reading{Known: true, Low: true}); err != nil {
 		t.Fatal(err)
 	}
-	if SettingsGeneration() <= before || !CreditsLowAt(dir) || ChatDefaultAt(dir) != FreeChatModel || CrewAt(dir) != CrewFree {
-		t.Fatalf("low record did not move chat and crew defaults: chat=%q crew=%q", ChatDefaultAt(dir), CrewAt(dir))
+	if SettingsGeneration() <= before || !CreditsLowAt(dir) || ChatDefaultAt(dir) != FreeChatModel || !crewHealthAt(dir).unaffordable[modelsource.DefaultID] {
+		t.Fatalf("low record did not move chat default and crew health: chat=%q", ChatDefaultAt(dir))
 	}
-	for tier, want := range freeCrewModels {
+	for tier, want := range freeHelperModels {
 		if got := TierModelAt(dir, tier); got != want {
 			t.Errorf("%s = %q, want %q", tier, got, want)
 		}
@@ -58,7 +61,7 @@ func TestCreditsRecordChangesImplicitDefaultsWithoutSavingModels(t *testing.T) {
 	if err := WriteCreditsReading(dir, "secret-key", credits.Reading{Known: true}); err != nil {
 		t.Fatal(err)
 	}
-	if CreditsLowAt(dir) || ChatDefaultAt(dir) != DefaultModel || CrewAt(dir) != DefaultCrew || CreditsNeedRead(dir, "secret-key") {
+	if CreditsLowAt(dir) || ChatDefaultAt(dir) != DefaultModel || crewHealthAt(dir).unaffordable[modelsource.DefaultID] || CreditsNeedRead(dir, "secret-key") {
 		t.Fatal("healthy re-read did not restore implicit defaults")
 	}
 }
@@ -75,7 +78,7 @@ func TestCannotPayKeepsTheWholeVendorSentence(t *testing.T) {
 	}
 }
 
-func TestFreeCrewIsAReadingAndExplicitRowsWin(t *testing.T) {
+func TestFreeHelpersAreAReadingAndExplicitRowsWin(t *testing.T) {
 	dir := t.TempDir()
 	if err := WriteAPIKey(dir, "key"); err != nil {
 		t.Fatal(err)
@@ -89,35 +92,30 @@ func TestFreeCrewIsAReadingAndExplicitRowsWin(t *testing.T) {
 	if ChatModelAt(dir) != "openai/gpt-4" {
 		t.Fatal("saved talk model changed")
 	}
-	if err := ApplyCrew(dir, CrewMax); err != nil {
-		t.Fatal(err)
-	}
-	if CrewAt(dir) != CrewMax {
-		t.Fatalf("explicit crew became %q", CrewAt(dir))
-	}
-	if TierModelAt(dir, ModelTierWorker) == FreeChatModel {
-		t.Fatal("a written seat was replaced")
-	}
-	if strings.Split(freeCrewModels[ModelTierHigh], "/")[0] == strings.Split(freeCrewModels[ModelTierWorker], "/")[0] {
-		t.Fatal("careful and worker share a vendor")
-	}
-	for _, model := range freeCrewModels {
+	for _, model := range freeHelperModels {
 		if !strings.HasSuffix(model, ":free") {
 			t.Fatalf("%q is not free", model)
 		}
 	}
+	if strings.Split(freeHelperModels[ModelTierReflex], "/")[0] == strings.Split(freeHelperModels[ModelTierLow], "/")[0] {
+		t.Fatal("reflex and small work share a vendor")
+	}
 }
 
-func TestLowBalanceDoesNotReplaceClearedStoredOrComputedSeats(t *testing.T) {
+// A ROW SOMEBODY WROTE IS NEVER REPLACED by the low reading: a crew pin stays
+// the pin, a written helper row stays theirs, a cleared helper row stays
+// empty, and no crew seat is handed a model this build chose.
+func TestLowBalanceDoesNotReplaceWrittenOrClearedRows(t *testing.T) {
 	for _, tc := range []struct {
-		name  string
-		write func(string) error
-		tier  string
-		want  string
+		name string
+		key  string
+		raw  string
+		tier string
+		want string
 	}{
-		{"cleared work row", func(dir string) error { return writeProfileValue(dir, KeyTierWorkerModel, "") }, ModelTierWorker, ""},
-		{"stored crew word", func(dir string) error { return writeProfileValue(dir, KeyCrew, CrewMax) }, ModelTierWorker, crewAllModels[CrewMax][ModelTierWorker]},
-		{"catalog pick", func(dir string) error { return SetCrewPick(dir, CrewPickCatalog) }, ModelTierReflex, DefaultReflexModel},
+		{"pinned worker", KeyTierWorkerModel, "openai/gpt-4", ModelTierWorker, "openai/gpt-4"},
+		{"written reflex row", KeyTierReflexModel, "vendor/reflex", ModelTierReflex, "vendor/reflex"},
+		{"cleared small-work row", KeyTierLowModel, "", ModelTierLow, ""},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			dir := t.TempDir()
@@ -127,14 +125,11 @@ func TestLowBalanceDoesNotReplaceClearedStoredOrComputedSeats(t *testing.T) {
 			if err := WriteCreditsReading(dir, "key", credits.Reading{Known: true, Low: true}); err != nil {
 				t.Fatal(err)
 			}
-			if err := tc.write(dir); err != nil {
+			if err := writeProfileValue(dir, tc.key, tc.raw); err != nil {
 				t.Fatal(err)
 			}
 			if got := TierModelAt(dir, tc.tier); got != tc.want {
-				t.Fatalf("explicit seat became %q, want %q", got, tc.want)
-			}
-			if tc.name == "cleared work row" && ResolveSeats(dir, "", "").Work.Model != DefaultModel {
-				t.Fatal("cleared headless work row became the free implicit default")
+				t.Fatalf("explicit row became %q, want %q", got, tc.want)
 			}
 		})
 	}
@@ -154,7 +149,7 @@ func TestLowCreditsBelongOnlyToTheCurrentKey(t *testing.T) {
 	if err := WriteAPIKey(dir, "key-B"); err != nil {
 		t.Fatal(err)
 	}
-	if CreditsLowAt(dir) || ChatDefaultAt(dir) != DefaultModel || CrewAt(dir) != DefaultCrew {
+	if CreditsLowAt(dir) || ChatDefaultAt(dir) != DefaultModel || crewHealthAt(dir).unaffordable[modelsource.DefaultID] {
 		t.Fatal("key A's low record changed key B's defaults before B was read")
 	}
 	if !CreditsNeedRead(dir, APIKeyAt(dir)) {
@@ -180,3 +175,41 @@ func TestFreeModelNeedsASuffixOrAKnownZeroTariff(t *testing.T) {
 		}
 	}
 }
+
+// A BALANCE READ AS LOW PUTS THE CREW ON FREE ROUTES before any call: the
+// three seats are routed to free pools, the decision says so once, and no
+// paid OpenRouter route is tried first. A healthy reading routes as usual.
+func TestALowBalanceRoutesTheCrewToFreePools(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows, catalog.Model{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true, IntelligenceIndex: 41.8, CodingIndex: 71.5,
+		AgenticIndex: 50.9, ArenaElo: 1348, ContextLength: 1310720, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	if err := WriteCreditsReading(dir, APIKeyAt(dir), credits.Reading{Known: true, Low: true}); err != nil {
+		t.Fatal(err)
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, seat := range crewroute.Seats {
+		if pick := d.Seat(seat); !crewroute.IsFree(pick.Send) {
+			t.Errorf("%s on a low balance sends %q, want a free pool", seat, pick.Send)
+		}
+	}
+	if strings.Count(d.Note, "free routes in use (may log prompts)") != 1 {
+		t.Errorf("the decision note is %q, want the free-routes notice once", d.Note)
+	}
+	if err := WriteCreditsReading(dir, APIKeyAt(dir), credits.Reading{Known: true}); err != nil {
+		t.Fatal(err)
+	}
+	d, err = RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if crewroute.IsFree(d.Seat(crewroute.Worker).Send) || strings.Contains(d.Note, "free routes") {
+		t.Errorf("a healthy balance still routed free: %s · %q", d.Seat(crewroute.Worker).Send, d.Note)
+	}
+}
diff --git a/internal/config/crew.go b/internal/config/crew.go
index 03b3f655d4..5acf6a1d17 100644
--- a/internal/config/crew.go
+++ b/internal/config/crew.go
@@ -1,729 +1,1358 @@
 package config
 
 import (
+	"encoding/json"
+	"errors"
 	"fmt"
 	"strings"
+	"time"
 
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
 	"github.com/Agent-Field/codeaf/internal/roles"
+	"github.com/Agent-Field/codeaf/internal/router"
 )
 
-// THE CREW: five classes of model, answered as one word.
+// THE CREW: THREE SEATS, EACH PINNED OR PICKED FOR THE TASK IN FRONT OF IT.
 //
-// The five tier rows are the honest shape of the decision — a class of call has
-// a class of model, and a new call joins a class instead of growing a knob — and
-// they are still five model ids somebody has to know. Nobody arrives at a
-// settings sheet wanting to name five model ids. They arrive wanting to spend
-// pennies, or wanting to spend what it takes. So there is one row above the five
-// that takes that sentence and writes all of them.
+// A task is done by a crew of three — the worker that does it, the planner
+// that cuts and steers it, the checker that reads the result against what was
+// asked — and which model sits each seat is decided PER TASK by the router
+// (internal/crewroute), from the kind of work the task is. Nothing about that
+// decision is stored. What IS stored, and is the whole of what a person
+// configures, is what the router may pick from:
 //
-// THREE PRESETS AND NO MORE. A fourth would be a fourth thing to explain, and
-// the axis they move along has exactly three interesting points: everything
-// cheap, one model thinking over cheap ones working, everything capable and
-// asked to think.
+//   - a PIN per seat, `model` or `model@provider`, which that seat always runs
+//     and the router never overrides;
+//   - the ALLOWED MODELS, one rule ([crewroute.ParseAllowed]) — `all` unless
+//     somebody narrowed it;
+//   - an optional DAILY CAP on what crews spend, which the router paces toward;
+//   - the PROVIDERS TURNED OFF, a set of connections the crew may not route
+//     through — empty unless somebody switched one off.
 //
-// TWO FAMILIES BEHIND THE SAME THREE WORDS. Every preset exists twice: once in
-// the all family, the same three words resolved over the whole catalog with
-// closed and frontier models in it; and once in the open family, every seat an
-// open-weight model, for the person who wants the three words to stay on that
-// shelf whatever the catalog does around it. Which family the words draw from
-// is one row, [KeyCrewSource], and all is what it reads when nobody has
-// answered it. Both the derived reading and the write resolve through the row
-// ([CrewSourceAt]), so the word on the sheet can never mean one family while
-// the five values it summarizes were drawn from the other.
+// The providers a crew can use are the connections the person made, read off
+// the profile the way every call reads them; what persists is only which of
+// them the crew leaves alone, so a connection made tomorrow is on the day it
+// is made. That is the one-sentence model the whole feature is built on — the
+// /crew panel says what is allowed and it persists; the words in an ask say
+// how hard to try that one task; nothing else sticks.
 //
-// THE PRESET IS DERIVED AND NEVER STORED. [CrewAt] reads the five live tier
-// values and answers which preset they are, or "custom". A stored word would be
-// a claim about five other rows that any one of them could falsify, and a sheet
-// that said "balanced" over a hand-pinned mastermind would be lying in exactly
-// the place somebody went to check. This is the one-source-of-truth law applied
-// to a summary: a summary that can drift from what it summarizes is not a
-// summary.
-//
-// THE BUILD WRITES NO WORD, AND READS ONE THAT IS THERE ([storedCrewWord]). Every
-// profile this product shapes derives the preset from the rows; a run that wrote
-// the word itself — a harness, a hand edit — named a budget, and a word on disk
-// that nothing read is a crew word that reached nobody. The word is the budget
-// when present, and the class rows under it are then that run's own pins.
-
-// The preset words. They are the values [KeyCrew] takes, and they are strings
-// on disk in the same sense every other choice row's words are — spelled here
-// once, read by the row, the command and the manual.
+// THE PINS LIVE IN THE TIER ROWS THE CREW HAS ALWAYS LIVED IN. The worker
+// seat is the `worker` tier row, the planner is the `mastermind` row, the
+// checker is the `high` row — the rows the role ladder already reads, so the
+// auxiliary calls that ride those tiers (the brief a task is shaped into, an
+// image read for a model that cannot see one, the plan of an adaptive run)
+// follow a pin without a second place to write it. An unwritten row is `auto`:
+// the seat is routed. The reflex and small-work rows are not crew seats and
+// keep their shipped defaults.
+
+// Crew rows, spelled once.
 const (
-	CrewFrugal   = "frugal"
-	CrewBalanced = "balanced"
-	CrewMax      = "max"
-	// CrewCustom is a READING and never a write. It is what the row says when
-	// the five tier values are somebody's own arrangement rather than one of the
-	// three, which is what happens the moment a person answers one tier row
-	// directly. It is deliberately absent from [CrewPresets]: "set the crew to
-	// custom" is not a sentence with a meaning — custom is what you get, not
-	// what you ask for.
-	CrewCustom = "custom"
+	// KeyCrewAllowed is the allowed-models rule. PROFILE-ONLY for the worker
+	// row's own reason: a repository that could widen it could send a
+	// visitor's work, and their credit, to a model nobody on that machine chose.
+	KeyCrewAllowed = "models.crew.allowed"
+	// KeyCrewCap is the daily cap on what crews spend, in dollars; absent or
+	// zero is no cap.
+	KeyCrewCap = "models.crew.cap"
+	// KeyCrewTaskCap is the most one task may spend, in dollars; absent or
+	// zero is [CrewTaskCapDefault].
+	KeyCrewTaskCap = "models.crew.task_cap"
+	// KeyCrewFreeRoutes is whether the crew may use providers' free pools
+	// (a `:free` route of a model). PROFILE-ONLY and OFF unless somebody
+	// turned it on: a free pool may log or train on what it is sent, which is
+	// a choice about a person's code, not a price.
+	KeyCrewFreeRoutes = "models.crew.free_routes"
+	// KeyCrewProvidersOff is the connected providers a person turned off for
+	// the crew, a list of provider ids; absent is every provider on. It is a
+	// row of its own beside the allowed rule and never a `-x` inside it
+	// (crewroute's providers.go says why), and PROFILE-ONLY for the allowed
+	// rule's reason.
+	KeyCrewProvidersOff = "models.crew.providers.off"
 )
 
-// CrewPresets lists the words a person may WRITE, cheapest first. [CrewCustom]
-// is not among them; see its own comment.
-var CrewPresets = []string{CrewFrugal, CrewBalanced, CrewMax}
+// CrewAuto is the word a seat reads when it is not pinned.
+const CrewAuto = "auto"
 
-// DefaultCrew is what a profile nobody has touched reads. It is balanced because
-// the five shipped tier defaults ARE the balanced row of the DEFAULT FAMILY —
-// see [crewAllModels] — and that identity is asserted by a test rather than
-// trusted.
-const DefaultCrew = CrewBalanced
+// CrewCommand is the one door a person reaches the crew through, spelled once
+// so a sentence naming it cannot drift from the command that answers.
+const CrewCommand = "/crew"
 
-// The two families the preset words can draw from. They are the values
-// [KeyCrewSource] takes, spelled here once and read by the row, the resolver
-// and the manual.
-const (
-	// CrewSourceOpen is the open-weight family.
-	CrewSourceOpen = "open"
-	// CrewSourceAll is the whole catalog, closed and frontier models included,
-	// and the family a profile that has answered nothing resolves.
-	CrewSourceAll = "all"
-)
+// CrewSeatTier is the tier row a seat's pin is written in.
+func CrewSeatTier(seat crewroute.Seat) string {
+	switch seat {
+	case crewroute.Planner:
+		return ModelTierMastermind
+	case crewroute.Checker:
+		return ModelTierHigh
+	}
+	return ModelTierWorker
+}
 
-// CrewSources lists them, open first, which is the order the row widens in: the
-// narrower shelf, then the whole catalog. The default is the second of them,
-// [DefaultCrewSource], because this list is about width and not about which one
-// a profile starts on.
-var CrewSources = []string{CrewSourceOpen, CrewSourceAll}
+// CrewSeatKey is the registry row a seat's pin is written in — the settings
+// sheet's one way of telling a seat's row from the other tier rows.
+func CrewSeatKey(seat crewroute.Seat) string { return tierKeyFor(CrewSeatTier(seat)) }
 
-// DefaultCrewSource is all: the three words are read off the whole catalog
-// unless the row says otherwise, and the five shipped tier defaults are that
-// family's balanced row.
-const DefaultCrewSource = CrewSourceAll
+// CrewTierSeat is the seat a tier row pins, false for a tier that is not a
+// crew seat (reflex, small work).
+func CrewTierSeat(tier string) (crewroute.Seat, bool) {
+	switch tier {
+	case ModelTierWorker:
+		return crewroute.Worker, true
+	case ModelTierMastermind:
+		return crewroute.Planner, true
+	case ModelTierHigh:
+		return crewroute.Checker, true
+	}
+	return "", false
+}
 
-// ── where the seats are picked from ────────────────────────────────────────
+// ParseCrewSeat reads a person's word for a seat. Only the three seat names
+// are accepted: the tier words behind them are machinery.
+func ParseCrewSeat(word string) (crewroute.Seat, bool) {
+	switch strings.ToLower(strings.TrimSpace(word)) {
+	case "worker":
+		return crewroute.Worker, true
+	case "planner":
+		return crewroute.Planner, true
+	case "checker":
+		return crewroute.Checker, true
+	}
+	return "", false
+}
 
-// THE THIRD ROW THE CREW WORDS ARE ANSWERED THROUGH. The crew row says how
-// much to spend and the family row says which shelf those budgets name; the
-// pick row says where the models for that money come from when a tier row
-// does not hold a model id of its own:
-//
-//   - `table` — the rows this build measured and shipped ([crewModels] and
-//     [crewAllModels]), which is what an unwritten seat has always read;
-//   - `catalog` — the same three budgets recomputed off the catalog's own
-//     published prices and scores, on every read, with no measurement of
-//     anybody's own runs in it ([AutoPickWith] with no prior);
-//   - `learn` — the catalog computation plus the Model Pool's measurements
-//     and the person's own judged runs, carried as a quality prior
-//     ([autoPrior]).
-//
-// THE DEFAULT IS THE TABLE because the table is what a profile has always
-// read: an unwritten seat names the preset's own row, and nothing about a
-// profile that has answered nothing moves until somebody answers a row. The
-// other two words are an opt-in to a read that keeps moving — a seat that
-// follows the catalog follows it whether or not the shipped rows do — and a
-// person has to say so.
-//
-// A PICK NEVER OVERRIDES A MODEL ID. The row answers for the seats a person
-// did not name, and the seats they did — written by hand, or by a preset —
-// keep their ids until the crew is picked again, except that a row holding
-// the preset's own table value is the preset answering, not a person pinning
-// one model by id. The rule is [pickedSeat]'s to apply and the manual's to
-// state.
-const (
-	// CrewPickTable is the measured rows this build ships, and the default.
-	CrewPickTable = "table"
-	// CrewPickCatalog is the catalog's own published figures, with nothing
-	// measured on top.
-	CrewPickCatalog = "catalog"
-	// CrewPickLearn is the catalog computation plus the Model Pool's
-	// measurements and the person's own judged runs.
-	CrewPickLearn = "learn"
-)
+// ── pins ────────────────────────────────────────────────────────────────────
 
-// CrewPicks lists the words a person may WRITE, narrowest first: the shipped
-// table, then the catalog on its own, then the catalog with what runs
-// measured. A pick word is not a preset and names no budget — the crew row
-// above it still does that.
-var CrewPicks = []string{CrewPickTable, CrewPickCatalog, CrewPickLearn}
+// CrewPin is one pinned seat: a model id, and the provider route it was
+// pinned to when somebody wrote `model@provider`.
+type CrewPin struct {
+	Model    string
+	Provider string
+}
 
-// DefaultCrewPick is the table: the rows this build measured are where an
-// unwritten seat's model comes from until somebody answers the row.
-const DefaultCrewPick = CrewPickTable
+// String is the pin the way it is written and stored: `model[@provider]`.
+func (p CrewPin) String() string {
+	if p.Provider == "" {
+		return p.Model
+	}
+	return p.Model + "@" + p.Provider
+}
 
-// knownCrewPick folds a word and says whether it is one of the picks this
-// build knows. It is the ONE place the fold is spelled: [SetCrewPick] and the
-// ladder's [pickedSeat] both go through it, so a pick added to [CrewPicks] is
-// accepted everywhere at once. A reader folds a word it does not know to the
-// default pick; a writer refuses it.
-func knownCrewPick(pick string) (string, bool) {
-	pick = strings.ToLower(strings.TrimSpace(pick))
-	for _, known := range CrewPicks {
-		if pick == known {
-			return known, true
+// ParseCrewPin reads a written pin. Blank and `auto` are not pins — auto is
+// true — and a pin whose model carries a thinking level (`vendor/model:high`)
+// is checked by the gate every tier row shares ([ValidateTierValue]).
+func ParseCrewPin(raw string) (pin CrewPin, auto bool, err error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" || strings.EqualFold(raw, CrewAuto) {
+		return CrewPin{}, true, nil
+	}
+	model, provider := raw, ""
+	if at := strings.LastIndex(raw, "@"); at > 0 {
+		model, provider = strings.TrimSpace(raw[:at]), strings.ToLower(strings.TrimSpace(raw[at+1:]))
+		if provider == "" {
+			return CrewPin{}, false, fmt.Errorf("%q: name the provider after @, or leave the @ off", raw)
 		}
 	}
-	return "", false
+	// A FREE POOL IS A ROUTE, NOT A THINKING LEVEL: `…:free` names the model's
+	// free route, and only what is left of the id is a tier value.
+	if err := ValidateTierValue(strings.TrimSuffix(model, ":free")); err != nil {
+		return CrewPin{}, false, err
+	}
+	return CrewPin{Model: model, Provider: provider}, false, nil
 }
 
-// normalCrewPick folds a pick word to one of the three this build knows,
-// reading a word it does not know as the default pick.
-func normalCrewPick(pick string) string {
-	if known, ok := knownCrewPick(pick); ok {
-		return known
+// CrewPinAt is one seat's pin, false when the seat is auto.
+//
+// A row that says `auto`, a row that is empty and a retired preset word are
+// all auto; any model id is a pin. A row that does not parse is auto too, and the
+// panel says so, because a seat that silently ran a half-read id would be the
+// one thing worse than a seat that ignores it.
+func CrewPinAt(profileDir string, seat crewroute.Seat) (CrewPin, bool) {
+	value, held := persistedString(profileDir, tierKeyFor(CrewSeatTier(seat)))
+	if !held {
+		return CrewPin{}, false
 	}
-	return DefaultCrewPick
+	pin, auto, err := ParseCrewPin(value)
+	if auto || err != nil {
+		return CrewPin{}, false
+	}
+	return pin, true
 }
 
-// CrewPickAt is where the seats are picked from on this profile,
-// [DefaultCrewPick] when the row is absent. A word this build does not know
-// reads as the default pick, silently, the way a retired choice reads
-// everywhere else on this sheet.
-func CrewPickAt(profileDir string) string {
-	if value, ok := persistedString(profileDir, KeyCrewPick); ok {
-		return normalCrewPick(value)
+// crewSeatRow is a seat's settings row: the pin as written, or empty — which
+// the row draws as `auto`.
+func crewSeatRow(profileDir string, seat crewroute.Seat) string {
+	if pin, ok := CrewPinAt(profileDir, seat); ok {
+		return pin.String()
 	}
-	return DefaultCrewPick
+	return ""
 }
 
-// AnyTierAutoAt answers whether any of the five tier rows reads `auto` on this
-// profile — written directly, or reaching the word through an older row
-// ([crewRow]) — which is the second way a seat resolution is computed from the
-// catalog's rows, beside the pick row ([CrewPickAt]). A door that resolves
-// seats asks both before it resolves, because both answers are computed from
-// the rows the process already holds, and a door that asks before they land
-// reads the family's table row over a profile that never chose it.
-func AnyTierAutoAt(profileDir string) bool {
-	for _, tier := range ModelTiers {
-		if model, _, _, _ := crewRow(profileDir, tier); IsAuto(model) {
-			return true
+// CrewPinsAt is every pinned seat.
+func CrewPinsAt(profileDir string) map[crewroute.Seat]CrewPin {
+	pins := map[crewroute.Seat]CrewPin{}
+	for _, seat := range crewroute.Seats {
+		if pin, ok := CrewPinAt(profileDir, seat); ok {
+			pins[seat] = pin
 		}
 	}
-	return false
+	return pins
 }
 
-// SetCrewPick writes the pick row ALONE, in one file write. The word is
-// refused the way every choice row refuses one, so a typo cannot land a pick
-// nothing reads. It writes no tier row: the pick says where seats are read
-// from, and the seats keep the ids on disk until the crew is picked again.
-func SetCrewPick(profileDir, pick string) error {
-	known, ok := knownCrewPick(pick)
-	if !ok {
-		return fmt.Errorf("pick one of: %s", strings.Join(CrewPicks, ", "))
+// SetCrewPin pins one seat, IN ONE FILE WRITE. `auto` or blank unpins it.
+//
+// A PIN OUTSIDE THE ALLOWED MODELS IS REFUSED WITH THE REASON, never written
+// and quietly ignored: the rule is the person's own and a pin that broke it
+// would be the one decision on the panel that contradicted another. A pin
+// naming a provider must name one that is connected, for the same reason.
+func SetCrewPin(profileDir string, seat crewroute.Seat, raw string) error {
+	pin, auto, err := ParseCrewPin(raw)
+	if err != nil {
+		return err
+	}
+	if auto {
+		return ClearCrewPin(profileDir, seat)
+	}
+	if err := CrewPinAllowed(profileDir, pin); err != nil {
+		return err
+	}
+	values := map[string]any{tierKeyFor(CrewSeatTier(seat)): pin.String()}
+	// A profile carrying retired rows is migrated in the same write.
+	for key, value := range legacyCrewClearing(profileDir) {
+		if _, set := values[key]; !set {
+			values[key] = value
+		}
 	}
-	return writeProfileValue(profileDir, KeyCrewPick, known)
+	return writeProfileValues(profileDir, values)
 }
 
-// crewModels is the open-weight table: one row per preset, one model per class.
-//
-// THE WORKER COLUMN IS THE DIAL. It holds glm-5.3-flash through balanced, and
-// max is the preset that takes it to glm-5.3, because it is the seat that pays
-// most of a task's bill, and a preset that moved every other seat while leaving
-// it alone would change everything about a task except its cost. The careful
-// column always sees images (the vision role rides it) and is a second vendor
-// from balanced upward; frugal keeps worker and careful on the same
-// glm-5.3-flash, because at that bill the open-weight front has no second
-// vendor to take the careful seat. The reflex and low columns never vary: they
-// are the same near-free models in all three presets, and a column that never
-// varies is not a dial.
-//
-// HOW THE IDS WERE READ OFF, on 2026-09-16 and seat by seat. Every open-weight
-// row of the catalog was placed on two axes: the expected bill that seat's own
-// call shape runs up, built from the catalog's published prompt, completion and
-// cache-read prices, against that seat's quality, taken from its published
-// intelligence, coding and agentic indexes. THE CALL SHAPE IS PART OF THE
-// PRICE. The worker and the careful seats were costed as LONG CACHED LOOPS — a
-// large prompt read back turn after turn, so the cache-read price carries most
-// of the weight — and the mastermind as ONE-SHOT CALLS, where the prompt is
-// paid in full each time and there are few of them. Each preset then takes, for
-// each seat, a point on the pareto front of that plot at the bill it is willing
-// to run: nothing on the front costs less at the same quality, and nothing at
-// the same bill scores higher.
-//
-// That is why the columns do not climb together. Under one-shot pricing
-// glm-5.3-flash is on the front at frugal's bill and glm-5.3 is the next point
-// above it, so the mastermind column reads flash, glm-5.3, glm-5.3; under
-// long-loop pricing the same plot puts kimi-k3 on the careful seat from
-// balanced upward, which is also the second vendor that seat has to be.
-//
-// No closed model is here: the open family is the shelf that stands on the
-// open-weight rows alone, and the `all` family is where a closed model goes.
-var crewModels = map[string]map[string]string{
-	CrewFrugal: {
-		ModelTierReflex:     "mistralai/mistral-nemo",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3-flash",
-		ModelTierHigh:       "z-ai/glm-5.3-flash",
-		ModelTierMastermind: "z-ai/glm-5.3-flash",
-	},
-	CrewBalanced: {
-		ModelTierReflex:     "mistralai/mistral-nemo",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3-flash",
-		ModelTierHigh:       "moonshotai/kimi-k3",
-		ModelTierMastermind: "z-ai/glm-5.3",
-	},
-	CrewMax: {
-		ModelTierReflex:     "mistralai/mistral-nemo",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3",
-		ModelTierHigh:       "moonshotai/kimi-k3",
-		ModelTierMastermind: "z-ai/glm-5.3",
-	},
-}
-
-// crewAllModels is the same three presets answered from the whole catalog
-// rather than its open-weight shelf, which is what the `all` family of
-// [KeyCrewSource] draws from AND WHAT A PROFILE THAT HAS ANSWERED NOTHING
-// RESOLVES ([DefaultCrewSource]). The careful column is a DIFFERENT VENDOR
-// from the worker in every preset here — the open family's frugal row is the
-// one standing exception — and the reflex and low columns still never vary.
-// Closed models live here and only here.
-//
-// The ids come off the same plot [crewModels] describes, run on 2026-09-16 over
-// every row of the catalog rather than the open-weight ones: expected task bill
-// against seat quality, the bill built from the published prompt, completion
-// and cache-read prices under each seat's own call shape — the worker and the
-// careful seats as long cached loops, the mastermind as one-shot calls — and
-// the quality from the published intelligence, coding and agentic indexes.
-//
-// THE WORKER STAYS ON glm-5.3-flash THROUGH BALANCED, and that is the whole
-// shape of this table. The worker seat carries most of a task's tokens, so a
-// step there multiplies through the entire bill while a step on the careful or
-// the mastermind seat is paid a handful of times. The money therefore goes to
-// the two low-volume seats first: frugal to balanced moves the careful seat to
-// claude-fable-5.1 and the mastermind to claude-opus-5, and max moves the
-// worker itself, with the careful seat staying on fable beside it.
-var crewAllModels = map[string]map[string]string{
-	CrewFrugal: {
-		ModelTierReflex:     "google/gemini-2.5-flash",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3-flash",
-		ModelTierHigh:       "qwen/qwen3.8-max-0902",
-		ModelTierMastermind: "z-ai/glm-5.3-flash",
-	},
-	CrewBalanced: {
-		ModelTierReflex:     "google/gemini-2.5-flash",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3-flash",
-		ModelTierHigh:       "anthropic/claude-fable-5.1",
-		ModelTierMastermind: "anthropic/claude-opus-5",
-	},
-	CrewMax: {
-		ModelTierReflex:     "google/gemini-2.5-flash",
-		ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-		ModelTierWorker:     "z-ai/glm-5.3",
-		ModelTierHigh:       "anthropic/claude-fable-5.1",
-		ModelTierMastermind: "anthropic/claude-opus-5",
-	},
-}
-
-// crewTableFor is the family one source word names. It is total: `open` names
-// the open-weight family, and every other reading (blank, misspelt, a word a
-// later build retired) names the catalog-wide one, because an unreadable answer
-// resolves the same family an absent answer does ([DefaultCrewSource]).
-func crewTableFor(source string) map[string]map[string]string {
-	if normalCrewSource(source) == CrewSourceOpen {
-		return crewModels
-	}
-	return crewAllModels
-}
-
-// knownCrewSource folds a word and says whether it is one of the families this
-// build knows. It is the ONE place the fold is spelled: [normalCrewSource],
-// [ApplyCrewUnder] and [SetCrewSource] all go through it, so a family added to
-// [CrewSources] is accepted everywhere at once. A reader folds a word it does
-// not know to the default family; a writer refuses it.
-func knownCrewSource(source string) (string, bool) {
-	source = strings.ToLower(strings.TrimSpace(source))
-	for _, known := range CrewSources {
-		if source == known {
-			return known, true
+// ClearCrewPin unpins one seat: the row is removed, and the seat is routed.
+func ClearCrewPin(profileDir string, seat crewroute.Seat) error {
+	values := legacyCrewClearing(profileDir)
+	values[tierKeyFor(CrewSeatTier(seat))] = removeProfileKey
+	return writeProfileValues(profileDir, values)
+}
+
+// ClearCrewPins unpins every seat in one write.
+func ClearCrewPins(profileDir string) error {
+	values := legacyCrewClearing(profileDir)
+	for _, seat := range crewroute.Seats {
+		values[tierKeyFor(CrewSeatTier(seat))] = removeProfileKey
+	}
+	return writeProfileValues(profileDir, values)
+}
+
+// CrewPinAllowed says why a pin may not be written, or nil. The model must be
+// one the allowed rule admits — by its figures when the catalog knows it, by
+// name otherwise — and a pinned provider must be connected and must reach it.
+func CrewPinAllowed(profileDir string, pin CrewPin) error {
+	rule := CrewAllowedAt(profileDir)
+	model, known := crewCatalogModel(pin.Model)
+	switch {
+	case known && !rule.AdmitsModel(model):
+		return fmt.Errorf("%s is outside the models you allow (%s) · widen them with /crew models +%s",
+			pin.Model, rule.String(), crewroute.ShortModel(pin.Model))
+	case !known && rule.Base != crewroute.BaseAll && !rule.NamesModel(pin.Model):
+		return fmt.Errorf("%s is not in the catalog, so the rule %s cannot admit it by price or licence · name it with /crew models +%s",
+			pin.Model, rule.String(), pin.Model)
+	case !known && rule.Base == crewroute.BaseAll && !rule.AdmitsModel(crewroute.Model{ID: pin.Model}):
+		return fmt.Errorf("%s is outside the models you allow (%s)", pin.Model, rule.String())
+	}
+	if pin.Provider != "" {
+		provider, ok := crewProviderByID(CrewProvidersAt(profileDir), pin.Provider)
+		if !ok {
+			return fmt.Errorf("%s is not a connected provider · connect it with /connect, or pin the model without @%s", pin.Provider, pin.Provider)
+		}
+		if !rule.AdmitsRoute(provider.ID) {
+			return fmt.Errorf("%s is a provider your allowed models exclude (%s)", provider.ID, rule.String())
+		}
+		if !provider.On {
+			return fmt.Errorf("%s is turned off for the crew · turn it on in /crew's providers row", provider.ID)
+		}
+		if _, ok := provider.route(pin.Model, model, known); !ok {
+			return fmt.Errorf("%s does not serve %s", provider.Name, pin.Model)
 		}
 	}
-	return "", false
+	return nil
 }
 
-// normalCrewSource folds a source word to one of the two this build knows,
-// reading a word it does not know as the default family.
-func normalCrewSource(source string) string {
-	if known, ok := knownCrewSource(source); ok {
-		return known
+// ── allowed models and the cap ──────────────────────────────────────────────
+
+// CrewAllowedAt is the allowed-models rule. A rule that does not parse — a
+// hand edit — reads as the default, the way a retired choice reads everywhere
+// else on this sheet; the writer refuses one.
+func CrewAllowedAt(profileDir string) crewroute.Allowed {
+	value, _ := persistedString(profileDir, KeyCrewAllowed)
+	rule, err := crewroute.ParseAllowed(value)
+	if err != nil {
+		rule, _ = crewroute.ParseAllowed(crewroute.DefaultAllowed)
 	}
-	return DefaultCrewSource
+	return rule
 }
 
-// CrewSourceAt is which family the preset words draw from on this profile,
-// [DefaultCrewSource] when the row is absent. A word this build does not know
-// reads as the default family, silently, the way a retired choice reads
-// everywhere else on this sheet.
-func CrewSourceAt(profileDir string) string {
-	if value, ok := persistedString(profileDir, KeyCrewSource); ok {
-		return normalCrewSource(value)
+// SetCrewAllowed writes the rule in its canonical spelling, refusing one that
+// does not parse and one that would leave a pinned seat outside it.
+func SetCrewAllowed(profileDir, raw string) error {
+	rule, err := crewroute.ParseAllowed(raw)
+	if err != nil {
+		return err
 	}
-	return DefaultCrewSource
+	return writeCrewAllowed(profileDir, rule)
 }
 
-// storedCrewWord is the crew word a profile STORES on the crew row, when it
-// names one of this build's presets.
-//
-// THIS BUILD NEVER WRITES IT. The crew row is derived from the five tier rows,
-// not stored ([KeyCrew] argues it), so on every profile this product shapes the
-// row is absent. But a run that writes ONE word into config.json instead of the
-// five rows — a harness driven arm, a hand edit — is asking for a budget, and a
-// word sitting on disk that nothing reads is a crew word that reached nobody.
-// The word is read here, at the one place a preset is decided ([crewPresetUnder]
-// and [crewStoredAt]), so a word that is present seats the crew it names whether
-// the five rows were written or not.
+// ModifyCrewAllowed is `/crew models +x` and `-x`: the rule with one word
+// added or taken away.
+func ModifyCrewAllowed(profileDir string, add bool, word string) error {
+	word = strings.TrimSpace(word)
+	if word == "" {
+		return errors.New("name a model or a provider after the + or -")
+	}
+	return writeCrewAllowed(profileDir, CrewAllowedAt(profileDir).With(add, word))
+}
+
+// writeCrewAllowed is the rule's one writer.
+func writeCrewAllowed(profileDir string, rule crewroute.Allowed) error {
+	for _, seat := range crewroute.Seats {
+		pin, ok := CrewPinAt(profileDir, seat)
+		if !ok {
+			continue
+		}
+		if model, known := crewCatalogModel(pin.Model); (known && !rule.AdmitsModel(model)) || (!known && rule.Base != crewroute.BaseAll && !rule.NamesModel(pin.Model)) {
+			return fmt.Errorf("your %s is pinned to %s, which that rule leaves out · /crew unpin %s first, or add +%s",
+				seat, pin.Model, seat, crewroute.ShortModel(pin.Model))
+		}
+	}
+	return writeProfileValue(profileDir, KeyCrewAllowed, rule.String())
+}
+
+// CrewCapAt is the daily cap on crew spend, zero for none.
+func CrewCapAt(profileDir string) float64 {
+	value, ok := persistedFloat(profileDir, KeyCrewCap)
+	if !ok || value < 0 {
+		return 0
+	}
+	return value
+}
+
+// SetCrewCap writes the cap: a dollar amount, or `none`.
+func SetCrewCap(profileDir, raw string) error {
+	return writeDollars(profileDir, KeyCrewCap, raw)
+}
+
+// CrewTaskCapDefault is the per-task limit when none is set.
+const CrewTaskCapDefault = 5.0
+
+// CrewTaskCapAt is the most one task may spend, in dollars: the stored figure
+// when it is above zero, [CrewTaskCapDefault] otherwise. There is always one.
+func CrewTaskCapAt(profileDir string) float64 {
+	value, ok := persistedFloat(profileDir, KeyCrewTaskCap)
+	if !ok || value <= 0 {
+		return CrewTaskCapDefault
+	}
+	return value
+}
+
+// SetCrewTaskCap writes the per-task limit: a dollar amount above zero. A
+// task always has a limit, so `none` and zero are refused.
+func SetCrewTaskCap(profileDir, raw string) error {
+	value, err := parseDollars(raw)
+	if err != nil {
+		return err
+	}
+	if value <= 0 {
+		return errors.New("a task always has a limit — a dollar amount above zero")
+	}
+	return writeProfileValue(profileDir, KeyCrewTaskCap, value)
+}
+
+// CrewFreeRoutesAt is whether the crew may route to providers' free pools.
+// Absent is off.
 //
-// A word this build does not know names no preset and is read as no word at all,
-// the way the family and pick rows fold a retired choice. The family is still
-// [CrewSourceAt]'s: the word names a budget, not a shelf.
-func storedCrewWord(profileDir string) (string, bool) {
-	value, held := persistedString(profileDir, KeyCrew)
-	if !held {
-		return "", false
+// A FREE ROUTE IS A ROUTE, NOT A MODEL. On, a model's free pool joins its other
+// routes ([crewroute.Free]) and is weighed at what it is expected to cost —
+// its refusals included — and a seat on it falls through to the same model's
+// paid route before any other model. Off, the free pools are not routes at
+// all; a person can still pin one by name.
+func CrewFreeRoutesAt(profileDir string) bool {
+	on, _ := persistedBool(profileDir, KeyCrewFreeRoutes)
+	return on
+}
+
+// SetCrewFreeRoutes turns the free routes on or off.
+func SetCrewFreeRoutes(profileDir string, on bool) error {
+	return writeProfileValue(profileDir, KeyCrewFreeRoutes, on)
+}
+
+// ── the providers turned off ────────────────────────────────────────────────
+
+// ErrCrewLastProvider is the refusal to turn off the last provider on: a crew
+// with nothing to route through is not a narrower crew but no crew, and the
+// way to say "none of these" is to disconnect them, which /connect does.
+var ErrCrewLastProvider = errors.New("at least one provider must stay on")
+
+// ErrCrewNoRoutableProvider is the same refusal one step wider: the providers
+// left on would route no seat — only a custom endpoint, say, which a pin
+// reaches and the router never picks — while every seat is not pinned to a
+// provider still on.
+var ErrCrewNoRoutableProvider = errors.New("at least one provider that can route a seat must stay on")
+
+// CrewProvidersOffAt is the providers turned off for the crew. A row that does
+// not read — a hand edit — reads as none off, the way a rule that does not
+// parse reads as the default.
+func CrewProvidersOffAt(profileDir string) crewroute.ProvidersOff {
+	raw, ok := persistedValue(profileDir, KeyCrewProvidersOff)
+	if !ok {
+		return nil
+	}
+	var ids []string
+	if json.Unmarshal(raw, &ids) != nil {
+		return nil
 	}
-	word := strings.ToLower(strings.TrimSpace(value))
-	for _, preset := range CrewPresets {
-		if word == preset {
-			return preset, true
+	off := crewroute.ProvidersOff{}
+	for _, id := range ids {
+		if id = strings.ToLower(strings.TrimSpace(id)); id != "" {
+			off[id] = true
 		}
 	}
-	return "", false
+	return off
 }
 
-// CrewModelsForSource is the five models one preset would set under one
-// family, by tier word, false for a word that is not a preset. It returns a
-// copy for [CrewModels]'s reason.
-func CrewModelsForSource(source, preset string) (map[string]string, bool) {
-	row, ok := crewTableFor(source)[strings.ToLower(strings.TrimSpace(preset))]
+// SetCrewProviderOn turns one connected provider on or off for the crew, IN
+// ONE FILE WRITE, refusing to turn off the last one on ([ErrCrewLastProvider])
+// and a provider that is not connected.
+//
+// THE ROW KEEPS ONLY CONNECTED PROVIDERS. An id left behind by a connection
+// since removed is dropped on the next write, so a provider disconnected and
+// connected again is on — the same as any connection made after the row was
+// written — and the row never grows a list of names nobody can see.
+func SetCrewProviderOn(profileDir, id string, on bool) error {
+	providers := CrewProvidersAt(profileDir)
+	provider, ok := crewProviderByID(providers, id)
 	if !ok {
-		return nil, false
+		return fmt.Errorf("%s is not a connected provider · connect it with /connect", strings.TrimSpace(id))
+	}
+	var ids []string
+	still := 0
+	for _, p := range providers {
+		stays := p.On
+		if p.ID == provider.ID {
+			stays = on
+		}
+		if stays {
+			still++
+			continue
+		}
+		ids = append(ids, p.ID)
+	}
+	if still == 0 {
+		return ErrCrewLastProvider
+	}
+	if !on && !crewStillRoutes(profileDir, providers, provider.ID) {
+		return ErrCrewNoRoutableProvider
+	}
+	if len(ids) == 0 {
+		return writeProfileValues(profileDir, map[string]any{KeyCrewProvidersOff: removeProfileKey})
+	}
+	return writeProfileValue(profileDir, KeyCrewProvidersOff, ids)
+}
+
+// crewStillRoutes is whether turning one more provider off leaves the crew
+// able to seat every seat: some allowed model a seat can sit is reached by a
+// provider still on, or every seat is pinned to a provider still on. A
+// profile that could route nothing before the change is not refused for
+// routing nothing after it — the refusal is about THIS change.
+func crewStillRoutes(profileDir string, providers []CrewProvider, id string) bool {
+	rule := CrewAllowedAt(profileDir)
+	all := crewCandidates(rule, providers)
+	before, after := crewroute.ProvidersOff{}, crewroute.ProvidersOff{}
+	for _, p := range providers {
+		if !p.On {
+			before[p.ID], after[p.ID] = true, true
+		}
+	}
+	after[id] = true
+	if !crewSeatable(before.Candidates(all)) || crewSeatable(after.Candidates(all)) {
+		return true
+	}
+	pins := CrewPinsAt(profileDir)
+	for _, seat := range crewroute.Seats {
+		pin, ok := pins[seat]
+		if !ok {
+			return false
+		}
+		route := resolveCrewPin(pin, providers)
+		if _, connected := crewProviderByID(providers, route.Provider); !connected || !after.On(route.Provider) {
+			return false
+		}
 	}
-	out := make(map[string]string, len(row))
-	for tier, model := range row {
-		out[tier] = model
+	return true
+}
+
+// crewSeatable is whether any candidate can sit a seat: a model that takes
+// tools, on at least one route.
+func crewSeatable(candidates []crewroute.Candidate) bool {
+	for _, c := range candidates {
+		if c.Model.Tools && len(c.Routes) > 0 {
+			return true
+		}
 	}
-	return out, true
+	return false
 }
 
-// crewLines is the one line each preset says about itself, IN THE FAMILY IT
-// DRAWS FROM. It is what /crew prints beside each option and what the settings
-// chooser shows under it, so it must name the models the preset actually picks
-// in the family on screen: a line naming open models above frontier ids is the
-// contradiction the chooser exists to prevent.
-var crewLines = map[string]map[string]string{
-	CrewSourceOpen: {
-		CrewFrugal:   "glm-flash works, checks and thinks · pennies a day",
-		CrewBalanced: "glm-flash works, kimi-k3 checks, glm-5.3 thinks",
-		CrewMax:      "glm-5.3 works and thinks, kimi-k3 checks",
-	},
-	CrewSourceAll: {
-		CrewFrugal:   "glm-flash works and thinks, qwen-max checks",
-		CrewBalanced: "glm-flash works, fable checks, opus thinks",
-		CrewMax:      "glm-5.3 works, fable checks, opus thinks",
-	},
+// ── what the router may pick from ───────────────────────────────────────────
+
+// CrewCatalog is how the catalog reaches crew routing: the binary holding the
+// catalog sets it ONCE AT START-UP, from its non-blocking read, and never a
+// fetch — a task is routed on whatever the catalog already holds. Nil, and a
+// func answering no rows, are ordinary states rather than errors: the router
+// then has no candidates, and a task's crew comes from its rescue ladder —
+// the last crew that worked here, the model the person is talking to.
+var CrewCatalog func() []catalog.Model
+
+// crewCatalogRows is [CrewCatalog] read with its ordinary absences folded.
+func crewCatalogRows() []catalog.Model {
+	if CrewCatalog == nil {
+		return nil
+	}
+	return CrewCatalog()
 }
 
-// CrewLine is one preset's own line in the DEFAULT family, empty for a word
-// that is not a preset. The family-aware spelling is [CrewLineFor].
-func CrewLine(preset string) string {
-	return CrewLineFor(DefaultCrewSource, preset)
+// crewModelOf reads one catalog row the way the router reads a model.
+func crewModelOf(row catalog.Model) crewroute.Model {
+	return crewroute.Model{
+		ID: row.ID, Open: row.OpenWeights,
+		PromptPrice: row.PromptPrice, CompletionPrice: row.CompletionPrice, CacheReadPrice: row.CacheReadPrice,
+		Intelligence: row.IntelligenceIndex, Coding: row.CodingIndex, Agentic: row.AgenticIndex,
+		ArenaElo: row.ArenaElo, Released: crewReleased(row),
+		Context: row.ContextLength, Tools: crewTakesTools(row) && crewSpeaksText(row),
+	}
 }
 
-// CrewLineFor is one preset's own line in one family, empty for a word that is
-// not a preset. A family this build does not know reads as the default one, the
-// way the row does.
-func CrewLineFor(source, preset string) string {
-	return crewLines[normalCrewSource(source)][strings.ToLower(strings.TrimSpace(preset))]
+// crewReleased is when a catalog row's model was released: the row's own
+// listing time, or the date a canonical slug ends on (`…-20260826`), or the
+// zero time when the row says neither.
+func crewReleased(row catalog.Model) time.Time {
+	if row.Created > 0 {
+		return time.Unix(row.Created, 0).UTC()
+	}
+	slug := strings.TrimSpace(row.CanonicalSlug)
+	if at := strings.LastIndex(slug, "-"); at >= 0 && len(slug)-at-1 == 8 {
+		if day, err := time.Parse("20060102", slug[at+1:]); err == nil && day.Year() >= 2020 {
+			return day
+		}
+	}
+	return time.Time{}
 }
 
-// CrewModels is the five models one preset would set in the DEFAULT family, by
-// tier word: the family a profile nobody has touched reads, and the spelling
-// the callers hold. The family-aware spelling is
-// [CrewModelsForSource]. It returns a copy, because a caller printing the
-// table must not be able to edit it.
-func CrewModels(preset string) (map[string]string, bool) {
-	return CrewModelsForSource(DefaultCrewSource, preset)
+// crewIndexesFrom is m with every published figure it lacks — an index, the
+// arena Elo, the release date — read from other, a row of the same model.
+func crewIndexesFrom(m, other crewroute.Model) crewroute.Model {
+	if m.Intelligence <= 0 {
+		m.Intelligence = other.Intelligence
+	}
+	if m.Coding <= 0 {
+		m.Coding = other.Coding
+	}
+	if m.Agentic <= 0 {
+		m.Agentic = other.Agentic
+	}
+	if m.ArenaElo <= 0 {
+		m.ArenaElo = other.ArenaElo
+	}
+	if m.Released.IsZero() {
+		m.Released = other.Released
+	}
+	return m
 }
 
-// CrewAt is the crew as the five live tier values make it: the preset they are,
-// or [CrewCustom].
-//
-// It reads through [TierModelAt], so a profile that has never been touched reads
-// the shipped defaults and therefore reads [DefaultCrew] — the five defaults are
-// the balanced row and nothing here needs to know that separately. A tier a
-// person cleared on purpose reads empty, matches no preset, and turns the answer
-// to custom, which is the truth: "one of these follows the conversation" is not
-// any of the three.
+// crewTakesTools is whether a catalog row says the model takes tool calls.
 //
-// The comparison runs against the family [CrewSourceAt] names, so the reading
-// moves with the row and never behind it: flip the family and a crew the old
-// family wrote matches nothing, which reads as custom and is true, because one
-// family's five ids are not any preset of the other.
-func CrewAt(profileDir string) string {
-	family := CrewSourceAt(profileDir)
-	if CrewPickAt(profileDir) != CrewPickTable {
-		// WITH THE PICK OFF THE TABLE the three dial seats are computed ids the
-		// preset tables do not hold, and comparing the live seats would read
-		// custom over a crew the person chose. The word answers what the STORED
-		// rows make instead — the budget the seats are computed at ([pickedSeat]
-		// reads the same rows) — so the word on the sheet stays the decision it
-		// summarizes while the ids underneath move with the catalog.
-		return crewStoredAt(profileDir, family)
-	}
-	live := make(map[string]string, len(ModelTiers))
-	for _, tier := range ModelTiers {
-		live[tier] = tierSeatUnder(profileDir, family, tier).Model
-	}
-	if sameCrew(live, freeCrewModels) {
-		return CrewFree
-	}
-	table := crewTableFor(family)
-	for _, preset := range CrewPresets {
-		if sameCrew(live, table[preset]) {
-			return preset
-		}
-	}
-	return CrewCustom
-}
-
-// crewStoredAt is the crew the STORED five rows make, in the family given:
-// the preset they are, or [CrewCustom]. It is [CrewAt]'s reading when the
-// pick row takes the seats off the table, where the live comparison would
-// compare computed ids.
+// A ROW THAT LISTS NO PARAMETERS HAS SAID NOTHING, and a crew seat is an agent
+// loop: a model whose tool support is unknown is not sent to find out in the
+// middle of somebody's task.
+func crewTakesTools(row catalog.Model) bool {
+	return len(row.Parameters) > 0 && listHolds(row.Parameters, "tools")
+}
+
+// crewSpeaksText is whether a catalog row reads text and writes text. A crew
+// seat is a conversation of text and tool calls: a speech, transcription or
+// image model that lists tool parameters is still no seat. A row that lists
+// no modalities has said nothing either way and is judged on its tools alone.
+func crewSpeaksText(row catalog.Model) bool {
+	if len(row.InputModalities) > 0 && !listHolds(row.InputModalities, "text") {
+		return false
+	}
+	return len(row.OutputModalities) == 0 || listHolds(row.OutputModalities, "text")
+}
+
+// crewCatalogModel is one model as the router would read it, from the
+// catalog, false when the catalog does not know it.
 //
-// Each row is read through the ladder's own row reader ([crewRow]). A row the
-// reader cannot answer because the key was NEVER HELD reads the family's
-// default-preset id, which is what that tier runs until somebody writes it;
-// a row CLEARED ON PURPOSE reads empty and matches nothing, because
-// "follows the conversation" is not any of the three; a row that says auto is
-// skipped, because auto is the one row with no opinion of its own — it runs
-// at whatever budget the rows around it name ([crewPresetUnder]).
-func crewStoredAt(profileDir, family string) string {
-	// A STORED CREW WORD NAMES THE BUDGET OUTRIGHT. A run that wrote one word
-	// instead of the five rows made its decision on the word, and the five rows
-	// under it are that word's own table rows — so the word is the answer, and
-	// the row comparison below is only for a profile whose budget is the rows.
-	if word, ok := storedCrewWord(profileDir); ok {
-		return word
-	}
-	defaults := crewTableFor(family)[DefaultCrew]
-	stored := make(map[string]string, len(ModelTiers))
-	for _, tier := range ModelTiers {
-		value, _, source, cleared := crewRow(profileDir, tier)
-		switch {
-		case cleared:
-			stored[tier] = ""
-		case source == "":
-			stored[tier] = strings.ToLower(strings.TrimSpace(defaults[tier]))
-		case IsAuto(value):
-			stored[tier] = AutoValue
-		default:
-			stored[tier] = strings.ToLower(strings.TrimSpace(value))
+// THE EXACT ID WINS. A pin names what the person wrote, and a catalog that
+// lists that id serves that id — never a dated snapshot that happens to share
+// its lineage and to be listed first. Only an id the catalog does not list is
+// read through its lineage.
+func crewCatalogModel(id string) (crewroute.Model, bool) {
+	exact := stripCrewRoute(id)
+	rows := crewCatalogRows()
+	for _, row := range rows {
+		if strings.EqualFold(row.ID, exact) && !row.PriceUnknown {
+			return crewModelOf(row), true
 		}
 	}
-	table := crewTableFor(family)
-	// THE DEFAULT PRESET WINS EVERY TIE, the law [crewPresetUnder] states: a
-	// profile whose every row says auto is a crew with no opinion of its own,
-	// and it reads balanced rather than whichever preset the loop met first.
-	if crewStoredMatches(stored, table[DefaultCrew]) {
-		return DefaultCrew
+	lineage := crewroute.Lineage(exact)
+	for _, row := range rows {
+		if crewroute.Lineage(row.ID) == lineage && !row.PriceUnknown {
+			return crewModelOf(row), true
+		}
 	}
-	for _, preset := range CrewPresets {
-		if preset != DefaultCrew && crewStoredMatches(stored, table[preset]) {
-			return preset
+	return crewroute.Model{}, false
+}
+
+// stripCrewRoute takes a connection's prefix off an id a person wrote with
+// one (`openrouter/z-ai/glm-5.3-flash`), leaving the catalog id.
+func stripCrewRoute(id string) string {
+	return strings.TrimPrefix(strings.TrimSpace(id), modelsource.DefaultID+"/")
+}
+
+// listHolds says whether a row's own list carries the word, case folded.
+func listHolds(words []string, word string) bool {
+	for _, held := range words {
+		if strings.EqualFold(strings.TrimSpace(held), word) {
+			return true
 		}
 	}
-	return CrewCustom
+	return false
 }
 
-// crewStoredMatches compares a stored reading with one preset row, skipping
-// the tiers whose row says auto.
-func crewStoredMatches(stored, preset map[string]string) bool {
-	for _, tier := range ModelTiers {
-		if stored[tier] == AutoValue {
+// CrewProvider is one connected provider as the crew can use it.
+type CrewProvider struct {
+	// ID is the connection's own id — `openrouter`, `z-ai`, `codex`,
+	// `ollama` — and the word an `@provider` pin names.
+	ID string
+	// Name is how the panel says it.
+	Name string
+	// Written is the id prefix that sends a call to this connection.
+	Written string
+	// Kind is how it bills: metered, a subscription plan, or local.
+	Kind crewroute.RouteKind
+	// Serves is the models a plan door serves, empty for every model the
+	// vendor lists.
+	Serves []string
+	// On is whether the crew may route through it: every connection is, until
+	// a person turns it off ([SetCrewProviderOn]).
+	On bool
+	// vendors are the catalog vendor prefixes this connection serves directly.
+	vendors []string
+	// collides lists the catalog vendors whose ids this connection's Written
+	// prefix would capture, so the default route spells them `openrouter/…`.
+	collides map[string]bool
+}
+
+// crewVendors maps a direct connection to the catalog vendor prefixes it
+// serves. A connection whose Written is the vendor's own prefix needs no row.
+var crewVendors = map[string][]string{
+	"moonshot": {"moonshotai"},
+	"codex":    {"openai"},
+}
+
+// CrewProvidersAt is every provider the crew can route through: each
+// connection this profile has with a key, in the person's own order, the
+// default service first when it has one. It is DERIVED, never a setting —
+// connecting a provider is what adds it.
+func CrewProvidersAt(profileDir string) []CrewProvider {
+	off := CrewProvidersOffAt(profileDir)
+	set := ResolveSources(profileDir, APIKeyAt(profileDir), DefaultBaseURL)
+	written := map[string]bool{}
+	for _, service := range set.All() {
+		written[strings.ToLower(service.Source.Written)] = true
+	}
+	var out []CrewProvider
+	for _, service := range set.All() {
+		source := service.Source
+		if strings.TrimSpace(service.Key) == "" && !source.KeyOptional {
 			continue
 		}
-		if stored[tier] != strings.ToLower(strings.TrimSpace(preset[tier])) {
-			return false
+		p := CrewProvider{ID: strings.ToLower(source.ID), Name: source.Name, Written: source.Written, Kind: crewroute.Metered}
+		p.On = off.On(p.ID)
+		switch {
+		case strings.EqualFold(source.ID, modelsource.DefaultID):
+			p.collides = map[string]bool{}
+			for w := range written {
+				if w != modelsource.DefaultID {
+					p.collides[w] = true
+				}
+			}
+		case strings.EqualFold(source.ID, "codex"):
+			p.Kind = crewroute.Plan
+			p.Serves = []string{source.Preferred}
+		case strings.EqualFold(source.ID, "ollama"):
+			p.Kind = crewroute.Local
+		case modelsource.IsCustomID(source.ID):
+			// A custom endpoint serves models the catalog does not describe;
+			// it is reachable by a pin that names it and by nothing else.
+		case service.Door.ID != "" && !service.Door.Metered:
+			p.Kind = crewroute.Plan
+			p.Serves = append([]string(nil), service.Door.Models...)
+		}
+		if !strings.EqualFold(source.ID, modelsource.DefaultID) && !modelsource.IsCustomID(source.ID) && !strings.EqualFold(source.ID, "ollama") {
+			p.vendors = append([]string{strings.ToLower(source.Written)}, crewVendors[strings.ToLower(source.ID)]...)
 		}
+		out = append(out, p)
 	}
-	return true
+	return out
 }
 
-// sameCrew compares two crews class by class, case-folded, because a model id is
-// matched case-insensitively everywhere else on this surface.
-func sameCrew(live, preset map[string]string) bool {
-	for _, tier := range ModelTiers {
-		if !strings.EqualFold(strings.TrimSpace(live[tier]), preset[tier]) {
-			return false
+// crewProviderByID finds a connected provider by the word a pin names.
+func crewProviderByID(providers []CrewProvider, id string) (CrewProvider, bool) {
+	id = strings.ToLower(strings.TrimSpace(id))
+	for _, p := range providers {
+		if p.ID == id || strings.EqualFold(p.Written, id) {
+			return p, true
 		}
 	}
-	return true
+	return CrewProvider{}, false
 }
 
-// ApplyCrew writes all five tier rows from one preset, IN ONE FILE WRITE.
+// route is how this provider reaches one catalog model, false when it does
+// not. The send is the id that makes an ordinary call go this way — the
+// connection-routing grammar every call already obeys ([modelsource.Split]).
+func (p CrewProvider) route(id string, model crewroute.Model, known bool) (crewroute.Route, bool) {
+	id = stripCrewRoute(id)
+	vendor, tail := id, id
+	if slash := strings.Index(id, "/"); slash >= 0 {
+		vendor, tail = strings.ToLower(id[:slash]), id[slash+1:]
+	}
+	if p.ID == modelsource.DefaultID {
+		if !known {
+			return crewroute.Route{}, false
+		}
+		send := id
+		if p.collides[vendor] {
+			send = modelsource.DefaultID + "/" + id
+		}
+		return crewroute.Route{Provider: p.ID, Send: send, Kind: p.Kind}, true
+	}
+	// A pin written with this connection's own prefix is already its send.
+	if strings.EqualFold(vendor, p.Written) && !known {
+		return crewroute.Route{Provider: p.ID, Send: id, Kind: p.Kind}, true
+	}
+	served := false
+	for _, v := range p.vendors {
+		if v == vendor {
+			served = true
+			break
+		}
+	}
+	if !served {
+		return crewroute.Route{}, false
+	}
+	if len(p.Serves) > 0 {
+		ok := false
+		for _, s := range p.Serves {
+			if strings.EqualFold(crewroute.Lineage(s), crewroute.Lineage(tail)) {
+				ok = true
+				break
+			}
+		}
+		if !ok {
+			return crewroute.Route{}, false
+		}
+	}
+	return crewroute.Route{Provider: p.ID, Send: p.Written + "/" + tail, Kind: p.Kind}, true
+}
+
+// CrewCandidatesAt is what the router may pick from on this profile: every
+// catalog model the allowed rule admits, with every route a connected
+// provider offers it on — plans and local models first, then a direct
+// connection, then the default service, which is the order a tie between
+// routes of equal cost is broken in. A model no connected provider reaches is
+// not a candidate, however cheap.
 //
-// The five keys land together or not at all. Five separate writes would leave a
-// window — one process crash, one full disk — in which two classes belong to the
-// old crew and two to the new, and the crew row would read "custom" about a
-// state nobody chose. It is also the only shape in which a reader that happens
-// to be resolving a role while somebody presses enter cannot see half a crew.
+// A provider the person turned off carries none of those routes
+// ([crewroute.ProvidersOff]), so a model only it reached is no candidate
+// either — the route cost the router weighs is always a route it may take.
+func CrewCandidatesAt(profileDir string) []crewroute.Candidate {
+	candidates, _ := crewCandidatesNoticed(profileDir, crewHealthAt(profileDir))
+	return candidates
+}
+
+// crewCandidates is [CrewCandidatesAt] over a rule and a set of providers
+// already read, which is how [CrewOffersAt] asks the same question under `all`.
+// It is asked with no free routes.
+func crewCandidates(rule crewroute.Allowed, providers []CrewProvider) []crewroute.Candidate {
+	return crewCandidatesWith(rule, providers, crewRouteFacts{})
+}
+
+// crewCandidatesWith is [crewCandidates] with the profile's route facts.
 //
-// The preset is resolved under the family [CrewSourceAt] names, so the row and
-// the write cannot disagree about which table the word means: flip to `all`,
-// press the crew again, and the five ids that land are the all-family ones.
-func ApplyCrew(profileDir, preset string) error {
-	// An empty family means KEEP THE ONE THE PROFILE HOLDS, so this path reads the
-	// profile once inside ApplyCrewUnder rather than once here and again there, and
-	// the write is exactly the five tiers. One resolve-and-write serves both callers
-	// rather than two that can drift apart.
-	return ApplyCrewUnder(profileDir, "", preset)
-}
-
-// ApplyCrewUnder writes a FAMILY AND A PRESET AS ONE DECISION, IN ONE FILE
-// WRITE. The family row and the five tier rows are one state, so writing them
-// apart leaves a window in which a reader sees the family set to `all` while the
-// rows still hold open ids, which is the half-written crew [ApplyCrew] forbids, read as
-// `custom` about a state nobody chose.
+// ONE MODEL IS ONE CANDIDATE, WHATEVER IT IS SPELLED. Catalog rows are grouped
+// by their canonical identity ([crewroute.Canonical]), so a model's free pool
+// (`…:free`) is not a second, free model beside it but one more route of the
+// same one — kept only when free routes are on ([CrewFreeRoutesAt]). A free
+// pool whose paid model the catalog does not list is a model with that one
+// route, weighed at what the route is expected to cost, never at zero.
+func crewCandidatesWith(rule crewroute.Allowed, providers []CrewProvider, facts crewRouteFacts) []crewroute.Candidate {
+	var models []crewroute.Model
+	var free map[string]string // canonical id → the free row's id
+	if rows := crewCatalogRows(); len(rows) > 0 {
+		paid := map[string]bool{}
+		at := map[string]int{}
+		for _, row := range rows {
+			if crewUnpriced(row) || strings.HasPrefix(row.ID, "~") || crewroute.IsFree(row.ID) {
+				continue
+			}
+			lineage := crewroute.Lineage(row.ID)
+			if paid[lineage] {
+				// The same model again — a dated snapshot beside its name —
+				// is one candidate, read from the row that lists the model
+				// by its own name when there is one, so a seat is sent the
+				// name and not whichever snapshot the catalog listed first.
+				// THE FIGURES ARE THE MODEL'S, whichever row carried them: an
+				// index the snapshot's row published is not lost because the
+				// model's own row did not repeat it.
+				if strings.EqualFold(row.ID, lineage) {
+					models[at[lineage]] = crewIndexesFrom(crewModelOf(row), models[at[lineage]])
+				} else {
+					models[at[lineage]] = crewIndexesFrom(models[at[lineage]], crewModelOf(row))
+				}
+				continue
+			}
+			paid[lineage], at[lineage] = true, len(models)
+			models = append(models, crewIndexesFrom(crewModelOf(row), crewroute.Model{}))
+		}
+		if facts.free {
+			free = map[string]string{}
+			for _, row := range rows {
+				if !crewroute.IsFree(row.ID) || strings.HasPrefix(row.ID, "~") || crewUnpriced(row) {
+					continue
+				}
+				key := crewroute.Lineage(row.ID)
+				free[key] = row.ID
+				if !paid[key] {
+					paid[key] = true
+					m := crewModelOf(row)
+					m.ID = strings.TrimSuffix(m.ID, ":free")
+					models = append(models, m)
+				}
+			}
+		}
+	}
+	var out []crewroute.Candidate
+	for _, m := range models {
+		if !rule.AdmitsModel(m) {
+			continue
+		}
+		var plans, direct, fallback []crewroute.Route
+		for _, p := range providers {
+			if !rule.AdmitsRoute(p.ID) {
+				continue
+			}
+			r, ok := p.route(m.ID, m, true)
+			if !ok {
+				continue
+			}
+			switch {
+			case r.Kind != crewroute.Metered:
+				plans = append(plans, r)
+			case p.ID == modelsource.DefaultID:
+				fallback = append(fallback, r)
+			default:
+				direct = append(direct, r)
+			}
+		}
+		if send, ok := free[crewroute.Lineage(m.ID)]; ok {
+			for _, p := range providers {
+				if p.ID == modelsource.DefaultID && rule.AdmitsRoute(p.ID) {
+					plans = append(plans, crewroute.Route{Provider: p.ID, Send: send, Kind: crewroute.Free})
+				}
+			}
+		}
+		// Only a free pool: the model is reachable on nothing else.
+		fallback = withoutPaidPool(fallback, free[crewroute.Lineage(m.ID)], m)
+		// AND ONLY THE ROUTES THAT ARE HEALTHY: a route quarantined, cooling
+		// down, on a disconnected provider, or paid on an account out of
+		// credit is not offered, and the rest carry their learned failure
+		// rate ([crewHealth.usable]).
+		routes := facts.health.usable(append(append(plans, direct...), fallback...))
+		if len(routes) == 0 {
+			continue
+		}
+		out = append(out, crewroute.Candidate{Model: m, Routes: routes})
+	}
+	return out
+}
+
+// crewUnpriced is a catalog row the router may not weigh: one whose provider
+// published no price, or a paid id priced at nothing — a stealth or preview
+// model, a meta-router — whose zero promises nothing about the next call and
+// would win every seat at $0. ONLY A FREE POOL (`…:free`) PRICED AT AN
+// EXPLICIT ZERO IS FREE. A pin still names such a model by its id; the router
+// never picks one on its own.
+func crewUnpriced(row catalog.Model) bool {
+	if row.PriceUnknown {
+		return true
+	}
+	return !crewroute.IsFree(row.ID) && row.PromptPrice <= 0 && row.CompletionPrice <= 0 && row.RequestPrice <= 0
+}
+
+// withoutPaidPool drops the default service's metered route for a model the
+// catalog lists ONLY as a free pool: there is no paid route to it, and a
+// metered route at the free row's zero prices would be the free pool again
+// under another kind.
+func withoutPaidPool(routes []crewroute.Route, freeSend string, m crewroute.Model) []crewroute.Route {
+	if freeSend == "" || m.PromptPrice > 0 || m.CompletionPrice > 0 {
+		return routes
+	}
+	out := routes[:0]
+	for _, r := range routes {
+		if r.Provider != modelsource.DefaultID {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// CrewOffer is one model a seat could be pinned to on this profile: a model
+// some connected provider reaches, WHETHER OR NOT THE ALLOWED RULE ADMITS IT.
 //
-// The family row rides along ONLY WHEN IT CHANGES, so an enter that keeps the
-// family does not pin a setting the person never answered: the five tier rows are
-// written and the family row stays unanswered, free to follow a later default
-// family.
-func ApplyCrewUnder(profileDir, source, preset string) error {
-	// An empty source keeps the family the profile holds, which is how [ApplyCrew]
-	// asks for the five tiers alone. The profile is read ONCE here, so there is no
-	// window between a check and the write in which the family could move.
-	persisted := CrewSourceAt(profileDir)
-	if strings.TrimSpace(source) == "" {
-		source = persisted
-	}
-	known, ok := knownCrewSource(source)
-	if !ok {
-		return fmt.Errorf("pick one of: %s", strings.Join(CrewSources, ", "))
+// THE PICKER LISTS WHAT THE RULE LEAVES OUT, AND SAYS SO. A list that hid
+// every model outside the rule would answer "why can't I pick kimi?" with
+// silence; one that shows it dim, with the one key that lets it in, answers
+// the question on the row where it was asked ([SetCrewPin] still refuses a pin
+// outside the rule — the panel's key widens the rule first, out loud).
+type CrewOffer struct {
+	Model crewroute.Model
+	// Routes are every connected provider reaching it, in [CrewCandidatesAt]'s
+	// order — plans and local first, the default service last — and the
+	// cheapest route is the first one.
+	Routes []crewroute.Route
+	// Served is whether a provider that is ON reaches it: a model only a
+	// provider turned off reaches is still listed, and is not allowed.
+	Served bool
+	// Allowed is whether the rule admits the model on at least one route
+	// through a provider that is on.
+	Allowed bool
+}
+
+// CrewOffersAt is every model a connected provider reaches, allowed or not,
+// in the catalog's order. It is [CrewCandidatesAt] asked under `all` and then
+// read against the rule in force, so the two can never disagree about which
+// route reaches what.
+func CrewOffersAt(profileDir string) []CrewOffer {
+	rule := CrewAllowedAt(profileDir)
+	off := CrewProvidersOffAt(profileDir)
+	providers := CrewProvidersAt(profileDir)
+	var out []CrewOffer
+	facts := crewRouteFacts{free: CrewFreeRoutesAt(profileDir), health: crewHealthAt(profileDir)}
+	for _, c := range crewCandidatesWith(crewroute.Allowed{Base: crewroute.BaseAll}, providers, facts) {
+		// ── ONLY WHAT A SEAT CAN RUN ──
+		// A picker offers exactly what the router could seat: a model that takes
+		// tool calls and holds a seat's context — not an embedding, image or
+		// video model — on a route that is healthy (quarantined and cooling
+		// routes were left out above).
+		if !crewroute.Seatable(crewroute.Planner, c) {
+			continue
+		}
+		// ── end of the seat check ──
+		offer := CrewOffer{Model: c.Model, Routes: c.Routes}
+		offer.Served = len(off.Routes(c.Routes)) > 0
+		if rule.AdmitsModel(c.Model) {
+			for _, r := range off.Routes(c.Routes) {
+				if rule.AdmitsRoute(r.Provider) {
+					offer.Allowed = true
+					break
+				}
+			}
+		}
+		out = append(out, offer)
 	}
-	preset = strings.ToLower(strings.TrimSpace(preset))
-	models, ok := CrewModelsForSource(known, preset)
-	if !ok {
-		return fmt.Errorf("pick one of: %s", strings.Join(CrewPresets, ", "))
+	return out
+}
+
+// SetCrewAllowedRule writes a rule the panel composed ([crewroute.Allowed]'s
+// edits) through the rule's one writer, so a checklist tick is refused for
+// exactly the reason the typed form would be — a pinned seat it would leave
+// outside.
+func SetCrewAllowedRule(profileDir string, rule crewroute.Allowed) error {
+	return writeCrewAllowed(profileDir, rule)
+}
+
+// CrewState is the crew's persisted rows as they stand — the three seats, the
+// allowed rule, the cap, the providers turned off and the free-routes switch,
+// raw — which is what the panel's undo puts back.
+//
+// IT IS THE ROWS AND NOT A READING OF THEM. An undo that re-wrote what the
+// readers made of the rows would turn a hand-written `auto` into an absent
+// row, or a preset's legacy row into a pin; putting the bytes back is the only
+// undo that restores exactly what was there.
+type CrewState struct {
+	values map[string]json.RawMessage
+}
+
+// crewStateKeys are the rows a [CrewState] carries.
+func crewStateKeys() []string {
+	keys := []string{KeyCrewAllowed, KeyCrewCap, KeyCrewTaskCap, KeyCrewProvidersOff, KeyCrewFreeRoutes}
+	for _, seat := range crewroute.Seats {
+		keys = append(keys, tierKeyFor(CrewSeatTier(seat)))
 	}
-	values := make(map[string]any, len(models)+1)
-	for tier, model := range models {
-		values[tierKeyFor(tier)] = model
+	return keys
+}
+
+// CrewStateAt reads the crew's rows as they stand.
+func CrewStateAt(profileDir string) CrewState {
+	state := CrewState{values: map[string]json.RawMessage{}}
+	for _, key := range crewStateKeys() {
+		if raw, ok := persistedValue(profileDir, key); ok {
+			state.values[key] = raw
+		}
 	}
-	if known != persisted {
-		values[KeyCrewSource] = known
+	return state
+}
+
+// RestoreCrewState writes a [CrewState] back, IN ONE FILE WRITE: a row that
+// was absent is removed, and every other row gets its old bytes.
+func RestoreCrewState(profileDir string, state CrewState) error {
+	values := map[string]any{}
+	for _, key := range crewStateKeys() {
+		if raw, ok := state.values[key]; ok {
+			values[key] = raw
+			continue
+		}
+		values[key] = removeProfileKey
 	}
 	return writeProfileValues(profileDir, values)
 }
 
-// writeCrew is the row's writer: the same refusal wording every choice row uses,
-// and then the atomic write.
-func writeCrew(profileDir, raw string) error {
-	return ApplyCrew(profileDir, raw)
+// CrewGapsAt names what the allowed models leave uncovered, for the panel's
+// one-line warning. A pinned seat is judged by its pin alone, read from the
+// catalog whether or not a route to it is healthy right now, because the pin
+// is what the seat runs.
+func CrewGapsAt(profileDir string) []crewroute.Gap {
+	pins := map[crewroute.Seat]crewroute.Model{}
+	for seat, pin := range CrewPinsAt(profileDir) {
+		model, known := crewCatalogModel(pin.Model)
+		if !known {
+			model = crewroute.Model{ID: pin.Model}
+		}
+		pins[seat] = model
+	}
+	return crewroute.Gaps(CrewCandidatesAt(profileDir), pins)
+}
+
+// ── one task's crew ─────────────────────────────────────────────────────────
+
+// CrewAsk is one task's request for a crew.
+type CrewAsk struct {
+	Task crewroute.Task
+	// Effort is the one-task word: best, cheap, or the knee.
+	Effort crewroute.Effort
+	// Pins are ONE-TASK pins, laid over the profile's: `--pin` and the seat
+	// flags. They never persist.
+	Pins map[crewroute.Seat]CrewPin
+	// Sends are seats a door has already filled with an id to send as it
+	// stands — a flag, a variable — which the router treats as pins.
+	Sends map[crewroute.Seat]string
+	// Stronger is the crew that ran, for a redo that asks for a stronger one.
+	Stronger *crewroute.Decision
+	// Again is the crew that ran and never started, for a redo of it: the
+	// next-best models at the same cost, not a stronger crew.
+	Again *crewroute.Decision
+	// ChatModel is the model the person is talking to — proven reachable —
+	// the last rung of a seat's ladder when nothing routed can start.
+	ChatModel string
+	// Repo keys the learned offset: a repository whose work of one class was
+	// redone stronger starts that class a step higher.
+	Repo string
 }
 
-// SetCrewSource writes the family row ALONE, in one file write. The settings
-// row is its caller; the chooser commits the family and the preset together
-// through [ApplyCrewUnder]. The word is refused the way every choice row refuses
-// one, so a typo cannot land a family nothing reads.
-func SetCrewSource(profileDir, source string) error {
-	known, ok := knownCrewSource(source)
-	if !ok {
-		return fmt.Errorf("pick one of: %s", strings.Join(CrewSources, ", "))
+// ErrCrewAtCap is a crew asked for with the day's crew spend already at the
+// daily cap. The decision still comes back: the chat asks the person, and a
+// headless run refuses unless told `-yes-spend`.
+var ErrCrewAtCap = errors.New("today's crew spend has reached the daily cap")
+
+// CrewHistory is how the router's log reaches crew routing: today's crew
+// spend and the learned offsets, read out of the profile's router-events log
+// (internal/router's crew.go). It is a variable so a test can hand a day of
+// its own; nil reads as a day with nothing spent and nothing learned — the
+// state of a fresh install, not an error.
+var CrewHistory = func(profileDir string) CrewDay {
+	log := router.ReadCrewLog(ProfilePath(profileDir, ""), time.Now())
+	return CrewDay{SpentUSD: log.SpentUSD, Offsets: log.Offsets, CostFactor: log.CostFactor, Learned: crewLearned(log.Quality)}
+}
+
+// crewLearned is the log's learned quality moves keyed the way the router
+// reads them ([crewroute.LearnKey]): the ids a seat ran folded to their
+// lineage, the moves of one lineage averaged.
+func crewLearned(quality map[string]float64) map[string]float64 {
+	if len(quality) == 0 {
+		return nil
 	}
-	return writeProfileValue(profileDir, KeyCrewSource, known)
+	sums, counts := map[string]float64{}, map[string]int{}
+	for key, move := range quality {
+		parts := strings.SplitN(key, "\x00", 3)
+		if len(parts) != 3 {
+			continue
+		}
+		k := crewroute.LearnKey(crewroute.Class(parts[0]), crewroute.Seat(parts[1]), parts[2])
+		sums[k] += move
+		counts[k]++
+	}
+	out := make(map[string]float64, len(sums))
+	for k, sum := range sums {
+		out[k] = sum / float64(counts[k])
+	}
+	return out
 }
 
-// CrewSummary is the one line a crew change confirms itself with:
-//
-//	crew → balanced · brain claude-opus-5 · hands glm-5.3-flash · checks claude-fable-5.1
-//
-// The three names are the classes a person actually asked about — what thinks,
-// what works, what checks — and HANDS IS THE WORKER: the seat that does the
-// task, which is what everybody reading the word took it to mean back when it
-// named the small-work tier. The reflex and small-work models are deliberately
-// absent: they are the same near-free models in all three presets, so naming
-// them would be facts that never vary. The ids are shortened to their base names
-// because the vendor prefix is the half nobody reads twice.
-func CrewSummary(profileDir string) string {
-	return crewSummaryWith(profileDir, "")
-}
-
-// CrewSummaryPick is the confirmation with the pick named when it is not the
-// default one:
-//
-//	crew → balanced · learn · brain claude-opus-5 · hands glm-5.3-flash · checks claude-fable-5.1
+// CrewRecordOf is one decision as the router's log keeps it.
+func CrewRecordOf(d crewroute.Decision, repo, title string) router.CrewRecord {
+	record := router.CrewRecord{
+		TaskClass: string(d.Class), Repo: repo, Title: title, Effort: string(d.Effort), Steps: d.Steps,
+		Seats: map[string]string{}, Providers: map[string]string{}, Kinds: map[string]string{}, EstUSD: d.EstUSD,
+		Redo: d.Redo, EstBase: d.EstUSD, TaskSubclass: d.Subclass, TaskReach: d.Reach,
+	}
+	if d.CostFactor > 0 {
+		record.EstBase = d.EstUSD / d.CostFactor
+	}
+	for _, pick := range d.Crew {
+		if pick.Learned != 0 {
+			if record.Learned == nil {
+				record.Learned = map[string]float64{}
+			}
+			record.Learned[string(pick.Seat)] = pick.Learned
+		}
+		record.Seats[string(pick.Seat)] = pick.Send
+		if pick.Provider != "" {
+			record.Providers[string(pick.Seat)] = pick.Provider
+		}
+		if pick.Kind != "" {
+			record.Kinds[string(pick.Seat)] = string(pick.Kind)
+		}
+		if pick.Pinned {
+			record.Pinned = append(record.Pinned, string(pick.Seat))
+		}
+	}
+	return record
+}
+
+// LogCrewDecision writes one task's crew decision into the profile's router
+// log, under the call id the outcome will settle.
+func LogCrewDecision(profileDir, call string, d crewroute.Decision, repo, title string) {
+	record := CrewRecordOf(d, repo, title)
+	record.Top = crewTop(profileDir, d)
+	router.LogCrewDecision(ProfilePath(profileDir, ""), call, record, CrewCandidateNames(profileDir))
+}
+
+// LogCrewOutcome settles it: accepted, redone stronger, or not kept.
+func LogCrewOutcome(profileDir, call string, d crewroute.Decision, repo, title, outcome string, costUSD float64) {
+	router.LogCrewOutcome(ProfilePath(profileDir, ""), call, CrewRecordOf(d, repo, title), outcome, costUSD)
+}
+
+// CrewCandidateNames is what a logged decision was made among.
 //
-// The pick rides the preset word because the two are one decision read at two
-// heights — how much to spend, and where the models for that money come from
-// — and a confirmation that said only `balanced` would drop the half the
-// person just changed. At the default pick this is [CrewSummary] itself, so a
-// profile nobody has taught the pick to confirms exactly as it always has.
-func CrewSummaryPick(profileDir string) string {
-	return crewSummaryWith(profileDir, CrewPickAt(profileDir))
+// ONLY WHAT COULD SIT A SEAT IS NAMED: a speech, image or embedding model the
+// catalog lists is no candidate for a crew, and a log row naming it would
+// claim the router weighed it.
+func CrewCandidateNames(profileDir string) []string {
+	return crewroute.Names(crewSeatableOnly(CrewCandidatesAt(profileDir)))
 }
 
-// crewSummaryWith is the line both summaries are built from: the pick named
-// between the preset and the three classes when one was given that is not the
-// default, and never otherwise — a profile at the default pick confirms in
-// the words it has always confirmed in.
-func crewSummaryWith(profileDir, pick string) string {
-	head := "crew → " + CrewAt(profileDir)
-	if pick != "" && pick != CrewPickTable {
-		head += " · " + pick
+// crewSeatableOnly is the candidates that can sit at least one seat.
+func crewSeatableOnly(candidates []crewroute.Candidate) []crewroute.Candidate {
+	var out []crewroute.Candidate
+	for _, c := range candidates {
+		for _, seat := range crewroute.Seats {
+			if crewroute.Seatable(seat, c) {
+				out = append(out, c)
+				break
+			}
+		}
 	}
-	return head + " · " + CrewClasses(profileDir)
+	return out
 }
 
-// CrewClasses is the three class names alone:
-//
-//	brain claude-opus-5 · hands glm-5.3-flash · checks claude-fable-5.1
-//
-// It is the tail of [CrewSummary] lifted out because a second surface prints the
-// crew now — /status, where the word already has a label of its own and "crew →"
-// in front of it would say the word twice. ONE SOURCE OF TRUTH: the three names,
-// their order and their separator are spelled here once, so the confirmation a
-// person reads after /crew and the line they read in /status cannot drift into
-// naming the same four models differently.
-func CrewClasses(profileDir string) string {
-	ids := CrewClassModels(profileDir)
-	return "brain " + ids[0] + " · hands " + ids[1] + " · checks " + ids[2]
-}
-
-// CrewClassModels is the three ids [CrewClasses] names, in that order and
-// without the role words in front of them:
-//
-//	claude-opus-5, glm-5.3-flash, claude-fable-5.1
+// crewTop is a decision's best three per seat, re-weighed at its λ over the
+// candidates it was routed among, for the log row.
+func crewTop(profileDir string, d crewroute.Decision) map[string][]router.CrewScore {
+	candidates, _ := crewCandidatesNoticed(profileDir, crewHealthAt(profileDir).probing())
+	var learned map[string]float64
+	if CrewHistory != nil {
+		learned = CrewHistory(profileDir).Learned
+	}
+	out := map[string][]router.CrewScore{}
+	for seat, ranked := range crewroute.Explain(d.Class, d.Lambda, candidates, learned, crewTopN) {
+		for _, s := range ranked {
+			route := s.Provider
+			if s.Kind != "" {
+				route += ":" + string(s.Kind)
+			}
+			out[string(seat)] = append(out[string(seat)], router.CrewScore{Model: s.Model, Route: route, Q: s.Quality, C: s.CostUSD, S: s.Score})
+		}
+	}
+	return out
+}
+
+// crewTopN is how many candidates a log row keeps per seat.
+const crewTopN = 3
+
+// CrewLogAt is the router log's account of crews on this profile, for the
+// panel: today's spend and tasks and the recent ones.
+func CrewLogAt(profileDir string) router.CrewLog {
+	return router.ReadCrewLog(ProfilePath(profileDir, ""), time.Now())
+}
+
+// CrewDay is what the log says about crews: today's spend, and the learned
+// escalation offset per repository and class.
+type CrewDay struct {
+	SpentUSD float64
+	Offsets  map[string]int
+	// CostFactor is the learned estimate factor per class
+	// ([router.CrewLog.CostFactor]).
+	CostFactor map[string]float64
+	// Learned is this install's learned quality moves, keyed
+	// [crewroute.LearnKey] ([router.CrewLog.Quality]).
+	Learned map[string]float64
+}
+
+// OffsetKey is the key [CrewDay.Offsets] is read under.
+func OffsetKey(repo string, class crewroute.Class) string {
+	return strings.TrimSpace(repo) + "\x00" + string(class)
+}
+
+// RouteCrew picks one task's crew on this profile: the seats pinned there or
+// for this task run their pins, and every other seat is routed.
 //
-// It exists because a surface drawing the crew line has to be able to say which
-// runs of it are the ANSWER — the ids a person typed /crew to change — and which
-// are the labels around them (internal/tui3's payload.go). Reading them back out
-// of the sentence would be a second parser for a string this file just built, so
-// the sentence is built from this list instead and the two cannot disagree about
-// how many models there are or which order they come in.
-func CrewClassModels(profileDir string) []string {
-	return []string{
-		shortModel(TierModelAt(profileDir, ModelTierMastermind)),
-		shortModel(TierModelAt(profileDir, ModelTierWorker)),
-		shortModel(TierModelAt(profileDir, ModelTierHigh)),
-	}
-}
-
-// shortModel is a model id without its vendor prefix, and the level kept. THE
-// EMPTINESS LAW: a class that follows the conversation has no id to print, and
-// says so in words rather than leaving a gap a reader has to interpret.
-func shortModel(value string) string {
-	value = strings.TrimSpace(value)
-	if value == "" {
-		return "the conversation"
+// The class is read first, so the learned offset for this repository and this
+// class of work can move the price of a point before the seats are picked. A
+// day at its cap still answers with the crew it would run, beside
+// [ErrCrewAtCap]; a seat nothing allowed can sit is a [crewroute.NoCandidateError].
+func RouteCrew(profileDir string, ask CrewAsk) (crewroute.Decision, error) {
+	reading := crewroute.Classify(ask.Task)
+	providers := CrewProvidersAt(profileDir)
+	pins := map[crewroute.Seat]crewroute.Pin{}
+	for seat, pin := range CrewPinsAt(profileDir) {
+		pins[seat] = resolveCrewPin(pin, providers)
 	}
-	if at := strings.LastIndex(value, "/"); at >= 0 {
-		return value[at+1:]
+	for seat, pin := range ask.Pins {
+		pins[seat] = resolveCrewPin(pin, providers)
 	}
-	return value
+	for seat, send := range ask.Sends {
+		if send = strings.TrimSpace(send); send != "" {
+			pins[seat] = resolveCrewPin(CrewPin{Model: send}, providers)
+		}
+	}
+	day := CrewDay{}
+	if CrewHistory != nil {
+		day = CrewHistory(profileDir)
+	}
+	pace, atCap := crewroute.Pace(day.SpentUSD, CrewCapAt(profileDir))
+	health := crewHealthAt(profileDir)
+	// AN ACCOUNT OUT OF CREDIT, OR A KEY REFUSED, IS PROBED BY THE NEXT TASK:
+	// its paid routes are routed as usual, so the task's first seat call is
+	// the probe. A 200 clears the account on the spot; another refusal moves
+	// the seat down its ladder inside the task (to a free pool, when nothing
+	// paid is left), costing one refused call. Without the probe an account
+	// topped up would never be asked again.
+	candidates, notice := crewCandidatesNoticed(profileDir, health.probing())
+	req := crewroute.Request{
+		Task:       ask.Task,
+		Class:      reading.Class,
+		Reading:    &reading,
+		Candidates: candidates,
+		Pins:       pins,
+		Effort:     ask.Effort,
+		Steps:      day.Offsets[OffsetKey(ask.Repo, reading.Class)],
+		Pace:       pace,
+		Stronger:   ask.Stronger,
+		Again:      ask.Again,
+		Avoid:      health.demoted,
+		Learned:    day.Learned,
+		CostFactor: day.CostFactor[string(reading.Class)],
+		TaskCap:    CrewTaskCapAt(profileDir),
+	}
+	d, err := crewroute.Decide(req)
+	if err != nil && !errors.Is(err, crewroute.ErrStrongest) {
+		// NO CREW CAN BE FORMED: the seat nothing can sit goes down the rest of
+		// the ladder — the last crew that worked here, the person's own model
+		// — and with nothing left the answer is the one thing to do.
+		d, err = crewRescued(profileDir, req, health, ask.ChatModel, err)
+	}
+	if err != nil {
+		return crewroute.Decision{}, err
+	}
+	if notice != "" {
+		d.Note = strings.TrimSpace(strings.TrimPrefix(d.Note+" · "+notice, " · "))
+	}
+	d.Why, d.Sure = reading.Why, reading.Sure
+	d.Redo = ask.Stronger != nil || ask.Again != nil
+	if atCap {
+		return d, ErrCrewAtCap
+	}
+	return d, nil
+}
+
+// resolveCrewPin is a pin with the route it will run on: the provider it
+// names, or the connection its own prefix names, or the default service.
+func resolveCrewPin(pin CrewPin, providers []CrewProvider) (out crewroute.Pin) {
+	out = crewroute.Pin{Model: stripCrewRoute(pin.Model), Provider: pin.Provider, Send: pin.Model, Kind: crewroute.Metered}
+	if crewroute.IsFree(out.Model) {
+		// A pinned free pool runs on that pool and is weighed as one.
+		defer func() { out.Kind = crewroute.Free }()
+	}
+	model, known := crewCatalogModel(pin.Model)
+	if known && !crewroute.IsFree(out.Model) && !strings.EqualFold(model.ID, out.Model) {
+		// THE CATALOG DOES NOT LIST THE ID AS WRITTEN, only a variant of it:
+		// the pin is sent as that variant, and the line says so.
+		pin.Model, out.Send = model.ID, model.ID
+	}
+	if pin.Provider != "" {
+		if p, ok := crewProviderByID(providers, pin.Provider); ok {
+			if r, ok := p.route(pin.Model, model, known); ok {
+				out.Provider, out.Send, out.Kind = r.Provider, r.Send, r.Kind
+			}
+		}
+		return out
+	}
+	// No provider named: the id itself says where it goes, the way every call
+	// reads it — a connection's own prefix, or the default service.
+	for _, p := range providers {
+		if p.ID == modelsource.DefaultID {
+			continue
+		}
+		if prefix := strings.ToLower(p.Written) + "/"; strings.HasPrefix(strings.ToLower(pin.Model), prefix) {
+			out.Provider, out.Kind = p.ID, p.Kind
+			return out
+		}
+	}
+	for _, p := range providers {
+		if p.ID == modelsource.DefaultID {
+			out.Provider = p.ID
+		}
+	}
+	return out
+}
+
+// standingCrewSeat is a routed seat for the calls that ride a crew seat's
+// tier without a task in front of them — the conversation's own planner and
+// careful calls. They are routed as work of no particular class, so an
+// unpinned seat never falls back to a model this build chose for everybody.
+// A profile with nothing the router can pick answers empty, which is the role
+// ladder's own floor: the model the person is talking to.
+func standingCrewSeat(profileDir string, seat crewroute.Seat) string {
+	d, err := crewroute.Decide(crewroute.Request{Class: crewroute.Other, Candidates: CrewCandidatesAt(profileDir)})
+	if err != nil {
+		return ""
+	}
+	return d.Seat(seat).Send
 }
 
 // ── the gate on a tier value ────────────────────────────────────────────────
 
-// writeTierModel is the writer all five tier rows share: validate the notation,
-// then persist. It is one function rather than five closures so a sixth tier
-// cannot arrive with a gate somebody forgot to put on it.
+// writeTierModel is the writer the two rows that are not crew seats share:
+// validate the notation, then persist. The crew's three rows write through
+// [SetCrewPin], which runs the same gate and the allowed-models rule besides.
 func writeTierModel(profileDir, tier, raw string) error {
 	raw = strings.TrimSpace(raw)
 	if err := ValidateTierValue(raw); err != nil {
diff --git a/internal/config/crew_test.go b/internal/config/crew_test.go
index 70b2c20a4f..6b458d65ad 100644
--- a/internal/config/crew_test.go
+++ b/internal/config/crew_test.go
@@ -1,643 +1,548 @@
 package config
 
 import (
-	"encoding/json"
-	"os"
+	"errors"
+	"slices"
 	"strings"
 	"testing"
 
-	"github.com/Agent-Field/codeaf/internal/roles"
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 )
 
-// THE CREW, from the three sides a person meets it: what a preset writes, what
-// the row says about four values it did not write, and what the row refuses.
-
-// THE SHIPPED DEFAULTS ARE A PRESET AND NOT FOUR OPINIONS. This is the identity
-// the whole derived reading rests on: if the four defaults were not exactly one
-// preset's row, a profile nobody had touched would read "custom" about values
-// this build chose itself.
-func TestTheShippedTierDefaultsAreExactlyTheBalancedCrew(t *testing.T) {
-	balanced, ok := CrewModels(CrewBalanced)
-	if !ok {
-		t.Fatal("there is no balanced preset")
-	}
-	for _, c := range []struct{ tier, want string }{
-		{ModelTierReflex, DefaultReflexModel},
-		{ModelTierLow, DefaultLowModel},
-		{ModelTierWorker, DefaultWorkerModel},
-		{ModelTierHigh, DefaultHighModel},
-		{ModelTierMastermind, DefaultMastermindModel},
-	} {
-		if balanced[c.tier] != c.want {
-			t.Errorf("balanced sets %s to %q, and the shipped default is %q",
-				c.tier, balanced[c.tier], c.want)
-		}
+// crewProfile is a profile with an OpenRouter key and a small catalog, the
+// ordinary state a crew is routed in. Every variable a seat or a key reads
+// is cleared so the machine running the test cannot answer for it.
+func crewProfile(t *testing.T) string {
+	t.Helper()
+	for _, name := range []string{APIKeyEnv, "OPENAI_API_KEY", ModelEnv, PlanModelEnv, CheckModelEnv, "CODEAF_BASE_URL",
+		"DEEPSEEK_API_KEY", "ZHIPU_API_KEY", "MOONSHOT_API_KEY", "MINIMAX_API_KEY", "DASHSCOPE_API_KEY"} {
+		t.Setenv(name, "")
 	}
-	if got := CrewAt(t.TempDir()); got != DefaultCrew {
-		t.Fatalf("a profile nobody has touched reads the crew as %q, want %q", got, DefaultCrew)
+	dir := t.TempDir()
+	if err := WriteAPIKey(dir, "sk-or-v1-crewtest-0123456789"); err != nil {
+		t.Fatal(err)
 	}
+	previous := CrewCatalog
+	t.Cleanup(func() { CrewCatalog = previous })
+	rows := []catalog.Model{
+		{ID: "z-ai/glm-5.3-flash", CanonicalSlug: "z-ai/glm-5.3-flash-20260826", OpenWeights: true, PromptPrice: 1.5e-7, CompletionPrice: 5e-7, CacheReadPrice: 5e-8,
+			IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ArenaElo: 1348, ContextLength: 1310720, Parameters: []string{"tools"}},
+		{ID: "moonshotai/kimi-k3", CanonicalSlug: "moonshotai/kimi-k3-20260715", OpenWeights: true, PromptPrice: 3e-6, CompletionPrice: 1.5e-5, CacheReadPrice: 3e-7,
+			IntelligenceIndex: 43.6, CodingIndex: 76.2, AgenticIndex: 50, ArenaElo: 1421, ContextLength: 1048576, Parameters: []string{"tools"}},
+		{ID: "deepseek/deepseek-v4-flash", CanonicalSlug: "deepseek/deepseek-v4-flash-20260423", OpenWeights: true, PromptPrice: 8.246e-8, CompletionPrice: 1.6492e-7, CacheReadPrice: 1.6492e-8,
+			IntelligenceIndex: 24.2, CodingIndex: 56.2, AgenticIndex: 22.2, ArenaElo: 1216, ContextLength: 1048576, Parameters: []string{"tools"}},
+		{ID: "anthropic/claude-opus-5", CanonicalSlug: "anthropic/claude-opus-5-20260723", PromptPrice: 5e-6, CompletionPrice: 2.5e-5, CacheReadPrice: 5e-7,
+			IntelligenceIndex: 50.8, CodingIndex: 78, AgenticIndex: 56.5, ArenaElo: 1372, ContextLength: 1000000, Parameters: []string{"tools"}},
+		{ID: "vendor/no-tools", PromptPrice: 1e-9, CompletionPrice: 1e-9, Parameters: []string{"temperature"}},
+		{ID: "vendor/unpriced", PriceUnknown: true, Parameters: []string{"tools"}},
+	}
+	CrewCatalog = func() []catalog.Model { return rows }
+	return dir
 }
 
-// THE OPEN FAMILY IS LOCKED TOO, and this is its page. It is read through
-// [CrewModelsForSource] and not [CrewModels], because the bare spelling answers
-// the DEFAULT family and the default family is the catalog-wide one — the all
-// table's own page is [TestTheAllFamilyNamesTheLockedModels].
-func TestCrewPresetsNameTheApprovedModels(t *testing.T) {
-	want := map[string]map[string]string{
-		CrewFrugal: {
-			ModelTierReflex:     "mistralai/mistral-nemo",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3-flash",
-			ModelTierHigh:       "z-ai/glm-5.3-flash",
-			ModelTierMastermind: "z-ai/glm-5.3-flash",
-		},
-		CrewBalanced: {
-			ModelTierReflex:     "mistralai/mistral-nemo",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3-flash",
-			ModelTierHigh:       "moonshotai/kimi-k3",
-			ModelTierMastermind: "z-ai/glm-5.3",
-		},
-		CrewMax: {
-			ModelTierReflex:     "mistralai/mistral-nemo",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3",
-			ModelTierHigh:       "moonshotai/kimi-k3",
-			ModelTierMastermind: "z-ai/glm-5.3",
-		},
-	}
-	for preset, expected := range want {
-		got, ok := CrewModelsForSource(CrewSourceOpen, preset)
-		if !ok {
-			t.Fatalf("there is no %s preset", preset)
+const (
+	fixTask  = "fix: crash when the config file is empty\n\nTraceback (most recent call last):\nValueError: empty"
+	openTask = "Add a --json flag to the status command so scripts can read it"
+)
+
+func TestAnUntouchedProfileRoutesEverySeat(t *testing.T) {
+	dir := crewProfile(t)
+	seats, err := ResolveSeats(dir, SeatFlags{}, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A fix: the model the catalog reads as able for its price in every seat —
+	// the cheaper v4-flash publishes weaker indexes, and a checker's ability
+	// must reach the floor.
+	for seat, want := range map[Seat]string{seats.Work: "z-ai/glm-5.3-flash", seats.Plan: "z-ai/glm-5.3-flash", seats.Check: "z-ai/glm-5.3-flash"} {
+		if seat.Source != SeatRouted || seat.Model != want {
+			t.Errorf("%s: %+v, want routed to %s on a fix", seat.Role, seat, want)
 		}
-		for _, tier := range ModelTiers {
-			if got[tier] != expected[tier] {
-				t.Errorf("%s sets %s to %q, want %q", preset, tier, got[tier], expected[tier])
-			}
+	}
+	if seats.Crew == nil || seats.Crew.Class != crewroute.Bugfix {
+		t.Fatalf("crew %+v, want a bugfix decision", seats.Crew)
+	}
+	fixEst := seats.Crew.EstUSD
+	seats, err = ResolveSeats(dir, SeatFlags{}, CrewAsk{Task: crewroute.Task{Text: openTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if seats.Work.Model != "z-ai/glm-5.3-flash" || seats.Crew.EstUSD <= fixEst {
+		t.Errorf("open-ended: worker %s at $%.3f; want the flash worker on a dearer crew than the fix's $%.3f",
+			seats.Work.Model, seats.Crew.EstUSD, fixEst)
+	}
+	for _, m := range []string{seats.Work.Model, seats.Plan.Model, seats.Check.Model} {
+		if strings.Contains(m, "opus") || strings.Contains(m, "fable") {
+			t.Errorf("a seat fell to %s", m)
 		}
 	}
 }
 
-// Every preset names every class, and every model in it is a whole slug. A
-// preset with a gap in it would write a blank into a tier row, which means
-// "follow the conversation" — the opposite of choosing a crew.
-func TestEveryPresetNamesEveryClass(t *testing.T) {
-	for _, preset := range CrewPresets {
-		models, ok := CrewModels(preset)
-		if !ok {
-			t.Fatalf("%s is in CrewPresets and has no models", preset)
-		}
-		for _, tier := range ModelTiers {
-			model := models[tier]
-			if strings.TrimSpace(model) == "" {
-				t.Errorf("%s leaves %s blank, which means follow the conversation", preset, tier)
-			}
-			if !strings.Contains(model, "/") {
-				t.Errorf("%s sets %s to %q, which is not a provider-qualified id", preset, tier, model)
-			}
-			// A level is only ever legible on a value the gate accepts.
-			if err := ValidateTierValue(model); err != nil {
-				t.Errorf("%s sets %s to %q, which its own row would refuse: %v", preset, tier, model, err)
-			}
-		}
-		if CrewLine(preset) == "" {
-			t.Errorf("%s has no line to say about itself", preset)
-		}
+// THE CHECK SEAT NEVER QUIETLY INHERITS THE PLANNER. A person who pinned the
+// planner said something about planning; the checker is routed for the task.
+func TestAPlanFlagDoesNotSeatTheChecker(t *testing.T) {
+	dir := crewProfile(t)
+	seats, err := ResolveSeats(dir, SeatFlags{PlanModel: "anthropic/claude-opus-5"}, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if CrewLine(CrewCustom) != "" {
-		t.Error("custom has a line, and custom is a reading rather than a choice")
+	if seats.Plan.Source != SeatFlag || seats.Plan.Model != "anthropic/claude-opus-5" {
+		t.Errorf("planner %+v, want the flag", seats.Plan)
 	}
-	if _, ok := CrewModels(CrewCustom); ok {
-		t.Error("custom names four models, and it is not a preset")
+	if seats.Check.Source != SeatRouted || seats.Check.Model == "anthropic/claude-opus-5" {
+		t.Errorf("checker %+v inherited the planner's flag", seats.Check)
+	}
+	if !seats.Crew.Seat(crewroute.Planner).Pinned {
+		t.Error("the flag did not reach the router as a one-task pin")
 	}
 }
 
-// Setting a preset writes all five tier keys, and the row reads that preset back.
-func TestSettingAPresetWritesAllFiveTiers(t *testing.T) {
-	dir := t.TempDir()
-	rows := registry(t, dir)
-	crew := mustRow(t, rows, KeyCrew)
-
-	if err := crew.Apply(CrewMax); err != nil {
-		t.Fatalf("setting the crew to max: %v", err)
-	}
-	want, _ := CrewModels(CrewMax)
-	for _, tier := range ModelTiers {
-		if got := TierModelAt(dir, tier); got != want[tier] {
-			t.Errorf("after max, the %s tier reads %q, want %q", tier, got, want[tier])
-		}
-	}
-	if got := CrewAt(dir); got != CrewMax {
-		t.Fatalf("the crew reads %q after max was set", got)
+func TestTheLadderFlagThenEnvThenPinThenRouter(t *testing.T) {
+	dir := crewProfile(t)
+	if err := SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
 	}
-	// THE FIVE KEYS ARE ON DISK, all of them, in one file — a preset is not a
-	// word stored beside four rows it claims to have written.
-	values := map[string]json.RawMessage{}
-	raw, err := os.ReadFile(BudgetConfigPath(dir))
+	t.Setenv(ModelEnv, "deepseek/deepseek-v4-flash")
+	seats, err := ResolveSeats(dir, SeatFlags{}, CrewAsk{Task: crewroute.Task{Text: fixTask}})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := json.Unmarshal(raw, &values); err != nil {
-		t.Fatal(err)
+	if seats.Work.Source != SeatEnv || seats.Work.Rung() != ModelEnv {
+		t.Errorf("worker %+v, want the variable", seats.Work)
 	}
-	for _, tier := range ModelTiers {
-		if _, written := values[tierKeyFor(tier)]; !written {
-			t.Errorf("%s is not in config.json after a preset was applied", tierKeyFor(tier))
-		}
+	if seats.Check.Source != SeatPinned || seats.Check.Model != "moonshotai/kimi-k3" {
+		t.Errorf("checker %+v, want the profile pin", seats.Check)
 	}
-	if _, written := values[KeyCrew]; written {
-		t.Error("models.crew was stored — the reading is derived, and a stored word can become a lie")
+	if seats.Plan.Source != SeatRouted {
+		t.Errorf("planner %+v, want routed", seats.Plan)
 	}
-
-	if err := crew.Apply(CrewFrugal); err != nil {
-		t.Fatalf("setting the crew to frugal: %v", err)
+	seats, _ = ResolveSeats(dir, SeatFlags{Model: "z-ai/glm-5.3-flash"}, CrewAsk{Task: crewroute.Task{Text: fixTask},
+		Pins: map[crewroute.Seat]CrewPin{crewroute.Checker: {Model: "deepseek/deepseek-v4-flash"}}})
+	if seats.Work.Source != SeatFlag {
+		t.Errorf("a flag lost to the variable: %+v", seats.Work)
+	}
+	if seats.Check.Model != "deepseek/deepseek-v4-flash" || seats.Check.Source != SeatPinned {
+		t.Errorf("a one-task --pin lost to the profile pin: %+v", seats.Check)
 	}
-	if got := CrewAt(dir); got != CrewFrugal {
-		t.Fatalf("the crew reads %q after frugal was set", got)
+	// And the one-task pin did not persist.
+	if pin, _ := CrewPinAt(dir, crewroute.Checker); pin.Model != "moonshotai/kimi-k3" {
+		t.Errorf("the profile pin moved to %q", pin.Model)
 	}
 }
 
-// ANSWERING ONE TIER ROW TURNS THE CREW TO CUSTOM, because that is what happened.
-func TestAnsweringOneTierRowMakesTheCrewCustom(t *testing.T) {
-	dir := t.TempDir()
-	rows := registry(t, dir)
-
-	if err := mustRow(t, rows, KeyCrew).Apply(CrewBalanced); err != nil {
+func TestPinsRoundTripAndRefuseWhatTheRuleLeavesOut(t *testing.T) {
+	dir := crewProfile(t)
+	if err := SetCrewPin(dir, crewroute.Worker, "z-ai/glm-5.3-flash@openrouter"); err != nil {
 		t.Fatal(err)
 	}
-	if err := mustRow(t, rows, KeyTierMastermindModel).Apply("openai/gpt-5"); err != nil {
-		t.Fatal(err)
-	}
-	if got := CrewAt(dir); got != CrewCustom {
-		t.Fatalf("the crew reads %q over a hand-set mastermind, want %q", got, CrewCustom)
+	pin, ok := CrewPinAt(dir, crewroute.Worker)
+	if !ok || pin.Model != "z-ai/glm-5.3-flash" || pin.Provider != "openrouter" {
+		t.Fatalf("pin read back %+v, %v", pin, ok)
 	}
-	// And the row itself says so, which is the whole point: the summary cannot
-	// disagree with the four rows it summarizes.
-	if got := mustRow(t, registry(t, dir), KeyCrew).Value(); got != CrewCustom {
-		t.Fatalf("the crew row reads %q", got)
+	if got := mustRow(t, registry(t, dir), KeyTierWorkerModel).Value(); got != "z-ai/glm-5.3-flash@openrouter" {
+		t.Errorf("the worker row reads %q", got)
 	}
-
-	// A tier CLEARED on purpose is custom too — "one of these follows the
-	// conversation" is not any of the three presets.
-	if err := mustRow(t, rows, KeyTierMastermindModel).Apply(""); err != nil {
+	if err := SetCrewAllowed(dir, "open"); err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewCustom {
-		t.Fatalf("the crew reads %q with a cleared mastermind, want %q", got, CrewCustom)
+	if err := SetCrewPin(dir, crewroute.Planner, "anthropic/claude-opus-5"); err == nil || !strings.Contains(err.Error(), "outside the models you allow") {
+		t.Errorf("a closed model pinned under `open`: %v", err)
 	}
-
-	// Putting the preset back is one keystroke and heals all five.
-	if err := mustRow(t, registry(t, dir), KeyCrew).Apply(CrewBalanced); err != nil {
+	if err := SetCrewPin(dir, crewroute.Planner, "moonshotai/kimi-k3@fireworks"); err == nil || !strings.Contains(err.Error(), "not a connected provider") {
+		t.Errorf("a pin on an unconnected provider: %v", err)
+	}
+	// A rule that would strand a pin is refused and names the pin.
+	if err := SetCrewAllowed(dir, "≤0.1/0.2"); err == nil || !strings.Contains(err.Error(), "pinned to z-ai/glm-5.3-flash") {
+		t.Errorf("a rule that strands the worker pin: %v", err)
+	}
+	if err := SetCrewPin(dir, crewroute.Worker, "auto"); err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewBalanced {
-		t.Fatalf("the crew reads %q after balanced was set again", got)
+	if _, ok := CrewPinAt(dir, crewroute.Worker); ok {
+		t.Error("`auto` did not unpin the worker")
+	}
+	if got := mustRow(t, registry(t, dir), KeyTierWorkerModel).Value(); got != CrewAuto {
+		t.Errorf("an unpinned worker row reads %q, want auto", got)
 	}
 }
 
-// The row refuses a word that is not a preset, in the words every choice row
-// refuses in — and it refuses "custom", which is a reading and not a choice.
-func TestTheCrewRowRefusesAWordThatIsNotAPreset(t *testing.T) {
-	dir := t.TempDir()
-	crew := mustRow(t, registry(t, dir), KeyCrew)
-	for _, word := range []string{"cheap", CrewCustom, ""} {
-		err := crew.Apply(word)
-		if err == nil {
-			t.Fatalf("the crew row took %q", word)
-		}
-		if !strings.Contains(err.Error(), CrewBalanced) {
-			t.Errorf("refusing %q does not name the choices: %v", word, err)
+func TestTheAllowedRuleNarrowsTheCandidates(t *testing.T) {
+	dir := crewProfile(t)
+	ids := func() []string { return crewroute.Names(CrewCandidatesAt(dir)) }
+	all := ids()
+	for _, want := range []string{"anthropic/claude-opus-5", "z-ai/glm-5.3-flash"} {
+		if !slices.Contains(all, want) {
+			t.Errorf("all: %v is missing %s", all, want)
 		}
 	}
-	if got := CrewAt(dir); got != DefaultCrew {
-		t.Fatalf("a refused write changed the crew to %q", got)
+	if slices.Contains(all, "vendor/unpriced") {
+		t.Errorf("an unpriced row is a candidate: %v", all)
 	}
-}
-
-// ── the family the three words draw from ────────────────────────────────────
-
-// THE CAREFUL SEAT IS A SECOND VENDOR, IN EVERY PRESET OF THE ALL FAMILY.
-// A check from the same vendor as the work it checks is a check that shares
-// that vendor's blind spots. The open family's frugal row is the one standing
-// exception: worker and careful both sit on glm-5.3-flash there, because at
-// that preset's bill the open-weight front has no second vendor to take the
-// careful seat.
-func TestTheCarefulSeatIsAlwaysASecondVendorInEveryFamily(t *testing.T) {
-	vendor := func(id string) string {
-		if at := strings.Index(id, "/"); at > 0 {
-			return id[:at]
-		}
-		return id
+	if err := ModifyCrewAllowed(dir, false, "anthropic"); err != nil {
+		t.Fatal(err)
 	}
-	for _, family := range CrewSources {
-		for _, preset := range CrewPresets {
-			if family == CrewSourceOpen && preset == CrewFrugal {
-				continue
-			}
-			models, ok := CrewModelsForSource(family, preset)
-			if !ok {
-				t.Fatalf("there is no %s preset in the %s family", preset, family)
-			}
-			if vendor(models[ModelTierWorker]) == vendor(models[ModelTierHigh]) {
-				t.Errorf("%s under %s has %q working and %q checking, and a check from "+
-					"the same vendor catches what that vendor lets through",
-					preset, family, models[ModelTierWorker], models[ModelTierHigh])
-			}
-		}
+	if got := ids(); slices.Contains(got, "anthropic/claude-opus-5") {
+		t.Errorf("-anthropic left %v", got)
+	}
+	if got := CrewAllowedAt(dir).String(); got != "all -anthropic" {
+		t.Errorf("rule reads %q", got)
 	}
 }
 
-// THE ALL FAMILY IS LOCKED, not derived: this is the page that says which ids
-// the three words mean. A wrong id here is a person's bill, and a silent
-// rewrite of the locked table would be a decision made by a diff.
-func TestTheAllFamilyNamesTheLockedModels(t *testing.T) {
-	want := map[string]map[string]string{
-		CrewFrugal: {
-			ModelTierReflex:     "google/gemini-2.5-flash",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3-flash",
-			ModelTierHigh:       "qwen/qwen3.8-max-0902",
-			ModelTierMastermind: "z-ai/glm-5.3-flash",
-		},
-		CrewBalanced: {
-			ModelTierReflex:     "google/gemini-2.5-flash",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3-flash",
-			ModelTierHigh:       "anthropic/claude-fable-5.1",
-			ModelTierMastermind: "anthropic/claude-opus-5",
-		},
-		CrewMax: {
-			ModelTierReflex:     "google/gemini-2.5-flash",
-			ModelTierLow:        "deepseek/deepseek-v4-flash-0731",
-			ModelTierWorker:     "z-ai/glm-5.3",
-			ModelTierHigh:       "anthropic/claude-fable-5.1",
-			ModelTierMastermind: "anthropic/claude-opus-5",
-		},
-	}
-	for preset, expected := range want {
-		got, ok := CrewModelsForSource(CrewSourceAll, preset)
-		if !ok {
-			t.Fatalf("there is no %s preset in the all family", preset)
-		}
-		for _, tier := range ModelTiers {
-			if got[tier] != expected[tier] {
-				t.Errorf("%s under all sets %s to %q, want %q", preset, tier, got[tier], expected[tier])
-			}
-			if !strings.Contains(got[tier], "/") {
-				t.Errorf("%s under all sets %s to %q, which is not a provider-qualified id", preset, tier, got[tier])
-			}
-			if err := ValidateTierValue(got[tier]); err != nil {
-				t.Errorf("%s under all sets %s to %q, which its own row would refuse: %v", preset, tier, got[tier], err)
-			}
-		}
+func TestADailyCapPacesAndThenStops(t *testing.T) {
+	dir := crewProfile(t)
+	if err := SetCrewCap(dir, "1"); err != nil {
+		t.Fatal(err)
 	}
-	// THE LINES ARE PART OF THE TABLE, and they are the words a person reads while
-	// deciding to spend frontier money: a line naming a model the preset does not
-	// pick is the contradiction the chooser exists to prevent.
-	wantLines := map[string]map[string]string{
-		CrewSourceOpen: {
-			CrewFrugal:   "glm-flash works, checks and thinks · pennies a day",
-			CrewBalanced: "glm-flash works, kimi-k3 checks, glm-5.3 thinks",
-			CrewMax:      "glm-5.3 works and thinks, kimi-k3 checks",
-		},
-		CrewSourceAll: {
-			CrewFrugal:   "glm-flash works and thinks, qwen-max checks",
-			CrewBalanced: "glm-flash works, fable checks, opus thinks",
-			CrewMax:      "glm-5.3 works, fable checks, opus thinks",
-		},
-	}
-	for family, lines := range wantLines {
-		for preset, line := range lines {
-			if got := CrewLineFor(family, preset); got != line {
-				t.Errorf("the %s family's %s line is %q, want %q", family, preset, got, line)
-			}
-		}
+	previous := CrewHistory
+	t.Cleanup(func() { CrewHistory = previous })
+	spent := 0.99
+	CrewHistory = func(string) CrewDay { return CrewDay{SpentUSD: spent} }
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: openTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Seat(crewroute.Checker).Model == "moonshotai/kimi-k3" {
+		t.Error("at 99% of the cap an open-ended task still bought the dear checker")
+	}
+	spent = 1.2
+	if _, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: openTask}}); !errors.Is(err, ErrCrewAtCap) {
+		t.Errorf("over the cap: %v, want ErrCrewAtCap", err)
 	}
 }
 
-// A SOURCE NOBODY SET IS THE DEFAULT FAMILY, which is the catalog-wide one. The
-// open table exists beside it, but a profile that never answered the row
-// resolves `all`: the shipped defaults, the all presets under the same words,
-// and a write that lands the all ids. This is the default-preservation law for
-// the FAMILY. An unknown word is held to the same law, silently, the way a
-// retired choice reads everywhere else.
-func TestASourceNobodyAnsweredReadsTheDefaultFamily(t *testing.T) {
-	dir := t.TempDir()
-	if got := CrewSourceAt(dir); got != DefaultCrewSource {
-		t.Fatalf("an untouched profile reads the source as %q, want %q", got, DefaultCrewSource)
+func TestALearnedOffsetStartsARedoneClassHigher(t *testing.T) {
+	dir := crewProfile(t)
+	previous := CrewHistory
+	t.Cleanup(func() { CrewHistory = previous })
+	CrewHistory = func(string) CrewDay {
+		return CrewDay{Offsets: map[string]int{OffsetKey("repo", crewroute.Bugfix): 1}}
 	}
-	if got := CrewAt(dir); got != DefaultCrew {
-		t.Fatalf("an untouched profile reads the crew as %q, want %q", got, DefaultCrew)
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}, Repo: "repo"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	plain, _ := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}, Repo: "elsewhere"})
+	if d.Quality <= plain.Quality || d.EstUSD <= plain.EstUSD {
+		t.Errorf("a fix class redone here starts at quality %.2f ($%.3f), not above another repository's %.2f ($%.3f)",
+			d.Quality, d.EstUSD, plain.Quality, plain.EstUSD)
 	}
-	if err := ApplyCrew(dir, CrewMax); err != nil {
+	if plain.Seat(crewroute.Worker).Model != "z-ai/glm-5.3-flash" {
+		t.Errorf("another repository inherited the offset: %s", plain.Seat(crewroute.Worker).Model)
+	}
+}
+
+// A CONNECTED PLAN IS PREFERRED: its marginal cost is nothing, and the send
+// goes out through the plan's own prefix.
+func TestAPlanRouteIsFreeAndCollidingIdsKeepTheirRouterSpelling(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValue(dir, keyModelSources, []PersistedSource{{ID: "z-ai", Written: "z-ai", Key: "zai-key-0123456789", Door: "coding-plan", Order: 1}}); err != nil {
 		t.Fatal(err)
 	}
-	want, _ := CrewModelsForSource(DefaultCrewSource, CrewMax)
-	for _, tier := range ModelTiers {
-		if got := TierModelAt(dir, tier); got != want[tier] {
-			t.Errorf("with no source set, max wrote %s to %q, want the default family's %q", tier, got, want[tier])
+	var zai CrewProvider
+	for _, p := range CrewProvidersAt(dir) {
+		if p.ID == "z-ai" {
+			zai = p
 		}
 	}
-	// A WORD THIS BUILD DOES NOT KNOW READS AS THE DEFAULT FAMILY, silently.
-	// Being told a preference from an older build is now an error is the one
-	// thing a retirement must never do, and a family is not a thing to guess
-	// either.
-	if err := writeProfileValue(dir, KeyCrewSource, "wide"); err != nil {
-		t.Fatal(err)
+	if zai.Kind != crewroute.Plan {
+		t.Fatalf("z-ai on its coding plan: %+v", zai)
 	}
-	if got := CrewSourceAt(dir); got != DefaultCrewSource {
-		t.Fatalf("an unknown source word reads as %q, want %q", got, DefaultCrewSource)
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewMax {
-		t.Fatalf("an unknown source word moved the crew to %q", got)
+	w := d.Seat(crewroute.Worker)
+	if w.Provider != "z-ai" || w.CostUSD != 0 || w.Send != "z-ai/glm-5.3-flash" {
+		t.Errorf("worker %+v, want glm-5.3-flash on the coding plan", w)
 	}
-}
-
-// FLIPPING TO ALL MAKES THE SAME WORDS MEAN THE ALL FAMILY. Seats nobody pinned
-// move at once, because an unwritten seat is the default crew resolved in the
-// current family; the five ids already written are theirs, so a flip is a
-// meaning change to them rather than a write, and they read custom against the
-// new family until one keystroke re-applies them.
-func TestFlippingToAllMakesTheWordsMeanTheAllFamily(t *testing.T) {
-	dir := t.TempDir()
-	rows := registry(t, dir)
-	if err := mustRow(t, rows, KeyCrewSource).Apply(CrewSourceAll); err != nil {
-		t.Fatalf("setting the family to all: %v", err)
-	}
-	if got := CrewSourceAt(dir); got != CrewSourceAll {
-		t.Fatalf("the source row reads %q after all was set", got)
-	}
-	// The crew row never writes the source: a stored tier id is not a family claim,
-	// and the family is not stored in the crew row either.
-	if err := mustRow(t, registry(t, dir), KeyCrew).Apply(CrewBalanced); err != nil {
-		t.Fatalf("setting the crew to balanced: %v", err)
-	}
-	want, _ := CrewModelsForSource(CrewSourceAll, CrewBalanced)
-	for _, tier := range ModelTiers {
-		if got := TierModelAt(dir, tier); got != want[tier] {
-			t.Errorf("under all, balanced wrote %s to %q, want the all-family %q", tier, got, want[tier])
-		}
+	// A z-ai model pinned to OpenRouter is spelled so the call goes there.
+	if err := SetCrewPin(dir, crewroute.Planner, "z-ai/glm-5.3-flash@openrouter"); err != nil {
+		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewBalanced {
-		t.Fatalf("the crew reads %q after balanced was applied under all", got)
+	d, _ = RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if p := d.Seat(crewroute.Planner); p.Send != "openrouter/z-ai/glm-5.3-flash" || p.Provider != "openrouter" {
+		t.Errorf("planner pinned @openrouter: %+v", p)
 	}
+}
 
-	// And the same five ids are NOT balanced in the open family, which is the
-	// point of the toggle: the words changed family, and the reading follows.
-	if err := mustRow(t, registry(t, dir), KeyCrewSource).Apply(CrewSourceOpen); err != nil {
+func TestMigratingARetiredCrew(t *testing.T) {
+	dir := crewProfile(t)
+	// A balanced preset applied in the `open` family: all five rows written,
+	// the three seat rows exactly the preset's, and the family and pick rows.
+	// The ids stay pins: no row says which hand wrote it.
+	if err := writeProfileValues(dir, map[string]any{
+		KeyTierReflexModel: "mistralai/mistral-nemo", KeyTierLowModel: "deepseek/deepseek-v4-flash-0731",
+		KeyTierWorkerModel: "z-ai/glm-5.3-flash", KeyTierHighModel: "moonshotai/kimi-k3", KeyTierMastermindModel: "z-ai/glm-5.3",
+		legacyKeyCrewSource: "open", legacyKeyCrewPick: "learn",
+	}); err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewCustom {
-		t.Fatalf("after flipping back to open, the all-family five read %q, want %q", got, CrewCustom)
-	}
-	// One keystroke heals it, and heals it open.
-	if err := mustRow(t, registry(t, dir), KeyCrew).Apply(CrewBalanced); err != nil {
+	line, err := MigrateCrew(dir)
+	if err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewBalanced {
-		t.Fatalf("the crew reads %q after balanced was applied under open again", got)
+	if !strings.Contains(line, "kept your pins: worker z-ai/glm-5.3-flash, planner z-ai/glm-5.3, checker moonshotai/kimi-k3") || !strings.Contains(line, "allowed models: open") {
+		t.Errorf("notice %q", line)
+	}
+	if got := CrewAllowedAt(dir).String(); got != "open" {
+		t.Errorf("the open family became %q", got)
 	}
-	open, _ := CrewModelsForSource(CrewSourceOpen, CrewBalanced)
-	for _, tier := range ModelTiers {
-		if got := TierModelAt(dir, tier); got != open[tier] {
-			t.Errorf("after re-applying under open, %s reads %q, want the open %q", tier, got, open[tier])
+	for _, key := range []string{legacyKeyCrewSource, legacyKeyCrewPick} {
+		if _, held := persistedValue(dir, key); held {
+			t.Errorf("%s survived the migration", key)
 		}
 	}
+	if pins := CrewPinsAt(dir); len(pins) != 3 {
+		t.Errorf("the seat rows are pins %v, want all three kept", pins)
+	}
+	if got := TierModelAt(dir, ModelTierReflex); got != "mistralai/mistral-nemo" {
+		t.Errorf("the reflex row, not a crew seat, moved to %q", got)
+	}
+	// Once: the second run has nothing to say.
+	if again, _ := MigrateCrew(dir); again != "" {
+		t.Errorf("a second migration said %q", again)
+	}
 }
 
-// ── the level on a tier value ───────────────────────────────────────────────
-
-// A LEVEL IS ACCEPTED AND ANY OTHER SUFFIX IS REFUSED IN WORDS.
-func TestTheTierRowsTakeALevelAndRefuseAMisspeltOne(t *testing.T) {
-	dir := t.TempDir()
-	row := mustRow(t, registry(t, dir), KeyTierMastermindModel)
-
-	for _, value := range []string{
-		"moonshotai/kimi-k3:low",
-		"moonshotai/kimi-k3:medium",
-		"moonshotai/kimi-k3:high",
-		"deepseek/deepseek-v4-flash",
-		"",
-	} {
-		if err := row.Apply(value); err != nil {
-			t.Errorf("the mastermind row refused %q: %v", value, err)
-		}
+// THE OWNER'S PROFILE: the three seats all hold the id an old preset shipped,
+// beside written low and reflex rows. Nothing retired is on it, so nothing
+// moves: all three stay pins, every run.
+func TestAPresetsIdsAPersonWroteStayPinned(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValues(dir, map[string]any{
+		KeyTierReflexModel: "mistralai/mistral-nemo", KeyTierLowModel: "z-ai/glm-5.3-flash",
+		KeyTierWorkerModel: "z-ai/glm-5.3-flash", KeyTierHighModel: "z-ai/glm-5.3-flash", KeyTierMastermindModel: "z-ai/glm-5.3-flash",
+	}); err != nil {
+		t.Fatal(err)
 	}
-
-	for _, value := range []string{
-		// off is an effort word this build knows and a tier value may not carry
-		// it: it is a different request shape, and some endpoints refuse it.
-		"moonshotai/kimi-k3:off",
-		"moonshotai/kimi-k3:max",
-		"moonshotai/kimi-k3:none",
-		"moonshotai/kimi-k3:xhigh",
-		"moonshotai/kimi-k3:ultra",
-		"moonshotai/kimi-k3:",
-	} {
-		err := row.Apply(value)
-		if err == nil {
-			t.Errorf("the mastermind row took %q", value)
-			continue
+	for run := 0; run < 2; run++ {
+		if line, err := MigrateCrew(dir); err != nil || line != "" {
+			t.Fatalf("run %d migrated a profile with nothing retired: %q %v", run, line, err)
 		}
-		for _, level := range roles.Efforts {
-			if !strings.Contains(err.Error(), level) {
-				t.Errorf("refusing %q does not name %q: %v", value, level, err)
-			}
+	}
+	for _, seat := range crewroute.Seats {
+		if pin, ok := CrewPinAt(dir, seat); !ok || pin.Model != "z-ai/glm-5.3-flash" {
+			t.Errorf("the %s is %+v, %v, want its pin kept", seat, pin, ok)
 		}
 	}
-
-	// EVERY TIER ROW HAS THE SAME GATE. A sixth tier must not be able to arrive
-	// with the check missing.
-	for _, key := range []string{KeyTierReflexModel, KeyTierLowModel, KeyTierWorkerModel, KeyTierHighModel} {
-		if err := mustRow(t, registry(t, dir), key).Apply("some/model:off"); err == nil {
-			t.Errorf("%s took a level it cannot honour", key)
+	for _, key := range []string{KeyTierWorkerModel, KeyTierHighModel, KeyTierMastermindModel, KeyTierLowModel, KeyTierReflexModel} {
+		if _, held := persistedValue(dir, key); !held {
+			t.Errorf("%s was deleted", key)
 		}
 	}
 }
 
-// A level written into a tier row reaches [roles.ResolveCall] as its own half,
-// and never as part of the model id.
-func TestALevelOnATierRowResolvesAsAnEffortAndNotAsAnId(t *testing.T) {
-	dir := t.TempDir()
-	if err := mustRow(t, registry(t, dir), KeyTierMastermindModel).Apply("moonshotai/kimi-k3:high"); err != nil {
+// A CHECKER PINNED ALONE BESIDE A RETIRED WORD IS KEPT, and the line says so;
+// migrating again changes nothing.
+func TestAPinnedCheckerSurvivesMigration(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValues(dir, map[string]any{KeyTierHighModel: "moonshotai/kimi-k3", legacyKeyCrew: "balanced"}); err != nil {
 		t.Fatal(err)
 	}
-	source := roles.Source(func(key string) (string, bool) {
-		if key == roles.TierKey(roles.TierMastermind) {
-			return TierModelAt(dir, ModelTierMastermind), true
-		}
-		return "", false
-	})
-	call, err := roles.ResolveCall(source, roles.RolePlanner, "vendor/conversation")
-	if err != nil {
-		t.Fatal(err)
+	line, err := MigrateCrew(dir)
+	if err != nil || !strings.Contains(line, "kept your pins: checker moonshotai/kimi-k3") {
+		t.Fatalf("notice %q %v", line, err)
+	}
+	if again, _ := MigrateCrew(dir); again != "" {
+		t.Errorf("a second migration said %q", again)
 	}
-	if call.Model != "moonshotai/kimi-k3" || call.Effort != "high" {
-		t.Fatalf("the planner resolved to %+v", call)
+	if pin, ok := CrewPinAt(dir, crewroute.Checker); !ok || pin.Model != "moonshotai/kimi-k3" {
+		t.Errorf("the checker is %+v, %v", pin, ok)
 	}
 }
 
-// Every persisted write bumps the generation, which is the signal a live crew
-// source invalidates its snapshot on (cmd/codeaf's v3RolesSource).
-func TestEverySettingsWriteBumpsTheGeneration(t *testing.T) {
-	dir := t.TempDir()
-	before := SettingsGeneration()
-	if err := mustRow(t, registry(t, dir), KeyCrew).Apply(CrewMax); err != nil {
+func TestMigrationKeepsAHandWrittenIdAsAPin(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValues(dir, map[string]any{
+		KeyTierHighModel: "anthropic/claude-opus-5", KeyTierWorkerModel: "auto", legacyKeyCrew: "frugal",
+	}); err != nil {
 		t.Fatal(err)
 	}
-	after := SettingsGeneration()
-	if after <= before {
-		t.Fatalf("the generation went %d → %d across a write", before, after)
+	line, err := MigrateCrew(dir)
+	if err != nil {
+		t.Fatal(err)
 	}
-	// A refused write changes nothing, so it must not move the counter — a
-	// reader that rebuilt on every rejected keystroke would be paying for
-	// somebody's typing.
-	_ = mustRow(t, registry(t, dir), KeyCrew).Apply("nonsense")
-	if got := SettingsGeneration(); got != after {
-		t.Fatalf("a refused write moved the generation to %d", got)
+	if !strings.Contains(line, "kept your pins: checker anthropic/claude-opus-5") {
+		t.Errorf("notice %q", line)
 	}
-}
-
-// THE FAMILY ROW REFUSES A WORD THAT IS NOT A FAMILY, the way the crew row
-// refuses a word that is not a preset, and a refused write leaves the row absent
-// rather than half-written.
-func TestSetCrewSourceRefusesAWordThatIsNotAFamily(t *testing.T) {
-	dir := t.TempDir()
-	if err := SetCrewSource(dir, "wide"); err == nil {
-		t.Fatal("SetCrewSource accepted a word that is not a family")
+	if pin, ok := CrewPinAt(dir, crewroute.Checker); !ok || pin.Model != "anthropic/claude-opus-5" {
+		t.Errorf("the hand-written checker is %+v, %v", pin, ok)
 	}
-	if got := CrewSourceAt(dir); got != DefaultCrewSource {
-		t.Fatalf("a refused write left the row reading %q", got)
+	if _, ok := CrewPinAt(dir, crewroute.Worker); ok {
+		t.Error("an `auto` row became a pin")
 	}
-	if CrewConfigured(dir) {
-		t.Fatal("a refused write marked the crew as answered")
+	if _, held := persistedValue(dir, legacyKeyCrew); held {
+		t.Error("the preset word survived")
 	}
 }
 
-// AN UNWRITTEN SEAT FOLLOWS THE FAMILY, which is what makes the hint true: a
-// profile on the all family with no rows runs the frontier crew without anyone
-// picking it, and the crew word already reads the default preset.
-func TestAnUnwrittenSeatFollowsTheFamily(t *testing.T) {
-	dir := t.TempDir()
-	if err := SetCrewSource(dir, CrewSourceAll); err != nil {
-		t.Fatal(err)
-	}
-	want, ok := CrewModelsForSource(CrewSourceAll, DefaultCrew)
-	if !ok {
-		t.Fatal("there is no default preset in the all family")
-	}
-	for tier, model := range want {
-		if got := TierModelAt(dir, tier); got != model {
-			t.Fatalf("%s on an all profile with no row is %q, want the all default %q", tier, got, model)
+func TestParseCrewPin(t *testing.T) {
+	cases := []struct {
+		raw   string
+		pin   CrewPin
+		auto  bool
+		fails bool
+	}{
+		{"", CrewPin{}, true, false},
+		{"auto", CrewPin{}, true, false},
+		{"moonshotai/kimi-k3", CrewPin{Model: "moonshotai/kimi-k3"}, false, false},
+		{"moonshotai/kimi-k3:high@OpenRouter", CrewPin{Model: "moonshotai/kimi-k3:high", Provider: "openrouter"}, false, false},
+		{"moonshotai/kimi-k3@", CrewPin{}, false, true},
+		{"moonshotai/kimi-k3:hgih", CrewPin{}, false, true},
+	}
+	for _, tc := range cases {
+		pin, auto, err := ParseCrewPin(tc.raw)
+		if (err != nil) != tc.fails || auto != tc.auto || (!tc.fails && pin != tc.pin) {
+			t.Errorf("ParseCrewPin(%q) = %+v, %v, %v", tc.raw, pin, auto, err)
 		}
 	}
-	if got := CrewAt(dir); got != CrewBalanced {
-		t.Fatalf("an all profile with no rows reads the crew as %q, want %q", got, CrewBalanced)
-	}
 }
 
-// ── the pick row ────────────────────────────────────────────────────────────
-
-// THE PICK ROW DEFAULTS TO THE TABLE, and a word that is not one of the three
-// is refused the way every choice row refuses one.
-func TestCrewPickDefaultsToTheTable(t *testing.T) {
-	dir := t.TempDir()
-	if got := CrewPickAt(dir); got != CrewPickTable {
-		t.Fatalf("an untouched profile reads the pick %q, want %q", got, CrewPickTable)
-	}
-	if got := CrewAt(dir); got != DefaultCrew {
-		t.Fatalf("an untouched profile reads the crew %q, want %q", got, DefaultCrew)
+// THE PICKER'S OFFERS ARE EVERY REACHABLE MODEL, and the rule only marks them:
+// a model the rule leaves out is still offered, as not allowed.
+func TestCrewOffersMarkWhatTheRuleLeavesOut(t *testing.T) {
+	dir := crewProfile(t)
+	if err := SetCrewAllowed(dir, "open"); err != nil {
+		t.Fatal(err)
 	}
-	if err := SetCrewPick(dir, CrewPickLearn); err != nil {
-		t.Fatalf("learn would not set: %v", err)
+	allowed := map[string]bool{}
+	for _, offer := range CrewOffersAt(dir) {
+		if len(offer.Routes) == 0 {
+			t.Errorf("%s was offered with no route", offer.Model.ID)
+		}
+		allowed[offer.Model.ID] = offer.Allowed
 	}
-	if got := CrewPickAt(dir); got != CrewPickLearn {
-		t.Fatalf("the pick reads %q after learn was set", got)
+	if got, ok := allowed["anthropic/claude-opus-5"]; !ok || got {
+		t.Fatalf("a closed model under `open` reads offered=%v allowed=%v", ok, got)
 	}
-	if err := SetCrewPick(dir, "measured"); err == nil {
-		t.Fatal("a word that is not one of the three was accepted")
+	if !allowed["moonshotai/kimi-k3"] {
+		t.Fatal("an open model under `open` is not allowed")
 	}
-	if got := CrewPickAt(dir); got != CrewPickLearn {
-		t.Fatalf("a refused write left the pick reading %q", got)
+	if _, ok := allowed["vendor/unpriced"]; ok {
+		t.Fatal("an unpriced row was offered")
 	}
 }
 
-// THE AUTO ROW IS THE OTHER WAY A SEAT IS COMPUTED FROM THE CATALOG'S ROWS,
-// beside the pick row this section's tests read. A pick off the table and a
-// tier row that says auto both compute from the rows the process holds, and
-// the door that waits for them asks [AnyTierAutoAt] for the second. A row
-// cleared on purpose says nothing about models, and a crew of model ids asks
-// for nothing — but the word reaches the read through the lineage too, so a
-// profile older than the worker seat counts its small-work row as well.
-func TestAnyTierAutoAtAnswersWhenARowSaysAuto(t *testing.T) {
-	dir := t.TempDir()
-	if AnyTierAutoAt(dir) {
-		t.Fatal("an untouched profile has no auto row to wait for")
-	}
-	if err := ApplyCrew(dir, CrewBalanced); err != nil {
+// UNDO PUTS THE ROWS BACK, absent ones included, in one write.
+func TestCrewStateRestoresTheRows(t *testing.T) {
+	dir := crewProfile(t)
+	before := CrewStateAt(dir)
+	if err := SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
 		t.Fatal(err)
 	}
-	if AnyTierAutoAt(dir) {
-		t.Fatal("a crew of model ids has no auto row to wait for")
-	}
-	if err := writeProfileValue(dir, tierKeyFor(ModelTierWorker), AutoValue); err != nil {
+	if err := SetCrewCap(dir, "5"); err != nil {
 		t.Fatal(err)
 	}
-	if !AnyTierAutoAt(dir) {
-		t.Fatal("a worker row that says auto went unnoticed")
+	if err := SetCrewAllowedRule(dir, crewroute.Allowed{Base: crewroute.BaseOpen}); err != nil {
+		t.Fatal(err)
 	}
-	if err := writeProfileValue(dir, tierKeyFor(ModelTierWorker), ""); err != nil {
+	if err := RestoreCrewState(dir, before); err != nil {
 		t.Fatal(err)
 	}
-	if AnyTierAutoAt(dir) {
-		t.Fatal("a row cleared on purpose read as an auto row")
+	if _, ok := CrewPinAt(dir, crewroute.Checker); ok {
+		t.Fatal("the restored profile still pins the checker")
 	}
-	vintage := t.TempDir()
-	if err := writeProfileValue(vintage, tierKeyFor(ModelTierLow), AutoValue); err != nil {
-		t.Fatal(err)
+	if CrewCapAt(dir) != 0 || CrewAllowedAt(dir).String() != "all" {
+		t.Fatalf("restored cap %v rule %q", CrewCapAt(dir), CrewAllowedAt(dir).String())
 	}
-	if !AnyTierAutoAt(vintage) {
-		t.Fatal("an auto row reached through the lineage went unnoticed")
+	if _, held := persistedValue(dir, KeyCrewCap); held {
+		t.Fatal("an absent row came back as a written one")
 	}
 }
 
-// THE PICK-AWARE CREW WORD READS THE BUDGET THE SEATS ARE COMPUTED AT. The
-// live seats are computed ids the preset tables do not hold, so the word is
-// read off the STORED rows — a profile that applied a crew and then set the
-// pick keeps saying the crew it picked — and a row the person emptied on
-// purpose still reads custom, because "follows the conversation" is not any
-// of the three.
-func TestTheCrewWordReadsThePresetThePickComputesAt(t *testing.T) {
-	dir := t.TempDir()
-	if err := ApplyCrew(dir, CrewMax); err != nil {
+// A PROVIDER TURNED OFF IS A ROUTE TAKEN AWAY, in a row of its own: the router
+// never picks through it, the offers mark a model only it reached as not
+// allowed, the last provider on cannot be turned off, a pin naming it is
+// refused, and the undo puts the row back with the others.
+func TestCrewProvidersTurnedOff(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValue(dir, keyModelSources, []PersistedSource{{ID: "z-ai", Written: "z-ai", Key: "zai-key-0123456789", Door: "coding-plan", Order: 1}}); err != nil {
 		t.Fatal(err)
 	}
-	if err := SetCrewPick(dir, CrewPickLearn); err != nil {
+	before := CrewStateAt(dir)
+	for _, p := range CrewProvidersAt(dir) {
+		if !p.On {
+			t.Fatalf("a connection nobody turned off reads off: %+v", p)
+		}
+	}
+	if err := SetCrewProviderOn(dir, "z-ai", false); err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewMax {
-		t.Fatalf("a max crew under learn reads %q, want %q", got, CrewMax)
+	if got := CrewProvidersOffAt(dir); !got["z-ai"] || len(got) != 1 {
+		t.Fatalf("the row reads %v", got)
 	}
-	// And a hand-typed row makes the word custom, as it always has: the stored
-	// comparison is the honest one, not a second way to say balanced.
-	rows, err := os.ReadFile(BudgetConfigPath(dir))
+	if rule := CrewAllowedAt(dir).String(); rule != "all" {
+		t.Fatalf("turning a provider off wrote the allowed rule: %q", rule)
+	}
+	for _, c := range CrewCandidatesAt(dir) {
+		for _, r := range c.Routes {
+			if r.Provider == "z-ai" {
+				t.Fatalf("%s is still routed through a provider that is off", c.Model.ID)
+			}
+		}
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
 	if err != nil {
 		t.Fatal(err)
 	}
-	values := map[string]string{}
-	if err := json.Unmarshal(rows, &values); err != nil {
+	if w := d.Seat(crewroute.Worker); w.Provider != "openrouter" {
+		t.Fatalf("the worker rode %s with z-ai off", w.Provider)
+	}
+	if err := SetCrewPin(dir, crewroute.Worker, "z-ai/glm-5.3-flash@z-ai"); err == nil || !strings.Contains(err.Error(), "turned off") {
+		t.Fatalf("a pin through a provider that is off: %v", err)
+	}
+	// THE LAST ONE ON STAYS ON.
+	if err := SetCrewProviderOn(dir, "openrouter", false); !errors.Is(err, ErrCrewLastProvider) {
+		t.Fatalf("turning off the last provider on: %v", err)
+	}
+	if err := SetCrewProviderOn(dir, "nobody", false); err == nil {
+		t.Fatal("a provider that is not connected was turned off")
+	}
+	// ONLY OPENROUTER ON, AND ONLY IT SERVES: every offer is still served.
+	for _, offer := range CrewOffersAt(dir) {
+		if !offer.Served {
+			t.Errorf("%s reads unserved while openrouter is on", offer.Model.ID)
+		}
+	}
+	if err := RestoreCrewState(dir, before); err != nil {
 		t.Fatal(err)
 	}
-	values[tierKeyFor(ModelTierMastermind)] = "openai/gpt-5"
-	raw, err := json.Marshal(values)
-	if err != nil {
+	if _, held := persistedValue(dir, KeyCrewProvidersOff); held {
+		t.Fatal("undo left the providers row written")
+	}
+	// TURNING THE LAST ONE BACK ON REMOVES THE ROW rather than writing an empty list.
+	if err := SetCrewProviderOn(dir, "z-ai", false); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(BudgetConfigPath(dir), raw, 0o600); err != nil {
+	if err := SetCrewProviderOn(dir, "z-ai", true); err != nil {
 		t.Fatal(err)
 	}
-	if got := CrewAt(dir); got != CrewCustom {
-		t.Fatalf("a hand-typed row under learn reads the crew %q, want custom", got)
+	if _, held := persistedValue(dir, KeyCrewProvidersOff); held {
+		t.Fatal("every provider on left the row written")
+	}
+}
+
+// THE GUARD IS ON ROUTING, NOT ON COUNTING: a custom endpoint left on alone
+// routes no seat, so turning OpenRouter off beside it is refused — unless
+// every seat is pinned to a provider still on.
+func TestCrewProvidersKeepOneThatRoutes(t *testing.T) {
+	dir := crewProfile(t)
+	custom := PrepareCustomSource(dir, "http://127.0.0.1:9001/v1", "my-vllm")
+	custom.Key, custom.Order = "sk-my-vllm-0123456789", 1
+	if err := WriteSources(dir, []PersistedSource{custom}); err != nil {
+		t.Fatal(err)
+	}
+	if err := SetCrewProviderOn(dir, "openrouter", false); !errors.Is(err, ErrCrewNoRoutableProvider) {
+		t.Fatalf("turning off the one provider that routes beside a custom endpoint: %v", err)
+	}
+	for _, seat := range crewroute.Seats {
+		if err := SetCrewPin(dir, seat, "my-vllm/qwen-coder"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := SetCrewProviderOn(dir, "openrouter", false); err != nil {
+		t.Fatalf("every seat pinned to the custom endpoint, and still refused: %v", err)
 	}
 }
diff --git a/internal/config/crewfresh_test.go b/internal/config/crewfresh_test.go
new file mode 100644
index 0000000000..13779871be
--- /dev/null
+++ b/internal/config/crewfresh_test.go
@@ -0,0 +1,72 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// A FRESH PROFILE STARTS ON AUTO. With HOME and CODEAF_HOME both empty
+// directories and no profile override, every crew seat is routed — worker,
+// planner and checker — nothing is pinned, the allowed rule is `all`, a task
+// is held to $5, and there is no daily crew cap until one is set. Reading all
+// of it writes nothing.
+func TestAFreshProfileStartsOnAutoWithTheDefaultLimits(t *testing.T) {
+	crewProfile(t) // clears the seat and key variables, installs a catalog
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("CODEAF_HOME", t.TempDir())
+	t.Setenv(ProfileDirEnv, "")
+	dir := ProfileDir()
+	if dir != "" {
+		t.Fatalf("profile override leaked: %q", dir)
+	}
+	if pins := CrewPinsAt(dir); len(pins) != 0 {
+		t.Fatalf("a fresh profile has pins: %v", pins)
+	}
+	if rule := CrewAllowedAt(dir).String(); rule != "all" {
+		t.Fatalf("a fresh profile allows %q, want all", rule)
+	}
+	if limit := CrewTaskCapAt(dir); limit != 5 {
+		t.Fatalf("a fresh profile's per-task limit is $%.2f, want $5", limit)
+	}
+	if daily := CrewCapAt(dir); daily != 0 {
+		t.Fatalf("a fresh profile has a daily crew cap of $%.2f, want none", daily)
+	}
+	for _, seat := range crewroute.Seats {
+		row := TierSeatAt(dir, CrewSeatTier(seat))
+		if row.Source != SeatRouted {
+			t.Errorf("%s reads %+v on a fresh profile, want auto (routed)", seat, row)
+		}
+	}
+	if _, err := os.Stat(filepath.Join(os.Getenv("CODEAF_HOME"), "config.json")); !os.IsNotExist(err) {
+		t.Fatalf("reading a fresh profile wrote config.json: %v", err)
+	}
+}
+
+// NO SEAT FALLS BACK TO A MODEL THIS BUILD CHOSE. With nothing the router can
+// seat, a crew seat reads empty — the role ladder's floor is the model the
+// person is talking to — and a task's crew is an error that says so, never a
+// hard-coded default.
+func TestNoCrewSeatFallsBackToABuiltInModel(t *testing.T) {
+	dir := crewProfile(t)
+	CrewCatalog = func() []catalog.Model { return nil }
+	builtIn := map[string]bool{DefaultModel: true, DefaultReflexModel: true, DefaultLowModel: true, FreeChatModel: true}
+	for _, seat := range crewroute.Seats {
+		row := TierSeatAt(dir, CrewSeatTier(seat))
+		if row.Model != "" || builtIn[row.Model] {
+			t.Errorf("%s with nothing routable reads %q, want empty", seat, row.Model)
+		}
+	}
+	seats, err := ResolveSeats(dir, SeatFlags{}, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err == nil {
+		t.Fatalf("a crew with nothing routable resolved: %+v", seats)
+	}
+	for _, seat := range []Seat{seats.Work, seats.Plan, seats.Check} {
+		if builtIn[seat.Model] {
+			t.Errorf("%s fell back to the built-in %s", seat.Role, seat.Model)
+		}
+	}
+}
diff --git a/internal/config/crewhealth.go b/internal/config/crewhealth.go
new file mode 100644
index 0000000000..a237b0e896
--- /dev/null
+++ b/internal/config/crewhealth.go
@@ -0,0 +1,539 @@
+package config
+
+import (
+	"errors"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/router"
+)
+
+// ROUTE HEALTH — WHAT THIS INSTALL HAS LEARNED ABOUT EACH ROUTE.
+//
+// A route is a provider, a send id and a price, and a crew seat's first call on
+// it either answers or fails with a kind of failure (internal/provider's
+// RouteFailure: payment, auth, forbidden, quota, unavailable, transient). Those
+// outcomes are written to the router's log as they happen ([LogCrewRoute]) and
+// read back here, oldest first, into what every decision is routed around:
+//
+//   - forbidden   → the route is QUARANTINED for [crewQuarantineFor]: this route
+//     will not take this model for this account, and asking again tomorrow
+//     will not change that;
+//   - quota       → the route COOLS DOWN until the reset it said, or for
+//     [crewCooldownFor];
+//   - unavailable → the route cools down, and the model is DEMOTED off
+//     unpinned seats: it is not served there any more;
+//   - payment     → every PAID route on that provider's account is
+//     UNAFFORDABLE, until a paid call on it answers again;
+//   - auth        → the provider is DISCONNECTED, until a call on it answers
+//     again — or the person reconnects it;
+//   - transient   → nothing but the route's failure rate.
+//
+// Every outcome feeds the route's learned chance of refusing a first call,
+// which is part of what the route is expected to cost (crewroute's routeCost).
+// NOTHING HERE NAMES A PROVIDER: the kinds are the provider layer's, and a
+// provider that says its credit is gone before a call is made can say so
+// through [CrewAccountState].
+
+// The health windows, spelled once.
+const (
+	// crewQuarantineFor is how long a forbidden route is kept out.
+	crewQuarantineFor = 7 * 24 * time.Hour
+	// crewCooldownFor is how long a quota or unavailable route rests when it
+	// said no reset of its own.
+	crewCooldownFor = time.Hour
+	// crewUnavailableFor is how long a route whose model was not served rests.
+	crewUnavailableFor = 6 * time.Hour
+	// crewDemoteFor is how far back failures count toward demoting a model,
+	// and crewDemoteAfter how many start failures (not limits) it takes.
+	crewDemoteFor   = 7 * 24 * time.Hour
+	crewDemoteAfter = 2
+	// A route's learned failure rate is read against a prior worth
+	// crewPriorTasks tasks at crewPriorRate, so one lucky call does not make a
+	// route look safe.
+	crewPriorTasks = 3.0
+	crewPriorRate  = 0.3
+)
+
+// CrewAccountState is what a provider adapter can say about an account before
+// any call is made: its remaining credit, and when its limit resets.
+type CrewAccountState struct {
+	CreditKnown bool
+	CreditUSD   float64
+	ResetAt     time.Time
+}
+
+// CrewAccounts is the OPTIONAL adapter that primes route health for providers
+// that can report their account state. Nil — the default — is providers that
+// cannot, whose health is learned from their calls alone.
+var CrewAccounts func(profileDir, provider string) (CrewAccountState, bool)
+
+// CrewRouteHistory is how route outcomes reach the health reading: the router
+// log's recent first-call outcomes. A variable so a test can hand its own.
+var CrewRouteHistory = func(profileDir string) []router.CrewRouteOutcome {
+	return router.ReadCrewLog(ProfilePath(profileDir, ""), time.Now()).Routes
+}
+
+// crewHealth is the reading.
+type crewHealth struct {
+	now time.Time
+	// blocked is send → until, for a route quarantined or cooling down.
+	blocked map[string]time.Time
+	// unaffordable and disconnected are providers.
+	unaffordable map[string]bool
+	disconnected map[string]bool
+	// demoted are model lineages kept off unpinned seats.
+	demoted map[string]bool
+	// fail is send → learned chance of refusing a first call.
+	fail map[string]float64
+	// resets is provider → the latest reset a cooling route said.
+	resets map[string]time.Time
+	// lowBalance are providers whose balance was READ as low before any call
+	// ([CreditsLowAt]). They stay unaffordable while a task is probing: the
+	// reading is taken again at every launch while it is low
+	// ([CreditsNeedRead]), so a top-up is noticed without a refused call.
+	lowBalance map[string]bool
+}
+
+// crewRouteFacts are what a candidate list is built with beyond the rule and
+// the providers: whether free pools are routes, and route health.
+type crewRouteFacts struct {
+	free   bool
+	health crewHealth
+}
+
+// crewHealthAt reads this profile's route health now.
+func crewHealthAt(profileDir string) crewHealth {
+	var history []router.CrewRouteOutcome
+	if CrewRouteHistory != nil {
+		history = CrewRouteHistory(profileDir)
+	}
+	h := crewHealthOf(history, time.Now())
+	// AN OPENROUTER BALANCE KNOWN TO BE LOW ([CreditsLowAt]) is an account out
+	// of credit before any call is made: the seats reach for free routes and
+	// the crew line says so, instead of a first paid call being refused.
+	if useFreeDefaultsAt(profileDir) {
+		h.unaffordable[modelsource.DefaultID] = true
+		h.lowBalance = map[string]bool{modelsource.DefaultID: true}
+	}
+	if CrewAccounts != nil {
+		for _, p := range CrewProvidersAt(profileDir) {
+			if state, ok := CrewAccounts(profileDir, p.ID); ok && state.CreditKnown && state.CreditUSD <= 0 {
+				h.unaffordable[p.ID] = true
+			}
+		}
+	}
+	return h
+}
+
+// crewHealthOf reads route outcomes, oldest first, as health at now.
+func crewHealthOf(history []router.CrewRouteOutcome, now time.Time) crewHealth {
+	h := crewHealth{now: now, blocked: map[string]time.Time{}, unaffordable: map[string]bool{},
+		disconnected: map[string]bool{}, demoted: map[string]bool{}, fail: map[string]float64{}, resets: map[string]time.Time{}}
+	sorted := append([]router.CrewRouteOutcome(nil), history...)
+	sort.SliceStable(sorted, func(i, j int) bool { return sorted[i].At.Before(sorted[j].At) })
+	starts, fails := map[string]int{}, map[string]int{}
+	startFails := map[string]int{}
+	block := func(send string, until time.Time) {
+		if until.After(now) && until.After(h.blocked[send]) {
+			h.blocked[send] = until
+		}
+	}
+	for _, o := range sorted {
+		if o.Kind == "" {
+			starts[o.Send]++
+			delete(h.disconnected, o.Provider)
+			if o.Paid {
+				delete(h.unaffordable, o.Provider)
+			}
+			continue
+		}
+		fails[o.Send]++
+		lineage := crewroute.Lineage(o.Send)
+		switch o.Kind {
+		case "payment":
+			h.unaffordable[o.Provider] = true
+		case "auth":
+			h.disconnected[o.Provider] = true
+		case "forbidden":
+			block(o.Send, o.At.Add(crewQuarantineFor))
+			if now.Sub(o.At) < crewDemoteFor {
+				startFails[lineage]++
+			}
+		case "quota":
+			until := o.Until
+			if until.IsZero() {
+				until = o.At.Add(crewCooldownFor)
+			}
+			block(o.Send, until)
+			if until.After(h.resets[o.Provider]) {
+				h.resets[o.Provider] = until
+			}
+		case "unavailable":
+			block(o.Send, o.At.Add(crewUnavailableFor))
+			if now.Sub(o.At) < crewDemoteFor {
+				h.demoted[lineage] = true
+			}
+		}
+	}
+	for lineage, n := range startFails {
+		if n >= crewDemoteAfter {
+			h.demoted[lineage] = true
+		}
+	}
+	for send := range fails {
+		n := float64(starts[send] + fails[send])
+		h.fail[send] = (float64(fails[send]) + crewPriorRate*crewPriorTasks) / (n + crewPriorTasks)
+	}
+	return h
+}
+
+// probing is this health with the accounts it holds out of credit and the
+// providers whose key it saw refused put back on trial: what a new task is
+// routed under, so its first call asks them again ([RouteCrew]). An account
+// whose balance was read as low is not put on trial ([crewHealth.lowBalance]).
+func (h crewHealth) probing() crewHealth {
+	h.unaffordable, h.disconnected = map[string]bool{}, map[string]bool{}
+	for id := range h.lowBalance {
+		h.unaffordable[id] = true
+	}
+	return h
+}
+
+// CrewHealthySend is the model an auxiliary call — a summary, a brief, a
+// landing's answer, anything that is not a crew seat's own call nor the
+// person's turn — should ask instead of send, when send's route is one route
+// health says will not answer: quarantined or cooling, on an account out of
+// credit, on a provider whose key was refused. It is the router's standing
+// worker pick, then the seat's rescue; send itself when its route is
+// healthy or nothing better is reachable.
+//
+// AN AUXILIARY CALL NEVER PROBES. Only a task's first seat call asks an
+// account out of credit again ([RouteCrew]); a helper that did would spend a
+// refusal on every summary.
+func CrewHealthySend(profileDir, send, chatModel string) string {
+	send = strings.TrimSpace(send)
+	if send == "" {
+		return send
+	}
+	health := crewHealthCached(profileDir)
+	if health.answers(send, CrewProvidersAt(profileDir)) {
+		return send
+	}
+	if seat := standingCrewSeat(profileDir, crewroute.Worker); seat != "" && seat != send {
+		return seat
+	}
+	for _, rung := range CrewRescue(profileDir, crewroute.Other, crewroute.Worker, chatModel) {
+		if rung.Send != send {
+			return rung.Send
+		}
+	}
+	return send
+}
+
+// CrewRouteAnswers is whether route health expects send's route to answer:
+// not quarantined or cooling, not on an account out of credit, not on a
+// provider whose key was refused. A profile with nothing wrong on it answers
+// at once, without reading its providers.
+func CrewRouteAnswers(profileDir, send string) bool {
+	send = strings.TrimSpace(send)
+	if send == "" {
+		return true
+	}
+	health := crewHealthCached(profileDir)
+	if len(health.blocked) == 0 && len(health.unaffordable) == 0 && len(health.disconnected) == 0 {
+		return true
+	}
+	return health.answers(send, CrewProvidersAt(profileDir))
+}
+
+// answers is whether this health expects send's route to answer.
+func (h crewHealth) answers(send string, providers []CrewProvider) bool {
+	if _, blocked := h.blocked[send]; blocked {
+		return false
+	}
+	pin := resolveCrewPin(CrewPin{Model: send}, providers)
+	return !h.disconnected[pin.Provider] && !(pin.Kind == crewroute.Metered && h.unaffordable[pin.Provider])
+}
+
+// forgetCrewHealth drops the cached route health.
+func forgetCrewHealth() {
+	crewHealthCache.mu.Lock()
+	crewHealthCache.at = time.Time{}
+	crewHealthCache.mu.Unlock()
+}
+
+// crewHealthCached is [crewHealthAt] read at most once a few seconds per
+// profile: auxiliary calls ask it on every request, and the router's log is a
+// file.
+func crewHealthCached(profileDir string) crewHealth {
+	crewHealthCache.mu.Lock()
+	defer crewHealthCache.mu.Unlock()
+	if crewHealthCache.dir == profileDir && time.Since(crewHealthCache.at) < crewHealthFresh {
+		return crewHealthCache.health
+	}
+	crewHealthCache.dir, crewHealthCache.at, crewHealthCache.health = profileDir, time.Now(), crewHealthAt(profileDir)
+	return crewHealthCache.health
+}
+
+// crewHealthFresh is how long a cached health reading stands.
+const crewHealthFresh = 3 * time.Second
+
+var crewHealthCache struct {
+	mu     sync.Mutex
+	dir    string
+	at     time.Time
+	health crewHealth
+}
+
+// usable is the routes this health leaves, with their learned failure rates.
+func (h crewHealth) usable(routes []crewroute.Route) []crewroute.Route {
+	out := routes[:0]
+	for _, r := range routes {
+		if _, blocked := h.blocked[r.Send]; blocked {
+			continue
+		}
+		if h.disconnected[r.Provider] || (r.Kind == crewroute.Metered && h.unaffordable[r.Provider]) {
+			continue
+		}
+		r.FailRate = h.fail[r.Send]
+		out = append(out, r)
+	}
+	return out
+}
+
+// crewCandidatesNoticed is [CrewCandidatesAt] with the one notice a decision
+// carries when it had to reach for free routes.
+//
+// WHEN NOTHING PAID CAN BE REACHED, THE FREE POOLS ARE USED — whatever the
+// free-routes row says — because a task on a free pool is better than a task
+// that cannot start, and the line says so: a free pool may log what it is
+// sent. A paid route coming back (a paid call answering, a provider reporting
+// credit) puts the next task back on normal routing on its own.
+func crewCandidatesNoticed(profileDir string, health crewHealth) ([]crewroute.Candidate, string) {
+	rule, providers, off := CrewAllowedAt(profileDir), CrewProvidersAt(profileDir), CrewProvidersOffAt(profileDir)
+	facts := crewRouteFacts{free: CrewFreeRoutesAt(profileDir), health: health}
+	candidates := off.Candidates(crewCandidatesWith(rule, providers, facts))
+	if facts.free || len(health.unaffordable) == 0 || anyPaidRoute(candidates) {
+		return candidates, ""
+	}
+	facts.free = true
+	withFree := off.Candidates(crewCandidatesWith(rule, providers, facts))
+	if len(withFree) == len(candidates) {
+		return candidates, ""
+	}
+	return withFree, "free routes in use (may log prompts) · credit unavailable on " + strings.Join(crewSet(health.unaffordable), ", ")
+}
+
+// anyPaidRoute is whether any candidate is reachable on a route that bills.
+func anyPaidRoute(candidates []crewroute.Candidate) bool {
+	for _, c := range candidates {
+		for _, r := range c.Routes {
+			if r.Kind == crewroute.Metered {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// crewSet is a set's members in order.
+func crewSet(set map[string]bool) []string {
+	out := make([]string, 0, len(set))
+	for k, on := range set {
+		if on {
+			out = append(out, k)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// crewAction is the ONE thing a person can do when no crew can be formed or a
+// seat has nowhere left to go, read off what the routes said — never the
+// refusal's own text.
+func (h crewHealth) crewAction() string {
+	switch {
+	case len(h.unaffordable) > 0:
+		return "add credit on " + strings.Join(crewSet(h.unaffordable), ", ") + " to continue"
+	case len(h.disconnected) > 0:
+		return "reconnect " + strings.Join(crewSet(h.disconnected), ", ") + " with /connect"
+	}
+	var latest time.Time
+	for _, at := range h.resets {
+		if at.After(latest) {
+			latest = at
+		}
+	}
+	if !latest.IsZero() && latest.After(h.now) {
+		return "the limit resets at " + latest.Local().Format("15:04") + " — try again then"
+	}
+	return "no allowed model on a connected provider can start · widen /crew models or pin one with /crew"
+}
+
+// pinnedBefore is whether a seat was the person's pin rather than a rescue.
+func pinnedBefore(seat crewroute.Seat, pins map[crewroute.Seat]crewroute.Pin, rescued []string) bool {
+	for _, said := range rescued {
+		if strings.HasPrefix(said, string(seat)+" on ") {
+			return false
+		}
+	}
+	_, ok := pins[seat]
+	return ok
+}
+
+// ErrCrewUnreachable is a crew nothing reachable can form; its text is the one
+// action ([crewHealth.crewAction]).
+type ErrCrewUnreachable struct{ Action string }
+
+func (e ErrCrewUnreachable) Error() string { return e.Action }
+
+// LogCrewRoute writes one seat's first-call outcome on its route: answered
+// (kind empty), or failed with a route-failure kind and when the route said it
+// may be asked again.
+func LogCrewRoute(profileDir, call string, d crewroute.Decision, repo, title string, seat crewroute.Seat, pick crewroute.Pick, kind string, until time.Time) {
+	if kind != "" {
+		// A FAILURE IS SEEN BY THE VERY NEXT CALL, not a few seconds later:
+		// the cache that spares every request a read of the log is dropped.
+		forgetCrewHealth()
+	}
+	router.LogCrewRoute(ProfilePath(profileDir, ""), call, CrewRecordOf(d, repo, title), router.CrewRouteOutcome{
+		Seat: string(seat), Send: pick.Send, Provider: pick.Provider,
+		Paid: pick.Kind == crewroute.Metered, Kind: kind, Until: until,
+	})
+}
+
+// CrewRescue is the last of a seat's ladder, after everything the router
+// offered: the seat as the last crew that completed a task on this install
+// ran it, then the model the person is talking to — each only when its route
+// is healthy and the model can sit the seat. The router's own rungs come first
+// ([crewroute.Decision.Ladder]).
+func CrewRescue(profileDir string, class crewroute.Class, seat crewroute.Seat, chatModel string) []crewroute.Pick {
+	health := crewHealthAt(profileDir)
+	var out []crewroute.Pick
+	seen := map[string]bool{}
+	add := func(send string) {
+		send = strings.TrimSpace(send)
+		if send == "" || seen[send] {
+			return
+		}
+		seen[send] = true
+		if _, blocked := health.blocked[send]; blocked {
+			return
+		}
+		pin := resolveCrewPin(CrewPin{Model: send}, CrewProvidersAt(profileDir))
+		// NOT EVEN THE PERSON'S OWN MODEL rides an account that just said it
+		// is out of credit, or a key that was just refused: the conversation
+		// running on it proves the model, not the account.
+		if health.disconnected[pin.Provider] || (pin.Kind == crewroute.Metered && health.unaffordable[pin.Provider]) {
+			return
+		}
+		if model, known := crewCatalogModel(send); known && !crewroute.Seatable(seat, crewroute.Candidate{Model: model, Routes: []crewroute.Route{{Send: pin.Send}}}) {
+			return
+		}
+		out = append(out, crewroute.Pick{Seat: seat, Model: pin.Model, Provider: pin.Provider, Send: pin.Send, Kind: pin.Kind})
+	}
+	if last := CrewLastGood(profileDir); last != nil {
+		add(last.Seats[string(seat)])
+	}
+	out = append(out, crewFreeRescue(profileDir, class, seat, health)...)
+	add(chatModel)
+	return out
+}
+
+// crewFreeRescue is the seat on a free pool when EVERY PAID ROUTE IS OUT OF
+// REACH — the free-routes switch off or on. With the switch on the pools are
+// already routes on the seat's ladder; with it off they are used only here,
+// and the crew line says so ([crewCandidatesNoticed]'s notice). The best few
+// free picks for the seat, each a different model, so a pool at its limit
+// leaves the next.
+func crewFreeRescue(profileDir string, class crewroute.Class, seat crewroute.Seat, health crewHealth) []crewroute.Pick {
+	candidates, notice := crewCandidatesNoticed(profileDir, health)
+	if notice == "" {
+		return nil
+	}
+	var free []crewroute.Candidate
+	for _, c := range candidates {
+		var routes []crewroute.Route
+		for _, r := range c.Routes {
+			if r.Kind == crewroute.Free {
+				routes = append(routes, r)
+			}
+		}
+		// THE RESCUE KEEPS A FLOOR: a model tuned for one domain (finance,
+		// medicine, law) or too small to do a seat's work is no rescue at all,
+		// however little else is left — a task stopped on its one action is
+		// better than one sent to a model that cannot do it.
+		if len(routes) > 0 && !crewroute.DomainTuned(c.Model.ID) && !crewroute.Tiny(c.Model.ID) {
+			free = append(free, crewroute.Candidate{Model: c.Model, Routes: routes})
+		}
+	}
+	var out []crewroute.Pick
+	avoid := map[string]bool{}
+	for len(out) < crewFreeRescues && len(free) > 0 {
+		d, err := crewroute.Decide(crewroute.Request{Class: class, Candidates: free, Avoid: avoid, Rescue: true})
+		if err != nil {
+			break
+		}
+		pick := d.Seat(seat)
+		if pick.Send == "" || avoid[crewroute.Lineage(pick.Model)] {
+			break
+		}
+		pick.Pinned = false
+		out = append(out, pick)
+		avoid[crewroute.Lineage(pick.Model)] = true
+	}
+	return out
+}
+
+// crewFreeRescues is how many free models a seat's rescue tries.
+const crewFreeRescues = 3
+
+// CrewLastGood is the crew of the newest task whose result was kept.
+var CrewLastGood = func(profileDir string) *router.CrewRecord {
+	return router.ReadCrewLog(ProfilePath(profileDir, ""), time.Now()).LastGood
+}
+
+// crewRescued is a decision the router could not form for want of a seat,
+// formed with that seat on its rescue: the last good crew's model, then the
+// person's own. Nothing to rescue it with is the one action.
+func crewRescued(profileDir string, req crewroute.Request, health crewHealth, chatModel string, cause error) (crewroute.Decision, error) {
+	var missing crewroute.NoCandidateError
+	if !errors.As(cause, &missing) {
+		return crewroute.Decision{}, cause
+	}
+	pins := map[crewroute.Seat]crewroute.Pin{}
+	for seat, pin := range req.Pins {
+		pins[seat] = pin
+	}
+	var rescued []string
+	for tries := 0; tries < len(crewroute.Seats); tries++ {
+		rescue := CrewRescue(profileDir, req.Class, missing.Seat, chatModel)
+		if len(rescue) == 0 {
+			return crewroute.Decision{}, ErrCrewUnreachable{Action: health.crewAction()}
+		}
+		r := rescue[0]
+		pins[missing.Seat] = crewroute.Pin{Model: r.Model, Provider: r.Provider, Send: r.Send, Kind: r.Kind}
+		rescued = append(rescued, string(missing.Seat)+" on "+crewroute.ShortModel(r.Model))
+		req.Pins = pins
+		d, err := crewroute.Decide(req)
+		if err == nil {
+			// The rescues rode in as pins to be seated; they are not the person's.
+			for i := range d.Crew {
+				if _, was := req.Pins[d.Crew[i].Seat]; was && !pinnedBefore(d.Crew[i].Seat, pins, rescued) {
+					d.Crew[i].Pinned = false
+				}
+			}
+			d.Note = strings.TrimSpace(d.Note + " running on fallback crew · " + strings.Join(rescued, ", "))
+			return d, nil
+		}
+		if !errors.As(err, &missing) {
+			return crewroute.Decision{}, err
+		}
+	}
+	return crewroute.Decision{}, ErrCrewUnreachable{Action: health.crewAction()}
+}
diff --git a/internal/config/crewhealth_test.go b/internal/config/crewhealth_test.go
new file mode 100644
index 0000000000..d74757d980
--- /dev/null
+++ b/internal/config/crewhealth_test.go
@@ -0,0 +1,652 @@
+package config
+
+import (
+	"errors"
+	"math"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/router"
+)
+
+// withRouteHistory hands the health reading a history of its own, and no
+// last-good crew unless the test says.
+func withRouteHistory(t *testing.T, history *[]router.CrewRouteOutcome) {
+	t.Helper()
+	previous, previousGood := CrewRouteHistory, CrewLastGood
+	t.Cleanup(func() { CrewRouteHistory, CrewLastGood = previous, previousGood })
+	CrewRouteHistory = func(string) []router.CrewRouteOutcome { return *history }
+	CrewLastGood = func(string) *router.CrewRecord { return nil }
+}
+
+// EACH KIND OF FAILURE MOVES A ROUTE'S HEALTH ITS OWN WAY, and a later success
+// on the same account puts it back.
+func TestRouteHealthTransitions(t *testing.T) {
+	now := time.Date(2026, 9, 24, 12, 0, 0, 0, time.UTC)
+	at := func(ago time.Duration) time.Time { return now.Add(-ago) }
+	reset := now.Add(90 * time.Minute)
+	h := crewHealthOf([]router.CrewRouteOutcome{
+		{At: at(time.Hour), Send: "a/forbidden:free", Provider: "p1", Kind: "forbidden"},
+		{At: at(10 * 24 * time.Hour), Send: "a/old-forbidden", Provider: "p1", Kind: "forbidden"},
+		{At: at(time.Minute), Send: "a/limited", Provider: "p2", Kind: "quota", Until: reset},
+		{At: at(time.Minute), Send: "a/gone", Provider: "p2", Kind: "unavailable"},
+		{At: at(time.Hour), Send: "a/pricey", Provider: "broke", Kind: "payment"},
+		{At: at(time.Hour), Send: "a/keyless", Provider: "badkey", Kind: "auth"},
+		{At: at(2 * time.Hour), Send: "a/twice", Provider: "p3", Kind: "forbidden"},
+		{At: at(time.Hour), Send: "openrouter/a/twice", Provider: "p4", Kind: "forbidden"},
+		{At: at(time.Hour), Send: "a/flaky", Provider: "p5", Kind: "transient"},
+		{At: at(time.Minute), Send: "a/flaky", Provider: "p5"},
+	}, now)
+	if _, ok := h.blocked["a/forbidden:free"]; !ok {
+		t.Error("a forbidden route was not quarantined")
+	}
+	if _, ok := h.blocked["a/old-forbidden"]; ok {
+		t.Error("a quarantine outlived its week")
+	}
+	if until := h.blocked["a/limited"]; !until.Equal(reset) {
+		t.Errorf("a limited route cools until %v, want its reset %v", until, reset)
+	}
+	if !h.demoted[crewroute.Lineage("a/gone")] || !h.demoted[crewroute.Lineage("a/twice")] {
+		t.Errorf("demoted %v: want the withdrawn model and the one refused on two routes", h.demoted)
+	}
+	if !h.unaffordable["broke"] || !h.disconnected["badkey"] {
+		t.Errorf("unaffordable %v, disconnected %v", h.unaffordable, h.disconnected)
+	}
+	if rate := h.fail["a/flaky"]; rate <= 0 || rate >= 1 {
+		t.Errorf("a route that failed once and answered once reads %v", rate)
+	}
+	// A paid call answering on the account clears it; so does a call on the
+	// provider whose key was refused.
+	cleared := crewHealthOf([]router.CrewRouteOutcome{
+		{At: at(time.Hour), Send: "a/pricey", Provider: "broke", Kind: "payment"},
+		{At: at(time.Minute), Send: "a/pricey", Provider: "broke", Paid: true},
+		{At: at(time.Hour), Send: "a/keyless", Provider: "badkey", Kind: "auth"},
+		{At: at(time.Minute), Send: "a/keyless", Provider: "badkey"},
+	}, now)
+	if cleared.unaffordable["broke"] || cleared.disconnected["badkey"] {
+		t.Errorf("a later success did not clear: %v %v", cleared.unaffordable, cleared.disconnected)
+	}
+}
+
+// THE OWNER'S SEQUENCE: a route refused a seat with a 403, and the next task
+// was routed onto it again. A forbidden route is quarantined, and the next
+// task's crew does not sit on it.
+func TestAForbiddenRouteIsNotRoutedToAgain(t *testing.T) {
+	dir := crewProfile(t)
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	first, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	worker := first.Seat(crewroute.Worker)
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Seat: "worker", Send: worker.Send, Provider: worker.Provider, Kind: "forbidden"})
+	second, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pick := range second.Crew {
+		if pick.Send == worker.Send {
+			t.Fatalf("the %s seat went back to the quarantined route %s", pick.Seat, pick.Send)
+		}
+	}
+}
+
+// THE PANEL'S GAP COUNTS A PINNED CHECKER. A strong checker pinned over a set
+// whose only other model is weak leaves no warning — even while the pin's route
+// is quarantined and the candidates no longer carry it — and a weak one pinned
+// over a strong set is warned about by name.
+func TestTheGapCountsAPinnedChecker(t *testing.T) {
+	dir := crewProfile(t)
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	if err := SetCrewAllowed(dir, "deepseek-v4-flash, kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	if gaps := CrewGapsAt(dir); len(gaps) != 0 {
+		t.Fatalf("a set with kimi-k3 in it: gaps %+v", gaps)
+	}
+	if err := SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Seat: "checker", Send: "moonshotai/kimi-k3", Provider: "openrouter", Kind: "forbidden"})
+	for _, c := range CrewCandidatesAt(dir) {
+		if crewroute.Lineage(c.Model.ID) == crewroute.Lineage("moonshotai/kimi-k3") && len(c.Routes) > 0 {
+			t.Fatalf("the quarantined pin is still a candidate: %+v", c)
+		}
+	}
+	if gaps := CrewGapsAt(dir); len(gaps) != 0 {
+		t.Errorf("kimi-k3 pinned as checker: gaps %+v, want none", gaps)
+	}
+	history = nil
+	if err := SetCrewPin(dir, crewroute.Checker, "deepseek/deepseek-v4-flash"); err != nil {
+		t.Fatal(err)
+	}
+	gaps := CrewGapsAt(dir)
+	want := "checker pinned to deepseek-v4-flash · open-ended work will be checked weakly"
+	if len(gaps) != 1 || gaps[0].Line != want {
+		t.Errorf("v4-flash pinned as checker: gaps %+v, want %q", gaps, want)
+	}
+	if err := ClearCrewPin(dir, crewroute.Checker); err != nil {
+		t.Fatal(err)
+	}
+	if gaps := CrewGapsAt(dir); len(gaps) != 0 {
+		t.Errorf("the checker unpinned again: gaps %+v", gaps)
+	}
+}
+
+// A ZERO-CREDIT ACCOUNT, end to end: a paid call says payment → the next
+// task is still routed on the paid route, which its first call probes → the
+// seat's rescue is the free pool → with that pool at its limit and the chat
+// model on the same account, nothing → the one action. A paid call answering
+// clears it, and the rescue has no free pool to offer any more.
+func TestAZeroCreditAccountWalksTheLadder(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows, catalog.Model{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true,
+		IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ContextLength: 1310720, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	ask := CrewAsk{Task: crewroute.Task{Text: fixTask}}
+
+	normal, err := RouteCrew(dir, ask)
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := normal.Seat(crewroute.Worker)
+	if w.Kind != crewroute.Metered {
+		t.Fatalf("with credit and free routes off the worker is %+v", w)
+	}
+
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Seat: "worker", Send: w.Send, Provider: w.Provider, Kind: "payment"})
+	probe, err := RouteCrew(dir, ask)
+	if err != nil {
+		t.Fatalf("an account out of credit refused the task at decision time: %v", err)
+	}
+	if got := probe.Seat(crewroute.Worker); got.Kind != crewroute.Metered {
+		t.Fatalf("the next task's worker is %+v, want the paid route, probed", got)
+	}
+	rescue := CrewRescue(dir, crewroute.Bugfix, crewroute.Worker, "somelab/the-chat-model")
+	if len(rescue) == 0 || rescue[0].Kind != crewroute.Free {
+		t.Fatalf("the rescue is %+v, want the free pool", rescue)
+	}
+
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Seat: "worker", Send: rescue[0].Send, Provider: w.Provider, Kind: "quota"})
+	for _, r := range CrewRescue(dir, crewroute.Bugfix, crewroute.Worker, "somelab/the-chat-model") {
+		if r.Send == rescue[0].Send || r.Model == "somelab/the-chat-model" {
+			t.Fatalf("the rescue offers %+v: a pool at its limit, or the chat model on the account out of credit", r)
+		}
+	}
+	if got := crewHealthAt(dir).crewAction(); got != "add credit on openrouter to continue" {
+		t.Errorf("the one action is %q", got)
+	}
+
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Seat: "worker", Send: w.Send, Provider: w.Provider, Paid: true})
+	for _, r := range CrewRescue(dir, crewroute.Bugfix, crewroute.Worker, "somelab/the-chat-model") {
+		if r.Kind == crewroute.Free {
+			t.Fatalf("with credit back the rescue still reaches for a free pool: %+v", r)
+		}
+	}
+}
+
+// AN AUXILIARY CALL NEVER ASKS A ROUTE THAT WILL NOT ANSWER: a helper that
+// would call a quarantined route, or a paid route on an account out of
+// credit, is handed the router's healthy pick instead.
+func TestAnAuxiliaryCallIsHandedAHealthyRoute(t *testing.T) {
+	dir := crewProfile(t)
+	history := []router.CrewRouteOutcome{{At: time.Now(), Send: "z-ai/glm-5.3-flash", Provider: "openrouter", Kind: "forbidden"}}
+	withRouteHistory(t, &history)
+	crewHealthCache.mu.Lock()
+	crewHealthCache.dir = ""
+	crewHealthCache.mu.Unlock()
+	if got := CrewHealthySend(dir, "z-ai/glm-5.3-flash", "somelab/chat"); got == "z-ai/glm-5.3-flash" || got == "" {
+		t.Errorf("a helper on the quarantined route is sent to %q", got)
+	}
+	if got := CrewHealthySend(dir, "moonshotai/kimi-k3", "somelab/chat"); got != "moonshotai/kimi-k3" {
+		t.Errorf("a healthy route was moved to %q", got)
+	}
+}
+
+// A PICKER OFFERS WHAT A SEAT CAN RUN: no model without tool calls, and no
+// model whose every route is quarantined.
+func TestCrewOffersOnlyWhatASeatCanRun(t *testing.T) {
+	dir := crewProfile(t)
+	history := []router.CrewRouteOutcome{{At: time.Now(), Send: "moonshotai/kimi-k3", Provider: "openrouter", Kind: "forbidden"}}
+	withRouteHistory(t, &history)
+	for _, offer := range CrewOffersAt(dir) {
+		switch offer.Model.ID {
+		case "vendor/no-tools":
+			t.Error("a model that takes no tool calls was offered")
+		case "moonshotai/kimi-k3":
+			t.Error("a model on a quarantined route was offered")
+		}
+	}
+}
+
+// A DIRECT CONNECTION IS A ROUTE BESIDE THE DEFAULT SERVICE: a model a
+// connected provider serves itself is one candidate with both routes, and a
+// payment failure on one account leaves the other.
+func TestADirectConnectionIsASecondRouteToTheSameModel(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValue(dir, keyModelSources, []PersistedSource{{ID: "deepseek", Written: "deepseek", Key: "sk-deepseek-0123456789", Order: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	var routes []crewroute.Route
+	for _, c := range CrewCandidatesAt(dir) {
+		if crewroute.Lineage(c.Model.ID) == "deepseek/deepseek-v4-flash" {
+			routes = c.Routes
+		}
+	}
+	if len(routes) != 2 || routes[0].Provider != "deepseek" || routes[1].Provider != "openrouter" {
+		t.Fatalf("deepseek-v4-flash routes: %+v, want the direct connection then the default service", routes)
+	}
+	history = append(history, router.CrewRouteOutcome{At: time.Now(), Send: routes[1].Send, Provider: "openrouter", Kind: "payment"})
+	for _, c := range CrewCandidatesAt(dir) {
+		for _, r := range c.Routes {
+			if r.Provider == "openrouter" && r.Kind == crewroute.Metered {
+				t.Fatalf("a paid route on the account out of credit is still offered: %+v", r)
+			}
+		}
+	}
+}
+
+// THE FREE SWITCH DECIDES WHETHER A FREE POOL IS A ROUTE AT ALL. Off (the
+// default), no candidate, offer or routed seat carries a :free route and no
+// :free id is offered; on, the pool is one more route of its paid model.
+func TestTheFreeSwitchGovernsFreeRoutesEverywhere(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows,
+		catalog.Model{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true, IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ContextLength: 1310720, Parameters: []string{"tools"}},
+		catalog.Model{ID: "thinkingmachines/inkling-small:free", ContextLength: 262144, CodingIndex: 60, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	freeRoutes := func() (ids []string, routes int) {
+		for _, c := range CrewCandidatesAt(dir) {
+			for _, r := range c.Routes {
+				if r.Kind == crewroute.Free {
+					routes++
+				}
+			}
+		}
+		for _, o := range CrewOffersAt(dir) {
+			if crewroute.IsFree(o.Model.ID) {
+				ids = append(ids, o.Model.ID)
+			}
+			for _, r := range o.Routes {
+				if r.Kind == crewroute.Free {
+					routes++
+				}
+			}
+		}
+		return ids, routes
+	}
+	if ids, routes := freeRoutes(); len(ids) > 0 || routes > 0 {
+		t.Fatalf("with free routes off: offered %v, %d free routes", ids, routes)
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: openTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pick := range d.Crew {
+		if pick.Kind == crewroute.Free || strings.Contains(pick.Send, ":free") || strings.Contains(pick.Model, "inkling") {
+			t.Fatalf("with free routes off the %s seat is %+v", pick.Seat, pick)
+		}
+	}
+	if err := SetCrewFreeRoutes(dir, true); err != nil {
+		t.Fatal(err)
+	}
+	ids, routes := freeRoutes()
+	if len(ids) > 0 || routes == 0 {
+		t.Fatalf("with free routes on: offered ids %v (want none, a pool is a route), %d free routes (want some)", ids, routes)
+	}
+}
+
+// A PICKER NEVER OFFERS A MODEL THAT CANNOT HOLD A CONVERSATION: speech,
+// transcription and image models are no seat, whatever parameters they list.
+func TestCrewOffersNoSpeechOrImageModels(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows,
+		catalog.Model{ID: "deepgram/aura-2", PromptPrice: 1e-9, CompletionPrice: 1e-9, ContextLength: 262144, InputModalities: []string{"text"}, OutputModalities: []string{"audio"}, Parameters: []string{"tools"}},
+		catalog.Model{ID: "deepgram/nova-3", PromptPrice: 1e-9, CompletionPrice: 1e-9, ContextLength: 262144, InputModalities: []string{"audio"}, OutputModalities: []string{"text"}, Parameters: []string{"tools"}},
+		catalog.Model{ID: "vendor/flux-image", PromptPrice: 1e-9, CompletionPrice: 1e-9, ContextLength: 262144, InputModalities: []string{"text"}, OutputModalities: []string{"image"}, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	var deepseek bool
+	for _, offer := range CrewOffersAt(dir) {
+		switch offer.Model.ID {
+		case "deepgram/aura-2", "deepgram/nova-3", "vendor/flux-image":
+			t.Errorf("%s was offered for a seat", offer.Model.ID)
+		case "deepseek/deepseek-v4-flash":
+			deepseek = true
+		}
+	}
+	if !deepseek {
+		t.Error("a chat model with tools was not offered")
+	}
+}
+
+// THE FREE RUNG RUNS WITH THE SWITCH OFF when every paid route is out of
+// reach: a seat's rescue after a payment failure is a free pool, and the
+// person's own model on the account that said no is not.
+func TestTheRescueFallsToAFreePoolWhenNothingPaidIsReachable(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows, catalog.Model{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true,
+		IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ContextLength: 1310720, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	history := []router.CrewRouteOutcome{{At: time.Now(), Seat: "worker", Send: "z-ai/glm-5.3-flash", Provider: "openrouter", Kind: "payment"}}
+	withRouteHistory(t, &history)
+	if CrewFreeRoutesAt(dir) {
+		t.Fatal("the switch should be off")
+	}
+	rescue := CrewRescue(dir, crewroute.Bugfix, crewroute.Worker, "moonshotai/kimi-k3")
+	if len(rescue) == 0 || rescue[0].Kind != crewroute.Free {
+		t.Fatalf("rescue %+v, want a free pool first", rescue)
+	}
+	for _, r := range rescue {
+		if r.Model == "moonshotai/kimi-k3" {
+			t.Errorf("the chat model rode the account out of credit: %+v", r)
+		}
+	}
+}
+
+// A FREE POOL CAN BE PINNED BY NAME: `:free` is a route, not a thinking level,
+// and the pin runs on the pool.
+func TestAFreePoolCanBePinnedByName(t *testing.T) {
+	pin, auto, err := ParseCrewPin("thinkingmachines/inkling-small:free@openrouter")
+	if err != nil || auto || pin.Model != "thinkingmachines/inkling-small:free" || pin.Provider != "openrouter" {
+		t.Fatalf("parse: %+v %v %v", pin, auto, err)
+	}
+	if _, _, err := ParseCrewPin("vendor/model:loud"); err == nil {
+		t.Error("an unknown suffix was taken")
+	}
+	dir := crewProfile(t)
+	got := resolveCrewPin(CrewPin{Model: "z-ai/glm-5.3-flash:free"}, CrewProvidersAt(dir))
+	if got.Kind != crewroute.Free || got.Send != "z-ai/glm-5.3-flash:free" {
+		t.Errorf("a pinned free pool resolves to %+v", got)
+	}
+}
+
+// A PIN SENDS THE ID THE PERSON WROTE when the catalog lists it, though a
+// dated snapshot of the same model is listed first; an id the catalog does
+// not list is sent as the variant it resolves to, and the line says which.
+func TestAPinSendsExactlyTheIdWritten(t *testing.T) {
+	dir := crewProfile(t)
+	rows := append([]catalog.Model{{ID: "deepseek/deepseek-v4-flash-0731", OpenWeights: true, PromptPrice: 8e-8, CompletionPrice: 1.6e-7,
+		IntelligenceIndex: 24.2, CodingIndex: 56.2, AgenticIndex: 22.2, ContextLength: 1048576, Parameters: []string{"tools"}}}, CrewCatalog()...)
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	if err := SetCrewPin(dir, crewroute.Checker, "deepseek/deepseek-v4-flash"); err != nil {
+		t.Fatal(err)
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := d.Seat(crewroute.Checker); got.Send != "deepseek/deepseek-v4-flash" || got.Model != "deepseek/deepseek-v4-flash" {
+		t.Fatalf("the pinned checker is %+v, want exactly the id written", got)
+	}
+	if strings.Contains(d.Line("", -1), "→") {
+		t.Errorf("an exact pin reads as resolved: %q", d.Line("", -1))
+	}
+
+	if err := SetCrewPin(dir, crewroute.Checker, "z-ai/glm-5.3-flash-latest"); err != nil {
+		t.Fatal(err)
+	}
+	d, err = RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := d.Seat(crewroute.Checker); got.Send != "z-ai/glm-5.3-flash" {
+		t.Fatalf("a pin the catalog lists only as a variant is %+v", got)
+	}
+	if line := d.Line("", -1); !strings.Contains(line, "glm-5.3-flash-latest → glm-5.3-flash") {
+		t.Errorf("the resolved pin is not said: %q", line)
+	}
+
+	for _, c := range CrewCandidatesAt(dir) {
+		if crewroute.Lineage(c.Model.ID) == "deepseek/deepseek-v4-flash" && c.Model.ID != "deepseek/deepseek-v4-flash" {
+			t.Errorf("the candidate is read from the snapshot %s, not the model's own row", c.Model.ID)
+		}
+	}
+}
+
+// A MODEL IS PRICED FROM ITS OWN ROW, never from a route spelling of it the
+// catalog listed first (`:floor` is the cheapest provider's price, not the
+// model's list price).
+func TestAModelIsPricedFromItsOwnRow(t *testing.T) {
+	dir := crewProfile(t)
+	rows := append([]catalog.Model{{ID: "moonshotai/kimi-k3:floor", OpenWeights: true, PromptPrice: 8.8e-7, CompletionPrice: 1.053e-5,
+		IntelligenceIndex: 43.6, CodingIndex: 76.2, AgenticIndex: 50, ContextLength: 1048576, Parameters: []string{"tools"}}}, CrewCatalog()...)
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	for _, offer := range CrewOffersAt(dir) {
+		if crewroute.Lineage(offer.Model.ID) == "moonshotai/kimi-k3" && (offer.Model.ID != "moonshotai/kimi-k3" || offer.Model.PromptPrice != 3e-6) {
+			t.Errorf("kimi-k3 is offered as %s at %v/token in", offer.Model.ID, offer.Model.PromptPrice)
+		}
+	}
+}
+
+// A DECISION ROW EXPLAINS ITSELF: only candidates that can sit a seat are
+// named, and each seat carries its best three with route, quality, cost and
+// score.
+func TestADecisionRowNamesOnlySeatableCandidatesAndItsTopThree(t *testing.T) {
+	dir := crewProfile(t)
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	for _, name := range CrewCandidateNames(dir) {
+		if name == "vendor/no-tools" {
+			t.Errorf("a model that cannot sit a seat is named a candidate")
+		}
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	top := crewTop(dir, d)
+	worker := top["worker"]
+	if len(worker) == 0 || len(worker) > 3 || worker[0].Model != d.Seat(crewroute.Worker).Model || worker[0].Route == "" {
+		t.Errorf("the worker's top is %+v, want the pick first with its route", worker)
+	}
+}
+
+// A RESCUE TAKES A GENERAL OR A CODE MODEL BEFORE ONE TUNED FOR A DOMAIN, and
+// says free routes once.
+func TestTheFreeRescuePrefersGeneralModels(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows,
+		catalog.Model{ID: "inclusionai/ling-3.0-flash-fin:free", ContextLength: 262144, IntelligenceIndex: 60, CodingIndex: 80, AgenticIndex: 60, Parameters: []string{"tools"}},
+		catalog.Model{ID: "poolside/laguna-s-2.1:free", ContextLength: 262144, CodingIndex: 40, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	history := []router.CrewRouteOutcome{{At: time.Now(), Seat: "worker", Send: "z-ai/glm-5.3-flash", Provider: "openrouter", Kind: "payment"}}
+	withRouteHistory(t, &history)
+	for _, seat := range crewroute.Seats {
+		rescue := CrewRescue(dir, crewroute.Bugfix, seat, "")
+		if len(rescue) == 0 || crewroute.DomainTuned(rescue[0].Model) {
+			t.Errorf("the %s rescue is %+v, want a general model first", seat, rescue)
+		}
+	}
+	_, notice := crewCandidatesNoticed(dir, crewHealthAt(dir))
+	if strings.Count(notice, "free routes") != 1 {
+		t.Errorf("the notice says free routes other than once: %q", notice)
+	}
+}
+
+// A SEAT THAT CANNOT START MOVES SIDEWAYS BEFORE IT MOVES UP: with the cheap
+// worker's route quarantined, the next rung is a qualified model at a similar
+// cost, not the dearest measured one — even when the model's own catalog row
+// left its indexes to a dated snapshot's row.
+func TestTheNextRungIsAtASimilarCost(t *testing.T) {
+	dir := crewProfile(t)
+	var rows []catalog.Model
+	for _, r := range CrewCatalog() {
+		if r.ID == "deepseek/deepseek-v4-flash" {
+			bare := r
+			bare.IntelligenceIndex, bare.CodingIndex, bare.AgenticIndex = 0, 0, 0
+			rows = append(rows, catalog.Model{ID: "deepseek/deepseek-v4-flash-0731", OpenWeights: true, PromptPrice: r.PromptPrice, CompletionPrice: r.CompletionPrice,
+				IntelligenceIndex: r.IntelligenceIndex, CodingIndex: r.CodingIndex, AgenticIndex: r.AgenticIndex, ContextLength: r.ContextLength, Parameters: r.Parameters}, bare)
+			continue
+		}
+		rows = append(rows, r)
+	}
+	CrewCatalog = func() []catalog.Model { return rows }
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, seat := range []crewroute.Seat{crewroute.Worker, crewroute.Planner} {
+		pick, ladder := d.Seat(seat), d.Ladder[seat]
+		if len(ladder) == 0 {
+			t.Fatalf("the %s has no ladder", seat)
+		}
+		if next := ladder[0]; next.CostUSD > 3*pick.CostUSD || crewroute.Lineage(next.Model) == "moonshotai/kimi-k3" {
+			t.Errorf("the %s's next rung from %s ($%.4f) is %s ($%.4f)", seat, pick.Model, pick.CostUSD, next.Model, next.CostUSD)
+		}
+	}
+}
+
+// A CREW'S CALLS ARE HELD TO THE LOWER OF ITS OWN CAP AND THE DAY'S LIMIT,
+// and an open-ended kimi checker to three times its estimate.
+func TestTheSpendLinesASeatCallIsHeldTo(t *testing.T) {
+	dir := crewProfile(t)
+	if err := writeProfileValues(dir, map[string]any{KeyCrewCap: 1.0, KeyDailyBudget: 0.25}); err != nil {
+		t.Fatal(err)
+	}
+	if capUSD, action := CrewSpendCap(dir, true); capUSD != 0.25 || !strings.Contains(action, "/budget") {
+		t.Errorf("with the daily limit: %v %q", capUSD, action)
+	}
+	if capUSD, action := CrewSpendCap(dir, false); capUSD != 1.0 || !strings.Contains(action, "/crew cap") {
+		t.Errorf("without it: %v %q", capUSD, action)
+	}
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	if err := SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	// The planner on another model, so the checker's model is its own.
+	if err := SetCrewPin(dir, crewroute.Planner, "z-ai/glm-5.3-flash"); err != nil {
+		t.Fatal(err)
+	}
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: openTask}})
+	if err != nil && !errors.Is(err, ErrCrewAtCap) {
+		t.Fatal(err)
+	}
+	ceilings := CrewSeatCeilings(d)
+	if est, got := d.Seat(crewroute.Checker).EstUSD, ceilings[d.Seat(crewroute.Checker).Send]; est <= 0 || math.Abs(got-3*est) > 1e-9 {
+		t.Errorf("the open-ended kimi checker's ceiling is $%.3f (estimate $%.3f)", got, d.Seat(crewroute.Checker).EstUSD)
+	}
+	// One model in every seat: the spend the guard keeps is the model's, so
+	// the checker's line would stop the worker, and there is none.
+	one := crewroute.Decision{Crew: []crewroute.Pick{
+		{Seat: crewroute.Worker, Model: "vendor/cheap", Send: "vendor/cheap"},
+		{Seat: crewroute.Checker, Model: "vendor/cheap", Send: "vendor/cheap", EstUSD: 0.01},
+	}}
+	if got := CrewSeatCeilings(one); got != nil {
+		t.Errorf("a checker sharing the worker's model has a ceiling: %v", got)
+	}
+}
+
+// A MODEL PRICED AT NOTHING THAT IS NOT A FREE POOL IS NO CANDIDATE: a stealth
+// preview listed at "0"/"0" scored as $0 and won a planner's rescue. Neither
+// it nor a row with no published price is picked — in the crew or in the free
+// rescue — while an explicit-zero `:free` pool still is.
+func TestAnUnpricedModelIsNeverPicked(t *testing.T) {
+	dir := crewProfile(t)
+	rows := CrewCatalog()
+	rows = append(rows,
+		catalog.Model{ID: "stealth/space-bunny-alpha", ContextLength: 1048576,
+			IntelligenceIndex: 70, CodingIndex: 80, AgenticIndex: 70, Parameters: []string{"tools"}},
+		catalog.Model{ID: "vendor/unpublished", PriceUnknown: true, ContextLength: 1048576,
+			IntelligenceIndex: 70, CodingIndex: 80, AgenticIndex: 70, Parameters: []string{"tools"}},
+		catalog.Model{ID: "stealth/space-bunny-alpha-2:free", PriceUnknown: true, ContextLength: 1048576,
+			IntelligenceIndex: 70, CodingIndex: 80, AgenticIndex: 70, Parameters: []string{"tools"}},
+		catalog.Model{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true, ContextLength: 1310720,
+			IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, Parameters: []string{"tools"}})
+	CrewCatalog = func() []catalog.Model { return rows }
+	unpriced := func(id string) bool {
+		return strings.Contains(id, "space-bunny") || strings.Contains(id, "unpublished")
+	}
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	d, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: fixTask}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pick := range d.Crew {
+		if unpriced(pick.Model) {
+			t.Errorf("the %s is %s", pick.Seat, pick.Model)
+		}
+		for _, rung := range d.Ladder[pick.Seat] {
+			if unpriced(rung.Model) {
+				t.Errorf("the %s's ladder holds %s", pick.Seat, rung.Model)
+			}
+		}
+	}
+	history = []router.CrewRouteOutcome{{At: time.Now(), Seat: "worker", Send: "z-ai/glm-5.3-flash", Provider: "openrouter", Kind: "payment"}}
+	for _, seat := range crewroute.Seats {
+		rescue := CrewRescue(dir, crewroute.Bugfix, seat, "")
+		if len(rescue) == 0 {
+			t.Fatalf("the %s has no free rescue", seat)
+		}
+		for _, r := range rescue {
+			if unpriced(r.Model) {
+				t.Errorf("the %s's rescue holds %s", seat, r.Model)
+			}
+		}
+	}
+}
+
+// A COMPLEX FIX IS ROUTED AS ONE ON THE REAL ROAD: RouteCrew classifies first
+// (for the learned offset) and hands the whole reading on, so the hermes
+// report runs its worker a rung above a one-line fix's, and the log row says
+// complex. ResolveSeats is the road codeaf do takes.
+func TestRouteCrewRunsAComplexFixOnAStrongerWorker(t *testing.T) {
+	dir := crewProfile(t)
+	var history []router.CrewRouteOutcome
+	withRouteHistory(t, &history)
+	report, err := os.ReadFile("../crewroute/testdata/hermes-7680.md")
+	if err != nil {
+		t.Fatal(err)
+	}
+	simple, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: "fix: typo in the loop bound of paginate() skips the last page"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	hard, err := RouteCrew(dir, CrewAsk{Task: crewroute.Task{Text: string(report)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if simple.Subclass != "simple" || hard.Subclass != "complex" {
+		t.Fatalf("subclasses %q and %q", simple.Subclass, hard.Subclass)
+	}
+	if record := CrewRecordOf(hard, "repo", "t"); record.TaskSubclass != "complex" || record.TaskReach == "" {
+		t.Errorf("the log row carries %q / %q", record.TaskSubclass, record.TaskReach)
+	}
+	sw, hw := simple.Seat(crewroute.Worker), hard.Seat(crewroute.Worker)
+	if hw.Quality <= sw.Quality {
+		t.Errorf("complex worker %s (q %.2f), simple %s (q %.2f)", hw.Model, hw.Quality, sw.Model, sw.Quality)
+	}
+	seats, err := ResolveSeats(dir, SeatFlags{}, CrewAsk{Task: crewroute.Task{Text: string(report)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if seats.Crew == nil || seats.Crew.Subclass != "complex" || seats.Crew.Seat(crewroute.Worker).Model != hw.Model {
+		t.Errorf("codeaf do's seats: %+v", seats.Crew)
+	}
+}
diff --git a/internal/config/crewmigrate.go b/internal/config/crewmigrate.go
new file mode 100644
index 0000000000..0c974738b2
--- /dev/null
+++ b/internal/config/crewmigrate.go
@@ -0,0 +1,116 @@
+package config
+
+import (
+	"strings"
+
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// A PROFILE WRITTEN BEFORE THE CREW WAS ROUTED, READ THE WAY ITS OWNER MEANT IT.
+//
+// Until 2026-09-24 a crew was a preset word — frugal, balanced, max — that
+// wrote all five tier rows at once, a family row (`open` or `all`) saying
+// which shelf the word drew from, a pick row (`table`, `catalog`, `learn`)
+// saying where unwritten seats were computed from, and a tier row could say
+// `auto` to be computed. None of those words means anything now: every seat
+// nobody pinned is routed per task. So a profile carrying them is read like
+// this, and migrated once, with one line saying so:
+//
+//   - the preset word, the pick word and an `auto` row are read as AUTO;
+//   - the family row's `open` becomes the allowed-models rule `open`, because
+//     it said which models the person would accept, which is exactly what that
+//     rule says now; `all` is the default and needs no row;
+//   - a seat row holding ANY model id is A PIN — even one a retired preset
+//     once wrote, and even three rows holding the same id. There is no telling
+//     from a row which hand wrote it, and a pick never overrides a model id
+//     that may have been a person's: the rule the old picker kept, kept.
+//
+// The reading is applied on every read until the migration writes it down
+// ([MigrateCrew]), so a build that has not yet migrated a profile still runs
+// the crew its owner meant.
+
+// The retired rows, spelled here and nowhere else.
+const (
+	legacyKeyCrew       = "models.crew"
+	legacyKeyCrewSource = "models.crew.source"
+	legacyKeyCrewPick   = "models.crew.pick"
+)
+
+// legacyWords are the retired preset and pick words a seat row may hold.
+var legacyWords = map[string]bool{
+	"frugal": true, "balanced": true, "max": true, "table": true, "catalog": true, "learn": true, CrewAuto: true,
+}
+
+// crewSeatTiers are the three tier rows that hold crew pins.
+var crewSeatTiers = []string{ModelTierWorker, ModelTierHigh, ModelTierMastermind}
+
+// legacyCrewClearing is the write that migrates a profile: every retired row
+// removed, the family's `open` carried onto the allowed rule, and every seat
+// row that is not a person's pin removed. It is empty for a profile with
+// nothing retired on it, and any crew write folds it into its own one write.
+func legacyCrewClearing(profileDir string) map[string]any {
+	values := map[string]any{}
+	for _, key := range []string{legacyKeyCrew, legacyKeyCrewPick} {
+		if _, held := persistedValue(profileDir, key); held {
+			values[key] = removeProfileKey
+		}
+	}
+	if source, held := persistedString(profileDir, legacyKeyCrewSource); held {
+		values[legacyKeyCrewSource] = removeProfileKey
+		if strings.EqualFold(strings.TrimSpace(source), "open") {
+			if _, answered := persistedValue(profileDir, KeyCrewAllowed); !answered {
+				values[KeyCrewAllowed] = "open"
+			}
+		}
+	}
+	for _, tier := range crewSeatTiers {
+		value, held := persistedString(profileDir, tierKeyFor(tier))
+		if !held {
+			continue
+		}
+		word := strings.ToLower(strings.TrimSpace(value))
+		if word == "" || legacyWords[word] {
+			values[tierKeyFor(tier)] = removeProfileKey
+		}
+	}
+	return values
+}
+
+// MigrateCrew writes a retired crew's reading down, once, and answers the one
+// line that says so — empty for a profile with nothing to migrate, which is
+// every profile after the first run of this build.
+//
+// THE LINE IS SAID ONCE BECAUSE THE MIGRATION IS DONE ONCE: after it, the
+// retired rows are gone and nothing is left to say it about. It names what
+// stayed pinned, because a person whose crew changed shape under them is owed
+// the half that did not.
+func MigrateCrew(profileDir string) (string, error) {
+	values := legacyCrewClearing(profileDir)
+	if len(values) == 0 {
+		return "", nil
+	}
+	if err := writeProfileValues(profileDir, values); err != nil {
+		return "", err
+	}
+	// The seats in the order the manual and the panel list them.
+	var kept []string
+	pins := CrewPinsAt(profileDir)
+	for _, seat := range crewroute.Seats {
+		if pin, ok := pins[seat]; ok {
+			kept = append(kept, string(seat)+" "+pin.String())
+		}
+	}
+	line := "your crew is auto now · codeaf picks the worker, planner and checker for each task"
+	if len(kept) > 0 {
+		// A PERSON WHOSE SEATS STAYED PINNED IS TOLD THAT FIRST: nothing they
+		// wrote was changed, and only the seats they left open are picked.
+		line = "kept your pins: " + strings.Join(kept, ", ")
+		if len(kept) < len(crewSeatTiers) {
+			line += " · the other seats are picked for each task"
+		}
+	}
+	if rule, held := values[KeyCrewAllowed]; held {
+		line += " · allowed models: " + rule.(string)
+	}
+	return line + " · " + CrewCommand + " to see it", nil
+}
diff --git a/internal/config/crewspend.go b/internal/config/crewspend.go
new file mode 100644
index 0000000000..384729c4e6
--- /dev/null
+++ b/internal/config/crewspend.go
@@ -0,0 +1,106 @@
+package config
+
+import (
+	"fmt"
+	"math"
+
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// WHAT A SEAT CALL IS HELD TO BEFORE IT IS MADE (internal/session's
+// spendguard.go does the holding): the model's prices, the day's cap, and each
+// seat's own ceiling on one task.
+
+// CrewCallPrice is a model's prices per token — prompt, completion, cache
+// read — as the catalog or the evidence table knows them. ok is false for a
+// model neither prices, and for a free pool.
+func CrewCallPrice(model string) (prompt, completion, cacheRead float64, ok bool) {
+	m, known := crewCatalogModel(model)
+	if !known || (m.PromptPrice <= 0 && m.CompletionPrice <= 0) {
+		return 0, 0, 0, false
+	}
+	return m.PromptPrice, m.CompletionPrice, m.CacheReadPrice, true
+}
+
+// CrewSpendCap is the day's cap a crew's seat calls are held to, and the one
+// sentence a call it stops ends on: the crew's own daily cap
+// ([CrewCapAt]), or — where withDaily says the run is bound by it — the
+// day's spending limit ([DailyBudgetUSDAt]), whichever is lower. Zero is no
+// cap.
+func CrewSpendCap(profileDir string, withDaily bool) (float64, string) {
+	capUSD, action := CrewCapAt(profileDir), ""
+	if capUSD > 0 {
+		action = "today's crew spend has reached the daily cap of " + crewroute.Money(capUSD) + " · raise it with /crew cap"
+	}
+	if withDaily {
+		if daily, err := DailyBudgetUSDAt(profileDir); err == nil && daily > 0 && (capUSD <= 0 || daily < capUSD) {
+			capUSD = daily
+			action = fmt.Sprintf("today's spending limit of $%.2f is reached · raise it with /budget", daily)
+		}
+	}
+	return capUSD, action
+}
+
+// CrewTaskSpendCap is the per-task limit every priced call of one task is
+// held to ([CrewTaskCapAt]) and the sentence a call it stops ends on. It is
+// not lifted by --yes-spend: that flag answers the day's questions, not this.
+func CrewTaskSpendCap(profileDir string) (float64, string) {
+	capUSD := CrewTaskCapAt(profileDir)
+	return capUSD, CrewTaskCapAction(capUSD)
+}
+
+// CrewTaskCapAction is the sentence a call the per-task limit stops ends on.
+func CrewTaskCapAction(capUSD float64) string {
+	return "this task reached its " + CrewTaskMoney(capUSD) + " limit · raise it in /crew"
+}
+
+// CrewTaskMoney is a per-task limit in words: whole dollars without cents
+// ($5), anything else to the cent ($2.50).
+func CrewTaskMoney(usd float64) string {
+	if usd == math.Trunc(usd) {
+		return fmt.Sprintf("$%.0f", usd)
+	}
+	return fmt.Sprintf("$%.2f", usd)
+}
+
+// CrewSeatCeilings is each seat's own spend ceiling on one task, keyed by the
+// ids the seat is asked for: the CHECKER'S, a few times what it is expected to
+// cost and never under a floor. A check is the seat whose length nothing else
+// bounds — it reads until it is satisfied — and one that ran to eleven times
+// its estimate on a dear model was the whole of a day's overshoot. A seat on a
+// route that bills nothing has no ceiling.
+func CrewSeatCeilings(d crewroute.Decision) map[string]float64 {
+	checker := d.Seat(crewroute.Checker)
+	if checker.EstUSD <= 0 {
+		return nil
+	}
+	ceiling := checker.EstUSD * crewCheckCeilingTimes
+	if ceiling < crewCheckCeilingFloor {
+		ceiling = crewCheckCeilingFloor
+	}
+	// A CHECKER ON A MODEL ANOTHER SEAT ALSO SITS has no ceiling: the guard
+	// keeps a model's spend, not a seat's, and a crew whose three seats are one
+	// model would stop its WORKER at the checker's line.
+	for _, pick := range d.Crew {
+		if pick.Seat != crewroute.Checker && (pick.Send == checker.Send || pick.Model == checker.Model) {
+			return nil
+		}
+	}
+	out := map[string]float64{}
+	for _, id := range []string{checker.Send, checker.Model} {
+		if id != "" {
+			out[id] = ceiling
+		}
+	}
+	return out
+}
+
+// CrewCheckCeilingAction is the sentence a check its ceiling ends says, with
+// the ceiling's dollars.
+const CrewCheckCeilingAction = "the check stopped at its spend ceiling of $%.2f, three times its estimate, before it finished"
+
+// The checker's ceiling: how many times its estimate, and the least it is.
+const (
+	crewCheckCeilingTimes = 3.0
+	crewCheckCeilingFloor = 0.05
+)
diff --git a/internal/config/crewword_test.go b/internal/config/crewword_test.go
deleted file mode 100644
index 1e5b2d6d1b..0000000000
--- a/internal/config/crewword_test.go
+++ /dev/null
@@ -1,155 +0,0 @@
-package config
-
-import (
-	"testing"
-
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
-)
-
-// A CREW WORD A RUN STORES IS THE BUDGET ITS SEATS RUN AT.
-//
-// The crew row is derived from the five tier rows and this build never stores
-// it — but a run that writes ONE word into config.json instead of the five
-// rows (a harness, a hand edit) is asking for a budget, and a word that sits on
-// disk unread is a crew word that reached nobody. The seats nobody wrote then
-// read that word's own table rows, under whatever family the profile names.
-func TestAStoredCrewWordSeatsItsPreset(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-
-	// Frugal and max are the two the default family tells apart from balanced
-	// in a seat a task pays for: frugal's careful seat and max's worker are the
-	// cells that move. Balanced is the preset a profile reads anyway, so it
-	// proves nothing here.
-	for _, preset := range []string{CrewFrugal, CrewMax} {
-		row, ok := CrewModelsForSource(DefaultCrewSource, preset)
-		if !ok {
-			t.Fatalf("there is no %s preset in the %s family", preset, DefaultCrewSource)
-		}
-		dir := writeProfileRows(t, map[string]string{KeyCrew: preset})
-		for _, tier := range []string{ModelTierWorker, ModelTierHigh} {
-			seat := TierSeatAt(dir, tier)
-			if seat.Model != row[tier] {
-				t.Errorf("crew=%s: the %s seat reads %q, want the preset's own %q",
-					preset, tier, seat.Model, row[tier])
-			}
-		}
-		// And the word is the word: the crew reads as the preset the run asked
-		// for, not the default it fell to.
-		if got := CrewAt(dir); got != preset {
-			t.Errorf("crew=%s: the crew word reads %q", preset, got)
-		}
-	}
-
-	// A word this build does not know is no word at all, and an untouched
-	// profile is unchanged — the seam fires only on a preset on disk.
-	unknown := writeProfileRows(t, map[string]string{KeyCrew: "knee"})
-	if got := TierSeatAt(unknown, ModelTierWorker).Model; got != DefaultWorkerModel {
-		t.Errorf("an unknown crew word seated %q, want the build's own default %q", got, DefaultWorkerModel)
-	}
-	untouched := t.TempDir()
-	if got := TierSeatAt(untouched, ModelTierWorker); got.Source != SeatDefault || got.Crew != "" {
-		t.Errorf("an untouched profile reads %q (%s), want the default rung as before", got.Model, got.Rung())
-	}
-}
-
-// A PINNED ROW SURVIVES THE LEARNED PICK.
-//
-// The knee of a Pareto arm pins the crew table's OWN ids — `glm-5.3-flash` for
-// the worker, `fable-5.1` for the careful seat — and the pick used to answer
-// them anyway, on the value-comparison rule that a row holding the preset's own
-// table value is the preset answering rather than a pin. A hand pin writes ONE
-// row, where a `/crew` APPLY writes all five, so a partial write is the person's
-// own rows and the pick leaves them alone — with or without a stored crew word.
-func TestAPinnedRowSurvivesTheLearnedPick(t *testing.T) {
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	balanced, ok := CrewModelsForSource(DefaultCrewSource, CrewBalanced)
-	if !ok {
-		t.Fatalf("there is no %s preset in the %s family", CrewBalanced, DefaultCrewSource)
-	}
-	pins := map[string]string{
-		tierKeyFor(ModelTierWorker): balanced[ModelTierWorker],
-		tierKeyFor(ModelTierHigh):   balanced[ModelTierHigh],
-	}
-	// Both the Pareto arm's shape (a stored crew word beside its pins) and the
-	// bare pin the brief writes are pins: the stored word is not what makes them
-	// win, but it must not cost them their rung either.
-	for _, tc := range []struct {
-		name string
-		rows map[string]string
-	}{
-		{"a stored word beside the pins", map[string]string{KeyCrew: CrewBalanced}},
-		{"the pins alone", map[string]string{}},
-	} {
-		rows := map[string]string{KeyCrewPick: CrewPickLearn}
-		for k, v := range tc.rows {
-			rows[k] = v
-		}
-		for k, v := range pins {
-			rows[k] = v
-		}
-		dir := writeProfileRows(t, rows)
-		for _, tier := range []string{ModelTierWorker, ModelTierHigh} {
-			seat := TierSeatAt(dir, tier)
-			if seat.Model != pins[tierKeyFor(tier)] {
-				t.Errorf("%s: a pinned %s under %s reads %q, want the pin %q",
-					tc.name, tier, CrewPickLearn, seat.Model, pins[tierKeyFor(tier)])
-			}
-		}
-	}
-
-	// THE CONTROL: a seat nobody wrote is still computed — the pick answers for
-	// the seats the person did not name.
-	dir := writeProfileRows(t, map[string]string{
-		KeyCrewPick:                 CrewPickLearn,
-		tierKeyFor(ModelTierWorker): balanced[ModelTierWorker],
-	})
-	mind := TierSeatAt(dir, ModelTierMastermind)
-	if mind.Source != SeatLearned {
-		t.Errorf("an unwritten seat under %s reads %q (%s), want a learned seat",
-			CrewPickLearn, mind.Model, mind.Rung())
-	}
-}
-
-// A CREW APPLIED WHOLE STILL COMPUTES ITS DIAL SEATS UNDER A PICK.
-//
-// `/crew balanced` writes all five tier rows at once, at the preset's own ids,
-// and the pick is meant to compute those three dial seats at the crew's budget.
-// Only a PARTIAL write is a person's pin, so a whole crew keeps the old rule: a
-// row holding the preset's own table value is the preset answering.
-func TestAWholeCrewApplyStillComputesUnderTheLearnedPick(t *testing.T) {
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	dir := t.TempDir()
-	if err := ApplyCrew(dir, CrewBalanced); err != nil {
-		t.Fatal(err)
-	}
-	if err := SetCrewPick(dir, CrewPickLearn); err != nil {
-		t.Fatal(err)
-	}
-	if !allTiersWritten(dir) {
-		t.Fatal("a crew apply did not write all five tier rows")
-	}
-
-	_, front, _ := crewpick.Presets(crewpick.Front(autoCandidates(autoTestRows()), crewpick.DefaultShapes(), crewpick.All))
-	for _, tc := range []struct {
-		tier string
-		want string
-	}{
-		{ModelTierWorker, front.Worker},
-		{ModelTierHigh, front.High},
-		{ModelTierMastermind, front.Mastermind},
-	} {
-		seat := TierSeatAt(dir, tc.tier)
-		if seat.Model != tc.want || seat.Source != SeatLearned {
-			t.Errorf("the applied crew's %s under %s reads %q (%s), want the computed %q (learned)",
-				tc.tier, CrewPickLearn, seat.Model, seat.Source, tc.want)
-		}
-	}
-}
diff --git a/internal/config/custom_test.go b/internal/config/custom_test.go
index e4569b0c54..5ebffcada8 100644
--- a/internal/config/custom_test.go
+++ b/internal/config/custom_test.go
@@ -244,7 +244,9 @@ func TestRenameConnectionWithAnInvalidTierValueLeavesEveryRowUnchanged(t *testin
 	if got := TierModelAt(dir, ModelTierLow); got != "homelab/b:low" {
 		t.Fatalf("the low tier moved before the failure: %q", got)
 	}
-	if got := TierModelAt(dir, ModelTierHigh); got != "homelab/a:mid" {
+	// The checker row is a crew seat, and a value the tier gate refuses is not
+	// a pin it runs — so the row is read as it stands on disk.
+	if got, _ := persistedString(dir, KeyTierHighModel); got != "homelab/a:mid" {
 		t.Fatalf("the high tier did not keep the value the rename refused: %q", got)
 	}
 	if got := ModelFallbacksAt(dir); got != "homelab/a, openai/x" {
diff --git a/internal/config/derivation_test.go b/internal/config/derivation_test.go
index c0728fe6cb..69b3253a54 100644
--- a/internal/config/derivation_test.go
+++ b/internal/config/derivation_test.go
@@ -139,10 +139,6 @@ var settingReaders = map[string]string{
 	// the word into poolcfg beside the mode, and the puller's keys resolve
 	// from there (cmd/codeaf's poolTrustedKeys).
 	KeyModelPoolPublicKey: "ModelPoolAt",
-	// The crew's pick row names its resolver: the surfaces read the pick to
-	// say it beside the crew word, and the ladder turns it into computed seats
-	// ([pickedSeat]) — the identifier proves the word reaches a surface.
-	KeyCrewPick: "CrewPickAt",
 	// The prompt-profile row names the session field the word lands in, which
 	// is what the far side actually reads: cmd/codeaf's applyV3Governance puts
 	// PromptProfileAt's answer there and internal/session's promptprofile.go
@@ -268,17 +264,6 @@ var settingReaders = map[string]string{
 	// low row prove this one. cmd/codeaf's crew source and internal/tui3's
 	// settings skin both reach it by this name.
 	KeyTierMastermindModel: "TierMastermind",
-	// The crew row is the four tier rows answered as one word, and what reads it
-	// is /crew (internal/tui3's crew.go) — the row's own reader, named here
-	// rather than the writer, because a row that could be set and never read
-	// would be exactly the dial-wired-to-nothing this table exists to catch.
-	KeyCrew: "CrewAt",
-	// The source row's own reader is CrewSourceAt, and the picker reaches it by
-	// that name (internal/tui3's crew.go), so the row names its reader rather
-	// than the crew derivation one hop away. The crew's writer resolves through
-	// the same reader, so the row and the five ids it produces cannot disagree
-	// about which family the preset words mean.
-	KeyCrewSource: "CrewSourceAt",
 	// The reflex row names the ROLE that reaches it rather than TierKey, which
 	// its two neighbours share: internal/reflex resolves [roles.RoleReflex] and
 	// nothing else lands on this key, so naming the shared spelling a third
diff --git a/internal/config/firstrun.go b/internal/config/firstrun.go
index bb96fa8cec..975fdbac85 100644
--- a/internal/config/firstrun.go
+++ b/internal/config/firstrun.go
@@ -60,23 +60,6 @@ func APIKeyConfigured(profileDir string) bool {
 	return APIKeyAt(profileDir) != ""
 }
 
-// CrewConfigured is whether a person has ever answered the crew: any of the
-// tier rows, or the family row above them, is in the profile file. It is any
-// rather than all because [ApplyCrew] writes the tier rows together, and a
-// person who pinned one tier by hand, or chose a family, has an opinion the
-// setup must not paper over with a preset.
-func CrewConfigured(profileDir string) bool {
-	if _, ok := persistedString(profileDir, KeyCrewSource); ok {
-		return true
-	}
-	for _, tier := range ModelTiers {
-		if _, ok := persistedString(profileDir, tierKeyFor(tier)); ok {
-			return true
-		}
-	}
-	return false
-}
-
 // DailyBudgetConfigured is whether a person has answered the daily ceiling: the
 // environment pins it, or the profile file holds it.
 func DailyBudgetConfigured(profileDir string) bool {
diff --git a/internal/config/firstrun_test.go b/internal/config/firstrun_test.go
index c8b8c749ed..abf6f5b71c 100644
--- a/internal/config/firstrun_test.go
+++ b/internal/config/firstrun_test.go
@@ -16,25 +16,25 @@ func TestAFreshProfileIsMissingAllThreeAndAnAnsweredOneIsNot(t *testing.T) {
 	t.Setenv("CODEAF_DAILY_BUDGET", "")
 	dir := t.TempDir()
 
-	if APIKeyConfigured(dir) || CrewConfigured(dir) || DailyBudgetConfigured(dir) {
-		t.Fatal("a profile nobody has touched must read as unanswered on all three")
+	if APIKeyConfigured(dir) || DailyBudgetConfigured(dir) {
+		t.Fatal("a profile nobody has touched must read as unanswered on both")
 	}
-	// The crew and the ceiling both RESOLVE on that profile — to the defaults —
-	// and that is exactly what must not count.
-	if CrewAt(dir) != DefaultCrew {
-		t.Fatalf("crew resolves to %q, want the default", CrewAt(dir))
+	// The crew RESOLVES on that profile — every seat auto — and that is
+	// exactly what must not count.
+	if pins := CrewPinsAt(dir); len(pins) != 0 {
+		t.Fatalf("an untouched profile has pins %v", pins)
 	}
 
 	if err := WriteAPIKey(dir, " sk-or-v1-abc "); err != nil {
 		t.Fatal(err)
 	}
-	if err := ApplyCrew(dir, CrewMax); err != nil {
+	if err := SetCrewCap(dir, "5"); err != nil {
 		t.Fatal(err)
 	}
 	if err := WriteDailyBudgetUSD(dir, 7); err != nil {
 		t.Fatal(err)
 	}
-	if !APIKeyConfigured(dir) || !CrewConfigured(dir) || !DailyBudgetConfigured(dir) {
+	if !APIKeyConfigured(dir) || !DailyBudgetConfigured(dir) {
 		t.Fatal("every answered row must read as configured")
 	}
 	if got := PersistedAPIKey(dir); got != "sk-or-v1-abc" {
@@ -149,25 +149,16 @@ func TestTheAPIKeyRowMasksReadsTheShellFirstAndWritesTheProfile(t *testing.T) {
 	}
 }
 
-// THE FAMILY IS AN OPINION TOO. A person who chose a family and never pinned a
-// tier has still answered the crew, so the setup must not paper over it with a
-// preset: the law the tier rows already carry, extended to the row above them.
-// And a family nobody chose is the default, which is NOT an answer.
-func TestTheFamilyRowCountsAsAnAnsweredCrew(t *testing.T) {
+// THE ALLOWED RULE NOBODY WROTE IS `all`, and narrowing it is read back.
+func TestTheAllowedRuleDefaultsToAllAndReadsBack(t *testing.T) {
 	dir := t.TempDir()
-	if CrewConfigured(dir) {
-		t.Fatal("a profile nobody has touched must read as unanswered")
-	}
-	if got := CrewSourceAt(dir); got != DefaultCrewSource {
-		t.Fatalf("an untouched profile reads the family as %q, want the default", got)
+	if got := CrewAllowedAt(dir).String(); got != "all" {
+		t.Fatalf("an untouched profile allows %q, want all", got)
 	}
-	if err := SetCrewSource(dir, CrewSourceAll); err != nil {
+	if err := SetCrewAllowed(dir, "open"); err != nil {
 		t.Fatal(err)
 	}
-	if !CrewConfigured(dir) {
-		t.Fatal("a profile whose family was chosen must read as answered")
-	}
-	if got := CrewSourceAt(dir); got != CrewSourceAll {
-		t.Fatalf("the family row reads %q after it was written", got)
+	if got := CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("a narrowed rule reads back %q", got)
 	}
 }
diff --git a/internal/config/freecrew.go b/internal/config/freecrew.go
index 439eee77e4..7d18f08604 100644
--- a/internal/config/freecrew.go
+++ b/internal/config/freecrew.go
@@ -3,27 +3,26 @@ package config
 // FreeChatModel is the build's chat bottom rung while a known account is low.
 const FreeChatModel = "qwen/qwen3.8-27b:free"
 
-// CrewFree is a derived reading of the five free seats, never a saved preset.
-const CrewFree = "free"
-
-// The free table is hand-picked because the ordinary crew picker rejects zero
-// tariffs; each seat must remain usable without an account top-up.
-var freeCrewModels = map[string]string{
-	ModelTierReflex:     "nvidia/nemotron-3.5-lightning:free",
-	ModelTierLow:        "thinkingmachines/inkling-small:free",
-	ModelTierWorker:     FreeChatModel,
-	ModelTierHigh:       "thinkingmachines/inkling:free",
-	ModelTierMastermind: FreeChatModel,
+// freeHelperModels are the free models the two rows that are not crew seats —
+// reflex and small work — read while a known account is low. The table is
+// hand-picked because an ordinary pick rejects zero tariffs; each row must
+// stay usable without an account top-up.
+//
+// The three crew seats are not here: they are routed per task, and a known-low
+// account reaches the router as an OpenRouter account out of credit
+// ([crewHealthAt]), which moves the seats onto free routes with the router's
+// own notice.
+var freeHelperModels = map[string]string{
+	ModelTierReflex: "nvidia/nemotron-3.5-lightning:free",
+	ModelTierLow:    "thinkingmachines/inkling-small:free",
 }
 
-// freeTierModelAt is the only low-credit check beneath an unwritten table seat.
-func freeTierModelAt(profileDir, family, tier string) string {
-	if useFreeDefaultsAt(profileDir) && CrewPickAt(profileDir) == CrewPickTable {
-		if _, stored := storedCrewWord(profileDir); !stored {
-			if model := freeCrewModels[tier]; model != "" {
-				return model
-			}
+// freeTierModelAt is the only low-credit check beneath an unwritten helper row.
+func freeTierModelAt(profileDir, tier string) string {
+	if useFreeDefaultsAt(profileDir) {
+		if model := freeHelperModels[tier]; model != "" {
+			return model
 		}
 	}
-	return defaultTierModel(family, tier)
+	return builtinTierModel(tier)
 }
diff --git a/internal/config/projectconfig_test.go b/internal/config/projectconfig_test.go
index a82bfc5cf0..298ba974e0 100644
--- a/internal/config/projectconfig_test.go
+++ b/internal/config/projectconfig_test.go
@@ -93,12 +93,14 @@ func TestEveryProjectRowResolvesProjectOverProfileOverDefault(t *testing.T) {
 	}{
 		{KeyToolApprovalMode, "deny", "allow", DefaultToolApprovalMode},
 		{KeyToolApprovals, "bash:deny", "bash:allow", ""},
-		// The two tier rows ARRIVE WITH A MODEL IN THEM since the crew landed
-		// (crew.go), so their built-in reading is this build's own choice for
-		// that class of work rather than nothing. The ladder is unchanged: the
-		// repository's answer, then the person's, then the shipped one.
+		// The small-work row ARRIVES WITH A MODEL IN IT, so its built-in
+		// reading is this build's own near-free model. The checker row is a
+		// crew seat and has no shipped model: unpinned, it is routed, and a
+		// profile with no provider connected has nothing to route to — empty,
+		// which follows the conversation. The ladder is unchanged: the
+		// repository's answer, then the person's, then the built-in one.
 		{KeyTierLowModel, "project/cheap", "profile/cheap", DefaultLowModel},
-		{KeyTierHighModel, "project/capable", "profile/capable", DefaultHighModel},
+		{KeyTierHighModel, "project/capable", "profile/capable", ""},
 		{KeyModelRoles, "title:project/title", "title:profile/title", ""},
 	} {
 		got, err := ProjectStringAt(project, profile, row.key)
diff --git a/internal/config/seats.go b/internal/config/seats.go
index 315fc4cd26..635cf9a263 100644
--- a/internal/config/seats.go
+++ b/internal/config/seats.go
@@ -1,311 +1,82 @@
 package config
 
 import (
+	"errors"
 	"strings"
 
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/env"
 )
 
-// THE TWO SEATS EVERY DOOR SITS SOMEBODY IN, RESOLVED ONE WAY.
+// THE THREE SEATS EVERY DOOR SITS SOMEBODY IN, RESOLVED ONE WAY.
 //
-// A run needs two models named before it can start: the one that plans and the
-// one that works. The chat surface has always asked the profile for them — a
-// role rides a tier, a tier is a crew row, and /crew writes all four
-// ([ApplyCrew], internal/roles) — while every headless door resolved its own
-// pair from a flag and an environment variable and never opened the profile at
-// all. So "my crew is frugal", said in the product's own vocabulary, held in the
-// conversation and was silently lost the moment the same brain ran under `do`
-// (#166). The benchmark that found it had to hand-translate a preset into two
-// slugs, which is the one-source-of-truth violation the crew exists to prevent.
+// A run needs its crew named before it can start: the worker that does the
+// work, the planner that structures it, the checker that reads the result.
+// Every door — `codeaf do`, `plan run`, `plan new`, `exec`, a saved program —
+// resolves them here, through one ladder, so a pin said in the product's own
+// vocabulary holds on every surface (#166 was the day it did not).
 //
-// [ResolveSeats] is the whole ladder, in one place, for every door: the flag, the
-// environment, the crew, the shipped default. It lives beside [CrewAt] rather
-// than in the commands because a fifth door must inherit it by calling it, not
-// by remembering to re-derive it — a rung copied into four files is a rung that
-// will differ in one of them.
+// THE LADDER, ONCE PER SEAT:
 //
-// IT ALSO REPORTS WHICH RUNG ANSWERED. That is not decoration: the whole defect
-// was invisible from outside, and a run whose receipt names the rung can be
-// checked by the script that ran it. [Config.Load] cannot answer that question —
-// it folds the environment and the default together into one string — which is
-// why the ladder reads the environment itself rather than reading it back off a
-// loaded config.
+//  1. the flag, which is what this invocation said — a ONE-TASK PIN;
+//  2. the environment, which is what this campaign said — a pin too;
+//  3. a one-task `--pin`, then the profile's pin (/crew pin);
+//  4. THE ROUTER, for every seat nothing above named: the task is classified
+//     and the seat picked for it (internal/crewroute, [RouteCrew]).
+//
+// THERE IS NO FIFTH RUNG. A seat nothing pinned is routed; it never falls
+// back to a model this build chose for everybody, and the check seat never
+// quietly inherits the planner's model because only the planner was named —
+// a person who pinned the planner said something about planning.
+//
+// IT ALSO REPORTS WHICH RUNG ANSWERED, because the defect this file was
+// written for was invisible from outside, and a run whose receipt names the
+// rung can be checked by the script that ran it.
 
-// SeatRole is which of the two seats one answer fills. It is on the [Seat] so a
-// seat can name its own flag and its own variable rather than being handed them.
+// SeatRole is which of the three seats one answer fills, by the name a person
+// reads. It is on the [Seat] so a seat can name its own flag and variable.
 type SeatRole string
 
 const (
-	// SeatWork is the model that does the work.
-	SeatWork SeatRole = "work"
-	// SeatPlan is the model that structures it — plans, replans, contracts, the
-	// delivery gate. Empty is legal here and means "the work model plans too";
-	// see [Config.PlanModelResolved].
-	SeatPlan SeatRole = "plan"
-	// SeatCheck is the model that checks finished work. It has no flagless
-	// rung of its own here: an empty check seat is the crew's careful row,
-	// read by the run's crew factory rather than resolved here, because the
-	// check is the one seat a two flag run must not let a third model fill.
-	SeatCheck SeatRole = "check"
+	// SeatWork is the worker: the model that does the work.
+	SeatWork SeatRole = "worker"
+	// SeatPlan is the planner: plans, replans, contracts, the delivery gate.
+	SeatPlan SeatRole = "planner"
+	// SeatCheck is the checker: the model that reads finished work.
+	SeatCheck SeatRole = "checker"
 )
 
-// SeatSource is the rung that answered, and the five constants are the ladder in
-// order. It is an enum rather than a sentence because a caller putting it in
-// JSON is making a promise a script parses.
+// crewSeatOf is the router's seat for a role.
+func crewSeatOf(role SeatRole) crewroute.Seat {
+	switch role {
+	case SeatPlan:
+		return crewroute.Planner
+	case SeatCheck:
+		return crewroute.Checker
+	}
+	return crewroute.Worker
+}
+
+// SeatSource is the rung that answered. It is an enum rather than a sentence
+// because a caller putting it in JSON is making a promise a script parses.
 type SeatSource string
 
 const (
-	// SeatFlag is `--model` or `--plan-model`: the most recent thing the person
-	// said, and it always wins.
+	// SeatFlag is `--model`, `--plan-model` or `--check-model`: the most recent
+	// thing the person said, and it always wins.
 	SeatFlag SeatSource = "flag"
-	// SeatEnv is the environment: automation's override, set once for a campaign
-	// instead of threaded onto every invocation.
+	// SeatEnv is the environment: automation's override, set once for a
+	// campaign instead of threaded onto every invocation.
 	SeatEnv SeatSource = "env"
-	// SeatCrew is the profile's own tier row — what /crew wrote.
-	SeatCrew SeatSource = "crew"
-	// SeatInherited is the profile's crew answering through an OLDER row than
-	// this seat's own, because the profile was written before this seat existed
-	// ([tierLineage]). It is still the crew answering — the model came from what
-	// the person chose — and it is a separate rung because a person is owed the
-	// difference between "the row you wrote" and "the row your row was split out
-	// of".
-	SeatInherited SeatSource = "inherited"
-	// SeatComputed is a tier row that says `auto` answering from the catalog:
-	// the seat's model computed off the published figures at read time
-	// ([AutoPick]). It is a rung of the crew's own, not the build's default —
-	// the person wrote the row — and it says so because a receipt that called it
-	// `crew` would hide the one fact a reader of the run is checking: the id was
-	// derived, not named.
-	SeatComputed SeatSource = "computed"
-	// SeatTable is a tier row that says `auto` answering from the family's
-	// table row ([autoRow], [pickedModel]) because nothing could be computed —
-	// no catalog, or no pick off it. The id is the preset's own, and the rung
-	// says which kind of answer it was.
-	SeatTable SeatSource = "table"
-	// SeatLearned is a seat computed at the crew's budget under the `learn`
-	// pick ([CrewPickAt]): the catalog's own figures, plus the Model Pool's
-	// measurements and the person's own judged runs carried as a quality
-	// prior. It is a rung of its own, beside [SeatComputed], because the one
-	// fact a reader of a run is checking — was this id derived, and from
-	// what — is a different answer under the two words: the catalog alone,
-	// or the catalog plus what runs measured.
-	SeatLearned SeatSource = "learned"
-	// SeatDefault is this build's choice, for a profile that has never said
-	// anything about models at all.
+	// SeatPinned is a pin: the profile's own (/crew pin) or a one-task `--pin`.
+	SeatPinned SeatSource = "pinned"
+	// SeatRouted is the router's pick for this task.
+	SeatRouted SeatSource = "routed"
+	// SeatDefault is this build's own model for a tier that is not a crew
+	// seat — reflex and small work — on a profile that never wrote the row.
 	SeatDefault SeatSource = "default"
 )
 
-// tierLineage is THE TABLE THAT MAKES A NEW SEAT SAFE TO ADD, and every tier
-// word has a row in it whether or not it has an ancestor.
-//
-// A seat added to the ladder after people have profiles is a seat their profiles
-// have no key for, and the ladder would fall past the crew they chose to this
-// build's default — which is what happened when the worker row landed (#302):
-// four pinned rows, and all the work quietly running on a model nobody picked.
-// So the rule is written once, here, rather than discovered again per seat: A
-// TIER WITH NO KEY OF ITS OWN INHERITS FROM THE ROW IT WAS SPLIT OUT OF, AND
-// SAYS THAT IT DID. A tier that is nobody's descendant declares that by naming
-// no ancestor, explicitly, so the next tier cannot join the table by forgetting
-// to.
-//
-// Words is what the settings sheet calls the row, because the one line a person
-// reads about the substitution has to name a row they can go and find.
-//
-// AND THE READ NEVER REPAIRS THE PROFILE. Writing the inherited key back would
-// end the substitution for good after one run, and it would also mean every
-// `codeaf do` — several at once on the same profile, on a machine where the disk
-// may be full — rewrites the file a person's crew lives in, to record a decision
-// this build made rather than one they did. [ApplyCrew] already writes every
-// row, so a person who answers the line ends it themselves, once, deliberately.
-var tierLineage = map[string]struct {
-	// Inherits is the tier this one falls back to, or empty for a tier that has
-	// always existed and inherits from nothing.
-	Inherits string
-	// Words is this row's name on the settings sheet.
-	Words string
-}{
-	ModelTierReflex: {Words: "reflex"},
-	ModelTierLow:    {Words: "small work"},
-	// The worker seat was split out of the small-work row in #278: before it,
-	// the work seat of every headless run and every node of an adaptive run
-	// resolved through `models.tiers.low`. That row is therefore the honest
-	// ancestor — a profile pinned before #278 meant its small-work model when it
-	// said what the work should run on.
-	ModelTierWorker:     {Inherits: ModelTierLow, Words: "worker"},
-	ModelTierHigh:       {Words: "careful work"},
-	ModelTierMastermind: {Words: "thinking"},
-}
-
-// tierWords is a row's name on the settings sheet, for the one line that has to
-// send somebody to it. An unknown tier answers with its own word, which is what
-// a table this file owns can promise about a word it does not.
-func tierWords(tier string) string {
-	if row, ok := tierLineage[tier]; ok && row.Words != "" {
-		return row.Words
-	}
-	return tier
-}
-
-// inheritedTier is the crew's answer for a tier the profile has no key for: the
-// nearest ancestor row that was actually WRITTEN, and which row that was.
-//
-// It walks the lineage rather than taking one step, so a seat split out of a
-// seat still reaches the row a profile older than both of them holds. The walk
-// is bounded by the number of tiers, which makes a table with a cycle in it slow
-// nothing down — [TestEveryTierDeclaresItsAncestry] is what refuses the cycle.
-//
-// AN UNWRITTEN ANCESTOR IS NOT AN ANSWER. Reading the ancestor through
-// [TierModelAt] would hand back this build's default for that row and report it
-// as the crew, which is the same lie one row over. A row cleared on purpose
-// reads empty — "follow the conversation", which a headless run cannot — and
-// falls through too.
-func inheritedTier(profileDir, tier string) (model, from string, ok bool) {
-	for hops := 0; hops < len(tierLineage); hops++ {
-		row, known := tierLineage[tier]
-		if !known || row.Inherits == "" {
-			return "", "", false
-		}
-		tier = row.Inherits
-		if written, held := persistedString(profileDir, tierKeyFor(tier)); held {
-			if value := strings.TrimSpace(written); value != "" {
-				return value, tier, true
-			}
-			return "", "", false
-		}
-	}
-	return "", "", false
-}
-
-// tierSeatRole is what one tier's seat is CALLED in the line a person reads
-// about it. The two seats a run sits somebody in have names of their own
-// ([SeatWork], [SeatPlan]) and both surfaces have to spell them the same way: a
-// conversation whose work seat was inherited must read the sentence `codeaf do`
-// prints, not a second wording for one fact. Every other row answers with its
-// own name on the settings sheet, so a tier that joins the lineage tomorrow has
-// a sentence before anybody writes one.
-func tierSeatRole(tier string) SeatRole {
-	switch tier {
-	case ModelTierWorker:
-		return SeatWork
-	case ModelTierMastermind:
-		return SeatPlan
-	}
-	return SeatRole(tierWords(tier))
-}
-
-// crewRow is THE PROFILE HALF OF THE LADDER, and the one place that tells a row
-// somebody WROTE from a row they CLEARED from a key that was NEVER HELD.
-//
-// The distinction is the whole mechanism and it is decided here so that the two
-// ladders above it cannot decide it differently: [resolveSeat], which climbs a
-// flag and a variable first for a run, and [TierSeatAt], which is what a
-// conversation and the settings sheet read. A second copy of these three cases
-// is how a person's crew comes to mean one thing headless and another in chat,
-// which is the defect this file was written for one surface at a time (#166,
-// #302, #312).
-//
-// source is empty when the profile has nothing this ladder can use, and
-// `cleared` tells the two ways of having nothing apart: a row emptied ON PURPOSE
-// says "follow the conversation", which a conversation can do and a headless run
-// cannot, so each caller's own bottom rung answers for it.
-func crewRow(profileDir, tier string) (model, from string, source SeatSource, cleared bool) {
-	if written, held := persistedString(profileDir, tierKeyFor(tier)); held {
-		if value := strings.TrimSpace(written); value != "" {
-			return value, "", SeatCrew, false
-		}
-		return "", "", "", true
-	}
-	// The key was never held, which on a profile older than this seat means the
-	// crew was chosen before the seat existed. It still answers, through the row
-	// this row was split out of ([tierLineage]).
-	if value, ancestor, ok := inheritedTier(profileDir, tier); ok {
-		return value, ancestor, SeatInherited, false
-	}
-	return "", "", "", false
-}
-
-// TierSeatAt is ONE TIER ROW READ AS A SEAT, for the surfaces that seat roles
-// rather than run a door: the conversation's role map (cmd/codeaf's v3Crew), the
-// five rows of the settings sheet, and the crew word derived from them.
-//
-// IT IS [resolveSeat] WITHOUT THE TWO RUNGS THAT BELONG TO AN INVOCATION. A flag
-// is something a command line said and a conversation has no command line for
-// its crew; CODEAF_MODEL names the model a person TALKS TO ([Load] folds it into
-// Config.Model), and a variable that also filled the work seat of every task
-// handed off in that conversation would be one word quietly moving two dials.
-// What is left is the profile — which is where a conversation's seats have
-// always come from.
-//
-// Where it differs from a run is the BOTTOM, and only there:
-//
-//   - a row the person WROTE is the crew answering;
-//   - a row they CLEARED reads empty, and stays empty, because on this surface
-//     that is an answer — "follow the conversation" — and refusing it would make
-//     a default into a rule ([TierModelAt] argues it at length);
-//   - a key NEVER HELD asks the lineage before the bottom rung, so a profile
-//     older than the worker seat hands a task the same model `codeaf do` hands
-//     it (#302 headless, #312 in the conversation), and the seat carries the fact
-//     so a surface can say it once ([Seat.Notice]);
-//   - anything else is this build's own choice for that class of work.
-//
-// THE PRESET WORD IS DELIBERATELY NOT READ HERE. [Seat.Crew] stays empty:
-// [CrewAt] derives the preset from all five rows THROUGH this function, so a
-// seat that filled it in would be the ladder asking the summary that is computed
-// from the ladder — five extra file reads per row, and a cycle. A surface that
-// wants both facts asks for both.
-func TierSeatAt(profileDir, tier string) Seat {
-	return tierSeatUnder(profileDir, CrewSourceAt(profileDir), tier)
-}
-
-// tierSeatUnder is [TierSeatAt] with the family already read, so a caller that
-// walks every tier ([CrewAt]) reads the profile ONCE for the family instead of
-// once per unwritten seat, and the five seats cannot be resolved under one
-// family while the preset table is resolved under another.
-func tierSeatUnder(profileDir, family, tier string) Seat {
-	model, from, source, cleared := crewRow(profileDir, tier)
-	// WHETHER THE ROW ITSELF WAS WRITTEN, read before the fallback below can
-	// stand in for it. A row a person typed is a pin the pick must not recompute
-	// ([pickedSeat]), and that is a fact about the row's presence, not about
-	// whether its id happens to match the preset it sits in.
-	written := source == SeatCrew
-	// THE BUDGET A ROW NOBODY WROTE RUNS AT. A build this one shapes writes no
-	// crew word, and an unwritten row reads the default preset's own id — but a
-	// run that STORED a word on the crew row ([storedCrewWord]) named a budget,
-	// and the seat reads that word's table row instead. The pick may still
-	// compute it when the pick is off the table.
-	var byWord string
-	if source == "" {
-		source = SeatDefault
-		if !cleared {
-			model = freeTierModelAt(profileDir, family, tier)
-			if seat, ok := unwrittenSeat(profileDir, family, tier); ok {
-				model, source, byWord = seat.Model, seat.Source, seat.Crew
-			}
-		}
-	}
-	// A row that says auto resolves through the one seam both ladders share
-	// ([autoRow]). Only a row somebody WROTE — directly, or through the lineage
-	// — can say it: the default rung names a model id, and a cleared row names
-	// nothing at all.
-	if IsAuto(model) {
-		var preset string
-		model, source, preset = autoRow(profileDir, family, tier)
-		return Seat{Role: tierSeatRole(tier), Model: model, Source: source, Crew: preset}
-	}
-	// AND THE PICK ROW ANSWERS FOR THE SEATS NOBODY NAMED, before the row's
-	// own rung is read: a pick of catalog or learn computes the dial seats at
-	// the crew's preset ([pickedSeat]), and leaves everything it does not
-	// answer — a hand-typed id, a cleared row, the two seats that always read
-	// the table — exactly as it was. A cleared row is a deliberate answer
-	// ("follow the conversation") and no pick unsays it on this surface.
-	if !cleared {
-		if seat, ok := pickedSeat(profileDir, family, tier, model, written); ok {
-			return seat
-		}
-	}
-	return Seat{Role: tierSeatRole(tier), Model: model, Source: source, From: from, Crew: byWord}
-}
-
 // ModelEnv, PlanModelEnv, and CheckModelEnv are the variables the seats read.
 // They are spelled here once because the ladder, [Load], and receipts name them.
 const (
@@ -314,7 +85,8 @@ const (
 	CheckModelEnv = "CODEAF_CHECK_MODEL"
 )
 
-// Seat is one seat's answer: the model, and where it came from.
+// Seat is one seat's answer: the model, where it came from, and the provider
+// it runs on when the router or a pin named one.
 type Seat struct {
 	// envSpelling is the variable that answered when Source is [SeatEnv] —
 	// the current spelling or the former one — recorded at resolution so the
@@ -323,21 +95,7 @@ type Seat struct {
 	Role        SeatRole
 	Model       string
 	Source      SeatSource
-	// From is the tier word this seat's model was INHERITED from, and is empty
-	// unless Source is [SeatInherited]. It is carried rather than re-derived
-	// because the line that tells a person what happened has to name the row it
-	// read, and a second walk of the lineage at print time could name a
-	// different one.
-	From string
-	// Crew is the preset word the profile's five tier rows make — `frugal`,
-	// `balanced`, `max` or `custom` ([CrewAt]) — and is empty unless Source is
-	// [SeatCrew], [SeatInherited], [SeatComputed] or [SeatTable]. It is read
-	// rather than stored, exactly as the settings sheet reads it, so a receipt
-	// and the sheet cannot disagree about which crew ran. On the computed and
-	// table rungs it is the preset the auto row is computed at, read from the
-	// stored rows ([crewPresetUnder]) rather than derived through the resolver,
-	// which would be the seam asking itself.
-	Crew string
+	Provider    string
 }
 
 // Flag is the flag that fills this seat.
@@ -353,16 +111,19 @@ func (s Seat) Flag() string {
 
 // Env is the variable that fills this seat.
 func (s Seat) Env() string {
-	if s.Role == SeatPlan {
+	switch s.Role {
+	case SeatPlan:
 		return PlanModelEnv
+	case SeatCheck:
+		return CheckModelEnv
 	}
 	return ModelEnv
 }
 
 // Rung is the answering rung as a receipt says it: the flag or the variable by
-// name, the crew by preset, and otherwise the one word `default`. Naming the
-// flag and the variable rather than saying "flag" and "env" costs nothing and
-// tells a reader which of the two they would have to change.
+// name, and otherwise the rung's own word. Naming the flag and the variable
+// rather than saying "flag" and "env" costs nothing and tells a reader which
+// of the two they would have to change.
 func (s Seat) Rung() string {
 	switch s.Source {
 	case SeatFlag:
@@ -372,347 +133,182 @@ func (s Seat) Rung() string {
 			return s.envSpelling
 		}
 		return s.Env()
-	case SeatCrew:
-		return s.crewRung()
-	case SeatInherited:
-		// The crew answered, through an older row. Both halves are said,
-		// because a receipt that said only `crew custom` would hide exactly the
-		// substitution this rung exists to report.
-		return s.crewRung() + ", inherited"
-	case SeatComputed:
-		return s.crewRung() + ", computed from the catalog"
-	case SeatLearned:
-		return s.crewRung() + ", learned"
-	case SeatTable:
-		return s.crewRung() + ", table"
-	}
-	return "default"
-}
-
-// crewRung is the crew half of a rung: the preset the profile's rows make, or
-// the bare word for a profile whose preset cannot be read.
-func (s Seat) crewRung() string {
-	if strings.TrimSpace(s.Crew) == "" {
-		return "crew"
-	}
-	return "crew " + s.Crew
-}
-
-// Notice is the ONE line a person reads when this seat was not filled by a row
-// they wrote, and it is empty for every other seat.
-//
-// IT IS SAID ONCE, WHERE THE SEATS ARE REPORTED, and never at the point of a
-// call: this seat answers every request a run makes, and a line that arrived
-// with all of them would be noise a person learns to read past — which leaves
-// them exactly where the silence did. [Report] is how a door prints it, so the
-// door does not have to remember.
-//
-// It is the register the surface already speaks in — an observation, a middle
-// dot, a promise, lowercase, no full stop, nothing about machinery
-// (internal/session's taskEscalationNote and checkpointCeilingNote). The
-// observation is the true thing: the profile is older than the seat. The promise
-// is what is running instead and what ends it.
-//
-// AND THE PROMISE NAMES THE DOOR, because it used to end in one nobody could
-// find. `until you pick a crew again` is a remedy with no address on it, and
-// this line is printed on FOUR HEADLESS DOORS — `codeaf do`, `codeaf plan run`,
-// `codeaf exec` and `codeaf run` — where there is no way at all to pick a crew:
-// [CrewPreset] is written by `/crew` and by the settings sheet's Providers row,
-// both of which are the conversation, and no flag and no terminal verb sets one.
-// So a person reading this in a terminal was told to do something, given no way
-// to do it, and left to discover on their own that the answer was a different
-// surface. Cause plus what to do is the law on both surfaces; a cause plus a
-// dead end is the defect.
-//
-// ONE FORM, TRUE FROM BOTH PLACES IT IS PRINTED. Naming `/crew` reads as the
-// next keystroke in the conversation and as a destination from the terminal, and
-// it is the same sentence in both — which is what keeps somebody who has seen
-// one surface recognising the other. `seat` STAYS: it is this product's own
-// noun for a row of the crew, taught under that name on the manual's own page
-// and spoken by the settings sheet and the model picker, and the vocabulary law
-// is about MACHINERY — the program's words for its own process — not about a
-// domain noun the product teaches.
-//
-// AND THE PROMISE ATTRIBUTES THE MODEL RATHER THAN DESCRIBING IT. This read
-// `it is running on your small work model`, printed directly under a models
-// line naming `deepseek/deepseek-v4-pro` — so two consecutive lines called one
-// model by its name and then called it small, and the developer who met them
-// could not tell which model the lane was actually on. The two lines were never
-// in disagreement about the FACT: whenever the source is [SeatInherited] the
-// model on the line above IS the inherited one, always, because that is what
-// inheriting means. What differed was the grammar. `small work` is the NAME OF
-// A SEAT on the settings sheet, one of the five this product seats, and putting
-// it in front of `model` turns a seat's name into an adjective about the model
-// it holds.
-//
-// So the notice never characterises the model a second time — it says which
-// SEAT lent it. `your small work seat's model` cannot be read as a claim about
-// deepseek-v4-pro, and it answers the question the person actually has: this
-// seat has no row of its own, so it is borrowing that one's. A description was
-// always going to contradict the line above it, since the two are one model.
-func (s Seat) Notice() string {
-	if s.Source != SeatInherited {
-		return ""
+	case "":
+		return string(SeatDefault)
 	}
-	return "your crew was set before the " + string(s.Role) + " seat existed · " +
-		"it is running on your " + tierWords(s.From) + " seat's model until you pick a crew with " +
-		CrewCommand + " in the conversation"
+	return string(s.Source)
 }
 
-// CrewCommand is the one door that ends the inheritance [Notice] describes. It
-// is a constant so the sentence and the surface that answers to it cannot drift
-// apart — the notice is printed by four commands that cannot reach it, and a
-// remedy naming a door that has been renamed is worse than one naming none.
-const CrewCommand = "/crew"
-
-// FromWords is the row this seat's model was inherited from, in the words the
-// settings sheet calls that row by — empty unless the source is
-// [SeatInherited]. It is exported for the surface that has its own sentence to
-// build about the same fact ([Notice] is the sentence; this is the noun), so two
-// surfaces cannot invent two names for one row.
-func (s Seat) FromWords() string {
-	if s.Source != SeatInherited {
-		return ""
-	}
-	return tierWords(s.From)
-}
-
-// Report is what a door prints: the seat, and the line that says a row was
-// inherited when one was.
-func (s Seat) Report() string { return withNotice(s.Line(), s.Notice()) }
-
 // Describe is one seat in a receipt's voice:
 //
-//	work z-ai/glm-5.3-flash (crew frugal)
-//	plan follows the work model (default)
+//	worker z-ai/glm-5.3-flash (routed)
+//	checker moonshotai/kimi-k3 (pinned)
 //
-// THE EMPTINESS LAW, as the crew row already keeps it: an unfilled plan seat is
-// said in words rather than left as a gap somebody has to interpret.
+// THE EMPTINESS LAW: a seat with no model says so in words rather than
+// leaving a gap somebody has to interpret.
 func (s Seat) Describe() string {
 	model := strings.TrimSpace(s.Model)
 	if model == "" {
-		model = "follows the work model"
+		model = "no model"
 	}
 	return string(s.Role) + " " + model + " (" + s.Rung() + ")"
 }
 
 // modelsLabel is the word a door puts in front of the sentence. It is spelled
-// once so the four doors cannot label the same fact differently.
+// once so the doors cannot label the same fact differently.
 const modelsLabel = "models: "
 
 // Line is one seat labelled, for the door that seats only one — `exec`, which
 // executes and never plans.
 func (s Seat) Line() string { return modelsLabel + s.Describe() }
 
-// Seats is both seats of one run, and the check seat beside them when a door
-// resolved one. Work and Plan are the ladder's two answers
-// ([ResolveSeats]); Check is the door's own answer for the review round
-// ([CheckSeat]), and empty on a door that named nothing, which the run's crew
-// factory reads as the profile's careful row.
+// Report is what a door prints for one seat.
+func (s Seat) Report() string { return s.Line() }
+
+// Seats is one run's crew as the door resolved it, and the router's decision
+// beside it when a seat was routed.
 type Seats struct {
 	Work  Seat
 	Plan  Seat
 	Check Seat
+	// Crew is the router's decision for this task — the class it read, every
+	// seat's pick and the estimate — nil only when no router was asked.
+	Crew *crewroute.Decision
 }
 
-// Sentence is both seats, unlabelled, for a door whose opening lines have a
-// label column of their own:
+// Sentence is the crew, unlabelled:
 //
-//	work z-ai/glm-5.3-flash (crew frugal) · plan z-ai/glm-5.3-flash (crew frugal)
+//	worker z-ai/glm-5.3-flash (routed) · planner z-ai/glm-5.3-flash (routed) · checker moonshotai/kimi-k3 (pinned)
 //
-// ONE SHAPE AND NOT TWO. It would read a little better to collapse a run whose
-// seats came from the same crew into one clause, and it would mean a script
-// parsing this has two grammars to know and a person comparing two runs has two
-// shapes to compare. Every run says both seats and names the rung beside each.
+// ONE SHAPE AND NOT TWO: every run says every seat and names the rung beside
+// each, so a script parsing this has one grammar to know.
 func (s Seats) Sentence() string {
-	return s.Work.Describe() + " · " + s.Plan.Describe()
+	return s.Work.Describe() + " · " + s.Plan.Describe() + " · " + s.Check.Describe()
 }
 
-// Line is the one line a headless run opens with:
-//
-//	models: work z-ai/glm-5.3-flash (crew frugal) · plan z-ai/glm-5.3-flash (crew frugal)
+// Line is the one line a headless run opens with.
 func (s Seats) Line() string { return modelsLabel + s.Sentence() }
 
-// Notice is the inheritance line for whichever seat was filled by an older row,
-// and empty when neither was. Both seats are asked and their lines joined,
-// because the table decides which tiers have ancestors and this must not have to
-// be edited when a second one does.
-func (s Seats) Notice() string {
-	lines := make([]string, 0, 2)
-	for _, seat := range []Seat{s.Work, s.Plan} {
-		if notice := seat.Notice(); notice != "" {
-			lines = append(lines, notice)
-		}
+// Report is what a door prints: the models line, and under it the crew's own
+// line — the class the task was read as and the estimate — when it was routed.
+func (s Seats) Report() string {
+	if s.Crew == nil {
+		return s.Line()
 	}
-	return strings.Join(lines, "\n")
+	return s.Line() + "\ncrew: " + s.Crew.Line(PinMark, -1)
 }
 
-// Report is what a door prints instead of [Line]: the models line, and beneath
-// it the one line that says a seat was inherited. ONE PLACE, so a door added
-// tomorrow cannot print the models and swallow the reason.
-func (s Seats) Report() string { return withNotice(s.Line(), s.Notice()) }
+// PinMark is the mark a pinned seat wears on a headless line. The chat
+// surface draws its own, from its icon vocabulary.
+const PinMark = "📌"
 
-// withNotice puts a notice under a line, and is the whole of the composition so
-// the two Report methods cannot disagree about it.
-func withNotice(line, notice string) string {
-	if notice == "" {
-		return line
-	}
-	return line + "\n" + notice
+// SeatFlags are the three seat flags a door took.
+type SeatFlags struct {
+	Model      string
+	PlanModel  string
+	CheckModel string
 }
 
-// ResolveSeats climbs the ladder once per seat.
+// ResolveSeats climbs the ladder for all three seats and routes every seat
+// nothing named, for the task in ask.
 //
-//  1. the flag, which is what this invocation said;
-//  2. the environment, which is what this campaign said;
-//  3. the profile's crew — the planning seat takes the MASTERMIND tier and the
-//     work seat takes the WORKER tier, because that is where the two roles ride
-//     in chat: roles.DefaultAssignment puts RolePlanner on TierMastermind and
-//     RoleWorker on TierWorker, and a chat task's own worker resolves through
-//     the same row (internal/session's defaultTaskModel), so a headless run, an
-//     adaptive run and a task handed off in conversation all call the same
-//     model on the same profile;
-//  4. the crew again, through an OLDER ROW, for a profile written before this
-//     seat existed — the worker row's ancestor is the small-work row it was
-//     split out of ([tierLineage]), and the seat says it was inherited rather
-//     than reporting the model as though the person had pinned it;
-//  5. this build's default, which a profile that has said nothing about models
-//     at all is the only thing left for.
+// A flag and a variable are handed to the router AS PINS FOR THIS TASK, so the
+// decision it answers — the crew line, the estimate, the logged row — is the
+// crew that actually runs, and a seat the flag filled still says `--model`
+// on the receipt. A value is handed on WHOLE: a flag may read
+// `moonshotai/kimi-k3:low`, and the level is split off where every level is,
+// at the point of the call ([roles.SplitEffort]).
 //
-// profileDir is the profile to ask, [ProfileDir] for an ordinary process. The
-// environment is read HERE, at call time, and not carried in from [Load]: Load
-// resolves CODEAF_MODEL and DefaultModel into one field and the difference
-// between them is exactly what the receipt has to report.
-//
-// A tier value may carry a thinking level (`moonshotai/kimi-k3:low`) and is
-// handed on WHOLE, exactly as a flag or a variable carrying one is. The level is
-// applied where every other level is applied — the role ladder splits it into a
-// model and an effort at the point of the call ([roles.SplitEffort],
-// internal/session's roleRequest) — and the client seam takes the level off the
-// slug it sends ([Config.providerConfig]). Neither of those is this function's
-// business, and a rung that quietly shortened the value would be the second
-// model policy this whole file exists to remove.
-func ResolveSeats(profileDir, flagModel, flagPlanModel string) Seats {
-	return Seats{
-		Work: resolveSeat(SeatWork, profileDir, flagModel, ModelTierWorker, ChatDefaultAt(profileDir)),
-		Plan: resolveSeat(SeatPlan, profileDir, flagPlanModel, ModelTierMastermind, ""),
+// The error is the router's: a seat nothing allowed can sit, or
+// [ErrCrewAtCap] — beside which the seats still come back, because what a
+// door does at the cap (ask, refuse, or be told to spend) is the door's.
+func ResolveSeats(profileDir string, flags SeatFlags, ask CrewAsk) (Seats, error) {
+	seats := Seats{Work: Seat{Role: SeatWork}, Plan: Seat{Role: SeatPlan}, Check: Seat{Role: SeatCheck}}
+	if ask.Sends == nil {
+		ask.Sends = map[crewroute.Seat]string{}
 	}
-}
-
-// CheckSeat is the check seat's own ladder, resolved at the door.
-// The flag wins, then the check environment. A plan seat pinned by either its
-// flag or its environment answers next. Any other plan source leaves the seat
-// empty for the run's crew factory to fill from the careful row.
-func CheckSeat(flagCheck string, plan Seat) Seat {
-	seat := Seat{Role: SeatCheck}
-	if value := strings.TrimSpace(flagCheck); value != "" {
-		seat.Model, seat.Source = value, SeatFlag
-		return seat
+	for _, slot := range []struct {
+		seat *Seat
+		flag string
+	}{{&seats.Work, flags.Model}, {&seats.Plan, flags.PlanModel}, {&seats.Check, flags.CheckModel}} {
+		seat := slot.seat
+		if value := strings.TrimSpace(slot.flag); value != "" {
+			seat.Model, seat.Source = value, SeatFlag
+		} else if value := strings.TrimSpace(env.Value(seat.Env())); value != "" {
+			seat.Model, seat.Source = value, SeatEnv
+			seat.envSpelling, _ = env.Spelling(seat.Env())
+		} else {
+			continue
+		}
+		ask.Sends[crewSeatOf(seat.Role)] = seat.Model
 	}
-	if value := strings.TrimSpace(env.Get(CheckModelEnv)); value != "" {
-		seat.Model, seat.Source = value, SeatEnv
-		return seat
+	decision, err := RouteCrew(profileDir, ask)
+	if err != nil && !errors.Is(err, ErrCrewAtCap) {
+		return seats, err
 	}
-	if plan.Source == SeatFlag || plan.Source == SeatEnv {
-		seat.Model, seat.Source = plan.Model, plan.Source
+	seats.Crew = &decision
+	for _, seat := range []*Seat{&seats.Work, &seats.Plan, &seats.Check} {
+		pick := decision.Seat(crewSeatOf(seat.Role))
+		seat.Provider = pick.Provider
+		if seat.Source != "" {
+			continue
+		}
+		seat.Model = pick.Send
+		if pick.Pinned {
+			seat.Source = SeatPinned
+		} else {
+			seat.Source = SeatRouted
+		}
 	}
-	return seat
+	return seats, err
 }
 
-// resolveSeat is the ladder itself, once, for either seat. The two seats differ
-// in three values — which flag, which tier, what the bottom rung is — and in
-// nothing else, which is why there is one function and not two.
-//
-// UNTOUCHED IS NOT THE CREW ANSWERING. A tier is read through [crewRow] rather
-// than [TierModelAt] so that a profile which has never held the key falls
-// THROUGH to the default rather than being reported as `crew balanced` — the
-// five shipped tier defaults are the balanced row, so TierModelAt would answer
-// for a person who has never said anything, the bottom rung would become
-// unreachable, and this build's headless default model would quietly change for
-// everybody. `crew` here means somebody chose a crew. A row cleared on purpose
-// reads empty, which is "follow the conversation" — a sentence a headless run
-// has no conversation to answer with — so it falls through too.
+// CheckEnvModel is the check seat's environment rung alone, for the chat's
+// runs: a conversation has no flag, and CODEAF_CHECK_MODEL reaches a `/task`
+// run the way the manual says it reaches a headless one. Empty when unset.
+func CheckEnvModel() string {
+	return strings.TrimSpace(env.Get(CheckModelEnv))
+}
+
+// TierSeatAt is ONE TIER ROW READ AS A SEAT, for the surfaces that seat roles
+// rather than run a door: the conversation's role map (cmd/codeaf's v3Crew),
+// the settings sheet's rows, and a run's crew factory for a seat its door did
+// not name.
 //
-// AND A KEY THAT WAS NEVER HELD IS NOT THE SAME AS A PROFILE THAT SAID NOTHING.
-// The two were one case until the worker row landed (#302) and a profile that
-// had pinned every row it knew about fell all the way to the default for the
-// seat that does the work. So an unheld key asks the lineage before the bottom
-// rung: the crew answers through the ancestor row when the person wrote one, on
-// its own rung, and the run says so in one line ([Seat.Notice]).
+// A CREW SEAT'S ROW — worker, planner (mastermind), checker (high) — is its
+// pin when one is written, and otherwise the router's pick for work of no
+// particular class ([standingCrewSeat]): the calls that ride those tiers
+// without a task in front of them are routed too, never handed a model this
+// build chose for everybody.
 //
-// EVERY RUNG HANDS ITS VALUE ON WHOLE. A tier value may read
-// `moonshotai/kimi-k3:low` and a flag may say the same thing; both travel from
-// here unchanged, are seeded into the plan role's binding unchanged, and are
-// split into a model and a thinking effort by the role ladder at the point of
-// the call. A crew rung that shortened the value would leave a person planning
-// at `low` in the conversation and at nothing headless — the same divergence
-// #166 is about, one knob over.
-func resolveSeat(role SeatRole, profileDir, flag, tier, fallback string) Seat {
-	seat := Seat{Role: role}
-	if value := strings.TrimSpace(flag); value != "" {
-		seat.Model, seat.Source = value, SeatFlag
-		return seat
-	}
-	if value := strings.TrimSpace(env.Value(seat.Env())); value != "" {
-		seat.Model, seat.Source = value, SeatEnv
-		// The receipt names the spelling that answered — the former one is
-		// still read for a release, and a person who set it must not be told
-		// to look at a row they never wrote.
-		seat.envSpelling, _ = env.Spelling(seat.Env())
-		return seat
-	}
-	// AND THE PROFILE IS READ THROUGH THE ROW A CONVERSATION READS IT THROUGH
-	// ([crewRow]), so the three cases a tier key can be in are decided once for
-	// both surfaces. Nothing the profile can say fills this seat with the
-	// fallback except silence: a row cleared on purpose says "follow the
-	// conversation", which a headless run has no conversation to answer with,
-	// and it lands on the same bottom rung a profile that said nothing does.
-	model, from, source, cleared := crewRow(profileDir, tier)
-	if source == "" {
-		if cleared && role == SeatWork {
-			fallback = DefaultModel
-		}
-		// THE PICK ANSWERS BEFORE THE BOTTOM RUNG: an unwritten seat under a
-		// pick of catalog or learn is computed at the crew's preset
-		// ([pickedSeat]), the same answer the conversation reads, and a row
-		// cleared on purpose still falls through — the pick answers for seats
-		// nobody named, and a cleared row is somebody naming emptiness.
-		if !cleared {
-			if seat, ok := pickedSeat(profileDir, CrewSourceAt(profileDir), tier, "", false); ok {
-				return seat
-			}
-		}
-		// A STORED CREW WORD SEATS THE HEADLESS DOOR TOO ([unwrittenSeat]): the
-		// word names a budget, and the row nobody wrote reads that budget's own
-		// table row rather than the run's fallback — the same seat the
-		// conversation reads, so a word cannot mean one thing here and another in
-		// chat.
-		if !cleared {
-			if seat, ok := unwrittenSeat(profileDir, CrewSourceAt(profileDir), tier); ok {
-				return seat
-			}
+// THE OTHER TWO ROWS — reflex and small work — are not crew seats and read the
+// way they always have: a row somebody WROTE is theirs, a row they CLEARED
+// reads empty and follows the conversation ([TierModelAt] argues why UNSET
+// and CLEARED are different answers), and a key never held reads this build's
+// own near-free model — or, on an account known to be low, a free one
+// ([freeTierModelAt]).
+func TierSeatAt(profileDir, tier string) Seat {
+	if seat, ok := CrewTierSeat(tier); ok {
+		role := SeatRole(seat)
+		if pin, ok := CrewPinAt(profileDir, seat); ok {
+			return Seat{Role: role, Model: pin.Model, Source: SeatPinned, Provider: pin.Provider}
 		}
-		seat.Model, seat.Source = fallback, SeatDefault
-		return seat
+		return Seat{Role: role, Model: standingCrewSeat(profileDir, seat), Source: SeatRouted}
 	}
-	// A row that says auto resolves through the one seam both ladders share
-	// ([autoRow]) — on the rung it earned, with the preset it was computed at
-	// carried for the receipt — and never to `auto` and never to empty, which
-	// is what a headless run could do nothing with.
-	if IsAuto(model) {
-		var preset string
-		seat.Model, seat.Source, preset = autoRow(profileDir, CrewSourceAt(profileDir), tier)
-		seat.Crew = preset
-		return seat
+	role := SeatRole(tierWords(tier))
+	if written, held := persistedString(profileDir, tierKeyFor(tier)); held {
+		return Seat{Role: role, Model: strings.TrimSpace(written), Source: SeatPinned}
 	}
-	// AND BETWEEN THE ROW AND ITS OWN RUNG, the pick: a written row holding
-	// the preset's own table value is the preset answering rather than a pin,
-	// and the pick computes it ([pickedSeat]) — unless the profile stores a crew
-	// word, which makes every written row a pin. A hand-typed id keeps its rung
-	// either way.
-	if seat, ok := pickedSeat(profileDir, CrewSourceAt(profileDir), tier, model, source == SeatCrew); ok {
-		return seat
+	return Seat{Role: role, Model: freeTierModelAt(profileDir, tier), Source: SeatDefault}
+}
+
+// tierWords is a non-crew row's name on the settings sheet.
+func tierWords(tier string) string {
+	switch tier {
+	case ModelTierReflex:
+		return "reflex"
+	case ModelTierLow:
+		return "small work"
 	}
-	seat.Model, seat.Source, seat.From, seat.Crew = model, source, from, CrewAt(profileDir)
-	return seat
+	return tier
 }
diff --git a/internal/config/seats_test.go b/internal/config/seats_test.go
deleted file mode 100644
index 8b9086d9ab..0000000000
--- a/internal/config/seats_test.go
+++ /dev/null
@@ -1,1042 +0,0 @@
-package config
-
-import (
-	"context"
-	"encoding/json"
-	"github.com/Agent-Field/codeaf/internal/env"
-	"io"
-	"io/fs"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Agent-Field/agentfield/sdk/go/ai"
-	"github.com/Agent-Field/codeaf/internal/catalog"
-	"github.com/Agent-Field/codeaf/internal/crewpick"
-	"github.com/Agent-Field/codeaf/internal/router"
-)
-
-// THE LADDER, PINNED RUNG BY RUNG. The bug it exists to prevent is not a wrong
-// model — it is a rung that answers when a rung above it should have, which is
-// invisible in a run's output and shows up as a benchmark measuring a crew it
-// was not using (#166). So every rung is asserted for both seats, including the
-// order between them.
-func TestTheSeatLadderAnswersInItsOwnOrder(t *testing.T) {
-	for _, test := range []struct {
-		name string
-		// crew is written with the same writer /crew uses, or left empty for a
-		// profile nobody has touched.
-		crew           string
-		hand           map[string]string
-		env, planEnv   string
-		flag, planFlag string
-
-		work, workRung string
-		plan, planRung string
-	}{
-		{
-			name: "a profile nobody has touched answers with the build's default",
-			work: DefaultModel, workRung: "default",
-			plan: "", planRung: "default",
-		},
-		{
-			name: "the crew answers when it is the only thing said",
-			crew: CrewFrugal,
-			work: "z-ai/glm-5.3-flash", workRung: "crew frugal",
-			plan: "z-ai/glm-5.3-flash", planRung: "crew frugal",
-		},
-		{
-			name:    "the environment outranks the crew",
-			crew:    CrewFrugal,
-			env:     "vendor/from-the-environment",
-			planEnv: "vendor/plans-from-the-environment",
-			work:    "vendor/from-the-environment", workRung: ModelEnv,
-			plan: "vendor/plans-from-the-environment", planRung: PlanModelEnv,
-		},
-		{
-			name:     "the flag outranks the environment",
-			crew:     CrewFrugal,
-			env:      "vendor/from-the-environment",
-			planEnv:  "vendor/plans-from-the-environment",
-			flag:     "vendor/from-the-flag",
-			planFlag: "vendor/plans-from-the-flag",
-			work:     "vendor/from-the-flag", workRung: "--model",
-			plan: "vendor/plans-from-the-flag", planRung: "--plan-model",
-		},
-		{
-			// The two seats climb independently: one flag does not settle both.
-			name:    "one seat may be flagged while the other still climbs",
-			crew:    CrewFrugal,
-			planEnv: "vendor/plans-from-the-environment",
-			flag:    "vendor/from-the-flag",
-			work:    "vendor/from-the-flag", workRung: "--model",
-			plan: "vendor/plans-from-the-environment", planRung: PlanModelEnv,
-		},
-		{
-			// Presets choose models without silently adding a thinking level.
-			// An operator can still put a level on a flag or tier row.
-			name: "the crew leaves generation behavior to the model",
-			crew: CrewMax,
-			work: "z-ai/glm-5.3", workRung: "crew max",
-			plan: "anthropic/claude-opus-5", planRung: "crew max",
-		},
-		{
-			// And a flag carrying one is not shortened either, so the two rungs
-			// hand the same kind of value to everything downstream.
-			name:     "a flagged level travels the same way",
-			planFlag: "moonshotai/kimi-k3:low",
-			work:     DefaultModel, workRung: "default",
-			plan: "moonshotai/kimi-k3:low", planRung: "--plan-model",
-		},
-		{
-			// One row answered by hand is a custom crew, and the receipt says
-			// so rather than naming a preset the four rows do not make.
-			name: "a hand-written row reads as the custom crew it makes",
-			crew: CrewFrugal,
-			// THE WORK SEAT IS THE WORKER ROW, and not the small-work row beside
-			// it: the same row a task handed off in conversation rides.
-			hand: map[string]string{ModelTierWorker: "vendor/my-own-worker"},
-			work: "vendor/my-own-worker", workRung: "crew custom",
-			plan: "z-ai/glm-5.3-flash", planRung: "crew custom",
-		},
-		{
-			// A row cleared on purpose means "follow the conversation", and a
-			// headless run has no conversation to follow.
-			name: "a cleared row falls through to the default",
-			crew: CrewFrugal,
-			hand: map[string]string{ModelTierWorker: "", ModelTierMastermind: ""},
-			work: DefaultModel, workRung: "default",
-			plan: "", planRung: "default",
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			dir := t.TempDir()
-			if test.crew != "" {
-				if err := ApplyCrew(dir, test.crew); err != nil {
-					t.Fatalf("writing the %s crew: %v", test.crew, err)
-				}
-			}
-			for tier, model := range test.hand {
-				if err := writeTierModel(dir, tier, model); err != nil {
-					t.Fatalf("writing the %s row: %v", tier, err)
-				}
-			}
-			// Set at call time, both of them, so a case that names neither is
-			// running against a shell that has.
-			t.Setenv(ModelEnv, test.env)
-			t.Setenv(PlanModelEnv, test.planEnv)
-
-			seats := ResolveSeats(dir, test.flag, test.planFlag)
-			if seats.Work.Model != test.work || seats.Work.Rung() != test.workRung {
-				t.Errorf("work seat = %q (%s), want %q (%s)",
-					seats.Work.Model, seats.Work.Rung(), test.work, test.workRung)
-			}
-			if seats.Plan.Model != test.plan || seats.Plan.Rung() != test.planRung {
-				t.Errorf("plan seat = %q (%s), want %q (%s)",
-					seats.Plan.Model, seats.Plan.Rung(), test.plan, test.planRung)
-			}
-		})
-	}
-}
-
-// AN UNTOUCHED PROFILE IS NOT THE CREW ANSWERING, and this is the decision
-// written down where it can be argued with.
-//
-// The four shipped tier defaults ARE the balanced row (crew.go), so [CrewAt]
-// says `balanced` about a profile nobody has ever opened. Reading the seats
-// through [TierModelAt] would therefore let the crew rung answer for a person
-// who has never said anything about models — the bottom rung would become
-// unreachable, and this build's headless default model would silently change
-// from [DefaultModel] to the low tier's. So the ladder asks whether the key was
-// WRITTEN, and `crew` on a receipt means somebody chose a crew.
-func TestAnUntouchedProfileReadsTheDefaultAndNotTheBalancedCrew(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-
-	if got := CrewAt(dir); got != DefaultCrew {
-		t.Fatalf("an untouched profile reads crew %q, so this test is about the wrong thing", got)
-	}
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Source != SeatDefault || seats.Work.Model != DefaultModel {
-		t.Fatalf("work seat = %q (%s), want the build default", seats.Work.Model, seats.Work.Rung())
-	}
-	if seats.Plan.Source != SeatDefault || seats.Plan.Model != "" {
-		t.Fatalf("plan seat = %q (%s), want an empty seat that follows the work model",
-			seats.Plan.Model, seats.Plan.Rung())
-	}
-
-	// And the same profile once somebody has actually said `balanced`: the same
-	// four models, and now the crew is what answered.
-	if err := ApplyCrew(dir, CrewBalanced); err != nil {
-		t.Fatal(err)
-	}
-	seats = ResolveSeats(dir, "", "")
-	if seats.Work.Source != SeatCrew || seats.Work.Rung() != "crew balanced" {
-		t.Fatalf("after /crew balanced the work seat reads %s", seats.Work.Rung())
-	}
-}
-
-// The receipt is the whole point of resolving the rung, so its sentence is
-// pinned: both seats, each with what chose it, on one line.
-func TestTheReceiptNamesBothSeatsAndTheirRungs(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "vendor/plans")
-	if err := ApplyCrew(dir, CrewFrugal); err != nil {
-		t.Fatal(err)
-	}
-	line := ResolveSeats(dir, "", "").Line()
-	frugal, _ := CrewModels(CrewFrugal)
-	want := "models: work " + frugal[ModelTierWorker] + " (crew frugal) · plan vendor/plans (" + PlanModelEnv + ")"
-	if line != want {
-		t.Fatalf("the opening line reads\n\t%s\nwant\n\t%s", line, want)
-	}
-
-	// An unfilled plan seat is said in words rather than left as a gap.
-	t.Setenv(PlanModelEnv, "")
-	empty := ResolveSeats(t.TempDir(), "", "")
-	if !strings.Contains(empty.Line(), "plan follows the work model (default)") {
-		t.Fatalf("an empty plan seat reads %q", empty.Line())
-	}
-}
-
-// THE LEVEL COMES OFF AT THE WIRE AND NOWHERE EARLIER.
-//
-// `moonshotai/kimi-k3:low` is how a tier row, a flag and a variable all say
-// "that model, thinking a little". The value travels whole to the client seam,
-// which keeps the level beside the adapter while asking the provider for the
-// model alone. A slug with the level on it is one no provider publishes; sent
-// whole it is a 404 on every call the seat makes, which is what the flag path
-// did before this seam knew the difference.
-func TestTheThinkingLevelNeverReachesTheProviderAsPartOfTheSlug(t *testing.T) {
-	var asked string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		raw, _ := io.ReadAll(r.Body)
-		var body struct {
-			Model string `json:"model"`
-		}
-		_ = json.Unmarshal(raw, &body)
-		asked = body.Model
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(w, `{"choices":[{"message":{"content":"hi"},"finish_reason":"stop"}],"usage":{}}`)
-	}))
-	defer server.Close()
-
-	settings := Config{APIKey: "k", BaseURL: server.URL, Timeout: DefaultTimeout}
-	ask := func(client router.Client, err error) string {
-		t.Helper()
-		if err != nil {
-			t.Fatal(err)
-		}
-		asked = ""
-		if _, err := client.CompleteWithMessages(context.Background(),
-			[]ai.Message{{Role: "user", Content: []ai.ContentPart{{Type: "text", Text: "hi"}}}}); err != nil {
-			t.Fatal(err)
-		}
-		return asked
-	}
-
-	// The plan seat, however it was filled.
-	if got := ask(settings.ClientFor("moonshotai/kimi-k3:low")); got != "moonshotai/kimi-k3" {
-		t.Fatalf("the plan client asked for %q, want the model id alone", got)
-	}
-	// And the work seat, which reaches the same seam through Client().
-	settings.Model = "moonshotai/kimi-k3:high"
-	if got := ask(settings.Client()); got != "moonshotai/kimi-k3" {
-		t.Fatalf("the work client asked for %q, want the model id alone", got)
-	}
-	// A suffix that is not a level is part of the id and is left alone.
-	if got := ask(settings.ClientFor("vendor/model:free")); got != "vendor/model:free" {
-		t.Fatalf("a non-level suffix was eaten: %q", got)
-	}
-	// The settings keep what the person wrote, so the role ladder still sees
-	// the level it has to apply.
-	if settings.Model != "moonshotai/kimi-k3:high" {
-		t.Fatalf("building a client rewrote the seat to %q", settings.Model)
-	}
-}
-
-// A PROFILE OLDER THAN A SEAT STILL GETS THE CREW IT CHOSE, AND IS TOLD SO.
-//
-// This is #302 written down. A crew applied before the worker row existed pinned
-// the four rows there were, and the ladder read the fifth key, found nothing,
-// and fell past the whole profile to the build's default — so every headless run
-// worked on a model the person had never named while their planning ran on the
-// one they had. The only tell was one word on a line nobody reads twice.
-//
-// The rung is the crew, through the row the worker row was split out of, and it
-// says `inherited` rather than borrowing the plain crew rung: the person is owed
-// the difference between the row they wrote and the row they did not.
-func TestACrewWrittenBeforeTheWorkerSeatStillAnswersForItAndSaysSo(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	// The pre-#278 crew shape, written the way it was written then: four rows
-	// and no worker row.
-	for tier, model := range map[string]string{
-		ModelTierReflex:     "mistralai/mistral-nemo",
-		ModelTierLow:        "deepseek/deepseek-v4-flash",
-		ModelTierHigh:       "qwen/qwen3.8-27b",
-		ModelTierMastermind: "deepseek/deepseek-v4-flash",
-	} {
-		if err := writeTierModel(dir, tier, model); err != nil {
-			t.Fatalf("writing the %s row: %v", tier, err)
-		}
-	}
-	if _, held := persistedString(dir, KeyTierWorkerModel); held {
-		t.Fatal("the fixture holds a worker row, so it is not the profile this is about")
-	}
-
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Model != "deepseek/deepseek-v4-flash" {
-		t.Errorf("the work seat runs on %q, want the small-work model the person pinned", seats.Work.Model)
-	}
-	if seats.Work.Model == DefaultModel {
-		t.Errorf("the work seat fell to the build's default %q with a whole crew written above it", DefaultModel)
-	}
-	if seats.Work.Source != SeatInherited || seats.Work.From != ModelTierLow {
-		t.Errorf("the work seat says %s from %q, want the crew through the small-work row",
-			seats.Work.Source, seats.Work.From)
-	}
-	if got := seats.Work.Rung(); got != "crew custom, inherited" {
-		t.Errorf("the receipt reads %q, want the crew and the fact that it was inherited", got)
-	}
-	// The seat the profile does hold a row for is untouched by any of this.
-	if seats.Plan.Source != SeatCrew || seats.Plan.Model != "deepseek/deepseek-v4-flash" {
-		t.Errorf("the plan seat reads %q (%s)", seats.Plan.Model, seats.Plan.Rung())
-	}
-}
-
-// AND THE PLAIN-INSTALL PATH IS BYTE-IDENTICAL. A profile that has said nothing
-// about models has nothing to inherit from, so the bottom rung answers and
-// nothing is said about it — the third acceptance of #302, and the rung whose
-// unreachability the ladder's own comment warns about.
-func TestAProfileThatHasSaidNothingStillRunsTheBuildsDefaultAndSaysNothing(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Source != SeatDefault || seats.Work.Model != DefaultModel {
-		t.Fatalf("the work seat reads %q (%s), want the build's default", seats.Work.Model, seats.Work.Rung())
-	}
-	if notice := seats.Notice(); notice != "" {
-		t.Fatalf("a profile with no crew was told about an inheritance that did not happen: %q", notice)
-	}
-	if seats.Report() != seats.Line() {
-		t.Fatalf("the report grew a line: %q", seats.Report())
-	}
-
-	// One row written by hand, and the seat that has no row of its own inherits
-	// it — the same profile, one key later.
-	if err := writeTierModel(dir, ModelTierLow, "vendor/my-small-work"); err != nil {
-		t.Fatal(err)
-	}
-	seats = ResolveSeats(dir, "", "")
-	if seats.Work.Source != SeatInherited || seats.Work.Model != "vendor/my-small-work" {
-		t.Fatalf("the work seat reads %q (%s), want the small-work row it inherits from",
-			seats.Work.Model, seats.Work.Rung())
-	}
-	// A row cleared ON PURPOSE is an answer, and the answer is "follow the
-	// conversation" — which a headless run cannot, so it falls to the default
-	// rather than being reported as a crew that chose it.
-	if err := writeTierModel(dir, ModelTierLow, ""); err != nil {
-		t.Fatal(err)
-	}
-	if seats := ResolveSeats(dir, "", ""); seats.Work.Source != SeatDefault {
-		t.Fatalf("a cleared small-work row was inherited anyway: %q (%s)",
-			seats.Work.Model, seats.Work.Rung())
-	}
-}
-
-// THE LINE IS SAID ONCE, AND ONLY WHEN IT IS TRUE.
-//
-// A substitution nobody is told about is the defect; a warning on every one of a
-// run's calls is the same defect wearing a hat, because a person learns to read
-// past it. So it belongs exactly where the seats are reported, once, and the
-// register is the one the surface already speaks in — an observation, a middle
-// dot, a promise, lowercase, no full stop, no machinery.
-func TestTheInheritedSeatIsAnnouncedOnceInTheHousesOwnVoice(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	if err := writeTierModel(dir, ModelTierLow, "vendor/my-small-work"); err != nil {
-		t.Fatal(err)
-	}
-	seats := ResolveSeats(dir, "", "")
-
-	notice := seats.Notice()
-	if notice == "" {
-		t.Fatal("the seat was inherited and nothing was said about it")
-	}
-	report := seats.Report()
-	if got := strings.Count(report, notice); got != 1 {
-		t.Fatalf("the line is printed %d times in one report, want once:\n%s", got, report)
-	}
-	if !strings.HasPrefix(report, seats.Line()+"\n") {
-		t.Fatalf("the report is not the models line and then the reason:\n%s", report)
-	}
-	if !strings.Contains(notice, "small work") {
-		t.Errorf("the line does not name the row a person would go and look at: %q", notice)
-	}
-	if !strings.Contains(notice, "work seat") {
-		t.Errorf("the line does not name the seat that was filled: %q", notice)
-	}
-	if notice != strings.ToLower(notice) {
-		t.Errorf("the line is not lowercase: %q", notice)
-	}
-	if strings.HasSuffix(notice, ".") {
-		t.Errorf("the line ends in a full stop, which makes a remark into an announcement: %q", notice)
-	}
-	if strings.Count(notice, " · ") != 1 {
-		t.Errorf("the line is not the observation-then-promise the surface speaks in: %q", notice)
-	}
-	if strings.Contains(notice, "\n") {
-		t.Errorf("the line is more than one line: %q", notice)
-	}
-	for _, machinery := range []string{"tier", "models.tiers", "fallback", "resolve", "seatinherited", "config"} {
-		if strings.Contains(notice, machinery) {
-			t.Errorf("the line says %q, which is machinery: %q", machinery, notice)
-		}
-	}
-
-	// And a crew that pins every row hears nothing at all: the notice is a fact
-	// about this profile, not decoration on the models line.
-	pinned := t.TempDir()
-	if err := ApplyCrew(pinned, CrewFrugal); err != nil {
-		t.Fatal(err)
-	}
-	if notice := ResolveSeats(pinned, "", "").Notice(); notice != "" {
-		t.Fatalf("a fully pinned crew was told about an inheritance: %q", notice)
-	}
-	// Nor does a seat somebody filled by hand this minute.
-	t.Setenv(ModelEnv, "vendor/from-the-environment")
-	if notice := ResolveSeats(dir, "", "").Notice(); notice != "" {
-		t.Fatalf("a seat filled from the environment was called inherited: %q", notice)
-	}
-}
-
-// EVERY TIER DECLARES ITS ANCESTRY, OR DECLARES THAT IT HAS NONE.
-//
-// The worker row will not be the last seat added, and the failure it caused is
-// invisible from outside — so the rule lives in one table and this reads the
-// table rather than the code that uses it. A tier word added to [ModelTiers]
-// without a row here is the same defect again, one seat later, and it fails
-// here instead of in somebody's benchmark.
-func TestEveryTierDeclaresItsAncestry(t *testing.T) {
-	known := make(map[string]bool, len(ModelTiers))
-	for _, tier := range ModelTiers {
-		known[tier] = true
-	}
-	for _, tier := range ModelTiers {
-		row, ok := tierLineage[tier]
-		if !ok {
-			t.Errorf("the %s tier declares no ancestry — name the row it was split out of, "+
-				"or an empty ancestor to say it was always here", tier)
-			continue
-		}
-		if row.Words == "" {
-			t.Errorf("the %s tier has no name a person would recognise, so the line about it "+
-				"cannot send them to a row they can find", tier)
-		}
-		if row.Inherits != "" && !known[row.Inherits] {
-			t.Errorf("the %s tier inherits from %q, which is not a tier", tier, row.Inherits)
-		}
-		// A ring of rows would make the walk depend on where it started.
-		seen := map[string]bool{tier: true}
-		for step := row.Inherits; step != ""; step = tierLineage[step].Inherits {
-			if seen[step] {
-				t.Fatalf("the lineage from %s comes back to %s", tier, step)
-			}
-			seen[step] = true
-		}
-	}
-	for tier := range tierLineage {
-		if !known[tier] {
-			t.Errorf("the table holds %q, which is not one of this build's tiers", tier)
-		}
-	}
-	// The one ancestry there is today, named rather than merely well-formed: the
-	// worker seat came out of the small-work row (#278), and a change of mind
-	// about that is a change of what old profiles run on.
-	if got := tierLineage[ModelTierWorker].Inherits; got != ModelTierLow {
-		t.Errorf("the worker row inherits from %q, want the small-work row it was split out of", got)
-	}
-}
-
-// APPLYING A CREW PINS EVERY SEAT, so a profile written by this build never
-// needs the lineage at all — the inheritance is for the profiles that already
-// exist, and it must not become the ordinary path.
-func TestApplyingACrewLeavesNoSeatToInherit(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	for _, preset := range CrewPresets {
-		dir := t.TempDir()
-		if err := ApplyCrew(dir, preset); err != nil {
-			t.Fatal(err)
-		}
-		for _, tier := range ModelTiers {
-			if _, held := persistedString(dir, tierKeyFor(tier)); !held {
-				t.Errorf("%s leaves the %s row unwritten, so a seat on it inherits", preset, tier)
-			}
-		}
-		if seats := ResolveSeats(dir, "", ""); seats.Work.Source != SeatCrew {
-			t.Errorf("%s: the work seat reads %s", preset, seats.Work.Rung())
-		}
-	}
-}
-
-// THE SAME LADDER, READ THE WAY A CONVERSATION READS IT.
-//
-// #312 is #302 on the other surface. The chat's role map, the settings sheet and
-// the crew word all resolve a tier row through [TierModelAt], which knew two
-// answers — the row somebody wrote, and this build's choice — so a profile older
-// than the worker seat handed every task started in a conversation to the build's
-// default while the same profile handed `codeaf do` the crew's own model. The
-// rung is the same rung; what this table pins is that adding it moved NOTHING
-// else: a row written, a row cleared and a profile with no rows at all read
-// exactly what they read before, on every tier.
-func TestATierRowIsSeatedTheWayAConversationReadsIt(t *testing.T) {
-	const small = "vendor/my-small-work"
-	for _, test := range []struct {
-		name string
-		// rows is the profile's config.json, written as a profile of that
-		// vintage holds it: a key present with a value, a key present and empty,
-		// or a key that is simply not there.
-		rows   map[string]string
-		tier   string
-		model  string
-		source SeatSource
-		from   string
-	}{
-		{
-			name:  "a key that was never held on a profile older than the seat takes the row it was split out of",
-			rows:  map[string]string{KeyTierLowModel: small},
-			tier:  ModelTierWorker,
-			model: small, source: SeatInherited, from: ModelTierLow,
-		},
-		{
-			name:  "a row somebody wrote is the crew answering and nothing climbs past it",
-			rows:  map[string]string{KeyTierLowModel: small, KeyTierWorkerModel: "vendor/my-worker"},
-			tier:  ModelTierWorker,
-			model: "vendor/my-worker", source: SeatCrew,
-		},
-		{
-			// The decision this whole rung is fenced against: emptying a row is
-			// somebody saying "follow the conversation", and a conversation is
-			// the one thing that CAN. It must not start inheriting.
-			name:  "a row cleared on purpose still follows the conversation",
-			rows:  map[string]string{KeyTierLowModel: small, KeyTierWorkerModel: ""},
-			tier:  ModelTierWorker,
-			model: "", source: SeatDefault,
-		},
-		{
-			name:  "a profile that has said nothing still reads this build's choice",
-			rows:  map[string]string{},
-			tier:  ModelTierWorker,
-			model: DefaultWorkerModel, source: SeatDefault,
-		},
-		{
-			// An ancestor that was itself cleared is not an answer either: the
-			// walk stops at the row that was written, and an empty one is not.
-			name:  "an ancestor cleared on purpose is not inherited from",
-			rows:  map[string]string{KeyTierLowModel: ""},
-			tier:  ModelTierWorker,
-			model: DefaultWorkerModel, source: SeatDefault,
-		},
-		{
-			// And a tier with no ancestor is untouched by any of it.
-			name:  "a row that was always here has nothing to inherit",
-			rows:  map[string]string{KeyTierLowModel: small},
-			tier:  ModelTierHigh,
-			model: DefaultHighModel, source: SeatDefault,
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			dir := writeProfileRows(t, test.rows)
-			seat := TierSeatAt(dir, test.tier)
-			if seat.Model != test.model || seat.Source != test.source || seat.From != test.from {
-				t.Errorf("the %s row seats %q (%s from %q), want %q (%s from %q)",
-					test.tier, seat.Model, seat.Source, seat.From, test.model, test.source, test.from)
-			}
-			// AND THE MODEL EVERY OTHER CALLER READS IS THIS SEAT'S MODEL. The
-			// sheet, the crew word and the conversation's role map all go
-			// through TierModelAt, and a seat that disagreed with it would be a
-			// receipt about a model nothing runs on.
-			if got := TierModelAt(dir, test.tier); got != seat.Model {
-				t.Errorf("TierModelAt reads %q while the seat reads %q", got, seat.Model)
-			}
-		})
-	}
-}
-
-// THE LINE IS THE SAME LINE ON BOTH SURFACES, and the noun in it is the row a
-// person can go and find. A second wording for one fact is how somebody
-// concludes the two surfaces are doing two different things.
-func TestAnInheritedTierSeatSaysTheSameSentenceTheRunSays(t *testing.T) {
-	dir := writeProfileRows(t, map[string]string{KeyTierLowModel: "vendor/my-small-work"})
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-
-	seat := TierSeatAt(dir, ModelTierWorker)
-	if got, want := seat.Notice(), ResolveSeats(dir, "", "").Work.Notice(); got != want {
-		t.Fatalf("the conversation reads\n\t%s\nand the run reads\n\t%s", got, want)
-	}
-	if got := seat.FromWords(); got != "small work" {
-		t.Errorf("the row is called %q here and `small work` on the settings sheet", got)
-	}
-	// Every other shape says nothing at all, which is what makes the line worth
-	// reading when it is there.
-	for name, rows := range map[string]map[string]string{
-		"a pinned row":  {KeyTierWorkerModel: "vendor/my-worker"},
-		"a cleared row": {KeyTierLowModel: "vendor/my-small-work", KeyTierWorkerModel: ""},
-		"no rows":       {},
-	} {
-		seat := TierSeatAt(writeProfileRows(t, rows), ModelTierWorker)
-		if notice := seat.Notice(); notice != "" {
-			t.Errorf("%s was told about an inheritance that did not happen: %q", name, notice)
-		}
-		if words := seat.FromWords(); words != "" {
-			t.Errorf("%s names a row it did not inherit from: %q", name, words)
-		}
-	}
-}
-
-// ONE READER OF A TIER ROW, AND EVERY SURFACE BEHIND IT.
-//
-// The defect was not that the ladder was wrong — it was that the conversation
-// had a second, shorter one. So this reads the sources and states the law twice:
-// inside this package, only the file that owns the ladder turns a tier key into
-// a MODEL (asking whether a key exists is a different question, and
-// [CrewConfigured] asks it), and outside it nobody spells a tier key at all. A
-// surface that wants a model asks [TierModelAt]; one that also wants the rung
-// asks [TierSeatAt]; nobody opens the file for themselves.
-func TestEveryReadOfATierRowGoesThroughTheLadder(t *testing.T) {
-	root := moduleRoot(t)
-	inside, err := filepath.Glob(filepath.Join(root, "internal", "config", "*.go"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, path := range inside {
-		base := filepath.Base(path)
-		if strings.HasSuffix(base, "_test.go") || base == "seats.go" {
-			continue
-		}
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, line := range strings.Split(string(raw), "\n") {
-			if !strings.Contains(line, "tierKeyFor(") || !strings.Contains(line, "persistedString(") {
-				continue
-			}
-			// `_, ok :=` is the presence question and is nobody's second ladder.
-			if !strings.Contains(line, "_, ok :=") && !strings.Contains(line, "_, held :=") {
-				t.Errorf("%s reads the VALUE of a tier row for itself: %q\n\tthe ladder is seats.go's, and a "+
-					"second reader is how `unset` comes to mean one thing here and another there",
-					base, strings.TrimSpace(line))
-			}
-		}
-	}
-	// And outside this package, nothing spells a tier key at all.
-	_ = filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
-		switch {
-		case err != nil:
-			return nil
-		case entry.IsDir():
-			if name := entry.Name(); name == ".git" || name == "bin" || name == "bench" {
-				return filepath.SkipDir
-			}
-			return nil
-		case !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go"):
-			return nil
-		case strings.HasPrefix(path, filepath.Join(root, "internal", "config")):
-			return nil
-		}
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil
-		}
-		if strings.Contains(string(raw), `"models.tiers.`) {
-			rel, _ := filepath.Rel(root, path)
-			t.Errorf("%s spells a tier key by hand instead of asking the ladder", rel)
-		}
-		return nil
-	})
-	// AND THE CONVERSATION'S OWN ROLE MAP IS ON IT. This is the wiring #312 was
-	// about: the three rows the chat resolves from the profile go through this
-	// package, which is what makes the worker row inherit there too.
-	raw, err := os.ReadFile(filepath.Join(root, "cmd", "codeaf", "chatv3.go"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tier := range []string{"ModelTierReflex", "ModelTierMastermind", "ModelTierWorker"} {
-		if want := "config.TierModelAt(c.profileDir, config." + tier + ")"; !strings.Contains(string(raw), want) {
-			t.Errorf("the chat door does not seat the %s row through the ladder (%s)", tier, want)
-		}
-	}
-}
-
-// writeProfileRows makes a throwaway profile holding exactly these keys — a
-// value for a row somebody wrote, the empty string for a row they cleared, and
-// nothing at all for a key of a vintage that never had one.
-func writeProfileRows(t *testing.T, rows map[string]string) string {
-	t.Helper()
-	dir := t.TempDir()
-	raw, err := json.Marshal(rows)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(BudgetConfigPath(dir), raw, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	return dir
-}
-
-// moduleRoot walks up to the directory holding go.mod, for the two tests that
-// read the tree they are part of.
-func moduleRoot(t *testing.T) string {
-	t.Helper()
-	dir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	for {
-		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
-			return dir
-		}
-		parent := filepath.Dir(dir)
-		if parent == dir {
-			t.Fatalf("no go.mod above %s", dir)
-		}
-		dir = parent
-	}
-}
-
-// ── THE INHERITED-SEAT NOTICE ENDED IN A DOOR NOBODY COULD FIND ─────────────
-//
-// The line is printed on four HEADLESS doors — `codeaf do`, `codeaf plan run`,
-// `codeaf exec` and `codeaf run` — and it ended `until you pick a crew again`.
-// There is no way to pick a crew from a terminal: a crew is written by `/crew`
-// and by the settings sheet's Providers row, both of which are the
-// conversation, and no flag and no verb in the binary sets one. So the one line
-// whose whole job is to explain a surprising model choice told somebody to do
-// something and gave them nowhere to do it.
-//
-// The law on both surfaces is CAUSE PLUS WHAT TO DO. A cause plus a dead end is
-// the defect, and the fix is the address, not the noun.
-func TestTheInheritedSeatNoticeNamesADoorAPersonCanActuallyReach(t *testing.T) {
-	dir := writeProfileRows(t, map[string]string{KeyTierLowModel: "vendor/my-small-work"})
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	notice := ResolveSeats(dir, "", "").Work.Notice()
-	if notice == "" {
-		t.Fatal("a profile older than the worker seat was told nothing at all")
-	}
-	if !strings.Contains(notice, CrewCommand) {
-		t.Fatalf("the remedy names no door at all, so a person reading it in a terminal "+
-			"has nowhere to go.\n  said: %q\n  want it to name %q", notice, CrewCommand)
-	}
-	// AND IT SAYS WHERE THAT DOOR IS. `/crew` alone is the next keystroke to
-	// somebody already in the conversation and a riddle to somebody in a shell,
-	// and the shell is where four of the five printers of this line stand.
-	if !strings.Contains(notice, CrewCommand+" in the conversation") {
-		t.Fatalf("the door is named without saying where it is.\n  said: %q", notice)
-	}
-	// THE REGISTER THE FUNCTION'S OWN COMMENT SETS OUT: an observation, a middle
-	// dot, a promise, lowercase, no full stop.
-	if !strings.Contains(notice, " · ") {
-		t.Errorf("the observation and the promise are not separated by the middle dot: %q", notice)
-	}
-	if strings.HasSuffix(notice, ".") {
-		t.Errorf("the line ends in a full stop, which nothing else in this register does: %q", notice)
-	}
-	if first := notice[:1]; first != strings.ToLower(first) {
-		t.Errorf("the line opens upper-case: %q", notice)
-	}
-}
-
-// AND `seat` IS THE PRODUCT'S OWN NOUN, NOT MACHINERY.
-//
-// It was proposed for renaming as machinery vocabulary. It is not: the crew and
-// its seats are what the settings sheet, the model picker and the manual's own
-// page all teach a person to say, and the vocabulary law bans the PROGRAM'S
-// words for its own process — `auditor`, `verdict`, `refuted` — not a domain
-// noun the product names things with. Renaming it here would have left every
-// other surface, and the page that explains this exact line, speaking a word the
-// binary no longer printed.
-func TestTheNoticeKeepsTheProductsOwnWordForARowOfTheCrew(t *testing.T) {
-	dir := writeProfileRows(t, map[string]string{KeyTierLowModel: "vendor/my-small-work"})
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	notice := ResolveSeats(dir, "", "").Work.Notice()
-	for _, want := range []string{"crew", "seat"} {
-		if !strings.Contains(notice, want) {
-			t.Fatalf("the notice stopped saying %q, and every other crew surface still does:\n%s",
-				want, notice)
-		}
-	}
-}
-
-// TestTheInheritedNoticeNamesTheSeatItBorrowedFromRatherThanDescribingTheModel
-// is the defect a developer met on their first run.
-//
-// The banner read
-//
-//	models: work deepseek/deepseek-v4-pro (crew custom, inherited)
-//	your crew was set before the work seat existed · it is running on your small work model until you pick a crew with /crew in the conversation
-//
-// — two consecutive lines, one naming a model and the next calling that same
-// model small, with no way for the reader to tell which model the lane was
-// actually on. The two were never in disagreement about the fact: an inherited
-// seat's model IS the model on the line above, always. So the notice may not
-// describe the model at all; it names the SEAT the model was borrowed from,
-// which is the only thing the line above does not already say.
-func TestTheInheritedNoticeNamesTheSeatItBorrowedFromRatherThanDescribingTheModel(t *testing.T) {
-	dir := writeProfileRows(t, map[string]string{KeyTierLowModel: "deepseek/deepseek-v4-pro"})
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-
-	report := ResolveSeats(dir, "", "").Report()
-	if !strings.Contains(report, "deepseek/deepseek-v4-pro") {
-		t.Fatalf("the banner never names the model the work seat is on:\n%s", report)
-	}
-	// The row's own name is still said — a person has to know which seat to go
-	// and look at — but never as an adjective in front of `model`.
-	if !strings.Contains(report, "your small work seat's model") {
-		t.Errorf("the notice does not say which seat lent the model, so the reader "+
-			"cannot find the row to change:\n%s", report)
-	}
-	for _, describes := range []string{"small work model", "worker model", "careful work model", "thinking model", "reflex model"} {
-		if strings.Contains(report, describes) {
-			t.Errorf("the banner names %s on one line and calls it %q on the next — "+
-				"a seat's name used as an adjective reads as a claim about the model, "+
-				"and the two lines are about ONE model:\n%s",
-				"deepseek/deepseek-v4-pro", "your "+describes, report)
-		}
-	}
-}
-
-// A person who set the former spelling of the model variable is told that
-// spelling on the receipt, not the current one they never wrote; with both
-// set, the current one answered and is named.
-func TestTheReceiptNamesTheSpellingOfTheVariableThatAnswered(t *testing.T) {
-	dir := t.TempDir()
-	legacy := env.Legacy(ModelEnv) // AFORGE_MODEL — legacy-name
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	t.Setenv(legacy, "vendor/former")
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Source != SeatEnv || seats.Work.Model != "vendor/former" {
-		t.Fatalf("work seat = %q (%s), want the former spelling's value from the env rung", seats.Work.Model, seats.Work.Rung())
-	}
-	if got := seats.Work.Rung(); got != legacy {
-		t.Fatalf("rung = %q, want %q — the receipt must name the variable the person set", got, legacy)
-	}
-	t.Setenv(ModelEnv, "vendor/current")
-	seats = ResolveSeats(dir, "", "")
-	if got := seats.Work.Rung(); got != ModelEnv || seats.Work.Model != "vendor/current" {
-		t.Fatalf("rung = %q model = %q, want %q and its value", got, seats.Work.Model, ModelEnv)
-	}
-}
-
-// ── the pick row's half of the ladder ───────────────────────────────────────
-
-// A PICK OFF THE TABLE COMPUTES THE DIAL SEATS AND LEAVES THE OTHER TWO ALONE.
-// The three seats that the presets dial — worker, careful work, mastermind —
-// are computed at the crew's preset, `learned` under the learn word and
-// `computed from the catalog` under the catalog word; reflex and small work
-// always read the table, which is what makes a pick a dial over three seats
-// and not a second crew. The ids are asserted against crewpick's own front,
-// the way the shipped tables are (auto_test.go owns the method).
-func TestAPickOffTheTableComputesTheDialSeats(t *testing.T) {
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	_, balanced, _ := crewpick.Presets(crewpick.Front(autoCandidates(autoTestRows()), crewpick.DefaultShapes(), crewpick.All))
-	table, _ := CrewModelsForSource(CrewSourceAt(""), DefaultCrew)
-
-	for _, pick := range []struct {
-		word   string
-		source SeatSource
-	}{
-		{CrewPickLearn, SeatLearned},
-		{CrewPickCatalog, SeatComputed},
-	} {
-		dir := writeProfileRows(t, map[string]string{KeyCrewPick: pick.word})
-		for _, c := range []struct {
-			tier string
-			want string
-		}{
-			{ModelTierWorker, balanced.Worker},
-			{ModelTierHigh, balanced.High},
-			{ModelTierMastermind, balanced.Mastermind},
-		} {
-			seat := TierSeatAt(dir, c.tier)
-			if seat.Model != c.want || seat.Source != pick.source {
-				t.Errorf("%s: the %s seat reads %q (%s), want %q (%s)", pick.word, c.tier,
-					seat.Model, seat.Source, c.want, pick.source)
-			}
-			if seat.Crew != DefaultCrew {
-				t.Errorf("%s: the %s seat ran at %q, want the untouched profile's %q", pick.word, c.tier, seat.Crew, DefaultCrew)
-			}
-		}
-		// THE PICK COMPUTES RATHER THAN READS: the front's ids are not the
-		// preset table's own, so a seat carrying the front's id is a seat the
-		// catalog answered and not the table in disguise.
-		if balanced.Worker == table[ModelTierWorker] {
-			t.Fatal("the test rows field a front identical to the shipped table; the pick would be asserting nothing")
-		}
-		// REFLEX AND SMALL WORK ALWAYS READ THE TABLE, and a pick does not
-		// touch them: the same rung an untouched profile has always read, with
-		// the table's own id.
-		for _, tier := range []string{ModelTierReflex, ModelTierLow} {
-			seat := TierSeatAt(dir, tier)
-			if seat.Model != table[tier] {
-				t.Errorf("%s: the %s seat reads %q, want the table's %q", pick.word, tier, seat.Model, table[tier])
-			}
-			if seat.Source != SeatDefault {
-				t.Errorf("%s: the %s seat reads rung %q, want the table's own default", pick.word, tier, seat.Source)
-			}
-		}
-	}
-}
-
-// A HAND-TYPED MODEL SURVIVES THE PICK. The pick answers for the seats nobody
-// named, not over the names they typed — and the headless ladder says the same
-// thing the conversation says, because a pick that meant one thing in chat and
-// another under `codeaf do` would be the divergence the ladder exists to
-// prevent.
-func TestAHandTypedSeatSurvivesThePick(t *testing.T) {
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	dir := writeProfileRows(t, map[string]string{
-		KeyCrewPick:                 CrewPickLearn,
-		tierKeyFor(ModelTierWorker): "someone/else",
-	})
-
-	seat := TierSeatAt(dir, ModelTierWorker)
-	if seat.Model != "someone/else" || seat.Source != SeatCrew {
-		t.Fatalf("a hand-typed worker reads %q (%s), want someone/else (crew)", seat.Model, seat.Source)
-	}
-	// The seats the pick does answer are computed at the preset the stored
-	// rows still make — the hand-typed row costs them their preset match, so
-	// the budget falls back to the default preset, which is what an undecided
-	// profile runs at.
-	_, balanced, _ := crewpick.Presets(crewpick.Front(autoCandidates(autoTestRows()), crewpick.DefaultShapes(), crewpick.All))
-	high := TierSeatAt(dir, ModelTierHigh)
-	if high.Model != balanced.High || high.Source != SeatLearned {
-		t.Fatalf("the careful seat reads %q (%s), want %q (learned)", high.Model, high.Source, balanced.High)
-	}
-
-	// AND THE HEADLESS LADDER SAYS THE SAME. The work seat is the worker tier
-	// and the plan seat is the mastermind tier, and both must answer exactly
-	// what the conversation's rows answer — the receipt's own claim.
-	seats := ResolveSeats(dir, "", "")
-	if seats.Work.Model != "someone/else" || seats.Work.Source != SeatCrew {
-		t.Fatalf("headless, the work seat reads %q (%s), want someone/else (crew)", seats.Work.Model, seats.Work.Source)
-	}
-	if seats.Plan.Model != balanced.Mastermind || seats.Plan.Source != SeatLearned {
-		t.Fatalf("headless, the plan seat reads %q (%s), want %q (learned)", seats.Plan.Model, seats.Plan.Source, balanced.Mastermind)
-	}
-}
-
-// THE PICK'S RUNGS SAY THEIR WORDS, so a receipt never has to be guessed at:
-// the catalog word computes, the learn word learned, and the table's own
-// fallback keeps its one word.
-func TestThePickRungsSayTheirWords(t *testing.T) {
-	seat := Seat{Crew: CrewBalanced, Source: SeatComputed}
-	if got := seat.Rung(); got != "crew "+CrewBalanced+", computed from the catalog" {
-		t.Errorf("the computed rung reads %q, want crew %s, computed from the catalog", got, CrewBalanced)
-	}
-	seat.Source = SeatLearned
-	if got := seat.Rung(); got != "crew "+CrewBalanced+", learned" {
-		t.Errorf("the learned rung reads %q, want crew %s, learned", got, CrewBalanced)
-	}
-}
-
-// A BARE `auto` ROW IS COMPUTED UNDER THE PICK TOO, and its rung names the word
-// that ran. The pool's measurements reach the auto row through the same prior
-// the pick carries — [AutoPick] wraps [autoPrior] — so a row computed under the
-// learn word is a learned seat and must say so, not the catalog word's
-// `computed from the catalog`. [autoRow] is the one seam both ladders resolve an
-// auto row through, so the conversation's row and the headless work seat must
-// name the same rung: a row that meant one thing in chat and another headless is
-// the divergence the seam exists to prevent.
-func TestAnAutoRowUnderLearnReadsTheLearnRung(t *testing.T) {
-	t.Setenv(ModelEnv, "")
-	t.Setenv(PlanModelEnv, "")
-	restore := AutoModels
-	AutoModels = func() []catalog.Model { return autoTestRows() }
-	defer func() { AutoModels = restore }()
-
-	dir := writeProfileRows(t, map[string]string{
-		KeyCrewPick:                 CrewPickLearn,
-		tierKeyFor(ModelTierWorker): AutoValue,
-	})
-	want := "crew " + CrewBalanced + ", learned"
-	for name, seat := range map[string]Seat{
-		"conversation": TierSeatAt(dir, ModelTierWorker),
-		"headless":     ResolveSeats(dir, "", "").Work,
-	} {
-		if got := seat.Rung(); got != want {
-			t.Errorf("%s: a bare auto row under %s reads rung %q, want %q", name, CrewPickLearn, got, want)
-		}
-		if strings.TrimSpace(seat.Model) == "" || IsAuto(seat.Model) {
-			t.Errorf("%s: the auto seat reads model %q, want a computed id", name, seat.Model)
-		}
-	}
-}
-
-// THE CHECK SEAT IS RESOLVED AT THE DOOR, rung by rung: its flag, its
-// environment, a plan seat pinned by flag or environment, then empty for the
-// crew factory's careful row. A plan filled by the crew does not answer.
-func TestCheckSeatClimbsItsOwnLadder(t *testing.T) {
-	planFlag := Seat{Role: SeatPlan, Model: "vendor/named-plan-flag", Source: SeatFlag}
-	planEnv := Seat{Role: SeatPlan, Model: "vendor/named-plan-env", Source: SeatEnv}
-	planCrew := Seat{Role: SeatPlan, Model: "vendor/crew-plan", Source: SeatCrew}
-
-	t.Run("check flag", func(t *testing.T) {
-		t.Setenv(CheckModelEnv, "vendor/named-check-env")
-		seat := CheckSeat("vendor/named-check-flag", planFlag)
-		if seat.Model != "vendor/named-check-flag" || seat.Source != SeatFlag {
-			t.Fatalf("check seat = %q (%s), want the check flag", seat.Model, seat.Rung())
-		}
-	})
-	t.Run("check environment", func(t *testing.T) {
-		t.Setenv(CheckModelEnv, "vendor/named-check-env")
-		seat := CheckSeat("", planFlag)
-		if seat.Model != "vendor/named-check-env" || seat.Source != SeatEnv {
-			t.Fatalf("check seat = %q (%s), want the check environment", seat.Model, seat.Rung())
-		}
-	})
-	t.Run("plan flag", func(t *testing.T) {
-		t.Setenv(CheckModelEnv, "")
-		seat := CheckSeat("", planFlag)
-		if seat.Model != planFlag.Model || seat.Source != SeatFlag {
-			t.Fatalf("check seat = %q (%s), want the flagged plan", seat.Model, seat.Rung())
-		}
-	})
-	t.Run("plan environment", func(t *testing.T) {
-		t.Setenv(CheckModelEnv, "")
-		seat := CheckSeat("", planEnv)
-		if seat.Model != planEnv.Model || seat.Source != SeatEnv {
-			t.Fatalf("check seat = %q (%s), want the environment plan", seat.Model, seat.Rung())
-		}
-	})
-	t.Run("crew careful", func(t *testing.T) {
-		t.Setenv(CheckModelEnv, "")
-		for _, plan := range []Seat{{Role: SeatPlan}, planCrew} {
-			if seat := CheckSeat("", plan); seat.Model != "" {
-				t.Fatalf("check seat = %q, want empty for the crew's careful row", seat.Model)
-			}
-		}
-	})
-}
diff --git a/internal/config/settings.go b/internal/config/settings.go
index 9bda64e36b..7ca1cc07ae 100644
--- a/internal/config/settings.go
+++ b/internal/config/settings.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/ctxbudget"
 	"github.com/Agent-Field/codeaf/internal/env"
 	"github.com/Agent-Field/codeaf/internal/pool/poolcfg"
@@ -220,50 +221,6 @@ const (
 	// [ValidateTierValue] is the same gate on all five — but this is the one the
 	// shipped crew writes it into.
 	KeyTierMastermindModel = "models.tiers.mastermind"
-	// KeyCrew is the five tiers answered as ONE DECISION. Nobody arrives wanting
-	// to name five model ids; they arrive wanting to spend pennies, or to spend
-	// what it takes. So the row takes one word — frugal, balanced, max — and
-	// writes all five tier rows from it.
-	//
-	// IT IS NOT STORED. The row's reading is DERIVED from the five live tier
-	// values: they match a preset and it says so, or they do not and it says
-	// custom. A stored word would be a claim about five other rows that any one
-	// of them could falsify by being edited, and a settings sheet that told you
-	// "balanced" over a hand-pinned tier would be lying in the one place a person
-	// went to check.
-	//
-	// THE BUILD WRITES NO WORD HERE, AND READS ONE THAT IS. The derivation above is
-	// what every profile this product shapes reads — but a run that wrote the
-	// word itself (a harness, a hand edit) named a budget, and a crew word that
-	// reached nobody is worse than a row five others can falsify: [storedCrewWord]
-	// reads it as the budget its seats run at, and the class rows under it are
-	// that run's own pins ([pickedSeat]).
-	KeyCrew = "models.crew"
-	// KeyCrewSource is which family the crew words draw from: `open`, the
-	// open-weight table this build ships, or `all`, the same three words
-	// resolved over the whole catalog with closed and frontier models in it.
-	// IT IS A ROW RATHER THAN A SECOND VOCABULARY because the three words are
-	// the only thing anybody learns: the question a person arrives with is how
-	// much to spend, and which shelf the answer comes off is one more answer to
-	// the same question, not six new preset words. The row is read by the
-	// crew's own machinery (crew.go's [CrewSourceAt]) and never by a caller
-	// spelling the ids itself, so the family and the tables cannot disagree
-	// about what a preset means. It is PROFILE-ONLY with the tier rows, for the
-	// worker row's own reason: a repository that could answer it could send a
-	// visitor's work, and their credit, to a vendor they never chose.
-	KeyCrewSource = "models.crew.source"
-	// KeyCrewPick is where the crew's seats are picked from when a tier row
-	// does not hold a model id of its own. The three words are read and
-	// answered by the crew's own machinery (crew.go's [CrewPickAt] and
-	// [SetCrewPick]) beside the words [KeyCrew] and [KeyCrewSource] take: the
-	// crew row says how much to spend, the family row says which shelf those
-	// budgets name, and this row says where the models for that money come
-	// from — the rows this build measured, or a computation off the catalog
-	// made again on every read, with or without what the Model Pool measured.
-	// It is PROFILE-ONLY with the crew and family rows, for the worker row's
-	// own reason: a repository that could answer it could send a visitor's
-	// work, and their credit, to a model nobody on that machine chose.
-	KeyCrewPick = "models.crew.pick"
 	// KeyMouse is whether the surface reports the mouse at all. ON is the
 	// default ([DefaultMouse]), because hover, click and the wheel are v3's own
 	// language and the thing they cost is bought back by a key: an alt-screen
@@ -1030,45 +987,24 @@ const (
 // [tierKeyFor] is total over it.
 var ModelTiers = []string{ModelTierReflex, ModelTierLow, ModelTierWorker, ModelTierHigh, ModelTierMastermind}
 
-// THE SHIPPED CREW. All five tiers arrive pointed at a model, and the five
-// together are exactly the `balanced` row of the DEFAULT FAMILY (crew.go's
-// [crewAllModels], named by [DefaultCrewSource]) — which is what makes the crew
-// row read "balanced" on a profile nobody has touched instead of reading
-// "custom" about its own defaults.
+// THE TWO ROWS THAT ARE NOT CREW SEATS arrive pointed at a model. The reflex
+// and small-work tiers carry the calls a conversation makes on its own behalf —
+// twice a turn for the reflex — so a person who never opened the sheet gets a
+// model that costs near nothing rather than the one they are talking to. The
+// three crew seats have no shipped model at all: an unpinned seat is routed per
+// task (crew.go), and a build-chosen worker, planner or checker would be the
+// implicit fallback the router exists to remove.
 //
 // Each is a bare OpenRouter id, spelled ONCE here and read by every caller
-// through [TierModelAt], so the model this build considers near-free is one
-// string rather than a figure repeated in a row, a resolver and a page.
-//
-// Blank is still an answer on every one of them: a row a person emptied on
-// purpose reads empty and the roles on it follow the model the person is talking
+// through [TierModelAt]. Blank is still an answer on both: a row a person
+// emptied on purpose reads empty and follows the model the person is talking
 // to, which is [roles.Resolve]'s floor. UNSET and CLEARED are different answers
-// here, and that distinction is the whole mechanism ([TierModelAt] says how).
-//
-// The ids are read off the catalog's own published rows — its intelligence,
-// coding and agentic indexes against its prompt, completion and cache-read
-// prices, priced under each seat's own call shape (crew.go's [crewAllModels]
-// comment owns the method and the date). The low row is pinned to a DATED build
-// on purpose: the bare `deepseek/deepseek-v4-flash` id resolves to the April
+// here ([TierModelAt] says how). The low row is pinned to a DATED build on
+// purpose: the bare `deepseek/deepseek-v4-flash` id resolves to the April
 // build, and the July build costs the same.
 const (
 	DefaultReflexModel = "google/gemini-2.5-flash"
 	DefaultLowModel    = "deepseek/deepseek-v4-flash-0731"
-	// The worker is the seat that pays most of a task's bill, so it is the last
-	// seat a preset spends on: a step here multiplies through every token a task
-	// runs up, where a step on the two low-volume seats is paid a handful of
-	// times. glm-5.3-flash is the point on the long-cached-loop front that
-	// balanced runs at, and it can see images, which the parent can hand it
-	// without a vision detour.
-	DefaultWorkerModel = "z-ai/glm-5.3-flash"
-	// The careful tier is ALWAYS A DIFFERENT VENDOR FROM THE WORKER, in every
-	// preset, and always a model that sees images: a check from a second vendor
-	// catches what the first vendor's blind spots let through, and the vision
-	// role rides this row.
-	DefaultHighModel = "anthropic/claude-fable-5.1"
-	// The mastermind names a capable planning model. Its generation behavior is
-	// left to the provider unless an operator adds a level to the model id.
-	DefaultMastermindModel = "anthropic/claude-opus-5"
 )
 
 // DocumentEngines are the four rungs CODEAF_DOC_ENGINE accepts.
@@ -2420,62 +2356,13 @@ func (s *Settings) build() []Setting {
 			read:  func() string { return formatDuration(resolvedDuration(BriefAfterAt(dir))) },
 			write: func(raw string) error { return writeDuration(dir, KeyBriefAfter, raw) },
 		},
-		// THE CREW, AND THEN THE FOUR CLASSES IN IT. The tiers are what a person
-		// actually configures for the calls codeaf makes on its own — the name it
-		// gives a session, the check on work a task says is finished, the plan an
-		// adaptive run steers by (internal/roles). Four rows, not one per feature: a new
-		// call joins a class and needs no row of its own.
-		//
-		// The crew row comes FIRST because it is the only one most people will
-		// ever touch: one word writes all four (crew.go). The four below it are
-		// what that word wrote, and each is answerable on its own — which is what
-		// turns the crew reading to "custom".
-		Setting{
-			Key: KeyCrew, Category: CategoryModels, Kind: SettingChoice,
-			Label: "crew", Choices: CrewPresets,
-			Hint: "the five models codeaf works with, chosen as one word. `frugal`, " +
-				"`balanced` and `max` each pick their own roster, listed by /crew and under " +
-				"the crew row, and which shelf they draw from is the `model family` row " +
-				"below. Change one of the five rows below and this reads `custom`.",
-			read:  func() string { return CrewAt(dir) },
-			write: func(raw string) error { return writeCrew(dir, raw) },
-		},
-		// WHERE THE SEATS ARE PICKED FROM, one row under the crew. The crew row
-		// says how much to spend and this says where the models for that money
-		// come from when a tier row does not hold a person's own id: the rows
-		// this build measured and shipped, or the same three budgets recomputed
-		// off the catalog on every read, with or without what the Model Pool
-		// and the person's own judged runs measured. The words are the crew's
-		// own (crew.go), so the row and the ladder cannot disagree about what a
-		// pick means.
-		Setting{
-			Key: KeyCrewPick, Category: CategoryModels, Kind: SettingChoice,
-			Label: "picked from", Choices: CrewPicks,
-			Hint: "where the crew's models come from. table: the rows we measured. " +
-				"catalog: recomputed from today's published prices and scores at your " +
-				"crew's budget. learn: catalog plus the Model Pool's measurements and " +
-				"your own judged runs.",
-			read:  func() string { return CrewPickAt(dir) },
-			write: func(raw string) error { return SetCrewPick(dir, raw) },
-		},
-		// THE FAMILY THE THREE WORDS DRAW FROM, one row under the crew. It sits
-		// beside the crew row because it is the same decision read one level up:
-		// the crew row says which five models, and this says which shelf those
-		// five come off. `all` is the default and what the shipped five are the
-		// balanced row of; `open` narrows the same three words to open weights.
-		Setting{
-			Key: KeyCrewSource, Category: CategoryModels, Kind: SettingChoice,
-			Label: "model family", Choices: CrewSources,
-			Hint: "which family the crew words draw from. `all` is the default: frugal, " +
-				"balanced and max read off the whole catalog, closed and frontier models " +
-				"included, and cost what those models cost. `open` reads the same three " +
-				"words off the open-weight rows only, so no seat is a bet on one vendor's " +
-				"pricing. Seats nobody pinned move with the family at " +
-				"once, because an unwritten seat is the default crew; rows already written " +
-				"keep their ids until you pick the crew again.",
-			read:  func() string { return CrewSourceAt(dir) },
-			write: func(raw string) error { return SetCrewSource(dir, raw) },
-		},
+		// THE TWO ROWS THAT ARE NOT THE CREW, AND THEN THE CREW'S THREE PINS.
+		// The tiers are what a person configures for the calls codeaf makes on
+		// its own — the name it gives a session, the check on work a task says is
+		// finished, the plan an adaptive run steers by (internal/roles). The
+		// crew's three rows are PINS: blank is `auto`, the router picking that
+		// seat for each task, and /crew is where they are read and set with the
+		// allowed models and the cap beside them (crew.go).
 		Setting{
 			Key: KeyTierReflexModel, Category: CategoryModels, Kind: SettingText,
 			Label: "reflex", EmptyLabel: "follows the conversation",
@@ -2494,37 +2381,32 @@ func (s *Settings) build() []Setting {
 			read:  func() string { return TierModelAt(dir, ModelTierLow) },
 			write: func(raw string) error { return writeTierModel(dir, ModelTierLow, raw) },
 		},
-		// The worker row is the one most people will change second, after the
-		// crew: it is the seat that does the work and pays most of a task's bill.
 		Setting{
 			Key: KeyTierWorkerModel, Category: CategoryModels, Kind: SettingText,
-			Label: "worker", EmptyLabel: "follows the conversation",
-			Hint: "the model that does the work — every task you hand off, the parts it " +
-				"divides into, and the nodes of an adaptive run. Most of what a task costs " +
-				"is spent here. Leave it blank and tasks ride the model you are talking to; " +
-				"the `task model` row under Tasks, when set, wins over this one.",
-			read:  func() string { return TierModelAt(dir, ModelTierWorker) },
-			write: func(raw string) error { return writeTierModel(dir, ModelTierWorker, raw) },
+			Label: "worker", EmptyLabel: CrewAuto,
+			Hint: "the model that does the work of every task — blank is auto: codeaf picks it " +
+				"for each task from the kind of work it is. Pin one with a model id, or " +
+				"`model@provider` to pin the route too. /crew shows all three seats.",
+			read:  func() string { return crewSeatRow(dir, crewroute.Worker) },
+			write: func(raw string) error { return SetCrewPin(dir, crewroute.Worker, raw) },
 		},
 		Setting{
 			Key: KeyTierHighModel, Category: CategoryModels, Kind: SettingText,
-			Label: "careful work", EmptyLabel: "follows the conversation",
-			Hint: "the capable model for the things that must not be wrong — the check on " +
-				"finished task work, the brief a task is shaped into, reading an image.",
-			read:  func() string { return TierModelAt(dir, ModelTierHigh) },
-			write: func(raw string) error { return writeTierModel(dir, ModelTierHigh, raw) },
+			Label: "checker", EmptyLabel: CrewAuto,
+			Hint: "the model that checks finished task work, and reads an image for a model " +
+				"that cannot — blank is auto: a strong checker for open-ended work, a cheap one " +
+				"for a narrow fix. Pin one with a model id, or `model@provider`.",
+			read:  func() string { return crewSeatRow(dir, crewroute.Checker) },
+			write: func(raw string) error { return SetCrewPin(dir, crewroute.Checker, raw) },
 		},
-		// The fourth tier is the one whose value may name a LEVEL as well as a
-		// model, because it is the one class of call where how hard the model
-		// thinks is the point rather than the price.
 		Setting{
 			Key: KeyTierMastermindModel, Category: CategoryModels, Kind: SettingText,
-			Label: "mastermind", EmptyLabel: "follows the conversation",
-			Hint: "the model that plans adaptive runs and designs saved harnesses — the one " +
-				"answer that decides what every other call does. Add `:low`, `:medium` or " +
+			Label: "planner", EmptyLabel: CrewAuto,
+			Hint: "the model that plans a task's work and designs saved harnesses — blank is " +
+				"auto. Pin one with a model id, or `model@provider`; add `:low`, `:medium` or " +
 				"`:high` to ask it to think that hard: `moonshotai/kimi-k3:high`.",
-			read:  func() string { return TierModelAt(dir, ModelTierMastermind) },
-			write: func(raw string) error { return writeTierModel(dir, ModelTierMastermind, raw) },
+			read:  func() string { return crewSeatRow(dir, crewroute.Planner) },
+			write: func(raw string) error { return SetCrewPin(dir, crewroute.Planner, raw) },
 		},
 		Setting{
 			Key: KeyModelRoles, Category: CategoryModels, Kind: SettingText,
@@ -4038,33 +3920,20 @@ func ParseToolApprovals(raw string) (map[string]string, error) {
 	return pairs, nil
 }
 
-// TierModelAt resolves the model one auxiliary tier runs on. Empty means the
-// tier follows the session's own model, which is internal/roles' floor.
+// TierModelAt resolves the model one tier runs on. Empty means the tier follows
+// the session's own model, which is internal/roles' floor.
 //
-// UNSET AND CLEARED ARE DIFFERENT ANSWERS, on all five tiers. A profile that has
-// never held the key gets this build's own choice for that class of work
-// ([DefaultReflexModel] and its four neighbours), because a person who never
-// opened the sheet should not have the whole crew answering on the most
-// expensive model in the build — which is what following the conversation means
-// once there is a mastermind tier in it. A row somebody emptied ON PURPOSE reads
-// empty and follows the conversation, because refusing to let them turn it off
-// would make a default into a rule.
+// A CREW SEAT'S TIER — worker, mastermind (the planner), high (the checker) —
+// reads its pin, or the router's standing pick when it has none ([TierSeatAt]),
+// so the calls that ride those tiers outside a task follow the crew without a
+// second place to set it.
 //
-// AND UNSET HAS TWO READINGS OF ITS OWN, which is the rung this function learned
-// in #312. A key that was never held on a profile OLDER THAN ITS SEAT is not a
-// person declining to answer — it is a crew chosen before the row existed — so
-// the read climbs [TierSeatAt], where an unheld key asks the row it was split
-// out of first ([tierLineage]) and only a profile with nothing above it reaches
-// the build's choice. Every caller of this function therefore reads the model a
-// conversation ACTUALLY runs that class of work on: the role map cmd/codeaf
-// builds, the settings sheet's five rows, and [CrewAt], which is why the crew
-// word and the work cannot disagree. A caller that also needs to say WHERE the
-// answer came from asks [TierSeatAt] for the seat instead of this for the model.
-//
-// The reflex tier was the first row written this way, for the reason its key
-// still states: a call made twice a turn is a bill nobody agreed to. The other
-// three joined it when the crew landed, and the four defaults together are one
-// preset rather than four opinions (crew.go).
+// THE OTHER TWO ROWS KEEP THE RULE THEY HAVE ALWAYS HAD: UNSET AND CLEARED ARE
+// DIFFERENT ANSWERS. A profile that has never held the key gets this build's
+// own near-free model ([DefaultReflexModel], [DefaultLowModel]), because a call
+// made twice a turn is a bill nobody agreed to; a row somebody emptied ON
+// PURPOSE reads empty and follows the conversation, because refusing to let
+// them turn it off would make a default into a rule.
 //
 // The value may carry a level (`moonshotai/kimi-k3:low`) and IS RETURNED WHOLE.
 // Splitting is [roles.SplitEffort]'s job at the point of resolution, because a
@@ -4089,35 +3958,12 @@ func tierKeyFor(tier string) string {
 	return KeyTierLowModel
 }
 
-// defaultTierModel is what a tier answers on a profile that has never held its
-// key: the DEFAULT CREW, resolved in the family the profile chose. It is not the
-// build's constant alone, because a profile that answered the family row and no
-// tier row would otherwise run one family's crew under the other's label: the
-// family saying one thing and the ladder another. Under the default family the
-// answer is the constant, which is what [DefaultWorkerModel] and its kin name,
-// because that family's default row and the builtin five name the same set by
-// construction (crew_test.go pins it).
-func defaultTierModel(family, tier string) string {
-	if table, ok := CrewModelsForSource(family, DefaultCrew); ok {
-		if model, held := table[tier]; held {
-			return model
-		}
-	}
-	return builtinTierModel(tier)
-}
-
-// builtinTierModel is the build's own five. It is reachable only for a tier word
-// no family table holds, because both tables answer every tier this build knows.
+// builtinTierModel is the build's own model for the two rows that are not crew
+// seats. A crew seat's tier has none — it is routed — and reads the small-work
+// model only if a caller asks for a tier word this build does not know.
 func builtinTierModel(tier string) string {
-	switch tier {
-	case ModelTierReflex:
+	if tier == ModelTierReflex {
 		return DefaultReflexModel
-	case ModelTierWorker:
-		return DefaultWorkerModel
-	case ModelTierHigh:
-		return DefaultHighModel
-	case ModelTierMastermind:
-		return DefaultMastermindModel
 	}
 	return DefaultLowModel
 }
diff --git a/internal/config/settings_test.go b/internal/config/settings_test.go
index ad1e0aef42..abd0f78761 100644
--- a/internal/config/settings_test.go
+++ b/internal/config/settings_test.go
@@ -773,14 +773,11 @@ func TestMaskCredentialHidesTheKeyAndItsLength(t *testing.T) {
 // The three throttle rows read their defaults, take a person's answer, and hand
 // it back to the accessor the session door calls — which is the whole of what a
 // settings row has to do.
-// EVERY TIER ROW SHIPS POINTED AT A MODEL, and the two answers a person can give
-// one are different from each other: never touching it is this build's own
-// choice, emptying it on purpose is "follow the conversation".
-//
-// The reflex row was the first written this way, for the reason its key states.
-// The other three joined it when the crew landed (crew.go), because a whole crew
-// following the conversation means the most expensive model in the build
-// answering the cheapest questions in it.
+// THE TWO ROWS THAT ARE NOT CREW SEATS SHIP POINTED AT A MODEL, and the two
+// answers a person can give one are different from each other: never touching
+// it is this build's own choice, emptying it on purpose is "follow the
+// conversation". The crew's three seats ship with NO model: unpinned, a seat is
+// routed, and a profile with no provider connected has nothing to route to.
 func TestEveryTierShipsWithAModelAndCanStillBeCleared(t *testing.T) {
 	dir := t.TempDir()
 	row := mustRow(t, registry(t, dir), KeyTierReflexModel)
@@ -791,15 +788,12 @@ func TestEveryTierShipsWithAModelAndCanStillBeCleared(t *testing.T) {
 	if got := row.Value(); got != DefaultReflexModel {
 		t.Fatalf("the reflex row reads %q in an untouched profile, want %q", got, DefaultReflexModel)
 	}
-	// And so do its three neighbours, each with the model this build chose for
-	// that class of work.
-	for _, c := range []struct{ tier, want string }{
-		{ModelTierLow, DefaultLowModel},
-		{ModelTierHigh, DefaultHighModel},
-		{ModelTierMastermind, DefaultMastermindModel},
-	} {
-		if got := TierModelAt(dir, c.tier); got != c.want {
-			t.Fatalf("the %s tier resolves %q in an untouched profile, want %q", c.tier, got, c.want)
+	if got := TierModelAt(dir, ModelTierLow); got != DefaultLowModel {
+		t.Fatalf("the low tier resolves %q in an untouched profile, want %q", got, DefaultLowModel)
+	}
+	for _, tier := range []string{ModelTierWorker, ModelTierHigh, ModelTierMastermind} {
+		if seat := TierSeatAt(dir, tier); seat.Source != SeatRouted {
+			t.Fatalf("the %s tier reads %+v in an untouched profile, want a routed seat", tier, seat)
 		}
 	}
 
diff --git a/internal/config/sources_test.go b/internal/config/sources_test.go
index 77a7a2ac9d..4c25124121 100644
--- a/internal/config/sources_test.go
+++ b/internal/config/sources_test.go
@@ -469,7 +469,7 @@ func TestReconnectingACollidingServiceKeepsTheFirstSuggestedName(t *testing.T) {
 func TestAnUnqualifiedIdResolvesExactlyAsItDidBefore(t *testing.T) {
 	models := []string{
 		DefaultModel, DefaultVoiceModel, DefaultReflexModel, DefaultLowModel,
-		DefaultWorkerModel, DefaultHighModel, DefaultMastermindModel,
+		"z-ai/glm-5.3-flash", "moonshotai/kimi-k3", "anthropic/claude-opus-5",
 	}
 	for _, base := range []string{DefaultBaseURL, "https://company.example/v1"} {
 		for _, model := range models {
diff --git a/internal/config/testdata/profile-keys.ledger b/internal/config/testdata/profile-keys.ledger
index 4d6c828b2f..ec695bced4 100644
--- a/internal/config/testdata/profile-keys.ledger
+++ b/internal/config/testdata/profile-keys.ledger
@@ -45,8 +45,13 @@ model.work
 model_pool
 model_sources
 models.crew
+models.crew.allowed
+models.crew.cap
+models.crew.free_routes
 models.crew.pick
+models.crew.providers.off
 models.crew.source
+models.crew.task_cap
 models.fallbacks
 models.pool.public_key
 models.roles
diff --git a/internal/crewpick/crewpick.go b/internal/crewpick/crewpick.go
deleted file mode 100644
index a8e6942667..0000000000
--- a/internal/crewpick/crewpick.go
+++ /dev/null
@@ -1,715 +0,0 @@
-// Package crewpick picks one model per seat for a three-seat crew by reading
-// the pareto front of expected task bill against crew quality.
-//
-// It deliberately imports nothing from the rest of the tree and touches no
-// disk and no network: the caller owns the candidate list and the seat
-// shapes, and the same candidates give the same front however often they are
-// asked about and in whatever order they arrive.
-//
-// The law it implements: every (worker, high, mastermind) combination the
-// candidates can field is scored by the bill its seats' token volumes run up
-// and by the mean of its three seat qualities. A candidate is in the running
-// for a seat only when it meets the family and the seat's needs and its
-// quality reaches Floor of that seat's best in the family, and a crew is
-// refused outright when its high seat comes from the worker's own vendor.
-// The crews that no other crew beats on both bill and quality survive as the
-// front, sorted by bill; Presets and AtKnob read picks off that front.
-//
-// A candidate that publishes some but not all of its three indexes is scored
-// on the ones it publishes: each missing index is estimated from the call's
-// candidates that publish both it and one of its measured ones — the donors —
-// never above the call's largest measured value of that index, and the
-// result says which of a pick's indexes were estimated. A candidate that
-// publishes none of its indexes, or no price at all, is out of the running.
-package crewpick
-
-import (
-	"math"
-	"slices"
-	"sort"
-	"strings"
-)
-
-// An Index is one of the three capability indexes quality is read from —
-// intelligence, coding, agentic — in the order the seat weights and a
-// candidate's reading carry them.
-type Index int
-
-const (
-	Intelligence Index = iota
-	Coding
-	Agentic
-)
-
-// A Candidate is one model up for a seat. Prices are dollars per 1M tokens.
-//
-// A candidate carrying none of the three indexes — zero values, which is how
-// unpublished indexes read — or carrying a zero prompt price is not a
-// candidate at all: it never occupies a seat, never clears a floor, and
-// raises no ceiling. A candidate carrying some but not all of its indexes is
-// scored on the ones it publishes, each missing one estimated from the
-// donors among its fellow candidates, and the result says which of a pick's
-// indexes those were. A model that publishes no cache-read price says so with
-// HasCacheRead false and pays the prompt price on the cache share too.
-type Candidate struct {
-	// ID names the candidate; the text before its first slash is the vendor.
-	ID string
-	// Open marks a candidate the open family may draw from.
-	Open bool
-	// Intelligence, Coding and Agentic are the three capability indexes
-	// quality is read from.
-	Intelligence float64
-	Coding       float64
-	Agentic      float64
-	// PromptPrice, CompletionPrice and CacheReadPrice are the dollars per
-	// 1M tokens of each kind.
-	PromptPrice     float64
-	CompletionPrice float64
-	CacheReadPrice  float64
-	// HasCacheRead reports whether CacheReadPrice is published at all.
-	HasCacheRead bool
-	// Context is the model's context window, in tokens.
-	Context int
-	// Images and Tools are what the model can take and call.
-	Images bool
-	Tools  bool
-}
-
-// A Seat is one of a crew's three roles: the worker carries the volume of
-// the work, the high seat judges and repairs what the worker writes, and the
-// mastermind spends a little context steering the whole task.
-type Seat int
-
-const (
-	Worker Seat = iota
-	High
-	Mastermind
-)
-
-// A SeatShape is how one seat uses whatever model sits it: the weights
-// quality is read from, the token mix cost is computed on, what the model must
-// be able to take and call, the window it must have, and the share of a
-// task's tokens the seat burns.
-type SeatShape struct {
-	// Weights reads quality from the three indexes: intelligence, coding,
-	// agentic.
-	Weights [3]float64
-	// InOut is the seat's input tokens per output token; the completion
-	// price is spread over it.
-	InOut float64
-	// CacheShare is the share of the seat's input tokens served from cache.
-	CacheShare float64
-	// NeedTools and NeedImages are what a model must take and call to sit
-	// the seat.
-	NeedTools  bool
-	NeedImages bool
-	// MinContext is the window a model must have to sit the seat.
-	MinContext int
-	// Volume is the seat's share of a task's tokens, and the weight its
-	// cost carries in a crew's bill.
-	Volume float64
-}
-
-// DefaultShapes returns the three seat shapes crews are picked for. The
-// worker takes half its quality from the agentic index and reads barely
-// anything but cached input; the high seat judges the three indexes evenly,
-// needs tools and images both, and sees the same token mix on a sliver of the
-// volume; the mastermind reads intelligence and agentic only, on a terse
-// ten-in-one mix with no cache and a fraction of the volume.
-func DefaultShapes() map[Seat]SeatShape {
-	return map[Seat]SeatShape{
-		Worker: {
-			Weights:    [3]float64{0.2, 0.3, 0.5},
-			InOut:      100,
-			CacheShare: 0.75,
-			NeedTools:  true,
-			MinContext: 200_000,
-			Volume:     0.90,
-		},
-		High: {
-			Weights:    [3]float64{1.0 / 3.0, 1.0 / 3.0, 1.0 / 3.0},
-			InOut:      100,
-			CacheShare: 0.75,
-			NeedTools:  true,
-			NeedImages: true,
-			MinContext: 200_000,
-			Volume:     0.08,
-		},
-		Mastermind: {
-			Weights:    [3]float64{0.6, 0, 0.4},
-			InOut:      10,
-			MinContext: 200_000,
-			Volume:     0.02,
-		},
-	}
-}
-
-// A Family is which candidates a crew may be drawn from.
-type Family int
-
-const (
-	// Open draws only from candidates marked Open.
-	Open Family = iota
-	// All draws from every candidate.
-	All
-)
-
-// A Crew is one (worker, high, mastermind) pick. Bill is the expected dollars
-// per 1M task tokens once each seat's share of the task is paid for at its
-// seat cost; Quality is the mean of the three seat qualities on a 0-100
-// scale.
-type Crew struct {
-	Worker     string
-	High       string
-	Mastermind string
-	Bill       float64
-	Quality    float64
-	// Estimated marks, for the model in each seat, which of its indexes
-	// were scored by estimate rather than measurement: the row is the seat
-	// and the column the index. A crew picked on measured indexes alone is
-	// all false.
-	Estimated [3][3]bool
-	// Measured marks, for the model in each seat, whether a pool's own
-	// rating for that model entered the seat's quality: the row is the seat
-	// and the value says the seat's model carried a rating with a positive
-	// observation count. A crew picked with no prior, or whose seats the
-	// prior never rated, is all false.
-	Measured [3]bool
-}
-
-// Floor is the share of a seat's best quality in the family that a candidate
-// must reach to stay in the running for that seat. A model that cannot do
-// the job is not cheap, whatever it costs.
-const Floor = 0.80
-
-// PriorWeightAt is the observation count at which a pool's own rating for a
-// model carries the same weight in a seat's quality as the catalog's
-// published indexes: at N observations the rating is worth half the seat and
-// the catalog the other half. A rating with no observations never enters.
-const PriorWeightAt = 30
-
-// A Rating is a pool's measured quality for one model on one seat, on the
-// same 0-100 scale quality is read on, with the number of observations behind
-// it.
-type Rating struct {
-	Mean float64
-	N    int
-}
-
-// A Prior is a pool's measured quality per seat, keyed by canonical model id:
-// the rating a seat's quality is blended towards, by how many observations
-// back it. A nil Prior is no prior at all, and every seat keeps the catalog
-// quality.
-type Prior map[Seat]map[string]Rating
-
-// A Cell is one measurement a caller hands PriorFromCells: a role, a model id
-// and the pool's mean quality with the observations behind it. It is the shape
-// a measurement document reads into, so crewpick need not import the reader.
-type Cell struct {
-	Role  string
-	Model string
-	Mean  float64
-	N     int
-}
-
-// seatWords names the roles a Cell's role word maps to a seat by, folded to
-// one spelling so a document's own case never matters. Any other word names
-// no seat and is ignored.
-var seatWords = map[string]Seat{
-	"worker":     Worker,
-	"high":       High,
-	"mastermind": Mastermind,
-}
-
-// PriorFromCells reads a pool's measurements into a Prior: a cell names a
-// seat by its role word, a model by an id that canonical resolves to the
-// canonical id a candidate is looked up by, and carries a mean and a count.
-// A cell whose role names no seat, or whose count is below minInstalls, is
-// ignored, and so is a count of zero or less. A nil canonical leaves the id
-// as it stands. When no cell survives the prior is nil, which is the same as
-// no prior at all.
-//
-// The floor here keeps counting rows rather than the installs a measurement
-// document carries beside them: the reader applies the document's floor
-// before these cells arrive — on installs where a cell spells them — and
-// rows cannot be fewer than the installs that produced them, so a cell that
-// floor kept meets this one too. The cells built outside a document carry
-// rows alone, so an installs field on Cell would sit unset on every caller,
-// and there is none.
-func PriorFromCells(cells []Cell, minInstalls int, canonical func(string) string) Prior {
-	var prior Prior
-	for _, c := range cells {
-		seat, ok := seatWords[strings.ToLower(strings.TrimSpace(c.Role))]
-		if !ok || c.N < minInstalls || c.N <= 0 {
-			continue
-		}
-		model := c.Model
-		if canonical != nil {
-			model = canonical(model)
-		}
-		if prior == nil {
-			prior = Prior{}
-		}
-		if prior[seat] == nil {
-			prior[seat] = map[string]Rating{}
-		}
-		prior[seat][model] = Rating{Mean: c.Mean, N: c.N}
-	}
-	return prior
-}
-
-// MergePriors folds two priors into one. Seat by seat, a rating both hold for
-// a model is combined by observation count — the two means weighted by the
-// counts behind them, the counts added — and a rating either holds alone is
-// carried whole. A nil prior on either side is the other, and two nils are
-// nil. The priors given are read and never changed, so the answer is never
-// one of them.
-func MergePriors(a, b Prior) Prior {
-	if a == nil {
-		return b
-	}
-	if b == nil {
-		return a
-	}
-	merged := make(Prior)
-	for seat, ratings := range a {
-		for model, r := range ratings {
-			if merged[seat] == nil {
-				merged[seat] = map[string]Rating{}
-			}
-			merged[seat][model] = r
-		}
-	}
-	for seat, ratings := range b {
-		for model, r := range ratings {
-			got, ok := merged[seat][model]
-			if !ok {
-				if merged[seat] == nil {
-					merged[seat] = map[string]Rating{}
-				}
-				merged[seat][model] = r
-				continue
-			}
-			n := got.N + r.N
-			if n <= 0 {
-				merged[seat][model] = Rating{}
-				continue
-			}
-			merged[seat][model] = Rating{
-				Mean: (float64(got.N)*got.Mean + float64(r.N)*r.Mean) / float64(n),
-				N:    n,
-			}
-		}
-	}
-	return merged
-}
-
-// SeatCost is the seat's expected cost of a candidate, in dollars per 1M
-// input-equivalent tokens: the prompt price blended with the cache-read
-// price by the seat's cache share, plus the completion price spread over the
-// seat's input-to-output ratio. A candidate that publishes no cache-read
-// price pays the prompt price on the cache share too.
-func SeatCost(c Candidate, shape SeatShape) float64 {
-	cache := c.PromptPrice
-	if c.HasCacheRead {
-		cache = c.CacheReadPrice
-	}
-	return (1-shape.CacheShare)*c.PromptPrice + shape.CacheShare*cache + c.CompletionPrice/shape.InOut
-}
-
-// SeatQuality is the candidate's quality for the seat on a 0-100 scale: each
-// index counted against the pool's best for that index and weighted by the
-// seat's weights. The pool sets the scale, so the same candidate scores
-// differently in a stronger pool. A missing index is estimated from the
-// pool's donors exactly as in Front. A row that is not a candidate at all,
-// and any row against a pool with no candidates to raise a scale, score
-// zero.
-func SeatQuality(c Candidate, shape SeatShape, pool []Candidate) float64 {
-	return SeatQualityWith(c, shape, pool, Worker, nil)
-}
-
-// SeatQualityWith is SeatQuality with the pool's prior blended in for the seat
-// given: a rating the prior holds for the candidate's canonical id, with a
-// positive observation count, moves the seat's quality towards the rating's
-// mean by N/(N+PriorWeightAt), and a seat the prior never rates — or rates
-// with no observations — keeps the catalog quality unchanged.
-func SeatQualityWith(c Candidate, shape SeatShape, pool []Candidate, seat Seat, prior Prior) float64 {
-	if !isCandidate(c) {
-		return 0
-	}
-	scale := maxima(pool)
-	r := fill(c, readTally(pool), scale)
-	q, _ := blendQuality(c.ID, quality(r.idx, shape, scale), seat, prior)
-	return q
-}
-
-// Front returns the pareto front of (bill, quality) over every crew the
-// candidates can field in the family, sorted by bill: a crew on it is beaten
-// by no other crew on both, and every crew off it is beaten by one on it.
-//
-// shapes must carry an entry for every seat. Per seat the running is
-// narrowed twice before crews are enumerated — family and the seat's needs
-// first, then Floor against that seat's best in the family — and a crew is
-// refused while its high seat comes from the worker's own vendor, so the two
-// seats that see the same work never share one shop. Ties in (bill, quality)
-// break to the crew scored on fewer estimated indexes, and ties past that by
-// id order — worker, then high, then mastermind — which is what makes the
-// front a property of the candidates rather than of their order.
-func Front(candidates []Candidate, shapes map[Seat]SeatShape, fam Family) []Crew {
-	return FrontWith(candidates, shapes, fam, nil)
-}
-
-// FrontWith is Front with the pool's prior blended into each seat's quality: a
-// rating the prior holds for a seat's model, with a positive observation
-// count, moves that seat's quality towards the rating's mean by
-// N/(N+PriorWeightAt), the seat's measured flag says so, and the floor and the
-// crew's quality read the blended value. A nil prior leaves every seat on the
-// catalog quality, exactly as Front does. The front is a property of the
-// candidates and the prior, never of the order they arrive in.
-func FrontWith(candidates []Candidate, shapes map[Seat]SeatShape, fam Family, prior Prior) []Crew {
-	scale := maxima(candidates)
-	t := readTally(candidates)
-	readings := make([]reading, 0, len(candidates))
-	for _, c := range candidates {
-		readings = append(readings, fill(c, t, scale))
-	}
-	workers := shortlist(readings, shapes[Worker], fam, scale, Worker, prior)
-	highs := shortlist(readings, shapes[High], fam, scale, High, prior)
-	minds := shortlist(readings, shapes[Mastermind], fam, scale, Mastermind, prior)
-	vw := shapes[Worker].Volume
-	vh := shapes[High].Volume
-	vm := shapes[Mastermind].Volume
-
-	crews := make([]Crew, 0, len(workers)*len(highs)*len(minds))
-	for _, w := range workers {
-		for _, h := range highs {
-			if vendor(w.c.ID) == vendor(h.c.ID) {
-				continue
-			}
-			for _, m := range minds {
-				crews = append(crews, Crew{
-					Worker:     w.c.ID,
-					High:       h.c.ID,
-					Mastermind: m.c.ID,
-					Bill:       vw*w.cost + vh*h.cost + vm*m.cost,
-					Quality:    (w.quality + h.quality + m.quality) / 3,
-					Estimated:  [3][3]bool{w.est, h.est, m.est},
-					Measured:   [3]bool{w.measured, h.measured, m.measured},
-				})
-			}
-		}
-	}
-
-	// The front: cheapest bill first, best quality first within a bill, and
-	// a crew survives when its quality beats everything cheaper so far.
-	sort.SliceStable(crews, func(i, j int) bool {
-		if crews[i].Bill != crews[j].Bill {
-			return crews[i].Bill < crews[j].Bill
-		}
-		if crews[i].Quality != crews[j].Quality {
-			return crews[i].Quality > crews[j].Quality
-		}
-		return estimateCount(crews[i]) < estimateCount(crews[j])
-	})
-	var front []Crew
-	best := math.Inf(-1)
-	for _, crew := range crews {
-		if crew.Quality > best+1e-9 {
-			front = append(front, crew)
-			best = crew.Quality
-		}
-	}
-	return front
-}
-
-// Presets reads the three named picks off a front: frugal is the cheapest
-// crew, max the dearest, and balanced the knee between them — the crew
-// farthest above the straight line from one end of the front to the other in
-// (ln bill, quality), which is where money stops buying quality in earnest.
-// A front of one crew is all three; an empty front is none.
-func Presets(front []Crew) (frugal, balanced, max Crew) {
-	if len(front) == 0 {
-		return Crew{}, Crew{}, Crew{}
-	}
-	frugal, balanced, max = front[0], knee(front), front[len(front)-1]
-	return frugal, balanced, max
-}
-
-// AtKnob reads one pick off the front at knob k in [0, 1]: the budget runs
-// geometrically from the frugal bill to the max bill — lo*(hi/lo)^k — and
-// the pick is the best-quality crew whose bill fits it, so k of 0 is frugal
-// and k of 1 is max. An empty front picks nothing.
-func AtKnob(front []Crew, k float64) Crew {
-	if len(front) == 0 {
-		return Crew{}
-	}
-	lo, hi := front[0].Bill, front[len(front)-1].Bill
-	budget := lo * math.Pow(hi/lo, k)
-	var pick Crew
-	for _, crew := range front {
-		if crew.Bill <= budget*(1+1e-9) {
-			pick = crew
-		}
-	}
-	return pick
-}
-
-// knee returns the front's knee: the crew farthest above the straight line
-// from the first crew to the last in (ln bill, quality). Ties go to the
-// earlier crew, and a front whose two ends share a bill has no line to be
-// above — its best crew carries the name.
-func knee(front []Crew) Crew {
-	x0, y0 := math.Log(front[0].Bill), front[0].Quality
-	x1, y1 := math.Log(front[len(front)-1].Bill), front[len(front)-1].Quality
-	if x1 == x0 {
-		return front[len(front)-1]
-	}
-	pick := front[0]
-	best := math.Inf(-1)
-	for _, crew := range front {
-		d := (crew.Quality - y0) - (y1-y0)*(math.Log(crew.Bill)-x0)/(x1-x0)
-		if d > best {
-			pick, best = crew, d
-		}
-	}
-	return pick
-}
-
-// A seatPick is a candidate already priced and scored for one seat, on the
-// candidate's reading: measured and estimated indexes alike. measured says
-// whether the pool's own rating for the seat entered the quality.
-type seatPick struct {
-	c        Candidate
-	idx      [3]float64
-	est      [3]bool
-	cost     float64
-	quality  float64
-	measured bool
-}
-
-// shortlist returns a seat's running: the candidates that pass family and the
-// seat's needs, kept when their quality reaches Floor of the family's best
-// for the seat, in id order. The seat's quality is read with the pool's prior
-// blended in, and measured marks the picks the prior touched.
-func shortlist(readings []reading, shape SeatShape, fam Family, scale [3]float64, seat Seat, prior Prior) []seatPick {
-	var running []seatPick
-	top := 0.0
-	for _, r := range readings {
-		if !eligible(r.c, shape, fam) {
-			continue
-		}
-		q, measured := blendQuality(r.c.ID, quality(r.idx, shape, scale), seat, prior)
-		pick := seatPick{c: r.c, idx: r.idx, est: r.est, cost: SeatCost(r.c, shape), quality: q, measured: measured}
-		running = append(running, pick)
-		top = math.Max(top, pick.quality)
-	}
-	var kept []seatPick
-	for _, pick := range running {
-		if pick.quality >= Floor*top {
-			kept = append(kept, pick)
-		}
-	}
-	sort.Slice(kept, func(i, j int) bool { return kept[i].c.ID < kept[j].c.ID })
-	return kept
-}
-
-// quality is SeatQuality against pre-read maxima, on a candidate's reading.
-func quality(idx [3]float64, shape SeatShape, scale [3]float64) float64 {
-	if scale[Intelligence] <= 0 || scale[Coding] <= 0 || scale[Agentic] <= 0 {
-		return 0
-	}
-	w := shape.Weights
-	return 100 * (w[Intelligence]*idx[Intelligence]/scale[Intelligence] +
-		w[Coding]*idx[Coding]/scale[Coding] +
-		w[Agentic]*idx[Agentic]/scale[Agentic])
-}
-
-// blendQuality blends the pool's prior for one seat into the catalog quality:
-// a rating the prior holds for the model on the seat, with a positive
-// observation count, carries weight N/(N+PriorWeightAt) against the catalog's
-// own quality, and the second result reports whether the rating entered. A
-// seat the prior never rates, or rates with no observations, keeps the
-// catalog quality and reads measured false.
-func blendQuality(model string, catalog float64, seat Seat, prior Prior) (float64, bool) {
-	if prior == nil {
-		return catalog, false
-	}
-	rating, ok := prior[seat][model]
-	if !ok || rating.N <= 0 {
-		return catalog, false
-	}
-	w := float64(rating.N) / float64(rating.N+PriorWeightAt)
-	return (1-w)*catalog + w*rating.Mean, true
-}
-
-// maxima reads the pool's largest measured value of each index — the scale
-// quality is measured against and the ceiling an estimate never crosses.
-// Only real candidates raise a ceiling, and a row that publishes only some
-// of its indexes raises only those.
-func maxima(pool []Candidate) (scale [3]float64) {
-	for _, c := range pool {
-		if !isCandidate(c) {
-			continue
-		}
-		v := measured(c)
-		for i, val := range v {
-			scale[i] = math.Max(scale[i], val)
-		}
-	}
-	return scale
-}
-
-// measured is the candidate's three indexes as it published them: an
-// unpublished index reads as zero.
-func measured(c Candidate) [3]float64 {
-	return [3]float64{c.Intelligence, c.Coding, c.Agentic}
-}
-
-// A tally is one call's donor statistics: for every ordered pair of indexes,
-// how many candidates — the donors — carry both measured, and the median of
-// the first over the second among them. A missing index is estimated from
-// these.
-type tally struct {
-	count  [3][3]int
-	median [3][3]float64
-}
-
-// readTally reads the pool's tally; the donors of a pair of indexes are the
-// candidates carrying both measured.
-func readTally(pool []Candidate) tally {
-	var ratios [3][3][]float64
-	for _, c := range pool {
-		if !isCandidate(c) {
-			continue
-		}
-		v := measured(c)
-		for _, x := range [3]Index{Intelligence, Coding, Agentic} {
-			for _, y := range [3]Index{Intelligence, Coding, Agentic} {
-				if x != y && v[x] > 0 && v[y] > 0 {
-					ratios[x][y] = append(ratios[x][y], v[x]/v[y])
-				}
-			}
-		}
-	}
-	var t tally
-	for _, x := range [3]Index{Intelligence, Coding, Agentic} {
-		for _, y := range [3]Index{Intelligence, Coding, Agentic} {
-			t.count[x][y] = len(ratios[x][y])
-			if len(ratios[x][y]) >= 3 {
-				t.median[x][y] = medianOf(ratios[x][y])
-			}
-		}
-	}
-	return t
-}
-
-// medianOf is the middle of the values in order, or the mean of the two
-// middles when there is no single middle.
-func medianOf(values []float64) float64 {
-	slices.Sort(values)
-	n := len(values)
-	if n%2 == 1 {
-		return values[n/2]
-	}
-	return (values[n/2-1] + values[n/2]) / 2
-}
-
-// A reading is a candidate's three indexes ready for scoring — the measured
-// ones as published, the missing ones estimated from the call's donors —
-// with est remembering which of the three were estimated rather than
-// measured.
-type reading struct {
-	c   Candidate
-	idx [3]float64
-	est [3]bool
-}
-
-// fill reads the candidate's three indexes for scoring. A measured index is
-// taken as published; a missing one is estimated from the ones present: each
-// present index Y offers Y times the tally's median of the missing index over
-// Y among the donors carrying both — or, when fewer than three donors carry
-// the pair, equal standing, the missing index read where its present one
-// stands, X over the pool's largest X equal to Y over the pool's largest Y —
-// and the mean of the offers is kept, never above the pool's largest measured
-// value of the missing index. A row that is no candidate at all fills to
-// zeros.
-func fill(c Candidate, t tally, scale [3]float64) reading {
-	var r reading
-	if !isCandidate(c) {
-		return r
-	}
-	r.c = c
-	v := measured(c)
-	r.idx = v
-	for _, x := range [3]Index{Intelligence, Coding, Agentic} {
-		if v[x] > 0 {
-			continue
-		}
-		var offers []float64
-		for _, y := range [3]Index{Intelligence, Coding, Agentic} {
-			if y == x || v[y] <= 0 {
-				continue
-			}
-			if t.count[x][y] >= 3 {
-				offers = append(offers, v[y]*t.median[x][y])
-			} else {
-				offers = append(offers, v[y]/scale[y]*scale[x])
-			}
-		}
-		sum := 0.0
-		for _, offer := range offers {
-			sum += offer
-		}
-		r.idx[x] = math.Min(sum/float64(len(offers)), scale[x])
-		r.est[x] = true
-	}
-	return r
-}
-
-// estimateCount reads how many of a crew's picks were scored on estimated
-// indexes — the tiebreak between crews that tie on bill and quality.
-func estimateCount(c Crew) int {
-	n := 0
-	for _, seat := range c.Estimated {
-		for _, est := range seat {
-			if est {
-				n++
-			}
-		}
-	}
-	return n
-}
-
-// isCandidate reports whether a row is a candidate at all: at least one of
-// the three indexes present and a prompt price above zero. Everything
-// downstream — eligibility, the floor, the maxima — starts from this.
-func isCandidate(c Candidate) bool {
-	return (c.Intelligence > 0 || c.Coding > 0 || c.Agentic > 0) && c.PromptPrice > 0
-}
-
-// eligible reports whether a candidate may sit the seat: family first, then
-// what the seat needs the model to take and call, then the window it needs.
-func eligible(c Candidate, shape SeatShape, fam Family) bool {
-	if !isCandidate(c) {
-		return false
-	}
-	if fam == Open && !c.Open {
-		return false
-	}
-	if shape.NeedTools && !c.Tools {
-		return false
-	}
-	if shape.NeedImages && !c.Images {
-		return false
-	}
-	return c.Context >= shape.MinContext
-}
-
-// vendor is the id text before the first slash, or the whole id when there is
-// no slash.
-func vendor(id string) string {
-	if i := strings.Index(id, "/"); i >= 0 {
-		return id[:i]
-	}
-	return id
-}
diff --git a/internal/crewpick/crewpick_test.go b/internal/crewpick/crewpick_test.go
deleted file mode 100644
index f884530002..0000000000
--- a/internal/crewpick/crewpick_test.go
+++ /dev/null
@@ -1,833 +0,0 @@
-package crewpick
-
-import (
-	"encoding/json"
-	"fmt"
-	"math"
-	"os"
-	"slices"
-	"testing"
-)
-
-// A fixture row in its own field names: a null index reads as zero —
-// missing, the way the package reads it — and a null cache-read price reads
-// as unpublished. The partially published row and the rows with unpublished
-// cache prices stay in the fixture, so the estimate and exclusion rules
-// have something to bite on.
-type row struct {
-	ID    string   `json:"id"`
-	Open  bool     `json:"open"`
-	I     float64  `json:"I"`
-	C     float64  `json:"C"`
-	A     float64  `json:"A"`
-	Pi    float64  `json:"pi"`
-	Po    float64  `json:"po"`
-	Cr    *float64 `json:"cr"`
-	Ctx   int      `json:"ctx"`
-	Img   bool     `json:"img"`
-	Tools bool     `json:"tools"`
-}
-
-// loadCandidates reads the fixture into candidates.
-func loadCandidates(t *testing.T) []Candidate {
-	t.Helper()
-	raw, err := os.ReadFile("testdata/candidates.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var rows []row
-	if err := json.Unmarshal(raw, &rows); err != nil {
-		t.Fatal(err)
-	}
-	cands := make([]Candidate, 0, len(rows))
-	for _, r := range rows {
-		c := Candidate{
-			ID:              r.ID,
-			Open:            r.Open,
-			Intelligence:    r.I,
-			Coding:          r.C,
-			Agentic:         r.A,
-			PromptPrice:     r.Pi,
-			CompletionPrice: r.Po,
-			Context:         r.Ctx,
-			Images:          r.Img,
-			Tools:           r.Tools,
-		}
-		if r.Cr != nil {
-			c.CacheReadPrice = *r.Cr
-			c.HasCacheRead = true
-		}
-		cands = append(cands, c)
-	}
-	return cands
-}
-
-// model builds a candidate that can sit any seat: every index at 100, tools
-// and images, a 200k window, and a published cache price.
-func model(id string) Candidate {
-	return Candidate{
-		ID:              id,
-		Open:            true,
-		Intelligence:    100,
-		Coding:          100,
-		Agentic:         100,
-		PromptPrice:     1,
-		CompletionPrice: 4,
-		CacheReadPrice:  0.1,
-		HasCacheRead:    true,
-		Context:         200_000,
-		Images:          true,
-		Tools:           true,
-	}
-}
-
-// donors builds n fully measured candidates that can sit no seat — a window
-// too small for any of them — so they feed the estimates and the ceilings
-// and nothing else.
-func donors(prefix string, n int) []Candidate {
-	rows := make([]Candidate, 0, n)
-	for i := range n {
-		d := model(fmt.Sprintf("%s/d%d", prefix, i))
-		d.Context = 1000
-		rows = append(rows, d)
-	}
-	return rows
-}
-
-// wantCrew checks a pick against its worker|high|mastermind line.
-func wantCrew(t *testing.T, name string, got Crew, want string) {
-	t.Helper()
-	line := got.Worker + "|" + got.High + "|" + got.Mastermind
-	if line != want {
-		t.Fatalf("%s = %s, want %s", name, line, want)
-	}
-}
-
-// The fixture's front is a fixed property of its rows: seven crews in the
-// open family, eighteen in all, and these are the picks each front reads.
-// The all-family balanced crew is where money stops buying quality — a bill
-// of 0.590 at quality 95.4.
-func TestPresetsReadTheFixtureFront(t *testing.T) {
-	cands := loadCandidates(t)
-	shapes := DefaultShapes()
-
-	open := Front(cands, shapes, Open)
-	if len(open) != 7 {
-		t.Fatalf("open front holds %d crews, want 7", len(open))
-	}
-	frugal, balanced, max := Presets(open)
-	wantCrew(t, "open frugal", frugal, "deepseek/deepseek-v4-flash-0731|z-ai/glm-5.3-flash|z-ai/glm-5.3-flash")
-	wantCrew(t, "open balanced", balanced, "z-ai/glm-5.3-flash|moonshotai/kimi-k3|z-ai/glm-5.3")
-	wantCrew(t, "open max", max, "z-ai/glm-5.3|moonshotai/kimi-k3|z-ai/glm-5.3")
-
-	all := Front(cands, shapes, All)
-	if len(all) != 18 {
-		t.Fatalf("all front holds %d crews, want 18", len(all))
-	}
-	frugal, balanced, max = Presets(all)
-	wantCrew(t, "all frugal", frugal, "z-ai/glm-5.3-flash|google/gemini-3.8-flash|z-ai/glm-5.3-flash")
-	wantCrew(t, "all balanced", balanced, "z-ai/glm-5.3-flash|anthropic/claude-fable-5.1|anthropic/claude-fable-5.1")
-	wantCrew(t, "all max", max, "anthropic/claude-fable-5.1|openai/gpt-6-astra|anthropic/claude-fable-5.1")
-	if math.Abs(balanced.Bill-0.590) > 0.005 {
-		t.Fatalf("all balanced bill = %f, want about 0.590", balanced.Bill)
-	}
-	if math.Abs(balanced.Quality-95.4) > 0.05 {
-		t.Fatalf("all balanced quality = %f, want about 95.4", balanced.Quality)
-	}
-}
-
-// The high seat sees the same work the worker does, so a crew never draws it
-// from the worker's own vendor. Every crew on both fixture fronts holds
-// that line, and a pool that cannot field two vendors fields no crew at all.
-func TestTheHighSeatNeverSharesAVendorWithTheWorker(t *testing.T) {
-	cands := loadCandidates(t)
-	for _, fam := range []Family{Open, All} {
-		for _, crew := range Front(cands, DefaultShapes(), fam) {
-			if vendor(crew.Worker) == vendor(crew.High) {
-				t.Fatalf("worker %s and high %s share a vendor", crew.Worker, crew.High)
-			}
-		}
-	}
-
-	oneVendor := []Candidate{model("one/first"), model("one/second")}
-	if front := Front(oneVendor, DefaultShapes(), All); len(front) != 0 {
-		t.Fatalf("a one-vendor pool fielded %d crews, want none", len(front))
-	}
-}
-
-// The floor keeps a seat's running to candidates that can do the job: a
-// model whose quality falls below Floor of the seat's best in the family is
-// not cheap and never reaches a crew. The boundary is inclusive — a
-// candidate sitting exactly on the floor runs, and at a tenth of the price
-// of anything above it, it runs first.
-func TestTheFloorDropsAModelThatCannotDoTheJob(t *testing.T) {
-	pool := []Candidate{model("a/m"), model("c/h")}
-
-	// Cheap enough to be every crew's frugal worker, and short one index:
-	// 70 of the worker seat's 100, 76 of the mastermind's, and ineligible
-	// for the high seat, which needs images.
-	cheap := model("b/w")
-	cheap.Agentic = 40
-	cheap.Images = false
-	cheap.PromptPrice = 0.01
-	cheap.CompletionPrice = 0.02
-	cheap.HasCacheRead = false
-	pool = append(pool, cheap)
-
-	// Exactly on the worker seat's floor: 80 of 100.
-	edge := model("e/b")
-	edge.Agentic = 60
-	edge.PromptPrice = 0.02
-	edge.CompletionPrice = 0.04
-	edge.HasCacheRead = false
-	pool = append(pool, edge)
-
-	front := Front(pool, DefaultShapes(), All)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	frugal, _, _ := Presets(front)
-	if frugal.Worker != "e/b" {
-		t.Fatalf("frugal worker = %s, want the on-floor candidate e/b", frugal.Worker)
-	}
-	for _, crew := range front {
-		for _, id := range []string{crew.Worker, crew.High, crew.Mastermind} {
-			if id == "b/w" {
-				t.Fatalf("the below-floor model b/w reached a crew: %+v", crew)
-			}
-		}
-	}
-}
-
-// A row carrying none of its three indexes, or priced at zero, is not a
-// candidate at all: it never reaches a seat and it raises no ceiling. Both
-// rules bite where the floor cannot — a free model would clear any floor,
-// and a bare row carries no index to estimate from.
-func TestARowWithNoIndexesAtAllOrNoPriceIsNoCandidate(t *testing.T) {
-	good := []Candidate{model("a/m"), model("c/h")}
-	good[1].Intelligence = 90
-	good[1].PromptPrice = 2
-	good[1].CompletionPrice = 8
-	good[1].CacheReadPrice = 0.2
-
-	bare := model("d/x")
-	bare.Intelligence = 0
-	bare.Coding = 0
-	bare.Agentic = 0
-	bare.PromptPrice = 0.01
-	bare.CompletionPrice = 0.02
-	bare.HasCacheRead = false
-
-	free := model("e/y")
-	free.PromptPrice = 0
-
-	pool := append(slices.Clone(good), bare, free)
-	front := Front(pool, DefaultShapes(), All)
-	for _, crew := range front {
-		for _, id := range []string{crew.Worker, crew.High, crew.Mastermind} {
-			if id == "d/x" || id == "e/y" {
-				t.Fatalf("a non-candidate row reached a crew: %+v", crew)
-			}
-		}
-	}
-	// The non-candidate rows leave the real candidates' front exactly what
-	// it was without them.
-	if want := Front(good, DefaultShapes(), All); !slices.Equal(front, want) {
-		t.Fatalf("the non-candidate rows moved the front:\n got %+v\nwant %+v", front, want)
-	}
-}
-
-// A model publishing only its intelligence index — a release scored in
-// stages — is scored on it, with the coding and agentic indexes estimated
-// from the donors, and at a hundredth of the price it takes the worker seat.
-func TestAModelWithOnlyAnIntelligenceIndexIsChosen(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h")}
-	newRelease := model("b/x")
-	newRelease.Coding = 0
-	newRelease.Agentic = 0
-	newRelease.PromptPrice = 0.01
-	newRelease.CompletionPrice = 0.02
-	newRelease.HasCacheRead = false
-	pool = append(pool, newRelease)
-	pool = append(pool, donors("v", 3)...)
-
-	front := Front(pool, DefaultShapes(), All)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	frugal, _, _ := Presets(front)
-	if frugal.Worker != "b/x" {
-		t.Fatalf("frugal worker = %s, want the partially scored b/x", frugal.Worker)
-	}
-	want := [3][3]bool{{false, true, true}, {}, {false, true, true}}
-	if frugal.Estimated != want {
-		t.Fatalf("the b/x crew's Estimated = %v, want %v", frugal.Estimated, want)
-	}
-}
-
-// A model publishing only its coding index — many an older model — is
-// scored on it, with the intelligence and agentic indexes estimated, and at
-// a hundredth of the price it takes the worker seat too.
-func TestAModelWithOnlyACodingIndexIsChosen(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h")}
-	older := model("b/x")
-	older.Intelligence = 0
-	older.Agentic = 0
-	older.PromptPrice = 0.01
-	older.CompletionPrice = 0.02
-	older.HasCacheRead = false
-	pool = append(pool, older)
-	pool = append(pool, donors("v", 3)...)
-
-	front := Front(pool, DefaultShapes(), All)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	frugal, _, _ := Presets(front)
-	if frugal.Worker != "b/x" {
-		t.Fatalf("frugal worker = %s, want the partially scored b/x", frugal.Worker)
-	}
-	want := [3][3]bool{{true, false, true}, {}, {true, false, true}}
-	if frugal.Estimated != want {
-		t.Fatalf("the b/x crew's Estimated = %v, want %v", frugal.Estimated, want)
-	}
-}
-
-// The donor estimate is the median of the missing index over the present
-// one among the donors carrying both — not the mean, which the far-out
-// fourth donor drags away — and the rows missing either index of the pair
-// never donate. The row missing its intelligence index still raises the
-// coding ceiling with its own 400.
-func TestTheDonorEstimateIsTheMedianRatio(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{0, 1, 0}}
-	pool := []Candidate{
-		{ID: "a/d1", Intelligence: 10, Coding: 10, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d2", Intelligence: 10, Coding: 20, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d3", Intelligence: 10, Coding: 30, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d4", Intelligence: 10, Coding: 300, Agentic: 10, PromptPrice: 1},
-		{ID: "b/noc", Intelligence: 10, Agentic: 10, PromptPrice: 1},
-		{ID: "b/noi", Coding: 400, Agentic: 10, PromptPrice: 1},
-	}
-	x := Candidate{ID: "c/x", Intelligence: 10, PromptPrice: 1}
-
-	// The donors' coding over intelligence ratios run 1, 2, 3, 30: the
-	// median reads 2.5 and the estimate 25 of a 400 ceiling, where the mean
-	// would read 9 and the estimate 90.
-	if got := SeatQuality(x, shape, pool); got != 6.25 {
-		t.Fatalf("SeatQuality on the median estimate = %v, want 6.25", got)
-	}
-}
-
-// With fewer than three donors carrying a pair, the estimate falls back to
-// equal standing — the missing index read at the present one's share of
-// the pool's ceilings — not to the median of two donors, and not to
-// exclusion.
-func TestFewerThanThreeDonorsEstimatesByEqualStanding(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{0, 1, 0}}
-	pool := []Candidate{
-		{ID: "a/d1", Intelligence: 100, Coding: 50, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d2", Intelligence: 50, Coding: 100, Agentic: 10, PromptPrice: 1},
-	}
-	x := Candidate{ID: "b/x", Intelligence: 80, PromptPrice: 1}
-
-	// Equal standing reads x's coding at x's share of the intelligence
-	// ceiling, 80 of 100; the two donors' median would read 100.
-	if got := SeatQuality(x, shape, pool); got != 80 {
-		t.Fatalf("SeatQuality on equal standing = %v, want 80", got)
-	}
-}
-
-// An estimate never crosses the pool's largest measured value of its
-// index: the donors' coding over intelligence median runs 20, and 50 times
-// that would read 1000 of a 300 ceiling.
-func TestAnEstimateIsCappedAtTheLargestMeasuredIndex(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{0, 1, 0}}
-	pool := []Candidate{
-		{ID: "a/d1", Intelligence: 10, Coding: 100, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d2", Intelligence: 10, Coding: 200, Agentic: 10, PromptPrice: 1},
-		{ID: "a/d3", Intelligence: 10, Coding: 300, Agentic: 10, PromptPrice: 1},
-	}
-	x := Candidate{ID: "b/x", Intelligence: 50, PromptPrice: 1}
-
-	if got := SeatQuality(x, shape, pool); got != 100 {
-		t.Fatalf("SeatQuality on the capped estimate = %v, want 100", got)
-	}
-}
-
-// The estimate is never silent: the crew says, for the model in each seat,
-// which of its three indexes were scored by estimate and which measured.
-// The worker publishes only its intelligence index and the mastermind only
-// its coding one; the high seat is measured throughout.
-func TestTheResultMarksEstimatedIndexes(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h")}
-	worker := model("b/x")
-	worker.Coding = 0
-	worker.Agentic = 0
-	worker.Images = false
-	worker.PromptPrice = 0.01
-	worker.CompletionPrice = 0.02
-	worker.HasCacheRead = false
-	mind := model("d/m")
-	mind.Intelligence = 0
-	mind.Agentic = 0
-	mind.Tools = false
-	mind.PromptPrice = 0.005
-	mind.CompletionPrice = 0.01
-	mind.HasCacheRead = false
-	pool = append(pool, worker, mind)
-	pool = append(pool, donors("v", 3)...)
-
-	front := Front(pool, DefaultShapes(), All)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	frugal, _, _ := Presets(front)
-	if frugal.Worker != "b/x" || frugal.Mastermind != "d/m" {
-		t.Fatalf("frugal = %s|%s|%s, want b/x on the worker seat and d/m on the mastermind's", frugal.Worker, frugal.High, frugal.Mastermind)
-	}
-	want := [3][3]bool{{false, true, true}, {}, {true, false, true}}
-	if frugal.Estimated != want {
-		t.Fatalf("the crew's Estimated = %v, want %v", frugal.Estimated, want)
-	}
-}
-
-// Two candidates for a seat otherwise tied on quality and cost run to the
-// one with fewer estimated indexes — even when its id reads later, and
-// whichever way round the pool arrives.
-func TestATieOnQualityAndCostRunsToFewerEstimatedIndexes(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h")}
-	// Twins for the mastermind seat, identical in every number the picker
-	// reads, but aaa runs on two estimated indexes and zzz on none.
-	aaa := model("aaa/two")
-	aaa.Intelligence = 0
-	aaa.Coding = 80
-	aaa.Agentic = 0
-	aaa.Tools = false
-	aaa.Images = false
-	aaa.PromptPrice = 0.1
-	aaa.CompletionPrice = 0.2
-	aaa.HasCacheRead = false
-	zzz := aaa
-	zzz.ID = "zzz/one"
-	zzz.Intelligence = 80
-	zzz.Agentic = 80
-	pool = append(pool, aaa, zzz)
-	pool = append(pool, donors("v", 3)...)
-
-	front := Front(pool, DefaultShapes(), All)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	if front[0].Mastermind != "zzz/one" {
-		t.Fatalf("a tie went to the estimated twin: %+v", front[0])
-	}
-	for _, crew := range front {
-		if crew.Mastermind == "aaa/two" {
-			t.Fatalf("the estimated twin survived its tie: %+v", crew)
-		}
-	}
-
-	reversed := slices.Clone(pool)
-	slices.Reverse(reversed)
-	if two := Front(reversed, DefaultShapes(), All); !slices.Equal(front, two) {
-		t.Fatal("the tie broke differently when the pool arrived reversed")
-	}
-}
-
-// Estimates, caps and ties read the same whatever order the candidates
-// arrive in: a pool of partially published models gives the same front
-// shuffled as it does in hand order.
-func TestPartialCandidatesGiveTheSameFrontInAnyOrder(t *testing.T) {
-	newRelease := model("b/new")
-	newRelease.Coding = 0
-	newRelease.Agentic = 0
-	newRelease.PromptPrice = 0.01
-	newRelease.CompletionPrice = 0.02
-	newRelease.HasCacheRead = false
-	older := model("d/old")
-	older.Intelligence = 0
-	older.Agentic = 0
-	older.Tools = false
-	staged := model("e/staged")
-	staged.Agentic = 0
-	pool := []Candidate{model("a/w"), model("c/h"), newRelease, older, staged}
-	pool = append(pool, donors("v", 3)...)
-
-	one := Front(pool, DefaultShapes(), All)
-	if len(one) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	if one[0].Estimated == ([3][3]bool{}) {
-		t.Fatal("the cheapest crew carries no estimated index; the partial candidates never reached it")
-	}
-	reversed := slices.Clone(pool)
-	slices.Reverse(reversed)
-	if two := Front(reversed, DefaultShapes(), All); !slices.Equal(one, two) {
-		t.Fatal("the front changed when the partial candidates arrived reversed")
-	}
-	rotated := append(slices.Clone(pool[3:]), pool[:3]...)
-	if three := Front(rotated, DefaultShapes(), All); !slices.Equal(one, three) {
-		t.Fatal("the front changed when the pool arrived rotated")
-	}
-}
-
-// An input with no index missing picks on measurements alone: the fixture's
-// partially published row left out, both fronts hold the same sizes and
-// the same frugal, balanced and max picks the whole fixture holds, and no
-// estimated flag is set anywhere — the partial row never raised a ceiling,
-// so leaving it out moves nothing measured.
-func TestNothingMissingLeavesEveryPickUnchanged(t *testing.T) {
-	cands := loadCandidates(t)
-	var full []Candidate
-	for _, c := range cands {
-		if c.Intelligence > 0 && c.Coding > 0 && c.Agentic > 0 {
-			full = append(full, c)
-		}
-	}
-	shapes := DefaultShapes()
-
-	open := Front(full, shapes, Open)
-	if len(open) != 7 {
-		t.Fatalf("the full open front holds %d crews, want 7", len(open))
-	}
-	frugal, balanced, max := Presets(open)
-	wantCrew(t, "open frugal", frugal, "deepseek/deepseek-v4-flash-0731|z-ai/glm-5.3-flash|z-ai/glm-5.3-flash")
-	wantCrew(t, "open balanced", balanced, "z-ai/glm-5.3-flash|moonshotai/kimi-k3|z-ai/glm-5.3")
-	wantCrew(t, "open max", max, "z-ai/glm-5.3|moonshotai/kimi-k3|z-ai/glm-5.3")
-
-	all := Front(full, shapes, All)
-	if len(all) != 18 {
-		t.Fatalf("the full all front holds %d crews, want 18", len(all))
-	}
-	frugal, balanced, max = Presets(all)
-	wantCrew(t, "all frugal", frugal, "z-ai/glm-5.3-flash|google/gemini-3.8-flash|z-ai/glm-5.3-flash")
-	wantCrew(t, "all balanced", balanced, "z-ai/glm-5.3-flash|anthropic/claude-fable-5.1|anthropic/claude-fable-5.1")
-	wantCrew(t, "all max", max, "anthropic/claude-fable-5.1|openai/gpt-6-astra|anthropic/claude-fable-5.1")
-	if math.Abs(balanced.Bill-0.590) > 0.005 {
-		t.Fatalf("all balanced bill = %f, want about 0.590", balanced.Bill)
-	}
-	if math.Abs(balanced.Quality-95.4) > 0.05 {
-		t.Fatalf("all balanced quality = %f, want about 95.4", balanced.Quality)
-	}
-	for _, front := range [][]Crew{open, all} {
-		for _, crew := range front {
-			if crew.Estimated != ([3][3]bool{}) {
-				t.Fatalf("a fully measured pool raised an estimated flag: %+v", crew)
-			}
-		}
-	}
-}
-
-// The knob runs from one end of the front to the other: at 0 the budget is
-// the cheapest bill and the pick is frugal, at 1 it is the dearest and the
-// pick is max.
-func TestAtKnobAtTheEndsReadsFrugalAndMax(t *testing.T) {
-	cands := loadCandidates(t)
-	for _, fam := range []Family{Open, All} {
-		front := Front(cands, DefaultShapes(), fam)
-		frugal, _, max := Presets(front)
-		if got := AtKnob(front, 0); got != frugal {
-			t.Fatalf("AtKnob at 0 = %+v, want the frugal %+v", got, frugal)
-		}
-		if got := AtKnob(front, 1); got != max {
-			t.Fatalf("AtKnob at 1 = %+v, want the max %+v", got, max)
-		}
-	}
-}
-
-// The front is a property of the candidates, not of their order: the running
-// for each seat is read in id order, so the same list gives the same front
-// however it arrives.
-func TestTheSameCandidatesGiveTheSameFrontInAnyOrder(t *testing.T) {
-	cands := loadCandidates(t)
-	shapes := DefaultShapes()
-	one := Front(cands, shapes, All)
-
-	reversed := slices.Clone(cands)
-	slices.Reverse(reversed)
-	if two := Front(reversed, shapes, All); !slices.Equal(one, two) {
-		t.Fatal("the front changed when the candidates arrived reversed")
-	}
-}
-
-// Two crews that tie in (bill, quality) are one point on the front, and the
-// point keeps the crew whose ids read first — worker, then high, then
-// mastermind — whichever way round the pool arrived.
-func TestTiesInBillAndQualityBreakInIdOrder(t *testing.T) {
-	// Two candidates identical in every way but the id, and able to sit
-	// only the mastermind seat: every crew one finishes ties with the crew
-	// the other finishes.
-	aaa := model("aaa/x")
-	aaa.Tools = false
-	aaa.Images = false
-	aaa.PromptPrice = 0.1
-	aaa.CompletionPrice = 0.2
-	aaa.HasCacheRead = false
-	bbb := aaa
-	bbb.ID = "bbb/x"
-
-	pool := []Candidate{model("a/m"), model("c/h"), aaa, bbb}
-	one := Front(pool, DefaultShapes(), All)
-	if len(one) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	for _, crew := range one {
-		if crew.Mastermind != "aaa/x" {
-			t.Fatalf("a tie went to the wrong twin: %+v", crew)
-		}
-	}
-
-	reversed := slices.Clone(pool)
-	slices.Reverse(reversed)
-	if two := Front(reversed, DefaultShapes(), All); !slices.Equal(one, two) {
-		t.Fatal("the tie broke differently when the pool arrived reversed")
-	}
-}
-
-// The seat's cost is its token mix priced: the prompt price blended with the
-// cache-read price by the cache share, and the completion price spread over
-// the input-to-output ratio. A model that publishes no cache-read price pays
-// the prompt price on the cache share too.
-func TestSeatCostPricesTheTokenMix(t *testing.T) {
-	shape := SeatShape{InOut: 2, CacheShare: 0.5}
-	published := Candidate{PromptPrice: 2, CompletionPrice: 8, CacheReadPrice: 0.5, HasCacheRead: true}
-	if got := SeatCost(published, shape); got != 5.25 {
-		t.Fatalf("SeatCost with a published cache price = %f, want 5.25", got)
-	}
-	unpublished := Candidate{PromptPrice: 2, CompletionPrice: 8}
-	if got := SeatCost(unpublished, shape); got != 6 {
-		t.Fatalf("SeatCost with no published cache price = %f, want 6", got)
-	}
-}
-
-// Quality reads each index against the pool's best for that index, so the
-// same candidate scores lower in a stronger pool. A row that is not a
-// candidate scores nothing, and so does any row against a pool with no
-// candidates to raise a scale.
-func TestSeatQualityReadsAgainstThePoolsBest(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{0.25, 0.25, 0.5}}
-	pool := []Candidate{
-		{ID: "best", Intelligence: 100, Coding: 100, Agentic: 100, PromptPrice: 1},
-		{ID: "half", Intelligence: 50, Coding: 100, Agentic: 100, PromptPrice: 1},
-	}
-	if got := SeatQuality(pool[0], shape, pool); got != 100 {
-		t.Fatalf("the pool's best scored %f, want 100", got)
-	}
-	if got := SeatQuality(pool[1], shape, pool); got != 87.5 {
-		t.Fatalf("the half scored %f, want 87.5", got)
-	}
-
-	stronger := append(slices.Clone(pool),
-		Candidate{ID: "top", Intelligence: 200, Coding: 100, Agentic: 100, PromptPrice: 1})
-	if got := SeatQuality(pool[1], shape, stronger); got != 81.25 {
-		t.Fatalf("the half scored %f against a stronger pool, want 81.25", got)
-	}
-
-	blank := Candidate{ID: "blank", Coding: 0, PromptPrice: 1}
-	if got := SeatQuality(blank, shape, pool); got != 0 {
-		t.Fatalf("a row missing an index scored %f, want 0", got)
-	}
-	if got := SeatQuality(pool[0], shape, []Candidate{blank}); got != 0 {
-		t.Fatalf("a pool with no candidates scored %f, want 0", got)
-	}
-}
-
-// A pool's own rating for a seat moves that seat's quality towards the
-// rating's mean, and the more observations back it the farther it moves: a
-// rating with a large count across a seat whose catalog quality is 100 and
-// whose pool mean is 50 lands somewhere between the two.
-func TestALargeRatingMovesASeatTowardsThePoolMean(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{1, 0, 0}}
-	pool := []Candidate{model("m")}
-	if base := SeatQuality(pool[0], shape, pool); base != 100 {
-		t.Fatalf("the catalog quality is %f, want 100", base)
-	}
-	prior := Prior{Worker: {"m": {Mean: 50, N: 1000}}}
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, prior); got <= 50 || got >= 100 {
-		t.Fatalf("a large rating scored %f, want between the pool mean 50 and the catalog 100", got)
-	}
-}
-
-// The blend carries the rating and the catalog at equal weight at exactly
-// PriorWeightAt observations, so the seat reads the midpoint of the two; a
-// seat the prior never rates, and a rating with no observations, keep the
-// catalog quality.
-func TestTheBlendAtTheRatingWeightIsTheMidpoint(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{1, 0, 0}}
-	pool := []Candidate{model("m")}
-
-	half := Prior{Worker: {"m": {Mean: 40, N: PriorWeightAt}}}
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, half); got != 70 {
-		t.Fatalf("the blend at N = PriorWeightAt scored %f, want the midpoint 70", got)
-	}
-	unrated := Prior{Worker: {"other": {Mean: 40, N: 1000}}}
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, unrated); got != 100 {
-		t.Fatalf("a seat the prior never rated scored %f, want the catalog 100", got)
-	}
-	empty := Prior{Worker: {"m": {Mean: 40, N: 0}}}
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, empty); got != 100 {
-		t.Fatalf("a rating with no observations scored %f, want the catalog 100", got)
-	}
-}
-
-// A prior is read from role-worded cells: a role that names no seat and a
-// count below min_installs are both ignored, and only a role that names a
-// seat with enough observations behind it becomes a rating.
-func TestPriorFromCellsIgnoresACountBelowMinInstalls(t *testing.T) {
-	prior := PriorFromCells([]Cell{
-		{Role: "worker", Model: "a/kept", Mean: 80, N: 40},
-		{Role: "worker", Model: "b/dropped", Mean: 90, N: 10},
-		{Role: "engineer", Model: "c/ignored", Mean: 95, N: 100},
-	}, 30, nil)
-	if len(prior) != 1 || len(prior[Worker]) != 1 {
-		t.Fatalf("prior = %v, want one worker rating", prior)
-	}
-	if _, ok := prior[Worker]["a/kept"]; !ok {
-		t.Fatalf("a rating at the floor was dropped: %v", prior)
-	}
-	if _, ok := prior[Worker]["b/dropped"]; ok {
-		t.Fatalf("a rating below min_installs survived: %v", prior)
-	}
-}
-
-// The result says which seats a pool's rating entered: a seat whose model the
-// prior rated reads measured, and a seat it did not — here the mastermind,
-// which no rating names — does not.
-func TestMeasuredIsSetOnlyOnTheSeatsThePriorTouched(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h"), model("b/m")}
-	prior := Prior{
-		Worker: {"a/w": {Mean: 100, N: 100}},
-		High:   {"b/m": {Mean: 100, N: 100}},
-	}
-	front := FrontWith(pool, DefaultShapes(), All, prior)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	wantCrew(t, "frugal", front[0], "a/w|b/m|a/w")
-	if front[0].Measured != ([3]bool{true, true, false}) {
-		t.Fatalf("Measured = %v, want the worker and high seats alone", front[0].Measured)
-	}
-}
-
-// A prior changes quality alone: every bill a crew is given is its seats'
-// token mixes priced, exactly as it is without a prior.
-func TestAPriorNeverChangesTheBill(t *testing.T) {
-	pool := []Candidate{model("a/w"), model("c/h"), model("b/m")}
-	shapes := DefaultShapes()
-	prior := Prior{
-		Worker: {"a/w": {Mean: 20, N: 10_000}},
-		High:   {"c/h": {Mean: 140, N: 10_000}},
-	}
-	front := FrontWith(pool, shapes, All, prior)
-	if len(front) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	for _, crew := range front {
-		want := 0.0
-		for _, seat := range []struct {
-			model string
-			seat  Seat
-		}{{crew.Worker, Worker}, {crew.High, High}, {crew.Mastermind, Mastermind}} {
-			for _, c := range pool {
-				if c.ID == seat.model {
-					want += shapes[seat.seat].Volume * SeatCost(c, shapes[seat.seat])
-				}
-			}
-		}
-		if math.Abs(crew.Bill-want) > 1e-9 {
-			t.Fatalf("crew %s|%s|%s bill = %f, want its seats' priced mix %f",
-				crew.Worker, crew.High, crew.Mastermind, crew.Bill, want)
-		}
-	}
-}
-
-// A prior is a property of the candidates, not of their order: with a rating
-// present the same pool gives the same front shuffled, rotated and reversed.
-func TestAPriorKeepsTheFrontTheSameInAnyOrder(t *testing.T) {
-	cands := loadCandidates(t)
-	prior := Prior{Worker: {"z-ai/glm-5.3": {Mean: 90, N: 100}}}
-	one := FrontWith(cands, DefaultShapes(), All, prior)
-	if len(one) == 0 {
-		t.Fatal("the pool must field crews")
-	}
-	reversed := slices.Clone(cands)
-	slices.Reverse(reversed)
-	if two := FrontWith(reversed, DefaultShapes(), All, prior); !slices.Equal(one, two) {
-		t.Fatal("the front changed when the candidates arrived reversed")
-	}
-	rotated := append(slices.Clone(cands[3:]), cands[:3]...)
-	if three := FrontWith(rotated, DefaultShapes(), All, prior); !slices.Equal(one, three) {
-		t.Fatal("the front changed when the pool arrived rotated")
-	}
-}
-
-// An alias resolved through canonical meets its candidate: a cell spelling a
-// model's alias lands on the candidate's canonical id, so the rating reaches
-// it, while the same cell with no canonical step lands on the alias and
-// touches nothing.
-func TestAnAliasResolvedThroughCanonicalMeetsItsCandidate(t *testing.T) {
-	shape := SeatShape{Weights: [3]float64{1, 0, 0}}
-	pool := []Candidate{model("z-ai/glm-5.3")}
-	canonical := func(id string) string {
-		if id == "glm-5.3" {
-			return "z-ai/glm-5.3"
-		}
-		return id
-	}
-	cell := Cell{Role: "worker", Model: "glm-5.3", Mean: 40, N: PriorWeightAt}
-	resolved := PriorFromCells([]Cell{cell}, 5, canonical)
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, resolved); got != 70 {
-		t.Fatalf("the aliased rating scored %f, want the midpoint 70", got)
-	}
-	unresolved := PriorFromCells([]Cell{cell}, 5, nil)
-	if got := SeatQualityWith(pool[0], shape, pool, Worker, unresolved); got != 100 {
-		t.Fatalf("the unresolved alias scored %f, want the catalog 100 untouched", got)
-	}
-}
-
-// Two priors fold into one: a rating both hold for a model is weighted by the
-// counts behind it, a rating either holds alone is carried whole, and a nil on
-// either side is the other side.
-func TestMergePriorsFoldsTwoPriorsByObservationCount(t *testing.T) {
-	if got := MergePriors(nil, nil); got != nil {
-		t.Fatalf("two nils folded to %v, want nil", got)
-	}
-	a := Prior{Worker: {"a/one": {Mean: 80, N: 20}}}
-	if got := MergePriors(a, nil); got == nil || got[Worker]["a/one"].N != 20 {
-		t.Fatalf("a nil on one side is not the other: %v", got)
-	}
-	b := Prior{High: {"b/two": {Mean: 60, N: 5}}}
-	if got := MergePriors(nil, b); got == nil || got[High]["b/two"].N != 5 {
-		t.Fatalf("a nil on one side is not the other: %v", got)
-	}
-
-	// A model only one prior names is carried whole, in either order.
-	onlyA := Prior{Worker: {"a/only": {Mean: 70, N: 4}}}
-	onlyB := Prior{Worker: {"b/only": {Mean: 90, N: 6}}}
-	got := MergePriors(onlyA, onlyB)
-	if len(got[Worker]) != 2 {
-		t.Fatalf("no shared key folded to %v, want the union", got)
-	}
-	if r := got[Worker]["a/only"]; r.Mean != 70 || r.N != 4 {
-		t.Fatalf("a carried rating moved: %v", r)
-	}
-	if r := got[Worker]["b/only"]; r.Mean != 90 || r.N != 6 {
-		t.Fatalf("a carried rating moved: %v", r)
-	}
-
-	// A model both name: the counts add and the mean is the mean of the means
-	// weighted by them — (10*50 + 30*90) / 40 = 80.
-	sharedA := Prior{Worker: {"c/both": {Mean: 50, N: 10}}}
-	sharedB := Prior{Worker: {"c/both": {Mean: 90, N: 30}}}
-	if r := MergePriors(sharedA, sharedB)[Worker]["c/both"]; r.Mean != 80 || r.N != 40 {
-		t.Fatalf("a shared rating folded to %v, want mean 80 over 40", r)
-	}
-
-	// The priors given are read and never changed.
-	if r := sharedA[Worker]["c/both"]; r.Mean != 50 || r.N != 10 {
-		t.Fatalf("the merge moved its first prior: %v", r)
-	}
-	if r := sharedB[Worker]["c/both"]; r.Mean != 90 || r.N != 30 {
-		t.Fatalf("the merge moved its second prior: %v", r)
-	}
-}
diff --git a/internal/crewpick/testdata/candidates.json b/internal/crewpick/testdata/candidates.json
deleted file mode 100644
index 493a31a519..0000000000
--- a/internal/crewpick/testdata/candidates.json
+++ /dev/null
@@ -1 +0,0 @@
-[{"id": "inclusionai/ling-3.0-flash-vl", "open": true, "I": 25, "C": 57, "A": 30, "pi": 0.06, "po": 0.18, "cr": 0.012, "ctx": 131072, "img": true, "tools": true, "so": true, "created": 1789056114, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v4.1-flash", "open": true, "I": 39.5, "C": null, "A": null, "pi": 0.3, "po": 1.2, "cr": 0.006, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1789021285, "exp": null, "alias": null}, {"id": "openai/gpt-6-astra", "open": false, "I": 52.8, "C": 76.9, "A": 51.5, "pi": 10.0, "po": 50.0, "cr": 1.0, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1788552838, "exp": null, "alias": null}, {"id": "qwen/qwen3.8-max-0902", "open": false, "I": 45.4, "C": 76.2, "A": 56.1, "pi": 2.0, "po": 6.0, "cr": 0.25, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1788469704, "exp": null, "alias": null}, {"id": "google/gemini-3.8-flash", "open": false, "I": 41.2, "C": 76.3, "A": 41.1, "pi": 0.75, "po": 3.75, "cr": 0.075, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1788362056, "exp": null, "alias": null}, {"id": "anthropic/claude-fable-5.1", "open": false, "I": 53.4, "C": 81.6, "A": 58, "pi": 10.0, "po": 50.0, "cr": 0.25, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1788285838, "exp": null, "alias": null}, {"id": "ibm-granite/granite-4.2-8b", "open": true, "I": 11.8, "C": 22.4, "A": 3.7, "pi": 0.06, "po": 0.25, "cr": 0.015, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1788206780, "exp": null, "alias": null}, {"id": "inclusionai/ling-3.0-flash-fin", "open": false, "I": 23, "C": 55.6, "A": 29.3, "pi": 0.06, "po": 0.18, "cr": 0.012, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1787846290, "exp": null, "alias": null}, {"id": "z-ai/glm-5.3-flash", "open": true, "I": 41.9, "C": 71.5, "A": 51.2, "pi": 0.09, "po": 0.3, "cr": 0.018, "ctx": 1310720, "img": true, "tools": true, "so": true, "created": 1787752741, "exp": null, "alias": null}, {"id": "z-ai/glm-5.3", "open": true, "I": 44.9, "C": 74.8, "A": 53.4, "pi": 1.4, "po": 4.4, "cr": 0.26, "ctx": 1310720, "img": false, "tools": true, "so": true, "created": 1787086655, "exp": null, "alias": null}, {"id": "qwen/qwen3.8-27b", "open": true, "I": 33.9, "C": 68.1, "A": 46.5, "pi": 0.21400000000000002, "po": 2.5500000000000003, "cr": 0.15, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1786722910, "exp": null, "alias": null}, {"id": "google/gemini-3.7-flash", "open": false, "I": 39.4, "C": 76.1, "A": 36.4, "pi": 0.75, "po": 3.75, "cr": 0.075, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1786640581, "exp": null, "alias": null}, {"id": "qwen/qwen3.8-2.4t-a95b", "open": true, "I": 40, "C": 71.9, "A": 50.4, "pi": 2.0, "po": 6.0, "cr": 0.25, "ctx": 1048576, "img": false, "tools": true, "so": true, "created": 1786551702, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v4-pro-0813", "open": true, "I": 36.3, "C": 68.8, "A": 42.3, "pi": 1.32, "po": 3.9600000000000004, "cr": 0.044, "ctx": 1048576, "img": false, "tools": true, "so": true, "created": 1786549364, "exp": null, "alias": null}, {"id": "x-ai/grok-4.6", "open": false, "I": 44.4, "C": 76.8, "A": 53.4, "pi": 2.0, "po": 6.0, "cr": 0.5, "ctx": 500000, "img": true, "tools": true, "so": true, "created": 1786548957, "exp": null, "alias": null}, {"id": "nvidia/nemotron-3.5-lightning", "open": true, "I": 13.6, "C": 26.8, "A": 6.1, "pi": 0.08, "po": 0.19999999999999998, "cr": 0.04, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1786452751, "exp": null, "alias": null}, {"id": "meta/muse-spark-1.2", "open": false, "I": 39.8, "C": 72.2, "A": 44, "pi": 1.25, "po": 4.25, "cr": 0.15, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1785959287, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v4-flash-0731", "open": true, "I": 34.5, "C": 69.1, "A": 41.7, "pi": 0.06, "po": 0.12, "cr": 0.012, "ctx": 1310720, "img": false, "tools": true, "so": true, "created": 1785478908, "exp": null, "alias": null}, {"id": "thinkingmachines/inkling-small", "open": true, "I": 26.1, "C": 52.9, "A": 25, "pi": 0.44999999999999996, "po": 1.2, "cr": 0.09999999999999999, "ctx": 1048576, "img": true, "tools": true, "so": false, "created": 1785443117, "exp": null, "alias": null}, {"id": "anthropic/claude-opus-5", "open": false, "I": 50.7, "C": 78, "A": 56.2, "pi": 5.0, "po": 25.0, "cr": 0.5, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1784912544, "exp": null, "alias": null}, {"id": "inclusionai/ling-3.0-flash", "open": true, "I": 20.6, "C": 50.6, "A": 21, "pi": 0.020999999999999998, "po": 0.063, "cr": 0.004200000000000001, "ctx": 262144, "img": false, "tools": true, "so": false, "created": 1784818580, "exp": null, "alias": null}, {"id": "google/gemini-3.6-flash", "open": false, "I": 34.3, "C": 69.2, "A": 30.2, "pi": 0.75, "po": 3.75, "cr": 0.075, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1784646733, "exp": null, "alias": null}, {"id": "google/gemini-3.5-flash-lite", "open": false, "I": 22.7, "C": 49.3, "A": 15.9, "pi": 0.3, "po": 2.5, "cr": 0.03, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1784646726, "exp": null, "alias": null}, {"id": "meituan/longcat-2.0", "open": true, "I": 19.7, "C": 45.3, "A": 15.9, "pi": 0.3, "po": 1.2, "cr": 0.006, "ctx": 1048756, "img": false, "tools": true, "so": false, "created": 1784554658, "exp": null, "alias": null}, {"id": "thinkingmachines/inkling", "open": true, "I": 25.5, "C": 52.1, "A": 24.3, "pi": 1.0, "po": 4.05, "cr": 0.16999999999999998, "ctx": 1048576, "img": true, "tools": true, "so": false, "created": 1784325956, "exp": null, "alias": null}, {"id": "moonshotai/kimi-k3", "open": true, "I": 43.8, "C": 76.2, "A": 50.6, "pi": 3.0, "po": 15.0, "cr": 0.3, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1784215858, "exp": null, "alias": null}, {"id": "meta/muse-spark-1.1", "open": false, "I": 34.3, "C": 71.3, "A": 27.5, "pi": 1.25, "po": 4.25, "cr": 0.15, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1784215741, "exp": null, "alias": null}, {"id": "openai/gpt-5.6-luna", "open": false, "I": 37.5, "C": 71.4, "A": 42.7, "pi": 0.19999999999999998, "po": 1.2, "cr": 0.02, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1783590864, "exp": null, "alias": null}, {"id": "openai/gpt-5.6-terra", "open": false, "I": 42.3, "C": 76.7, "A": 43.7, "pi": 2.0, "po": 12.0, "cr": 0.19999999999999998, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1783590857, "exp": null, "alias": null}, {"id": "openai/gpt-5.6-sol", "open": false, "I": 47.1, "C": 77.4, "A": 50.5, "pi": 2.0, "po": 10.0, "cr": 0.19999999999999998, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1783590850, "exp": null, "alias": null}, {"id": "x-ai/grok-4.5", "open": false, "I": 39.1, "C": 72.4, "A": 42.1, "pi": 2.0, "po": 6.0, "cr": 0.3, "ctx": 500000, "img": true, "tools": true, "so": true, "created": 1783523154, "exp": null, "alias": null}, {"id": "anthropic/claude-sonnet-5", "open": false, "I": 38.4, "C": 71.5, "A": 44.3, "pi": 2.0, "po": 10.0, "cr": 0.19999999999999998, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1782843083, "exp": null, "alias": null}, {"id": "z-ai/glm-5.2", "open": true, "I": 34, "C": 68.8, "A": 39.4, "pi": 1.4, "po": 4.4, "cr": 0.14, "ctx": 1048576, "img": false, "tools": true, "so": true, "created": 1781631930, "exp": null, "alias": null}, {"id": "moonshotai/kimi-k2.7-code", "open": true, "I": 26.3, "C": 60.8, "A": 22.5, "pi": 0.7062, "po": 3.21, "cr": 0.18, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1781266361, "exp": null, "alias": null}, {"id": "anthropic/claude-fable-5", "open": false, "I": 49.7, "C": 76.5, "A": 51, "pi": 10.0, "po": 50.0, "cr": 1.0, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1781007515, "exp": null, "alias": null}, {"id": "nvidia/nemotron-3-ultra-550b-a55b", "open": true, "I": 23.4, "C": 49.3, "A": 21.7, "pi": 0.625, "po": 3.125, "cr": 0.1875, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1780551208, "exp": null, "alias": null}, {"id": "qwen/qwen3.7-plus", "open": false, "I": 25.8, "C": 55.9, "A": 19.7, "pi": 0.32, "po": 1.28, "cr": 0.064, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1780491783, "exp": null, "alias": null}, {"id": "minimax/minimax-m3", "open": true, "I": 29.6, "C": 58.6, "A": 30.8, "pi": 0.3, "po": 1.2, "cr": 0.06, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1780245374, "exp": null, "alias": null}, {"id": "anthropic/claude-opus-4.8", "open": false, "I": 42, "C": 74.3, "A": 42.6, "pi": 5.0, "po": 25.0, "cr": 0.5, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1779905091, "exp": null, "alias": null}, {"id": "qwen/qwen3.7-max", "open": false, "I": 29.9, "C": 66, "A": 23.9, "pi": 1.475, "po": 4.425, "cr": 0.295, "ctx": 1000000, "img": false, "tools": true, "so": true, "created": 1779376861, "exp": null, "alias": null}, {"id": "google/gemini-3.5-flash", "open": false, "I": 33, "C": 70.1, "A": 27.3, "pi": 1.5, "po": 9.0, "cr": 0.15, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1779193800, "exp": null, "alias": null}, {"id": "x-ai/grok-4.3", "open": false, "I": 25.4, "C": 42.2, "A": 17.2, "pi": 1.25, "po": 2.5, "cr": 0.19999999999999998, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1777591821, "exp": null, "alias": null}, {"id": "mistralai/mistral-medium-3-5", "open": false, "I": 14.9, "C": 46.9, "A": 9.4, "pi": 1.5, "po": 7.5, "cr": null, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1777570439, "exp": null, "alias": null}, {"id": "qwen/qwen3.6-35b-a3b", "open": true, "I": 18.8, "C": 41.9, "A": 15, "pi": 0.09999999999999999, "po": 0.8999999999999999, "cr": 0.049999999999999996, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1777260255, "exp": null, "alias": null}, {"id": "qwen/qwen3.6-27b", "open": true, "I": 21.9, "C": 53.7, "A": 20.1, "pi": 0.3, "po": 2.0, "cr": 0.03, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1777255064, "exp": null, "alias": null}, {"id": "openai/gpt-5.5", "open": false, "I": 38.6, "C": 74.9, "A": 37.3, "pi": 5.0, "po": 30.0, "cr": 0.5, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1777051893, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v4-pro", "open": true, "I": 30.9, "C": 59.4, "A": 27.7, "pi": 1.5999999999999999, "po": 3.1999999999999997, "cr": 0.135, "ctx": 1048576, "img": false, "tools": true, "so": true, "created": 1777000679, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v4-flash", "open": true, "I": 24.8, "C": 52, "A": 27.9, "pi": 0.088606, "po": 0.177212, "cr": 0.017721200000000003, "ctx": 1048576, "img": false, "tools": true, "so": true, "created": 1777000666, "exp": null, "alias": null}, {"id": "tencent/hy3-preview", "open": true, "I": 25.8, "C": 58.8, "A": 25.6, "pi": 0.18, "po": 0.6, "cr": 0.06, "ctx": 262144, "img": false, "tools": true, "so": false, "created": 1776878150, "exp": null, "alias": null}, {"id": "xiaomi/mimo-v2.5-pro", "open": true, "I": 26.4, "C": 60.2, "A": 22.7, "pi": 0.435, "po": 0.87, "cr": 0.0036, "ctx": 1050000, "img": false, "tools": true, "so": true, "created": 1776874273, "exp": null, "alias": null}, {"id": "xiaomi/mimo-v2.5", "open": true, "I": 22.3, "C": 56.8, "A": 17.4, "pi": 0.14, "po": 0.28, "cr": 0.0028, "ctx": 1050000, "img": true, "tools": true, "so": true, "created": 1776874269, "exp": null, "alias": null}, {"id": "moonshotai/kimi-k2.6", "open": true, "I": 27.5, "C": 61.8, "A": 22.1, "pi": 0.95, "po": 4.0, "cr": 0.16, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1776699402, "exp": null, "alias": null}, {"id": "z-ai/glm-5.1", "open": true, "I": 26.4, "C": 55.8, "A": 25.2, "pi": 0.966, "po": 3.036, "cr": 0.1794, "ctx": 204800, "img": false, "tools": true, "so": true, "created": 1775578025, "exp": null, "alias": null}, {"id": "google/gemma-4-31b-it", "open": true, "I": 15.4, "C": 43.4, "A": 6.7, "pi": 0.09, "po": 0.33999999999999997, "cr": 0.049999999999999996, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1775148486, "exp": null, "alias": null}, {"id": "arcee-ai/trinity-large-thinking", "open": true, "I": 10.9, "C": 25.8, "A": 1.2, "pi": 0.25, "po": 0.7999999999999999, "cr": 0.06, "ctx": 262144, "img": false, "tools": true, "so": false, "created": 1775058318, "exp": null, "alias": null}, {"id": "minimax/minimax-m2.7", "open": true, "I": 23.2, "C": 52.6, "A": 16.8, "pi": 0.3, "po": 1.2, "cr": 0.06, "ctx": 204800, "img": false, "tools": true, "so": true, "created": 1773836697, "exp": null, "alias": null}, {"id": "openai/gpt-5.4-nano", "open": false, "I": 21.2, "C": 56.1, "A": 17.7, "pi": 0.19999999999999998, "po": 1.25, "cr": 0.02, "ctx": 400000, "img": true, "tools": true, "so": true, "created": 1773748187, "exp": null, "alias": null}, {"id": "openai/gpt-5.4-mini", "open": false, "I": 24.6, "C": 56.1, "A": 19.7, "pi": 0.75, "po": 4.5, "cr": 0.075, "ctx": 400000, "img": true, "tools": true, "so": true, "created": 1773748178, "exp": null, "alias": null}, {"id": "mistralai/mistral-small-2603", "open": true, "I": 11.5, "C": 26.6, "A": 1.4, "pi": 0.15, "po": 0.6, "cr": 0.015, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1773695685, "exp": null, "alias": null}, {"id": "nvidia/nemotron-3-super-120b-a12b", "open": true, "I": 13.6, "C": 37.7, "A": 4.1, "pi": 0.08, "po": 0.44999999999999996, "cr": null, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1773245239, "exp": null, "alias": null}, {"id": "inception/mercury-2", "open": false, "I": 11.5, "C": 31.1, "A": 4, "pi": 0.25, "po": 0.75, "cr": 0.024999999999999998, "ctx": 128000, "img": false, "tools": true, "so": true, "created": 1772636275, "exp": null, "alias": null}, {"id": "google/gemini-3.1-flash-lite-preview", "open": false, "I": 16, "C": 34.7, "A": 3.2, "pi": 0.25, "po": 1.5, "cr": 0.024999999999999998, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1772512673, "exp": null, "alias": null}, {"id": "qwen/qwen3.5-122b-a10b", "open": true, "I": 16.2, "C": 45.7, "A": 9.6, "pi": 0.26, "po": 2.08, "cr": null, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1772053789, "exp": null, "alias": null}, {"id": "google/gemini-3.1-pro-preview", "open": false, "I": 30.4, "C": 68.8, "A": 10.3, "pi": 2.0, "po": 12.0, "cr": 0.19999999999999998, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1771509627, "exp": null, "alias": null}, {"id": "anthropic/claude-sonnet-4.6", "open": false, "I": 30.5, "C": 63, "A": 33.1, "pi": 3.0, "po": 15.0, "cr": 0.3, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1771342990, "exp": null, "alias": null}, {"id": "qwen/qwen3.5-397b-a17b", "open": true, "I": 19.1, "C": 48.2, "A": 10.6, "pi": 0.55, "po": 3.5, "cr": 0.22499999999999998, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1771223018, "exp": null, "alias": null}, {"id": "qwen/qwen3-coder-next", "open": true, "I": 10.1, "C": 36.2, "A": 3.6, "pi": 0.12, "po": 0.7999999999999999, "cr": 0.07, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1770164101, "exp": null, "alias": null}, {"id": "upstage/solar-pro-3", "open": false, "I": 7.8, "C": 16.2, "A": 1.4, "pi": 0.15, "po": 0.6, "cr": 0.015, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1769481200, "exp": null, "alias": null}, {"id": "nvidia/nemotron-3-nano-30b-a3b", "open": true, "I": 8.9, "C": 14.4, "A": 1, "pi": 0.06, "po": 0.24, "cr": null, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1765731275, "exp": null, "alias": null}, {"id": "mistralai/devstral-2512", "open": true, "I": 9.4, "C": 31.3, "A": 4.9, "pi": 0.39999999999999997, "po": 2.0, "cr": 0.04, "ctx": 262144, "img": false, "tools": true, "so": true, "created": 1765285419, "exp": null, "alias": null}, {"id": "mistralai/ministral-14b-2512", "open": true, "I": 6, "C": 14.4, "A": 1.1, "pi": 0.19999999999999998, "po": 0.19999999999999998, "cr": 0.02, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1764681735, "exp": null, "alias": null}, {"id": "mistralai/ministral-8b-2512", "open": true, "I": 5.5, "C": 9.7, "A": 0.6, "pi": 0.15, "po": 0.15, "cr": 0.015, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1764681654, "exp": null, "alias": null}, {"id": "mistralai/ministral-3b-2512", "open": true, "I": 4.8, "C": 4.8, "A": 0.8, "pi": 0.09999999999999999, "po": 0.09999999999999999, "cr": 0.01, "ctx": 131072, "img": true, "tools": true, "so": true, "created": 1764681560, "exp": null, "alias": null}, {"id": "mistralai/mistral-large-2512", "open": false, "I": 9.7, "C": 20.1, "A": 2.4, "pi": 0.5, "po": 1.5, "cr": 0.049999999999999996, "ctx": 262144, "img": true, "tools": true, "so": true, "created": 1764624472, "exp": null, "alias": null}, {"id": "anthropic/claude-haiku-4.5", "open": false, "I": 17.6, "C": 43.9, "A": 10.3, "pi": 1.0, "po": 5.0, "cr": 0.09999999999999999, "ctx": 200000, "img": true, "tools": true, "so": true, "created": 1760547638, "exp": null, "alias": null}, {"id": "anthropic/claude-sonnet-4.5", "open": false, "I": 21.2, "C": 52.1, "A": 17.5, "pi": 3.0, "po": 15.0, "cr": 0.3, "ctx": 1000000, "img": true, "tools": true, "so": true, "created": 1759161676, "exp": null, "alias": null}, {"id": "deepseek/deepseek-v3.1-terminus", "open": true, "I": 15.4, "C": 43.5, "A": 8.9, "pi": 0.27, "po": 1.0, "cr": 0.135, "ctx": 163840, "img": false, "tools": true, "so": true, "created": 1758548275, "exp": null, "alias": null}, {"id": "qwen/qwen3-30b-a3b-thinking-2507", "open": true, "I": 9.8, "C": 12.1, "A": 0.9, "pi": 0.19999999999999998, "po": 2.4, "cr": null, "ctx": 81920, "img": false, "tools": true, "so": false, "created": 1756399192, "exp": null, "alias": null}, {"id": "mistralai/mistral-medium-3.1", "open": false, "I": 9.5, "C": 20.5, "A": 3.1, "pi": 0.39999999999999997, "po": 2.0, "cr": 0.04, "ctx": 131072, "img": true, "tools": true, "so": true, "created": 1755095639, "exp": null, "alias": null}, {"id": "openai/gpt-5-mini", "open": false, "I": 17.4, "C": 15.6, "A": 8.9, "pi": 0.25, "po": 2.0, "cr": 0.024999999999999998, "ctx": 400000, "img": true, "tools": true, "so": true, "created": 1754587407, "exp": null, "alias": null}, {"id": "openai/gpt-oss-120b", "open": true, "I": 12.3, "C": 30.4, "A": 6.2, "pi": 0.037, "po": 0.16999999999999998, "cr": null, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1754414231, "exp": null, "alias": null}, {"id": "openai/gpt-oss-20b", "open": true, "I": 9, "C": 20.7, "A": 1.4, "pi": 0.03, "po": 0.13, "cr": 0.03, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1754414229, "exp": null, "alias": null}, {"id": "qwen/qwen3-235b-a22b-thinking-2507", "open": true, "I": 12.7, "C": 22.1, "A": 1.3, "pi": 0.22999999999999998, "po": 2.3, "cr": null, "ctx": 131072, "img": false, "tools": true, "so": false, "created": 1753449557, "exp": null, "alias": null}, {"id": "google/gemini-2.5-pro", "open": false, "I": 16.7, "C": 33.3, "A": 3.5, "pi": 1.25, "po": 10.0, "cr": 0.125, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1750169544, "exp": null, "alias": null}, {"id": "qwen/qwen3-8b", "open": true, "I": 5.2, "C": 9, "A": 0.8, "pi": 0.117, "po": 0.45499999999999996, "cr": null, "ctx": 131072, "img": false, "tools": true, "so": false, "created": 1745876632, "exp": null, "alias": null}, {"id": "qwen/qwen3-14b", "open": true, "I": 6.4, "C": 13.8, "A": 0.9, "pi": 0.12, "po": 0.24, "cr": null, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1745876478, "exp": null, "alias": null}, {"id": "qwen/qwen3-32b", "open": true, "I": 7.2, "C": 15.3, "A": 0.9, "pi": 0.08, "po": 0.28, "cr": null, "ctx": 131072, "img": false, "tools": true, "so": true, "created": 1745875945, "exp": null, "alias": null}, {"id": "meta-llama/llama-4-maverick", "open": true, "I": 9.3, "C": 16.3, "A": 0.6, "pi": 0.1875, "po": 0.6525, "cr": null, "ctx": 1048576, "img": true, "tools": true, "so": true, "created": 1743881822, "exp": null, "alias": null}, {"id": "meta-llama/llama-4-scout", "open": true, "I": 6.5, "C": 8.2, "A": 0.5, "pi": 0.09999999999999999, "po": 0.3, "cr": null, "ctx": 1310720, "img": true, "tools": true, "so": true, "created": 1743881519, "exp": null, "alias": null}, {"id": "deepseek/deepseek-chat-v3-0324", "open": true, "I": 9.7, "C": 21.2, "A": 0.8, "pi": 0.25, "po": 1.0, "cr": null, "ctx": 163840, "img": false, "tools": true, "so": true, "created": 1742824755, "exp": null, "alias": null}, {"id": "google/gemma-3-12b-it", "open": true, "I": 3.8, "C": 5.8, "A": 0.1, "pi": 0.049999999999999996, "po": 0.15, "cr": null, "ctx": 131072, "img": true, "tools": true, "so": true, "created": 1741902625, "exp": null, "alias": null}, {"id": "cohere/command-a", "open": true, "I": 13.9, "C": 27.8, "A": 3.6, "pi": 2.5, "po": 10.0, "cr": null, "ctx": 256000, "img": false, "tools": false, "so": true, "created": 1741894342, "exp": null, "alias": null}, {"id": "google/gemma-3-27b-it", "open": true, "I": 4.9, "C": 10.1, "A": 0.1, "pi": 0.08, "po": 0.44999999999999996, "cr": 0.04, "ctx": 131072, "img": true, "tools": true, "so": true, "created": 1741756359, "exp": null, "alias": null}, {"id": "openai/o3-mini-high", "open": false, "I": 11, "C": 16.3, "A": 0.9, "pi": 1.1, "po": 4.4, "cr": 0.55, "ctx": 200000, "img": false, "tools": true, "so": true, "created": 1739372611, "exp": null, "alias": null}, {"id": "deepseek/deepseek-r1", "open": true, "I": 11.4, "C": 24.6, "A": 1.1, "pi": 0.7, "po": 2.5, "cr": null, "ctx": 64000, "img": false, "tools": true, "so": false, "created": 1737381095, "exp": null, "alias": null}]
\ No newline at end of file
diff --git a/internal/crewroute/allowed.go b/internal/crewroute/allowed.go
new file mode 100644
index 0000000000..8b92d1c5fd
--- /dev/null
+++ b/internal/crewroute/allowed.go
@@ -0,0 +1,344 @@
+package crewroute
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// WHICH MODELS THE CREW MAY BE PICKED FROM — ONE RULE, WRITTEN ONCE.
+//
+// The /crew panel says what is allowed and the router picks inside it, and
+// this is the rule's grammar and its one reading. It is a RULE rather than a
+// list wherever it can be, because a rule keeps meaning what it meant when the
+// catalog moves: `open` admits tomorrow's open-weight release the day it is
+// listed, and a list of today's ids would need somebody to notice it.
+//
+//	all                       everything a connected provider can reach (the default)
+//	open                      open-weight models only
+//	≤1/5                      at most $1 per million tokens in and $5 out (`<=1/5` too)
+//	glm-5.3-flash, kimi-k3    exactly these models — an id, a model's own name
+//	                          after its vendor, or a vendor or provider name
+//
+// Any of the four may be followed by `+x` and `-x`, read left to right, the
+// last word about a model winning: `open -deepseek` is every open model but
+// DeepSeek's, `≤1/5 +moonshotai/kimi-k3` is the price rule with one exception
+// let in. A `+x` or `-x` naming a PROVIDER — `-openrouter` — takes that
+// provider's routes away rather than models, so a model it serves stays
+// allowed on any other route that reaches it.
+
+// Base is the first word of a rule: what is allowed before any `+x` or `-x`.
+type Base string
+
+const (
+	BaseAll   Base = "all"
+	BaseOpen  Base = "open"
+	BasePrice Base = "price"
+	BaseList  Base = "list"
+)
+
+// DefaultAllowed is the rule a profile that never answered reads.
+const DefaultAllowed = "all"
+
+// Allowed is a parsed rule.
+type Allowed struct {
+	Base Base
+	// MaxIn and MaxOut are the price rule's two ceilings, dollars per million
+	// tokens. Zero on every other base.
+	MaxIn  float64
+	MaxOut float64
+	// Members are an explicit list's words.
+	Members []string
+	// Mods are the `+x` / `-x` words, in the order they were written.
+	Mods []Mod
+}
+
+// Mod is one `+x` or `-x`.
+type Mod struct {
+	Add  bool
+	Word string
+}
+
+// ParseAllowed reads a rule. An empty rule is [DefaultAllowed]. A rule that
+// does not parse is refused with the reason, because a typo that silently
+// allowed everything would be a setting somebody thinks is protecting them.
+func ParseAllowed(raw string) (Allowed, error) {
+	words := splitRule(raw)
+	if len(words) == 0 {
+		return Allowed{Base: BaseAll}, nil
+	}
+	var rule Allowed
+	first := strings.ToLower(words[0])
+	rest := words
+	switch {
+	case first == string(BaseAll):
+		rule.Base, rest = BaseAll, words[1:]
+	case first == string(BaseOpen):
+		rule.Base, rest = BaseOpen, words[1:]
+	case strings.HasPrefix(first, "≤") || strings.HasPrefix(first, "<="):
+		in, out, err := parsePriceRule(first)
+		if err != nil {
+			return Allowed{}, err
+		}
+		rule.Base, rule.MaxIn, rule.MaxOut, rest = BasePrice, in, out, words[1:]
+	case strings.HasPrefix(first, "+") || strings.HasPrefix(first, "-"):
+		// A rule that opens with a modifier modifies everything: `-openrouter`
+		// alone is all, minus one provider.
+		rule.Base = BaseAll
+	default:
+		rule.Base = BaseList
+	}
+	for _, word := range rest {
+		switch {
+		case strings.HasPrefix(word, "+") && len(word) > 1:
+			rule.Mods = append(rule.Mods, Mod{Add: true, Word: strings.ToLower(word[1:])})
+		case strings.HasPrefix(word, "-") && len(word) > 1:
+			rule.Mods = append(rule.Mods, Mod{Add: false, Word: strings.ToLower(word[1:])})
+		case rule.Base == BaseList:
+			rule.Members = append(rule.Members, strings.ToLower(word))
+		default:
+			return Allowed{}, fmt.Errorf("%q: after %s, name a model or provider with + or -", word, rule.Base)
+		}
+	}
+	return rule, nil
+}
+
+// splitRule reads a rule's words: spaces and commas both separate them.
+func splitRule(raw string) []string {
+	return strings.FieldsFunc(strings.TrimSpace(raw), func(r rune) bool {
+		return r == ',' || r == ' ' || r == '\t' || r == '\n'
+	})
+}
+
+// parsePriceRule reads `≤1/5` or `<=1/5`: two ceilings, dollars per million.
+func parsePriceRule(word string) (in, out float64, err error) {
+	body := strings.TrimPrefix(strings.TrimPrefix(word, "≤"), "<=")
+	body = strings.ReplaceAll(body, "$", "")
+	parts := strings.Split(body, "/")
+	if len(parts) != 2 {
+		return 0, 0, fmt.Errorf("%q: a price rule is ≤<in>/<out> dollars per million tokens, like ≤1/5", word)
+	}
+	in, errIn := strconv.ParseFloat(strings.TrimSpace(parts[0]), 64)
+	out, errOut := strconv.ParseFloat(strings.TrimSpace(parts[1]), 64)
+	if errIn != nil || errOut != nil || in < 0 || out < 0 {
+		return 0, 0, fmt.Errorf("%q: a price rule is ≤<in>/<out> dollars per million tokens, like ≤1/5", word)
+	}
+	return in, out, nil
+}
+
+// String writes the rule back in its canonical spelling, which is what the
+// panel shows and what is stored.
+func (a Allowed) String() string {
+	var words []string
+	switch a.Base {
+	case BaseOpen:
+		words = append(words, string(BaseOpen))
+	case BasePrice:
+		words = append(words, "≤"+trimFloat(a.MaxIn)+"/"+trimFloat(a.MaxOut))
+	case BaseList:
+		words = append(words, strings.Join(a.Members, ", "))
+	default:
+		if len(a.Mods) == 0 {
+			return string(BaseAll)
+		}
+		words = append(words, string(BaseAll))
+	}
+	for _, mod := range a.Mods {
+		sign := "-"
+		if mod.Add {
+			sign = "+"
+		}
+		words = append(words, sign+mod.Word)
+	}
+	return strings.Join(words, " ")
+}
+
+// trimFloat spells a ceiling without trailing zeros.
+func trimFloat(v float64) string { return strconv.FormatFloat(v, 'f', -1, 64) }
+
+// With is the rule with one more `+x` or `-x` on its end — what `/crew models
+// +x` writes. A word the rule already carries with the same sign is not
+// written twice, and the same word with the other sign is replaced, so the
+// rule stays the shortest spelling of what the person meant.
+func (a Allowed) With(add bool, word string) Allowed {
+	word = strings.ToLower(strings.TrimSpace(word))
+	out := a
+	out.Mods = nil
+	for _, mod := range a.Mods {
+		if mod.Word != word {
+			out.Mods = append(out.Mods, mod)
+		}
+	}
+	out.Mods = append(out.Mods, Mod{Add: add, Word: word})
+	return out
+}
+
+// AdmitsModel says whether the rule allows a model, before routes are asked.
+func (a Allowed) AdmitsModel(m Model) bool {
+	admitted := false
+	switch a.Base {
+	case BaseAll, "":
+		admitted = true
+	case BaseOpen:
+		admitted = m.Open
+	case BasePrice:
+		// Prices are per token in the catalog; the rule is per million.
+		admitted = m.PromptPrice*1e6 <= a.MaxIn+1e-9 && m.CompletionPrice*1e6 <= a.MaxOut+1e-9
+	case BaseList:
+		for _, member := range a.Members {
+			if matchesModel(member, m.ID) {
+				admitted = true
+				break
+			}
+		}
+	}
+	for _, mod := range a.Mods {
+		if matchesModel(mod.Word, m.ID) {
+			admitted = mod.Add
+		}
+	}
+	return admitted
+}
+
+// AdmitsRoute says whether the rule allows a provider's routes. Only a `-x`
+// naming the provider takes them away; a later `+x` gives them back.
+func (a Allowed) AdmitsRoute(provider string) bool {
+	provider = strings.ToLower(strings.TrimSpace(provider))
+	admitted := true
+	for _, mod := range a.Mods {
+		if mod.Word == provider {
+			admitted = mod.Add
+		}
+	}
+	return admitted
+}
+
+// NamesModel says whether the rule speaks about this model by name — a list
+// member or a modifier matching it. It is how a pin outside a price or open
+// rule can still be let in by name.
+func (a Allowed) NamesModel(id string) bool {
+	for _, member := range a.Members {
+		if matchesModel(member, id) {
+			return true
+		}
+	}
+	for _, mod := range a.Mods {
+		if mod.Add && matchesModel(mod.Word, id) {
+			return true
+		}
+	}
+	return false
+}
+
+// matchesModel reads one rule word against one model id: the whole id, the
+// model's own name after its vendor, or the vendor itself. The comparison is
+// on lineage, so `deepseek/deepseek-v4-flash` names the dated build too.
+func matchesModel(word, id string) bool {
+	word = strings.ToLower(strings.TrimSpace(word))
+	if word == "" {
+		return false
+	}
+	full := Lineage(id)
+	if Lineage(word) == full {
+		return true
+	}
+	vendor, tail := full, full
+	if slash := strings.Index(full, "/"); slash >= 0 {
+		vendor, tail = full[:slash], full[slash+1:]
+	}
+	return word == vendor || Lineage(word) == tail
+}
+
+// ── THE PANEL'S EDITS, EACH THE SHORTEST RULE THAT SAYS IT ──
+//
+// The /crew panel edits the rule a toggle at a time — a model ticked on or off
+// in its checklist, a provider taken away, the base walked from `all` to
+// `open` — and every one of those writes the rule back through the same one
+// writer the typed form uses. What these add is the arithmetic of saying the
+// change in as few words as possible, because the rule is SHOWN: a checklist
+// that left `+x -x +x` behind after three presses would be a panel writing a
+// rule nobody could read back.
+
+// Custom says whether the rule is more than one of the three plain bases: an
+// explicit list, or a base with exceptions on it. It is the fourth answer the
+// panel's models row walks between, and the one its checklist edits.
+func (a Allowed) Custom() bool {
+	return a.Base == BaseList || len(a.Mods) > 0
+}
+
+// Rebased is the rule on a new base with nothing carried over — the `‹ open ›`
+// the panel's row steps to is `open`, and not `open` with whatever exceptions
+// the rule it stepped from happened to have. The price ceilings are taken for
+// [BasePrice] and ignored for every other base.
+func (a Allowed) Rebased(base Base, maxIn, maxOut float64) Allowed {
+	out := Allowed{Base: base}
+	if base == BasePrice {
+		out.MaxIn, out.MaxOut = maxIn, maxOut
+	}
+	return out
+}
+
+// Without is the rule with every `+x` or `-x` naming word taken off, which
+// hands that word's verdict back to the base.
+func (a Allowed) Without(word string) Allowed {
+	word = strings.ToLower(strings.TrimSpace(word))
+	out := a
+	out.Mods = nil
+	for _, mod := range a.Mods {
+		if mod.Word != word {
+			out.Mods = append(out.Mods, mod)
+		}
+	}
+	return out
+}
+
+// Toggled is the rule with one model's verdict flipped to admit, in the
+// shortest spelling: an explicit list gains or loses a member, and any other
+// base loses the exception it already had for the model when that alone gives
+// the wanted verdict, or gains one when it does not. It is what a tick in the
+// panel's checklist writes.
+//
+// AN EXPLICIT LIST MAY NOT BE EMPTIED. `a, b` less both is not a rule the
+// grammar can spell — an empty rule reads as `all`, which is the opposite of
+// what unticking the last model means — so the second answer is false and the
+// rule comes back as it was.
+func (a Allowed) Toggled(m Model, admit bool) (Allowed, bool) {
+	word := strings.ToLower(strings.TrimSpace(m.ID))
+	if a.Base == BaseList {
+		out := a.Without(word)
+		var members []string
+		for _, member := range a.Members {
+			if !matchesModel(member, m.ID) {
+				members = append(members, member)
+			}
+		}
+		if admit {
+			members = append(members, word)
+		}
+		if len(members) == 0 {
+			return a, false
+		}
+		out.Members = members
+		if out.AdmitsModel(m) != admit {
+			// A vendor-wide exception outranks the member: say this model by name
+			// after it, which is the last word and therefore the verdict.
+			out = out.With(admit, word)
+		}
+		return out, true
+	}
+	out := a.Without(word)
+	if out.AdmitsModel(m) != admit {
+		out = out.With(admit, word)
+	}
+	return out, true
+}
+
+// RouteToggled is the rule with one provider's routes given back or taken
+// away, in the shortest spelling, the way [Allowed.Toggled] says a model.
+func (a Allowed) RouteToggled(provider string, admit bool) Allowed {
+	out := a.Without(provider)
+	if out.AdmitsRoute(provider) != admit {
+		out = out.With(admit, provider)
+	}
+	return out
+}
diff --git a/internal/crewroute/allowed_test.go b/internal/crewroute/allowed_test.go
new file mode 100644
index 0000000000..34b745ef12
--- /dev/null
+++ b/internal/crewroute/allowed_test.go
@@ -0,0 +1,120 @@
+package crewroute
+
+import "testing"
+
+func TestAllowedRules(t *testing.T) {
+	flash := Model{ID: "z-ai/glm-5.3-flash", Open: true, PromptPrice: 0.15e-6, CompletionPrice: 0.5e-6}
+	kimi := Model{ID: "moonshotai/kimi-k3", Open: true, PromptPrice: 3e-6, CompletionPrice: 15e-6}
+	opus := Model{ID: "anthropic/claude-opus-5", PromptPrice: 5e-6, CompletionPrice: 25e-6}
+	v4 := Model{ID: "deepseek/deepseek-v4-flash-0731", Open: true, PromptPrice: 0.04e-6, CompletionPrice: 0.64e-6}
+	cases := []struct {
+		rule  string
+		admit map[string]bool
+	}{
+		{"", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: true, v4.ID: true}},
+		{"all", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: true, v4.ID: true}},
+		{"open", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: false, v4.ID: true}},
+		{"open -deepseek", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: false, v4.ID: false}},
+		{"≤1/5", map[string]bool{flash.ID: true, kimi.ID: false, opus.ID: false, v4.ID: true}},
+		{"<=1/5 +moonshotai/kimi-k3", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: false, v4.ID: true}},
+		{"glm-5.3-flash, kimi-k3", map[string]bool{flash.ID: true, kimi.ID: true, opus.ID: false, v4.ID: false}},
+		{"deepseek/deepseek-v4-flash", map[string]bool{v4.ID: true, flash.ID: false}},
+		{"anthropic", map[string]bool{opus.ID: true, flash.ID: false}},
+		{"-anthropic", map[string]bool{opus.ID: false, flash.ID: true}},
+	}
+	for _, tc := range cases {
+		rule, err := ParseAllowed(tc.rule)
+		if err != nil {
+			t.Fatalf("%q: %v", tc.rule, err)
+		}
+		for _, m := range []Model{flash, kimi, opus, v4} {
+			want, asked := tc.admit[m.ID]
+			if !asked {
+				continue
+			}
+			if got := rule.AdmitsModel(m); got != want {
+				t.Errorf("%q admits %s = %v, want %v", tc.rule, m.ID, got, want)
+			}
+		}
+	}
+}
+
+func TestAllowedRefusesWhatItCannotRead(t *testing.T) {
+	for _, bad := range []string{"≤1", "<=a/b", "open kimi-k3", "≤-1/5"} {
+		if _, err := ParseAllowed(bad); err == nil {
+			t.Errorf("%q parsed; want a refusal", bad)
+		}
+	}
+}
+
+func TestAllowedRoundTripsAndModifies(t *testing.T) {
+	for _, rule := range []string{"all", "open", "≤1/5", "open -deepseek +deepseek/deepseek-v4-flash", "glm-5.3-flash, kimi-k3"} {
+		parsed, err := ParseAllowed(rule)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if parsed.String() != rule {
+			t.Errorf("%q round-trips as %q", rule, parsed.String())
+		}
+	}
+	open, _ := ParseAllowed("open -deepseek")
+	if got := open.With(true, "deepseek").String(); got != "open +deepseek" {
+		t.Errorf("With flips a sign: %q", got)
+	}
+	if got := open.With(false, "openrouter"); got.AdmitsRoute("openrouter") || !got.AdmitsRoute("z-ai") {
+		t.Errorf("-openrouter: %q", got.String())
+	}
+}
+
+// THE PANEL'S EDITS ARE THE SHORTEST RULE THAT SAYS THEM: a tick undone is the
+// rule it was, and a list keeps at least one member.
+func TestAllowedTogglesInTheShortestSpelling(t *testing.T) {
+	kimi := Model{ID: "moonshotai/kimi-k3", Open: true}
+	opus := Model{ID: "anthropic/claude-opus-5"}
+	all, _ := ParseAllowed("all")
+
+	off, ok := all.Toggled(kimi, false)
+	if !ok || off.String() != "all -moonshotai/kimi-k3" {
+		t.Fatalf("unticking kimi from all wrote %q", off.String())
+	}
+	back, _ := off.Toggled(kimi, true)
+	if back.String() != "all" || back.Custom() {
+		t.Fatalf("ticking it again wrote %q, want the plain base back", back.String())
+	}
+
+	open, _ := ParseAllowed("open")
+	in, _ := open.Toggled(opus, true)
+	if in.String() != "open +anthropic/claude-opus-5" || !in.AdmitsModel(opus) {
+		t.Fatalf("ticking a closed model on open wrote %q", in.String())
+	}
+
+	list, _ := ParseAllowed("kimi-k3, glm-5.3-flash")
+	grown, _ := list.Toggled(opus, true)
+	if !grown.AdmitsModel(opus) || grown.Base != BaseList {
+		t.Fatalf("ticking onto a list wrote %q", grown.String())
+	}
+	shrunk, _ := grown.Toggled(kimi, false)
+	if shrunk.AdmitsModel(kimi) || len(shrunk.Mods) != 0 {
+		t.Fatalf("unticking a member wrote %q, want it off the list and no exception", shrunk.String())
+	}
+	one, _ := ParseAllowed("kimi-k3")
+	if kept, ok := one.Toggled(kimi, false); ok || kept.String() != one.String() {
+		t.Fatalf("emptying a list was accepted as %q", kept.String())
+	}
+
+	away := all.RouteToggled("openrouter", false)
+	if away.String() != "all -openrouter" || away.AdmitsRoute("openrouter") {
+		t.Fatalf("taking openrouter away wrote %q", away.String())
+	}
+	if again := away.RouteToggled("openrouter", true); again.String() != "all" {
+		t.Fatalf("giving it back wrote %q", again.String())
+	}
+
+	price, _ := ParseAllowed("open -deepseek")
+	if re := price.Rebased(BasePrice, 1, 5); re.String() != "≤1/5" {
+		t.Fatalf("rebasing onto a price wrote %q", re.String())
+	}
+	if !price.Custom() {
+		t.Fatal("a base with an exception is not custom")
+	}
+}
diff --git a/internal/crewroute/canonical.go b/internal/crewroute/canonical.go
new file mode 100644
index 0000000000..f163bda46f
--- /dev/null
+++ b/internal/crewroute/canonical.go
@@ -0,0 +1,310 @@
+package crewroute
+
+import (
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/Agent-Field/codeaf/internal/pool/index"
+)
+
+// ONE MODEL, MANY SPELLINGS — WHAT IS THE SAME MODEL ACROSS PROVIDERS.
+//
+// Evidence and quality belong to a MODEL; a price, a limit and a send id belong
+// to a ROUTE to it. OpenRouter spells GLM `z-ai/glm-5.3-flash`, Fireworks
+// `accounts/fireworks/models/glm-5p3-flash`, a Hugging Face mirror
+// `zai-org/GLM-5.3-Flash`, OpenRouter's free pool `z-ai/glm-5.3-flash:free`,
+// and a local Ollama pull `glm-5.3-flash:q4_k_m`. The router must read those
+// as one model with five routes — or, for the local pull, as a distinct
+// VARIANT of the one model — or it scores a model once and prices it five
+// times as five strangers.
+//
+// [Canonical] is that reading. It is PURE AND FAST — string operations, no
+// pattern engine, no network — because it runs for every catalog row of every
+// decision. It composes, in order:
+//
+//  1. the provider namespaces a re-hosting provider puts in front of a model
+//     (`openrouter/`, `accounts/<account>/models/`), taken off;
+//  2. the route suffixes that name a way of serving the same weights
+//     (`:free`, `:nitro`, `:floor`), taken off — a route is not a model;
+//  3. a local quantisation tag (`:q4_k_m`, `:fp8`, `-gguf`), taken off into a
+//     VARIANT: the same weights squeezed, which inherit the model's evidence
+//     at a discount ([quantDiscount]) but are never the same model;
+//  4. spelling: lowercase, `_` read as `-`, and a version written with a `p`
+//     between two digits (`5p3`) read as the dot it stands for;
+//  5. the owner: a Hugging Face organisation read as the catalog's vendor
+//     ([vendorOrgs]), and a bare model name given the vendor its family
+//     belongs to ([familyVendors]);
+//  6. the pool index's own alternates (internal/pool/index), and the small
+//     table of known mismatches below ([modelAliases]);
+//  7. [Lineage]'s rules: a thinking level, `-latest` and a dated snapshot.
+//
+// AN UNKNOWN SPELLING STAYS ITS OWN MODEL. Nothing here merges two ids because
+// they look alike: every rule is a fact about how a provider spells an id, and
+// a model no rule recognises is read on its own catalog figures, the way
+// every model is.
+
+// Canon is a model's canonical identity: the id evidence is kept under, and
+// the quantisation variant when the id names a squeezed local copy of it.
+type Canon struct {
+	ID      string
+	Variant string
+}
+
+// String is the identity as one key: the id, and the variant after `@` when
+// there is one — so a quantised copy is never the model it came from.
+func (c Canon) String() string {
+	if c.Variant == "" {
+		return c.ID
+	}
+	return c.ID + "@" + c.Variant
+}
+
+// quantDiscount is how much of a model's quality a quantised local copy is
+// credited with. Quantisation costs something on agentic work — tool calls
+// are where a squeezed model slips first — so the credit is a conservative
+// share: a local copy sits a seat when it is free AND nearly as good, never
+// because its model's score was borrowed whole.
+const quantDiscount = 0.85
+
+// routeSuffixes are the `:word` endings that name a way of serving a model
+// rather than a model: OpenRouter's free pool, its throughput and price
+// variants.
+var routeSuffixes = map[string]bool{"free": true, "nitro": true, "floor": true}
+
+// thinkingSuffixes are the `:word` endings that name how hard a model thinks
+// on a call — the same weights, asked differently.
+var thinkingSuffixes = map[string]bool{"low": true, "medium": true, "high": true, "minimal": true, "max": true}
+
+// vendorOrgs are Hugging Face organisations whose models the catalog lists
+// under another vendor word. A TABLE OF FACTS: each is the organisation that
+// publishes the weights and the vendor word OpenRouter spells for it.
+var vendorOrgs = map[string]string{
+	"zai-org":     "z-ai",
+	"deepseek-ai": "deepseek",
+	"moonshot":    "moonshotai",
+	"meta":        "meta-llama",
+}
+
+// familyVendors give a bare model name — a provider that hosts it without an
+// owner in the id, as Fireworks and Ollama do — the vendor its family belongs
+// to. A TABLE OF FACTS about which company names its models this way; a name
+// no entry starts is left without a vendor and stays its own model.
+var familyVendors = []struct{ prefix, vendor string }{
+	{"glm-", "z-ai"},
+	{"kimi-", "moonshotai"},
+	{"deepseek-", "deepseek"},
+	{"qwen", "qwen"},
+	{"gpt-oss", "openai"},
+	{"llama-", "meta-llama"},
+	{"mistral-", "mistralai"},
+	{"devstral", "mistralai"},
+	{"codestral", "mistralai"},
+	{"minimax-", "minimax"},
+	{"gemma-", "google"},
+}
+
+// modelAliases are known mismatches no rule above reads: a provider's own name
+// for a model the catalog lists under another. A TABLE OF FACTS, each entry
+// added when a provider was seen to spell a model this way — never a guess
+// that two names probably mean one model.
+var modelAliases = map[string]string{
+	// Together serves Llama 3.3 70B under a "-turbo" name for the same
+	// instruct weights the catalog lists.
+	"meta-llama/llama-3.3-70b-instruct-turbo": "meta-llama/llama-3.3-70b-instruct",
+}
+
+var (
+	poolIndexOnce sync.Once
+	poolIndex     *index.Index
+)
+
+// poolAliases is the embedded pool index, read once; nil when it will not
+// parse, which leaves its alternates unread and nothing else changed.
+func poolAliases() *index.Index {
+	poolIndexOnce.Do(func() {
+		if x, err := index.SeedIndex(); err == nil {
+			poolIndex = x
+		}
+	})
+	return poolIndex
+}
+
+// Canonical is the id a model's evidence is kept under, across every
+// provider's spelling of it ([CanonicalOf] without the variant).
+func Canonical(id string) string { return CanonicalOf(id).ID }
+
+// canonMemo holds what [CanonicalOf] has read, because a decision asks the
+// same few hundred ids several times each and the answer never changes. It
+// is bounded: past canonMemoMax ids it stops remembering new ones.
+var canonMemo = struct {
+	sync.RWMutex
+	ids map[string]Canon
+}{ids: map[string]Canon{}}
+
+const canonMemoMax = 8192
+
+// CanonicalOf reads one id as the model it names — see the file comment for
+// the rules, in order.
+func CanonicalOf(id string) Canon {
+	canonMemo.RLock()
+	c, ok := canonMemo.ids[id]
+	canonMemo.RUnlock()
+	if ok {
+		return c
+	}
+	c = canonicalOf(id)
+	canonMemo.Lock()
+	if len(canonMemo.ids) < canonMemoMax {
+		canonMemo.ids[id] = c
+	}
+	canonMemo.Unlock()
+	return c
+}
+
+// canonicalOf is [CanonicalOf] without the memo.
+func canonicalOf(id string) Canon {
+	s := strings.ToLower(strings.TrimSpace(id))
+	s = strings.TrimPrefix(s, "~")
+	s = strings.TrimPrefix(s, "openrouter/")
+	if strings.HasPrefix(s, "accounts/") {
+		// accounts/<account>/models/<name>: Fireworks' namespace for a model it
+		// hosts, with no owner in it.
+		if at := strings.Index(s, "/models/"); at >= 0 {
+			s = s[at+len("/models/"):]
+		}
+	}
+	var variant string
+	// The `:word` endings, last first: a route, a thinking level, a quant tag.
+	for {
+		at := strings.LastIndex(s, ":")
+		if at <= 0 {
+			break
+		}
+		tail := s[at+1:]
+		switch {
+		case routeSuffixes[tail], thinkingSuffixes[tail], tail == "latest":
+			s = s[:at]
+			continue
+		case quantTag(tail):
+			variant, s = tail, s[:at]
+			continue
+		}
+		break
+	}
+	if at := strings.LastIndex(s, "-"); at > 0 && (s[at+1:] == "gguf" || quantTag(s[at+1:])) && variant == "" {
+		variant, s = s[at+1:], s[:at]
+	}
+	vendor, name := "", s
+	if slash := strings.Index(s, "/"); slash >= 0 {
+		vendor, name = s[:slash], s[slash+1:]
+	}
+	name = versionDots(strings.ReplaceAll(name, "_", "-"))
+	if mapped, ok := vendorOrgs[vendor]; ok {
+		vendor = mapped
+	}
+	if vendor == "" {
+		for _, f := range familyVendors {
+			if strings.HasPrefix(name, f.prefix) {
+				vendor = f.vendor
+				break
+			}
+		}
+	}
+	out := name
+	if vendor != "" {
+		out = vendor + "/" + name
+	}
+	if alias, ok := modelAliases[out]; ok {
+		out = alias
+	}
+	if x := poolAliases(); x != nil {
+		out = strings.ToLower(x.Canonical(out))
+	}
+	return Canon{ID: lineageTail(out), Variant: variant}
+}
+
+// quantTag is whether a word names a quantisation: q4_k_m, q8_0, iq3_xs,
+// fp8, fp16, bf16, int4, int8, awq, gptq.
+func quantTag(word string) bool {
+	switch {
+	case word == "awq" || word == "gptq" || word == "bf16" || word == "gguf":
+		return true
+	case strings.HasPrefix(word, "fp") && allDigits(word[2:]):
+		return true
+	case strings.HasPrefix(word, "int") && allDigits(word[3:]):
+		return true
+	case strings.HasPrefix(word, "iq") && len(word) > 2 && word[2] >= '0' && word[2] <= '9':
+		return true
+	case strings.HasPrefix(word, "q") && len(word) > 1 && word[1] >= '0' && word[1] <= '9':
+		return true
+	}
+	return false
+}
+
+// versionDots reads a version written with a `p` between two digits as the
+// dot it stands for: `glm-5p3-flash` is `glm-5.3-flash`.
+func versionDots(name string) string {
+	if !strings.Contains(name, "p") {
+		return name
+	}
+	b := []byte(name)
+	for i := 1; i+1 < len(b); i++ {
+		if b[i] == 'p' && b[i-1] >= '0' && b[i-1] <= '9' && b[i+1] >= '0' && b[i+1] <= '9' {
+			b[i] = '.'
+		}
+	}
+	return string(b)
+}
+
+// DomainTuned is whether a model's own id says it was tuned for one domain
+// other than code and general work — finance, medicine, law, a single subject,
+// role-play — by a tag among the words of its name. Such a model is a poor
+// seat for software work whatever its figures, and a rescue that must take a
+// model it knows little about takes a general or a code model first.
+func DomainTuned(id string) bool {
+	name := strings.ToLower(ShortModel(strings.TrimSuffix(id, ":free")))
+	for _, word := range strings.FieldsFunc(name, func(r rune) bool {
+		return r == '-' || r == '_' || r == '.' || r == ':' || r == '/'
+	}) {
+		if domainTags[word] {
+			return true
+		}
+	}
+	return false
+}
+
+// domainTags are the name words that mark a model tuned for one domain.
+var domainTags = map[string]bool{
+	"fin": true, "finance": true, "financial": true, "med": true, "medical": true, "medicine": true,
+	"bio": true, "biomed": true, "clinical": true, "health": true, "legal": true, "law": true,
+	"math": true, "maths": true, "chem": true, "chemistry": true, "roleplay": true, "rp": true,
+	"story": true, "storytelling": true, "novel": true, "creative": true, "translate": true,
+	"translation": true, "guard": true, "safety": true, "sante": true, "medic": true,
+	"pharma": true, "doctor": true, "bank": true, "banking": true, "trading": true, "tax": true,
+	"legalbench": true, "romance": true, "companion": true, "erp": true,
+}
+
+// Tiny is whether a model's own id gives it fewer parameters than a crew seat
+// can use — `lfm-2.5-2.6b`, `gemma-3n-e4b` — read off the largest size tag in
+// its name (`30b-a3b` is thirty billion, three active). A name that gives no
+// size is not called tiny.
+func Tiny(id string) bool {
+	name := strings.ToLower(ShortModel(strings.TrimSuffix(id, ":free")))
+	largest := 0.0
+	for _, word := range strings.FieldsFunc(name, func(r rune) bool {
+		return r == '-' || r == '_' || r == ':' || r == '/'
+	}) {
+		word = strings.TrimPrefix(word, "e")
+		if !strings.HasSuffix(word, "b") {
+			continue
+		}
+		if n, err := strconv.ParseFloat(strings.TrimSuffix(word, "b"), 64); err == nil && n > largest {
+			largest = n
+		}
+	}
+	return largest > 0 && largest < tinyBelow
+}
+
+// tinyBelow is the fewest billions of parameters a crew seat is given to.
+const tinyBelow = 8.0
diff --git a/internal/crewroute/canonical_test.go b/internal/crewroute/canonical_test.go
new file mode 100644
index 0000000000..05307e84ef
--- /dev/null
+++ b/internal/crewroute/canonical_test.go
@@ -0,0 +1,104 @@
+package crewroute
+
+import (
+	"math"
+	"strings"
+	"testing"
+)
+
+// ONE MODEL, EVERY SPELLING: OpenRouter, Fireworks, a Hugging Face mirror,
+// Together, a free pool, a dated snapshot and a local quantised pull of the
+// same weights all read as one model — the
+// quantised pull as a distinct variant of it.
+func TestCanonicalReadsEveryProvidersSpellingOfOneModel(t *testing.T) {
+	cases := []struct {
+		id, want, variant string
+	}{
+		{"z-ai/glm-5.3-flash", "z-ai/glm-5.3-flash", ""},
+		{"openrouter/z-ai/glm-5.3-flash", "z-ai/glm-5.3-flash", ""},
+		{"accounts/fireworks/models/glm-5p3-flash", "z-ai/glm-5.3-flash", ""},
+		{"zai-org/GLM-5.3-Flash", "z-ai/glm-5.3-flash", ""},
+		{"z-ai/glm_5.3_flash", "z-ai/glm-5.3-flash", ""},
+		{"z-ai/glm-5.3-flash:free", "z-ai/glm-5.3-flash", ""},
+		{"z-ai/glm-5.3-flash:nitro", "z-ai/glm-5.3-flash", ""},
+		{"z-ai/glm-5.3-flash-20260301", "z-ai/glm-5.3-flash", ""},
+		{"~z-ai/glm-5.3-flash-latest", "z-ai/glm-5.3-flash", ""},
+		{"z-ai/glm-5.3-flash:high", "z-ai/glm-5.3-flash", ""},
+		{"glm-5.3-flash:q4_k_m", "z-ai/glm-5.3-flash", "q4_k_m"},
+		{"deepseek-ai/DeepSeek-V4-Flash", "deepseek/deepseek-v4-flash", ""},
+		{"accounts/fireworks/models/kimi-k3", "moonshotai/kimi-k3", ""},
+		{"meta-llama/Llama-3.3-70B-Instruct-Turbo", "meta-llama/llama-3.3-70b-instruct", ""},
+		{"moonshotai/kimi-k3-fp8", "moonshotai/kimi-k3", "fp8"},
+	}
+	for _, tc := range cases {
+		got := CanonicalOf(tc.id)
+		if got.ID != tc.want || got.Variant != tc.variant {
+			t.Errorf("CanonicalOf(%q) = %+v, want %q variant %q", tc.id, got, tc.want, tc.variant)
+		}
+	}
+}
+
+// AN UNKNOWN SPELLING STAYS ITS OWN MODEL: nothing is merged on a likeness.
+func TestCanonicalNeverMergesOnALikeness(t *testing.T) {
+	for _, pair := range [][2]string{
+		{"z-ai/glm-5.3-flash", "z-ai/glm-5.3"},
+		{"somelab/coder-7b", "otherlab/coder-7b"},
+		{"thinkingmachines/inkling-small", "thinkingmachines/inkling"},
+	} {
+		if Canonical(pair[0]) == Canonical(pair[1]) {
+			t.Errorf("%q and %q were read as one model", pair[0], pair[1])
+		}
+	}
+	if got := Canonical("somelab/mystery-model"); got != "somelab/mystery-model" {
+		t.Errorf("an unknown id was rewritten to %q", got)
+	}
+}
+
+// A QUANTISED COPY IS NOT ITS MODEL, and is credited a share of its model's
+// quality.
+func TestAQuantisedCopyIsCreditedAShareOfItsModel(t *testing.T) {
+	tab := prior()
+	local := glmFlash
+	local.ID = "glm-5.3-flash:q4_k_m"
+	if Lineage(local.ID) == Lineage(glmFlash.ID) || !strings.Contains(Lineage(local.ID), "@q4_k_m") {
+		t.Fatalf("the quantised copy shares the model's identity: %q", Lineage(local.ID))
+	}
+	full, _ := tab.quality(OpenEnded, Worker, glmFlash)
+	got, _ := tab.quality(OpenEnded, Worker, local)
+	if want := full * quantDiscount; full <= 0 || math.Abs(got-want) > 1e-9 {
+		t.Fatalf("the copy reads %v, want %v", got, want)
+	}
+}
+
+// A MODEL'S NAME SAYS WHEN IT WAS TUNED FOR ONE DOMAIN, and a general or a
+// code model's does not.
+func TestDomainTunedModelsAreToldByTheirNames(t *testing.T) {
+	for _, id := range []string{"inclusionai/ling-3.0-flash-fin:free", "vendor/med-llama-70b", "acme/legal-7b", "x/qwen-math-72b", "y/roleplay-13b:free"} {
+		if !DomainTuned(id) {
+			t.Errorf("%s reads as general", id)
+		}
+	}
+	for _, id := range []string{"poolside/laguna-s-2.1:free", "z-ai/glm-5.3-flash", "qwen/qwen3-coder:free", "google/gemma-4-31b-it:free", "cohere/north-mini-code:free"} {
+		if DomainTuned(id) {
+			t.Errorf("%s reads as domain-tuned", id)
+		}
+	}
+}
+
+// A MODEL'S NAME SAYS WHEN IT IS TOO SMALL FOR A SEAT, and a name with no size
+// or a large one does not.
+func TestTinyModelsAreToldByTheirNames(t *testing.T) {
+	for _, id := range []string{"liquid/lfm-2.5-2.6b:free", "google/gemma-3n-e4b-it:free", "meta-llama/llama-3.2-3b-instruct"} {
+		if !Tiny(id) {
+			t.Errorf("%s reads as big enough", id)
+		}
+	}
+	for _, id := range []string{"nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free", "z-ai/glm-5.3-flash", "qwen/qwen3-32b", "poolside/laguna-s-2.1:free"} {
+		if Tiny(id) {
+			t.Errorf("%s reads as tiny", id)
+		}
+	}
+	if !DomainTuned("inclusionai/ling-3.0-flash-sante:free") {
+		t.Error("a health-tuned model reads as general")
+	}
+}
diff --git a/internal/crewroute/classify.go b/internal/crewroute/classify.go
new file mode 100644
index 0000000000..86cadb2d90
--- /dev/null
+++ b/internal/crewroute/classify.go
@@ -0,0 +1,424 @@
+package crewroute
+
+import (
+	"regexp"
+	"strings"
+)
+
+// WHAT KIND OF WORK A TASK IS, READ OFF ITS OWN WORDS.
+//
+// The router routes on a task's CLASS and on nothing finer, by design
+// (docs/design/model-pool/pareto-crewing.pdf): the class decides the crew. A
+// narrow fix goes to the cheapest qualified crew, and open-ended work (a
+// feature, a refactor, docs, a design) gets a strong checker behind it. So the
+// question this file answers is the only one the router asks of the text:
+// which of the two is this?
+//
+// ── THE SIGNALS ──
+//
+// It is rules, not a model, and every rule is written down here so a person
+// asking "why did it call my task a bugfix" is answered by reading them:
+//
+//   - LABELS weigh most. An issue labelled `bug` or `enhancement` is a person
+//     telling us the answer.
+//   - THE TITLE weighs more than the body. A conventional-commit prefix
+//     (`fix:`, `feat:`, `refactor:`), a `[bug]` tag or a leading verb
+//     (`add`, `support`, `document`) is the author classifying their own work.
+//   - THE BODY adds the rest: a stack trace, an exception's name, "crashes",
+//     "regression", "steps to reproduce" lean narrow; "feature request",
+//     "would be great", "consider adding", "refactor" lean open-ended.
+//
+// A harness's own wrapper around an issue — "Implement issue #12: …" and the
+// standing instruction to keep the test suite green that follows every task
+// it hands out — is read past, because it is the same sentence on every task
+// and a signal that fires on everything tells the router nothing.
+//
+// ── UNCERTAIN IS OPEN-ENDED ──
+//
+// When the signals do not clearly favour one class, the answer is
+// [OpenEnded], and that is the safe side on purpose: calling a narrow fix
+// open-ended costs a strong checker it did not need — cents — while calling
+// open-ended work a narrow fix sends it to a crew without the checker that
+// work needs. The two mistakes are not the same size, so the tie does not go
+// to the cheaper one.
+
+// Class is the kind of work a task is. It is a string because it is written
+// into the router's event log and onto a task's card, and a script reading
+// either reads the word.
+type Class string
+
+const (
+	// Bugfix is a NARROW, VERIFIABLE change: a defect, a regression, a missing
+	// check, a test that should exist. It goes to the cheapest qualified crew.
+	Bugfix Class = "bugfix"
+	// OpenEnded is work whose shape the task does not fix: a feature, a
+	// refactor, documentation, a design. It gets a strong checker: the checker
+	// is the seat worth paying for here.
+	OpenEnded Class = "openended"
+	// Other is work that changes nothing in particular — a question, an
+	// investigation, a review. It is read on the average of the other two
+	// classes' links, because the weights carry none of its own.
+	Other Class = "other"
+)
+
+// Classes lists the three, in the order a report prints them.
+// Word is the class as a person reads it: `open-ended` rather than the
+// logged `openended`, which stays the key the router's log and the evidence
+// table are written in.
+func (c Class) Word() string {
+	if c == OpenEnded {
+		return "open-ended"
+	}
+	return string(c)
+}
+
+var Classes = []Class{Bugfix, OpenEnded, Other}
+
+// Task is what the classifier reads: the words a person or an issue gave the
+// work, and the labels the issue carried when it came from a tracker.
+type Task struct {
+	Text   string
+	Labels []string
+}
+
+// Reading is the classifier's answer: the class, the one line saying which
+// signal decided it, and whether the signals were clear. Sure false is the
+// uncertain case, which always reads [OpenEnded].
+type Reading struct {
+	Class Class
+	Why   string
+	Sure  bool
+	// Complex is, for a bugfix, the signals that make it a fix with reach
+	// ([complexFix]), in words; empty is a simple fix. It names no class of
+	// its own — the task is still a bugfix on every line a person reads — and
+	// it moves only the worker ([Decide]).
+	Complex string
+}
+
+// signal is one rule: a pattern, the class it leans toward, how hard, and
+// the words the reading names it by when it decides.
+type signal struct {
+	pattern *regexp.Regexp
+	class   Class
+	weight  int
+	name    string
+}
+
+// The weights, spelled once. A label is a person's own answer and outweighs
+// anything read off prose; a title is the author's own summary and outweighs
+// a body, where the same word may be describing somebody else's code.
+const (
+	weightLabel = 4
+	weightTitle = 2
+	weightBody  = 1
+	// clearMargin is how far one class must lead the other before the reading
+	// is SURE. One point is a single body word, which is not a decision.
+	clearMargin = 2
+)
+
+// titleSignals are read off the first line of the task, after any harness
+// wrapper is removed ([taskTitle]).
+var titleSignals = []signal{
+	{regexp.MustCompile(`(?i)^\s*(fix|bugfix|hotfix)(\([^)]*\))?!?:`), Bugfix, 2, "a fix: title"},
+	{regexp.MustCompile(`(?i)^\s*(test|tests|ci|chore|build)(\([^)]*\))?!?:`), Bugfix, 1, "a narrow chore title"},
+	{regexp.MustCompile(`(?i)\[\s*bug\s*\]|^\s*bug\s*[:\-]|^\s*BUG\b`), Bugfix, 2, "a bug tag in the title"},
+	{regexp.MustCompile(`(?i)\b(crash(es|ed|ing)?|error|exception|fails?|failing|broken|regression|drops?|rejects?|(is |are |gets? |being )?rejected|ignored|incorrect(ly)?|wrong(ly)?|overflow\w*|hangs?|leaks?)\b`), Bugfix, 1, "a failure word in the title"},
+	{regexp.MustCompile(`(?i)\binstead of\b`), Bugfix, 1, "what happens set against what should"},
+	// A MECHANICAL CHANGE — a rename, a version bump — is small and exact
+	// work however far across the tree it reaches: the fix's crew, not the
+	// open-ended one.
+	{mechanicalEdit, Bugfix, 2, "a mechanical change"},
+	{regexp.MustCompile(`\b[A-Z][A-Za-z]+(Error|Exception)\b`), Bugfix, 1, "an exception named in the title"},
+	// A DEFECT SAID IN PLAIN WORDS is a fix whether or not it wears a `fix:`
+	// prefix: a leading verb that repairs something, the word bug or broken,
+	// and a sentence that sets what happens against what should.
+	{regexp.MustCompile(`(?i)^\s*(please\s+)?(fix|repair|correct|resolve|patch)\b`), Bugfix, 2, "a title that asks for a repair"},
+	{regexp.MustCompile(`(?i)\b(bug|bugs|buggy|broken)\b`), Bugfix, 1, "the word bug or broken"},
+	{defectSentence, Bugfix, 2, "what happens set against what should"},
+	// A TITLE THAT SAYS WHAT THE CODE DOES NOT DO is a defect report: "never
+	// keeps a square image", "does not close the file", "fails to parse",
+	// "should reject". "should support" and its kin ask for something new and
+	// are weighed back on the open-ended side below.
+	{regexp.MustCompile(`(?i)\b(never|doesn't|doesn’t|does not|don't|don’t|do not|fails to|failed to|cannot|can't|can’t|won't|won’t|no longer|should(n't|n’t| not)?)\b`), Bugfix, 1, "a title that says what the code does not do"},
+	// A CALL WRITTEN OUT IN THE TITLE — `RandomResizedCrop(scale=(1, 1))`,
+	// `parse("")` — is somebody quoting the input that misbehaves.
+	{regexp.MustCompile(`\b[A-Za-z_][\w.]*\((?:[^()]|\([^()]*\))+\)`), Bugfix, 1, "a call written out in the title"},
+	{regexp.MustCompile(`(?i)\bshould (also )?(support|allow|accept|provide|offer|expose|have|be able)\b`), OpenEnded, 1, "a title asking for something the code should also do"},
+	{regexp.MustCompile(`(?i)^\s*(feat|feature|refactor|perf|docs?)(\([^)]*\))?!?:`), OpenEnded, 2, "a feature or refactor title"},
+	{regexp.MustCompile(`(?i)^\s*(add|support|implement|introduce|enable|allow|create|design|define|document|redesign|rework|restructure|migrate|extend|expose|make)\b`), OpenEnded, 2, "a title that asks for something new"},
+	{regexp.MustCompile(`(?i)\b(consider|proposal|rfc|epic|feature|enhancement|refactor|docs|documentation|more pythonic|should (probably )?(default|be|support|allow)|fractional|metadata)\b`), OpenEnded, 1, "an open-ended word in the title"},
+}
+
+// bodySignals are read off everything after the title.
+var bodySignals = []signal{
+	{regexp.MustCompile(`Traceback \(most recent call last\)|(?m)^\s+at [\w.$]+\(|panic: |goroutine \d+ \[`), Bugfix, 2, "a stack trace"},
+	{regexp.MustCompile(`\b[A-Z][A-Za-z]*(Error|Exception)\b`), Bugfix, 1, "an exception in the text"},
+	{regexp.MustCompile(`(?i)\b(steps to reproduce|to reproduce|describe the bug|expected behaviou?r|actual behaviou?r|minimal (reproducible )?example)\b`), Bugfix, 2, "a bug report's own headings"},
+	{defectSentence, Bugfix, 2, "what happens set against what should"},
+	{regexp.MustCompile(`(?i)\b(failing|failed|fails) (unit |integration )?tests?\b|\btests? (is |are )?(failing|fail|broken)\b`), Bugfix, 1, "a failing test named"},
+	{regexp.MustCompile(`(?i)\b(crash(es|ed)?|regression|exit code \d+|stack ?trace|segfault|fails with|raises|silently (drops?|discards?|ignores?)|returns? (the )?wrong)\b`), Bugfix, 1, "a failure described in the text"},
+	{regexp.MustCompile(`(?i)\b(is your feature request|feature request|would be (really )?(great|nice|useful|helpful)|it'?d be great|consider adding|nice to have|enhancement|design (doc|proposal)|user stor(y|ies))\b`), OpenEnded, 2, "a feature request's own words"},
+	{regexp.MustCompile(`(?i)\b(refactor(ing)?|restructur(e|ing)|redesign|extensib(le|ility)|new (api|option|parameter|feature|command|endpoint|page|metric)s?|not well documented|documentation)\b`), OpenEnded, 1, "open-ended work described in the text"},
+}
+
+// otherSignals mark work that changes nothing in particular. They are read
+// off the title only, because a question's body is full of the words a bug
+// report uses.
+var otherTitle = regexp.MustCompile(`(?i)^\s*(explain|investigate|why\b|how (do|does|can|should)|what (is|does|are)|review|audit|summari[sz]e|analy[sz]e|research|benchmark|compare)\b`)
+
+// labelWords maps an issue label, folded, to the class it names.
+var labelWords = map[string]Class{
+	"bug": Bugfix, "type: bug": Bugfix, "kind/bug": Bugfix, "defect": Bugfix, "regression": Bugfix,
+	"crash": Bugfix, "type:bug": Bugfix, "bugfix": Bugfix, "fix": Bugfix,
+	"enhancement": OpenEnded, "feature": OpenEnded, "feature request": OpenEnded, "type: feature": OpenEnded,
+	"kind/feature": OpenEnded, "refactor": OpenEnded, "documentation": OpenEnded, "docs": OpenEnded,
+	"design": OpenEnded, "proposal": OpenEnded, "rfc": OpenEnded, "epic": OpenEnded,
+	"question": Other, "investigation": Other, "discussion": Other,
+}
+
+// labelKeys are the words a tracker's own label spellings are built on —
+// `bug :bug:`, `type/bug`, `Kind: Enhancement ✨` — read when the label is
+// not one of [labelWords] as written. Labels with none of them (`help
+// wanted`, `good first issue`) say nothing about the kind of work.
+var labelKeys = map[string]Class{
+	"bug": Bugfix, "bugs": Bugfix, "defect": Bugfix, "regression": Bugfix, "crash": Bugfix, "bugfix": Bugfix,
+	"enhancement": OpenEnded, "feature": OpenEnded, "refactor": OpenEnded, "documentation": OpenEnded,
+	"docs": OpenEnded, "proposal": OpenEnded, "rfc": OpenEnded, "epic": OpenEnded,
+	"question": Other, "investigation": Other, "discussion": Other,
+}
+
+// labelWordRun is one run of letters in a folded label.
+var labelWordRun = regexp.MustCompile(`[a-z]+`)
+
+// labelClass is the class a label names: as written first, then word by
+// word, with an emoji shortcode (`:bug:`) read as its word.
+func labelClass(label string) (Class, bool) {
+	folded := strings.ToLower(strings.TrimSpace(label))
+	if class, ok := labelWords[folded]; ok {
+		return class, true
+	}
+	if strings.Contains(folded, "🐛") {
+		return Bugfix, true
+	}
+	for _, word := range labelWordRun.FindAllString(folded, -1) {
+		if class, ok := labelKeys[word]; ok {
+			return class, true
+		}
+	}
+	return "", false
+}
+
+// wrapperLine is the harness's own sentence around an issue's title:
+// "Implement issue #12: [bug] export drops the last row". The verb is
+// the harness talking and the tail is the issue's own title.
+var wrapperLine = regexp.MustCompile(`(?i)^\s*(implement|fix|resolve|address|solve|close|work on)\s+(github\s+)?issue\s+#?\d+\s*[:\-—]\s*(.*)$`)
+
+// defectSentence is a sentence that sets what happens against what should:
+// "returns a - b instead of a + b", "should keep the order but drops it",
+// "expected 3, got 4".
+var defectSentence = regexp.MustCompile(`(?i)\b(returns?|gives?|prints?|produces?|yields?|shows?)\b[^.]*\binstead of\b|\bshould\b[^.]*\bbut\b|\bexpected\b[^.]*\b(got|but|received|instead)\b`)
+
+// mechanicalEdit is a title that asks for a rename or a version bump.
+var mechanicalEdit = regexp.MustCompile(`(?i)^\s*(please\s+)?(rename|bump|update (the )?(version|copyright)|upgrade (the )?version)\b`)
+
+// tinyEdit is a change too small to be open-ended whatever verb it opens
+// with: a docstring, a typo, a comment, one line. It reads as work of no
+// particular class — the cheap crew — and it outweighs a leading "add".
+var tinyEdit = regexp.MustCompile(`(?i)\b(docstring|docstrings|typo|typos|spelling|misspell\w*|one[- ]line|single[- ]line|whitespace|a comment|code comment|trailing comma)\b`)
+
+// boilerplate is the standing instruction a harness appends to every task.
+// It is cut before the body is read, because it is the same on every task.
+var boilerplate = regexp.MustCompile(`(?is)work in this repository\..*$`)
+
+// Classify reads a task's class. It is pure and allocation-light: the rules
+// are compiled once at load, and a task is read in a single pass per rule.
+func Classify(task Task) Reading {
+	title, body := taskTitle(task.Text)
+	var score [3]int
+	best := map[Class]signal{}
+	note := func(s signal, weight int) {
+		score[classIndex(s.class)] += weight
+		if held, ok := best[s.class]; !ok || weight > held.weight {
+			best[s.class] = signal{class: s.class, weight: weight, name: s.name}
+		}
+	}
+	labelled := map[Class]bool{}
+	for _, label := range task.Labels {
+		if class, ok := labelClass(label); ok {
+			labelled[class] = true
+			note(signal{class: class, name: "the `" + strings.TrimSpace(label) + "` label"}, weightLabel)
+		}
+	}
+	if otherTitle.MatchString(title) {
+		note(signal{class: Other, name: "a title asking a question rather than for a change"}, weightTitle+1)
+	}
+	if tinyEdit.MatchString(title) {
+		note(signal{class: Other, name: "a small scoped edit"}, 2*weightTitle+1)
+	}
+	for _, s := range titleSignals {
+		if s.pattern.MatchString(title) {
+			note(s, s.weight*weightTitle)
+		}
+	}
+	for _, s := range bodySignals {
+		if s.pattern.MatchString(body) {
+			note(s, s.weight*weightBody)
+		}
+	}
+	reading := decide(score, best, labelled)
+	if reading.Class == Bugfix {
+		reading.Complex = complexFix(reachText(title, body))
+	}
+	return reading
+}
+
+// decide is the reading the scores make. A task a person labelled a bug and
+// nobody labelled anything else is a bugfix whatever its prose leaves unsaid:
+// the label is the answer, and the open-ended default is for tasks nobody
+// answered.
+func decide(score [3]int, best map[Class]signal, labelled map[Class]bool) Reading {
+	bug, open, other := score[0], score[1], score[2]
+	switch {
+	case other > bug && other > open:
+		return Reading{Class: Other, Why: best[Other].name, Sure: other-max(bug, open) >= clearMargin}
+	case bug >= open+clearMargin:
+		return Reading{Class: Bugfix, Why: best[Bugfix].name, Sure: true}
+	case open >= bug+clearMargin:
+		return Reading{Class: OpenEnded, Why: best[OpenEnded].name, Sure: true}
+	case labelled[Bugfix] && !labelled[OpenEnded]:
+		return Reading{Class: Bugfix, Why: best[Bugfix].name, Sure: true}
+	case bug == 0 && open == 0:
+		return Reading{Class: OpenEnded, Why: "nothing in the task says which kind of work it is", Sure: false}
+	}
+	return Reading{Class: OpenEnded, Why: "the task reads both ways, so it gets the stronger checker", Sure: false}
+}
+
+// classIndex is a class's slot in the score array.
+func classIndex(class Class) int {
+	switch class {
+	case Bugfix:
+		return 0
+	case OpenEnded:
+		return 1
+	}
+	return 2
+}
+
+// taskTitle splits a task into the line that names it and the rest. The
+// first non-blank line is the title, a Markdown heading's hashes and a
+// harness wrapper removed; when the wrapper carries the title, the heading
+// line above it (usually the same words) is dropped as a duplicate.
+func taskTitle(text string) (title, body string) {
+	text = boilerplate.ReplaceAllString(text, "")
+	lines := strings.Split(text, "\n")
+	at := -1
+	for i, line := range lines {
+		if strings.TrimSpace(line) != "" {
+			at = i
+			break
+		}
+	}
+	if at < 0 {
+		return "", ""
+	}
+	title = strings.TrimSpace(strings.TrimLeft(strings.TrimSpace(lines[at]), "#"))
+	rest := lines[at+1:]
+	if m := wrapperLine.FindStringSubmatch(title); m != nil {
+		title = strings.TrimSpace(m[3])
+	}
+	// A wrapper line further down names the same issue again; it is read as
+	// the title's second spelling and not as body text.
+	kept := rest[:0:0]
+	for _, line := range rest {
+		if m := wrapperLine.FindStringSubmatch(strings.TrimSpace(line)); m != nil {
+			if title == "" {
+				title = strings.TrimSpace(m[3])
+			}
+			continue
+		}
+		kept = append(kept, line)
+	}
+	return title, strings.Join(kept, "\n")
+}
+
+// A FIX WITH REACH IS NOT A ONE-LINE FIX. The cheapest worker is the pick for
+// fixes of the ordinary size, and a defect whose repair crosses files, a wire
+// contract or a language's rules
+// is a different job wearing the same word: the cheap worker's patch is the
+// narrow one, and the checker then rejects it or — worse — passes it. So a
+// bugfix is read once more for REACH, off its body, on signals that say what
+// the repair must hold together rather than what broke:
+//
+//   - more than one source file named;
+//   - an API, an endpoint, a status code or a protocol;
+//   - language rules — i18n, locales, plurals, grammar, Unicode;
+//   - a long report, or more than one reproduction;
+//   - existing tests, guards or behaviour that must keep passing;
+//   - a security defect — traversal, injection, a bypass — whose repair must
+//     close every path to it.
+//
+// Two of them make a complex fix; one alone is how an ordinary report reads.
+// A complex fix moves its worker one rung up the seat's front ([Decide]); its
+// planner and checker are the fix's own, and a pin is never overruled.
+
+// reachSignal is one of the signals above, and the words it is named by.
+type reachSignal struct {
+	name string
+	hit  func(body string) bool
+}
+
+// The patterns the reach signals read.
+var (
+	sourceFile  = regexp.MustCompile(`\b[\w./-]+\.(py|go|ts|tsx|js|jsx|mjs|rs|java|kt|rb|c|cc|cpp|h|hpp|cs|php|swift|scala|ex|exs|vue|svelte)\b`)
+	wireWords   = regexp.MustCompile(`(?i)\b(api|apis|endpoints?|status codes?|http ?[1-5]\d\d|[1-5]\d\d (error|response)|protocols?|grpc|websockets?|rpc|wire format|openapi)\b`)
+	languageRul = regexp.MustCompile(`(?i)\b(i18n|l10n|locales?|locali[sz]ation|internationali[sz]ation|translations?|plurali[sz]ation|plurals?|grammar|language rules?|unicode|utf-?8|diacritics?|right-to-left|rtl)\b`)
+	keepPassing = regexp.MustCompile(`(?i)\b(existing|current|other|all)( [\w-]+){0,2} (tests?|checks?|guards?|behaviou?r)\b[^.]{0,60}\b(pass|passing|keep|kept|still|remain|break|breaking|unchanged)|\bwithout breaking\b|\bbackwards? compat`)
+	reproMark   = regexp.MustCompile(`(?im)^\s*#+\s*(repro|reproduction|to reproduce|steps to reproduce)\b|^\s*(repro|reproduction) \d`)
+	manyRepros  = regexp.MustCompile(`(?i)\b(two|three|four|five|several|multiple|many|\d+) (repros|reproductions|reproducers|failing cases)\b`)
+	securityFix = regexp.MustCompile(`(?i)\b(security|vulnerab\w*|cve-\d+|path traversal|directory traversal|injection|xss|csrf|ssrf|auth(entication|orization)? bypass|privilege escalation|sanitis\w*|sanitiz\w*|escap(e|ing) (user )?input)\b`)
+)
+
+// complexLongBody is how long a report is, after the title, before its length
+// alone is a signal of reach: a few paragraphs, or a trace and a table.
+const complexLongBody = 2000
+
+var reachSignals = []reachSignal{
+	{"more than one file", func(body string) bool {
+		seen := map[string]bool{}
+		for _, f := range sourceFile.FindAllString(body, -1) {
+			seen[f] = true
+		}
+		return len(seen) > 1
+	}},
+	{"an API or protocol", wireWords.MatchString},
+	{"language rules", languageRul.MatchString},
+	{"a long report or several repros", func(body string) bool {
+		return len(body) > complexLongBody || strings.Count(body, "```") >= 4 || len(reproMark.FindAllString(body, -1)) > 1 ||
+			manyRepros.MatchString(body)
+	}},
+	{"a security fix", securityFix.MatchString},
+	{"existing tests that must keep passing", keepPassing.MatchString},
+}
+
+// reachText is what a fix is read for reach in: its body, or — for a task
+// written as one paragraph, which is the whole of most asks — its title.
+func reachText(title, body string) string {
+	if strings.TrimSpace(body) == "" {
+		return title
+	}
+	return body
+}
+
+// complexFix is the reach a fix's body shows, in words; empty is a simple fix.
+func complexFix(body string) string {
+	var hits []string
+	for _, s := range reachSignals {
+		if s.hit(body) {
+			hits = append(hits, s.name)
+		}
+	}
+	if len(hits) < 2 {
+		return ""
+	}
+	return strings.Join(hits, ", ")
+}
diff --git a/internal/crewroute/classify_test.go b/internal/crewroute/classify_test.go
new file mode 100644
index 0000000000..fbc183dc58
--- /dev/null
+++ b/internal/crewroute/classify_test.go
@@ -0,0 +1,105 @@
+package crewroute
+
+import "testing"
+
+func TestClassifyReadsTheKindOfWork(t *testing.T) {
+	cases := []struct {
+		name  string
+		task  Task
+		class Class
+		sure  bool
+	}{
+		{"a fix: title", Task{Text: "fix: avoid an overflow when formatting very large integers"}, Bugfix, true},
+		{"a bug tag", Task{Text: "[bug] export drops the last row of a table"}, Bugfix, true},
+		{"a stack trace", Task{Text: "config loader\n\nTraceback (most recent call last):\n  File \"x.py\", line 3\nKeyError: 'a'"}, Bugfix, true},
+		{"a crash in the title", Task{Text: "the diff tool crashes on repositories without an initial commit"}, Bugfix, true},
+		{"a bug label", Task{Text: "the chart looks odd", Labels: []string{"bug"}}, Bugfix, true},
+		{"a feature request", Task{Text: "Consider adding a percentile metric\n\n**Is your feature request related to a problem?**"}, OpenEnded, true},
+		{"a refactor title", Task{Text: "refactor(api): split the handler registry into modules"}, OpenEnded, true},
+		{"add something", Task{Text: "Add a --json flag to the status command"}, OpenEnded, true},
+		{"docs", Task{Text: "docs: explain the retry settings"}, OpenEnded, true},
+		{"an enhancement label", Task{Text: "the chart looks odd", Labels: []string{"enhancement"}}, OpenEnded, true},
+		{"a question", Task{Text: "Why does the scheduler skip the first job?"}, Other, true},
+		{"nothing to go on", Task{Text: "the widget"}, OpenEnded, false},
+		{"empty", Task{}, OpenEnded, false},
+	}
+	for _, tc := range cases {
+		got := Classify(tc.task)
+		if got.Class != tc.class || got.Sure != tc.sure {
+			t.Errorf("%s: %s (sure %v, %q), want %s (sure %v)", tc.name, got.Class, got.Sure, got.Why, tc.class, tc.sure)
+		}
+		if got.Why == "" {
+			t.Errorf("%s: a reading with no reason", tc.name)
+		}
+	}
+}
+
+// A HARNESS'S WRAPPER IS READ PAST: every task it hands out says "Implement
+// issue #N" and "make the existing test suite pass", and a signal that fires on
+// everything tells the router nothing.
+func TestClassifyReadsPastAHarnessWrapper(t *testing.T) {
+	wrapped := "Implement issue #12: [bug] export drops the last row of a table\n\nThe loop stops one short.\n\n" +
+		"Work in this repository. Implement the change and make the existing test suite pass. Do not weaken or delete tests to make them pass."
+	if got := Classify(Task{Text: wrapped}); got.Class != Bugfix {
+		t.Errorf("wrapped fix read as %s (%q)", got.Class, got.Why)
+	}
+	feature := "Implement issue #34: Remember the window size between sessions\n\nIt would be really useful to keep it for next time.\n\n" +
+		"Work in this repository. Implement the change and make the existing test suite pass."
+	if got := Classify(Task{Text: feature}); got.Class != OpenEnded {
+		t.Errorf("wrapped feature read as %s (%q)", got.Class, got.Why)
+	}
+}
+
+func TestParseEffortTakesAPersonsWords(t *testing.T) {
+	for word, want := range map[string]Effort{"": EffortKnee, "best": EffortBest, "thorough": EffortBest, "cheap": EffortCheap} {
+		if got, ok := ParseEffort(word); !ok || got != want {
+			t.Errorf("ParseEffort(%q) = %q, %v", word, got, ok)
+		}
+	}
+	if _, ok := ParseEffort("medium"); ok {
+		t.Error("an unknown effort word was accepted")
+	}
+}
+
+func TestLineageFoldsSnapshotsAndLevels(t *testing.T) {
+	cases := map[string]string{
+		"deepseek/deepseek-v4-flash-0731":    "deepseek/deepseek-v4-flash",
+		"~deepseek/deepseek-v4-flash-latest": "deepseek/deepseek-v4-flash",
+		"moonshotai/kimi-k3:high":            "moonshotai/kimi-k3",
+		"Z-AI/GLM-5.3-Flash":                 "z-ai/glm-5.3-flash",
+		"openai/gpt-5.5":                     "openai/gpt-5.5",
+		"qwen/qwen3.8-max-0902":              "qwen/qwen3.8-max",
+	}
+	for in, want := range cases {
+		if got := Lineage(in); got != want {
+			t.Errorf("Lineage(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// A DEFECT SAID IN PLAIN WORDS IS A FIX, a tiny edit is small whatever verb it
+// opens with, and a genuinely open ask stays open-ended.
+func TestClassifyPlainDefectsAndTinyEdits(t *testing.T) {
+	cases := []struct {
+		text  string
+		class Class
+	}{
+		{"Fix the bug in calc.py: add(a, b) returns a - b instead of a + b.", Bugfix},
+		{"Repair the export so it keeps the header row", Bugfix},
+		{"The pager is broken on narrow terminals", Bugfix},
+		{"sorting should keep equal items in order but it reorders them", Bugfix},
+		{"parse_date: expected 2024-01-02, got 2024-02-01", Bugfix},
+		{"tests/test_lists.py is failing: natural_list drops middle items", Bugfix},
+		{"add a one-line docstring to the helper in utils.py", Other},
+		{"fix a typo in the README", Other},
+		{"Add support for YAML config files", OpenEnded},
+		{"refactor the storage layer into separate packages", OpenEnded},
+		{"Design a plugin system for exporters", OpenEnded},
+		{"do a deep research on opensource coding agents and harnesses please", OpenEnded},
+	}
+	for _, tc := range cases {
+		if got := Classify(Task{Text: tc.text}); got.Class != tc.class {
+			t.Errorf("%q: %s (%q), want %s", tc.text, got.Class, got.Why, tc.class)
+		}
+	}
+}
diff --git a/internal/crewroute/fixtures_test.go b/internal/crewroute/fixtures_test.go
new file mode 100644
index 0000000000..736517a897
--- /dev/null
+++ b/internal/crewroute/fixtures_test.go
@@ -0,0 +1,53 @@
+package crewroute
+
+import "time"
+
+// released is a catalog row's release date.
+func released(year int, month time.Month, day int) time.Time {
+	return time.Date(year, month, day, 0, 0, 0, 0, time.UTC)
+}
+
+// Catalog rows as a live catalog lists them: per-token prices, context, open
+// weights, the published indexes and design-arena Elo, and the release date.
+var (
+	glmFlash = Model{ID: "z-ai/glm-5.3-flash", Open: true, PromptPrice: 4.5e-8, CompletionPrice: 6e-7, CacheReadPrice: 2.85e-8,
+		Intelligence: 41.8, Coding: 71.5, Agentic: 50.9, ArenaElo: 1348, Context: 1310720, Released: released(2026, 8, 26), Tools: true}
+	kimiK3 = Model{ID: "moonshotai/kimi-k3", Open: true, PromptPrice: 3e-6, CompletionPrice: 1.5e-5, CacheReadPrice: 3e-7,
+		Intelligence: 43.6, Coding: 76.2, Agentic: 50, ArenaElo: 1421, Context: 1048576, Released: released(2026, 7, 15), Tools: true}
+	v4Flash = Model{ID: "deepseek/deepseek-v4-flash", Open: true, PromptPrice: 7.168e-8, CompletionPrice: 1.4336e-7, CacheReadPrice: 1.4336e-8,
+		Intelligence: 24.2, Coding: 56.2, Agentic: 22.2, ArenaElo: 1216, Context: 1048576, Released: released(2026, 4, 23), Tools: true}
+	glm53 = Model{ID: "z-ai/glm-5.3", Open: true, PromptPrice: 1.4e-6, CompletionPrice: 4.4e-6, CacheReadPrice: 2.6e-7,
+		Intelligence: 44.8, Coding: 74.8, Agentic: 53.1, ArenaElo: 1387, Context: 1310720, Released: released(2026, 8, 16), Tools: true}
+	opus5 = Model{ID: "anthropic/claude-opus-5", PromptPrice: 5e-6, CompletionPrice: 2.5e-5, CacheReadPrice: 5e-7,
+		Intelligence: 50.8, Coding: 78, Agentic: 56.5, ArenaElo: 1372, Context: 1000000, Released: released(2026, 7, 23), Tools: true}
+	fable51 = Model{ID: "anthropic/claude-fable-5.1", PromptPrice: 1e-5, CompletionPrice: 5e-5, CacheReadPrice: 2.5e-7,
+		Intelligence: 53.4, Coding: 81.6, Agentic: 57.9, ArenaElo: 1421, Context: 1000000, Released: released(2026, 8, 31), Tools: true}
+	astra6 = Model{ID: "openai/gpt-6-astra", PromptPrice: 1e-5, CompletionPrice: 5e-5, CacheReadPrice: 1e-6,
+		Intelligence: 52.7, Coding: 76.9, Agentic: 51, Context: 1050000, Released: released(2026, 9, 3), Tools: true}
+)
+
+// candidateOf is a model reachable on the default service only.
+func candidateOf(m Model) Candidate {
+	return Candidate{Model: m, Routes: []Route{{Provider: "openrouter", Send: m.ID, Kind: Metered}}}
+}
+
+// catalogCandidates are three open models across the price range, each on the
+// default service.
+func catalogCandidates() []Candidate {
+	return []Candidate{candidateOf(glmFlash), candidateOf(kimiK3), candidateOf(v4Flash)}
+}
+
+// frontierCandidates are the three open models with a mid-price model and the
+// dearest frontier rows beside them.
+func frontierCandidates() []Candidate {
+	return append(catalogCandidates(), candidateOf(glm53), candidateOf(opus5), candidateOf(fable51), candidateOf(astra6))
+}
+
+// catalogRow is a model with published figures and no release date.
+func catalogRow(id string, open bool, in, out float64, intel, coding, agentic float64) Candidate {
+	return Candidate{
+		Model: Model{ID: id, Open: open, PromptPrice: in / 1e6, CompletionPrice: out / 1e6, CacheReadPrice: in / 1e7,
+			Intelligence: intel, Coding: coding, Agentic: agentic, Context: 1_000_000, Tools: true},
+		Routes: []Route{{Provider: "openrouter", Send: id, Kind: Metered}},
+	}
+}
diff --git a/internal/crewroute/law_test.go b/internal/crewroute/law_test.go
new file mode 100644
index 0000000000..3ea2efa050
--- /dev/null
+++ b/internal/crewroute/law_test.go
@@ -0,0 +1,45 @@
+package crewroute
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"strings"
+	"testing"
+)
+
+// NO PROVIDER IS NAMED IN THE ROUTER. A route is a provider, a send id, a kind
+// and a price; which provider is behind it is the caller's to know, and a
+// branch on one provider's name here would be a rule the next provider does
+// not get. The id-spelling tables (canonical.go) read how providers SPELL
+// model ids, which is data about ids, and are the one file allowed to.
+func TestTheRouterNamesNoProvider(t *testing.T) {
+	names := []string{"openrouter", "fireworks", "together", "ollama", "codex", "chatgpt", "groq", "deepinfra", "anthropic", "cloudflare"}
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") || name == "canonical.go" {
+			continue
+		}
+		file, err := parser.ParseFile(token.NewFileSet(), name, nil, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			lit, ok := n.(*ast.BasicLit)
+			if !ok || lit.Kind != token.STRING {
+				return true
+			}
+			for _, provider := range names {
+				if strings.Contains(strings.ToLower(lit.Value), provider) {
+					t.Errorf("%s names the provider %q in %s", name, provider, lit.Value)
+				}
+			}
+			return true
+		})
+	}
+}
diff --git a/internal/crewroute/prior.go b/internal/crewroute/prior.go
new file mode 100644
index 0000000000..db5bf180ca
--- /dev/null
+++ b/internal/crewroute/prior.go
@@ -0,0 +1,698 @@
+package crewroute
+
+import (
+	_ "embed"
+	"encoding/json"
+	"math"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// WHAT A SEAT IS WORTH, BEFORE THIS INSTALL HAS RUN ANYTHING.
+//
+// The router needs, for every class of work, every seat and every model it
+// might sit there, two numbers: how much that model in that seat adds to the
+// work's quality, and what it costs. Both are read off the model's own
+// catalog row through fitted weights (prior.json, embedded). No model has a
+// row of its own there: every model, whoever makes it, is scored the same way.
+//
+//  1. ABILITY FROM METADATA. A model's ability is a latent number predicted
+//     from the fields its catalog row carries. The weights are a joint
+//     Gaussian over the ability and those fields ([weights.Mean],
+//     [weights.Cov]); a row is scored by conditioning on the fields it HAS,
+//     and a field it lacks is integrated out, which widens the variance.
+//     A row that publishes any index — the intelligence, coding or agentic
+//     index, or the design-arena Elo ([weights.IndexFeatures]) — is scored
+//     from those indexes alone: nothing else on the row raises or lowers it,
+//     so a model at least as good on every index and no dearer is never
+//     scored below another. A row that publishes none is scored from its
+//     context length, release date and licence ([weights.BaseFeatures]), and
+//     its product family ([familyOf]) moves the mean by the family's fitted
+//     offset. Price is never read as ability: it is the cost.
+//
+//  2. ABILITY TO A SEAT. The ability is mapped to an expected solve rate u in
+//     (0, 1) ([weights.Ability]), and each (class, seat) reads u through its
+//     own linear link: quality = level + slope·(u − u_ref), on the 0–10 crew
+//     scale ([seatLink]). The slope is what the seat pays for ability in that
+//     class of work; its standard deviation is how sure the fit is of it.
+//     A seat is weighed at the ability's mean less [riskKappa] of its
+//     standard deviation, so a row the weights know less about is weighed
+//     below one they know well at the same mean.
+//
+//  3. THIS INSTALL'S OUTCOMES. What a person kept or redid, per class, seat
+//     and model, moves the quality by a bounded amount ([Request.Learned]).
+//
+// A model the weights cannot say enough about — its variance barely below the
+// prior's, because its row carries almost nothing ([weights.EvidenceMaxRatio])
+// — sits no seat unless a person pins it. Nor does a model whose ability's
+// upper bound falls under the weakest ability the weights credit with doing
+// the work ([weights.UFloor]).
+//
+// The cost of a seat is the seat's token shape — how much it reads fresh, how
+// much it reads back from a warm cache, how much it writes on an ordinary task
+// — priced at the route's published per-token prices and scaled per class and
+// seat ([weights.CostScale]).
+
+//go:embed prior.json
+var priorJSON []byte
+
+// shape is one seat's tokens on an ordinary task.
+type shape struct {
+	Prompt     float64 `json:"prompt"`
+	Cached     float64 `json:"cached"`
+	Completion float64 `json:"completion"`
+}
+
+// seatLink is one (class, seat)'s link from ability to quality.
+type seatLink struct {
+	Level   float64 `json:"level"`
+	Slope   float64 `json:"slope"`
+	SlopeSD float64 `json:"slope_sd"`
+}
+
+// classLink is one class's links, around the ability u_ref they are centred on.
+type classLink struct {
+	URef  float64           `json:"u_ref"`
+	Seats map[Seat]seatLink `json:"seats"`
+}
+
+// weights is prior.json read.
+type weights struct {
+	Knee float64 `json:"knee_per_usd"`
+	// Features names the metadata columns after the ability, in the order of
+	// Loc, Scale, Mean and Cov (whose index 0 is the ability).
+	Features []string `json:"features"`
+	// IndexFeatures are the published indexes a row is scored from when it
+	// carries any; BaseFeatures what a row with none is scored from.
+	IndexFeatures []string    `json:"index_features"`
+	BaseFeatures  []string    `json:"base_features"`
+	Loc           []float64   `json:"loc"`
+	Scale         []float64   `json:"scale"`
+	Mean          []float64   `json:"mean"`
+	Cov           [][]float64 `json:"cov"`
+	// VarScale calibrates the conditional variance.
+	VarScale float64 `json:"var_scale"`
+	// FamilyRho is the share of residual variance a family explains, and
+	// Families each family's offset (in residual standard deviations) and the
+	// variance left in that offset.
+	FamilyRho float64               `json:"family_rho"`
+	Families  map[string][2]float64 `json:"families"`
+	// Ability maps the latent ability to an expected solve rate:
+	// u = σ(A·θ + B).
+	Ability struct {
+		A float64 `json:"a"`
+		B float64 `json:"b"`
+	} `json:"ability"`
+	// UFloor is the least solve rate a model's upper bound must reach to sit
+	// a seat.
+	UFloor float64 `json:"u_floor"`
+	// EvidenceMaxRatio is the most the ability's variance may keep of the
+	// prior's for a model to be scored at all.
+	EvidenceMaxRatio float64                    `json:"evidence_max_ratio"`
+	Link             map[Class]classLink        `json:"link"`
+	Shapes           map[Seat]shape             `json:"shapes"`
+	CostScale        map[Class]map[Seat]float64 `json:"cost_scale"`
+	index            map[string]int             // feature name → column
+	cols             [len(featureNames)]int     // featureNames' columns, zero for one the weights lack
+	isIndex, isBase  [len(featureNames)]bool    // featureNames' roles
+	priorVar         float64                    // the ability's own variance, standardised
+}
+
+// table is one decision's view of the weights: the weights, the abilities
+// already read this decision, this install's learned moves, and the cost floor
+// of each seat over the candidates in front of it.
+type table struct {
+	*weights
+	learned map[string]float64
+	floors  map[Seat]float64
+	// priced is [table.pricedLadder], built from candidates on first use.
+	priced     map[Seat][]pricePoint
+	candidates []Candidate
+	cache      map[string]ability
+	// rescue is a table asked for a seat's last rungs ([Request.Rescue]).
+	rescue bool
+	// abilityFloor is whether any candidate's mean ability reaches the
+	// floor ([table.seatCredible]).
+	abilityFloor bool
+	// cheapTolerance, above one, is how many times a cheap pick's cost a
+	// worker may cost and still be preferred for being stronger
+	// ([Request.Effort] cheap).
+	cheapTolerance float64
+}
+
+var (
+	loaded   *weights
+	loadOnce sync.Once
+)
+
+// load reads the weights once. Weights that do not parse are a build that
+// must not ship, so it panics at first use the way a malformed embedded asset
+// does everywhere else in this tree, and a test reads it on every run.
+func load() *weights {
+	loadOnce.Do(func() {
+		var w weights
+		if err := json.Unmarshal(priorJSON, &w); err != nil {
+			panic("crewroute: prior.json: " + err.Error())
+		}
+		n := len(w.Features) + 1
+		if len(w.Loc) != n || len(w.Scale) != n || len(w.Mean) != n || len(w.Cov) != n {
+			panic("crewroute: prior.json: the ability model's dimensions disagree")
+		}
+		w.index = map[string]int{}
+		for i, f := range w.Features {
+			w.index[f] = i + 1
+		}
+		for i, f := range featureNames {
+			w.cols[i] = w.index[f]
+			w.isIndex[i] = holds(w.IndexFeatures, f)
+			w.isBase[i] = holds(w.BaseFeatures, f)
+		}
+		w.priorVar = w.Cov[0][0]
+		if w.VarScale <= 0 {
+			w.VarScale = 1
+		}
+		loaded = &w
+	})
+	return loaded
+}
+
+// holds is whether a list names a word.
+func holds(words []string, word string) bool {
+	for _, w := range words {
+		if w == word {
+			return true
+		}
+	}
+	return false
+}
+
+// prior is a fresh decision's table: nothing learned, no candidates seen.
+func prior() *table {
+	w := load()
+	return &table{weights: w, cache: map[string]ability{}}
+}
+
+// forDecision is the table one decision reads: this install's learned moves
+// and each seat's cost floor over the candidates.
+func forDecision(candidates []Candidate, learned map[string]float64) *table {
+	t := prior()
+	t.cache = make(map[string]ability, len(candidates))
+	t.learned = learned
+	t.floors = t.floorsOf(candidates)
+	return t
+}
+
+// ability is what the weights say about one model: the solve rate u, its
+// variance, the solve rate a seat weighs it at (u at the ability's mean less
+// [riskKappa] standard deviations), the latent ability's variance, whether
+// the row carried enough to be scored at all and whether it was scored from
+// published indexes — with the model's lineage and whether it is a quantised
+// copy, read once.
+type ability struct {
+	U, VarU  float64
+	UScore   float64
+	Theta    float64
+	VarTheta float64
+	Indexed  bool
+	Known    bool
+	lineage  string
+	quant    bool
+}
+
+// abilityOf reads one model's ability, once per decision.
+func (t *table) abilityOf(m Model) ability {
+	if a, ok := t.cache[m.ID]; ok {
+		return a
+	}
+	a := remembered(t.weights, m)
+	if t.cache != nil {
+		t.cache[m.ID] = a
+	}
+	return a
+}
+
+// The abilities of the rows seen lately, keyed by the whole row: a row that
+// changes — a new price, an index published — is a new key and is read
+// again. The memo is dropped whole when it grows past memoRows.
+var (
+	memoMu sync.Mutex
+	memo   = map[Model]ability{}
+)
+
+const memoRows = 8192
+
+// remembered is [weights.abilityOf] through the memo.
+func remembered(w *weights, m Model) ability {
+	memoMu.Lock()
+	a, ok := memo[m]
+	memoMu.Unlock()
+	if ok {
+		return a
+	}
+	a = w.abilityOf(m)
+	memoMu.Lock()
+	if len(memo) >= memoRows {
+		memo = map[Model]ability{}
+	}
+	memo[m] = a
+	memoMu.Unlock()
+	return a
+}
+
+// featureNames are the metadata fields the router can read off a model, in
+// the order [weights.features] reads them.
+var featureNames = [...]string{"lp_in", "lp_out", "lctx", "date", "open", "aa_int", "aa_cod", "aa_ag", "elo"}
+
+// features is the metadata a model is scored from, in the weights' columns,
+// NaN where the row does not carry the field or the field is not read: a row
+// that carries any index is read on its indexes only, and a row with none on
+// its base fields. The second answer is whether the row took the index path.
+func (w *weights) features(m Model) ([]float64, bool) {
+	x := make([]float64, len(w.Features))
+	for i := range x {
+		x[i] = math.NaN()
+	}
+	open := 0.0
+	if m.Open {
+		open = 1
+	}
+	values := [len(featureNames)]float64{
+		math.Log10(m.PromptPrice * 1e6), math.Log10(m.CompletionPrice * 1e6), math.Log2(float64(m.Context)),
+		yearsSince2024(m.Released), open, m.Intelligence, m.Coding, m.Agentic, m.ArenaElo,
+	}
+	has := [len(featureNames)]bool{
+		m.PromptPrice > 0, m.CompletionPrice > 0, m.Context > 0, !m.Released.IsZero(), true,
+		m.Intelligence > 0, m.Coding > 0, m.Agentic > 0, m.ArenaElo > 0,
+	}
+	indexed := false
+	for i, col := range w.cols {
+		if col > 0 && has[i] && w.isIndex[i] {
+			indexed = true
+		}
+	}
+	for i, col := range w.cols {
+		read := w.isBase[i]
+		if indexed {
+			read = w.isIndex[i]
+		}
+		if col > 0 && has[i] && read {
+			x[col-1] = values[i]
+		}
+	}
+	return x, indexed
+}
+
+// yearsSince2024 is a release date as the weights read it.
+func yearsSince2024(at time.Time) float64 {
+	return at.Sub(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)).Hours() / 24 / 365.25
+}
+
+// riskKappa is how many standard deviations of ability a seat weighs a model
+// below its mean.
+const riskKappa = 1.0
+
+// abilityOf conditions the joint Gaussian on the fields a row is read by,
+// adds the family's offset to a row without indexes, and maps the ability to
+// a solve rate.
+func (w *weights) abilityOf(m Model) ability {
+	x, indexed := w.features(m)
+	var obs [maxFeatures]int
+	var z, so0 [maxFeatures]float64
+	var soo [maxFeatures][maxFeatures]float64
+	k := 0
+	for i, v := range x {
+		if !math.IsNaN(v) && k < maxFeatures {
+			col := i + 1
+			obs[k] = col
+			z[k] = (v-w.Loc[col])/w.Scale[col] - w.Mean[col]
+			k++
+		}
+	}
+	for i := 0; i < k; i++ {
+		for j := 0; j < k; j++ {
+			soo[i][j] = w.Cov[obs[i]][obs[j]]
+		}
+		so0[i] = w.Cov[obs[i]][0]
+	}
+	mean, variance := w.Mean[0], w.priorVar
+	// K = S_0o S_oo⁻¹: solve S_oo k = S_o0.
+	if gain, ok := solveSPD(&soo, &so0, k); ok {
+		for i := 0; i < k; i++ {
+			mean += gain[i] * z[i]
+			variance -= gain[i] * so0[i]
+		}
+	}
+	variance = math.Max(variance, 1e-6)
+	known := variance/w.priorVar <= w.EvidenceMaxRatio+1e-9
+	canon := CanonicalOf(m.ID)
+	theta := mean*w.Scale[0] + w.Loc[0]
+	v := variance * w.Scale[0] * w.Scale[0]
+	if !indexed {
+		if off, ok := w.Families[familyKey(canon.ID)]; ok {
+			theta += math.Sqrt(v) * off[0]
+			v *= 1 - w.FamilyRho + off[1]
+		}
+		// A ROW WITH NO PUBLISHED INDEX IS NEVER SCORED ABOVE THE POPULATION'S
+		// MEAN: what its date, context, licence and family would add stands in
+		// for indexes it does not publish, so it widens the variance instead.
+		if pop := w.Mean[0]*w.Scale[0] + w.Loc[0]; theta > pop {
+			v += (theta - pop) * (theta - pop)
+			theta = pop
+		}
+	}
+	v *= w.VarScale
+	a, b := w.Ability.A, w.Ability.B
+	spread := math.Sqrt(1 + math.Pi*a*a*v/8)
+	u := sigmoid((a*theta + b) / spread)
+	d := a * u * (1 - u)
+	score := sigmoid((a*(theta-riskKappa*math.Sqrt(v)) + b) / spread)
+	return ability{U: u, VarU: d * d * v, UScore: score, Theta: theta, VarTheta: v, Known: known, Indexed: indexed,
+		lineage: canon.String(), quant: canon.Variant != ""}
+}
+
+// maxFeatures bounds the metadata columns the ability is read from.
+const maxFeatures = 16
+
+// solveSPD solves A x = b for the leading n×n block of a small symmetric
+// positive-definite A by Cholesky, false when it is not.
+func solveSPD(a *[maxFeatures][maxFeatures]float64, b *[maxFeatures]float64, n int) ([maxFeatures]float64, bool) {
+	var l [maxFeatures][maxFeatures]float64
+	var y, x [maxFeatures]float64
+	if n == 0 {
+		return x, false
+	}
+	for i := 0; i < n; i++ {
+		for j := 0; j <= i; j++ {
+			sum := a[i][j]
+			for k := 0; k < j; k++ {
+				sum -= l[i][k] * l[j][k]
+			}
+			if i == j {
+				if sum <= 0 {
+					return x, false
+				}
+				l[i][i] = math.Sqrt(sum)
+			} else {
+				l[i][j] = sum / l[j][j]
+			}
+		}
+	}
+	for i := 0; i < n; i++ {
+		sum := b[i]
+		for k := 0; k < i; k++ {
+			sum -= l[i][k] * y[k]
+		}
+		y[i] = sum / l[i][i]
+	}
+	for i := n - 1; i >= 0; i-- {
+		sum := y[i]
+		for k := i + 1; k < n; k++ {
+			sum -= l[k][i] * x[k]
+		}
+		x[i] = sum / l[i][i]
+	}
+	return x, true
+}
+
+func sigmoid(x float64) float64 { return 1 / (1 + math.Exp(-x)) }
+
+// familyOf is a model's product family: its vendor and its name with the
+// version numbers taken out — `z-ai/glm-5.3-flash` is `z-ai/glm-flash`, and a
+// token such as `v4`, `k3` or `30b` that is mostly a number is dropped whole.
+// A new version of a family starts from what the family's earlier versions
+// were fitted to.
+func familyOf(id string) string { return familyKey(CanonicalOf(id).ID) }
+
+// familyKey is [familyOf] on an id already read by [CanonicalOf].
+func familyKey(canon string) string {
+	vendor, name := "", canon
+	if at := strings.LastIndex(canon, "/"); at >= 0 {
+		vendor, name = canon[:at+1], canon[at+1:]
+	}
+	var keep []string
+	for _, tok := range strings.FieldsFunc(name, func(r rune) bool { return r == '-' || r == '.' }) {
+		stripped := strings.Map(func(r rune) rune {
+			if r >= '0' && r <= '9' {
+				return -1
+			}
+			return r
+		}, tok)
+		if stripped != tok && len(stripped) <= 2 {
+			continue
+		}
+		if stripped != "" {
+			keep = append(keep, stripped)
+		}
+	}
+	return vendor + strings.Join(keep, "-")
+}
+
+// linkOf is a class's link, the average of the others for a class the weights
+// do not carry.
+func (t *table) linkOf(class Class) classLink {
+	if l, ok := t.Link[class]; ok {
+		return l
+	}
+	return t.Link[Other]
+}
+
+// quality is what one model adds in one seat for one class of work — the
+// link at the solve rate the seat weighs the model at, plus what this install
+// learned — and its standard deviation. It is a score on the crew scale, not
+// clamped to it, so a weaker model is always scored below a stronger one.
+func (t *table) quality(class Class, seat Seat, m Model) (q, sd float64) {
+	return t.qualityOf(class, seat, t.abilityOf(m))
+}
+
+// qualityOf is [table.quality] on an ability already read.
+func (t *table) qualityOf(class Class, seat Seat, a ability) (q, sd float64) {
+	link := t.linkOf(class)
+	s := link.Seats[seat]
+	du := a.U - link.URef
+	q = s.Level + s.Slope*(a.UScore-link.URef)
+	sd = math.Sqrt(s.Slope*s.Slope*a.VarU + du*du*s.SlopeSD*s.SlopeSD)
+	if a.quant {
+		// A QUANTISED LOCAL COPY is credited with a share of its model's
+		// quality: the weights read the model's row, and the copy is squeezed.
+		q *= quantDiscount
+	}
+	if len(t.learned) > 0 {
+		q += t.learned[learnKey(class, seat, a.lineage)]
+	}
+	return q, sd
+}
+
+// credible is whether a model may sit a seat: its row says enough to score
+// it, and the upper bound of its ability reaches the weakest ability the
+// weights credit with doing the work.
+func (t *table) credible(m Model) bool { return t.credibleAt(t.abilityOf(m)) }
+
+// credibleAt is [table.credible] on an ability already read.
+func (t *table) credibleAt(a ability) bool {
+	return a.Known && a.U+2*math.Sqrt(a.VarU) >= t.UFloor
+}
+
+// seatCredible is [table.credibleAt] for one seat. THE WORKER AND THE
+// CHECKER ARE NEVER "ANY MODEL WILL DO": one does the work and the other
+// decides whether it is accepted, so each one's ability mean — not only its
+// upper bound — must reach the floor, whenever any candidate's does. A set of
+// allowed models with none that reaches it is still crewed, and [Gaps] says
+// the checker is weak.
+func (t *table) seatCredible(seat Seat, a ability) bool {
+	if !t.credibleAt(a) {
+		return false
+	}
+	return seat == Planner || !t.abilityFloor || a.U >= t.UFloor
+}
+
+// pricePoint is one ability on a seat's price ladder and the least a
+// credible priced model at least that able costs there.
+type pricePoint struct {
+	U, Cost float64
+}
+
+// floorsOf is each seat's cost floor over the candidates: the cheapest flat
+// cost of a credible model with a published price. It keeps the candidates
+// for the price ladder [table.priceFor] builds when an unpriced model asks.
+func (t *table) floorsOf(candidates []Candidate) map[Seat]float64 {
+	floors := map[Seat]float64{}
+	t.candidates = candidates
+	for _, c := range candidates {
+		if c.Model.PromptPrice <= 0 && c.Model.CompletionPrice <= 0 {
+			continue
+		}
+		a := t.abilityOf(c.Model)
+		if !t.credibleAt(a) {
+			continue
+		}
+		if a.U >= t.UFloor && seatable(Checker, c) {
+			t.abilityFloor = true
+		}
+		for _, seat := range Seats {
+			if !seatable(seat, c) {
+				continue
+			}
+			cost := t.seatCost(seat, c.Model)
+			if cost <= 0 {
+				continue
+			}
+			if held, ok := floors[seat]; !ok || cost < held {
+				floors[seat] = cost
+			}
+		}
+	}
+	return floors
+}
+
+// pricedLadder is, per seat, the credible priced candidates by ability, best
+// first, each with the least cost of any at least that able.
+func (t *table) pricedLadder() map[Seat][]pricePoint {
+	if t.priced != nil {
+		return t.priced
+	}
+	t.priced = map[Seat][]pricePoint{}
+	for _, c := range t.candidates {
+		if c.Model.PromptPrice <= 0 && c.Model.CompletionPrice <= 0 {
+			continue
+		}
+		a := t.abilityOf(c.Model)
+		if !t.credibleAt(a) {
+			continue
+		}
+		for _, seat := range Seats {
+			if cost := t.seatCost(seat, c.Model); cost > 0 && seatable(seat, c) {
+				t.priced[seat] = append(t.priced[seat], pricePoint{U: a.U, Cost: cost})
+			}
+		}
+	}
+	for seat, points := range t.priced {
+		sort.Slice(points, func(i, j int) bool { return points[i].U > points[j].U })
+		for i := 1; i < len(points); i++ {
+			points[i].Cost = math.Min(points[i].Cost, points[i-1].Cost)
+		}
+		t.priced[seat] = points
+	}
+	return t.priced
+}
+
+// costFloor is the least flat cost of a credible priced model in a seat.
+func (t *table) costFloor(seat Seat) float64 { return t.floors[seat] }
+
+// priceFor is what a model that publishes no price is weighed at in a seat:
+// A PRICE OF ZERO IS NOT EVIDENCE OF VALUE, so it is the least any credible
+// priced model at least as able costs there — or, when none is as able, the
+// dearest of them.
+func (t *table) priceFor(seat Seat, u float64) float64 {
+	points := t.pricedLadder()[seat]
+	if len(points) == 0 {
+		return 0
+	}
+	// points run best first; the last one at least as able holds the least
+	// cost among all at least as able.
+	at := sort.Search(len(points), func(i int) bool { return points[i].U < u })
+	if at == 0 {
+		dearest := 0.0
+		for _, p := range points {
+			dearest = math.Max(dearest, p.Cost)
+		}
+		return dearest
+	}
+	return points[at-1].Cost
+}
+
+// seatCost is what one model is expected to cost in one seat on an ordinary
+// task at the prices it publishes, scaled for the seat. A route that bills
+// nothing per token (a subscription, a local model) is priced by the caller,
+// not here. Classes share the flat shape; [table.classCost] scales it.
+func (t *table) seatCost(seat Seat, m Model) float64 {
+	s := t.Shapes[seat]
+	cached := m.CacheReadPrice
+	if cached <= 0 {
+		// A provider that publishes no cache-read price is paid the prompt
+		// price on what it reads back — the dearer reading, never a free one.
+		cached = m.PromptPrice
+	}
+	return s.Prompt*m.PromptPrice + s.Cached*cached + s.Completion*m.CompletionPrice
+}
+
+// classCost is a seat's expected dollars for one task of a class: the flat
+// shape's cost times the class and seat's fitted scale.
+func (t *table) classCost(class Class, seat Seat, m Model) float64 {
+	return t.seatCost(seat, m) * t.costScale(class, seat)
+}
+
+// costScale is a class and seat's fitted ratio of dollars to the flat shape,
+// one when the weights carry none.
+func (t *table) costScale(class Class, seat Seat) float64 {
+	if byseat, ok := t.CostScale[class]; ok {
+		if s := byseat[seat]; s > 0 {
+			return s
+		}
+	}
+	if s := t.CostScale[Other][seat]; s > 0 {
+		return s
+	}
+	return 1
+}
+
+// LearnKey is the key a learned quality move is kept under: the class, the
+// seat and the model's lineage.
+func LearnKey(class Class, seat Seat, model string) string {
+	return learnKey(class, seat, Lineage(model))
+}
+
+// learnKey is [LearnKey] on a lineage already read.
+func learnKey(class Class, seat Seat, lineage string) string {
+	return string(class) + "\x00" + string(seat) + "\x00" + lineage
+}
+
+// learnedOf is the learned move for one model in one seat, zero for none.
+func (t *table) learnedOf(class Class, seat Seat, a ability) float64 {
+	if len(t.learned) == 0 {
+		return 0
+	}
+	return t.learned[learnKey(class, seat, a.lineage)]
+}
+
+// Lineage is the id a model's quality is kept under: its canonical identity
+// across every provider's spelling ([CanonicalOf]) — lowercase, a provider's
+// namespace and a route suffix (`:free`, `:nitro`) taken off, a thinking
+// level, a floating alias's `~` and `-latest`, and a dated snapshot suffix
+// taken off. `deepseek/deepseek-v4-flash-0731` is the same lineage as
+// `deepseek/deepseek-v4-flash`, and so is its free pool: a route is not a
+// model. A quantised local copy keeps its variant after `@`, so it is never
+// mistaken for the model it was squeezed from.
+func Lineage(id string) string { return CanonicalOf(id).String() }
+
+// lineageTail is [Lineage]'s own rules on an id already read by
+// [CanonicalOf]: `-latest` and a dated snapshot suffix taken off.
+func lineageTail(id string) string {
+	id = strings.TrimSuffix(id, "-latest")
+	if at := strings.LastIndex(id, "-"); at > 0 {
+		if tail := id[at+1:]; (len(tail) == 4 || len(tail) == 8) && allDigits(tail) {
+			id = id[:at]
+		}
+	}
+	return id
+}
+
+// allDigits is whether a word is made of ASCII digits only.
+func allDigits(word string) bool {
+	for i := 0; i < len(word); i++ {
+		if word[i] < '0' || word[i] > '9' {
+			return false
+		}
+	}
+	return word != ""
+}
+
+// Scorable is whether the weights can score a model at all from what its row
+// carries — enough metadata for a finite-variance ability — for a caller that
+// offers models and wants to say which the router may pick unpinned.
+func Scorable(m Model) bool { return load().abilityOf(m).Known }
+
+// Knee is the default price of a quality point, in points per dollar — see
+// [Route] for why this is the knee of the quality-cost front.
+func Knee() float64 { return load().Knee }
diff --git a/internal/crewroute/prior.json b/internal/crewroute/prior.json
new file mode 100644
index 0000000000..1aa2b82164
--- /dev/null
+++ b/internal/crewroute/prior.json
@@ -0,0 +1 @@
+{"ability":{"a":1.69289,"b":-2.39415},"about":"crew prior: ability from catalog metadata (joint Gaussian; a row with any published index is conditioned on its indexes only, a row with none on its base fields plus a family offset), and a per-(class, seat) linear link from ability to seat quality","base_features":["lctx","date","open"],"cost_scale":{"bugfix":{"checker":0.797,"planner":1.636,"worker":2.928},"openended":{"checker":2.304,"planner":3.027,"worker":5.829},"other":{"checker":1.55,"planner":2.332,"worker":4.378}},"cov":[[1.030461,0.416575,0.583581,0.501484,0.747589,-0.305773,0.847848,0.897998,0.807642,0.86204],[0.416575,0.993129,1.029271,0.361442,0.139927,-0.40675,0.584541,0.55341,0.524119,0.439355],[0.583581,1.029271,1.506385,0.466973,0.257412,-0.58702,0.783987,0.75326,0.702375,0.614275],[0.501484,0.361442,0.466973,1.081343,0.371667,-0.202468,0.602851,0.607486,0.567244,0.470639],[0.747589,0.139927,0.257412,0.371667,1.073949,-0.211271,0.714962,0.793748,0.689152,0.797933],[-0.305773,-0.40675,-0.58702,-0.202468,-0.211271,1.011656,-0.437372,-0.413516,-0.366752,-0.334855],[0.847848,0.584541,0.783987,0.602851,0.714962,-0.437372,1.692432,1.04365,1.020982,0.939495],[0.897998,0.55341,0.75326,0.607486,0.793748,-0.413516,1.04365,1.600639,0.998652,1.003052],[0.807642,0.524119,0.702375,0.567244,0.689152,-0.366752,1.020982,0.998652,1.577331,0.895046],[0.86204,0.439355,0.614275,0.470639,0.797933,-0.334855,0.939495,1.003052,0.895046,1.650216]],"evidence_max_ratio":0.7,"families":{"01-ai/yi-chat":[-0.8166,0.2498],"01-ai/yi-coder":[-0.6075,0.2498],"01-ai/yi-coder-chat":[-0.4706,0.2498],"01-ai/yi-lightning":[-0.0358,0.2498],"allenai/olmo-instruct":[-0.7382,0.2498],"amazon/nova-pro":[-0.4706,0.2498],"amazon/nova-pro-preview":[0.0235,0.2498],"ant-group/ring":[-0.0835,0.2498],"anthropic/claude":[0.204,0.1681],"anthropic/claude-code":[0.4376,0.2498],"anthropic/claude-fable":[0.8626,0.1681],"anthropic/claude-haiku":[0.1272,0.1016],"anthropic/claude-haiku-latest+claude-sonnet":[-0.0034,0.2498],"anthropic/claude-opus":[0.4676,0.032],"anthropic/claude-opus-+gpt":[-0.1558,0.2498],"anthropic/claude-opus-[high]":[0.4659,0.2498],"anthropic/claude-opus-high":[0.0917,0.2498],"anthropic/claude-sonnet":[0.5528,0.0366],"anthropic/claude-sonnet-+claude-haiku-+gemini-pro-preview-+gemini-flash-preview-mini-+gpt-mini+text-embedding-small":[0.0619,0.2498],"anthropic/claude-sonnet-+claude-opus+gpt-global+gemini-pro":[0.2895,0.2498],"anthropic/claude-sonnet-+claude-opus-+claude-sonnet-+gemini-pro-preview":[0.2744,0.2498],"anthropic/claude-sonnet-+claude-sonnet":[-0.0289,0.2498],"anthropic/claude-sonnet-+claude-sonnet-+gemini-pro+gpt":[0.2252,0.2498],"anthropic/claude-sonnet-+deepseek":[0.0442,0.2498],"anthropic/claude-sonnet-+gemini-pro-preview":[0.0853,0.2498],"anthropic/claude-sonnet-+gpt":[0.3465,0.0849],"anthropic/claude-sonnet-+gpt-preview":[-0.0589,0.2498],"anthropic/claude-sonnet-+o+gemini-pro":[0.2163,0.2498],"anthropic/claude-sonnet-+o+o-mini":[0.2185,0.2498],"anthropic/claude-sonnet-[high]":[0.3953,0.2498],"anthropic/claude-sonnet-high":[-0.1903,0.2498],"anthropic/claude-sonnet-mini":[0.2165,0.1267],"anthropic/claude-sonnet-mini+o-mini":[0.1473,0.1681],"anthropic/fable-[high]":[0.4776,0.2498],"anysphere/cursor":[0.3564,0.2498],"arcee-ai/trinity-large":[-0.3179,0.2498],"bytedance-seed/doubao":[-0.0753,0.2498],"bytedance-seed/doubao-pro":[-0.2219,0.1681],"bytedance-seed/doubao-seed-code+doubao-seed":[0.3212,0.2498],"bytedance-seed/seed-pro-preview":[0.2453,0.2498],"cognition/swe":[0.3524,0.1267],"cohere/cai-command-a":[-0.1953,0.2498],"cohere/command-a":[-0.2322,0.2498],"cohere/command-a-plus":[-0.299,0.2498],"cohere/command-a-quality":[-0.3743,0.2498],"cohere/command-r":[-0.6885,0.1267],"cohere/command-r+":[-0.7138,0.2498],"cohere/command-r-plus":[-0.561,0.1267],"cursor/composer":[0.2738,0.2498],"deep-cogito/cogito":[0.1509,0.2498],"deepseek/deepseek":[0.4873,0.0849],"deepseek/deepseek-+-claude-sonnet":[0.0638,0.2498],"deepseek/deepseek-chat":[0.221,0.0849],"deepseek/deepseek-coder":[0.1863,0.1681],"deepseek/deepseek-coder-instruct":[-1.0365,0.1267],"deepseek/deepseek-coder-lite-instruct":[-0.3438,0.2498],"deepseek/deepseek-distill-llama":[0.2045,0.2498],"deepseek/deepseek-distill-qwen":[-0.2833,0.2498],"deepseek/deepseek-exp":[0.2972,0.2498],"deepseek/deepseek-flash":[0.4046,0.1681],"deepseek/deepseek-flash-[high]":[0.1776,0.2498],"deepseek/deepseek-flash-high-preview":[0.1582,0.2498],"deepseek/deepseek-lite-chat":[-1.0617,0.2498],"deepseek/deepseek-lite-preview":[-0.0789,0.2498],"deepseek/deepseek-local":[0.0257,0.1681],"deepseek/deepseek-preview":[0.1261,0.2498],"deepseek/deepseek-pro":[0.093,0.2498],"deepseek/deepseek-pro-[high]":[0.2165,0.2498],"deepseek/deepseek-pro-high-preview":[0.2605,0.2498],"deepseek/deepseek-speciale":[0.0984,0.2498],"deepseek/deepseek-terminus":[0.356,0.2498],"google/gemini-exp":[0.3081,0.2498],"google/gemini-flash":[-0.1397,0.0426],"google/gemini-flash-exp":[-0.479,0.1267],"google/gemini-flash-lite":[-0.4325,0.1267],"google/gemini-flash-lite-preview":[-0.1802,0.1016],"google/gemini-flash-preview":[0.222,0.0728],"google/gemini-flash-thinking-exp":[0.0202,0.2498],"google/gemini-pro":[0.2119,0.0728],"google/gemini-pro-exp":[0.2358,0.1267],"google/gemini-pro-preview":[0.509,0.1016],"google/gemini-pro-preview-customtools":[0.134,0.2498],"google/gemma":[0.2137,0.1681],"google/gemma-it":[-0.4465,0.0638],"https:/deepswe-preview":[0.0238,0.2498],"ibm-granite/granite":[-0.8232,0.1681],"inception/mercury":[-0.5088,0.2498],"jetbrains/junie":[0.4553,0.2498],"kat-coder-pro":[-0.1509,0.2498],"meta-llama/llama":[-0.5451,0.2498],"meta-llama/llama-+qwen":[-0.0684,0.2498],"meta-llama/llama-chat-hf":[-1.3179,0.2498],"meta-llama/llama-instruct":[0.1213,0.0728],"meta-llama/llama-maverick":[-0.2921,0.2498],"meta-llama/llama-maverick-instruct":[-0.0685,0.1681],"meta-llama/llama-nemotron-instruct":[0.0048,0.2498],"meta-llama/llama-nemotron-instruct-hf":[-0.4491,0.2498],"meta-llama/llama-nemotron-nano":[-0.0623,0.2498],"meta-llama/llama-nemotron-ultra":[0.5961,0.2498],"meta-llama/llama-scout-instruct":[-0.5931,0.1681],"meta-llama/llama-swe-rl":[-0.0627,0.2498],"meta-llama/muse-glimmer":[-0.0425,0.2498],"meta-llama/muse-spark":[0.3923,0.1016],"microsoft/phi":[-0.0766,0.2498],"microsoft/phi-medium-instruct":[-0.239,0.1681],"microsoft/phi-mini-instruct":[-1.0062,0.1016],"microsoft/phi-moe-instruct":[-0.357,0.2498],"microsoft/phi-small-instruct":[-0.4657,0.1681],"microsoft/wizardlm":[0.0645,0.2498],"minimax/minimax":[0.4869,0.0728],"minimax/minimax-preview":[0.4037,0.2498],"mistralai/codestral":[-0.7278,0.1681],"mistralai/codestral-k-m":[-0.5618,0.2498],"mistralai/devstral":[-0.0415,0.1681],"mistralai/devstral-instruct":[0.222,0.2498],"mistralai/devstral-small":[-0.1252,0.2498],"mistralai/devstral-small-instruct":[0.1526,0.2498],"mistralai/magistral-medium":[0.2501,0.2498],"mistralai/magistral-small":[0.1558,0.2498],"mistralai/mistral-instruct":[-0.4577,0.1681],"mistralai/mistral-large":[-0.1068,0.1267],"mistralai/mistral-medium":[0.6154,0.1681],"mistralai/mistral-nemo":[-0.4306,0.2498],"mistralai/mistral-small":[-0.9968,0.2498],"mistralai/mixtral-instruct":[0.0242,0.1681],"moonshotai/kimi":[0.7317,0.1016],"moonshotai/kimi-code":[0.3721,0.2498],"moonshotai/kimi-instant":[0.404,0.2498],"moonshotai/kimi-instruct":[0.1935,0.2498],"moonshotai/kimi-ioi":[0.2203,0.2498],"moonshotai/kimi-preview":[0.6195,0.1681],"moonshotai/kimi-thinking":[0.2664,0.2498],"moonshotai/kimi-thinking-turbo":[0.3329,0.2498],"nousresearch/hermes-llama":[0.244,0.1681],"nvidia/nemotron-nano":[-0.6892,0.2498],"nvidia/nemotron-super":[-0.1573,0.2498],"nvidia/nemotron-ultra":[-0.0308,0.2498],"ollama/codegeex":[-0.8137,0.2498],"ollama/codestral":[-0.5953,0.2498],"ollama/granite-dense":[-1.0518,0.2498],"ollama/hermes":[-0.9229,0.2498],"ollama/llama":[-0.9238,0.2498],"ollama/mistral-small":[-0.7138,0.2498],"ollama/opencodeinterpreter":[-0.8526,0.2498],"ollama/qwen":[-0.436,0.2498],"ollama/qwen-coder":[-0.2591,0.2498],"ollama/qwen-coder-instruct-gguf":[-0.3163,0.2498],"ollama/tulu":[-0.9238,0.2498],"ollama/yi-coder":[-0.6306,0.2498],"openai/":[0.5653,0.1681],"openai/chatgpt":[0.3604,0.1267],"openai/codex":[0.4206,0.2498],"openai/davinci":[-0.7954,0.2498],"openai/gpt":[0.4259,0.0394],"openai/gpt-+claude-sonnet":[0.2794,0.2498],"openai/gpt-astra":[0.7491,0.2498],"openai/gpt-chat":[0.053,0.2498],"openai/gpt-codex":[0.367,0.0849],"openai/gpt-codex-mini":[-0.2002,0.2498],"openai/gpt-instant":[0.1348,0.2498],"openai/gpt-luna":[0.1056,0.2498],"openai/gpt-luna-[medium]":[0.2309,0.2498],"openai/gpt-mini":[-0.1864,0.0849],"openai/gpt-nano":[-0.549,0.1267],"openai/gpt-oss":[-0.1304,0.1681],"openai/gpt-oss-rl":[-0.1966,0.2498],"openai/gpt-pre-release":[0.4335,0.2498],"openai/gpt-preview":[0.6458,0.1267],"openai/gpt-pro":[0.154,0.1681],"openai/gpt-sol":[0.4233,0.2498],"openai/gpt-sol-[medium]":[0.4857,0.2498],"openai/gpt-terra":[0.147,0.2498],"openai/gpt-turbo":[0.4115,0.1681],"openai/gpt-turbo-instruct":[0.8094,0.2498],"openai/high-+-gpt":[0.1836,0.2498],"openai/low-prompt-old":[0.0748,0.2498],"openai/mini":[0.4278,0.1267],"openai/preview":[0.5113,0.2498],"openai/pro":[0.4635,0.2498],"openrouter/horizon-alpha":[-0.1406,0.2498],"openrouter/horizon-beta":[-0.1272,0.2498],"perplexity/sonar":[-0.1422,0.2498],"perplexity/sonar-pro":[0.2022,0.2498],"poolside/laguna-m":[0.0891,0.2498],"poolside/laguna-xs":[-0.0356,0.2498],"qwen/qwen":[0.0019,0.027],"qwen/qwen-chat":[-1.361,0.0728],"qwen/qwen-coder":[-0.1599,0.1681],"qwen/qwen-coder-instruct":[-0.3525,0.0568],"qwen/qwen-coder-next":[0.0791,0.2498],"qwen/qwen-diff,-no-think,-alibaba-api":[0.032,0.2498],"qwen/qwen-flash":[-0.323,0.2498],"qwen/qwen-flash-next":[0.6628,0.2498],"qwen/qwen-ins":[-0.469,0.2498],"qwen/qwen-instruct":[-0.5857,0.0465],"qwen/qwen-instruct-turbo":[-0.6228,0.1681],"qwen/qwen-math-instruct":[-0.5571,0.2498],"qwen/qwen-max":[0.4669,0.1016],"qwen/qwen-max-preview":[0.2416,0.2498],"qwen/qwen-next-instruct":[-0.0461,0.2498],"qwen/qwen-plus":[-0.0475,0.1016],"qwen/qwen-plus-preview":[0.2073,0.2498],"qwen/qwen-thinking":[0.0994,0.1681],"qwen/qwq":[0.1247,0.2498],"qwen/qwq-+-qwen-coder-instruct":[-0.2111,0.2498],"qwen/qwq-max-preview":[0.1621,0.2498],"qwen/qwq-preview":[-0.0759,0.2498],"qwen/qwq-temp":[0.0578,0.2498],"stepfun/step-flash":[0.2902,0.1681],"stepfun/step-preview":[0.432,0.2498],"tencent/":[0.37,0.2498],"tencent/hunyuan-preview":[0.1183,0.2498],"tencent/preview":[0.5534,0.2498],"thinkingmachines/inkling":[-0.0579,0.2498],"thinkingmachines/inkling-small":[-0.0718,0.2498],"trinity-large":[-0.0982,0.2498],"ucsb-surfi/termigen":[-0.1533,0.2498],"unknown/acm-rewrite-qwen-chat":[-0.4565,0.2498],"unknown/agent":[0.3785,0.2498],"unknown/agentless-deepseek-qwen-vl":[-0.1778,0.2498],"unknown/agentless-qwen-coderb-qwen-vl":[-0.1423,0.1267],"unknown/amazon-nova-lite":[-0.5735,0.2498],"unknown/amazon-nova-micro":[-0.7354,0.2498],"unknown/amazon-nova-premier":[-0.0513,0.2498],"unknown/amazon-nova-pro":[-0.35,0.2498],"unknown/azerogpt":[-0.7646,0.1681],"unknown/codearts-glm":[0.6218,0.2498],"unknown/codearts-minimax":[0.408,0.2498],"unknown/codegen-qwen-instruct-chk":[-0.2455,0.2498],"unknown/codeqwen":[-0.7745,0.2498],"unknown/coding-amcfull-apifull-mmluk-meta-llama-instruct-chk":[-0.3682,0.2498],"unknown/coding-meta-llama-instruct-chk":[-0.3619,0.2498],"unknown/deepcoder-preview":[0.0554,0.2498],"unknown/dracarys-instruct":[0.1982,0.2498],"unknown/dracarys-llama-instruct":[0.1871,0.2498],"unknown/exaone":[0.1779,0.2498],"unknown/frogboss":[0.0524,0.2498],"unknown/frogmini":[-0.027,0.2498],"unknown/gemma":[-0.7496,0.2498],"unknown/human":[0.1684,0.2498],"unknown/hunyuan-turbos":[-0.2095,0.2498],"unknown/iswe-openmodels":[0.342,0.2498],"unknown/lcb-math-qwen-instructv-merged":[-0.4395,0.2498],"unknown/learnlm-pro-experimental":[-0.3162,0.2498],"unknown/mathstral":[-0.8491,0.2498],"unknown/mcts-refine":[-0.2899,0.2498],"unknown/metastone":[-0.1841,0.2498],"unknown/multiple":[0.5624,0.2498],"unknown/nan":[-0.0018,0.2498],"unknown/open-mistral-nemo":[-0.7216,0.2498],"unknown/open-mixtral":[-1.0543,0.1681],"unknown/openhands-lm":[0.3543,0.2498],"unknown/openhermes-mistral":[-0.9015,0.2498],"unknown/openreasoning-nemotron":[0.1794,0.2498],"unknown/optimus-alpha":[-0.0145,0.2498],"unknown/perplexity-sonar":[-1.7795,0.2498],"unknown/quasar-alpha":[-0.0022,0.2498],"unknown/reflection":[-0.6538,0.2498],"unknown/reflection-llama":[-0.6215,0.2498],"unknown/sdk":[0.3981,0.2498],"unknown/sky-preview":[-0.4314,0.2498],"unknown/smaug-qwen-instruct":[-0.5569,0.2498],"unknown/starling-lm-beta":[-0.9126,0.2498],"unknown/step":[-0.2236,0.2498],"unknown/swe-llama":[-0.9052,0.2498],"unknown/trinity-large":[0.0201,0.2498],"unknown/unknown":[-0.0322,0.2498],"unknown/vicuna":[-1.5824,0.1681],"unknown/wbot":[-0.2281,0.2498],"unknown/xbai":[0.1638,0.2498],"unknown/zephyr-alpha":[-1.0089,0.2498],"unknown/zephyr-beta":[-1.1369,0.2498],"upstage/solar-pro":[-0.8581,0.1267],"x-ai/grok":[0.1404,0.0465],"x-ai/grok-[high]":[0.4832,0.2498],"x-ai/grok-beta":[-0.0009,0.1267],"x-ai/grok-build":[0.0689,0.2498],"x-ai/grok-code-fast":[-0.219,0.2498],"x-ai/grok-fast":[-0.3376,0.1681],"x-ai/grok-mini":[0.1328,0.1681],"x-ai/grok-mini-beta":[0.0647,0.2498],"x-ai/grok-mini-reasoning-beta":[-0.2483,0.2498],"xiaomi/mimo":[0.1791,0.2498],"xiaomi/mimo-flash":[0.225,0.2498],"xiaomi/mimo-pro":[0.3028,0.1681],"z-ai/glm":[0.8345,0.0638],"z-ai/glm-[high]":[0.4265,0.2498],"z-ai/glm-air":[0.256,0.2498],"z-ai/glm-flash":[0.3295,0.1681],"z-ai/glm-turbo":[0.0735,0.2498]},"family_rho":0.486,"features":["lp_in","lp_out","lctx","date","open","aa_int","aa_cod","aa_ag","elo"],"index_features":["aa_int","aa_cod","aa_ag","elo"],"knee_per_usd":5.0,"link":{"bugfix":{"seats":{"checker":{"level":1.634,"slope":2.118,"slope_sd":1.264},"planner":{"level":0.98,"slope":2.118,"slope_sd":1.264},"worker":{"level":3.921,"slope":2.2,"slope_sd":1.272}},"u_ref":0.6095},"openended":{"seats":{"checker":{"level":1.345,"slope":8.556,"slope_sd":2.749},"planner":{"level":0.807,"slope":8.556,"slope_sd":2.749},"worker":{"level":3.227,"slope":8.565,"slope_sd":2.77}},"u_ref":0.6018},"other":{"seats":{"checker":{"level":1.49,"slope":5.337,"slope_sd":2.006},"planner":{"level":0.893,"slope":5.337,"slope_sd":2.006},"worker":{"level":3.574,"slope":5.383,"slope_sd":2.021}},"u_ref":0.6057}},"loc":[0.0,-0.221944,0.295021,17.303728,1.842834,0.377389,26.412941,44.133613,19.901136,1193.91129],"mean":[0.203091,-0.080757,-0.062968,-0.079207,-0.125447,0.055773,-0.568404,-0.348314,-0.440756,-0.369667],"noise":1.7217,"scale":[1.0,0.957046,0.726154,2.545528,0.768919,0.484733,14.103448,22.709659,18.571976,124.41988],"shapes":{"checker":{"cached":80000,"completion":2200,"prompt":12000},"planner":{"cached":10000,"completion":1500,"prompt":4000},"worker":{"cached":250000,"completion":4000,"prompt":15000}},"u_floor":0.3695,"var_scale":0.51,"version":2}
\ No newline at end of file
diff --git a/internal/crewroute/providers.go b/internal/crewroute/providers.go
new file mode 100644
index 0000000000..076e386b08
--- /dev/null
+++ b/internal/crewroute/providers.go
@@ -0,0 +1,66 @@
+package crewroute
+
+import "strings"
+
+// WHICH PROVIDERS THE CREW MAY ROUTE THROUGH — A SET BESIDE THE RULE, NOT IN IT.
+//
+// The allowed rule ([Allowed]) says which MODELS a seat may be picked from. The
+// providers a person turned off say which ROUTES may carry them, and the two
+// are kept apart on purpose: a `-x` in the rule naming a provider would also
+// read as a vendor (`-openai` takes OpenAI's models away, not just a route),
+// and stepping the rule onto a new base drops every exception it had, so a
+// provider switched off there would switch itself back on the next time the
+// models row was walked.
+//
+// THE SET IS OF PROVIDERS TURNED OFF, never of providers turned on, so a
+// provider connected tomorrow is on the day it is connected — the same thing
+// connecting one has always meant — and nobody has to remember a second place
+// to switch it on.
+//
+// The filter is the last step before a model becomes a candidate: a model's
+// routes through providers that are off are taken away, and a model left with
+// no route is no candidate, however cheap — exactly the verdict a model no
+// connected provider reaches already gets.
+
+// ProvidersOff is the set of provider ids a person turned off, lower case.
+// The zero value is every provider on.
+type ProvidersOff map[string]bool
+
+// On says whether a provider's routes may be used.
+func (off ProvidersOff) On(provider string) bool {
+	return !off[strings.ToLower(strings.TrimSpace(provider))]
+}
+
+// Routes is the routes a provider that is on carries, in their own order.
+func (off ProvidersOff) Routes(routes []Route) []Route {
+	if len(off) == 0 {
+		return routes
+	}
+	var out []Route
+	for _, r := range routes {
+		if off.On(r.Provider) {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// Candidates is the candidates with the routes of every provider that is off
+// taken away, and every candidate left with no route dropped. The route order
+// each candidate came with — plans and local first, the default service last —
+// is kept, because it is the order a tie between routes of equal cost is
+// broken in, and a filter is no reason to break it differently.
+func (off ProvidersOff) Candidates(candidates []Candidate) []Candidate {
+	if len(off) == 0 {
+		return candidates
+	}
+	var out []Candidate
+	for _, c := range candidates {
+		routes := off.Routes(c.Routes)
+		if len(routes) == 0 {
+			continue
+		}
+		out = append(out, Candidate{Model: c.Model, Routes: routes})
+	}
+	return out
+}
diff --git a/internal/crewroute/providers_test.go b/internal/crewroute/providers_test.go
new file mode 100644
index 0000000000..e23b32df63
--- /dev/null
+++ b/internal/crewroute/providers_test.go
@@ -0,0 +1,31 @@
+package crewroute
+
+import "testing"
+
+// A PROVIDER TURNED OFF TAKES ITS ROUTES AWAY AND NOTHING ELSE: a model it
+// shares with a provider still on keeps that route, in its own order, and a
+// model only it reached is no candidate.
+func TestProvidersOffFiltersRoutesNotModels(t *testing.T) {
+	shared := Candidate{Model: Model{ID: "z-ai/glm-5.3-flash"}, Routes: []Route{
+		{Provider: "z-ai", Kind: Plan}, {Provider: "ollama", Kind: Local}, {Provider: "openrouter", Kind: Metered},
+	}}
+	only := Candidate{Model: Model{ID: "openai/gpt-6"}, Routes: []Route{{Provider: "codex", Kind: Plan}}}
+	all := []Candidate{shared, only}
+
+	if got := ProvidersOff(nil).Candidates(all); len(got) != 2 || len(got[0].Routes) != 3 {
+		t.Fatalf("no provider off changed the candidates: %+v", got)
+	}
+	got := ProvidersOff{"codex": true, "ollama": true}.Candidates(all)
+	if len(got) != 1 || got[0].Model.ID != shared.Model.ID {
+		t.Fatalf("a model only an off provider reaches stayed a candidate: %+v", got)
+	}
+	if routes := got[0].Routes; len(routes) != 2 || routes[0].Provider != "z-ai" || routes[1].Provider != "openrouter" {
+		t.Fatalf("the routes left are %+v, want z-ai then openrouter", routes)
+	}
+	if len(all[0].Routes) != 3 {
+		t.Fatal("the filter changed the candidates it was handed")
+	}
+	if !(ProvidersOff{"codex": true}).On("OpenRouter") || (ProvidersOff{"codex": true}).On(" Codex ") {
+		t.Fatal("On does not read a provider id case folded")
+	}
+}
diff --git a/internal/crewroute/reach_test.go b/internal/crewroute/reach_test.go
new file mode 100644
index 0000000000..7bee656f98
--- /dev/null
+++ b/internal/crewroute/reach_test.go
@@ -0,0 +1,151 @@
+package crewroute
+
+import (
+	"os"
+	"testing"
+)
+
+// THE KORNIA CASE: an issue labelled `bug :bug:` — the tracker's own spelling —
+// whose title names the misbehaving call and says what it never does was read
+// as open-ended, because no rule knew the label's spelling and no title rule
+// fired. Either alone now reads it as a bugfix.
+func TestAKorniaStyleDefectIsABugfix(t *testing.T) {
+	title := "augmentation: RandomResizedCrop(scale=(1, 1)) never keeps a square or portrait image: strict candidate test and an inverted-ratio fallback"
+	report, err := os.ReadFile("testdata/kornia-4814.md")
+	if err != nil {
+		t.Fatal(err)
+	}
+	labels := []string{"bug :bug:", "help wanted", "good first issue"}
+	for name, task := range map[string]Task{
+		"the title alone":           {Text: title},
+		"the labels on a bare text": {Text: "the crop looks wrong", Labels: labels},
+		"the issue as filed":        {Text: string(report), Labels: labels},
+	} {
+		if got := Classify(task); got.Class != Bugfix || !got.Sure {
+			t.Errorf("%s: %s (sure %v, %q), want a sure bugfix", name, got.Class, got.Sure, got.Why)
+		}
+	}
+	for _, text := range []string{"The export does not close the file", "parse_date fails to read ISO weeks", "Settings should reject a negative timeout"} {
+		if got := Classify(Task{Text: text}); got.Class != Bugfix {
+			t.Errorf("%q: %s (%q), want bugfix", text, got.Class, got.Why)
+		}
+	}
+	if got := Classify(Task{Text: "The exporter should support YAML"}); got.Class == Bugfix {
+		t.Errorf("a request for something new read as a bugfix (%q)", got.Why)
+	}
+}
+
+// A FIX WITH REACH IS COMPLEX, A ONE-LINE FIX IS SIMPLE, and only the worker
+// moves: one rung, at the same λ, never over a pin.
+func TestAComplexFixGetsAStrongerWorker(t *testing.T) {
+	report, err := os.ReadFile("testdata/hermes-7680.md")
+	if err != nil {
+		t.Fatal(err)
+	}
+	complexTask := Task{Text: string(report)}
+	simpleTask := Task{Text: "fix: typo in the loop bound of paginate() skips the last page"}
+	if got := Classify(complexTask); got.Class != Bugfix || got.Complex == "" {
+		t.Fatalf("the hermes report: %s, reach %q, want a complex bugfix", got.Class, got.Complex)
+	}
+	if got := Classify(simpleTask); got.Class != Bugfix || got.Complex != "" {
+		t.Fatalf("a one-line typo: %s, reach %q, want a simple bugfix", got.Class, got.Complex)
+	}
+	cands := append(catalogCandidates(), candidateOf(glm53))
+	simple, err := Decide(Request{Task: simpleTask, Candidates: cands})
+	if err != nil {
+		t.Fatal(err)
+	}
+	hard, err := Decide(Request{Task: complexTask, Candidates: cands})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if simple.Subclass != "simple" || hard.Subclass != "complex" || hard.Class != Bugfix {
+		t.Errorf("subclasses %q and %q (class %s)", simple.Subclass, hard.Subclass, hard.Class)
+	}
+	if hard.Lambda != simple.Lambda {
+		t.Errorf("λ moved: %v against %v", hard.Lambda, simple.Lambda)
+	}
+	sw, hw := simple.Seat(Worker), hard.Seat(Worker)
+	if hw.Quality <= sw.Quality || Lineage(hw.Model) == Lineage(sw.Model) {
+		t.Errorf("complex worker %s (%.2f), simple worker %s (%.2f): want a stronger one", hw.Model, hw.Quality, sw.Model, sw.Quality)
+	}
+	for _, seat := range []Seat{Planner, Checker} {
+		if hard.Seat(seat).Model != simple.Seat(seat).Model {
+			t.Errorf("%s moved: %s against %s", seat, hard.Seat(seat).Model, simple.Seat(seat).Model)
+		}
+	}
+	pinned, err := Decide(Request{Task: complexTask, Candidates: cands, Pins: map[Seat]Pin{Worker: {Model: sw.Model}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := pinned.Seat(Worker).Model; Lineage(got) != Lineage(sw.Model) {
+		t.Errorf("a pinned worker became %s", got)
+	}
+}
+
+// A CLASS GIVEN IS NOT A REACH FORGOTTEN: a caller that classified first and
+// hands on only the class — or the whole reading — still gets the complex
+// fix's worker, read off the same words.
+func TestAGivenBugfixClassStillReadsReach(t *testing.T) {
+	report, err := os.ReadFile("testdata/hermes-7680.md")
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := Task{Text: string(report)}
+	cands := catalogCandidates()
+	plain, err := Decide(Request{Class: Bugfix, Task: Task{Text: "fix: typo in the loop bound of paginate() skips the last page"}, Candidates: cands})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reading := Classify(task)
+	for name, r := range map[string]Request{
+		"the class alone":   {Class: Bugfix, Task: task, Candidates: cands},
+		"the whole reading": {Class: Bugfix, Reading: &reading, Candidates: cands},
+	} {
+		d, err := Decide(r)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if d.Subclass != "complex" || d.Reach == "" {
+			t.Errorf("%s: subclass %q reach %q, want complex", name, d.Subclass, d.Reach)
+		}
+		if d.Seat(Worker).Quality <= plain.Seat(Worker).Quality {
+			t.Errorf("%s: worker %s, no stronger than the simple fix's %s", name, d.Seat(Worker).Model, plain.Seat(Worker).Model)
+		}
+	}
+}
+
+// A ONE-PARAGRAPH ASK IS READ FOR REACH TOO. Most asks have no body under a
+// title line, and the signals that make a fix complex sit in that one
+// paragraph.
+func TestAOneParagraphFixIsReadForReach(t *testing.T) {
+	cases := []struct{ text, why string }{
+		{"The /api/v2/orders endpoint returns HTTP 500 instead of 404 when the order id does not exist. The handler in api/orders.py and the repository in db/orders_repo.py both need changes, and the existing tests in tests/test_orders_api.py must keep passing. Repro: GET /api/v2/orders/999999 on a fresh database.", "two files and an endpoint"},
+		{"Security: the file upload endpoint accepts path traversal in the filename (../../etc/passwd). Sanitize filenames in upload/handlers.py and add a regression test.", "a security fix on an endpoint"},
+	}
+	for _, tc := range cases {
+		r := Classify(Task{Text: tc.text})
+		if r.Class != Bugfix || r.Complex == "" {
+			t.Errorf("%s: read as %s, reach %q; want a complex fix", tc.why, r.Class, r.Complex)
+		}
+	}
+	if r := Classify(Task{Text: "Fix typo in README: \"recieve\" should be \"receive\" in the install section."}); r.Complex != "" {
+		t.Errorf("a typo read as reaching: %q", r.Complex)
+	}
+}
+
+// A DEFECT SAID WITHOUT THE WORD BUG is still a fix, and a mechanical change
+// — a rename — is a small fix, not open-ended work.
+func TestDefectWordsAndMechanicalChangesReadAsFixes(t *testing.T) {
+	for _, text := range []string{
+		"Session titles are wrongly rejected for Japanese chats when the title contains English product names.",
+		"The export is incorrectly rounded when the total has three decimals.",
+		"Search returns the archived items instead of the live ones.",
+		"Rename the function get_usr to get_user across the codebase.",
+		"Bump the version to 2.4.1 in every package manifest.",
+	} {
+		if r := Classify(Task{Text: text}); r.Class != Bugfix || r.Complex != "" {
+			t.Errorf("%q read as %s (%s), reach %q; want a simple fix", text, r.Class, r.Why, r.Complex)
+		}
+	}
+}
diff --git a/internal/crewroute/route.go b/internal/crewroute/route.go
new file mode 100644
index 0000000000..0f92afb0a1
--- /dev/null
+++ b/internal/crewroute/route.go
@@ -0,0 +1,1434 @@
+// Package crewroute picks the crew for one task: which model sits the worker,
+// the planner and the checker seat, on which provider's route, for this piece
+// of work and nothing longer.
+//
+// ── THE ONE SENTENCE IT IMPLEMENTS ──
+//
+// The /crew panel says what is allowed (it persists); the words in the ask say
+// how hard to try this one task. Nothing else sticks. So there is no preset
+// here and no mode: a caller hands over the task, the models the person allows
+// on the providers they have connected, the seats they pinned, and at most one
+// word of effort, and gets back one crew for this task.
+//
+// ── WHY IT ROUTES ON THE CLASS OF WORK ──
+//
+// The design is in docs/design/model-pool/pareto-crewing.pdf. The rule it
+// follows: narrow fixes use the cheapest qualified crew, and open-ended work
+// gets a stronger checker, the one seat worth paying for there. The policy is
+// read off a table ([prior]) rather than written into branches: classify the
+// task ([Classify]), then pick each seat to maximise quality minus λ times
+// cost.
+//
+// ── WHAT IT DOES NOT DO ──
+//
+// It does not escalate on its own. A done-verdict that misses real solves and
+// passes failures would make an escalation loop spend on the wrong tasks, so
+// [AutoEscalate] is off, and a stronger crew is something a person asks for
+// (`redo stronger`).
+//
+// It is PURE: no disk, no network, no clock. The same request gives the same
+// crew, in the same order, every time — which is what lets a decision be
+// logged, replayed and argued with. A decision costs well under a millisecond.
+package crewroute
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// AutoEscalate is whether a crew is ever made stronger without somebody
+// asking. It is OFF, and a constant rather than a setting, because whether an
+// automatic escalation pays for itself depends on how far the checker's
+// verdict can be trusted, which is a property of the checker, not a
+// preference.
+const AutoEscalate = false
+
+// Seat is one of the crew's three seats, by the name a person reads.
+type Seat string
+
+const (
+	// Worker does the work: the leaves of a task, every tool turn of it.
+	Worker Seat = "worker"
+	// Planner cuts the work into pieces and steers the run.
+	Planner Seat = "planner"
+	// Checker reads finished work against what it was supposed to do.
+	Checker Seat = "checker"
+)
+
+// Seats lists the three in the order a crew is read out.
+var Seats = []Seat{Worker, Planner, Checker}
+
+// Model is a catalog row as the router reads it. Prices are dollars per
+// token, as the catalog publishes them.
+type Model struct {
+	ID              string
+	Open            bool
+	PromptPrice     float64
+	CompletionPrice float64
+	CacheReadPrice  float64
+	Intelligence    float64
+	Coding          float64
+	Agentic         float64
+	// ArenaElo is the best design-arena Elo the row publishes, zero for none.
+	ArenaElo float64
+	Context  int
+	// Released is when the model was released, the zero time when the row
+	// does not say.
+	Released time.Time
+	// Tools is whether the model takes tool calls. A crew seat is an agent
+	// loop, so a model that cannot call a tool cannot sit one.
+	Tools bool
+}
+
+// RouteKind is how a route bills.
+type RouteKind string
+
+const (
+	// Metered is billed per token at the model's published prices.
+	Metered RouteKind = "metered"
+	// Plan is a subscription login — a coding plan, a ChatGPT account — whose
+	// marginal cost for one more task is taken as zero.
+	Plan RouteKind = "plan"
+	// Local is a model on this machine, which costs nothing per token.
+	Local RouteKind = "local"
+	// Free is a provider's free pool for a model (OpenRouter's `:free`): no
+	// price, but rate-limited hard, dropped without notice, and allowed to log
+	// or train on what it is sent. It is weighed at what it is EXPECTED to cost
+	// ([routeCost]), used only when the person turned free routes on, and a
+	// seat on it falls through to the same model's paid route first.
+	Free RouteKind = "free"
+)
+
+// freeFailPrior is the chance a free route refuses a task's first call,
+// before this install has any outcome of its own for that route: free pools
+// are rate-limited by design, so the prior is pessimistic.
+const freeFailPrior = 0.3
+
+// freeLimitPenalty is what a free route is charged for its limits even when it
+// answers — the waits and retries of a rate-limited pool — in dollars a task.
+const freeLimitPenalty = 0.001
+
+// freeLimitShare is the same charge as a share of the paid route the seat
+// falls to, whichever is more: waits and retries cost more on a dearer seat.
+const freeLimitShare = 0.1
+
+// Route is one way to reach a model: the provider, the id to send so the call
+// goes that way, and how it bills.
+type Route struct {
+	Provider string
+	Send     string
+	Kind     RouteKind
+	// FailRate is this install's learned chance that the route refuses a
+	// task's first call, zero when nothing is known — a free route then reads
+	// [freeFailPrior].
+	FailRate float64
+}
+
+// Candidate is a model the person allows, with every route a connected
+// provider offers it on, the caller's preferred route first.
+type Candidate struct {
+	Model  Model
+	Routes []Route
+}
+
+// Pin is a seat the person fixed. Model is the id they wrote, Provider the
+// route they pinned when they wrote `model@provider`, and Send and Kind the
+// route the caller resolved for it.
+type Pin struct {
+	Model    string
+	Provider string
+	Send     string
+	Kind     RouteKind
+}
+
+// Effort is the one word about how hard to try this task.
+type Effort string
+
+const (
+	// EffortKnee is the default: the knee of the quality-cost front.
+	EffortKnee Effort = ""
+	// EffortBest buys the most quality the weights believe in, whatever it
+	// costs (λ → 0, ties to the cheaper).
+	EffortBest Effort = "best"
+	// EffortCheap buys quality only where it is nearly free.
+	EffortCheap Effort = "cheap"
+)
+
+// cheapTolerance is how many times the cheapest fitting worker's cost a
+// cheap crew pays for a stronger worker.
+const cheapTolerance = 1.5
+
+// ParseEffort reads a person's word for effort. Empty is the knee; anything
+// else that is not one of the two words is refused by the caller's own form.
+func ParseEffort(word string) (Effort, bool) {
+	switch strings.ToLower(strings.TrimSpace(word)) {
+	case "":
+		return EffortKnee, true
+	case "best", "thorough", "strong", "strongest":
+		return EffortBest, true
+	case "cheap", "cheapest":
+		return EffortCheap, true
+	}
+	return EffortKnee, false
+}
+
+// The price of quality, spelled once.
+//
+// THE KNEE is [Knee] quality points per dollar (prior.json). It sits where the
+// quality-cost front bends: a step up that buys fewer than [Knee] points per
+// dollar is not taken, and one that buys more is. Because the open-ended
+// checker's link pays for ability and a fix's support seats' do not, that
+// buys a strong checker on open-ended work and nothing on a fix, and it does
+// so because of the weights and the prices, not because of a branch.
+//
+// cheapFactor makes cheap ten times as stingy: quality must come at under
+// half a cent a point. stepFactor is one escalation step: a quarter of the
+// price per point, so each step buys what cost up to four times as much.
+const (
+	cheapFactor = 10.0
+	stepFactor  = 4.0
+	maxSteps    = 6
+)
+
+// Request is everything one decision reads.
+type Request struct {
+	Task Task
+	// Class, when set, is taken as given and the classifier is not asked — a
+	// replay, or a caller that already knows.
+	Class Class
+	// Reading, when set, is the classifier's whole answer as the caller
+	// already read it — the class, why, how sure, and a fix's reach — and is
+	// taken as it stands. A caller that classifies first to key its learned
+	// offset hands the reading on here rather than the class alone, which
+	// dropped the reach and ran every complex fix on the simple fix's worker.
+	Reading *Reading
+	// Candidates are the allowed models reachable on a connected provider.
+	Candidates []Candidate
+	// Pins are the seats the person fixed. A pinned seat always runs its pin.
+	Pins   map[Seat]Pin
+	Effort Effort
+	// Steps is how many escalation steps above the knee to start: the learned
+	// offset for this repository and class, which decays as tasks are accepted.
+	Steps int
+	// Pace multiplies λ as a daily cap is approached ([Pace]); zero is one.
+	Pace float64
+	// Stronger is the crew that ran, when the person asked to redo the task
+	// stronger: every unpinned seat is picked at least as strong, and the crew
+	// as a whole strictly stronger, or the decision says it cannot be.
+	Stronger *Decision
+	// Again is the crew that ran and NEVER STARTED — its seats' first calls
+	// were refused — when the person asks to redo it: the task never ran, so it
+	// is asked again at the same λ on the next-best models, not escalated.
+	Again *Decision
+	// Avoid are model lineages that failed to start on this install recently
+	// ([Lineage]). An unpinned seat is not given one while anything else can
+	// sit it; a pin is never overruled.
+	Avoid map[string]bool
+	// Learned is this install's move to a model's quality in a seat, by
+	// [LearnKey]: what its tasks kept or redid there ([router.CrewLog]).
+	Learned map[string]float64
+	// TaskCap is the most one task may be estimated to cost; zero is none. A
+	// crew estimated over it is not chosen, whatever the effort word.
+	TaskCap float64
+	// CostFactor is this install's learned ratio of what its tasks of the
+	// class cost to their estimates; zero is none learned.
+	CostFactor float64
+	// Rescue is a seat's LAST RUNG being picked — the free pools when nothing
+	// paid can be reached — rather than a crew being chosen: any model that
+	// can sit the seat (tools, context, a route) is taken, best first, though
+	// it publishes too little for the router to trust it as a first pick. A
+	// seat that runs on a thinly described model says so on its line; a seat
+	// that does not run at all says nothing useful.
+	Rescue bool
+}
+
+// Pick is one seat's answer.
+type Pick struct {
+	Seat     Seat
+	Model    string
+	Provider string
+	Send     string
+	Kind     RouteKind
+	Pinned   bool
+	Quality  float64
+	// SD is the standard deviation of Quality under the weights.
+	SD float64 `json:",omitempty"`
+	// Learned is the part of Quality this install's own outcomes moved.
+	Learned float64 `json:",omitempty"`
+	CostUSD float64
+	// EstUSD is what this seat is expected to cost the task ([table.classCost]):
+	// nothing on a plan, a local model or a free pool.
+	EstUSD float64 `json:",omitempty"`
+}
+
+// Decision is one task's crew.
+type Decision struct {
+	Class  Class
+	Why    string
+	Sure   bool
+	Effort Effort
+	Steps  int
+	// Lambda is the price of a quality point the crew was picked at.
+	Lambda float64
+	Crew   []Pick
+	// EstUSD is the crew's estimated cost for an ordinary task of its class.
+	EstUSD  float64
+	Quality float64
+	// OneOff is a stronger redo of a crew whose every seat was pinned: the
+	// pins were stepped over for this one run and are unchanged.
+	OneOff bool
+	// Considered is how many candidates the decision chose among.
+	Considered int
+	// Ladder is, for each unpinned seat, where the seat goes when its call
+	// fails to start, in order: the same model on its next routes, then the
+	// next qualified models at a similar cost. The caller adds what only it
+	// knows — the last crew that worked, the model the person is talking to.
+	Ladder map[Seat][]Pick `json:"-"`
+	// Retried are the seats that moved down their ladder during the task, in
+	// the order they moved, so the line can say so.
+	Retried []Retry `json:",omitempty"`
+	// Rungs are what a redo or an effort word changed against the crew it
+	// would otherwise have run, seat by seat.
+	Rungs []Retry `json:",omitempty"`
+	// Note is one plain sentence the line ends on: an effort word that changed
+	// nothing, or the free routes taken because nothing paid could be.
+	Note string `json:",omitempty"`
+	// Stopped is the one action a task stopped on when a seat had nowhere
+	// left to go and the failure said why — credit, a key, a limit. The line
+	// leads with it and offers no stronger redo, which could not help.
+	Stopped string `json:",omitempty"`
+	// Redo is whether this crew was asked for by a redo of a task that ran
+	// before. Its own acceptance is the redo's, not a later task's: it must
+	// not take back the step the redo just taught.
+	Redo bool `json:",omitempty"`
+	// Subclass is, for a bugfix, "complex" or "simple" ([complexFix]), with
+	// Reach the signals that made it complex. The log keeps it; every line a
+	// person reads still says bugfix.
+	Subclass string `json:",omitempty"`
+	Reach    string `json:",omitempty"`
+	// CostFactor is what this install's own tasks of the class have cost
+	// against their estimates ([router.CrewLog.CostFactor]); EstUSD carries
+	// it. Zero is none learned yet.
+	CostFactor float64 `json:",omitempty"`
+}
+
+// Unspent is the actual cost a line is drawn with when there is none worth
+// saying: a task that stopped before anything was spent. The line then names
+// no money at all, rather than a $0.000 that reads as a free success.
+const Unspent = -2.0
+
+// Retry is one seat moved from one model to another — down its ladder during
+// a task, or up a rung on a redo — and why, when a failure moved it.
+type Retry struct {
+	Seat Seat
+	From string
+	To   string
+	Why  string `json:",omitempty"`
+}
+
+// WithRung is the decision with one seat moved to another pick for the rest
+// of the task — a rung of its ladder, or one the caller found — the estimate
+// re-added and the move recorded, with why, for the line.
+func (d Decision) WithRung(seat Seat, next Pick, why string) Decision {
+	out := d
+	out.Crew = append([]Pick(nil), d.Crew...)
+	next.Seat = seat
+	out.Retried = append(append([]Retry(nil), d.Retried...), Retry{Seat: seat, From: d.Seat(seat).Model, To: next.Model, Why: why})
+	out.EstUSD, out.Quality = 0, 0
+	for i := range out.Crew {
+		if out.Crew[i].Seat == seat {
+			out.Crew[i] = next
+		}
+		out.EstUSD += estOf(out.Crew[i])
+		out.Quality += out.Crew[i].Quality
+	}
+	if out.CostFactor > 0 {
+		out.EstUSD *= out.CostFactor
+	}
+	return out
+}
+
+// Seat is one seat's pick, the zero Pick for a seat the decision has none for.
+func (d Decision) Seat(seat Seat) Pick {
+	for _, pick := range d.Crew {
+		if pick.Seat == seat {
+			return pick
+		}
+	}
+	return Pick{}
+}
+
+// NoCandidateError is a seat nobody pinned and nothing allowed can sit.
+type NoCandidateError struct{ Seat Seat }
+
+func (e NoCandidateError) Error() string {
+	return fmt.Sprintf("no allowed model on a connected provider can sit the %s seat", e.Seat)
+}
+
+// ErrStrongest is a redo that asked for a stronger crew than the strongest
+// one the allowed models make.
+var ErrStrongest = errors.New("this is already the strongest crew the models you allow can make")
+
+// Decide picks the crew for one task.
+func Decide(r Request) (Decision, error) {
+	t := forDecision(r.Candidates, r.Learned)
+	t.rescue = r.Rescue
+	if r.Effort == EffortCheap {
+		t.cheapTolerance = cheapTolerance
+	}
+	reading := readingOf(r)
+	d := Decision{Class: reading.Class, Why: reading.Why, Sure: reading.Sure, Effort: r.Effort, Steps: r.Steps, Considered: len(r.Candidates)}
+	pins := r.Pins
+	if r.Stronger != nil && allPinned(pins) {
+		// EVERY SEAT PINNED AND A STRONGER RUN ASKED FOR: the pins stay what
+		// they are, and this one run steps over them.
+		pins, d.OneOff = nil, true
+	}
+	lambda := baseLambda(t, r)
+	d.Lambda = lambda
+	candidates := r.Candidates
+	avoid := r.Avoid
+	if r.Again != nil {
+		avoid = map[string]bool{}
+		for lineage := range r.Avoid {
+			avoid[lineage] = true
+		}
+		for _, pick := range r.Again.Crew {
+			if !pick.Pinned {
+				avoid[Lineage(pick.Model)] = true
+			}
+		}
+	}
+	if len(avoid) > 0 {
+		candidates = avoiding(candidates, avoid)
+	}
+	crew, err := pickCrew(t, d.Class, candidates, pins, lambda)
+	if err != nil {
+		return Decision{}, err
+	}
+	// A LEARNED OFFSET IS RUNGS, NOT A PRICE: each step is one rung up the
+	// front from the crew the knee picks ([stronger]), so a repository whose
+	// work was redone once starts one rung higher — never at the top.
+	for i := 0; i < r.Steps && i < maxSteps && r.Stronger == nil && r.Again == nil; i++ {
+		ran := Decision{Crew: crew}
+		up, _, err := stronger(t, d.Class, candidates, pins, lambda, &ran)
+		if err != nil {
+			break
+		}
+		crew = up
+	}
+	if d.Class == Bugfix {
+		d.Subclass, d.Reach = "simple", reading.Complex
+		if reading.Complex != "" {
+			d.Subclass = "complex"
+			if r.Stronger == nil && r.Again == nil {
+				crew = withReachingWorker(t, crew, candidates)
+			}
+		}
+	}
+	if r.Stronger != nil {
+		crew, d.Lambda, err = stronger(t, d.Class, candidates, pins, lambda, r.Stronger)
+		if err != nil {
+			return Decision{}, err
+		}
+	}
+	// NO CREW OVER THE TASK LIMIT: a crew whose estimate, at this install's
+	// cost factor, is over the limit is not chosen — not under --best, not on
+	// a redo. The price of a point is raised until the crew fits; pins are
+	// kept as they are.
+	if r.TaskCap > 0 && crewEst(t, d.Class, crew, r.CostFactor) > r.TaskCap+1e-12 {
+		var fits bool
+		crew, d.Lambda, fits = underCap(t, d.Class, candidates, pins, d.Lambda, r.TaskCap, r.CostFactor)
+		if fits {
+			d.Note = "held under the " + Money(r.TaskCap) + " task limit"
+		} else {
+			d.Note = "every crew is estimated over the " + Money(r.TaskCap) + " task limit · the cheapest runs"
+		}
+	}
+	d.Crew = crew
+	// AN EFFORT WORD SAYS WHAT IT CHANGED, or that it changed nothing: the crew
+	// the knee would have picked is the one to compare with.
+	var knee *Decision
+	if (r.Effort == EffortBest || r.Effort == EffortCheap) && r.Stronger == nil && r.Again == nil {
+		plain := r
+		plain.Effort, plain.Steps = "", 0
+		kneeT := *t
+		kneeT.cheapTolerance = 0
+		if kneeCrew, err := pickCrew(&kneeT, d.Class, candidates, pins, baseLambda(t, plain)); err == nil {
+			knee = &Decision{Crew: kneeCrew}
+			if sameCrew(kneeCrew, crew) && d.Note == "" {
+				if r.Effort == EffortBest {
+					d.Note = "best · already the strongest crew allowed"
+				} else {
+					d.Note = "cheap · already the cheapest crew"
+				}
+			}
+		}
+	}
+	// A REDO SAYS WHAT IT CHANGED, seat by seat, so the card can show the rung
+	// it took rather than a new crew to compare by eye.
+	if ran := firstOf(firstOf(r.Stronger, r.Again), knee); ran != nil {
+		for _, pick := range crew {
+			if was := ran.Seat(pick.Seat); was.Model != "" && Lineage(was.Model) != Lineage(pick.Model) {
+				d.Rungs = append(d.Rungs, Retry{Seat: pick.Seat, From: was.Model, To: pick.Model})
+			}
+		}
+	}
+	// EACH UNPINNED SEAT CARRIES ITS NEXT PICK, so a model that fails to start
+	// is replaced inside the task rather than ending it: the best candidate of
+	// another lineage at the λ the crew was picked at.
+	for _, pick := range crew {
+		if pick.Pinned {
+			continue
+		}
+		if ladder := ladderFor(t, d.Class, pick, candidates, d.Lambda); len(ladder) > 0 {
+			if d.Ladder == nil {
+				d.Ladder = map[Seat][]Pick{}
+			}
+			d.Ladder[pick.Seat] = ladder
+		}
+	}
+	for i := range d.Crew {
+		d.Crew[i].EstUSD = pickEst(t, d.Class, d.Crew[i])
+	}
+	for _, pick := range d.Crew {
+		d.EstUSD += estOf(pick)
+		d.Quality += pick.Quality
+	}
+	// THE ESTIMATE LEARNS FROM THIS INSTALL: what its tasks of the class
+	// actually cost against their estimates moves the next one's.
+	if r.CostFactor > 0 {
+		d.CostFactor = r.CostFactor
+		d.EstUSD *= r.CostFactor
+	}
+	return d, nil
+}
+
+// pickEst is one pick's expected cost for the estimate: nothing where the
+// route bills nothing, the seat's expected cost for the class otherwise.
+func pickEst(t *table, class Class, pick Pick) float64 {
+	switch pick.Kind {
+	case Plan, Local, Free:
+		return 0
+	}
+	if math.IsInf(pick.CostUSD, 0) {
+		return 0
+	}
+	return pick.CostUSD
+}
+
+// crewEst is a crew's estimate against a task limit: each seat's expected
+// cost, times this install's cost factor when it is above one — the reading
+// that errs dear.
+func crewEst(t *table, class Class, crew []Pick, factor float64) float64 {
+	var sum float64
+	for _, pick := range crew {
+		sum += pickEst(t, class, pick)
+	}
+	if factor > 1 {
+		sum *= factor
+	}
+	return sum
+}
+
+// underCap is the crew picked at the least price of a point, from λ up, whose
+// estimate fits the task limit, and whether one fits. With none, it is the
+// cheapest crew the doubling reached.
+func underCap(t *table, class Class, candidates []Candidate, pins map[Seat]Pin, lambda, limit, factor float64) ([]Pick, float64, bool) {
+	at := math.Max(lambda, t.Knee/64)
+	var last []Pick
+	for i := 0; i < 40; i++ {
+		at *= 2
+		crew, err := pickCrew(t, class, candidates, pins, at)
+		if err != nil {
+			break
+		}
+		last = crew
+		if crewEst(t, class, crew, factor) <= limit+1e-12 {
+			return crew, at, true
+		}
+	}
+	return last, at, false
+}
+
+// estOf is a pick's expected cost: its estimate, or — for a pick made where
+// no estimate was read, a rescue — what it was weighed at.
+func estOf(pick Pick) float64 {
+	switch {
+	case pick.EstUSD > 0:
+		return pick.EstUSD
+	case pick.Kind == Plan || pick.Kind == Local || pick.Kind == Free:
+		return 0
+	}
+	return pick.CostUSD
+}
+
+// baseLambda is the price of a quality point this request starts at: the
+// knee, or the effort's own, moved by the learned steps and the day's pace.
+func baseLambda(t *table, r Request) float64 {
+	lambda := t.Knee
+	switch r.Effort {
+	case EffortBest:
+		return 0
+	case EffortCheap:
+		lambda *= cheapFactor
+	}
+	if r.Pace > 0 {
+		lambda *= r.Pace
+	}
+	return lambda
+}
+
+// firstOf is the first of two decisions that is set.
+func firstOf(a, b *Decision) *Decision {
+	if a != nil {
+		return a
+	}
+	return b
+}
+
+// ladderRivals is how many other models a seat's ladder offers after its
+// own model's routes.
+const ladderRivals = 2
+
+// ladderLook is how many times ladderRivals the ladder weighs before it puts
+// those at a similar cost first; similarCost is how much dearer than the
+// seat's pick "similar" allows.
+const (
+	ladderLook  = 3
+	similarCost = 3.0
+)
+
+// ladderFor is where a seat goes when its call fails to start, in order:
+//
+//  1. THE SAME MODEL ON ITS NEXT ROUTES, cheapest first. A route refusing says
+//     something about the route, and the model was picked on its own merits.
+//  2. THE NEXT QUALIFIED MODELS for the seat at the same λ — the picks the
+//     seat would have had without this model — so the fallback costs about
+//     what the pick did rather than whatever is left.
+func ladderFor(t *table, class Class, pick Pick, candidates []Candidate, lambda float64) []Pick {
+	// A SEAT THAT CANNOT START falls back to a credible model at a similar
+	// cost; the ability floor a first pick must reach does not send it to a
+	// model many times dearer.
+	fallback := *t
+	fallback.abilityFloor = false
+	t = &fallback
+	var ladder []Pick
+	own := Lineage(pick.Model)
+	for _, c := range candidates {
+		if t.abilityOf(c.Model).lineage != own {
+			continue
+		}
+		rest := append([]Route(nil), c.Routes...)
+		used := map[string]bool{pick.Send: true}
+		for {
+			var left []Route
+			for _, r := range rest {
+				if !used[r.Send] {
+					left = append(left, r)
+				}
+			}
+			if len(left) == 0 {
+				break
+			}
+			c.Routes = left
+			next := pickOf(t, class, pick.Seat, c)
+			used[next.Send] = true
+			ladder = append(ladder, next)
+			rest = left
+		}
+		break
+	}
+	// The rivals, in ONE pass: the best few other lineages by the score
+	// [bestFor] ranks on, kept in order as they are found — and then those at
+	// a SIMILAR COST to the seat's pick ahead of dearer ones, so a seat that
+	// cannot start moves sideways before it moves up: a failed call is not a
+	// request for a stronger crew.
+	keep := ladderRivals * ladderLook
+	type rival struct {
+		pick  Pick
+		score float64
+	}
+	var rivals []rival
+	for _, c := range candidates {
+		if t.abilityOf(c.Model).lineage == own {
+			continue
+		}
+		next, ok := eligible(t, class, pick.Seat, c)
+		if !ok {
+			continue
+		}
+		score := next.Quality - lambda*weighedCost(t, class, pick.Seat, next)
+		at := len(rivals)
+		for at > 0 && score > rivals[at-1].score+1e-12 {
+			at--
+		}
+		if at >= keep {
+			continue
+		}
+		rivals = append(rivals, rival{})
+		copy(rivals[at+1:], rivals[at:])
+		rivals[at] = rival{pick: next, score: score}
+		if len(rivals) > keep {
+			rivals = rivals[:keep]
+		}
+	}
+	near := math.Max(pick.CostUSD, t.costFloor(pick.Seat)*t.costScale(class, pick.Seat)) * similarCost
+	sort.SliceStable(rivals, func(i, j int) bool {
+		return rivals[i].pick.CostUSD <= near && rivals[j].pick.CostUSD > near
+	})
+	if len(rivals) > ladderRivals {
+		rivals = rivals[:ladderRivals]
+	}
+	for _, r := range rivals {
+		ladder = append(ladder, r.pick)
+	}
+	return ladder
+}
+
+// sameCrew is whether two crews seat the same models.
+func sameCrew(a, b []Pick) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for _, pick := range a {
+		if Lineage(seatOf(b, pick.Seat).Model) != Lineage(pick.Model) {
+			return false
+		}
+	}
+	return true
+}
+
+// seatOf is a crew's pick for a seat.
+func seatOf(crew []Pick, seat Seat) Pick {
+	if i := seatIndex(crew, seat); i >= 0 {
+		return crew[i]
+	}
+	return Pick{}
+}
+
+// avoiding is the candidates without the lineages named — unless that would
+// leave none, because a crew on a model that failed once is better than no
+// crew at all, and the task then says why it stopped.
+func avoiding(candidates []Candidate, avoid map[string]bool) []Candidate {
+	out := make([]Candidate, 0, len(candidates))
+	for _, c := range candidates {
+		if !avoid[Lineage(c.Model.ID)] {
+			out = append(out, c)
+		}
+	}
+	if len(out) == 0 {
+		return candidates
+	}
+	return out
+}
+
+// allPinned is whether every seat is pinned.
+func allPinned(pins map[Seat]Pin) bool {
+	for _, seat := range Seats {
+		if _, ok := pins[seat]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+// pickCrew picks every seat at one λ. The seats are independent — a crew's
+// quality is the sum of its seats' and so is its cost — so the best crew is
+// each seat's best pick, and no combination has to be searched.
+func pickCrew(t *table, class Class, candidates []Candidate, pins map[Seat]Pin, lambda float64) ([]Pick, error) {
+	crew := make([]Pick, 0, len(Seats))
+	for _, seat := range Seats {
+		if pin, ok := pins[seat]; ok {
+			crew = append(crew, pinned(t, class, seat, pin, candidates))
+			continue
+		}
+		pick, ok := bestFor(t, class, seat, candidates, lambda, math.Inf(-1))
+		if !ok {
+			return nil, NoCandidateError{Seat: seat}
+		}
+		if seat == Worker && t.cheapTolerance > 1 {
+			pick = strongerWithin(t, class, seat, candidates, pick, t.cheapTolerance)
+		}
+		crew = append(crew, pick)
+	}
+	if lambda > 0 && class != Bugfix {
+		crew = checkerFirst(t, class, crew, candidates, pins)
+	}
+	return crew, nil
+}
+
+// checkerFirst puts a support upgrade in the checker's seat. ON WORK WHOSE
+// SUPPORT SEATS THE WEIGHTS DO NOT TELL APART — their slopes within one
+// standard deviation of each other — the stronger of the two support picks
+// goes to the checker, which decides whether the work is accepted, and the
+// weaker to the planner. A pinned seat is never moved, and a model that
+// cannot sit the other seat stays where it was.
+func checkerFirst(t *table, class Class, crew []Pick, candidates []Candidate, pins map[Seat]Pin) []Pick {
+	if _, ok := pins[Planner]; ok {
+		return crew
+	}
+	if _, ok := pins[Checker]; ok {
+		return crew
+	}
+	link := t.linkOf(class)
+	p, c := link.Seats[Planner], link.Seats[Checker]
+	if math.Abs(p.Slope-c.Slope) > math.Max(p.SlopeSD, c.SlopeSD) {
+		return crew
+	}
+	pi, ci := -1, -1
+	for i, pick := range crew {
+		switch pick.Seat {
+		case Planner:
+			pi = i
+		case Checker:
+			ci = i
+		}
+	}
+	if pi < 0 || ci < 0 || Lineage(crew[pi].Model) == Lineage(crew[ci].Model) {
+		return crew
+	}
+	byID := map[string]Candidate{}
+	for _, cand := range candidates {
+		byID[cand.Model.ID] = cand
+	}
+	planCand, okP := byID[crew[pi].Model]
+	checkCand, okC := byID[crew[ci].Model]
+	if !okP || !okC {
+		return crew
+	}
+	asChecker, okC := eligible(t, class, Checker, planCand)
+	asPlanner, okP := eligible(t, class, Planner, checkCand)
+	if !okC || !okP || asChecker.Quality <= crew[ci].Quality+1e-9 {
+		return crew
+	}
+	out := append([]Pick(nil), crew...)
+	out[pi], out[ci] = asPlanner, asChecker
+	return out
+}
+
+// strongerWithin is a cheap seat's pick traded for the strongest eligible
+// model that costs at most tolerance times as much: a model barely dearer and
+// clearly stronger is the better buy even when quality is nearly free.
+func strongerWithin(t *table, class Class, seat Seat, candidates []Candidate, pick Pick, tolerance float64) Pick {
+	limit := weighedCost(t, class, seat, pick) * tolerance
+	best := pick
+	for _, c := range candidates {
+		other, ok := eligible(t, class, seat, c)
+		if !ok || weighedCost(t, class, seat, other) > limit+1e-12 || other.Quality <= best.Quality+1e-9 {
+			continue
+		}
+		best = other
+	}
+	return best
+}
+
+// bestFor is one seat's best pick at λ among the models whose quality is
+// above floor. Ties go to the cheaper pick and then to the smaller id, so the
+// answer never depends on the order the candidates arrived in.
+func bestFor(t *table, class Class, seat Seat, candidates []Candidate, lambda, floor float64) (Pick, bool) {
+	var best Pick
+	var bestScore float64
+	found := false
+	for _, c := range candidates {
+		pick, ok := eligible(t, class, seat, c)
+		if !ok || pick.Quality <= floor+1e-9 {
+			continue
+		}
+		score := pick.Quality - lambda*weighedCost(t, class, seat, pick)
+		switch {
+		case !found, score > bestScore+1e-12:
+		case score < bestScore-1e-12:
+			continue
+		case pick.CostUSD < best.CostUSD-1e-12:
+		case pick.CostUSD > best.CostUSD+1e-12:
+			continue
+		case pick.Model < best.Model:
+		default:
+			continue
+		}
+		best, bestScore, found = pick, score, true
+	}
+	return best, found
+}
+
+// Scored is one candidate as a seat weighed it: the model, the route it
+// would ride, its quality and cost as the router read them, and the score
+// (quality − λ·cost) it was ranked by.
+type Scored struct {
+	Model    string    `json:"m"`
+	Provider string    `json:"p,omitempty"`
+	Kind     RouteKind `json:"k,omitempty"`
+	Quality  float64   `json:"q"`
+	CostUSD  float64   `json:"c"`
+	Score    float64   `json:"s"`
+}
+
+// Explain is each seat's best n candidates at the λ a decision was made at,
+// best first — what a router log row carries so a crew can be explained from
+// the log alone.
+func Explain(class Class, lambda float64, candidates []Candidate, learned map[string]float64, n int) map[Seat][]Scored {
+	t := forDecision(candidates, learned)
+	out := map[Seat][]Scored{}
+	for _, seat := range Seats {
+		var ranked []Scored
+		for _, c := range candidates {
+			pick, ok := eligible(t, class, seat, c)
+			if !ok {
+				continue
+			}
+			cost := weighedCost(t, class, seat, pick)
+			ranked = append(ranked, Scored{Model: pick.Model, Provider: pick.Provider, Kind: pick.Kind,
+				Quality: round3(pick.Quality), CostUSD: round3(cost), Score: round3(pick.Quality - lambda*cost)})
+		}
+		sort.SliceStable(ranked, func(i, j int) bool { return ranked[i].Score > ranked[j].Score })
+		if len(ranked) > n {
+			ranked = ranked[:n]
+		}
+		out[seat] = ranked
+	}
+	return out
+}
+
+// round3 keeps a logged figure to three places.
+func round3(x float64) float64 { return math.Round(x*1000) / 1000 }
+
+// seatable is whether a candidate can sit a seat at all: it takes tool calls,
+// it has a route, and its context holds the seat's work. A free pool is a
+// ROUTE of its model, not a model ([Free]): whether the model may sit the seat
+// is decided on the model's own merits, and the route is chosen after.
+func seatable(seat Seat, c Candidate) bool {
+	if !c.Model.Tools || len(c.Routes) == 0 {
+		return false
+	}
+	return c.Model.Context <= 0 || c.Model.Context >= seatContext[seat]
+}
+
+// Seatable is [seatable] for a caller that offers models for a seat — a
+// picker, a rescue — so it offers exactly what the router could seat.
+func Seatable(seat Seat, c Candidate) bool { return seatable(seat, c) }
+
+// seatContext is the least context window a model needs to sit each seat, in
+// tokens: the worker holds a long agent loop over a repository, the checker
+// reads the work and its diff, the planner reads a brief and writes a plan. A
+// model that publishes no window is not refused for it.
+var seatContext = map[Seat]int{Worker: 64_000, Checker: 64_000, Planner: 32_000}
+
+// IsFree is whether an id names a free, rate-limited route (`…:free`).
+func IsFree(id string) bool {
+	return strings.HasSuffix(strings.ToLower(strings.TrimSpace(id)), ":free")
+}
+
+// eligible is one candidate in one seat, and whether it may sit it: seatable,
+// and credible under the weights ([table.credible]) — its row says enough to
+// score it, and its ability may reach what the seat needs.
+func eligible(t *table, class Class, seat Seat, c Candidate) (Pick, bool) {
+	if !seatable(seat, c) {
+		return Pick{}, false
+	}
+	a := t.abilityOf(c.Model)
+	pick := pickAt(t, class, seat, c, a)
+	if t.rescue {
+		return pick, true
+	}
+	return pick, t.seatCredible(seat, a)
+}
+
+// weighedCost is the cost a pick is weighed at: its expected cost on its
+// route, an unpriced model's already floored ([pickOf]).
+func weighedCost(t *table, class Class, seat Seat, pick Pick) float64 {
+	return pick.CostUSD
+}
+
+// pickOf is one candidate in one seat on its cheapest route. Routes of equal
+// cost keep the caller's order, which puts the provider the person connected
+// for that vendor ahead of a router.
+func pickOf(t *table, class Class, seat Seat, c Candidate) Pick {
+	return pickAt(t, class, seat, c, t.abilityOf(c.Model))
+}
+
+// pickAt is [pickOf] on the candidate's ability already read.
+func pickAt(t *table, class Class, seat Seat, c Candidate, a ability) Pick {
+	q, sd := t.qualityOf(class, seat, a)
+	metered := t.classCost(class, seat, c.Model)
+	unpriced := c.Model.PromptPrice <= 0 && c.Model.CompletionPrice <= 0
+	floor := 0.0
+	if unpriced {
+		// An unpriced model is weighed at what a priced model as able costs,
+		// never at zero.
+		floor = t.priceFor(seat, a.U) * t.costScale(class, seat)
+		metered = floor
+	}
+	fallback := metered
+	pick := Pick{Seat: seat, Model: c.Model.ID, Quality: q, SD: sd, Learned: t.learnedOf(class, seat, a),
+		CostUSD: math.Inf(1)}
+	for _, route := range c.Routes {
+		cost := routeCost(route, metered, fallback)
+		if unpriced && route.Kind == Free {
+			// A free pool of a model nobody prices is weighed above the
+			// cheapest priced model: its zero is not a price.
+			cost = math.Max(cost, floor+freeLimitPenalty)
+		}
+		if cost < pick.CostUSD-1e-12 {
+			pick.Provider, pick.Send, pick.Kind, pick.CostUSD = route.Provider, route.Send, route.Kind, cost
+		}
+	}
+	return pick
+}
+
+// routeCost is what one more task is EXPECTED to cost on a route: what it
+// bills — the metered price, nothing on a plan, a local model or a free pool —
+// plus what its refusals cost: the chance it refuses a first call times the
+// paid route the seat then falls to (fallback). A free pool's chance starts
+// pessimistic and it pays a charge for its limits.
+//
+// A FREE ROUTE IS NEVER PRICED AT ZERO. Zero is what made a free pool win a
+// worker seat and die in its first second; its expected cost is what a
+// person actually pays for choosing it.
+func routeCost(route Route, metered, fallback float64) float64 {
+	switch route.Kind {
+	case Plan, Local:
+		return route.FailRate * fallback
+	case Free:
+		rate := route.FailRate
+		if rate <= 0 {
+			rate = freeFailPrior
+		}
+		return rate*fallback + math.Max(freeLimitPenalty, freeLimitShare*fallback)
+	}
+	// A ROUTE THAT REFUSES SOME FIRST CALLS costs what it bills plus what its
+	// refusals send elsewhere, at this install's learned rate.
+	return metered + route.FailRate*fallback
+}
+
+// pinned is a pinned seat's pick: the pin, always, on the route the pin names
+// when it names one. A pinned model the candidates do not carry — outside the
+// catalog, or on a provider the router cannot price — still sits the seat on
+// the send the caller resolved; its quality is the weights' reading of what
+// its row carries, and its cost what its route publishes, or nothing.
+func pinned(t *table, class Class, seat Seat, pin Pin, candidates []Candidate) Pick {
+	pick := Pick{Seat: seat, Model: pin.Model, Provider: pin.Provider, Send: pin.Send, Kind: pin.Kind, Pinned: true}
+	for _, c := range candidates {
+		if Lineage(c.Model.ID) != Lineage(pin.Model) {
+			continue
+		}
+		found := pickOf(t, class, seat, c)
+		if pin.Provider != "" {
+			for _, route := range c.Routes {
+				if strings.EqualFold(route.Provider, pin.Provider) {
+					found.Provider, found.Send, found.Kind = route.Provider, route.Send, route.Kind
+					metered := t.classCost(class, seat, c.Model)
+					found.CostUSD = routeCost(route, metered, math.Max(metered, t.costFloor(seat)*t.costScale(class, seat)))
+				}
+			}
+		}
+		if math.IsInf(found.CostUSD, 1) {
+			found.CostUSD = 0
+		}
+		if pin.Send != "" && (found.Send == "" || strings.EqualFold(found.Provider, pin.Provider)) {
+			// THE PIN'S OWN SEND ON ITS OWN ROUTE: the id the person wrote (or
+			// the variant it resolved to), never the candidate's first row.
+			found.Send = pin.Send
+			if found.Kind == "" || pin.Kind == Free {
+				found.Kind = pin.Kind
+			}
+		}
+		found.Model = pin.Model
+		found.Pinned = true
+		return found
+	}
+	// A pin the candidates do not carry is read on its id alone: the weights'
+	// prior for a model they know nothing of, at no known cost.
+	pick.Quality, pick.SD = t.quality(class, seat, Model{ID: pin.Model})
+	if pick.Send == "" {
+		pick.Send = pin.Model
+	}
+	return pick
+}
+
+// stronger is a redo's crew: ONE RUNG UP, on one seat.
+//
+// Every seat keeps what ran; then the unpinned seat whose next rung buys the
+// most — quality gained less the dearer price at one step below this λ — moves
+// up to that rung and no further. The next rung is the least step up the
+// seat's front ([nextRung]): the next model above it by quality that no other
+// model beats on both quality and cost. A redo that jumped to the top of the
+// catalog skipped every mid-price model and multiplied the bill for one
+// sentence of dissatisfaction; a ladder is walked a rung at a time, and a
+// second redo takes the next rung. Ties go to the checker, then the worker,
+// then the planner — the checker is the seat the routing rule upgrades first.
+func stronger(t *table, class Class, candidates []Candidate, pins map[Seat]Pin, lambda float64, ran *Decision) ([]Pick, float64, error) {
+	crew := make([]Pick, 0, len(Seats))
+	for _, seat := range Seats {
+		if pin, ok := pins[seat]; ok {
+			crew = append(crew, pinned(t, class, seat, pin, candidates))
+			continue
+		}
+		was := ran.Seat(seat)
+		if was.Model == "" {
+			pick, ok := bestFor(t, class, seat, candidates, lambda, math.Inf(-1))
+			if !ok {
+				return nil, 0, NoCandidateError{Seat: seat}
+			}
+			was = pick
+		}
+		// A one-off over every pin starts from the pins as they ran.
+		was.Pinned = false
+		crew = append(crew, was)
+	}
+	step := lambda / stepFactor
+	at, gain := -1, math.Inf(-1)
+	var up Pick
+	for _, seat := range []Seat{Checker, Worker, Planner} {
+		i := seatIndex(crew, seat)
+		if i < 0 || crew[i].Pinned {
+			continue
+		}
+		next, ok := nextRung(t, class, seat, candidates, crew[i])
+		if !ok {
+			continue
+		}
+		g := (next.Quality - crew[i].Quality) - step*(weighedCost(t, class, seat, next)-weighedCost(t, class, seat, crew[i]))
+		if g > gain+1e-12 {
+			at, gain, up = i, g, next
+		}
+	}
+	if at < 0 {
+		return nil, 0, ErrStrongest
+	}
+	crew[at] = up
+	return crew, step, nil
+}
+
+// readingOf is the reading a decision is made on: the caller's own when it
+// handed one on, the class given with the reach read off the task's words
+// when it gave only the class, and the classifier's otherwise. A CLASS GIVEN
+// IS NOT A REACH FORGOTTEN: a bugfix named by a replay or a caller is still
+// read for reach whenever the task's words are there to read.
+func readingOf(r Request) Reading {
+	switch {
+	case r.Reading != nil && (r.Class == "" || r.Class == r.Reading.Class):
+		return *r.Reading
+	case r.Class == "":
+		return Classify(r.Task)
+	}
+	reading := Reading{Class: r.Class, Why: "given", Sure: true}
+	if r.Class == Bugfix {
+		reading.Complex = complexFix(reachText(taskTitle(r.Task.Text)))
+	}
+	return reading
+}
+
+// withReachingWorker is a complex fix's crew: its worker one rung up the
+// seat's front ([nextRung]) from the one the knee picked — the next model
+// above it by quality that nothing beats on both quality and cost, not the
+// top of the catalog. A pinned worker stays the pin, and a worker already at
+// the top stays where it is.
+func withReachingWorker(t *table, crew []Pick, candidates []Candidate) []Pick {
+	i := seatIndex(crew, Worker)
+	if i < 0 || crew[i].Pinned {
+		return crew
+	}
+	next, ok := nextRung(t, Bugfix, Worker, candidates, crew[i])
+	if !ok {
+		return crew
+	}
+	out := append([]Pick(nil), crew...)
+	out[i] = next
+	return out
+}
+
+// seatIndex is where a seat's pick sits in a crew, -1 when it is not there.
+func seatIndex(crew []Pick, seat Seat) int {
+	for i, pick := range crew {
+		if pick.Seat == seat {
+			return i
+		}
+	}
+	return -1
+}
+
+// nextRung is the least step up a seat's front from the pick it has: among the
+// models above it by quality, those no other model beats on both quality and
+// weighed cost, and of those the one with the least quality — ties to the
+// cheaper.
+func nextRung(t *table, class Class, seat Seat, candidates []Candidate, from Pick) (Pick, bool) {
+	own := Lineage(from.Model)
+	var above []Pick
+	for _, c := range candidates {
+		pick, ok := eligible(t, class, seat, c)
+		if !ok || pick.Quality <= from.Quality+1e-9 || t.abilityOf(c.Model).lineage == own {
+			continue
+		}
+		above = append(above, pick)
+	}
+	// The front, best first: a pick is on it when nothing at least as good
+	// costs no more (and one of the two strictly). Sweeping by quality from
+	// the top, a pick is dominated exactly when an earlier one is no dearer.
+	sort.SliceStable(above, func(i, j int) bool {
+		if math.Abs(above[i].Quality-above[j].Quality) > 1e-9 {
+			return above[i].Quality > above[j].Quality
+		}
+		return weighedCost(t, class, seat, above[i]) < weighedCost(t, class, seat, above[j])
+	})
+	var best Pick
+	found := false
+	cheapest := math.Inf(1)
+	for i := 0; i < len(above); {
+		// One quality level at a time: within it only the cheapest can be on
+		// the front, and it is dominated by anything above it no dearer.
+		j := i
+		for j < len(above) && math.Abs(above[j].Quality-above[i].Quality) <= 1e-9 {
+			j++
+		}
+		p := above[i]
+		pc := weighedCost(t, class, seat, p)
+		if pc < cheapest-1e-12 {
+			best, found = p, true
+		}
+		for k := i; k < j; k++ {
+			cheapest = math.Min(cheapest, weighedCost(t, class, seat, above[k]))
+		}
+		i = j
+	}
+	return best, found
+}
+
+// nextUp is the cheapest model whose quality in the seat is above floor.
+func nextUp(t *table, class Class, seat Seat, candidates []Candidate, floor float64) (Pick, bool) {
+	var best Pick
+	found := false
+	for _, c := range candidates {
+		pick, ok := eligible(t, class, seat, c)
+		if !ok || pick.Quality <= floor+1e-9 {
+			continue
+		}
+		if !found || pick.Quality < best.Quality-1e-9 ||
+			(math.Abs(pick.Quality-best.Quality) <= 1e-9 && (pick.CostUSD < best.CostUSD || (pick.CostUSD == best.CostUSD && pick.Model < best.Model))) {
+			best, found = pick, true
+		}
+	}
+	return best, found
+}
+
+// Pace is how a daily cap moves the price of a quality point: nothing until
+// half the cap is spent, then λ grows as what is left shrinks — twice as
+// stingy with a quarter of the cap left, five times with a tenth — so a day
+// that is running hot drifts to cheaper crews before it reaches the wall.
+// atCap is the wall itself: the day's spend has reached the cap. A cap of
+// zero is no cap.
+func Pace(spent, cap float64) (multiplier float64, atCap bool) {
+	if cap <= 0 {
+		return 1, false
+	}
+	if spent >= cap {
+		return 1, true
+	}
+	frac := spent / cap
+	if frac <= 0.5 {
+		return 1, false
+	}
+	return 1 / (2 * (1 - frac)), false
+}
+
+// Gap is one class of work the allowed models leave without a seat the
+// routing rule requires.
+type Gap struct {
+	Class Class
+	Seat  Seat
+	Line  string
+}
+
+// Gaps names what the allowed models cannot cover. Today that is one thing,
+// the seat the routing rule depends on: open-ended work with no strong checker
+// — none credible whose ability reaches the middle the open-ended link is
+// centred on.
+//
+// A PINNED SEAT IS THE SEAT. A pin always runs, so a pinned checker is the only
+// model the question is asked of: a strong pin leaves no gap however weak the
+// rest of the allowed models are, and a weak pin is a gap however strong they
+// are, said with the pin's name because the pin is what a person would change.
+// pins carry each pinned seat's model as the catalog reads it, or only its id
+// when the catalog does not carry it; a candidate of the same lineage is read
+// in its place, the way [pinned] reads it. An unpinned checker is asked of
+// every model allowed, as before.
+func Gaps(candidates []Candidate, pins map[Seat]Model) []Gap {
+	t := forDecision(candidates, nil)
+	strong := t.linkOf(OpenEnded).URef
+	isStrong := func(m Model) bool {
+		a := t.abilityOf(m)
+		return t.credibleAt(a) && a.U+math.Sqrt(a.VarU) >= strong
+	}
+	if pin, ok := pins[Checker]; ok && strings.TrimSpace(pin.ID) != "" {
+		for _, c := range candidates {
+			if Lineage(c.Model.ID) == Lineage(pin.ID) {
+				pin = c.Model
+				break
+			}
+		}
+		if isStrong(pin) {
+			return nil
+		}
+		return []Gap{{Class: OpenEnded, Seat: Checker, Line: "checker pinned to " + ShortModel(pin.ID) + " · open-ended work will be checked weakly"}}
+	}
+	for _, c := range candidates {
+		if seatable(Checker, c) && isStrong(c.Model) {
+			return nil
+		}
+	}
+	return []Gap{{Class: OpenEnded, Seat: Checker, Line: "no strong checker among the models you allow · open-ended work will be checked weakly"}}
+}
+
+// ── how a decision reads ────────────────────────────────────────────────────
+
+// Line is the one line a task card and a headless run's summary print:
+//
+//	bugfix · worker glm-5.3-flash (openrouter) · checker glm-5.3-flash · $0.021 (est $0.023)
+//
+// pinMark is drawn in front of a pinned seat's model; the chat surface hands
+// its own glyph and a headless door hands 📌. actual below zero is not known
+// yet, and the line then ends on the estimate alone (the emptiness law: an
+// unknown is absent, never $0.00).
+func (d Decision) Line(pinMark string, actual float64) string {
+	var b strings.Builder
+	if len(d.Retried) > 0 {
+		// A SEAT THAT MOVED DURING THE TASK IS SAID FIRST, plainly: the crew
+		// running is not the crew picked, and why — before any figure a reader
+		// could take for the picked crew's success.
+		//
+		// EACH SEAT SAYS ITS NET MOVE, once: where it started, where it is
+		// now, the FIRST reason — the cause, which a free pool at its limit
+		// further down never is — and how many it tried between — never the
+		// whole trail, which is the router log's to keep. A line that listed
+		// every rung of a long ladder wrapped past the card.
+		b.WriteString("running on fallback crew")
+		for _, seat := range Seats {
+			var first, last Retry
+			moves := 0
+			for _, r := range d.Retried {
+				if r.Seat != seat {
+					continue
+				}
+				if moves == 0 {
+					first = r
+				}
+				last, moves = r, moves+1
+			}
+			if moves == 0 {
+				continue
+			}
+			b.WriteString(" · " + string(seat) + " " + ShortModel(first.From) + " → " + ShortModel(last.To))
+			var note []string
+			if first.Why != "" {
+				note = append(note, first.Why)
+			}
+			if moves > 1 {
+				note = append(note, "+"+strconv.Itoa(moves-1)+" tried")
+			}
+			if len(note) > 0 {
+				b.WriteString(" (" + strings.Join(note, "; ") + ")")
+			}
+		}
+		b.WriteString(" · ")
+	}
+	b.WriteString(d.Class.Word())
+	worker, planner, checker := d.Seat(Worker), d.Seat(Planner), d.Seat(Checker)
+	// EACH SEAT IS SAID ONCE, WITH ITS CHANGE: a seat a redo or an effort word
+	// moved reads `planner glm-5.3-flash → kimi-k3` where the seat stands,
+	// never the seat and then its rung again at the end.
+	rung := map[Seat]Retry{}
+	for _, r := range d.Rungs {
+		rung[r.Seat] = r
+	}
+	said := func(pick Pick) string {
+		if r, ok := rung[pick.Seat]; ok {
+			return ShortModel(r.From) + " → " + seatModel(pick, pinMark)
+		}
+		return seatModel(pick, pinMark)
+	}
+	b.WriteString(" · worker ")
+	b.WriteString(said(worker))
+	if worker.Provider != "" {
+		route := worker.Provider
+		if worker.Kind == Free {
+			route += " · free"
+		}
+		b.WriteString(" (" + route + ")")
+	}
+	// THE PLANNER IS NAMED WHEN IT IS NOT THE WORKER. A crew whose planner is
+	// the worker's model says nothing a person reading the line needs; one
+	// whose planner is another model is a crew of three, and says so.
+	_, plannerMoved := rung[Planner]
+	if planner.Model != "" && (plannerMoved || Lineage(planner.Model) != Lineage(worker.Model)) {
+		b.WriteString(" · planner ")
+		b.WriteString(said(planner))
+	}
+	b.WriteString(" · checker ")
+	b.WriteString(said(checker))
+	switch {
+	case actual == Unspent:
+	case actual >= 0:
+		b.WriteString(" · " + Money(actual) + " (est " + Money(d.EstUSD) + ")")
+	default:
+		b.WriteString(" · est " + Money(d.EstUSD))
+	}
+	if d.Note != "" {
+		b.WriteString(" · " + d.Note)
+	}
+	return b.String()
+}
+
+// seatModel is one seat's model the way the line names it: the name after the
+// vendor, with the pin mark in front when the seat was pinned.
+func seatModel(pick Pick, pinMark string) string {
+	name := ShortModel(pick.Model)
+	if sent := ShortModel(pick.Send); pick.Pinned && sent != "" && sent != name {
+		// A PIN SENT AS ANOTHER ID SAYS WHICH: `deepseek-v4-flash → -0731`.
+		if strings.HasPrefix(sent, name) {
+			sent = sent[len(name):]
+		}
+		name += " → " + sent
+	}
+	switch {
+	case pick.Pinned && strings.TrimSpace(pinMark) != "":
+		return pinMark + " " + name
+	case pick.Pinned:
+		// NO MARK IS NO BLANK: a surface with no glyph for a pin says the word.
+		return name + " (pinned)"
+	}
+	return name
+}
+
+// ShortModel is a model id without its vendor: the half a person reads.
+func ShortModel(id string) string {
+	id = strings.TrimSpace(id)
+	if at := strings.LastIndex(id, "/"); at >= 0 {
+		return id[at+1:]
+	}
+	return id
+}
+
+// Money spells a task's dollars: three places under a dollar, where the
+// difference between routed crews lives, and two above it.
+func Money(usd float64) string {
+	if usd >= 1 {
+		return fmt.Sprintf("$%.2f", usd)
+	}
+	return fmt.Sprintf("$%.3f", usd)
+}
+
+// Names lists the candidate ids a decision chose among, sorted — the field a
+// logged decision carries so it can be analysed after the fact.
+func Names(candidates []Candidate) []string {
+	names := make([]string, 0, len(candidates))
+	for _, c := range candidates {
+		names = append(names, c.Model.ID)
+	}
+	sort.Strings(names)
+	return names
+}
diff --git a/internal/crewroute/route_test.go b/internal/crewroute/route_test.go
new file mode 100644
index 0000000000..f398dc9e90
--- /dev/null
+++ b/internal/crewroute/route_test.go
@@ -0,0 +1,698 @@
+package crewroute
+
+import (
+	"errors"
+	"math"
+	"math/rand"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestThePriorWeightsParseAndAreSmall(t *testing.T) {
+	if len(priorJSON) > 2<<20 {
+		t.Fatalf("prior.json is %d bytes; the embedded weights must stay under 2 MB", len(priorJSON))
+	}
+	w := load()
+	if w.Knee <= 0 || len(w.Shapes) != 3 || len(w.Features) == 0 {
+		t.Fatalf("weights incomplete: knee %v, %d shapes, %d features", w.Knee, len(w.Shapes), len(w.Features))
+	}
+	for _, class := range Classes {
+		for _, seat := range Seats {
+			if _, ok := w.Link[class].Seats[seat]; !ok {
+				t.Errorf("no link for %s/%s", class, seat)
+			}
+		}
+	}
+}
+
+// THE WEIGHTS CARRY NO MODEL OF THEIR OWN: every model, the ones a person
+// knows best included, is scored from its catalog row.
+func TestTheWeightsCarryNoModelRows(t *testing.T) {
+	for _, m := range []Model{glmFlash, kimiK3, v4Flash} {
+		if strings.Contains(string(priorJSON), m.ID) || strings.Contains(string(priorJSON), ShortModel(m.ID)) {
+			t.Errorf("prior.json names %s", m.ID)
+		}
+	}
+}
+
+// THE ROUTED POLICY, read off the weights and the prices rather than branches:
+// open-ended work pays more for ability in every seat than a fix does, so
+// there are prices at which open-ended work buys the stronger checker and a
+// fix does not — and none at which a fix buys it and open-ended work does not.
+func TestOpenEndedWorkBuysAStrongerCheckerAtPricesAFixDoesNot(t *testing.T) {
+	tab := prior()
+	for _, seat := range Seats {
+		if fix, open := tab.linkOf(Bugfix).Seats[seat].Slope, tab.linkOf(OpenEnded).Seats[seat].Slope; open <= fix {
+			t.Errorf("%s: open-ended slope %.3f not above the fix's %.3f", seat, open, fix)
+		}
+	}
+	weak := candidateOf(glmFlash)
+	split := false
+	for mult := 0.25; mult <= 64; mult *= 1.25 {
+		strong := glm53
+		strong.ID = "acme/strong-checker"
+		strong.PromptPrice, strong.CompletionPrice, strong.CacheReadPrice = glmFlash.PromptPrice*mult, glmFlash.CompletionPrice*mult, glmFlash.CacheReadPrice*mult
+		cands := []Candidate{weak, candidateOf(strong)}
+		fix, err := Decide(Request{Class: Bugfix, Candidates: cands})
+		if err != nil {
+			t.Fatal(err)
+		}
+		open, err := Decide(Request{Class: OpenEnded, Candidates: cands})
+		if err != nil {
+			t.Fatal(err)
+		}
+		fixBuys, openBuys := fix.Seat(Checker).Model == strong.ID, open.Seat(Checker).Model == strong.ID
+		if fixBuys && !openBuys {
+			t.Errorf("at %.2fx the flash price a fix buys the strong checker and open-ended work does not", mult)
+		}
+		split = split || (openBuys && !fixBuys)
+	}
+	if !split {
+		t.Error("no price at which open-ended work buys the stronger checker and a fix does not")
+	}
+	for _, cands := range [][]Candidate{catalogCandidates(), frontierCandidates()} {
+		fix, _ := Decide(Request{Class: Bugfix, Candidates: cands})
+		open, _ := Decide(Request{Class: OpenEnded, Candidates: cands})
+		if fix.EstUSD >= open.EstUSD {
+			t.Errorf("a fix estimates $%.3f, open-ended work $%.3f: the fix should be the cheaper crew", fix.EstUSD, open.EstUSD)
+		}
+	}
+}
+
+// A CHEAPER MODEL AT LEAST AS GOOD ON EVERY PUBLISHED INDEX NEVER LOSES. For
+// rows that publish the same indexes, A no dearer than B and at least as good
+// on each of them, B is never scored above A in any seat nor cheaper, and a
+// decision over the two never seats B — whatever their release dates,
+// context, licence or family say.
+func TestADominatedModelNeverBeatsItsDominator(t *testing.T) {
+	rng := rand.New(rand.NewSource(7))
+	names := []string{"deepseek/deepseek-v9-flash", "z-ai/glm-9", "acme/model", "moonshotai/kimi-k9", "anthropic/claude-opus-9"}
+	for i := 0; i < 400; i++ {
+		var a, b Model
+		b = Model{ID: names[rng.Intn(len(names))], Open: rng.Intn(2) == 0, Tools: true,
+			PromptPrice: (0.05 + rng.Float64()*5) / 1e6, CompletionPrice: (0.1 + rng.Float64()*25) / 1e6,
+			Context: 1 << (17 + rng.Intn(4)), Released: released(2025+rng.Intn(2), time.Month(1+rng.Intn(12)), 1+rng.Intn(28))}
+		b.CacheReadPrice = b.PromptPrice / 10
+		a = Model{ID: names[rng.Intn(len(names))] + "-a", Open: rng.Intn(2) == 0, Tools: true,
+			PromptPrice: b.PromptPrice * rng.Float64(), CompletionPrice: b.CompletionPrice * rng.Float64(),
+			Context: 1 << (17 + rng.Intn(4)), Released: released(2025+rng.Intn(2), time.Month(1+rng.Intn(12)), 1+rng.Intn(28))}
+		a.CacheReadPrice = a.PromptPrice / 10
+		fields := []struct {
+			get func(*Model) *float64
+			lo  float64
+		}{{func(m *Model) *float64 { return &m.Intelligence }, 20}, {func(m *Model) *float64 { return &m.Coding }, 40},
+			{func(m *Model) *float64 { return &m.Agentic }, 20}, {func(m *Model) *float64 { return &m.ArenaElo }, 1150}}
+		published := 0
+		for _, f := range fields {
+			if rng.Intn(2) == 0 {
+				continue
+			}
+			published++
+			v := f.lo + rng.Float64()*f.lo*0.8
+			*f.get(&b) = v
+			*f.get(&a) = v + rng.Float64()*f.lo*0.2
+		}
+		if published == 0 {
+			a.Coding, b.Coding = 70, 60
+		}
+		tab := prior()
+		for _, class := range []Class{Bugfix, OpenEnded, Other} {
+			for _, seat := range Seats {
+				qa, _ := tab.quality(class, seat, a)
+				qb, _ := tab.quality(class, seat, b)
+				if qb > qa+1e-9 {
+					t.Fatalf("%s %s: dominated %+v scored %.4f above %+v at %.4f", class, seat, b, qb, a, qa)
+				}
+				if tab.classCost(class, seat, b) < tab.classCost(class, seat, a) {
+					t.Fatalf("%s %s: the dominated model costs less", class, seat)
+				}
+			}
+			d, err := Decide(Request{Class: class, Candidates: []Candidate{candidateOf(b), candidateOf(a)}})
+			if err != nil {
+				continue
+			}
+			for _, p := range d.Crew {
+				if p.Model == b.ID {
+					t.Fatalf("%s: %s seated the dominated %+v over %+v", class, p.Seat, b, a)
+				}
+			}
+		}
+	}
+	// The row that started it: a flash model no dearer on any price than
+	// another and better on every index the other publishes, which publishes
+	// one index to its four.
+	thin := Model{ID: "deepseek/deepseek-v4.1-flash", Open: true, PromptPrice: 1.5e-7, CompletionPrice: 6e-7, CacheReadPrice: glmFlash.CacheReadPrice,
+		Intelligence: 39.5, Context: 1048576, Released: released(2026, 9, 10), Tools: true}
+	for _, class := range []Class{Bugfix, OpenEnded} {
+		for _, effort := range []Effort{EffortCheap, EffortKnee} {
+			d, err := Decide(Request{Class: class, Effort: effort, Candidates: []Candidate{candidateOf(thin), candidateOf(glmFlash)}})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := d.Seat(Worker).Model; got != glmFlash.ID {
+				t.Errorf("%s %q: worker %s over %s", class, effort, got, glmFlash.ID)
+			}
+		}
+	}
+}
+
+// THE SUPPORT SEATS OF A FIX STILL PAY FOR ABILITY: a model that publishes one
+// middling index at a fraction of a cent does not check a fix while a model
+// strong on every index costs a few tenths of a cent more.
+func TestAFixIsNotCheckedByWhateverIsCheapest(t *testing.T) {
+	if s := prior().linkOf(Bugfix).Seats[Checker].Slope; s <= 0 {
+		t.Fatalf("a fix's checker pays nothing for ability (slope %.3f)", s)
+	}
+	thin := Model{ID: "inclusionai/ling-3.0-flash", Open: true, PromptPrice: 2.1e-8, CompletionPrice: 6.3e-8, CacheReadPrice: 4.2e-9,
+		Coding: 50.6, Context: 262144, Released: released(2026, 7, 23), Tools: true}
+	d, err := Decide(Request{Class: Bugfix, Candidates: []Candidate{candidateOf(thin), candidateOf(glmFlash)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := d.Seat(Checker).Model; got != glmFlash.ID {
+		t.Errorf("a fix's checker is %s", got)
+	}
+	// A CHECKER'S MEAN ABILITY MUST REACH THE FLOOR when any candidate's does.
+	tab := forDecision([]Candidate{candidateOf(thin), candidateOf(v4Flash), candidateOf(glmFlash)}, nil)
+	for _, m := range []Model{thin, v4Flash, glmFlash} {
+		a := tab.abilityOf(m)
+		if pick, ok := eligible(tab, Bugfix, Checker, candidateOf(m)); ok && a.U < tab.UFloor {
+			t.Errorf("%s may check with mean ability %.3f under the floor %.3f", pick.Model, a.U, tab.UFloor)
+		}
+	}
+}
+
+// --BEST BUYS QUALITY IN EVERY SEAT, up to the task limit: no seat of a best
+// crew is left on a model another candidate outscores there.
+func TestBestBuysTheStrongestModelInEverySeat(t *testing.T) {
+	cands := frontierCandidates()
+	for _, class := range []Class{Bugfix, OpenEnded} {
+		d, err := Decide(Request{Class: class, Candidates: cands, Effort: EffortBest, TaskCap: 5})
+		if err != nil {
+			t.Fatal(err)
+		}
+		tab := forDecision(cands, nil)
+		for _, p := range d.Crew {
+			for _, c := range cands {
+				if other, ok := eligible(tab, class, p.Seat, c); ok && other.Quality > p.Quality+1e-9 {
+					t.Errorf("%s best: %s is %s at %.3f while %s scores %.3f", class, p.Seat, p.Model, p.Quality, other.Model, other.Quality)
+				}
+			}
+		}
+	}
+}
+
+// WITH ONLY CATALOG METADATA, a model whose published indexes are stronger
+// wins the seat from one at the same price, context and release date.
+func TestAStrongerIndexedSimilarPricedModelWinsASeat(t *testing.T) {
+	weak := catalogRow("acme/coder-a", true, 0.3, 1.2, 35, 60, 35)
+	strong := catalogRow("zeta/coder-b", true, 0.3, 1.2, 48, 76, 55)
+	for _, c := range []*Candidate{&weak, &strong} {
+		c.Model.Released = released(2026, 8, 1)
+	}
+	for _, class := range []Class{OpenEnded, Other} {
+		d, err := Decide(Request{Class: class, Candidates: []Candidate{weak, strong}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, seat := range []Seat{Worker, Checker} {
+			if got := d.Seat(seat).Model; got != strong.Model.ID {
+				t.Errorf("%s %s went to %s, want the stronger-indexed model", class, seat, got)
+			}
+		}
+	}
+}
+
+// A MODEL WITH NO USABLE METADATA is not scored, so it is neither a pick nor a
+// rung — however cheap — and it still sits a seat a person pins it to.
+func TestAModelWithNoUsableMetadataIsNotPickedUnlessPinned(t *testing.T) {
+	bare := Candidate{Model: Model{ID: "somelab/mystery", Context: 1_000_000, Tools: true},
+		Routes: []Route{{Provider: "openrouter", Send: "somelab/mystery", Kind: Metered}}}
+	if Scorable(bare.Model) {
+		t.Fatal("a row with nothing but a context window was scored")
+	}
+	cands := append(catalogCandidates(), bare)
+	for _, class := range Classes {
+		for _, effort := range []Effort{EffortCheap, EffortKnee, EffortBest} {
+			d, err := Decide(Request{Class: class, Candidates: cands, Effort: effort})
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, pick := range d.Crew {
+				if pick.Model == bare.Model.ID {
+					t.Errorf("%s/%q: the %s went to a model with no usable metadata", class, effort, pick.Seat)
+				}
+				for _, rung := range d.Ladder[pick.Seat] {
+					if rung.Model == bare.Model.ID {
+						t.Errorf("%s/%q: the %s's ladder holds it", class, effort, pick.Seat)
+					}
+				}
+			}
+		}
+	}
+	d, err := Decide(Request{Class: Bugfix, Candidates: cands, Pins: map[Seat]Pin{
+		Worker: {Model: bare.Model.ID, Send: bare.Model.ID, Kind: Metered},
+	}})
+	if err != nil || d.Seat(Worker).Model != bare.Model.ID || !d.Seat(Worker).Pinned {
+		t.Fatalf("the pin was not honoured: %+v %v", d.Seat(Worker), err)
+	}
+}
+
+// A MISSING INDEX WIDENS THE READING: a row that publishes one index is read
+// with more doubt than one that publishes all three.
+func TestAMissingIndexWidensTheVariance(t *testing.T) {
+	one := catalogRow("acme/one-index", true, 0.3, 1.2, 0, 70, 0).Model
+	all := catalogRow("acme/all-indexes", true, 0.3, 1.2, 45, 70, 50).Model
+	w := load()
+	if a, b := w.abilityOf(one), w.abilityOf(all); a.VarTheta <= b.VarTheta {
+		t.Errorf("one index read with variance %.4g, three with %.4g", a.VarTheta, b.VarTheta)
+	}
+}
+
+// A ROW THAT GAINS INDEXES IS READ AGAIN: nothing about a model is remembered
+// between decisions, so the next catalog refresh re-scores it — from its
+// indexes now, and with less doubt.
+func TestARowThatGainsIndexesIsRescored(t *testing.T) {
+	bare := glmFlash
+	bare.Intelligence, bare.Coding, bare.Agentic, bare.ArenaElo = 0, 0, 0, 0
+	w := load()
+	before, after := w.abilityOf(bare), w.abilityOf(glmFlash)
+	if before.Indexed || !after.Indexed {
+		t.Fatalf("index path: before %v, after %v", before.Indexed, after.Indexed)
+	}
+	if after.VarTheta >= before.VarTheta {
+		t.Errorf("published indexes did not narrow the reading: variance %.3f then %.3f", before.VarTheta, after.VarTheta)
+	}
+	qb, _ := prior().quality(OpenEnded, Worker, bare)
+	qa, _ := prior().quality(OpenEnded, Worker, glmFlash)
+	if qa <= qb {
+		t.Errorf("strong published indexes scored %.3f, not above the bare row's %.3f", qa, qb)
+	}
+}
+
+// A ROW WITH NO PUBLISHED INDEX IS NEVER SCORED ABOVE THE POPULATION'S MEAN,
+// however new it is: its date and family widen the reading instead.
+func TestANewRowWithoutIndexesIsNotScoredAboveAverage(t *testing.T) {
+	w := load()
+	pop := w.Mean[0]*w.Scale[0] + w.Loc[0]
+	fresh := Model{ID: "openai/gpt-9-luna-pro", PromptPrice: 1e-7, CompletionPrice: 5e-7, Context: 1050000,
+		Released: released(2026, 9, 22), Tools: true}
+	if a := w.abilityOf(fresh); a.Theta > pop+1e-9 || a.Indexed {
+		t.Errorf("an index-less row read at ability %.3f over the population's %.3f", a.Theta, pop)
+	}
+	if d, err := Decide(Request{Class: Bugfix, Candidates: []Candidate{candidateOf(fresh), candidateOf(glmFlash)}}); err != nil || d.Seat(Worker).Model != glmFlash.ID {
+		t.Errorf("worker %s over the indexed flash model (%v)", d.Seat(Worker).Model, err)
+	}
+}
+
+// THIS INSTALL'S OUTCOMES MOVE A SCORE WITHOUT FREEZING IT: the learned move
+// adds to the model's reading, and the reading still follows its catalog row.
+func TestInstallEvidenceMovesAScoreWithoutFreezingIt(t *testing.T) {
+	key := LearnKey(OpenEnded, Checker, glmFlash.ID)
+	plain, _ := Decide(Request{Class: OpenEnded, Candidates: []Candidate{candidateOf(glmFlash)}})
+	learned, _ := Decide(Request{Class: OpenEnded, Candidates: []Candidate{candidateOf(glmFlash)}, Learned: map[string]float64{key: 0.5}})
+	if got := learned.Seat(Checker).Quality - plain.Seat(Checker).Quality; math.Abs(got-0.5) > 1e-9 || learned.Seat(Checker).Learned != 0.5 {
+		t.Fatalf("a learned +0.5 moved the checker by %.3f (recorded %.3f)", got, learned.Seat(Checker).Learned)
+	}
+	cheaper := glmFlash
+	cheaper.Agentic = 30
+	moved, _ := Decide(Request{Class: OpenEnded, Candidates: []Candidate{candidateOf(cheaper)}, Learned: map[string]float64{key: 0.5}})
+	if moved.Seat(Checker).Quality == learned.Seat(Checker).Quality {
+		t.Error("with a learned move in place, a changed catalog row no longer moves the score")
+	}
+}
+
+// A redo lowers what a model is worth to this install and an accepted task
+// raises it: the learned move changes who sits the seat.
+func TestALearnedMoveCanChangeThePick(t *testing.T) {
+	cands := catalogCandidates()
+	base, _ := Decide(Request{Class: OpenEnded, Candidates: cands})
+	was := base.Seat(Checker).Model
+	down, _ := Decide(Request{Class: OpenEnded, Candidates: cands, Learned: map[string]float64{LearnKey(OpenEnded, Checker, was): -3}})
+	if down.Seat(Checker).Model == was {
+		t.Errorf("a checker this install marked down by 3 points still sits the seat")
+	}
+}
+
+// FRONTIER MODELS ARE CANDIDATES: --best may pick them, and no crew is
+// chosen whose estimate is over the task limit.
+func TestBestNeverPicksACrewOverTheTaskLimit(t *testing.T) {
+	cands := frontierCandidates()
+	best, err := Decide(Request{Class: OpenEnded, Candidates: cands, Effort: EffortBest, TaskCap: 5})
+	if err != nil {
+		t.Fatal(err)
+	}
+	frontier := false
+	for _, pick := range best.Crew {
+		if strings.HasPrefix(pick.Model, "anthropic/") || strings.HasPrefix(pick.Model, "openai/") {
+			frontier = true
+		}
+	}
+	if !frontier {
+		t.Errorf("--best on open-ended work picked no frontier model: %s", best.Line("", -1))
+	}
+	for _, limit := range []float64{5, 1, 0.2} {
+		for _, class := range Classes {
+			for _, effort := range []Effort{EffortKnee, EffortBest} {
+				for _, factor := range []float64{0, 1, 2.5} {
+					d, err := Decide(Request{Class: class, Candidates: cands, Effort: effort, TaskCap: limit, CostFactor: factor})
+					if err != nil {
+						t.Fatal(err)
+					}
+					if est := crewEst(prior(), class, d.Crew, factor); est > limit+1e-9 {
+						t.Errorf("%s/%q at $%v (factor %v): crew estimated $%.3f: %s", class, effort, limit, factor, est, d.Line("", -1))
+					}
+				}
+			}
+		}
+	}
+	tight, _ := Decide(Request{Class: OpenEnded, Candidates: cands, Effort: EffortBest, TaskCap: 0.2})
+	if !strings.Contains(tight.Note, "task limit") {
+		t.Errorf("a crew held under the limit does not say so: %q", tight.Note)
+	}
+	if est := tight.EstUSD; est > 0.2+1e-9 {
+		t.Errorf("held crew estimates $%.3f", est)
+	}
+}
+
+func TestAPinnedSeatAlwaysRunsItsPin(t *testing.T) {
+	cands := catalogCandidates()
+	d, err := Decide(Request{Class: Bugfix, Candidates: cands, Pins: map[Seat]Pin{
+		Checker: {Model: "moonshotai/kimi-k3", Send: "moonshotai/kimi-k3", Kind: Metered},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	checker := d.Seat(Checker)
+	if !checker.Pinned || checker.Model != "moonshotai/kimi-k3" {
+		t.Errorf("checker %+v, want the kimi pin", checker)
+	}
+	if d.Seat(Worker).Pinned {
+		t.Errorf("an unpinned worker was not routed: %+v", d.Seat(Worker))
+	}
+	// A pin the candidates do not carry still sits its seat on its own send.
+	d, err = Decide(Request{Class: Bugfix, Candidates: cands, Pins: map[Seat]Pin{
+		Worker: {Model: "ollama/qwen3-coder", Provider: "ollama", Send: "ollama/qwen3-coder", Kind: Local},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if w := d.Seat(Worker); w.Send != "ollama/qwen3-coder" || w.CostUSD != 0 || !w.Pinned {
+		t.Errorf("outside pin: %+v", w)
+	}
+}
+
+func TestTheCheapestRouteWinsAndAPlanCostsNothing(t *testing.T) {
+	cands := []Candidate{{Model: glmFlash, Routes: []Route{
+		{Provider: "openrouter", Send: "openrouter/z-ai/glm-5.3-flash", Kind: Metered},
+		{Provider: "z-ai", Send: "z-ai/glm-5.3-flash", Kind: Plan},
+	}}}
+	d, err := Decide(Request{Class: Bugfix, Candidates: cands})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pick := range d.Crew {
+		if pick.Provider != "z-ai" || pick.CostUSD != 0 {
+			t.Errorf("%s: %+v, want the coding plan at no marginal cost", pick.Seat, pick)
+		}
+	}
+	if d.EstUSD != 0 {
+		t.Errorf("a crew entirely on a plan estimates $%v", d.EstUSD)
+	}
+	// And a pinned provider is kept even when it is the dearer route.
+	d, _ = Decide(Request{Class: Bugfix, Candidates: cands, Pins: map[Seat]Pin{
+		Worker: {Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+	}})
+	if w := d.Seat(Worker); w.Provider != "openrouter" || w.Send != "openrouter/z-ai/glm-5.3-flash" || w.CostUSD == 0 {
+		t.Errorf("@openrouter pin: %+v", w)
+	}
+}
+
+func TestNoCandidateIsAnErrorNamingTheSeat(t *testing.T) {
+	_, err := Decide(Request{Class: Bugfix})
+	var missing NoCandidateError
+	if !errors.As(err, &missing) || missing.Seat != Worker {
+		t.Fatalf("err %v, want a NoCandidateError for the worker", err)
+	}
+}
+
+func TestRedoStrongerEscalatesOnlyUnpinnedSeats(t *testing.T) {
+	cands := catalogCandidates()
+	first, _ := Decide(Request{Class: Bugfix, Candidates: cands})
+	again, err := Decide(Request{Class: Bugfix, Candidates: cands, Stronger: &first})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Quality <= first.Quality {
+		t.Fatalf("redo stronger: %.2f is not above %.2f", again.Quality, first.Quality)
+	}
+	pins := map[Seat]Pin{Worker: {Model: "z-ai/glm-5.3-flash"}}
+	first, _ = Decide(Request{Class: OpenEnded, Candidates: cands, Pins: pins, Effort: EffortCheap})
+	first.Rungs, first.Note = nil, ""
+	again, err = Decide(Request{Class: OpenEnded, Candidates: cands, Pins: pins, Stronger: &first})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if w := again.Seat(Worker); !w.Pinned || w.Model != "z-ai/glm-5.3-flash" {
+		t.Errorf("redo moved a pinned worker: %+v", w)
+	}
+	// Every seat pinned: the pins stay, and the one run steps over them.
+	all := map[Seat]Pin{Worker: {Model: "z-ai/glm-5.3-flash"}, Planner: {Model: "z-ai/glm-5.3-flash"}, Checker: {Model: "z-ai/glm-5.3-flash"}}
+	first, _ = Decide(Request{Class: OpenEnded, Candidates: cands, Pins: all})
+	again, err = Decide(Request{Class: OpenEnded, Candidates: cands, Pins: all, Stronger: &first})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !again.OneOff || again.Quality <= first.Quality {
+		t.Errorf("all-pinned redo: one-off %v, quality %.2f over %.2f", again.OneOff, again.Quality, first.Quality)
+	}
+	// And the strongest crew there is has nowhere to go.
+	best, _ := Decide(Request{Class: OpenEnded, Candidates: cands, Effort: EffortBest})
+	best.Crew = []Pick{
+		{Seat: Worker, Model: "acme/top", Quality: 99}, {Seat: Planner, Model: "acme/top", Quality: 99}, {Seat: Checker, Model: "acme/top", Quality: 99},
+	}
+	if _, err := Decide(Request{Class: OpenEnded, Candidates: cands, Stronger: &best}); !errors.Is(err, ErrStrongest) {
+		t.Errorf("redo of the strongest crew: %v, want ErrStrongest", err)
+	}
+}
+
+func TestLearnedStepsStartAFixHigher(t *testing.T) {
+	cands := catalogCandidates()
+	base, _ := Decide(Request{Class: Bugfix, Candidates: cands})
+	d, _ := Decide(Request{Class: Bugfix, Candidates: cands, Steps: 2})
+	if d.Quality <= base.Quality {
+		t.Errorf("two learned steps on a fix: quality %.2f, not above the knee's %.2f", d.Quality, base.Quality)
+	}
+}
+
+func TestPaceGrowsAsTheCapNears(t *testing.T) {
+	cases := []struct {
+		spent, cap, want float64
+		atCap            bool
+	}{
+		{0, 0, 1, false},
+		{1, 10, 1, false},
+		{5, 10, 1, false},
+		{7.5, 10, 2, false},
+		{9, 10, 5, false},
+		{10, 10, 1, true},
+		{12, 10, 1, true},
+	}
+	for _, tc := range cases {
+		got, at := Pace(tc.spent, tc.cap)
+		if math.Abs(got-tc.want) > 1e-9 || at != tc.atCap {
+			t.Errorf("Pace(%v, %v) = %v, %v; want %v, %v", tc.spent, tc.cap, got, at, tc.want, tc.atCap)
+		}
+	}
+	// Near the cap an open-ended task takes a cheaper crew.
+	cands := frontierCandidates()
+	plain, _ := Decide(Request{Class: OpenEnded, Candidates: cands})
+	mult, _ := Pace(9.9, 10)
+	d, _ := Decide(Request{Class: OpenEnded, Candidates: cands, Pace: mult})
+	if d.EstUSD >= plain.EstUSD {
+		t.Errorf("at 99%% of the cap the crew still estimates $%.3f against $%.3f (λ %.0f)", d.EstUSD, plain.EstUSD, d.Lambda)
+	}
+}
+
+func TestGapsNameAMissingStrongChecker(t *testing.T) {
+	if gaps := Gaps(catalogCandidates(), nil); len(gaps) != 0 {
+		t.Errorf("a set with a strong checker has gaps %+v", gaps)
+	}
+	gaps := Gaps([]Candidate{candidateOf(v4Flash)}, nil)
+	if len(gaps) != 1 || gaps[0].Seat != Checker || gaps[0].Class != OpenEnded {
+		t.Errorf("v4-flash alone: gaps %+v, want the open-ended checker", gaps)
+	}
+}
+
+// A PINNED CHECKER IS THE CHECKER. The gap is asked of the pin alone: a strong
+// pin closes it over a weak set, a weak pin opens it over a strong one and names
+// itself, and a pin on another seat changes nothing.
+func TestGapsCountAPinnedChecker(t *testing.T) {
+	weakSet := []Candidate{candidateOf(v4Flash)}
+	if gaps := Gaps(weakSet, map[Seat]Model{Checker: kimiK3}); len(gaps) != 0 {
+		t.Errorf("a strong pinned checker over a weak set: gaps %+v, want none", gaps)
+	}
+	// The pin is read from the candidates when they carry it, and from the
+	// figures it came with when they do not.
+	if gaps := Gaps(append(weakSet, candidateOf(kimiK3)), map[Seat]Model{Checker: {ID: kimiK3.ID}}); len(gaps) != 0 {
+		t.Errorf("a strong pinned checker the candidates carry: gaps %+v, want none", gaps)
+	}
+	gaps := Gaps(catalogCandidates(), map[Seat]Model{Checker: v4Flash})
+	want := "checker pinned to deepseek-v4-flash · open-ended work will be checked weakly"
+	if len(gaps) != 1 || gaps[0].Seat != Checker || gaps[0].Class != OpenEnded || gaps[0].Line != want {
+		t.Errorf("a weak pinned checker over a strong set: gaps %+v, want %q", gaps, want)
+	}
+	if gaps := Gaps(catalogCandidates(), map[Seat]Model{Worker: v4Flash, Planner: v4Flash}); len(gaps) != 0 {
+		t.Errorf("an unpinned checker over a strong set, other seats pinned weak: gaps %+v", gaps)
+	}
+	gaps = Gaps(weakSet, map[Seat]Model{Worker: kimiK3})
+	if len(gaps) != 1 || !strings.HasPrefix(gaps[0].Line, "no strong checker among the models you allow") {
+		t.Errorf("an unpinned checker over a weak set, the worker pinned strong: gaps %+v", gaps)
+	}
+}
+func TestTheDecisionLine(t *testing.T) {
+	cands := catalogCandidates()
+	d, _ := Decide(Request{Class: OpenEnded, Candidates: cands, Pins: map[Seat]Pin{Checker: {Model: "moonshotai/kimi-k3"}}})
+	got := d.Line("📌", 0.108)
+	want := "open-ended · worker " + ShortModel(d.Seat(Worker).Model) + " (openrouter)"
+	if !strings.HasPrefix(got, want) || !strings.Contains(got, " · checker 📌 kimi-k3 · $0.108 (est "+Money(d.EstUSD)+")") {
+		t.Errorf("line %q", got)
+	}
+	if got := d.Line("📌", -1); !strings.HasSuffix(got, " · est "+Money(d.EstUSD)) {
+		t.Errorf("line before the run ends: %q", got)
+	}
+}
+
+// THE ROUTER'S OWN BUDGET: under two milliseconds a decision, against a
+// catalog the size of the real one, classification included.
+func TestADecisionTakesUnderTwoMilliseconds(t *testing.T) {
+	cands := frontierCandidates()
+	for i := 0; i < 600; i++ {
+		row := catalogRow("acme/m"+string(rune('a'+i%26))+strings.Repeat("x", i%7)+string(rune('a'+i/26)), i%2 == 0,
+			0.1+float64(i%30)/10, 0.5+float64(i%40)/5, 20+float64(i%35), 40+float64(i%45), 20+float64(i%40))
+		if i%3 == 0 {
+			row.Model.Intelligence, row.Model.Agentic = 0, 0
+		}
+		row.Model.Released = released(2025, time.Month(1+i%12), 1+i%28)
+		cands = append(cands, row)
+	}
+	task := Task{Text: "fix: crash when the config has no trailing newline\n\nTraceback (most recent call last):\n  ...\nValueError: bad"}
+	// THE FASTEST OF SEVERAL BATCHES is the decision's own cost: a mean over
+	// one batch on a shared, loaded machine also counts every time the
+	// scheduler took the core away, which is not the router's to answer for.
+	const batches, runs = 5, 40
+	best := time.Duration(1<<63 - 1)
+	for b := 0; b < batches; b++ {
+		start := time.Now()
+		for i := 0; i < runs; i++ {
+			if _, err := Decide(Request{Task: task, Candidates: cands, TaskCap: 5}); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if per := time.Since(start) / runs; per < best {
+			best = per
+		}
+	}
+	if best > 2*time.Millisecond {
+		t.Errorf("a decision took %v at best; the budget is 2ms", best)
+	}
+}
+
+func TestRouteIsDeterministicWhateverTheOrder(t *testing.T) {
+	cands := append(frontierCandidates(), catalogRow("acme/twin-a", true, 0.15, 0.5, 41.8, 71.5, 50.9), catalogRow("acme/twin-b", true, 0.15, 0.5, 41.8, 71.5, 50.9))
+	for _, class := range Classes {
+		a, _ := Decide(Request{Class: class, Candidates: cands})
+		reversed := make([]Candidate, len(cands))
+		for i := range cands {
+			reversed[len(cands)-1-i] = cands[i]
+		}
+		b, _ := Decide(Request{Class: class, Candidates: reversed})
+		for _, seat := range Seats {
+			if a.Seat(seat).Model != b.Seat(seat).Model {
+				t.Errorf("%s %s: %s one way, %s the other", class, seat, a.Seat(seat).Model, b.Seat(seat).Model)
+			}
+		}
+	}
+}
+
+// THE PORT READS THE WEIGHTS AS THEY WERE FITTED: the family key drops
+// version numbers and mostly-numeric tokens.
+func TestAFamilyIsTheNameWithoutItsVersion(t *testing.T) {
+	for id, want := range map[string]string{
+		"z-ai/glm-5.3-flash":         "z-ai/glm-flash",
+		"moonshotai/kimi-k3":         "moonshotai/kimi",
+		"deepseek/deepseek-v4-flash": "deepseek/deepseek-flash",
+		"anthropic/claude-opus-5":    "anthropic/claude-opus",
+		"qwen/qwen3-coder-30b-a3b":   "qwen/qwen-coder",
+	} {
+		if got := familyOf(id); got != want {
+			t.Errorf("familyOf(%q) = %q, want %q", id, got, want)
+		}
+	}
+}
+
+// ON OPEN-ENDED AND OTHER WORK A SUPPORT UPGRADE GOES TO THE CHECKER: the
+// weights do not tell the planner from the checker, and the checker is the
+// seat that accepts the work. At the knee the checker is never weaker than
+// the planner; a pinned planner stays where it was.
+func TestAtTheKneeTheCheckerIsNeverWeakerThanThePlanner(t *testing.T) {
+	for _, cands := range [][]Candidate{catalogCandidates(), frontierCandidates()} {
+		byID := map[string]Model{}
+		for _, c := range cands {
+			byID[c.Model.ID] = c.Model
+		}
+		for _, class := range []Class{OpenEnded, Other} {
+			d, err := Decide(Request{Class: class, Candidates: cands})
+			if err != nil {
+				t.Fatal(err)
+			}
+			w := load()
+			plan, check := w.abilityOf(byID[d.Seat(Planner).Model]), w.abilityOf(byID[d.Seat(Checker).Model])
+			if check.UScore < plan.UScore {
+				t.Errorf("%s: checker %s (%.3f) weaker than planner %s (%.3f)", class,
+					d.Seat(Checker).Model, check.UScore, d.Seat(Planner).Model, plan.UScore)
+			}
+		}
+	}
+	strong := glm53.ID
+	d, err := Decide(Request{Class: OpenEnded, Candidates: frontierCandidates(), Pins: map[Seat]Pin{
+		Planner: {Model: strong, Send: strong, Kind: Metered}}})
+	if err != nil || d.Seat(Planner).Model != strong {
+		t.Errorf("a pinned planner moved: %+v %v", d.Seat(Planner), err)
+	}
+}
+
+// --CHEAP DOES NOT BUY A WORKER ON PRICE ALONE: the worker's mean ability must
+// reach the floor, and a clearly stronger worker within half again the cost
+// is preferred.
+func TestACheapWorkerIsStillCredible(t *testing.T) {
+	thin := Model{ID: "inclusionai/ling-3.0-flash", Open: true, PromptPrice: 2.1e-8, CompletionPrice: 6.3e-8, CacheReadPrice: 4.2e-9,
+		Coding: 50.6, Context: 262144, Released: released(2026, 7, 23), Tools: true}
+	cands := []Candidate{candidateOf(thin), candidateOf(glmFlash), candidateOf(kimiK3)}
+	for _, class := range []Class{Bugfix, OpenEnded} {
+		d, err := Decide(Request{Class: class, Effort: EffortCheap, Candidates: cands})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := d.Seat(Worker).Model; got != glmFlash.ID {
+			t.Errorf("%s cheap: worker %s", class, got)
+		}
+	}
+	// Within the tolerance the stronger model wins; beyond it the cheaper one.
+	tab := forDecision(cands, nil)
+	base, _ := eligible(tab, Bugfix, Worker, candidateOf(glmFlash))
+	dear := glm53
+	dear.ID = "acme/near-price"
+	scale := 1.2 * tab.classCost(Bugfix, Worker, glmFlash) / tab.classCost(Bugfix, Worker, glm53)
+	dear.PromptPrice, dear.CompletionPrice, dear.CacheReadPrice = glm53.PromptPrice*scale, glm53.CompletionPrice*scale, glm53.CacheReadPrice*scale
+	if got := strongerWithin(tab, Bugfix, Worker, []Candidate{candidateOf(glmFlash), candidateOf(dear)}, base, cheapTolerance); got.Model != dear.ID {
+		t.Errorf("a stronger worker at 1.2x the cost lost to %s", got.Model)
+	}
+	far := dear
+	far.ID = "acme/far-price"
+	far.PromptPrice, far.CompletionPrice, far.CacheReadPrice = dear.PromptPrice*2, dear.CompletionPrice*2, dear.CacheReadPrice*2
+	if got := strongerWithin(tab, Bugfix, Worker, []Candidate{candidateOf(glmFlash), candidateOf(far)}, base, cheapTolerance); got.Model != glmFlash.ID {
+		t.Errorf("a stronger worker at 2.4x the cost was bought: %s", got.Model)
+	}
+}
diff --git a/internal/crewroute/seat_test.go b/internal/crewroute/seat_test.go
new file mode 100644
index 0000000000..cd228b7e48
--- /dev/null
+++ b/internal/crewroute/seat_test.go
@@ -0,0 +1,334 @@
+package crewroute
+
+import (
+	"strings"
+	"testing"
+)
+
+// A FREE POOL OF A MODEL NOBODY PRICES never wins a seat on its price: it is
+// weighed above the cheapest priced model, so with figures no better than a
+// priced model's it does not take that model's seat.
+func TestAFreeUnpricedModelNeverTakesASeatOnPrice(t *testing.T) {
+	stranger := candidateOf(glmFlash)
+	stranger.Model.ID = "thinkingmachines/inkling-small"
+	stranger.Model.PromptPrice, stranger.Model.CompletionPrice, stranger.Model.CacheReadPrice = 0, 0, 0
+	stranger.Routes = []Route{{Provider: "openrouter", Send: "thinkingmachines/inkling-small:free", Kind: Free}}
+	candidates := append(catalogCandidates(), stranger)
+	for _, class := range Classes {
+		d, err := Decide(Request{Class: class, Candidates: candidates})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, pick := range d.Crew {
+			if pick.Model == stranger.Model.ID {
+				t.Fatalf("%s %s went to the free stranger: %+v", class, pick.Seat, pick)
+			}
+		}
+	}
+}
+
+// A MODEL THAT CANNOT DO THE SEAT'S WORK DOES NOT SIT IT: no tool calls, or a
+// context too short for the seat.
+func TestTheCapabilityFiltersKeepUnfitModelsOut(t *testing.T) {
+	noTools := catalogRow("somelab/no-tools", true, 0.01, 0.02, 90, 90, 90)
+	noTools.Model.Tools = false
+	short := catalogRow("somelab/short", true, 0.01, 0.02, 90, 90, 90)
+	short.Model.Context = 16_000
+	for _, c := range []Candidate{noTools, short} {
+		if _, err := Decide(Request{Class: Bugfix, Candidates: []Candidate{c}}); err == nil {
+			t.Fatalf("%s sat a seat", c.Model.ID)
+		}
+	}
+}
+
+// ONE MODEL, THREE ROUTES: the free pool, a direct connection, and the
+// default service. With the free pool trusted, it is the route; the seat's
+// fallback is the SAME model on its next route, never another model.
+func TestAModelOnThreeRoutesTakesTheRightOneAndFallsThroughFreeToPaid(t *testing.T) {
+	m := glmFlash
+	routes := func(freeFail float64) []Route {
+		return []Route{
+			{Provider: "openrouter", Send: "z-ai/glm-5.3-flash:free", Kind: Free, FailRate: freeFail},
+			{Provider: "z-ai", Send: "z-ai/glm-5.3-flash", Kind: Metered},
+			{Provider: "openrouter", Send: "openrouter/z-ai/glm-5.3-flash", Kind: Metered},
+		}
+	}
+	one := func(freeFail float64) Decision {
+		d, err := Decide(Request{Class: Bugfix, Candidates: []Candidate{{Model: m, Routes: routes(freeFail)}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return d
+	}
+	d := one(0.05)
+	worker := d.Seat(Worker)
+	if worker.Kind != Free || worker.Send != "z-ai/glm-5.3-flash:free" {
+		t.Fatalf("a reliable free route was not taken: %+v", worker)
+	}
+	ladder := d.Ladder[Worker]
+	if len(ladder) < 2 || ladder[0].Model != worker.Model || ladder[0].Send != "z-ai/glm-5.3-flash" || ladder[1].Send != "openrouter/z-ai/glm-5.3-flash" {
+		t.Fatalf("the ladder is %+v, want the same model's direct then default routes first", ladder)
+	}
+	moved := d.WithRung(Worker, ladder[0], "free pool limited")
+	if moved.Seat(Worker).Send != "z-ai/glm-5.3-flash" || len(moved.Retried) != 1 || moved.Retried[0].Why != "free pool limited" {
+		t.Fatalf("moving the worker gave %+v", moved.Seat(Worker))
+	}
+	// A free route this install has watched refuse most first calls costs more
+	// than it saves, and the paid route is taken from the start.
+	if got := one(0.95).Seat(Worker); got.Kind != Metered || got.Send != "z-ai/glm-5.3-flash" {
+		t.Fatalf("an unreliable free route was still taken: %+v", got)
+	}
+}
+
+// A FREE ROUTE IS NEVER PRICED AT ZERO: its expected cost is its refusals.
+func TestAFreeRoutesExpectedCostIsItsRefusals(t *testing.T) {
+	if got := routeCost(Route{Kind: Free}, 0.02, 0.02); got <= 0 {
+		t.Fatalf("a free route costs %v", got)
+	}
+	if routeCost(Route{Kind: Free, FailRate: 0.9}, 0.02, 0.02) <= routeCost(Route{Kind: Free, FailRate: 0.1}, 0.02, 0.02) {
+		t.Fatal("a route that refuses more was not dearer")
+	}
+}
+
+// A MODEL THAT FAILED TO START IS KEPT OFF UNPINNED SEATS — while anything
+// else can sit them — and never off a pin.
+func TestAnAvoidedModelSitsNoUnpinnedSeat(t *testing.T) {
+	avoid := map[string]bool{Lineage("z-ai/glm-5.3-flash"): true}
+	d, err := Decide(Request{Class: Bugfix, Candidates: catalogCandidates(), Avoid: avoid})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pick := range d.Crew {
+		if Lineage(pick.Model) == Lineage("z-ai/glm-5.3-flash") {
+			t.Fatalf("%s went to the avoided model", pick.Seat)
+		}
+	}
+	pinned, err := Decide(Request{Class: Bugfix, Candidates: catalogCandidates(), Avoid: avoid,
+		Pins: map[Seat]Pin{Worker: {Model: "z-ai/glm-5.3-flash", Send: "z-ai/glm-5.3-flash", Kind: Metered}}})
+	if err != nil || pinned.Seat(Worker).Model != "z-ai/glm-5.3-flash" {
+		t.Fatalf("a pin was overruled: %+v %v", pinned.Seat(Worker), err)
+	}
+	// Avoiding the only model there is still makes a crew.
+	only := catalogCandidates()[:1]
+	if _, err := Decide(Request{Class: Bugfix, Candidates: only, Avoid: avoid}); err != nil {
+		t.Fatalf("avoiding the only model left no crew: %v", err)
+	}
+}
+
+// THE LINE: open-ended with its hyphen, the planner when it is another model,
+// the free route named, and a seat that moved said once.
+func TestTheLineSaysClassPlannerAndARetry(t *testing.T) {
+	d := Decision{Class: OpenEnded, EstUSD: 0.05, Crew: []Pick{
+		{Seat: Worker, Model: "z-ai/glm-5.3-flash", Provider: "openrouter", Kind: Free},
+		{Seat: Planner, Model: "moonshotai/kimi-k3"},
+		{Seat: Checker, Model: "moonshotai/kimi-k3"},
+	}}
+	line := d.Line("", -1)
+	for _, want := range []string{"open-ended · ", "(openrouter · free)", " · planner kimi-k3 · checker kimi-k3"} {
+		if !strings.Contains(line, want) {
+			t.Errorf("line %q lacks %q", line, want)
+		}
+	}
+	moved := d.WithRung(Worker, Pick{Model: "deepseek/deepseek-v4-flash"}, "credit unavailable on openrouter")
+	if line := moved.Line("", -1); !strings.Contains(line, "running on fallback crew · worker glm-5.3-flash → deepseek-v4-flash (credit unavailable on openrouter)") {
+		t.Errorf("the moved line does not say so: %q", line)
+	}
+	same := Decision{Class: Bugfix, Crew: []Pick{{Seat: Worker, Model: "a/x"}, {Seat: Planner, Model: "a/x"}, {Seat: Checker, Model: "a/y"}}}
+	if strings.Contains(same.Line("", -1), "planner") {
+		t.Errorf("a planner on the worker's model was named: %q", same.Line("", -1))
+	}
+}
+
+// THE OWNER'S CATALOG: a free stranger with no price and one published index
+// beside the priced models. Every class keeps it out.
+func TestTheOwnersCatalogNeverSeatsTheFreeStranger(t *testing.T) {
+	stranger := Candidate{
+		Model:  Model{ID: "thinkingmachines/inkling-small", Coding: 52.9, Context: 262_144, Tools: true},
+		Routes: []Route{{Provider: "router", Send: "thinkingmachines/inkling-small:free", Kind: Free}},
+	}
+	for _, class := range Classes {
+		d, err := Decide(Request{Class: class, Candidates: append(catalogCandidates(), stranger)})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, pick := range d.Crew {
+			if Lineage(pick.Model) == Lineage(stranger.Model.ID) {
+				t.Fatalf("%s %s went to the stranger", class, pick.Seat)
+			}
+		}
+	}
+}
+
+// REDO CLIMBS ONE RUNG AT A TIME: monotone, one seat, the next model on the
+// seat's front — never the top of the catalog in one step.
+func TestRedoClimbsTheLadderOneRungAtATime(t *testing.T) {
+	cands := frontierCandidates()
+	dear := catalogRow("somelab/very-dear", false, 30, 150, 60, 85, 70)
+	dear.Model.Released = released(2026, 9, 1)
+	cands = append(cands, dear)
+	ran, err := Decide(Request{Class: OpenEnded, Candidates: cands, Effort: EffortCheap})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ran.Rungs, ran.Note = nil, ""
+	prev := ran
+	for step := 0; step < 3; step++ {
+		next, err := Decide(Request{Class: OpenEnded, Candidates: cands, Stronger: &prev})
+		if err != nil {
+			t.Fatal(err)
+		}
+		changed := 0
+		for _, seat := range Seats {
+			if next.Seat(seat).Quality < prev.Seat(seat).Quality-1e-9 {
+				t.Fatalf("step %d: %s got weaker", step, seat)
+			}
+			if Lineage(next.Seat(seat).Model) != Lineage(prev.Seat(seat).Model) {
+				changed++
+			}
+			if next.Seat(seat).Model == dear.Model.ID && step == 0 {
+				t.Fatalf("the first redo jumped to the dearest model in the catalog on %s", seat)
+			}
+		}
+		if changed != 1 || len(next.Rungs) != 1 || !strings.Contains(next.Line("", -1), "→") {
+			t.Fatalf("step %d moved %d seats: %q", step, changed, next.Line("", -1))
+		}
+		prev = next
+	}
+}
+
+// A REDO OF A TASK THAT NEVER STARTED is asked again on the next-best models at
+// the same price of a point — not escalated, because nothing ran.
+func TestARedoOfATaskThatNeverStartedTakesTheNextBestAtTheSameCost(t *testing.T) {
+	cands := catalogCandidates()
+	ran, _ := Decide(Request{Class: Bugfix, Candidates: cands})
+	again, err := Decide(Request{Class: Bugfix, Candidates: cands, Again: &ran})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Lambda != ran.Lambda {
+		t.Fatalf("the retry moved λ from %v to %v", ran.Lambda, again.Lambda)
+	}
+	for _, seat := range Seats {
+		if Lineage(again.Seat(seat).Model) == Lineage(ran.Seat(seat).Model) {
+			t.Errorf("%s is the model that never started (%s)", seat, again.Seat(seat).Model)
+		}
+	}
+}
+
+// AN EFFORT WORD SAYS WHAT IT CHANGED, OR THAT IT CHANGED NOTHING.
+func TestAnEffortWordSaysWhatItChanged(t *testing.T) {
+	cands := catalogCandidates()
+	best, _ := Decide(Request{Class: Bugfix, Candidates: cands, Effort: EffortBest})
+	if len(best.Rungs) == 0 || best.Note != "" {
+		t.Fatalf("--best on a fix changed the crew and said %v / %q", best.Rungs, best.Note)
+	}
+	only := []Candidate{candidateOf(kimiK3)} // nothing stronger to be had
+	top, _ := Decide(Request{Class: Bugfix, Candidates: only, Effort: EffortBest})
+	if top.Note != "best · already the strongest crew allowed" || !strings.Contains(top.Line("", -1), top.Note) {
+		t.Fatalf("--best with nothing stronger said %q", top.Line("", -1))
+	}
+}
+
+// A LEARNED OFFSET IS RUNGS: each step is one rung from the knee's crew, and the
+// crew never skips to the top.
+func TestALearnedOffsetIsRungsNotAJump(t *testing.T) {
+	dear := catalogRow("somelab/very-dear", false, 30, 150, 60, 85, 70)
+	dear.Model.Released = released(2026, 9, 1)
+	cands := append(frontierCandidates(), dear)
+	base, _ := Decide(Request{Class: Bugfix, Candidates: cands})
+	one, _ := Decide(Request{Class: Bugfix, Candidates: cands, Steps: 1})
+	moved := 0
+	for _, seat := range Seats {
+		if Lineage(one.Seat(seat).Model) != Lineage(base.Seat(seat).Model) {
+			moved++
+		}
+		if one.Seat(seat).Model == "somelab/very-dear" {
+			t.Fatalf("one learned step jumped to the dearest model on %s", seat)
+		}
+	}
+	if moved != 1 {
+		t.Fatalf("one learned step moved %d seats", moved)
+	}
+}
+
+// A LINE LEADS WITH ITS STATE: a crew running on its fallback says so before
+// the class and the seats, and a task that stopped before spending names no
+// money — never a $0.000 that reads as a free success.
+func TestTheLineLeadsWithTheFallbackAndNamesNoUnspentMoney(t *testing.T) {
+	d := Decision{Class: Bugfix, EstUSD: 0.01, Crew: []Pick{
+		{Seat: Worker, Model: "z-ai/glm-5.3-flash"}, {Seat: Planner, Model: "z-ai/glm-5.3-flash"}, {Seat: Checker, Model: "moonshotai/kimi-k3"},
+	}}
+	moved := d.WithRung(Worker, Pick{Model: "deepseek/deepseek-v4-flash"}, "credit unavailable on openrouter")
+	line := moved.Line("", Unspent)
+	if !strings.HasPrefix(line, "running on fallback crew · worker glm-5.3-flash → deepseek-v4-flash") {
+		t.Errorf("the fallback is not first: %q", line)
+	}
+	if strings.Contains(line, "$") {
+		t.Errorf("an unspent line names money: %q", line)
+	}
+}
+
+// A REDO'S LINE SAYS EACH SEAT ONCE, WITH ITS CHANGE: a planner that moved is
+// `planner glm-5.3-flash → kimi-k3` where the planner stands, not the
+// planner and then its rung again.
+func TestARedoLineSaysEachSeatOnce(t *testing.T) {
+	d := Decision{Class: Bugfix, Crew: []Pick{
+		{Seat: Worker, Model: "z-ai/glm-5.3-flash"}, {Seat: Planner, Model: "moonshotai/kimi-k3"}, {Seat: Checker, Model: "moonshotai/kimi-k3"},
+	}, Rungs: []Retry{{Seat: Planner, From: "z-ai/glm-5.3-flash", To: "moonshotai/kimi-k3"}}}
+	line := d.Line("", -1)
+	if strings.Count(line, "planner") != 1 || !strings.Contains(line, "planner glm-5.3-flash → kimi-k3") {
+		t.Errorf("the redo line reads %q", line)
+	}
+}
+
+// A LONG LADDER IS ONE MOVE ON THE LINE: each seat says where it started,
+// where it is, the first reason and how many it tried between, and the line
+// stays within a card however many rungs were walked.
+func TestALongLadderIsSaidAsItsNetMove(t *testing.T) {
+	d := Decision{Class: Bugfix, EstUSD: 0.02, Crew: []Pick{
+		{Seat: Worker, Model: "z-ai/glm-5.3-flash"}, {Seat: Planner, Model: "z-ai/glm-5.3-flash"}, {Seat: Checker, Model: "moonshotai/kimi-k3"},
+	}}
+	for _, seat := range []Seat{Worker, Planner} {
+		why := "credit unavailable on openrouter"
+		for _, m := range []string{"poolside/laguna-s-2.1", "poolside/laguna-xs-2.1", "nvidia/nemotron-3-super-120b-a12b", "google/gemma-4-31b-it"} {
+			d = d.WithRung(seat, Pick{Model: m, Kind: Free}, why)
+			why = "limit reached on openrouter"
+		}
+	}
+	line := d.Line("", Unspent)
+	if !strings.Contains(line, "worker glm-5.3-flash → gemma-4-31b-it (credit unavailable on openrouter; +3 tried)") || strings.Contains(line, "laguna") {
+		t.Errorf("the ladder is not said as its net move: %q", line)
+	}
+	if n := len([]rune(line)); n > 260 {
+		t.Errorf("the line is %d characters after a long ladder: %q", n, line)
+	}
+}
+
+// A MODEL THAT PUBLISHES NOTHING BUT A PRICE IS NOT RANKED ON IT: a row with
+// no index, no date and a near-zero price is neither a pick nor a rung, and a
+// seat's last-rung rescue may still take it.
+func TestAModelWithNoEvidenceIsNotPickedOnPrice(t *testing.T) {
+	bare := Candidate{Model: Model{ID: "upstage/solar-mini4", PromptPrice: 1e-9, CompletionPrice: 1e-9, Tools: true},
+		Routes: []Route{{Provider: "openrouter", Send: "upstage/solar-mini4", Kind: Metered}}}
+	cands := append(catalogCandidates(), bare)
+	for _, effort := range []Effort{"", EffortCheap} {
+		d, err := Decide(Request{Class: Bugfix, Candidates: cands, Effort: effort})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, pick := range d.Crew {
+			if pick.Model == bare.Model.ID {
+				t.Errorf("effort %q: the %s is a model with no evidence", effort, pick.Seat)
+			}
+			for _, rung := range d.Ladder[pick.Seat] {
+				if rung.Model == bare.Model.ID {
+					t.Errorf("effort %q: the %s's ladder holds a model with no evidence", effort, pick.Seat)
+				}
+			}
+		}
+	}
+	rescue, err := Decide(Request{Class: Bugfix, Candidates: []Candidate{bare}, Rescue: true})
+	if err != nil || rescue.Seat(Planner).Model != bare.Model.ID {
+		t.Errorf("the rescue would not take it: %v %+v", err, rescue.Crew)
+	}
+}
diff --git a/internal/crewroute/testdata/hermes-7680.md b/internal/crewroute/testdata/hermes-7680.md
new file mode 100644
index 0000000000..2131593a3f
--- /dev/null
+++ b/internal/crewroute/testdata/hermes-7680.md
@@ -0,0 +1,124 @@
+# Critical: Hermes doesn't validate finish_reason for tool_calls, allowing truncated JSON to be processed
+
+## 🐛 Bug Report
+
+### Summary
+Hermes does not validate `finish_reason` when `tool_calls` are present, allowing truncated/incomplete JSON in tool call arguments to be processed. This causes cascading errors including HTTP 500 responses and wasted retry attempts.
+
+### Impact
+- **Severity:** Critical
+- **Affects:** All users using models with output token limits
+- **Symptoms:** HTTP 500 errors, invalid JSON in tool calls, session failures
+
+### Root Cause
+
+When a model returns `finish_reason="length"` with `tool_calls` present, the current code only checks for truncation when tool_calls are **absent** (`run_agent.py:7803`):
+
+```python
+if finish_reason == "length":
+    if self.api_mode == "chat_completions":
+        assistant_message = response.choices[0].message
+        if not assistant_message.tool_calls:  # ← Only handles missing tool_calls
+            # continuation retry logic
+```
+
+**Problem:** When `tool_calls` exist, the code skips the length check entirely and proceeds to process potentially incomplete JSON arguments.
+
+### Reproduction
+
+1. Use a model with limited output tokens (e.g., `max_tokens=4096`)
+2. Request a task that generates a large tool call (e.g., `write_file` with substantial content)
+3. Model hits token limit mid-generation
+4. Returns `finish_reason="length"` (or router rewrites to `"tool_calls"`) with incomplete JSON:
+   ```json
+   {"path": "/tmp/file.md", "content": "very long text...
+   ```
+5. Hermes processes the broken JSON → validation fails → 3 retries → tool error → HTTP 500
+
+### Example from Real Session
+
+**Session:** `20260411_121436_65708048`
+
+**Truncated tool call:**
+```json
+{"path": "/tmp/ai_gateway_comparison_report.md"
+```
+(Missing closing brace and `content` parameter)
+
+**Result:**
+- 3 retry attempts (all failed)
+- HTTP 500 from router
+- Session terminated
+
+**Context stats:**
+- 48K tokens (24% of 200K limit) - context was healthy
+- 45 tool calls (44 successful, 1 truncated)
+- No compression needed
+
+### Proposed Fix
+
+Add validation for truncated tool_calls when `finish_reason="length"`:
+
+```python
+if finish_reason == "length":
+    if self.api_mode == "chat_completions":
+        assistant_message = response.choices[0].message
+        
+        # NEW: Validate tool_calls JSON completeness
+        if assistant_message.tool_calls:
+            incomplete_tools = []
+            for tc in assistant_message.tool_calls:
+                args = tc.function.arguments or ""
+                if not args.strip():
+                    continue
+                try:
+                    json.loads(args)
+                except json.JSONDecodeError as e:
+                    incomplete_tools.append((tc.function.name, str(e)))
+            
+            if incomplete_tools:
+                tool_name, error = incomplete_tools[0]
+                # Return user-friendly error instead of processing broken JSON
+                return {
+                    "final_response": "⚠️ Tool call truncated due to length limit",
+                    "error": f"Tool call truncated: {tool_name} - {error}",
+                    "partial": True
+                }
+        
+        # Existing logic for missing tool_calls
+        if not assistant_message.tool_calls:
+            # continuation retry
+```
+
+### Benefits
+
+1. **Prevents cascading errors** - catches truncation early
+2. **Saves API calls** - no wasted retries on unfixable truncation
+3. **Better UX** - clear error message with actionable suggestions
+4. **Preserves context** - doesn't pollute message history with broken JSON
+
+### Testing
+
+Tested fix locally - successfully catches truncated tool calls and returns helpful error instead of HTTP 500.
+
+### Files Affected
+
+- `run_agent.py` (lines 7801-7803)
+
+### Related Code
+
+The existing invalid JSON retry logic (lines 8845-8883) doesn't distinguish between:
+- Recoverable JSON errors (model mistake) → retry makes sense
+- Truncation errors (length limit) → retry is pointless
+
+This fix addresses the root cause before broken JSON enters the retry loop.
+
+---
+
+**Environment:**
+- Hermes version: latest (2026-04-11)
+- Model: kr/claude-sonnet-4.5
+- Router: router.neomentor.tech
+- Platform: Matrix
+
+**Analysis:** Full detailed analysis available in session logs.
diff --git a/internal/crewroute/testdata/kornia-4814.md b/internal/crewroute/testdata/kornia-4814.md
new file mode 100644
index 0000000000..4805395dc7
--- /dev/null
+++ b/internal/crewroute/testdata/kornia-4814.md
@@ -0,0 +1,46 @@
+# augmentation: RandomResizedCrop(scale=(1, 1)) never keeps a square or portrait image: strict candidate test and an inverted-ratio fallback
+
+`RandomResizedCrop` keeps the whole image under `scale=(1.0, 1.0)` only for landscape inputs. For a square or portrait input it returns a smaller crop that falls outside both `scale` and `ratio`. torchvision's reference `RandomResizedCrop.get_params` keeps the whole image in these cases.
+
+Two lines in `kornia/augmentation/random_generator/_2d/crop.py` (on `main` 57cd68e6f) combine to cause this:
+
+1. **The candidate test is strict** (line 268): `(w < size[1]) * (h < size[0])`. torchvision accepts `0 < w <= width and 0 < h <= height`. With `scale=(1.0, 1.0)` no candidate can be strictly smaller on both axes, so every call falls back.
+2. **The fallback inverts the ratio** (lines 283-290). kornia's `ratio` is width/height (`w = sqrt(area * ratio)`), but the fallback computes `in_ratio = H / W`. It compares that against `min(ratio)` in both branches and never against `max(ratio)`. torchvision compares `W / H` against `min(ratio)` and `max(ratio)` and keeps the whole image when the input ratio is already in range.
+
+## Repro
+
+```python
+import torch
+import kornia.augmentation as K
+
+def crop_hw(shape):
+    torch.manual_seed(0)
+    src = K.RandomResizedCrop((4, 4), scale=(1.0, 1.0), p=1.0).forward_parameters((1, 1, *shape))["src"][0]
+    return int(src[2, 1] - src[1, 1]) + 1, int(src[1, 0] - src[0, 0]) + 1
+
+for shape in [(8, 6), (8, 8), (32, 32), (100, 60), (60, 100)]:
+    print(shape, crop_hw(shape))
+```
+
+Compared with torchvision 0.29.0's `RandomResizedCrop.get_params` run on the same shapes (the function taken verbatim from the wheel):
+
+| input H x W | kornia crop | area | w/h | torchvision crop |
+|---|---|---|---|---|
+| 8 x 6 | 4 x 6 | 0.50 | 1.50 | 8 x 6 |
+| 8 x 8 | 6 x 8 | 0.75 | 1.33 | 8 x 8 |
+| 32 x 32 | 24 x 32 | 0.75 | 1.33 | 32 x 32 |
+| 100 x 60 | 45 x 60 | 0.45 | 1.33 | 80 x 60 |
+| 60 x 100 | 60 x 80 | 0.80 | 1.33 | 60 x 80 |
+
+In the 8 x 6 row the crop's w/h of 1.5 is outside the default `ratio=(3/4, 4/3)`. It also has half the area that `scale` requests. Landscape inputs agree with torchvision only because the default `ratio` is symmetric (`min = 1 / max`).
+
+## Expected
+
+Follow torchvision's rule: a candidate may equal the input size, and the fallback compares `W / H` with both `min(ratio)` and `max(ratio)`, keeping the whole image when it is in range. Each change alone flips the current pin.
+
+## Where it is documented
+
+The `RandomResizedCrop` Convention block and `test_convention_random_resized_crop_fallback_can_escape_scale_and_ratio` currently describe this as intended behaviour. #4791 reframes both as a wart linked to this issue. The fix PR inverts the pin and drops the wart sentence.
+
+Posted on behalf of @ducha-aiki by Claude (Opus 5.5).
+
diff --git a/internal/e2e/manual_e2e_test.go b/internal/e2e/manual_e2e_test.go
index b9394afd0f..fccbea87ab 100644
--- a/internal/e2e/manual_e2e_test.go
+++ b/internal/e2e/manual_e2e_test.go
@@ -52,7 +52,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/exec/bare"
 	"github.com/Agent-Field/codeaf/internal/manual"
 	"github.com/Agent-Field/codeaf/internal/session"
@@ -311,17 +311,19 @@ func mentionsAny(text string, words ...string) bool {
 // TestManualQuotesTheCrewsRealSize is #293 §3, which is the failure class this
 // whole lane exists for: a page that has stopped being true reads exactly like
 // one that is, and the person asked precisely because they could not check. The
-// count is derived from [config.ModelTiers] and cross-checked against every
-// preset's own row, so the day a seat is added or removed this test moves with
-// the code and the manual is what turns red.
+// count is derived from [crewroute.Seats], the router's own list of the seats a
+// task runs on, so the day a seat is added or removed this test moves with the
+// code and the manual is what turns red.
 func TestManualQuotesTheCrewsRealSize(t *testing.T) {
-	seats := crewSeatCount(t)
-	t.Logf("internal/config owns the figure: %d seats (%v), the same count in all %d presets",
-		seats, config.ModelTiers, len(config.CrewPresets))
+	seats := len(crewroute.Seats)
+	if seats == 0 {
+		t.Fatalf("crewroute.Seats is empty")
+	}
+	t.Logf("internal/crewroute owns the figure: %d seats (%v)", seats, crewroute.Seats)
 
 	w := newManualWorld(t)
 	runManualScenario(t, w, "how many models the crew is",
-		"how many models does codeaf run on its own behalf?",
+		"how many models is a task's crew?",
 		func(p *probe, out turn, calls []manualCall) {
 			if len(calls) == 0 {
 				p.missf("the model answered a question about codeaf out of memory: it called %v and never opened the manual", out.names())
@@ -329,11 +331,11 @@ func TestManualQuotesTheCrewsRealSize(t *testing.T) {
 			}
 			// NAMING THE SEATS IS SAYING HOW MANY OF THEM THERE ARE, and it is
 			// the more checkable of the two: #293 §3's own worked example is two
-			// pages that listed four seat names and omitted the one that pays
+			// pages that listed some seat names and omitted the one that pays
 			// most of a task's bill, which a count alone would not have caught.
-			// The words are the settings registry's, not this file's.
-			if named := seatsNamedIn(out.Reply, crewSeatLabels(t)); len(named) == seats {
-				t.Logf("  the reply names all %d crew seats the registry owns: %v", seats, named)
+			// The words are the router's, not this file's.
+			if named := seatsNamedIn(out.Reply, crewSeatLabels()); len(named) == seats {
+				t.Logf("  the reply names all %d crew seats the router owns: %v", seats, named)
 				return
 			}
 			said := countsClaimedAbout(out.Reply, crewNouns)
@@ -350,64 +352,28 @@ func TestManualQuotesTheCrewsRealSize(t *testing.T) {
 					seats, said, out.Reply, indent(manualResults(calls), "    "))
 				return
 			}
-			t.Logf("  the reply says %d, which is what internal/config says", seats)
+			t.Logf("  the reply says %d, which is what internal/crewroute says", seats)
 		})
 }
 
 // crewNouns are the words a claim about the crew's size lands on. A number that
 // is not next to one of these is a number about something else — how many
-// presets there are, how many pages the manual has — and grading it would be
+// rows the settings sheet has, how many pages the manual has — and grading it would be
 // grading a sentence nobody asked about.
 var crewNouns = []string{"model", "models", "seat", "seats", "tier", "tiers", "crew"}
 
-// crewSeatCount is the figure the CODE owns, read the way the settings sheet
-// reads it and checked against the table underneath, so a count that only one
-// of the two agreed with could not pass as the answer.
-func crewSeatCount(t *testing.T) int {
-	t.Helper()
-	seats := len(config.ModelTiers)
-	if seats == 0 {
-		t.Fatalf("config.ModelTiers is empty")
-	}
-	for _, preset := range config.CrewPresets {
-		models, found := config.CrewModels(preset)
-		if !found {
-			t.Fatalf("config.CrewModels(%q) answers nothing", preset)
-		}
-		if len(models) != seats {
-			t.Fatalf("the %s preset sets %d models where there are %d tiers; the count this test grades is not one number",
-				preset, len(models), seats)
-		}
-	}
-	return seats
-}
-
-// crewSeatLabels is the word each crew seat is KNOWN BY, read off the settings
-// registry rows that front the five tiers — "reflex", "small work", "worker",
-// "careful work", "mastermind". They are the registry's because a seat's name is
-// the registry's to change, and a test that spelled them here would be the
-// second copy that #293 §3 is about.
-func crewSeatLabels(t *testing.T) []string {
-	t.Helper()
-	registry := config.NewSettings(config.SettingsOptions{})
-	labels := make([]string, 0, len(config.ModelTiers))
-	for _, tier := range config.ModelTiers {
-		row, found := registry.Row(tierRowKey(tier))
-		if !found || strings.TrimSpace(row.Label) == "" {
-			t.Fatalf("the settings registry has no labelled row for the %s tier", tier)
-		}
-		labels = append(labels, row.Label)
+// crewSeatLabels is the word each crew seat is KNOWN BY — "worker", "planner",
+// "checker" — read off the router's own list. They are the router's because a
+// seat's name is the router's to change, and a test that spelled them here
+// would be the second copy that #293 §3 is about.
+func crewSeatLabels() []string {
+	labels := make([]string, 0, len(crewroute.Seats))
+	for _, seat := range crewroute.Seats {
+		labels = append(labels, string(seat))
 	}
 	return labels
 }
 
-// tierRowKey is the settings key one tier's model row answers to. The prefix is
-// taken off a key the package already exports rather than typed again, so the
-// day the rows are renamed this moves with them.
-func tierRowKey(tier string) string {
-	return strings.TrimSuffix(config.KeyTierReflexModel, config.ModelTierReflex) + tier
-}
-
 // seatsNamedIn is which of those words a reply carries.
 func seatsNamedIn(reply string, labels []string) []string {
 	low := strings.ToLower(reply)
diff --git a/internal/e2e/tui_e2e_test.go b/internal/e2e/tui_e2e_test.go
index b863096ef4..b55d0bd148 100644
--- a/internal/e2e/tui_e2e_test.go
+++ b/internal/e2e/tui_e2e_test.go
@@ -109,7 +109,6 @@ func TestTUIE2E(t *testing.T) {
 	t.Run("plain_launch_opens_connections_and_harnesses", testPlainLaunchConnectionsAndHarnesses)
 	t.Run("a_nested_landing_asks_and_a_key_answers_it", testNestedGate)
 	t.Run("a_refused_landing_is_incomplete", testRefusedLanding)
-	t.Run("a_crew_older_than_the_work_seat_says_so_once", testInheritedWorkSeat)
 	t.Run("a_fresh_install_is_shown_the_setup", testFreshInstallSetup)
 	t.Run("a_refused_task_proposal_draws_no_schema_sentence", testRefusedTaskProposal)
 	t.Run("space_in_the_task_room_pages_the_card", testTaskRoomKeepsSpace)
@@ -176,6 +175,22 @@ func testPlainLaunchConnectionsAndHarnesses(t *testing.T) {
 		t.Fatalf("the plain launch lost this machine's harness registry:\n%s", harnesses)
 	}
 	t.Logf("the local engine road opened this machine's harness registry:\n%s", harnesses)
+
+	// AND THE CREW PANEL, which is the same kind of door onto this machine's
+	// profile: /crew opens it framed over the conversation, enter on the first
+	// seat opens that seat's list on `auto`, and esc steps back out one level at
+	// a time. Nothing is chosen, so nothing is written and no model is asked.
+	r.keys("Escape")
+	r.lit("/crew")
+	r.keys("Enter")
+	crew := r.waitFor(20*time.Second, say(t, "crewMainKeys"))
+	t.Logf("the crew panel opened:\n%s", crew)
+	r.keys("Enter")
+	seats := r.waitFor(20*time.Second, say(t, "crewAutoWord"))
+	t.Logf("the worker's seat list opened on auto:\n%s", seats)
+	r.keys("Escape")
+	r.waitFor(20*time.Second, say(t, "crewMainKeys"))
+	r.keys("Escape")
 	r.quit()
 }
 
@@ -1736,117 +1751,6 @@ func moneyIn(t *testing.T, screen, needle string, after bool) string {
 
 // ── 12 ──────────────────────────────────────────────────────────────────────
 
-// testInheritedWorkSeat is #312's acceptance on the real screen: a crew older
-// than the work seat, met where a person actually meets it.
-//
-// THE PROFILE IS THE DEFECT. A crew applied before the worker class existed
-// (#278) holds four `models.tiers.*` rows and no `worker` among them. Headless
-// doors learned to read that shape in #311; the conversation did not, so every
-// task started from a thread ran on the build's own worker model and nothing
-// anywhere said which model that was or why. This subtest builds exactly that
-// profile — four real rows, the fifth key deleted — starts one small task, and
-// reads back two things a unit test cannot: that the LINE is on the screen once,
-// and that the model the node actually called is the row the person pinned.
-//
-// THE MODEL IS READ OUT OF THE CALL LOG, which is always on and writes one line
-// per model call with the tag the caller set (internal/calllog, and session's
-// loop.go tags a node's calls `task`). That is the node's own journal, and it is
-// the only evidence in this suite that comes off the wire rather than off the
-// screen.
-//
-// IT IS DELIBERATELY THE CHEAPEST SHAPE THERE IS: `/task solo`, which runs one
-// worker and makes no sizing call before it, on a brief that is one file.
-func testInheritedWorkSeat(t *testing.T) {
-	// The row the work must land on. It is a DIFFERENT id from the model the
-	// conversation talks on (newHome pins that) and from this build's own worker
-	// default, because the whole question is which of the three answered.
-	const smallWork = "deepseek/deepseek-v4-flash-0731"
-	home := newHome(t, map[string]any{
-		"models.tiers.reflex":     "mistralai/mistral-nemo",
-		"models.tiers.low":        smallWork,
-		"models.tiers.high":       smallWork,
-		"models.tiers.mastermind": smallWork,
-	})
-	dropWorkerRow(t, home)
-	ws := newWorkspace(t, "seatws", false)
-	r := start(t, "afe2e_seat", home, ws, tuiWide, 40)
-
-	// Whichever door the launch took — home on a machine with several
-	// conversations, and straight into a greeted conversation on a fresh one,
-	// which is what a state root built one minute ago always is. THE GREETED
-	// CONVERSATION HAS TWO SHAPES and this waits for both: the starter line under
-	// the wordmark, and the starting POINTS a conversation nobody has typed in
-	// yet stands on, whose foot is [welcomeStarterKeysWord] — the screen that
-	// entry's own `why` warns a subtest about waiting past.
-	r.waitForAny(20*time.Second, say(t, "placeRestWord"), say(t, "starterTaskWord"),
-		say(t, "welcomeStarterKeysWord"))
-	r.keys("Escape")
-	r.lit("/task solo write a file called hello.txt containing the word hello")
-	r.keys("Enter")
-
-	// THE LINE, WHEN THE WORK STARTS. Both halves of it: the observation about
-	// the profile and the promise about what ends it.
-	screen := r.waitFor(4*time.Minute, say(t, "inheritedSeatObservation"), say(t, "inheritedSeatPromise"))
-	t.Logf("the conversation says which row filled its work seat:\n%s", screen)
-
-	// AND ONCE. A node divides into parts and each part starts; a line that
-	// arrived with each of them is the noise this mechanism refused headless.
-	if got := strings.Count(screen, say(t, "inheritedSeatObservation")); got != 1 {
-		t.Errorf("the line is on the screen %d times, want once:\n%s", got, screen)
-	}
-
-	// AND THE WORK IS ON THE ROW THE PERSON PINNED. The node's calls carry the
-	// `task` tag, and no call anywhere may have gone to the build's own worker.
-	// The log is POLLED rather than read once: the receipt is written when the
-	// node starts and the node's first call goes out a moment later, and this
-	// subtest deliberately stops as soon as there is something to read rather
-	// than paying for the whole piece of work.
-	models := waitForTaskCalls(t, home, 3*time.Minute)
-	if len(models) == 0 {
-		t.Fatalf("no call in the log was tagged as a task's; the log held %v", callModels(t, home))
-	}
-	t.Logf("the node called: %v", models)
-	for _, model := range models {
-		if model != smallWork {
-			t.Errorf("a task call went to %q, want the small-work row %q the crew pinned", model, smallWork)
-		}
-	}
-	for _, model := range callModels(t, home) {
-		if model == "z-ai/glm-5.3-flash" {
-			t.Errorf("a call went to this build's own worker model, which is the substitution the issue is about")
-		}
-	}
-	r.quit()
-}
-
-// dropWorkerRow deletes `models.tiers.worker` from a rig's config, so the
-// profile is the shape a crew set before that class existed actually has.
-//
-// It is a DELETE and not an empty string: the two are different answers
-// everywhere in this build — a row emptied on purpose means "follow the
-// conversation" — and it is the one this suite must write, because [newHome]
-// copies the person's own config and theirs may hold the key.
-func dropWorkerRow(t *testing.T, home string) {
-	t.Helper()
-	path := filepath.Join(home, "config.json")
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("config: %v", err)
-	}
-	rows := map[string]any{}
-	if err := json.Unmarshal(raw, &rows); err != nil {
-		t.Fatalf("config: %v", err)
-	}
-	delete(rows, "models.tiers.worker")
-	out, err := json.MarshalIndent(rows, "", " ")
-	if err != nil {
-		t.Fatalf("config: %v", err)
-	}
-	if err := os.WriteFile(path, out, 0o600); err != nil {
-		t.Fatalf("config: %v", err)
-	}
-}
-
 // waitForTaskCalls polls the call log until a node's own call is in it, and
 // answers every model those calls asked for.
 func waitForTaskCalls(t *testing.T, home string, within time.Duration) []string {
@@ -1931,7 +1835,7 @@ func callLogModels(t *testing.T, home, tag string) []string {
 // that ran it.
 //
 // IT IS DELIBERATELY THE CHEAPEST TASK THERE IS — `/task solo` on a one-file
-// brief, the shape [testInheritedWorkSeat] already pays for. The measured run
+// brief, the cheapest shape a task comes in. The measured run
 // lands in about thirty seconds and costs five cents.
 //
 // AND IT RUNS SHORT ON PURPOSE ([tuiShortRows]): a record that fits on the
diff --git a/internal/e2e/tuiwords_test.go b/internal/e2e/tuiwords_test.go
index 473738ae4e..3bc903b619 100644
--- a/internal/e2e/tuiwords_test.go
+++ b/internal/e2e/tuiwords_test.go
@@ -121,6 +121,14 @@ var tuiWords = map[string]tuiWord{
 		screen: "harnesses are unavailable here",
 		why:    "the refusal that must be absent from an ordinary launch and remain available to the hosted seam",
 	},
+	"crewMainKeys": {
+		screen: "enter change · esc close · ? keys",
+		why:    "/crew opened its panel, framed, with its keys in the bottom edge",
+	},
+	"crewAutoWord": {
+		screen: "auto — codeaf picks per task",
+		why:    "enter on a seat opened the seat list on its first row, auto",
+	},
 
 	// ── the bounded stop ─────────────────────────────────────────────────────
 	"stoppingWord": {
@@ -705,26 +713,6 @@ var tuiWords = map[string]tuiWord{
 			"planFigures). It is the same `N steps` and `$` the row already spends in its two columns",
 	},
 
-	// ── the seat a crew older than it never wrote ────────────────────────────
-	//
-	// The two halves of one line, and it is the ENGINE'S sentence: the surface
-	// says it in the thread and every headless door prints it under the models
-	// line, out of one composer (internal/config's Seat.Notice), so the gate
-	// looks for it where it is spelled rather than in the surface that relays it.
-	"inheritedSeatObservation": {
-		screen: "your crew was set before the work seat existed",
-		source: "your crew was set before the ",
-		pkg:    "internal/config",
-		why:    "the observation half: a profile older than the seat is told so, once, when work starts on it",
-	},
-	"inheritedSeatPromise": {
-		screen: "it is running on your small work seat's model",
-		source: "it is running on your ",
-		pkg:    "internal/config",
-		why: "the promise half, naming the row the work is actually on. It stops at the row rather " +
-			"than at `until you pick a crew again` because a transcript line is cut to make room for " +
-			"the task rail, and the sentence is longer than an ordinary window minus that column",
-	},
 	"taskLookWord": {
 		screen: "your call",
 		pkg:    "internal/session",
diff --git a/internal/manual/chat/adaptive-runs.md b/internal/manual/chat/adaptive-runs.md
index 142e9dc8d8..d0f0d854bb 100644
--- a/internal/manual/chat/adaptive-runs.md
+++ b/internal/manual/chat/adaptive-runs.md
@@ -139,7 +139,7 @@ None of this happens without a folder to weigh in. A run with no `-w`, or a goal
 no file that exists, is not treated as small — it is treated as unmeasured, and every one of
 these passes behaves exactly as it did before any of it was read.
 
-## Running one task without the screen — codeaf do, headless, from a script: what flags it takes, what it prints, and what its exit code means
+## Running one task without the screen — codeaf do, headless, from a script: what flags it takes, what it prints, what its last line and its exit code mean
 
 ```
 codeaf do "<task>"
@@ -158,9 +158,10 @@ keyboard decides for itself and says on the record that it decided.
 | `--json` | print one machine-readable object instead of the deliverable |
 | `--yes-spend` | spend past today's limit and the plan price without stopping |
 | `--slots <n>` | how many workers may run at once for this run; `0` is no limit. Unset, it is your `task.parallel` setting, which is no limit out of the box |
-| `--model <slug>` | the work model for this run |
-| `--plan-model <slug>` | the model that plans, when it should differ from the work model |
-| `--check-model <slug>` | the model that checks finished work; then `CODEAF_CHECK_MODEL`, then a plan seat pinned by flag or environment, then the crew's careful row |
+| `--model <slug>` | the worker for this run |
+| `--plan-model <slug>` | the planner for this run |
+| `--check-model <slug>` | the checker for this run; never the planner |
+| `--best` / `--cheap` / `--pin` | the crew for this one task — see *running from the terminal* |
 | `--context-fill <percent>` | how full a model's context window may get before it is compacted |
 | `--completion-reserve <tokens>` | tokens every call keeps free for its answer and its reasoning |
 
@@ -254,7 +255,7 @@ working. `exec` plans nothing, so naming it changes nothing, and it says so once
 error stream.
 
 Without `--json`, standard output is the worker's own text and nothing else. It opens on the
-error stream naming one model rather than two — `models: work <model> (crew frugal)` —
+error stream naming one model rather than three — `models: worker <model> (routed)` —
 because only one of them runs anything.
 
 ## What one costs and what happens when the money runs out
@@ -360,14 +361,14 @@ nobody made a finding about it. The row carries the node's own spend, and a land
 row carries its digest.
 
 **Each node row names the model it runs on, and it is not the planner's.** A run is
-deliberately two classes of model: the root row carries the **mastermind** class that cuts
-the goal, and every node row under it carries the **worker** class that does it — one
-careful call deciding what happens, many cheaper ones doing it. It is the same class a task
-handed off in conversation runs on. So opening a node and reading
+deliberately two seats: the root row carries the **planner** that cuts the goal, and every
+node row under it carries the **worker** that does it — one careful call deciding what
+happens, many cheaper ones doing it. They are the run's crew, picked for it the way a task
+handed off in conversation has its crew picked. So opening a node and reading
 `task <model>` at the foot of the frame is how you see your crew actually working; the run's
 own row above it will be naming something else, and that is the arrangement rather than a
 disagreement. The id is settled once, when the run starts, so a `/model` half way through
-does not move it. A run whose classes resolved nothing says nothing rather than guessing.
+does not move it. A run whose seats resolved nothing says nothing rather than guessing.
 
 ## What the rows under a run are called — sub task names that were just the prompt, and workers all named "You are a"
 
diff --git a/internal/manual/chat/commands.md b/internal/manual/chat/commands.md
index 8e2a43fbc8..9e01401300 100644
--- a/internal/manual/chat/commands.md
+++ b/internal/manual/chat/commands.md
@@ -184,11 +184,18 @@ Canonical word, the other words it answers to, its argument form, and what it do
 | `/memories` | — | — | prints every memory into the conversation |
 | `/remember` | — | `<text>` | keeps one thing across conversations |
 | `/forget` | — | `<query>` | forgets the best matching memory |
-| `/crew` | — | — | opens the six-seat reading: the model you talk to, then the three crew presets |
-| `/crew` | — | `<preset>` | sets the crew to `frugal`, `balanced` or `max` |
+| `/crew` | — | — | opens the crew panel: the three seats, the allowed models, the providers, the per-task limit and the daily cap, changed in place |
+| `/crew` | — | `pin <seat> <model[@provider]>` | pins the worker, planner or checker to a model; `/model` stays |
+| `/crew` | — | `unpin <seat\|all>` | puts a seat back on auto |
+| `/crew` | — | `models <rule>` | which models a seat may be picked from — `all`, `open`, `≤in/out`, ids |
+| `/crew` | — | `cap <dollars\|off>` | the most tasks' crews may spend in a day |
+| `/crew` | — | `cap task <dollars>` | the most one task may spend — $5 unless set; `-yes-spend` does not lift it |
 | `/task` | — | — | opens the full-screen task page — the same page as `/history` and ctrl+. |
 | `/task` | — | `<brief>` | starts one worker at once; its brief is written and its width read beside it, and wide work splits |
 | `/task` | — | `solo <brief>` | starts one worker at once, with no reading of its width |
+| `/task` | — | `--best <brief>` | starts the task on the strongest crew the allowed models make, this task only |
+| `/task` | — | `--cheap <brief>` | starts the task on the cheapest crew that does the work, this task only |
+| `/redo` | — | `stronger` | runs the last task again on a stronger crew, and teaches the crew that kind of work needs more |
 | `/history` | — | — | opens the full-screen sessions place — every task this machine has run, filterable (also ctrl+.) |
 | `/status` | `/info`, `/context` | — | prints every fact the status line knows, one per line |
 | `/status` | `/info`, `/context` | `--json` | prints the same facts as one JSON object, keys in the same order |
@@ -670,20 +677,18 @@ whole wall time — the right edge of the row shows the live `38 tok/s` instead)
 (`2 open · 1 waiting`) and `watching` (the standing count, which is drawn at the foot of the
 task column). `crew` is a fifth and has its own line above.
 
-The `crew` line sits directly under `model` and reads the preset word — or `custom` — and
-the three classes:
+The `crew` line sits directly under `model` and says the crew is auto, with any seat you
+pinned after it:
 
 ```
-crew     max · brain claude-opus-5 · hands glm-5.3 · checks claude-fable-5.1
+crew     auto · pinned checker moonshotai/kimi-k3
 ```
 
-The crew is **not on the status line**. It was one short segment there — `crew max`, or
-`crew custom` — at the head of the telemetry until 2026-09-09, and it came off: the row is
-a ledger of things you act on from it, and a preset is changed on a page. The `crew` line
-here and on the phone's status sheet is where it is read now, in full. Every ordinary
-launch has a crew — one is never unset, only `custom` — so the line is always there; the
-one session that shows none is a **remote** one opened with `--host`, where the crew
-belongs to the other machine.
+The crew is **not on the status line**: the row is a ledger of things you act on from it,
+and the crew is changed on its panel. The `crew` line here and on the phone's status sheet
+is where it is read. Every ordinary launch has a crew — auto is an answer, not an absence —
+so the line is always there; the one session that shows none is a **remote** one opened
+with `--host`, where the crew belongs to the other machine.
 
 `/status` differs from the on-screen status sheet in two deliberate ways:
 
@@ -824,8 +829,8 @@ the same row the Spending tab writes through.
 
 The row names it takes are **`day`** (`daily`, `today`), **`conversation`** (`chat`,
 `session`), **`plan`** (`plans`, `ask`) and **`practice`** — the four rows that can be
-edited. There is deliberately **no `/budget task`**: a task has no dollar limit of its
-own, so a command that accepted one would be writing a number nothing reads.
+edited. There is **no `/budget task`**: the per-task limit is set in `/crew`, with
+`/crew cap task <$>`.
 
 A write says back what it landed, in the tab's own words for that row — `per day · $50`,
 or `per day · no limit`. A figure it cannot read is refused in the row's own words with
@@ -1474,76 +1479,54 @@ On a project that has never run a task the page opens on its heading and one lin
 `work you send off with /task lands here, and its record stays`. The tasks pages describe the
 page in full.
 
-## /crew — the five models codeaf uses on its own behalf, read beside the one you talk to
+## /crew — the crew panel, and the three seats a task runs on
 
-codeaf runs **six model seats**. Seat one is the model you talk to, and `/model` is what
-moves it. The other five — reflex, small work, worker, careful work, mastermind — are the
-models codeaf uses on its own behalf, for the calls you did not type and for the work
-inside every task. `/crew` reads all six and sets the five in one word. **It never moves
-seat one.**
+The crew is the three seats a task runs on: the **worker** that does the work, the
+**planner** that structures it, and the **checker** that reads the result. By default all
+three are auto — codeaf picks each one for each task, from what kind of work the task is.
+**`/crew` never moves the model you talk to**; only `/model` does.
 
 ```
 /crew
 ```
 
-opens the six-seat reading, bottom-anchored like the model picker. From the top:
+opens the crew panel over the conversation — six rows you change in place (the worker,
+planner and checker seats, the allowed **models**, the **providers**, the daily **cap**)
+and a dim `today` line. `enter` changes the row under the cursor, `esc` closes, `?` lists
+every key. On the **providers** row `←`/`→` walk one chip per connected provider and `space`
+turns the one under the cursor off or on; the `+` at its end opens `/connect`. The
+models page has the panel drawn out and every key (*Crew panel keys*). A seat on auto says
+the model it usually runs; a pinned seat wears the pin mark `⌖`. Typed on home, `/crew`
+steps off home and `esc` brings you back.
 
-```
-the five models codeaf uses on its own behalf — not the one you chat with
-  you talk to · deepseek-v4-flash
-  family ‹ open models · all models ›
-  frugal — glm-flash works and thinks, qwen-max checks
-    reflex       google/gemini-2.5-flash · small work   deepseek/deepseek-v4-flash-0731 · worker       z-ai/glm-5.3-flash · careful work qwen/qwen3.8-max-0902 · mastermind   z-ai/glm-5.3-flash
-› balanced — glm-flash works, fable checks, opus thinks
-    reflex       google/gemini-2.5-flash · small work   deepseek/deepseek-v4-flash-0731 · worker       z-ai/glm-5.3-flash · careful work anthropic/claude-fable-5.1 · mastermind   anthropic/claude-opus-5
-  max — glm-5.3 works, fable checks, opus thinks
-    reflex       google/gemini-2.5-flash · small work   deepseek/deepseek-v4-flash-0731 · worker       z-ai/glm-5.3 · careful work anthropic/claude-fable-5.1 · mastermind   anthropic/claude-opus-5
-each of the five can be pinned on its own in /settings → Providers
-```
-
-The first line says what the presets change and what they do not. The second is **seat
-one** — `you talk to · <model>`, spelled as the legend above the box spells it — with no marker and
-no highlight, because nothing in this chooser can move it. The third is the **family**: **←→** moves `family`, which says which pool the three presets below it draw from, open weights or the
-whole catalog. Then the three presets: the one
-in force wears a highlighted ground, `›` is where **enter** is aimed and it opens on yours,
-↑ / ctrl+p and ↓ / ctrl+n move, and **esc** closes without changing anything. The last
-line points at the settings row where one seat can be pinned by itself; the chooser does not
-pick seats one at a time.
-
-If you have pinned one of the five yourself, no preset wears the ground and the chooser says
-`yours is none of the three — picking one puts all five back` above the closing line.
-
-A word that is not one of the three changes nothing and prints the three:
-`/crew cheap` answers `/crew cheap · not one of the three` and then the listing.
-
-What each of the five classes funds, and how to set one of them on its own, is on the models
-page.
-
-## /crew <preset> — the confirm line, and the model it leaves alone
-
-`/crew frugal`, `/crew balanced` or `/crew max` sets the five and confirms in one line:
+The shortcuts write the same rows and then open the panel with a tick on the row they
+changed:
 
 ```
-crew → max · brain claude-opus-5 · hands glm-5.3 · checks claude-fable-5.1 · you are still talking to deepseek-v4-flash — /model changes that
+/crew · /crew pin <worker|planner|checker> <model[@provider]> · /crew unpin <seat|all> · /crew models <all|open|≤in/out|ids…|+id|-id> · /crew cap <dollars|off> · /crew cap task <dollars>
 ```
 
-**The model ids are drawn brighter than the words around them.** `crew →`, the preset
-word, `brain`/`hands`/`checks` and `you are still talking to` stay at the grey every note
-is written in; the three crew ids and the model you are talking to step up, because they
-are what the command was typed to find out. `/model` wears the command chip, because it is
-a command you can type. See "Why is one word in a line brighter than the rest" on the
-screen page.
+- **`/crew pin <seat> <model[@provider]>`** pins one seat, for every task until you unpin
+  it. `@provider` sends it through that connection. A pin outside the allowed models is
+  refused. The confirmation names the model you are still talking to:
+  `checker ⌖ moonshotai/kimi-k3 · every task until you unpin it · you are still talking to
+  deepseek-v4-flash — /model changes that`.
+- **`/crew unpin <seat>`** puts the seat back on auto; `/crew unpin all` puts all three back.
+- **`/crew models <rule>`** sets which models a seat nobody pinned may be picked from —
+  `all`, `open`, `≤1/5` for a price ceiling per million tokens in and out, or a list of ids —
+  and `+id` or `-id` changes the rule in force by one word. Bare `/crew models` says the rule.
+- **`/crew cap <dollars|off>`** caps what crews may spend in a day. Bare `/crew cap` says the
+  cap and today's spend.
+- **`/crew cap task <dollars>`** sets the most one task may spend — $5 unless set. A call
+  that would take a task past it is not made, and `-yes-spend` does not lift it.
 
-The last clause names, by id, the one seat the command did not touch: the model you are
-talking to, in the same spelling the legend above the box uses, so you can check it
-against the line over your own prompt. `/crew` never changes that model and never offers to; only
-`/model` does. When the session has no model yet the clause reads
-`the model you talk to is untouched — /model changes that`.
+A form that is none of these changes nothing and prints the line of shortcuts:
+`/crew cheap · not a crew form · …`. How hard to try **one** task is not a panel setting at
+all — it is said with `/task --best` or `/task --cheap`, and `/redo stronger` asks again
+after the fact (see *Tasks*).
 
-**The change is live.** The next call codeaf makes on its own uses the new crew — no
-relaunch, and no waiting for the next session. To read the crew back afterwards: the live
-`/status` prints the `crew` line under `model`, the phone's status sheet has the same row,
-`/settings` → Providers has the crew row, and bare `/crew` opens on yours.
+**The change is live.** The next task uses it — no relaunch. The whole story, from how a
+seat is picked to how a profile from an earlier build is migrated, is on the models page.
 
 **That promise is local-session only.** Over `--host` the session resolves its crew from
 the other machine, and there is no crew write across the connection — so `/crew` refuses
@@ -1728,7 +1711,7 @@ Every one of them lands on the next launch rather than on the conversation in fr
 you, so they are a fact about this machine and not about this session. Nothing you saved
 moved: the keys they are stored under are unchanged.
 
-The five models codeaf uses on your behalf are **not** here — they are on Providers, with
+The models codeaf uses on your behalf are **not** here — they are on Providers, with
 the row that says which model you are talking to. They used to be on this tab, one tab away
 from it, which made "which model does the planning" and "which model am I talking to" two
 errands on two screens. Neither is the conversation's own money limit here any more: it is
@@ -1832,17 +1815,18 @@ order:
 5. **prompt profile** — how much codeaf tells the model before you type: `auto`, `lean`,
    `full`. Another cycle row. `auto` reads the model's context window and goes lean under
    32,000 tokens (see *Models, context, and what it costs*).
-6. **crew** — the five below, chosen as one word: `frugal`, `balanced`, `max`. It is a cycle
-   row: enter or space walks it. Answer any of the five yourself and it reads `custom`.
-7. **reflex** — `near-free · reads every turn — memory, titles, safety`
-8. **small work** — `cheap · the small calls — names, digests, the safety gate`
-9. **worker** — `does the work · every task, its parts, every run node — most of the bill`
-10. **careful work** — `careful · checks what must not be wrong — audits, briefs, vision`
-11. **mastermind** — `thinks · plans runs and designs harnesses — add :low, :medium or :high`
-12. **pinned roles**, and hanging off it the **roles** list — one row per auxiliary call
-    codeaf makes for itself, grouped under its class. Those rows come from the running binary
+6. **reflex** — `near-free · reads every turn — memory, titles, safety`
+7. **small work** — `cheap · the small calls — names, digests, the safety gate`
+8. **seats** — `the worker, planner and checker, the models they may be picked from, the providers they may route through, and the per-task and daily caps · enter opens /crew`
+9. **pinned roles**, and hanging off it the **roles** list — one row per auxiliary call
+    codeaf makes for itself, grouped under its row. Those rows come from the running binary
     rather than the settings registry.
 
+**worker**, **checker** and **planner** are the crew's three seats, and on the tab they are
+one row, **seats** (`auto · 1 pinned · models open · 3 of 4 providers · per task $5 · daily $5.00`).
+`enter` on it opens the `/crew` panel, where the seats, the allowed models, the providers
+and the per-task and daily caps are changed; `esc` there comes back to the row.
+
 **A pin for a role this build no longer has is ignored, and the row stops showing it.** Roles
 come and go with the calls that use them — `compaction` was one, and a compaction has not asked
 a model since long before it was deleted. A pin left behind for a word like that is dropped
@@ -1863,9 +1847,9 @@ that has come apart is cut and asked again, on by default (see *Models, context,
 it costs*) — and one row per capability slot added automatically from the settings
 registry: drawing, speaking, composing, filming, voice.
 
-The first four of the five classes are **select** rows and open the model picker. The
-**mastermind** row is a **text** box instead, because its value may carry a thinking level
-(`moonshotai/kimi-k3:high`) and a picker hands back a bare id.
+The reflex, small work, worker and checker rows are **select** rows and open the model
+picker. The **planner** row is a **text** box instead, because its value may carry a
+thinking level (`moonshotai/kimi-k3:high`) and a picker hands back a bare id.
 
 The connected model services have their own section on the tab, each with its billing
 door, the safe spelling of its key, its region and its order. The section ends with an
@@ -1924,13 +1908,13 @@ one call codeaf makes outside a turn — `title`, `guardian`, `auditor`,
 one of them you ask for yourself with `ctrl+r` (see the keys page) — drawn as
 `<role>    <model>`, with `pinned` after it when that role has a model of its own.
 
-The rows are **grouped under their class**, in the same order the five class rows are drawn
-above them: `roles · reflex`, `roles · small work`, `roles · worker`, `roles · careful work`,
-`roles · mastermind`. The class is the heading, so it is not repeated on every row — which
+The rows are **grouped under their row**, in the same order the five model rows are drawn
+above them: `roles · reflex`, `roles · small work`, `roles · worker`, `roles · checker`,
+`roles · planner`. The row is the heading, so it is not repeated on every role — which
 leaves the widest part of the row for the model id it is there to show.
 
 Stop on a row and the line under the list says **what that role is** and where its answer
-came from: `the plan that steers an adaptive run · follows mastermind above. enter pins it
+came from: `the plan that steers an adaptive run · follows planner above. enter pins it
 to a model of its own.`
 
 - **enter** opens the model picker and pins the role to what you choose.
diff --git a/internal/manual/chat/empty-screen.md b/internal/manual/chat/empty-screen.md
index 6591997bdf..190c4d06c9 100644
--- a/internal/manual/chat/empty-screen.md
+++ b/internal/manual/chat/empty-screen.md
@@ -9,7 +9,7 @@ A new conversation opens on **one centred group** and nothing else. From the top
 ┌─  ┌─┐ ┌─┤ ┌─┐ │ │ ├─          the codeaf wordmark, drawn CodeAF
 │   │ │ │ │ ├─╴ ├─┤ │
 └─  └─┘ └─┘ └─┘ ╵ ╵ ╵
-anthropic/claude-sonnet-4.5 · balanced crew
+anthropic/claude-sonnet-4.5 · auto crew
                                  a blank row
 › _                              the message box, cursor in it
 try "what is in this folder" · /task <brief> starts work · / shows commands
@@ -20,8 +20,8 @@ recent sessions                  only when this folder has earlier conversations
 ```
 
 The line under the wordmark is the model that will answer, as its full routing
-address, and the crew preset behind it (`frugal`, `balanced`, `max`, or `custom`) —
-the two facts that decide what a turn costs. The group is centred in the window, a
+address, and `auto crew` — tasks get their own worker, planner and checker, picked per
+task — the two facts that decide what the work costs. The group is centred in the window, a
 shade above the middle. It shows once, arrives with a slow sweep across the letters
 over about a second and a quarter, and is then still.
 
diff --git a/internal/manual/chat/getting-started.md b/internal/manual/chat/getting-started.md
index bf2ff2396f..9f67dda66a 100644
--- a/internal/manual/chat/getting-started.md
+++ b/internal/manual/chat/getting-started.md
@@ -17,8 +17,8 @@ an empty prompt and a provider error. It opens in the chat itself, on **two scre
 under a minute, nothing else on the frame:
 
 1. **connect openrouter** — the default service; `enter` signs in in your browser, and pasting an existing key also works
-2. **Models and spending** — one screen with three controls on it: **Daily limit**,
-   **Chat model** and **Work crew**, each already showing the value that is in force
+2. **Models and spending** — one screen with two controls on it, **Daily limit** and
+   **Chat model**, each already showing the value that is in force
 
 The second screen's way out is **`Start a conversation`**. Every control on it opens on
 the value you already have, so pressing `enter` there agrees to exactly what is on the
@@ -45,7 +45,7 @@ are standing on — `tab` walks the rows, `?` opens a control's detail — and o
 window it is cut by whole clauses rather than mid-word.
 
 **On a window too short for the whole screen the explanations are what go**, a whole
-sentence at a time and never half of one. The three values, `Start a conversation` and
+sentence at a time and never half of one. The two values, `Start a conversation` and
 the keyboard line are never given up, so a sixteen-row window still shows a screen you
 can answer and leave.
 
@@ -156,46 +156,37 @@ here. They keep their shipped defaults — plan approval asks first above `$100`
 conversation ceiling is `no limit` — and `/budget` or `/settings` → Spending changes them
 when they start to matter.
 
-## The model you talk to and the work crew on the setup screen
+## The model you talk to on the setup screen — and why it does not ask about the crew
 
 **Chat model** is the model you talk to, shown by name — `DeepSeek V4 Flash` rather than
 `deepseek/deepseek-v4-flash`. Its line reads *The model you talk to in this
-conversation.*, and `?` adds the exact catalog id and that it also handles this
-conversation's tool use. Opening the row draws the real catalog: five rows at a time,
-`↑`/`↓` scroll the rest past, and **typing narrows it**, so two hundred models are
-reachable from a form with five rows on it. The row under the cursor shows its exact id.
-The model you are already on is always on that list and the cursor opens on it, even with
-no catalog yet, so accepting confirms rather than changes. Choosing one goes through the
-same settings row `/model` writes and is kept for the next launch.
-
-**Work crew** is the five models codeaf uses on its own behalf — *Models used to plan,
-run, and check tasks.* Opening it draws the three presets — `Frugal`, `Balanced` and
-`Max` — each with a whole one-line description of **the choice** (how much model goes on
-the work), never a price: this screen makes no claim about what anything will cost you.
-`?` on the row shows the seats the crew is actually made of (`brain … · hands … ·
-checks …`) and that **a crew change leaves the model you talk to alone**. The crew is the five class rows (`models.tiers.reflex`, `models.tiers.low`,
-`models.tiers.worker`, `models.tiers.high`, `models.tiers.mastermind`); the model that
-answers you is the row above it, and neither touches the other.
-
-Two rules keep this screen from writing something you did not ask for:
-
-- **`esc` out of either list leaves the row exactly as it was.** A cursor inside a list
-  is provisional until you accept it.
-- **A crew you arranged yourself is never overwritten.** If any of the five class rows is
-  already in your profile — you pinned one by hand, or an earlier `/crew` wrote them — the
-  row reads `Custom`, `Start a conversation` writes no preset over it, and the list still
-  says `yours is none of the three — picking one puts all five back` if you want one.
-
-If a **task model** is pinned (`task.model`), one dim line under the crew says so —
-`Tasks are pinned to … · /settings changes that` — because that pin takes the worker seat
-out of the preset's hands and a crew row that did not mention it would be selling you a
-dial that is disconnected.
+conversation.*, and `?` adds the exact catalog id, that it also handles this
+conversation's tool use, and that tasks get their own crew, picked per task. Opening the
+row draws the real catalog: five rows at a time, `↑`/`↓` scroll the rest past, and
+**typing narrows it**, so two hundred models are reachable from a form with five rows on
+it. The row under the cursor shows its exact id. The model you are already on is always on
+that list and the cursor opens on it, even with no catalog yet, so accepting confirms
+rather than changes. Choosing one goes through the same settings row `/model` writes and
+is kept for the next launch.
+
+**There is no crew question**, because the crew is three seats — the worker, the planner and the
+checker — and codeaf picks all three for each task from what kind of work it is, so there
+is nothing to choose before the first task. `/crew` shows the crew, and pins a seat when
+you want one model there every time. The model that answers you is the one above, and
+neither touches the other.
+
+**`esc` out of the list leaves the row exactly as it was.** A cursor inside a list is
+provisional until you accept it.
+
+If a **task model** is pinned (`task.model`), one dim line under the chat model says so —
+`Tasks are pinned to … · /settings changes that` — because that pin decides the worker
+seat, and a screen that did not mention it would be hiding where tasks run.
 
 At **112 columns and wider** a bordered panel stands beside these rows, labelled
 `○ Example · what you can do` and footed `An illustration. Nothing here has run.` — the
 only bordered surface codeaf draws, so it cannot be read as more form. It holds one
 request you could type and what it leads to, and follows the row you are on: beside the
-crew it shows `/task Fix the failing tests and explain the changes.` That request **types
+review row it shows `/task Fix the failing tests and explain the changes.` That request **types
 itself out once** on arriving and on `←`/`→`, then settles; typing settles it at once.
 Under 112 columns it is not drawn and the form is unchanged.
 
@@ -242,23 +233,22 @@ Every answer went through a settings row, so every answer has a door:
 | What you answered | Where to change it later |
 | --- | --- |
 | the default service's openrouter key | clear or remove it and the next local interactive launch offers **connect openrouter** again; `/settings`, Providers tab, the **openrouter key** row still accepts a pasted replacement |
-| the crew | `/crew` (bare shows the three, `/crew max` sets one), or the **crew** row on the settings panel |
+| the crew | nothing was asked — it is auto. `/crew` shows it, and `/crew pin <seat> <model>` pins a seat |
 | the daily limit | `/budget` (also `/limits`), or `/settings` → **Spending**. `CODEAF_DAILY_BUDGET` in your shell outranks the row |
 | the model you talk to | `/model`, or the **Chat model** row on the setup screen — the same settings row either way |
 | memory, permissions, the task countdown | `/settings`; the setup screen only shows them, under `Other settings` |
 
 A credential changed in the settings row reaches the running conversation at once,
-exactly as the setup's does. The crew and the budget are read live too: the next call
-codeaf makes on its own behalf uses the new crew, and the rail is checked against the
-new ceiling.
+exactly as the setup's does. A crew pin and the budget are read live too: the next task
+starts on the new pin, and the rail is checked against the new ceiling.
 
-**The setup asks about three things and no more.** Memory stays on, tool approvals keep
+**The setup asks about two things and no more.** Memory stays on, tool approvals keep
 prompting, and a proposed task keeps its 15-second countdown — none of them becomes a
 question there, because none can be answered usefully before you have seen codeaf do
 anything. They are taught where they happen: the countdown is on the task card, and the
 first permission question explains the actual tool that asked for something.
 
-Under the three fields is one row that shows them: **`Other settings use defaults ·
+Under the two fields is one row that shows them: **`Other settings use defaults ·
 review`** on a fresh profile, and **`Review other settings`** on a profile that has
 already written any of them down — it never claims your own settings are defaults.
 `enter` on that row opens three read-only rows straight off the settings registry:
@@ -322,7 +312,7 @@ composer still names what `enter` does — and the first place you land on says
 line: `your terminal sends opt as a letter — turn on "use option as meta" in …`, naming the
 terminal you are actually in.
 
-**The first-run setup says it too.** When the three questions are done, a Mac gets one more
+**The first-run setup says it too.** When the questions are done, a Mac gets one more
 line: `the seven places answer opt+1…opt+7 · if opt types a character instead, turn on "use option as
 meta" in …`. It is a condition rather than a report — nothing has been pressed yet — and it is
 said once.
diff --git a/internal/manual/chat/home.md b/internal/manual/chat/home.md
index 02b798bca1..19d9296c82 100644
--- a/internal/manual/chat/home.md
+++ b/internal/manual/chat/home.md
@@ -1320,8 +1320,9 @@ one behind your back. This is every fate, in the words the drop-up draws them in
 | **`opens the page`** | `/settings` `/set` `/config` · `/home` · `/search` · `/spend` · `/standing` · `/memory` `/memories` · `/history` · `/task` (bare) | A place replaces a place, exactly as before. |
 | **`this list is /resume`** | `/resume` `/sessions` | Says `this list is /resume · enter opens a row` — home *is* that list. |
 | **`onto home's tray`** | `/attach <path>` | The file — or picture — rides on home's own tray into the conversation you open next. Home says `attached · notes.md · rides with the next conversation`. A bare `/attach` opens the browser aimed at the next conversation's folder, and a file chosen there lands on the tray. |
-| **`opens a conversation here first`** | `/files` · `/folder` `/place` `/dir` · `/manual` · `/crew` (bare) · `/permissions` `/perms` · `/connect` · `/harness` · `/subharness` · `/skill` `/skills` · `/copy` · `/select` · `/rewind` `/undo` `/back` · `/compact` · `/export` `/save` · `/standing <words>` · `/task <brief>` | Opens a conversation at the target — the folder at the right of the keys row and the model on the rule above the box — then runs there. Home closes, exactly as `enter` closes it. `/manual` is on this road since 2026-09-22: it is a question put to the model, so it needs a conversation to be asked in. `/folder` joined it the same day — it gives THIS conversation a folder, and home has no this; the pin it used to be here is `/project`. |
-| **`answers here`** | `/help` · `/status` · `/cost` · `/cache` · `/budget` · `/crew <preset>` · `/debug` · `/stop` · `/remember` · `/forget` · a word nobody defined | Answers with a note, and the first line of that note is put on home's own line under the box. `there is no command called /pricing · / lists them` is now something you can read. |
+| **`opens a conversation here first`** | `/files` · `/folder` `/place` `/dir` · `/manual` · `/permissions` `/perms` · `/connect` · `/harness` · `/subharness` · `/skill` `/skills` · `/copy` · `/select` · `/rewind` `/undo` `/back` · `/compact` · `/export` `/save` · `/standing <words>` · `/task <brief>` | Opens a conversation at the target — the folder at the right of the keys row and the model on the rule above the box — then runs there. Home closes, exactly as `enter` closes it. `/manual` is on this road since 2026-09-22: it is a question put to the model, so it needs a conversation to be asked in. `/folder` joined it the same day — it gives THIS conversation a folder, and home has no this; the pin it used to be here is `/project`. |
+| **`answers here`** | `/help` · `/status` · `/cost` · `/cache` · `/budget` · `/debug` · `/stop` · `/remember` · `/forget` · a word nobody defined | Answers with a note, and the first line of that note is put on home's own line under the box. `there is no command called /pricing · / lists them` is now something you can read. |
+| **`opens the crew panel`** | `/crew` and every `/crew` shortcut | Home steps aside and the crew panel opens over the conversation behind it; `esc` on the panel brings you back to home. A shortcut opens it with a tick on the row it changed. |
 | **`runs on the conversation behind home`** | `/land` · `/land <folder>` · `/workspace <path>` | Acts on the conversation this window is holding behind the screen — not on the one `enter` would open — and its answer is echoed onto home's line. |
 | **`a fresh conversation behind home`** | `/new` `/clear` `/clean` `/reset` | Replaces the conversation behind the screen and says `started a fresh conversation behind home`. It is not the same act as `enter`, which opens a conversation at the target. |
 | **`closes the conversation behind home`** | `/quit` `/exit` `/q` | Closes it and says `closed · <its name>`. When it was the last conversation this terminal was holding, codeaf leaves. |
diff --git a/internal/manual/chat/how-tasks-run.md b/internal/manual/chat/how-tasks-run.md
index 66eeeb9083..745a7d702b 100644
--- a/internal/manual/chat/how-tasks-run.md
+++ b/internal/manual/chat/how-tasks-run.md
@@ -1791,12 +1791,12 @@ The worker is fresh; the working copy is not. The task stays *running* while a r
 way, and you see one plain line of what is being closed.
 
 **A correction round is attempted by a more capable model.** The first attempt runs on the
-task's own model; when a check finds gaps, the worker sent back to close them runs on your
-crew's **careful work** model — the `repair` role, in `/crew`. It is the one place codeaf
+task's own model; when a check finds gaps, the worker sent back to close them runs on the
+task's **checker** — the `repair` role, under the checker row. It is the one place codeaf
 spends more than you asked it to, and it is spent only after something has actually gone
 wrong, on a job the check has already narrowed to named gaps in a working copy that is
-already most of the way there. Two things turn it off by themselves: a crew whose careful
-model is the same as the model the work is on repairs on that model and costs nothing
+already most of the way there. Two things turn it off by themselves: a crew whose checker
+is the same as the model the work is on repairs on that model and costs nothing
 extra, and a task whose model **you named** — on the card or from inside its room — keeps
 your model for the correction round too.
 
@@ -2179,7 +2179,7 @@ what was left of the work is **not work a worker can do**: an approving review o
 person may give, a credential or an account nobody here holds, a decision that is yours to
 make, or a step that is somebody else's system doing something by itself.
 
-It is found by the same `mastermind` model that reads a task's parts before it splits (the
+It is found by the same **planner** that reads a task's parts before it splits (the
 tasks page, *when a task turns out to be too wide for one worker*). That reading runs
 **beside the task's worker**, which has already started, and when it comes back saying
 nobody here can do this, the worker is stopped where it is — the one time a started worker
diff --git a/internal/manual/chat/keys.md b/internal/manual/chat/keys.md
index 7213acc594..8b373d415c 100644
--- a/internal/manual/chat/keys.md
+++ b/internal/manual/chat/keys.md
@@ -1779,6 +1779,18 @@ move · `enter` activate. Its foot reads `esc close · ↑↓ move`.
 `end`/`G` bottom · `ctrl+o` lifts the line cap. Its foot reads exactly
 `esc close · ↑↓ scroll`, or `esc close · ↑↓ scroll · tap … for the rest`.
 
+**Crew panel** (`/crew`): `up`/`k`/`ctrl+p`, `down`/`j`/`ctrl+n`, `home`, `end` walk the six
+rows · `enter` changes the row · `esc` goes back one level and closes · `?` lists every key ·
+`z` undoes the last change while the bottom edge offers `z undo`. On the **models** row
+`←`/`→` step `all`, `open`, `price`, `custom`, and `enter` steps forward like `→` until
+`price` or `custom`, where it opens the ceilings or the checklist. On the **providers** row `←`/`→` walk the
+chips and `space` turns the one under the cursor off or on — the foot reads
+`enter change · space toggle · esc close · ? keys` there and nowhere else — and `space` on
+the `+` opens `/connect`, whose `esc` comes back to this row; `enter` opens the providers list, whose foot reads
+`space or enter toggle · esc back`. On the **cap** row a digit starts the figure. A click on
+a row is `enter`, a click on a provider chip toggles it, and the wheel walks. The models
+page has every key (*Crew panel keys*).
+
 All of these are modal: while one is up, every chord except `ctrl+c` belongs to it.
 `ctrl+c` does not close the panel — it quits codeaf, with the panel still up.
 
diff --git a/internal/manual/chat/models-and-cost.md b/internal/manual/chat/models-and-cost.md
index d610020560..1970c68f95 100644
--- a/internal/manual/chat/models-and-cost.md
+++ b/internal/manual/chat/models-and-cost.md
@@ -461,209 +461,401 @@ another conversation cannot use this model-changing door. `/model` says
 behind that page. Provider pinning with `@provider` or `auto` remains available
 from the conversation's `/model`.
 
-Changing the conversation model does not move existing tasks. New tasks resolve
-their model from an explicit choice, the task model setting, the crew's worker
-class, then the conversation model when that worker class is blank.
-
-## The crew — which models codeaf uses on my behalf, and /crew
-
-codeaf makes calls you did not type: naming a session, naming a piece of work on the roster,
-the brief a task opens on, the safety gate, the check on finished task work, the second
-look before a task starts itself, the reading of a task's parts before they are handed out,
-the planner of an adaptive run and the nodes under it, the designer of a saved harness page,
-looking at an image. Each of those is a
-**role**, and every role sits on one of five **classes** — the **crew** — which you set in
-`/settings` → Providers, or in one word with `/crew`:
-
-- **reflex** — near-free · reads every turn — memory, titles, safety.
-- **small work** — cheap · the small calls — names, digests, the safety gate.
-- **worker** — does the work · every task you hand off, the parts it divides into, every
-  node of an adaptive run. Most of what a task costs is spent here.
-- **careful work** — careful · checks what must not be wrong — audits, briefs, vision.
-- **mastermind** — thinks · plans runs and designs harnesses.
-
-**All five arrive with a model already in them**, and on an account that is not
-known low on OpenRouter credits the five together are the `balanced` preset.
-While the account is known low, unwritten table seats use the free crew described
-in *OpenRouter credits and free models*, and `/status` calls that crew `free`:
-
-| class | as shipped |
-| --- | --- |
-| reflex | `google/gemini-2.5-flash` |
-| small work | `deepseek/deepseek-v4-flash-0731` |
-| worker | `z-ai/glm-5.3-flash` |
-| careful work | `anthropic/claude-fable-5.1` |
-| mastermind | `anthropic/claude-opus-5` |
-
-None of them is the model you are talking to. A crew that followed your conversation would
-put the most expensive model in the build on the cheapest questions in it — a call made
-twice every turn on a frontier model is a bill nobody agreed to. That is also why the two
-seats that read every turn stay on near-free models while the frontier ids sit on the seats
-that answer a handful of times. You can pin any vendor's model on any row yourself, and you
-can connect that vendor as a direct service; the
-[services page](services.md) explains its names, limits and missing Phase 1 cost record.
-
-**The `model family` row** (`models.crew.source`) decides which family
-the three preset words draw from. `all` is the default and is the table above: the whole
-catalog, closed and frontier models included, costing what those models cost. `open` reads the
-same three words, `frugal`, `balanced` and `max`, off the open-weight rows only, so no seat is a
-bet on one vendor's pricing. Flip the row and the seats nobody pinned move with it at once,
-because an unwritten seat is the default crew resolved in the family you are on; the rows already
-on disk keep their ids until you pick the crew again, and the crew word reads `custom` while they
-match no preset in the family you flipped to.
-
-Under `open`, the same three words resolve to these:
-
-| class | frugal | balanced | max |
-| --- | --- | --- | --- |
-| reflex | `mistralai/mistral-nemo` | `mistralai/mistral-nemo` | `mistralai/mistral-nemo` |
-| small work | `deepseek/deepseek-v4-flash-0731` | `deepseek/deepseek-v4-flash-0731` | `deepseek/deepseek-v4-flash-0731` |
-| worker | `z-ai/glm-5.3-flash` | `z-ai/glm-5.3-flash` | `z-ai/glm-5.3` |
-| careful work | `z-ai/glm-5.3-flash` | `moonshotai/kimi-k3` | `moonshotai/kimi-k3` |
-| mastermind | `z-ai/glm-5.3-flash` | `z-ai/glm-5.3` | `z-ai/glm-5.3` |
-
-The worker column is the dial in that family — it holds `glm-5.3-flash` through `balanced`, and
-`max` moves it to `glm-5.3` — because it is the seat that pays most of a task's bill and a
-preset that moved every other seat would change everything about a task except its cost.
-
-**Why these ids.** Every row of the catalog was placed on two axes on 2026-09-16: the bill a
-seat's own call shape runs up, built from the catalog's published prompt, completion and
-cache-read prices, against that seat's quality, taken from its published intelligence, coding
-and agentic indexes. The call shape is part of the price, so the seats were priced apart — the
-worker and the careful seats as long cached loops, where a large prompt is read back turn
-after turn and the cache-read price carries most of the weight, and the mastermind as one-shot
-calls, where the prompt is paid in full each time and there are few of them. Each preset then
-takes, for each seat, a point on the pareto front of that plot at the bill it is willing to
-run: nothing on the front costs less at the same quality, and nothing at the same bill scores
-higher. The two families are the same plot over two sets of rows, which is why the columns do
-not climb together in either of them.
-
-In the `all` family the worker stays on `glm-5.3-flash` through `balanced`, because the worker
-seat carries most of a task's tokens: a step there multiplies through the whole bill, where a
-step on the careful or the mastermind seat is paid a handful of times. So `frugal` to
-`balanced` spends on those two low-volume seats, and `max` moves the worker itself. The
-careful and mastermind seats are settled by `balanced` and stay there through `max`.
-
-The careful class always sees images — the vision role rides that row — and is a different
-vendor from the worker in every preset of the `all` family; the open family's `frugal` row
-is the one standing exception, with worker and careful both on `glm-5.3-flash`, because at
-that bill the open-weight front has no second vendor for the careful seat. The small-work row is pinned to
-the July build of DeepSeek V4 Flash on purpose: the bare `deepseek/deepseek-v4-flash` id
-resolves to the April build, and the July build costs the same.
-
-**Clearing a row is still an answer.** A class you empty on purpose reads
-`follows the conversation`, and every role on it runs on the model you are talking to. That
-is the only way to say "use my model for this", and it is deliberately something you have to
-say rather than the default.
-
-### The three presets
-
-These are the three in the family you are on unless you changed the `model family` row — the
-default one, `all`:
-
-| | frugal | balanced | max |
-| --- | --- | --- | --- |
-| reflex | `gemini-2.5-flash` | `gemini-2.5-flash` | `gemini-2.5-flash` |
-| small work | `deepseek-v4-flash-0731` | `deepseek-v4-flash-0731` | `deepseek-v4-flash-0731` |
-| worker | `glm-5.3-flash` | `glm-5.3-flash` | `glm-5.3` |
-| careful work | `qwen3.8-max-0902` | `claude-fable-5.1` | `claude-fable-5.1` |
-| mastermind | `glm-5.3-flash` | `claude-opus-5` | `claude-opus-5` |
-
-- **frugal**: glm-flash works and thinks, qwen-max checks
-- **balanced**: glm-flash works, fable checks, opus thinks
-- **max**: glm-5.3 works, fable checks, opus thinks
-
-The reflex and small-work columns never vary — they are the
-same near-free models in all three — so `/crew` never names them: the confirmation and
-`/status` say **brain**, **hands** and **checks**, which are the mastermind, the worker and
-the careful class.
-
-`/crew` opens all three as a chooser with yours marked, under a scope line — `the five
-models codeaf uses on its own behalf — not the one you chat with` — and a `you talk to ·
-<model>` line naming the seat the presets do not touch. ↑ / ctrl+p and ↓ / ctrl+n move;
-enter applies and esc cancels. If the five classes make a custom crew, no row is marked and
-the chooser says picking one puts all five back. `/crew max` still sets it directly and
-confirms in one line, which ends `· you are still talking to deepseek-v4-flash — /model
-changes that` — naming the conversation's own model by id, because the crew changes
-nothing about it and the model segment on the status line goes on saying what it said
-before. `/crew learn`, `/crew catalog` and `/crew table` move the **picked from** row and
-nothing else — the three words the row takes, answered without touching a model id — and
-when the pick is off `table` the crew word says so beside the preset: `balanced · learn`
-in `/status`, `crew balanced · learn` on the status line. The **crew** row in `/settings`
-→ Providers is the same thing: enter or space walks it frugal → balanced → max, and the
-**picked from** row under it walks table → catalog → learn.
-
-**The crew row is not stored by codeaf — it is worked out from the five.** Answer any one
-of the five rows yourself and the crew row reads `custom`, because that is what is true.
-`/crew balanced` puts all five back in one write. A profile that applied a crew before the
-worker row existed reads `custom` until a preset is applied again, because its four old
-rows and the new fifth are not any of the three. A run that writes the crew word into the
-profile itself — nothing this build does, but a harness or a hand edit may — is read as
-the budget its seats run at, and the class rows under it are that run's own pins.
-
-### Where the seats are picked from — table, catalog, learn
-
-The **picked from** row (`models.crew.pick`, just under the crew row) says where the
-seats' models come from when a class row does not hold a model id of its own. The crew
-row above it still says how much to spend; this row says where the models for that
-money are read from:
-
-- **table** — the rows we measured: the ids this build shipped with, the same ones every
-  preset table holds. This is the default, and it is what an unwritten class has always
-  read.
-- **catalog** — recomputed from today's published prices and scores at your crew's
-  budget, on every read. Nothing is stored; a catalog that moves moves the seat with it,
-  and your profile never holds a model id this build chose for you.
-- **learn** — the catalog computation plus the Model Pool's measurements and your own
-  judged runs, carried as a quality rating the better-measured models read on top of
-  their published scores.
-
-`catalog` and `learn` are Pareto crewing: the crew is picked on the cost-quality front,
-per role and per task, from evidence rather than from a fixed table.
-
-A pick moves the three seats the presets dial — **worker**, **careful work** and
-**mastermind** — and never the two that read every turn: **reflex** and **small work**
-keep their near-free ids, the same ones in every preset.
-
-**A model you typed by hand wins.** The pick answers for the seats nobody named. A class
-row YOU wrote keeps its model, spelled as you typed it — the crew table's own id included
-— and a `models.crew` word stored in the profile marks every class row beside it as yours.
-`/crew balanced` writes all five classes at once, so it is the preset answering rather
-than a pin and the pick computes its three dial seats. **A flag or an environment variable
-still outranks the pick** — the pick reads the profile, and `--model` and `CODEAF_MODEL`
-are what an invocation said.
-
-When the catalog cannot compute a seat — no catalog yet, or no pick off its front — the
-seat falls back to the table row for your preset, never to `auto` and never to empty. A
-seat the pick computed names it where the preset would be: `crew balanced, computed
-from the catalog` under **catalog**, `crew balanced, learned` under **learn**.
-
-**The per-seat alias is the bare word `auto`.** Any of the five class rows may hold the
-bare word `auto` instead of a model id, case folded. The seat's model is then
-**computed from the catalog** — the three published capability indexes against the three
-published prices, under that seat's own call shape — every time the row is read. The
-word stays on disk; the id is worked out on every read.
-
-**The budget it computes at comes from the other four rows.** `auto` has no opinion about
-cost of its own, so it runs at whatever preset the rows around it name: four rows that are
-`balanced`'s make an `auto` row a balanced seat, four that are `max`'s make it a max seat.
-
-**When the other rows match more than one preset, `balanced` wins.** It is the default
-preset, and the budget an undecided profile runs at is the budget an `auto` seat runs at.
-This is not a rare corner: `max` differs from `balanced` only in the worker seat, so a
-crew with `auto` on the worker and the other four rows as shipped matches both, and reads
-as `balanced`. Pin the worker to `max`'s own id and put the `auto` row on a seat above it
-if you want a computed seat at `max`'s budget.
-
-A seat on a computed row names both facts where a seat is shown — `crew balanced,
-computed from the catalog` — so the reading is never a guess.
-
-### The roles under each class
-
-Directly under the **pinned roles** row the panel lists **every registered role**, grouped
-under the class answering it, saying which model comes out. As shipped:
-
-| role | class | what it is |
+Changing the conversation model does not move existing tasks. A new task's
+worker comes from an explicit choice, then the task model setting, then the
+crew's **worker** seat — a pin, or the model the crew picked for that task —
+and only when nothing answers, the conversation model.
+
+## The crew — which models a task runs on, and /crew
+
+The crew is three seats: the **worker** that does the work, the **planner** that
+structures it, and the **checker** that reads the result. **By default all three are auto.**
+codeaf picks each seat for each task: it reads what kind of work the task is — a
+**bugfix**, a **complex fix**, **open-ended** work, or **other** — and picks the model for
+each seat from what its catalog row says about it, weighed against what the model costs.
+Every model a connected provider serves is a candidate, frontier models included, as long
+as the allowed models admit it. A model that publishes any index — the intelligence, coding
+or agentic index, or an arena rating — is scored on those alone, through learned weights
+that ship with codeaf, for that seat on that kind of work; price never counts as ability, so a model
+no dearer than another and at least as good on every index they both publish is never ranked
+below it. A model that publishes none is scored from its context, release date, licence and
+family, never above the average model, and less surely. Each seat weighs a model a little
+below its score by how unsure the score is, and a row is scored again when the catalog next
+lists new figures for it. How this install's own tasks ended — accepted, kept, redone, failed — moves
+a model's score in a seat a little each time, within a bound, and never freezes it. A task it
+cannot read with confidence counts as open-ended, because that is where a weak crew costs
+the most.
+
+The pick stops where more money stops buying much. Every seat pays for ability, and
+open-ended work pays more for it than a fix does, so a small fix usually runs on a cheap crew
+and open-ended work buys a stronger model sooner as prices rise. On open-ended and other work
+that upgrade goes to the **checker** first — the seat that accepts the work — and the planner
+stays on the base model; `--best` upgrades every seat. The worker and the checker are never
+simply the cheapest model: their score must reach the ability of the weakest model seen doing
+the work, whenever an allowed model's does, and `--cheap` takes a clearly stronger worker when
+it costs no more than half again as much. A fix whose report shows **reach** —
+more than one file, an API or protocol, language rules, a long report or several repros,
+a security defect, existing tests that must keep passing, two of these at least — is a
+**complex fix**: its worker is one rung stronger than a simple fix's; its planner and
+checker are the fix's own, the line still says bugfix, and a worker you pinned stays
+pinned. An issue's own labels count most:
+a `bug` label in any spelling (`bug :bug:`, `type/bug`) makes the task a bugfix. The price is the one you
+would actually pay: a model you reach through a subscription plan you connected costs
+nothing extra, and a local model costs nothing at all, so the crew prefers those routes
+whenever one serves the model.
+
+The crew is three seats because those are the calls a task spends most of its money on.
+codeaf also makes smaller calls on your behalf — naming a session, the safety gate, memory
+— and those ride two rows of their own in `/settings` → Providers, **reflex** and
+**small work**, which ship pointed at near-free models and are not part of the crew.
+
+**`/model` is untouched.** It is the model you talk to, and nothing about the crew moves
+it.
+
+### The /crew panel
+
+Bare `/crew` opens the crew panel: a framed panel over the conversation, with six rows you
+can change and one line about the day.
+
+```
+╭─ crew ──────────────────────────────────────────────────────── esc ─╮
+│› worker    auto · usually glm-5.3-flash                             │
+│  planner   auto · usually glm-5.3-flash                             │
+│  checker   ⌖ kimi-k3                                                │
+│                                                                     │
+│  models    ‹ all › (96)                                             │
+│  providers ✓ openrouter  ✓ z-ai sub  ✓ ollama local  ○ my-vllm  +   │
+│  cap       per task $5 · daily none                                 │
+│                                                                     │
+│  today $1.84 · 14 tasks                                             │
+╰─ enter change · esc close · ? keys ─────────────────────────────────╯
+```
+
+- **the seats** — `auto · usually <model>` for a seat codeaf picks, naming the model the
+  recent tasks — the last eight — ran there most (`likely` before there is any history,
+  and whatever the router would pick now when the usual model is no longer reachable); or the pin mark `⌖` and the
+  model, with `@provider` when a route is pinned too. A pin nothing connected can run says
+  `unavailable`.
+- **models** — which models a seat may be picked from, walked with `←`/`→` in place:
+  `all`, `open`, `price`, `custom`, with the number of models each admits in brackets. The
+  number counts only models a provider that is on still serves.
+- **providers** — one chip per connected provider: `✓` on, `○` off and dim. An API key is
+  its plain name, a subscription says `sub`, a model on this machine says `local` when there
+  is room, and a custom endpoint is the name you gave it. The `+` at the end opens
+  `/connect`. On a narrow window the chips fold to `3 of 4 on`.
+- **cap** — `per task $5 · daily none`: the most one task may spend, and the most crews
+  may spend in a day, `none` for no daily cap.
+- **today** — what crews spent today and how many tasks ran. A day with nothing in it has
+  no line.
+
+**The allowed models are the models rule less every model no provider that is on serves.**
+Turning a provider off takes its routes away, never a model: a model another provider still
+serves stays allowed on that route, and the crew's routing and its route costs only ever
+use providers that are on. Which providers are off is saved beside the rule, not inside it,
+so walking the models row to a new answer never turns a provider back on. A provider you
+connect later is on the day you connect it. **At least one provider must stay on**: turning
+off the last one is refused under the rows with `at least one provider must stay on`, and
+turning off the last one that can route a seat — leaving on only a custom endpoint, which a
+pin reaches and the crew never picks — is refused with
+`at least one provider that can route a seat must stay on`, unless every seat is pinned to
+a provider still on. A
+pinned seat whose only provider is off says `provider off` on its row.
+
+With nothing connected the panel says `no providers connected — /connect adds one`; a pin
+whose provider is not connected says `unavailable`. A rule that leaves open-ended work
+without a strong checker says so under the rows:
+`no strong checker among the models you allow · open-ended work will be checked weakly`.
+**A pinned checker is the checker**, so the warning asks about the pin alone: a strong pin
+clears it whatever else is allowed, and a weak one names itself —
+`checker pinned to deepseek-v4-flash · open-ended work will be checked weakly` — even when a
+strong model is allowed beside it.
+
+Every change is saved the moment you make it, and the next task uses it with no relaunch.
+The changed row wears a tick `✓`, and for five seconds the bottom edge offers `z undo`,
+which puts things back exactly as they were.
+
+## Crew panel keys — how to pin, unpin, set the cap or the allowed models on /crew
+
+`enter` is the one verb:
+
+- **enter on a seat** opens that seat's list: `auto — codeaf picks per task` first, then
+  the router's suggestion marked with the star and `suggested`, then every model your
+  providers reach with its price in and out per million tokens and one provider. Type to
+  filter; `enter` pins. **Unpinning is choosing `auto`** — the list opens on it, so it is
+  `enter enter`. `→` on a model shows its routes (`any route · cheapest`, then each
+  provider); `enter` on one pins the model to that provider, `←` folds them.
+- **A model outside your allowed models** is on the list marked `not allowed`. `enter` on it
+  says `<model> is not in your allowed models (<rule>) — enter to allow it`; a second
+  `enter` adds the model to the rule and pins it.
+- **models row**: `←`/`→` step between `all`, `open`, `price` and `custom`, saving each;
+  `enter` steps forward too, the way `→` does, until `price` or `custom`, where it opens
+  what that answer holds.
+  On `price` the row becomes two boxes, `≤ $[ 1 ] in / $[ 5 ] out`; `enter` edits the
+  first, `enter` (or `tab`) moves to the second, `enter` saves. On `custom`, `enter` opens
+  a checklist of every model your providers reach — models only; providers are the
+  providers row's — ticked where the rule admits it: type to filter, `space` or `enter`
+  ticks and unticks, and each tick is saved as the shortest rule that says it
+  (`open -deepseek`, `all -moonshotai/kimi-k3`).
+- **providers row**: `←`/`→` walk the chips, `space` turns the one under the cursor off or
+  on (the bottom edge says `space toggle` only on this row), and `space` on `+` opens
+  `/connect` — `esc` there brings you back to this row. `enter` opens the providers list: one line per provider with how it bills
+  (`api key`, `subscription`, `local`, `custom endpoint`), how many models it serves, what it
+  carried today and `on` or `off`; `space` or `enter` toggles the line under the cursor, `z`
+  undoes, `esc` goes back to the row. On a narrow window the list drops what it carried
+  today first, then the model count, then how it bills; `on` or `off` always stays. The
+  list's last line is
+  `free routes  off · rate-limited, may log prompts`: turned on, the crew may also use a
+  model's free `:free` route, which is rate-limited and may log what it is sent. It is off
+  until you turn it on, and it is on the list only, never on the panel's rows.
+- **cap row**: type a figure (a digit starts it) and `enter`; empty it and `enter` for none.
+  A figure that is not dollars is refused under the rows.
+- `z` undoes the last change while the bottom edge offers it; `?` shows every key;
+  `esc` goes back exactly one level, and on the panel closes it.
+- **Mouse**: a click on a row is `enter`; a click on `‹` or `›` steps the models row; a
+  click on a provider chip toggles it; the wheel scrolls a list.
+- **Filtering a seat's list** finds a model from the front of its name: a prefix of the id
+  or the name comes first, then a word inside it (`flash`), then the letters anywhere inside
+  it. A row whose letters only match scattered — `kim` in `grok-imagine` — is shown only
+  when nothing matched better.
+
+Typical keystrokes: pin the checker is `/crew ↓ ↓ enter kim enter`; allow open-weight
+models only is `/crew ↓ ↓ ↓ →`; a $5 cap is `/crew`, down to `cap`, `5`, `enter`.
+
+The shortcuts do the same writes from the box and then open the panel with the tick on the
+row they changed:
+
+```
+/crew · /crew pin <worker|planner|checker> <model[@provider]> · /crew unpin <seat|all> · /crew models <all|open|≤in/out|ids…|+id|-id> · /crew cap <dollars|off> · /crew cap task <dollars>
+```
+
+### Pinning a seat
+
+`/crew pin checker moonshotai/kimi-k3` pins the checker, and every task from then on runs
+its checker on that model until `/crew unpin checker` puts the seat back on auto.
+`/crew unpin all` puts all three back.
+
+**A pin may name the provider too**: `/crew pin worker z-ai/glm-5.3-flash@openrouter` sends
+that seat through OpenRouter even when a direct connection also serves the model. Without
+`@provider` the crew picks the cheapest route that reaches the pinned model.
+
+**A pin outside the allowed models is refused**, in words, and nothing is written — a pin
+the rule would have to break is not a pin. And a pinned model none of your connections can
+reach is not quietly swapped: the task does not start, and says why.
+
+In `/settings` → Providers the three seats are one row, **seats**, which says how many are
+pinned, the allowed rule, how many providers are on, the per-task limit and the daily cap; `enter` on it opens the crew panel, and `esc` there
+brings you back to the row.
+
+### Which models are allowed
+
+`/crew models` says which models a seat nobody pinned may be picked from. An unwritten rule is `all`.
+
+- **`all`** — every model a connected provider can reach.
+- **`open`** — open-weight models only, so no seat is a bet on one vendor's pricing.
+- **`≤1/5`** (or `<=1/5`) — at most $1 per million tokens in and $5 out.
+- **a list** — `glm-5.3-flash, kimi-k3`: exactly these. A word may be a full id, the name
+  after the vendor, or a vendor or provider name.
+
+Any rule can be followed by `+x` and `-x`, read left to right: `open -deepseek` is every
+open model but DeepSeek's, and `≤1/5 +moonshotai/kimi-k3` is the price rule with one
+exception let in. `/crew models +kimi-k3` or `/crew models -deepseek` changes the rule in
+force by one word. A `-x` naming a **provider** — `-openrouter` — takes that provider's
+routes away rather than any model; to switch a provider off for the crew, use the panel's
+**providers** row, which keeps the choice when the rule changes.
+
+A rule that would leave a pinned seat outside it is refused until you unpin the seat, and
+a rule that does not parse is refused with the reason — a typo that silently allowed
+everything would be a setting somebody thinks is protecting them. When the allowed models
+leave a kind of work without a strong enough checker, the panel says so on a `gap` line.
+
+### The daily cap
+
+`/crew cap 5` caps what crews may spend in a day at $5; `/crew cap off` takes the cap
+away. The crew **paces toward it**: once half the day's cap is spent, a dearer crew costs
+more of the day's quality to justify, so the picks lean cheaper as the cap gets close.
+
+**At the cap a task does not start.** In a conversation the task is refused with the cap,
+what was spent, and the two ways on — raise it with `/crew cap`, or ask for that task with
+`--cheap`. `codeaf do` refuses the same way unless you pass `-yes-spend`; `codeaf exec`,
+`codeaf run` and `codeaf plan` say one line about it and go ahead.
+
+**Nor does a call that would cross it.** Every call a task makes — its seats', and the
+helpers around them, such as the run's closing summary — is priced before it is made:
+what the day has spent, plus every call still on its way, plus what this call is expected
+to cost, which is never less than what the same model charged for its last call today.
+A call that would pass the cap is not made: the task stops on `today's crew spend has reached the daily cap
+of $5.00 · raise it with /crew cap`, with what it had done so far. A checker cut off this
+way ends on the same sentence.
+
+**A checker has a ceiling of its own on each task**: three times its estimate, and never
+less than $0.05. A check that reaches it stops there, on `the check stopped at its spend
+ceiling of $0.26, three times its estimate, before it finished`, and the task ends
+unchecked rather than on a bill ten times its estimate.
+
+This cap is the crew's own. The day's limit under `/settings` → Spending counts everything
+codeaf spends, and still applies.
+
+### The per-task limit
+
+No task may cost more than its limit: **$5** unless you set another. `/crew cap task 10`
+sets it to $10; on the panel it is the first figure on the **cap** row
+(`per task $5 · daily none`) — `enter` on the row, `tab` to the per-task box, type, `enter`.
+A task always has a limit: `none` and `0` are refused, and an emptied box is $5 again.
+
+Every priced call of one task — each seat's, on every model, and the helpers made for it —
+counts against one figure: what the task has spent, plus every call of it still on its
+way, plus what this call is expected to cost. A call that would pass the limit is not made,
+and the task stops on `this task reached its $5 limit · raise it in /crew`, with what it had
+done so far. The checker's own ceiling still applies inside it.
+
+`-yes-spend` does not lift it. `codeaf do` holds every run to the same limit, with or
+without a routed crew; the flag answers the day's questions and the plan-price question,
+not this one.
+
+### How hard to try one task — --best and --cheap
+
+The panel says what persists. **How hard to try one task is said in the ask, and sticks to
+nothing**:
+
+- `/task --best <brief>` puts the strongest crew the allowed models make on that task.
+- `/task --cheap <brief>` puts the cheapest crew that still does the work on it.
+- In a conversation, just say so — "do this properly", "cheapest is fine" — and the task
+  codeaf hands off carries the word as its `effort` (`best` or `cheap`).
+- From a terminal, `codeaf do --best` and `codeaf do --cheap` do the same (see *Running
+  from the terminal*).
+
+The next task is back on the ordinary pick.
+
+### What a task says about its crew
+
+A routed task says its crew in ONE line, under the line that says it started, and the line
+is rewritten in place as the task goes. When it starts:
+
+```
+task 12 crew · open-ended · worker glm-5.3-flash (openrouter) · planner kimi-k3 · checker ⌖ kimi-k3 · est $0.121
+```
+
+and when it lands, the same line with what it actually cost beside the estimate:
+
+```
+task 12 crew · open-ended · worker glm-5.3-flash (openrouter) · planner kimi-k3 · checker ⌖ kimi-k3 · $0.108 (est $0.121) · not right? /redo stronger
+```
+
+The estimate is what crews like this one cost: each seat's token profile for that kind of
+work at the model's catalog prices, then moved by what this install's own paid tasks of the
+kind cost against their estimates. A seat on a plan, a local model or a free pool adds
+nothing to it. No crew estimated over the per-task limit is picked, `--best` included: the
+pick is the best crew under it, and the line says `held under the $5.00 task limit` when that
+changed it.
+
+A pin sends exactly the id you wrote when the catalog lists it. An id the catalog lists
+only as a variant — a dated snapshot — is sent as that variant, and the line says which:
+`checker ⌖ deepseek-v4-flash → -0731`.
+
+The first word is the kind of work the task was read as. The worker's provider is named
+because it is where the money goes; the planner is named when it is another model than the
+worker; a seat you pinned wears the pin mark `⌖`. A task that failed leads its line with
+`failed — /redo stronger runs it again on a stronger crew`, and one that spent nothing
+names no money. `/task --best` that changes
+nothing says `best · already the strongest crew allowed`, and one that does names the rung
+(`worker glm-5.3-flash → kimi-k3`).
+
+**A seat whose model cannot start moves, inside the task.** When a seat's first call is
+refused, the seat goes down its ladder: the same model on its next route, then the next
+model for the seat at a similar cost, then the model the last good crew here used, then the
+model you are talking to — never a rung on an account that has just said it is out of
+credit or refused its key. The line says so first — `running on fallback crew · worker
+glm-5.3-flash → deepseek-v4-flash (credit unavailable on openrouter)` — and with nothing left
+the task stops on the one thing to do, which leads its line in place of `/redo stronger`
+(a stronger crew would meet the same wall): `failed — add credit on openrouter to
+continue`, `reconnect openrouter with /connect`, or when the limit resets. What each route did is kept: a route
+that refused a model is left out for a week, one at its limit rests until its reset, an
+account out of credit is skipped until a paid call on it answers again. Free routes are
+off unless you turn them on; when every paid route is out of reach they are used anyway,
+and the line says `free routes in use (may log prompts)`. A rescue never takes a model
+whose name says it was tuned for one domain (finance, medicine, law) or is too small for
+a seat's work, and a seat tries at most three free pools in a task; a pool at its limit
+is not waited on — the seat moves on at once, and with nothing left the task stops on
+its action within seconds. A pool that answered at its limit is not asked again in that
+task by any seat, and no helper call reaches a route that refused — it is refused before
+it is sent. A model the catalog lists at no price that is not a free pool (a stealth or
+preview model) is never picked unless you pin it, and neither is a model whose catalog row
+carries too little to score it: with no index, rating, release date or lineage to read there
+is nothing to rank it on but its price. The line says each seat's net move and
+its first cause — `worker glm-5.3-flash → gemma-4-31b-it (credit unavailable on
+openrouter; +3 tried)` — and the router's log keeps every rung. A seat that cannot start moves to a model at a similar cost before a
+dearer one. A task that ran on an account out of credit and failed ends on the credit action,
+not on `/redo stronger`. A free pool can be pinned by name —
+`/crew pin worker vendor/model:free` — and picking a model's `free` route in a seat's
+list pins that pool, not the paid route beside it.
+
+### Route health
+
+**What each route did is kept, and the next pick reads it.** Every seat's first call is
+logged with how it ended, and routes are weighed by it:
+
+- a route that **refused a model** outright — no such model, not allowed on this key — is
+  left out for a week;
+- a route **at its rate limit** rests until the reset it gave;
+- a route that **fails often** is weighed at what those failures cost, so a cheaper route
+  that rarely answers can lose to a dearer one that does;
+- an **account out of credit** or a **key refused** is skipped by helpers, and the next
+  task's first seat call asks it again, once: an answer puts it back at once;
+- an **OpenRouter balance read as low** (*OpenRouter credits and free models*) counts as out
+  of credit before any call is made and is not asked again by a task: with no other paid
+  provider connected, the crew goes to free routes and the line says
+  `free routes in use (may log prompts) · credit unavailable on openrouter`. The balance is
+  read again at every launch while it is low, so a top-up puts routing back to ordinary.
+
+Helper calls — summaries, briefs, a landing's answer — never go to a route health says will
+not answer: they are handed the router's own pick for the seat, or its rescue, instead.
+
+### Redo stronger
+
+`/redo stronger` runs the last task again ONE RUNG stronger: every seat keeps what it ran,
+and the one seat whose next model up buys the most moves to that next model — never to the
+top of the catalog in one step. The line says the rung it took (`checker glm-5.3-flash →
+deepseek-v4-flash`); a second redo takes the next rung. It is one task's ask — your pins and
+your allowed rule are untouched — and a crew already at the strongest the allowed models
+make says so and starts nothing. A task still running cannot be redone; stop it first.
+
+**A task that never started is asked again, not escalated.** When no seat answered a single
+call — the route refused it, the account was out of credit — nothing ran to be too weak, so
+the redo takes the next-best models at the same cost.
+
+**It also teaches the crew.** A redo says the crew under-served that kind of work in that
+repository, so the next task of the same kind there starts a rung higher — at most three
+steps — and a step comes off after one accepted task of that kind, so work that was
+under-served once is not overpaid for ever. A task counts as accepted when it finished and
+its result was not refused: merged, kept on its branch, or an answer with nothing to land.
+
+Every decision and how it ended — accepted, redone stronger, or not kept — is written to
+the router's log beside your settings, `router-events.jsonl`, which is what the panel's
+recent tasks and today's spend are read from.
+
+### A profile from before the crew was picked per task
+
+Earlier builds set the crew with a preset word, a model family and a pick word. A profile
+that still carries them is migrated once, on the first launch of this build, and told in
+one line:
+
+```
+your crew is auto now · codeaf picks the worker, planner and checker for each task · /crew to see it
+```
+
+The preset and pick words, and a seat row that said `auto`, become auto. A seat holding
+any model id stays pinned — even an id an old preset shipped, since nothing on the row
+says which hand wrote it — and a profile with pins is told so instead
+(`kept your pins: worker …, planner …, checker …`). A profile with nothing retired on it
+is not touched. A family of
+`open` becomes the allowed rule `open`; the default family needs no rule.
+
+### The roles under each row
+
+Directly under the **pinned roles** row, `/settings` → Providers lists **every registered
+role**, grouped under the row answering it, saying which model comes out:
+
+| role | row | what it is |
 | --- | --- | --- |
 | `reflex` | reflex | reads every turn for memory — routing and keeping |
 | `title` | small work | the name a session gives itself |
@@ -672,31 +864,31 @@ under the class answering it, saying which model comes out. As shipped:
 | `router` | small work | whether a turn should have been work |
 | `consolidate` | small work | tidies what is remembered while nobody is here |
 | `taskname` | small work | the two or three words a task is called |
-| `auditor` | careful work | whether finished-looking work is actually finished |
-| `vision` | careful work | reads images for a model that cannot see them |
-| `shaper` | careful work | the brief a task you started yourself is given |
-| `careful` | careful work | a part of a task that needs judgement |
-| `repair` | careful work | the second go at work a check found gaps in |
-| `planner` | mastermind | the plan that steers an adaptive run |
-| `designer` | mastermind | writes and reviews a harness page |
-| `routerconfirm` | mastermind | a second look before work starts itself |
-| `markreader` | mastermind | what is left of an answer that is being taken out of your hands, drawn as parts |
-| `handoff` | mastermind | the instruction a handed-over turn gives whoever finishes it |
-| `division` | mastermind | the parts a worker hands its own work out in |
+| `auditor` | checker | whether finished-looking work is actually finished |
+| `vision` | checker | reads images for a model that cannot see them |
+| `shaper` | checker | the brief a task you started yourself is given |
+| `careful` | checker | a part of a task that needs judgement |
+| `repair` | checker | the second go at work a check found gaps in |
+| `planner` | planner | the plan that steers an adaptive run |
+| `designer` | planner | writes and reviews a harness page |
+| `routerconfirm` | planner | a second look before work starts itself |
+| `markreader` | planner | what is left of an answer that is being taken out of your hands, drawn as parts |
+| `handoff` | planner | the instruction a handed-over turn gives whoever finishes it |
+| `division` | planner | the parts a worker hands its own work out in |
 
 The list is built from what is registered in the running binary, so it is the truth about
 this build rather than a table someone kept up to date. Stop on a row and the line under the
-list is that role's own description followed by which class it follows.
-
-**What the mastermind's roles have in common is that one answer decides what all the other
-calls do.** `planner` and `designer` used to sit on careful work beside the check on
-finished work, which made one model id answer two unrelated bills: the careful calls are
-many and short, and these are few. A planner that cuts badly spends a whole run on work nobody wanted;
-a designer that writes badly puts a wrong answer on the menu with a name on it;
-`routerconfirm` stands between a cheap model's "that should have been work" and a task
-starting itself, and it is asked on nothing else, so it costs a call only where something was
-about to be spent; `division` reads a task's parts before any of them exists, and every turn
-every part ever takes runs on the brief it leaves behind.
+list is that role's own description followed by which row it follows. A role on a crew seat
+that has no task in front of it — a title, a check outside any task — is answered by the
+seat's pin, or by the model the crew would pick for work of no particular kind.
+
+**What the planner's roles have in common is that one answer decides what all the other
+calls do.** A planner that cuts badly spends a whole run on work nobody wanted; a designer
+that writes badly puts a wrong answer on the menu with a name on it; `routerconfirm` stands
+between a cheap model's "that should have been work" and a task starting itself, and it is
+asked on nothing else, so it costs a call only where something was about to be spent;
+`division` reads a task's parts before any of them exists, and every turn every part ever
+takes runs on the brief it leaves behind.
 
 `markreader` and `handoff` are the two calls a long answer makes (*Tasks*). `markreader` is
 asked **at most once during an answer** — only when that answer can no longer work where it
@@ -705,258 +897,92 @@ of any answer that touched a tool at all. It reads the account of the work and s
 left of your question. **It runs beside the work rather than stopping it**: the next step of
 the answer goes out immediately and the reading happens alongside it. What it draws is the
 list the work carries on with; the step it lands beside is stopped either way, because the
-decision to stop was taken before it was asked. It used to be awaited, and a measured one held
-the work for 8.1 seconds to decide nothing. **A long answer no longer buys one of these
+decision to stop was taken before it was asked. **A long answer no longer buys one of these
 every ten rounds**: the two earlier moments cost no call at all now — codeaf tells the model
 what its answer has run up and the model decides for itself (*Tasks*, under *An answer that
 runs long is told*). `handoff` writes the instruction the task
-opens on when an answer is handed over. Both sit on mastermind for the same measured reason:
+opens on when an answer is handed over. Both sit on the planner for the same measured reason:
 a cheap model asked "is this finished" answered `(done)` about half-finished work 15 times out
 of 18, and that is the one answer that quietly drops a handover you were owed. There is no
 cheaper reading of that question — there is only a wrong one.
 
 **`careful` is not a call at all** — it is the model a *part* of a divided task runs on when
-the worker graded that part careful (*Tasks*). It sits on careful work beside the audit for
+the worker graded that part careful (*Tasks*). It sits on the checker beside the audit for
 the same reason: the failure it guards against is work that looks finished and is quietly
 wrong.
 
-## I changed the crew but the model at the bottom did not change — why did my model not change
-
-That is right, and nothing is broken. **`/crew` does not change the model you are talking
-to**, and the readout at the bottom of the frame is that model — the conversation's. The
-only thing that moves it is `/model`, the model row in `/settings`, or naming one with
-`/model <name>`. The confirmation says so by name: `/crew max` ends
-`· you are still talking to deepseek-v4-flash — /model changes that`, and `/status` prints
-`model` and `crew` on neighbouring lines so the two dials read as two.
-
-The crew is a different dial: the five **classes** codeaf makes its own calls on — reflex,
-small work, worker, careful work, mastermind — used for titles, memory, the safety gate,
-the work inside every task, checks on finished work, the brief a task is shaped into, adaptive-run
-planners and their nodes, harness pages, and looking at an image. Setting it writes all
-five class rows in one write, and **it is live from that moment**: the next call codeaf
-makes on its own uses the new crew, with no relaunch and no new session. A task already
-running keeps the model it was admitted on.
-
-**Where to read the crew back:**
-
-- `/status` prints a `crew` line directly under `model`:
-  `crew     max · brain claude-opus-5 · hands glm-5.3 · checks claude-fable-5.1`. The word is
-  the preset, or `custom` when the five classes are your own arrangement. **brain** is the
-  mastermind, **hands** is the worker, **checks** is the careful class.
-- `/settings` → Providers has the **crew** row above the five class rows.
-- Bare `/crew` opens the three presets with yours marked, under a `you talk to · <model>`
-  line naming the seat they do not touch.
-- `/status` and the phone status sheet say `crew max` on their own line — the status row
-  itself stopped carrying the crew word on 2026-09-09; it is a setting, not a measurement.
-- The hint line under the model picker says `crew max` beside its keys, so the picker you
-  opened looking for the change tells you the crew is a separate thing.
-
-**Tasks DO follow the crew, through its worker seat.** A plain task runs on the
-`task.model` row if you set one, otherwise on the crew's **worker** class, and only when
-that row is blank on the conversation's model. An **adaptive run** uses the classes the
-same way: its planner takes the **mastermind** class and every node under it takes the
-**worker** class. Those ids are settled once, when the task or run is admitted, so changing
-the crew — or `/model` — half way through does not move work already going.
+## I changed the crew but the model at the bottom did not change — does /crew change my chat model
+
+No, and nothing is broken. **`/crew` does not change the model you are talking to**, and
+the readout at the bottom of the frame is that model — the conversation's. The only things
+that move it are `/model`, the model row in `/settings`, or naming one with
+`/model <name>`. A pin confirms by naming the model you are still on:
+`checker ⌖ moonshotai/kimi-k3 · every task until you unpin it · you are still talking to
+deepseek-v4-flash — /model changes that`.
+
+`/status` prints `model` and `crew` on neighbouring lines so the two dials read as two:
+`crew  auto · codeaf picks the worker, planner and checker for each task`, or
+`auto · pinned checker moonshotai/kimi-k3` when you pinned a seat. The phone status sheet
+says the same, and the hint line under the model picker says `crew auto` beside its keys,
+so the picker you opened looking for the change tells you the crew is a separate thing.
+The one session with no `crew` line at all is a **remote** one opened with `--host`: that
+crew lives on the other machine.
 
 ## Which model does a task run on — why did my task run on glm-5.3-flash and not my chat model
 
-**The crew's worker seat**, unless you said otherwise. The ladder, first answer wins:
+**The crew's worker**, unless you said otherwise. The ladder, first answer wins:
 
 1. a model named in the ask — "do this on deepseek" — or picked on the proposal's chips;
 2. the `task model` row under `/settings` → Tasks, when you have set one;
-3. the crew's **worker** class — `hands` in the `/crew` confirmation and the `/status`
-   crew line;
-4. the model you are talking to, only when the worker row is blank.
-
-So on the shipped `balanced` crew a task runs on `z-ai/glm-5.3-flash` whatever you are
-chatting on, and `/crew max` moves the next task onto `z-ai/glm-5.3`. While a known
-OpenRouter balance is low, an unwritten worker row uses the free worker model
-instead; a crew or worker row you chose keeps its model. The task's row on the
-roster, its room's status line and its finished card all name the model it actually ran
-on. The worker of an adaptive run's nodes is the same seat, and so is the work model of
-`codeaf do` — one row, every door.
-
-This is new: until the worker seat existed a task rode the model you were talking to, and
-the crew moved everything about a task except its cost.
-
-## Does my crew reach codeaf do, or only this conversation — what models a headless run uses
-
-**It reaches both.** A crew you set here is the crew a run started from a script or a
-terminal uses — `codeaf do`, `codeaf exec`, `codeaf run`, `codeaf plan new`,
-`codeaf plan revise` and `codeaf plan run`. Set it once with `/crew frugal` and the same policy holds
-whether the work is asked for here or run with nobody watching.
-
-Those runs seat two models, and each one is resolved the same way. The first of these that
-answers wins:
-
-1. a model named on the command line: `--model` for the work, `--plan-model` for the
-   planning, and `--check-model` for the checks;
-2. `CODEAF_MODEL`, `CODEAF_PLAN_MODEL`, or `CODEAF_CHECK_MODEL` in the environment.
-   Without its own pin, a check rides a plan seat pinned by flag or environment,
-   so a third model never arrives from the profile;
-3. **your crew** — the planning seat takes the **mastermind** class, the work seat takes
-   the **worker** class, the same row a task handed off in conversation rides;
-4. **your crew again, through an older class**, when your profile was set before a class
-   existed — the worker class inherits the small-work class it was split out of, and the
-   run says it did;
-5. what the build ships with.
-
-So `--model` is one voice of four rather than the only one. This was not always true: until
-recently a run outside the chat read only the flag and the environment, and a crew set here
-was silently lost the moment the same brain ran from a script.
-
-Each of those runs opens by saying which voice answered, so nothing has to be guessed at:
-
-```
-models: work z-ai/glm-5.3-flash (crew frugal) · plan z-ai/glm-5.3-flash (crew frugal)
-```
-
-Two details worth knowing. A crew answers only once you have actually set one — a profile
-nobody has touched takes the build's default rather than reading its own shipped values back
-as a crew. And a class carrying a thinking level, like `kimi-k3:low`, carries it there too:
-the run plans on that model at that level, the same as it does here.
-
-## Why does my run say inherited — my crew is older than the worker class
-
-The worker class arrived after the other four. A crew set before it exists on disk as four
-classes with no worker among them, so a run has no worker row of its own to read. It does
-**not** fall back to the shipped default: it takes the class the worker was split out of —
-**small work**, the row that used to do this job — and it tells you, in one line under the
-models line:
-
-```
-models: work deepseek/deepseek-v4-flash (crew custom, inherited) · plan deepseek/deepseek-v4-flash (crew custom)
-your crew was set before the work seat existed · it is running on your small work seat's model until you pick a crew with /crew in the conversation
-```
-
-`inherited` beside the class means exactly that: **the model came from your crew, but from a
-row you did not write.** The line is said once, when the run opens, and never again — not on
-every call.
-
-The same thing happens in the conversation, where there is no models line to carry the word —
-see "Why is my task running on a model I did not pick".
-
-To end it, set the crew again with `/crew frugal`, `/crew balanced` or `/crew max`, which
-writes all five classes including the worker, or pin the worker row alone in `/settings` →
-Providers. Either one, and the next run reads `crew frugal` with no second line.
+3. the crew's **worker** — your pin, or the model the crew picked for this task;
+4. the model you are talking to, only when nothing above answers.
 
-A crew set with this build already pins every class, so this only ever appears on a profile
-older than the class. And it is only for a row you never wrote: a row you **emptied on
-purpose** means "follow the conversation", which a run outside the chat has no conversation
-for, so that falls to the build's default the way it always has.
+The task's crew line, its row on the roster, its room's status line and its finished card
+all name the model it actually ran on. The seats are settled when the task starts, so
+changing the crew — or `/model` — half way through does not move work already going. A
+second task handed off while one is still running joins it and rides its crew.
 
-## Why is my task running on a model I did not pick — inherited work seat in the conversation
-
-Tasks you hand off in a conversation run on the **worker** class, not on the model you are
-talking to. If your crew was set before that class existed, you have no worker row — so the
-work takes the class the worker was split out of, **small work**, and the thread tells you
-once, the first time a task starts:
-
-```
-your crew was set before the work seat existed · it is running on your small work seat's model until you pick a crew with /crew in the conversation
-```
-
-**It is said once per session**, when work actually starts, and never per task or per part.
-Twenty tasks in one sitting is one line. Start codeaf again tomorrow with the same profile and
-you get it again — it is true until you answer it.
-
-`/crew` shows the same fact about the row itself, under the three presets:
-
-```
-your work seat is inherited from small work — picking one writes it
-```
-
-**To end it, pick any crew** — `/crew frugal`, `/crew balanced`, `/crew max`, or the chooser
-that bare `/crew` opens. Every preset writes all five classes including the worker, so the
-line stops on both surfaces at once. You can also pin the worker row on its own in
-`/settings` → Providers.
-
-Three things this is **not**:
-
-- It is not the model you talk to. That one is on the status line and only `/model` moves it.
-- It is not a row you emptied. A worker row you cleared on purpose means "follow the
-  conversation", and a task then rides the model you are talking to — that is an answer, and
-  nothing is said about it.
-- It is not a fresh install. A profile that has never named any model runs this build's own
-  choice for each class, silently, the way it always has.
-
-The word `inherited` is the same word `codeaf do` prints beside the model on its `models:`
-line, so the two surfaces are telling you about one thing.
-
-## What are the six models — the one you talk to and the five crew seats
-
-codeaf runs **six model seats**. **Seat one is the model you talk to**: it answers every
-message you type, it is the id written above the message box, and `/model` is the only thing
-that moves it. The other five are the **crew** — the models codeaf uses on its own behalf,
-for calls you did not type:
-
-| seat | word | what it answers |
-| --- | --- | --- |
-| 1 | you talk to | your messages — set with `/model` |
-| 2 | reflex | memory, titles, the safety gate — near-free, reads every turn |
-| 3 | small work | digests, task names, the safety gate's yes-or-no — cheap |
-| 4 | worker | every task you hand off, its parts, every run node — most of the bill |
-| 5 | careful work | checks on finished work, the brief a task is shaped into, vision |
-| 6 | mastermind | plans adaptive runs and designs harnesses — thinks |
-
-`/crew` shows all six and sets seats two to six in one word — `frugal`, `balanced` or
-`max` — and never seat one. Bare `/crew` opens with `you talk to · <model>` above the three
-presets, so the seat the presets do not touch is on the same page as the ones they do.
-`/settings` → Providers pins any one of the five on its own, which turns the crew word to
-`custom`. Seat one is the model named above the message box; the other five are the
-`crew` line of `/status`.
-
-## Does /crew change my chat model — no, and what crew max on the status line means
-
-No. `/crew max` moves the five crew seats and leaves the model you talk to exactly where it
-was. The confirmation names it:
-
-```
-crew → max · brain claude-opus-5 · hands glm-5.3 · checks claude-fable-5.1 · you are still talking to deepseek-v4-flash — /model changes that
-```
+## Does my crew reach a run from the shell, or only this conversation — what models a headless run uses
 
-`/model`, `/model <name>` or the model row in `/settings` are the only ways to change the
-chat model, and `/crew` never offers to. The two dials also stay separate on the frame: the
-chat model is written above the message box, and `crew max` — or `crew balanced`,
-`crew frugal`, `crew custom` when you pinned a seat yourself — is a line of `/status` and of
-the phone status sheet. It is not on the status row: a setting is not a measurement, and
-the row is for numbers now. `/status` prints `model` and `crew` on neighbouring lines at any
-width. The one session with no `crew` line at all is a **remote** one opened with
-`--host`: that crew lives on the other machine.
+**It reaches both.** The pins, the allowed rule and the cap you set here are the ones
+`codeaf do`, `codeaf exec`, `codeaf run`, `codeaf plan new`, `codeaf plan revise` and
+`codeaf plan run` use, and each of those runs is routed for its own task the same way.
+*Running from the terminal* has the flags and the models line a run opens with.
 
-## Asking a class to think harder — a level on a class value
+## Asking a seat to think harder — a level on a pin
 
-A class value may carry a thinking level as well as a model:
+A pin, or any model row, may carry a thinking level as well as a model:
 
 ```
 moonshotai/kimi-k3:high
 ```
 
-`:low`, `:medium` and `:high` are the three. No shipped crew preset adds one; a level travels only when you add it.
+`:low`, `:medium` and `:high` are the three. Nothing codeaf picks adds one; a level travels only when you add it.
 The level is not part of the model id. It travels as its own request option, exactly as
 the picker's **ctrl+t** effort does, so the example sends model `moonshotai/kimi-k3` and
 asks for high thinking separately.
 
-- **Any of the five class rows takes one**, though the mastermind is the one it is for. On
-  the worker row in a conversation it reaches the one-shot role calls only, never the work
-  inside a task. At a headless door — `codeaf do`, `exec`, `plan` or `run` — that row fills
-  a seat instead, and every request the seat sends carries its level.
+- **Any pin and any model row takes one**, though the planner is the seat it is for:
+  `/crew pin planner moonshotai/kimi-k3:high`. On the worker in a conversation it reaches
+  the one-shot role calls only, never the work inside a task. At a headless door —
+  `codeaf do`, `exec`, `plan` or `run` — the pin fills a seat instead, and every request
+  the seat sends carries its level.
 - **Any other suffix is refused**, in words: *"off" is not a thinking level. Add `low`, `medium`,
   `high` to a model id, or leave the level off*. It is a different request shape — it asks the
   provider to suppress thinking outright — and some endpoints refuse it. `:max`, `:none`,
   `:xhigh` and the other near-misses are refused the same way. That refusal is about this
   notation alone — the effort ladder has rungs called `xhigh` and `max`, and they are a
-  separate thing from a suffix on a class value (see *Making the model think harder, deeper,
+  separate thing from a suffix on a pin (see *Making the model think harder, deeper,
   or less*).
 - Where a level is set, the role rows print it after the id, `kimi-k3:low`, which is the
   same notation the model picker and `/status` use.
 
-The **mastermind** row is a text box because a picker hands back a bare id, while this row may
-hold an id with a thinking instruction on it.
+The **planner** row in `/settings` → Providers is a text box because a picker hands back a
+bare id, while this row may hold an id with a thinking instruction on it.
 
 ## Why is my crew thinking at low — the pin is being ignored, effort=low in the log
 
-A level written onto a class value is a pin, and it reaches the wire on **every** request the
+A level written onto a pin is a pin too, and it reaches the wire on **every** request the
 seat that holds it sends — the conversation's one-shot role calls, and every call of a
 `codeaf do`, `exec`, `plan` or `run`. It is not a preference something further in gets to
 reconsider.
@@ -1009,8 +1035,8 @@ next to the money it is spending:
 
 `planner: <model>` is the model amending the plan after every node — resolved once when the
 run started, from the model whatever started the run named, then the `planner` role's pin,
-then the **mastermind** class, then the model you are talking to. Since the mastermind ships
-with a model in it, this is usually *not* the model in the rest of this conversation, which
+then the crew's **planner** — its pin, or the model the crew would pick — then the model you
+are talking to. That is usually *not* the model in the rest of this conversation, which
 is why the run's own page says it rather than leaving you to work it out. You cannot name it
 yourself from a conversation, because a conversation cannot start a run at all — see
 *adaptive runs*.
@@ -1021,7 +1047,7 @@ On a narrow screen (**under 60 columns**) the segment comes off that line and is
 on the first row of the page instead, above the chips. It is moved, not dropped — what the
 header sheds first is the goal, which you can still read in the conversation.
 
-The nodes under the planner run on the `worker` role, which sits on the **worker** class —
+The nodes under the planner run on the `worker` role, which sits on the crew's **worker** —
 a different model, and not on this line. `/settings` → Providers lists both.
 
 ## Pinning one role to its own model, and unpinning it
@@ -1030,7 +1056,7 @@ In `/settings` → Providers, move onto any row of the roles list and press **en
 opens the model picker — the same one `/model` opens, same filter box, same ranking — and
 what you choose is **pinned** to that role alone. The row then reads
 `<model>  pinned`, and the legend at the foot offers **del unpin**. Press
-**del** on a pinned row to clear it; the role goes back to following its class.
+**del** on a pinned row to clear it; the role goes back to following its row.
 
 The picker a role opens asks that role's own question. `vision` offers only models that
 can see; every other role offers the models you can hold a conversation with.
@@ -1042,13 +1068,12 @@ and pinning from the list rewrites the row without disturbing the other pins in
 
 **A third door: just ask.** "Use `deepseek/deepseek-v4-pro` for planning and for designing
 harnesses" is a sentence codeaf acts on — it looks the row up with `settings` and writes it
-with `change_setting`, into the same `models.roles` row, after asking you. The five class
-rows (`models.tiers.reflex`, `models.tiers.low`, `models.tiers.worker`, `models.tiers.high`,
-`models.tiers.mastermind`), the crew word (`models.crew`) and the pins are all writable that
-way; only the role **slots** further down the Providers tab are not, because those are
-bindings the running session holds rather than values in your profile.
+with `change_setting`, into the same `models.roles` row, after asking you. The model rows
+of the Providers tab — reflex, small work, and the crew's worker, checker and planner pins —
+are writable that way too; only the role **slots** further down the Providers tab are not,
+because those are bindings the running session holds rather than values in your profile.
 
-So the ladder for any role, most specific first: **its pin**, then **its class's model**,
+So the ladder for any role, most specific first: **its pin**, then **its row's model**,
 then **the model you are talking to**.
 
 Two things worth knowing:
@@ -1082,11 +1107,11 @@ Until something has settled at all it says
 `nothing measured yet. Ratings appear once calls have been graded.`
 
 **What codeaf does with it** is one thing only: when a task splits itself, a part the
-worker called ordinary work is minted on your **careful work** model instead if work
+worker called ordinary work is minted on your **checker**'s model instead if work
 named like it has been turned down twice or more on the model the task is on. That is the
-whole of it — no model is ever swapped out from under you, your chat model is untouched,
-and an install with no crew classes set never lifts anything, because there is nowhere
-dearer to lift it to. *Tasks*, under *When a task turns out to be too wide for one
+whole of it — no model is ever swapped out from under you, and your chat model is
+untouched. The crew learns from the same record in one more way, which you ask for:
+`/redo stronger` (see *The crew*). *Tasks*, under *When a task turns out to be too wide for one
 worker*, has the rest.
 
 The record lives with your settings, in `router-ledger.json` and `router-events.jsonl`.
@@ -1101,7 +1126,7 @@ small model that was down cost you the name and said nothing, while the model yo
 talking to sat there able to do it.
 
 Now the call **falls through one rung of the same ladder** and asks again: pin, then the
-class's model, then the model you are talking to. That last rung is the floor, and it is a
+row's model, then the model you are talking to. That last rung is the floor, and it is a
 model that demonstrably works — it is the one answering your own turns. The cost lands
 against the model that actually answered, not the one that refused, so `/cost` and the
 usage rows reconcile.
@@ -1111,9 +1136,9 @@ would turn one bad minute at a provider into three charges and three waits for a
 nobody asked for. Nothing is said on screen either way — these are errands you did not ask
 for, and there is no state for "a small thing did not work".
 
-**Each of these calls also has its own patience**, taken from its class rather than from a
-per-call setting: a reflex call has **45s**, a cheap-class call **2m**, a capable-class one
-**5m**, and a mastermind call **10m**. Some calls set something tighter still and keep it —
+**Each of these calls also has its own patience**, taken from its row rather than from a
+per-call setting: a reflex call has **45s**, a small-work call **2m**, a checker call
+**5m**, and a planner call **10m**. Some calls set something tighter still and keep it —
 the guardian answers in ten seconds or not at all, the memory lookup moves to another machine
 after **two seconds** and stops after **eighteen**, and the two readers at the end of an
 answer get **20s** and **30s**. What this replaced was the ordinary
@@ -1132,7 +1157,7 @@ correct behaviour and a surprise to anyone reading a bill, so this is the flag f
 where **one model has to answer for the whole run** — comparing two models against each
 other, timing a benchmark cell, or attributing a cost.
 
-It settles four things on your model: the five crew classes, any role you pinned, the model
+It settles four things on your model: the crew's three seats and the two small rows, any role you pinned, the model
 that work leaving the conversation runs on, and the fallback chain codeaf would otherwise
 move to when a model cannot answer. Under this flag **nothing hops** — not on a refusal,
 not on a reply that keeps stalling, not on rate limiting that will not clear — because a
@@ -1142,12 +1167,12 @@ ordinary run falls back to the nearest same-class model, and this flag withholds
 
 **The two calls that ordinarily refuse the conversation's model ride it too.** The reader that
 decides whether a long answer is moved to a task, and the writer of the brief that task opens
-on, normally run on the thinking tier and on nothing else: with no crew they are skipped
+on, normally run on the crew's planner and on nothing else: with no planner they are skipped
 rather than handed to the model that just wrote the answer. Under this flag they run on your
 model like everything else, because you have said your model is the crew. Without the flag and
-without a thinking-tier row, a move that needs them says `no second model is set`.
+without a planner to seat, a move that needs them says `no second model is set`.
 
-**It changes no setting and writes nothing.** Your crew rows and pins are untouched, `/crew`
+**It changes no setting and writes nothing.** Your pins and rows are untouched, `/crew`
 still says what it said, and the next session without the flag reads them exactly as before.
 It is a posture for one run, not an edit.
 
@@ -1164,28 +1189,18 @@ Two things it deliberately does not do:
 Standing items never take this posture, whatever the session that set them up was started
 with. They fire on their own clock long after your run ended, and the crew answers for them.
 
-## What the screen says under `--one-model` — why does the status line say one model, where did my crew word go, no crew receipt when a task starts
+## What the screen says under `--one-model` — why does the status line say one model, where did my crew word go, no crew line when a task starts
 
 **The crew line names the flag, because the flag is what seats the call.** Under
-`--one-model` the crew line of `/status` and the phone sheet reads `one model` rather than the preset your four
-rows derive to, and `/status` answers its crew line with `one model · every call rides the model
+`--one-model` the crew line of `/status` and the phone sheet reads `one model` rather than
+`auto`, and `/status` answers its crew line with `one model · every call rides the model
 you are talking to`. The model picker's hint slot and the welcome line under the wordmark say
 the same word. All of them read one answer, so none of them can disagree with another.
 
-**Your crew word is not gone, it is overridden.** The rows are untouched on disk — this flag
-writes nothing — and the next session started without it draws `crew balanced`, `crew max` or
-`crew custom` again exactly as before. What the flag refuses to do is print a crew that is not
-seating anything this run.
-
-**And no crew receipt is posted.** The line a profile older than the work seat ordinarily gets
-when its first task starts — `your crew was set before the work seat existed · it is running on
-your small work seat's model until you pick a crew with /crew in the conversation` — is not said
-under this flag. That line
-reports a substitution, and under the flag there is none: every call is already on the model
-you are talking to, which is your own answer to the question it asks. Picking a crew would not
-change what runs, so the sentence is not offered, and the `/crew` sheet says nothing about an
-inherited work seat either. Without the flag, the same profile draws `crew custom` and says
-that line once, exactly as it always did.
+**Your crew is not gone, it is overridden.** Your pins are untouched on disk — this flag
+writes nothing — and the next session started without it draws `crew auto` again exactly as
+before. What the flag refuses to do is print a crew that is not seating anything this run,
+so no task says a crew line under it either: nothing was picked.
 
 ## What temperature does codeaf use — sampling settings like temperature, top-p and seed
 
@@ -1334,7 +1349,7 @@ Neither happens now.
 
 What still travels is what somebody asked for: a level you dialled, an explicit
 `--reasoning` level, `CODEAF_REASONING` and `CODEAF_EXEC_REASONING` at a headless
-door, a crew class value like `moonshotai/kimi-k3:high`, and a rung on a task or
+door, a pinned value like `moonshotai/kimi-k3:high`, and a rung on a task or
 a standing card. `off` on the headless environment settings really does send the
 disable; `off` on the chat dial is the legacy spelling of `auto`. Errands the
 session runs for itself — naming a conversation, judging a route — still ask for
@@ -1368,7 +1383,7 @@ answer: it cannot think harder than its own ceiling.
 - A model whose catalog row says it takes no reasoning knob at all is sent nothing about
   thinking.
 
-These rungs are not the same notation as a thinking level written onto a crew class value
+These rungs are not the same notation as a thinking level written onto a pin
 (`moonshotai/kimi-k3:high`), which still takes only `low`, `medium` and `high`.
 
 ## The model went quiet, or stopped answering halfway through — the request is cut when nothing comes back, and how long it waits first
@@ -2342,7 +2357,7 @@ same three-second beat every place runs on, and it draws three things:
   is bound to planning" are opposite facts about the same blank. There is no figure on that
   row: no line in the ledger names a slot, so there is nothing measured to put there.
   **Today only the conversation slot is drawn at all.** A window holds a client for the
-  model you are talking to and for no other; the five crew slots are answered where their
+  model you are talking to and for no other; the other slots are answered where their
   own session is opened, so this window cannot tell "nothing is bound" from "I cannot ask" —
   and the emptiness law says an unknown is drawn as nothing rather than guessed at;
 - **by topic** — the three things money is ever spent on, because the ledger holds
@@ -2503,14 +2518,14 @@ their own words — `background`, `changes`, `spend`, `context`, `cache`, `rate`
 finally `file`.
 Labels are padded into two aligned columns.
 
-The `crew` line sits directly under `model` and reads the preset word — or `custom` — with
-the three classes after it:
+The `crew` line sits directly under `model` and says the crew is auto, with any seat you
+pinned after it:
 
 ```
-crew     max · brain claude-opus-5 · hands glm-5.3 · checks claude-fable-5.1
+crew     auto · pinned checker moonshotai/kimi-k3
 ```
 
-On the live status line the crew is one short segment — `crew max`, or `crew custom` — at
+On the live status line the crew is one short segment — `crew auto`, or `crew auto · 1 pinned` — at
 the head of the telemetry beside the model, and among the first a narrow row gives up; the
 `crew` line here and on the phone's status sheet is the full reading. A **remote** session
 opened with `--host` has no crew of its own to read — it is the other machine's — and gets
@@ -2795,7 +2810,7 @@ They live on **one tab**: `/settings` → **Spending**, which `/budget` opens di
 | **per day** | `$500` | new work waits for midnight or for you to raise it here |
 | **per conversation** | `no limit` | this conversation stops starting new turns; the turn in flight always finishes |
 | **per plan** | `asks first above $100` | a planned job estimated above it quotes its step count and its price and waits for your go-ahead — it asks, it does not stop |
-| **per task** | `no limit of its own` | nothing of its own; a task spends against the day and this conversation |
+| **per task** | `$5 a task` | that task's next priced call is not made; set in `/crew` |
 | **per standing run** | `$5 a firing` | that one firing stops there; each order may name its own |
 | **practice** | `$50 of the day` | codeaf's practice on itself stops until tomorrow, and your own work is untouched |
 
@@ -2936,30 +2951,24 @@ The row was called `ask before spending` when it lived on the Workspace tab, and
 setting key behind it is still `plan_consent_usd` — the panel's search matches the key as
 well as the label, so typing either finds it.
 
-## What may a task spend — a task has no dollar limit of its own
+## What may a task spend — $5 a task unless you set another
 
-**A task carries no dollar cap of its own.** The Spending tab says so on the `per task`
-row, in those words: `no limit of its own`, with the dim receipt `it spends against the
-day and this conversation`.
+**A task carries a dollar limit of its own: $5 unless you set another.** The Spending tab
+shows it on the `per task` row — `$5 a task`, with the dim receipt `set in /crew · it also
+spends against the day and this conversation`. It is set on the `/crew` panel's **cap** row
+or with `/crew cap task 10`; see [The per-task limit](#the-per-task-limit).
 
-That is not a missing feature — it is what the rail actually is. A task's own bounds are
-**steps and time**, not money: a deadline it may renew, a step count, and a limit on how
-long it may go without progress. The money it spends is counted against the day's limit
-and against the limit on the conversation that started it, which are the two rows above it
-on the same tab.
+Every priced call of one task counts against it, and a call that would pass it is not
+made. A task's other bounds are **steps and time**: a deadline it may renew, a step count,
+and a limit on how long it may go without progress. Its money is also counted against the day's limit and
+against the limit on the conversation that started it, the two rows above it on the same
+tab.
 
-**What you get instead of a per-task limit is seeing it happen.** The `$` on the status
-line counts what the tasks are spending while they are spending it, and `/cost` splits that
-figure into `conversation` and `tasks`. A task is bounded by the wallet and watched on the
-row — it is never stopped on its own dollar count.
+The `$` on the status line counts what the tasks are spending while they spend it, and
+`/cost` splits that figure into `conversation` and `tasks`.
 
-So **there is no per-task money row to edit**, and `/budget task 20` is not a shape this
-command takes. Where you *can* put a figure on one piece of work is the **composer layer**:
-`alt+enter` before you send a task, and its third line reads `it may spend up to $100.00
-before it asks`. Type a number there and that errand gets that ceiling — it stops before
-its next turn once it reaches it, and any adaptive run it starts is held to a tank no
-bigger. A task started any other way — `/task <brief>`, a proposal card, codeaf's own
-hands — runs under the day's limit and this conversation's.
+`/budget task 20` is not a shape this command takes; the per-task figure lives in `/crew`.
+The **composer layer** can put a further figure on one errand; see the tasks page.
 
 `per standing run` beside it is the same kind of reading for a different reason: it reads
 `$5 a firing · each order may name its own`, because that rail is written **per standing
@@ -3898,7 +3907,7 @@ lean.
 So an open-weight model with a large window is NOT lean. `glm-5.3-flash` and
 `glm-5.3` are served with 128,000 tokens of room, so they get the full
 page, the full tool list and saved memories, exactly like any other
-128,000-token model — including when they are the model your crew preset picked
+128,000-token model — including when they are the model the crew picked
 for the `worker` seat, and including when you then choose that same model in
 chat. Open weights are a licence, not a size.
 
diff --git a/internal/manual/chat/openrouter-credits.md b/internal/manual/chat/openrouter-credits.md
index 34058d7bd9..a1135e90eb 100644
--- a/internal/manual/chat/openrouter-credits.md
+++ b/internal/manual/chat/openrouter-credits.md
@@ -5,17 +5,17 @@
 For the default OpenRouter service, codeaf reads the account's credit balance and
 the key's own spending cap, whichever is smaller. A known remaining balance of $0.50
 or less is low. While it is low, a new conversation on a profile where you never
-chose a model opens on `qwen/qwen3.8-27b:free`, and the five crew seats nobody set
-use `nvidia/nemotron-3.5-lightning:free` for reflex,
-`thinkingmachines/inkling-small:free` for small work, `qwen/qwen3.8-27b:free` for
-worker, `thinkingmachines/inkling:free` for careful work and
-`qwen/qwen3.8-27b:free` for mastermind. `/status` and the setup screen call that
-crew `free`; `/crew` still offers `frugal`, `balanced` and `max`, and choosing one
-writes it.
+chose a model opens on `qwen/qwen3.8-27b:free`, and the two helper rows nobody set
+use `nvidia/nemotron-3.5-lightning:free` for reflex and
+`thinkingmachines/inkling-small:free` for small work. The crew's three seats — worker,
+planner and checker — are picked per task, and a low balance reaches them as an
+OpenRouter account out of credit: a seat nobody pinned is routed to a free pool, and the
+task's crew line says `free routes in use (may log prompts) · credit unavailable on
+openrouter` (*Route health* in *Models and cost*).
 
 Free ids are defaults only. A model you chose with `/model` or the setup screen,
-`--model`, `CODEAF_MODEL`, a crew you applied or a tier row you set stays chosen,
-and the free defaults are never written into your settings. Nothing is spent
+`--model`, `CODEAF_MODEL`, a seat you pinned with `/crew pin` or a helper row you set stays
+chosen, and the free defaults are never written into your settings. Nothing is spent
 reading the balance: it is two account lookups and no model call.
 
 OpenRouter limits free models to 20 requests per minute, and to 50 requests per
@@ -61,8 +61,8 @@ A conversation that has sent nothing and whose model nobody chose follows the
 default both ways: onto the free model when the account reads low, and back to
 the usual default when a later read finds more than $0.50. A conversation that has
 sent a message keeps its model either way. After a top-up, the next new
-conversation opens on the usual default and the crew seats nobody set return to the
-`balanced` models.
+conversation opens on the usual default, the helper rows return to their usual models,
+and the crew is routed over paid routes again.
 
 ## Low on credits warning under the message box
 
diff --git a/internal/manual/chat/permissions.md b/internal/manual/chat/permissions.md
index 2922ae579b..3b6f2dde5f 100644
--- a/internal/manual/chat/permissions.md
+++ b/internal/manual/chat/permissions.md
@@ -925,10 +925,9 @@ conversation's own model (`model.talk`) is changed with `/model`, and the other
 role slots — `model.plan`, `model.work`, `model.verify`, `model.scribe` — are
 bindings the running session holds rather than values in your profile, so
 neither `change_setting` nor the panel can write them. To send codeaf's own
-auxiliary calls somewhere, set one of the five crew classes
-(`models.tiers.reflex`, `models.tiers.low`, `models.tiers.worker`,
-`models.tiers.high`, `models.tiers.mastermind`), set all five at once with
-`models.crew`, or pin one role in `models.roles`.
+auxiliary calls somewhere, set one of the five model rows on the Providers tab —
+reflex, small work, worker, checker, planner — or pin one role in `models.roles`. A
+task's worker, planner and checker are pinned with `/crew pin`.
 
 A row your environment has pinned refuses like it does everywhere else:
 `<label> is set by <NAME>`.
diff --git a/internal/manual/chat/running-from-the-terminal.md b/internal/manual/chat/running-from-the-terminal.md
index c58f684220..ba5fca5183 100644
--- a/internal/manual/chat/running-from-the-terminal.md
+++ b/internal/manual/chat/running-from-the-terminal.md
@@ -363,6 +363,61 @@ one pass there is `--token-budget` and `--timeout`.
 itself, the same bytes `--out` would write. `codeaf logs --json` is a third: one JSON object per line,
 byte-for-byte what is on disk.
 
+## Which models a headless run uses — the crew, --best, --cheap, --pin and the daily cap
+
+A headless run has the same crew a conversation's task has: a **worker**, a **planner** and
+a **checker**, and every seat nobody pinned is picked for this task from what kind of work
+it is. The run says its crew on stderr before anything is spent — every seat, and which
+rung answered it — and under it the class the task was read as and the estimate:
+
+```
+models: worker z-ai/glm-5.3-flash (routed) · planner z-ai/glm-5.3-flash (routed) · checker moonshotai/kimi-k3 (pinned)
+crew: bugfix · worker glm-5.3-flash (openrouter) · checker 📌 kimi-k3 · est $0.023
+```
+
+A seat you pinned wears `📌`, so `checker 📌 kimi-k3` is a checker pinned with `/crew pin`.
+When the run ends, the `crew:` line is said again with what it actually cost beside the
+estimate: `crew: bugfix · worker glm-5.3-flash (openrouter) · checker 📌 kimi-k3 · $0.021 (est $0.023)`.
+
+**Every model flag is a one-task pin.** `--model`, `--plan-model` and `--check-model` pin the
+worker, planner and checker for this run and no other, and `CODEAF_MODEL`,
+`CODEAF_PLAN_MODEL` and `CODEAF_CHECK_MODEL` do the same from the environment. Each seat
+climbs its own ladder — the flag, then its variable, then a `/crew pin` in the profile,
+then the crew picked for this task — and the rung that answered is named beside the seat
+(`--model`, `CODEAF_MODEL`, `pinned`, `routed`). **The checker never inherits the planner:**
+a `--plan-model` says who plans and nothing about who checks.
+
+`codeaf do` takes three more, all for this one task:
+
+- **`--best`** — the strongest crew your allowed models make.
+- **`--cheap`** — the cheapest crew your allowed models make.
+- **`--pin seat=model[@provider]`** — pin one seat, `worker=`, `planner=` or `checker=`; say
+  it once per seat. `--pin checker=moonshotai/kimi-k3@openrouter` sends the checker through
+  that connection. A seat that is not one of the three, or a pin with no model, is refused.
+
+Nothing a headless run is told is written to the profile: the pins and the allowed models
+stay what `/crew` last set.
+
+**At the daily cap, `codeaf do` refuses.** When today's crew spend has reached the cap
+`/crew cap` set, it starts nothing and says so:
+
+```
+today's crew spend has reached the daily cap of $5.00 · raise it with `/crew cap`, run with --cheap, or pass -yes-spend
+```
+
+`-yes-spend` is the one way past it — past the daily cap, never past the per-task limit.
+**Every run is held to the per-task limit**, $5 unless `/crew cap task` set another: a call
+that would take the run past it is not made, and the run stops on
+`this task reached its $5 limit · raise it in /crew`. The other headless doors — `exec`, `run`, `plan run` —
+are a person at a terminal running one thing, so they **warn and go on**:
+`note: today's crew spend has reached the daily cap · this run goes ahead; `codeaf do` would have stopped`.
+
+With `--json`, `codeaf do` carries the crew too: `class` (the kind of work the task was read
+as), `crew` (each seat's `model`, `provider`, `kind`, `pinned` and `est_usd`), `est_usd` for
+the whole crew beside `spend_usd`, `effort` when `--best` or `--cheap` was given, and
+`check_model` with `check_model_source` beside the worker's `model_source` and the planner's
+`plan_model_source`.
+
 ## What checked my unattended or headless run — what judged the delivery, and why task.audit is not the answer
 
 A `codeaf do` errand's delivery is read at the end by the **delivery gate**. It takes a
@@ -417,8 +472,8 @@ answer includes the check's own sentence about what could not be read.
 
 Some fields belong to one command and stay. `codeaf do` carries `spend_work` and
 `spend_overhead` — what the work cost against what it cost to decide what the work should
-be — and `blocked_on`, `learned`, `plan_model`, `model_source`, `plan_model_source` and
-`subharness`. It also carries `judged_by` when the settled root records an answered gate
+be — and `blocked_on`, `learned`, `plan_model`, `model_source`, `plan_model_source`,
+`check_model`, `check_model_source`, `class`, `crew`, `est_usd`, `effort` and `subharness`. It also carries `judged_by` when the settled root records an answered gate
 attempt and `unjudged` when that gate could not be reached. Both keys can be absent when
 no root gate row is available; neither key replaces `ok` and `stop`. `codeaf run` carries `output`, which is
 the typed answer whole, and `report`.
@@ -702,7 +757,7 @@ the same answer as one object; `show` reads nothing off the network.
 **The scores start here.** In a conversation, after a task lands, a model
 outside the crew is asked to score each seat the work ran on — the worker that
 carried it, and the seat that checked it when there was one. The scores stay
-in your install's own sheet (`own.json`) and feed the very next crew pick;
+in your install's own sheet (`own.json`) and are read when the next crew is chosen;
 nothing else reads them. With `model_pool` set to `on` the same scores also
 wait in `outbox.jsonl` beside the sheet, to leave with the pool's other
 measurements; `read` keeps them local, and `off` asks no judge at all and
diff --git a/internal/manual/chat/running-on-another-machine.md b/internal/manual/chat/running-on-another-machine.md
index 86b853593c..ea77f0ed7a 100644
--- a/internal/manual/chat/running-on-another-machine.md
+++ b/internal/manual/chat/running-on-another-machine.md
@@ -470,7 +470,7 @@ machine that runs the session, but this build has no wire door for them. They do
 or change this machine's copy. The cache, permissions, crew and harness commands name the
 connected machine and say `change it on that machine`; the memory commands say `memory
 shows what this machine has learned, and this session is on another`. In particular,
-`/cache clean now` deletes nothing here, `/crew <preset>` writes nothing here, and
+`/cache clean now` deletes nothing here, `/crew pin` writes nothing here, and
 `/subharness` does not claim the far registry is empty.
 
 ## Did cache clean delete the laptop cache or the remote machine's cache?
@@ -479,11 +479,12 @@ Neither. Over `--host`, `/cache`, `/cache clean`, and `/cache clean now` cannot
 connected machine's build cache and refuse before touching this machine's cache. The
 answer names the connected machine and says to change it there.
 
-## Why didn't crew max change the crew on the remote machine?
+## Why didn't /crew pin change the crew on the remote machine?
 
-`/crew` has no far-profile door yet. Over `--host`, both the picker and `/crew <preset>`
-refuse before reading or writing this machine's profile, name the connected machine, and
-say to change the crew there.
+`/crew` has no far-profile door yet. Over `--host`, the panel and every shortcut —
+`pin`, `unpin`, `models`, `cap` — refuse before reading or writing this machine's profile,
+name the connected machine, and say to change the crew there:
+`devbox owns the crew · change it on that machine`.
 
 ## Why does remember over host not say whether memory is off?
 
diff --git a/internal/manual/chat/saved-programs.md b/internal/manual/chat/saved-programs.md
index c26f062603..9c0a39cf53 100644
--- a/internal/manual/chat/saved-programs.md
+++ b/internal/manual/chat/saved-programs.md
@@ -209,8 +209,8 @@ Optional: `--dir <dir>` for the directory to work in (`-w` still works), `--mode
 `--journal <path>` to append every call the run makes to a file, one JSON object per line,
 and `--json` for the one result object `codeaf do` and `codeaf exec` also print.
 
-With no `--model` it runs on your crew's small-work class — the same crew `/crew` sets —
-and it opens by saying which model it took and what chose it.
+With no `--model` it runs on the crew's worker — a `/crew pin` if you set one, otherwise
+the worker picked for this run — and it opens by saying which model it took and what chose it.
 
 There is no task surface and no card here. What comes back:
 
diff --git a/internal/manual/chat/screen.md b/internal/manual/chat/screen.md
index 05ee19a1fa..e42b5c0f23 100644
--- a/internal/manual/chat/screen.md
+++ b/internal/manual/chat/screen.md
@@ -877,7 +877,7 @@ What steps up, in the lines you will see it in:
 
 | Line | What is drawn brighter |
 | --- | --- |
-| the crew line after `/crew` | the three crew model ids and the model you are still talking to — `brain`, `hands`, `checks` and `you are still talking to` stay grey |
+| the `/crew` panel and its confirmations | the model ids, the allowed rule and the model you are still talking to — `worker`, `auto · now`, `every task until you unpin it` and `you are still talking to` stay grey |
 | `model · <id>` after `/model` | the model id |
 | `harness · <name>` | the harness's name |
 | `<mode> task <id> started · <title>` | the id and the title |
@@ -1099,8 +1099,8 @@ are looking at a different one is counted in `N waiting` on the next frame. `tab
 empty box goes to the last one — see the keys page, and home's *Switch between projects
 without leaving*.
 
-**Six facts are on `/status` and the phone sheet but not on the row:** `crew` (the preset
-the five models codeaf uses on its own behalf are on), `changes` (`Σ +128 −14`, lines
+**Six facts are on `/status` and the phone sheet but not on the row:** `crew` (auto, and
+any seat you pinned), `changes` (`Σ +128 −14`, lines
 added and removed by this session), `rate` (`1.2k tok/s avg`, this turn's output over
 this turn's whole wall time, waits and tool calls included — which is why it is not the
 figure at the right edge of the row), the compaction sparkline's readings, `open` and
@@ -1443,6 +1443,41 @@ Beyond the four tiers, these are the exact points where parts of the screen give
 | landed task card | nothing below width 8 |
 | turn receipt | none below width 8 |
 
+## The crew panel on screen — the /crew frame, its providers row, and what gives way when narrow
+
+`/crew` hangs one frame over the conversation, in the place every overlay takes, with the
+input line under it. Its rows, top to bottom: the three seats, a blank line, **models**,
+**providers**, **cap**, then the dim `today` line and any warning.
+
+```
+│  models    ‹ all › (96)                                             │
+│› providers ✓ openrouter  ✓ z-ai sub  ✓ ollama local  ○ my-vllm  +   │
+│  cap       none                                                     │
+```
+
+A provider chip is `✓` and its name when it is on, `○` and dim when it is off; the chip
+under the cursor is bold, and `+` at the end is `/connect`. The row that just changed wears
+a tick `✓` at its end, and the frame's bottom edge offers `z undo` for five seconds.
+
+`enter` on the providers row swaps the rows for the providers list, titled
+`crew · providers · 3 of 4 on`:
+
+```
+│› ✓ openrouter  api key          96 models · today $1.20    on       │
+│  ✓ z-ai        subscription     4 models  · nothing today  on       │
+│  ✓ ollama      local            2 models  · nothing today  on       │
+│  ○ my-vllm     custom endpoint  pins only · nothing today  off      │
+│                                                                     │
+│  free routes  off · rate-limited, may log prompts                   │
+```
+
+What gives way when the window narrows, in order: the seats drop their
+`usually <model>` hint, the provider chips drop their `local` word, and then the chips fold
+into one count — `providers 3 of 4 on` — where `space` and `enter` open the list instead.
+The list itself drops the day's spend first, then the model count, then how a provider
+bills, and always keeps `on` or `off`.
+Nothing on the panel is cut with `…`: a row that does not fit is said shorter.
+
 ## The two-row status deck at phone width
 
 Under 60 columns the status row becomes a deck of exactly two rows — never one, never
@@ -4006,7 +4041,7 @@ with its name in bold, the way a row on home does.
 The step above that is for the thing you have actually **chosen**, and it stays drawn
 when nobody is touching the list: the roster row and the strip chip of the room you are
 standing in, the model in use in `/model`, the conversation you are in on home and in
-`/resume`, the crew in force in `/crew`, the tab you are on in `/settings`. Both can be
+`/resume`, the tab you are on in `/settings`. Both can be
 on screen at once — that is what two steps are for — and the roster is where you will
 see it: the room you walked into on the louder ground, the row `↑↓` has reached on the
 quieter one. Where a cursor lands on the chosen row itself, the louder ground wins, so a
diff --git a/internal/manual/chat/services.md b/internal/manual/chat/services.md
index 601013bba6..64d3c77125 100644
--- a/internal/manual/chat/services.md
+++ b/internal/manual/chat/services.md
@@ -26,12 +26,12 @@ does not open, and codeaf does not show
 `openrouter is not connected · enter on your message connects in a browser, or export OPENROUTER_API_KEY`.
 Ollama counts as connected without a key because its local service explicitly needs none.
 
-The crew follows the same road. Its small background calls — naming a session, titling a
-task, the reflex and the judges — normally use the configured crew models. If one of those
+The small background calls follow the same road — naming a session, titling a task, the
+reflex and the judges — which normally use the models on the reflex and small-work rows. If one of those
 models belongs to the default service and that service has no key, the call instead uses
 the conversation's model on the connected service. Tools, tasks and child agents launched
 from that turn inherit the same rule, so none of them makes an OpenRouter request. If the
-default service does have a key, the crew keeps using its configured models as usual.
+default service does have a key, those calls keep using their configured models as usual.
 
 ## What model do I get after connecting a service — why did my model change
 
@@ -268,7 +268,7 @@ opens it for editing with the address and name pre-filled, and an empty key box
 the saved key. A changed name is a rename: every model id already picked under the old
 name is re-spelled with the new one, the conversation's own pick first (a turn still
 answering is waited out), and with it the stored ones: reasoning levels, the
-crew's role models, role pins, the fallback chain and the capability slots. A rename changes a label and nothing
+worker, checker and planner pins, role pins, the fallback chain and the capability slots. A rename changes a label and nothing
 else; it does not move the conversation onto a different model. `ctrl+r` on the row
 reconnects with the saved details. The `add custom connection` row runs the same three
 questions for a new connection, so the tab never sends you to `/connect` to add one.
diff --git a/internal/manual/chat/starting-codeaf.md b/internal/manual/chat/starting-codeaf.md
index 509d8fa519..cb788ebb46 100644
--- a/internal/manual/chat/starting-codeaf.md
+++ b/internal/manual/chat/starting-codeaf.md
@@ -65,7 +65,7 @@ that is a different program and nothing here talks to it.
 | `codeaf chat --host devbox` | the chat here, the work on another machine |
 
 **The very first launch on a machine with nothing configured** opens on a short setup
-instead — connect OpenRouter in your browser, choose the crew, set the spending rails —
+instead — connect OpenRouter in your browser, check the chat model, set the spending rails —
 and then on the empty conversation. The preference questions are shown once. The
 OpenRouter step returns on any later local interactive launch while no key exists,
 including a named or resumed conversation using the default service, and `enter` on an
diff --git a/internal/manual/chat/tasks.md b/internal/manual/chat/tasks.md
index ae2f28e48d..b5ab5d88bd 100644
--- a/internal/manual/chat/tasks.md
+++ b/internal/manual/chat/tasks.md
@@ -593,7 +593,7 @@ alongside the reply rather than in front of it, which is its own section below.
 
 **A yes is asked twice.** The cheap model only screens — it reads every substantial message
 and every wordy turn, which is why it is cheap — and it cannot start anything on its own. Before a task exists, the same
-question is put once more to your **mastermind** model, in the same words, with none of the
+question is put once more to your **planner** model, in the same words, with none of the
 first answer in front of it. Only if both say yes does the work start, and then one dim line
 goes into the transcript:
 
@@ -1016,7 +1016,7 @@ thinking tier, and both are deliberately crew-only — with no crew they are ski
 handed to the model that has just written the answer and would be editing itself. So if nothing
 is set for them, they have no model at all, and this is the sentence that says so.
 
-**What to do about it.** Set a thinking-tier model with `/crew`, or pin the two roles on the
+**What to do about it.** Pin a planner with `/crew pin planner <model>`, or pin the two roles on the
 **pinned roles** row in `/settings` → Providers — they are called `markreader` and `handoff`,
 so the row reads `markreader:openai/gpt-5, handoff:openai/gpt-5`. Or run with `--one-model`,
 which settles them on the model you are talking to along with everything else. Either way the
@@ -2257,11 +2257,9 @@ proposal card and the model's own proposals run under the conversation's own lim
 you set it — and under the day's limit above it. An adaptive run they start opens on the
 $100.00 default.
 
-**A task has no dollar limit of its own**, which the Spending tab says on its `per task`
-row in those words: `no limit of its own · it spends against the day and this conversation`.
-Its own bounds are steps and time. The composer layer's third line is the one place a
-figure is put on a single piece of work, and there is no per-task money row to edit
-anywhere in settings.
+**Every task also has a money limit of its own: $5 unless you set another**, shown on the
+Spending tab's `per task` row and set with `/crew cap task <$>`. A call that would spend
+past it is not made, whichever way the task was started, and the task stops there.
 
 Changing the engine's default changes the figure the composer layer opens on; the two are
 meant to be one number and are stated in both places on purpose.
@@ -3919,7 +3917,7 @@ because a second model read it and drew its parts, that drawing is put to this s
 beside the new task's worker, which starts at once rather than waiting for the reading — so
 the parts somebody already named are handed out without the worker having to find them
 again. Everything below applies to it without exception: the same tests, the same reading
-by the mastermind, the same refusals. The receipt reads the same too, and reaches the worker
+by the planner, the same refusals. The receipt reads the same too, and reaches the worker
 while it works, telling it the parts are now somebody else's so it does not do them again;
 an answer that arrives after the worker has finished is dropped. *When a reply is taken out of your hands* is where that happens.
 
@@ -3986,7 +3984,7 @@ parameters, not piles, and evidence that names no pile at all counts zero.
 read your request and judged it broad — the wide line before a `/task`, a proposal I marked
 wide, a message the harness moved to a task — and the count then says the evidence names too
 few items, those are two readings of the same work disagreeing. The count is not the last
-word there: the division goes to the mastermind, which decides it on the parts themselves.
+word there: the division goes to the planner, which decides it on the parts themselves.
 That is the whole of the exception, it exists only while the count is on, and the free-lane
 test is never waived by anything.
 
@@ -4003,27 +4001,27 @@ worker split out and a part a second model drew — so a part never depends on t
 doing the splitting remembering to restate the job once per part. Your own sentence still
 appears exactly once, at the top, where it appears on every task.
 
-**And then the plan itself is read once, by your `mastermind` model.** The tests above are
+**And then the plan itself is read once, by your `planner` model.** The tests above are
 about whether a split is worth it; neither of them reads the parts. But what a part owns is
 everything that worker will act on — it is not handed your conversation and cannot
 ask anybody anything, though the brief names the journal path and line of your original
 words so it can read them if the restatement was cut — and the scopes were written by whatever model the task itself runs on.
-So once those have passed, the whole division goes to the mastermind at once: the
+So once those have passed, the whole division goes to the planner at once: the
 evidence, the work it came out of, and every part beside its siblings. It can sharpen a
 scope, fix a boundary two parts share, fold two parts into one, or say the parts are really
 stages of one procedure and not a division at all — in which case nothing is split and the
 worker carries on, exactly as a no from a test above. So the parts you see may be fewer
 than the worker asked for, and what they own may not be word for word what it wrote.
 
-**And it has one more answer, which is not about the split at all.** The mastermind may
+**And it has one more answer, which is not about the split at all.** The planner may
 read the work and find that what is left of it **cannot be done by a worker** — an approving
 review only a named person may give, a credential or an account nobody here holds, a
 decision that is yours to make, or a step that is somebody else's system doing something by
 itself. When it says that, the task does **not** start a worker: it lands straight away
-needing your look, with the mastermind's own sentence as its report, and the only thing
+needing your look, with the planner's own sentence as its report, and the only thing
 spent on it is that one reading. The next section, *A task that landed needing your look
-without doing anything*, is what you see. This is a deliberate word the mastermind has to
-reach for; a mastermind that merely thinks the split unwise, or would rather one worker did
+without doing anything*, is what you see. This is a deliberate word the planner has to
+reach for; a planner that merely thinks the split unwise, or would rather one worker did
 this, has refused a division and the worker carries on with the work exactly as above.
 
 ## Two parts cannot own the same file — a division refused over an overlap
@@ -4074,31 +4072,31 @@ the same loss the rule above exists to stop. A part that finds something wrong i
 material says so in its report and leaves the file as it stands. Nothing checks this: the
 reading compares the parts **with each other**, never a part against the work it started
 from. What holds it is what the parts are told — the splitting worker is asked to say it in
-the brief of any part it hands shared material to, and the mastermind that reads the plan is
+the brief of any part it hands shared material to, and the planner that reads the plan is
 asked to write the file a part produces into that part's done-condition where the brief names
 files and the done-condition names none.
 
 **It is checked twice, and the first one is free.** The parts as the worker wrote them are
-read before the mastermind is, so the commonest case — a worker that drew its own
+read before the planner is, so the commonest case — a worker that drew its own
 boundaries badly — is refused for **nothing at all**, and the worker is told so. The parts
-the mastermind settled are read again afterwards, because it can sharpen a part onto a
+the planner settled are read again afterwards, because it can sharpen a part onto a
 file its sibling already owns; a refusal there has cost that one reading and nothing else,
 and its wording does not pretend otherwise. Only the **same file** counts either time. Two
 parts working in one directory on different files are independent and always were, and so
 is one part owning a folder while another owns a file inside it.
 
-**This reading can only ever improve a split; it cannot lose you one.** If the mastermind
+**This reading can only ever improve a split; it cannot lose you one.** If the planner
 cannot be reached, times out, or answers something unusable, the division goes ahead **as the
 worker wrote it**. It had already passed everything that was going to refuse it, and a second
 opinion that cannot be had is not a reason to throw work away.
 
 **Except on the one division it is deciding rather than sharpening** — the exception above,
 where the count said too few items and a model's reading of your request said broad. There
-the mastermind is the only thing that has said yes to those parts, so if it cannot be
+the planner is the only thing that has said yes to those parts, so if it cannot be
 reached nothing is admitted — and the worker is told exactly that: nothing was decided, ask
 once more. The unanswered ask costs nothing and is not held against the work; only a
-mastermind that actually answers settles the question, and its no is then final for that
-task. Nothing is lost either way: an unreachable mastermind cannot admit a split, and it
+planner that actually answers settles the question, and its no is then final for that
+task. Nothing is lost either way: an unreachable planner cannot admit a split, and it
 cannot cancel any work.
 
 ## Which model each part runs on — ordinary parts, careful parts, and the grade the worker sets
@@ -4108,11 +4106,10 @@ sets. Most parts are ordinary work — the failure mode is simply not being done
 can see whether it happened — and those run on the same model the task itself is on. A part
 graded **careful** is one whose failure mode is subtle wrongness: a design decision, a tricky
 piece of debugging, a judgement about somebody else's code, where the work can look finished
-and be quietly wrong. Those run on your **careful work** model instead — the same class
-the check at the end of a task uses. The mastermind that reads the plan can promote a part to
-careful too. If you have not set the four class rows at all, every part runs where its task
-runs and the grade costs you nothing; *Models and cost* has the rows and the `/crew` word
-that writes all four.
+and be quietly wrong. Those run on the task's **checker** instead — the same seat the
+check at the end of a task uses. The planner that reads the plan can promote a part to
+careful too. Where the checker is the same model as the worker, every part runs where its
+task runs and the grade costs you nothing; *Models and cost* has the crew and `/crew`.
 
 **And the grade is not the last word — what has actually happened here is.** Every task
 that settles writes down what the check said about it, against the model it ran on and
@@ -4120,12 +4117,12 @@ the name the work was given: `codeaf models` is where those rows show up. When a
 about to be handed out as ordinary work, codeaf looks that record up first. If work
 named like this one has been turned down by the check **twice or more** on the model the
 task is on, and the balance of those answers is against it, the part is minted on your
-**careful work** model instead — even though the worker called it ordinary. Two names
+**checker** model instead — even though the worker called it ordinary. Two names
 count as the same kind of work when they share half their words or more, so *tests for
 the rail* and *tests for the composer* are one thing and *the eleven adapters* is not.
 Nothing is spent to work any of this out: the check had already read the work and said
 so, and no extra model call is made to grade it. A part the worker itself graded careful
-is never moved back down, and an install with no class rows set never moves anything,
+is never moved back down, and a task whose checker is its worker never moves anything,
 because there is nowhere dearer to move it to.
 
 **A busy machine is not one of these tests.** `task.max_load` and `task.min_free_mb` never
@@ -4253,6 +4250,56 @@ how long, and nothing counts tries. See how-tasks-run.
 The frontier used to hold two tasks at once. Two was a guess standing in for a resource
 nobody had measured: idle on a sixteen-core box, one too many on a laptop already compiling.
 
+## How hard to try one task — /task --best, /task --cheap, and the crew a task says it ran on
+
+Every task runs on a **crew** of three seats — the worker, the planner and the checker —
+and unless you pinned a seat, codeaf picks each one for that task from what kind of work
+it is: a bug fix, a complex fix, open-ended work, or something else. On open-ended work the
+extra money goes to the checker first. The panel is `/crew`; the whole story
+is on the models page. What you say about **one** task is two words:
+
+- **`/task --best <brief>`** — the strongest crew the allowed models make, for this task.
+- **`/task --cheap <brief>`** — the cheapest crew that does the work, for this task.
+
+The word comes first, before `solo` if you use that too, and it moves this task's crew and
+nothing after it: the next task is picked the ordinary way again. A pinned seat stays
+pinned either way. Asked in words — "do this one properly, cost no object" — the model
+that grooms the work sets the hand-off's `effort` field to `best` or `cheap`, and it means
+the same; it leaves the field out unless you said how hard to try.
+
+**The task says its crew in one line, rewritten in place.** When it starts, it gives the
+class it was read as, the models on the seats and what it is expected to cost:
+
+```
+task 4 crew · bugfix · worker glm-5.3-flash (openrouter) · checker kimi-k3 · est $0.023
+```
+
+When it lands, the same line becomes what it actually cost beside the estimate, and the way
+to ask again:
+
+```
+task 4 crew · bugfix · worker glm-5.3-flash (openrouter) · checker kimi-k3 · $0.021 (est $0.023) · not right? /redo stronger
+```
+
+A seat you pinned wears the pin mark `⌖` in front of its model.
+
+**`/redo stronger`** runs the last task this conversation started again, one rung stronger:
+the one seat nobody pinned whose next model up buys the most moves to it, and the line names
+the rung. A task that never started is asked again on the next-best models instead. It also
+teaches the crew: the next task of the same kind in this repository starts a rung higher,
+until an accepted task brings it back. A crew
+that is already the strongest allowed says so and starts nothing —
+`this crew is already the strongest allowed · pin a stronger model with /crew pin, or widen /crew models`.
+A task still running is not redone; stop it first.
+
+**At the daily cap a task does not start.** `/crew cap` sets what crews may spend in a day;
+a task asked for once today's spend has reached it is refused with the cap, the spend and
+the two ways on:
+
+```
+today's crew spend ($5.01) has reached the daily cap of $5.00 · raise it with /crew cap, or ask for this task with --cheap
+```
+
 ## Naming a model for one task
 
 You ask in words — "let opus do this one", "run that on gpt-5". There is no key, command or
@@ -4282,17 +4329,17 @@ The digits are the question's answers and never the models — `1` is `start it`
 `no`. That is the same grammar on every question codeaf asks you, which is why the models
 moved off the digits and onto the arrows.
 
-Name nothing and the task runs on `task.model` if you have set it, otherwise on your crew's
-**worker** class (`hands` in the `/crew` line — `z-ai/glm-5.3-flash` on the shipped
-`balanced` crew), and only when that row is blank on the model the conversation was on
-**when the task was admitted**. The id is settled at that
+Name nothing and the task runs on `task.model` if you have set it, otherwise on its crew's
+**worker** — pinned with `/crew pin worker`, or picked for this task from what kind of work
+it is — and only when neither answers on the model the conversation was on. It is settled
+**when the task is admitted**. The id is settled at that
 moment and remembered for the task's whole life — it survives a restart, and switching the
 conversation's model afterwards does not move work that was already handed over. This
 holds for `/task` and for a task the model proposed alike. What *can* move it afterwards is
 you, from inside that task's own room — see the next section.
 
 **A model you named is kept even when the work is sent back.** If a check finds gaps, the
-worker that closes them normally runs on your crew's careful model rather than the task's
+worker that closes them normally runs on the task's checker rather than its worker
 (see *What happens when the work is not right yet*) — but only where nobody named a model.
 Name one, here or in the task's room, and every round of that task runs on it.
 
@@ -4357,7 +4404,7 @@ What that does, exactly:
   chose>`, so the change is on the record where every other model change is.
 - **New tasks are unaffected.** Work admitted after this still follows the ordinary
   ladder: `task.model` from settings if you have set one, otherwise the crew's worker
-  class, otherwise the model the conversation is on. A pick made inside one room is not a
+  for that task, otherwise the model the conversation is on. A pick made inside one room is not a
   preference the session learns.
 - **The row, the roster and the finished card all say the new model** from that moment on,
   and the change survives a restart. A pick that was saved for the next run instead leaves
diff --git a/internal/manual/chat/what-i-remember.md b/internal/manual/chat/what-i-remember.md
index 2fd5aacf9e..9947ae4d98 100644
--- a/internal/manual/chat/what-i-remember.md
+++ b/internal/manual/chat/what-i-remember.md
@@ -541,12 +541,12 @@ list, every search and every message from that instant.
 
 Two calls per message — plus one that is not per message at all: the background
 tidy, on the **small work** class, a few times a day at most while nobody is
-here. The two that ride every message are both on the cheapest of the five crew
-classes — the
-`reflex` class, which exists precisely because a call made twice a turn is a
+here. The two that ride every message are both on the cheapest of the five model
+rows — the
+`reflex` row, which exists precisely because a call made twice a turn is a
 different economy from one made once a session. It ships pointed at
-`google/gemini-2.5-flash`, and at `mistralai/mistral-nemo` under the `open`
-crew family. Each goes out with a short
+`google/gemini-2.5-flash`, and at `mistralai/mistral-nemo` when your allowed
+models are `open`. Each goes out with a short
 prompt and a 200-token ceiling, and each is asked to answer in a few words of
 JSON.
 
@@ -574,8 +574,8 @@ summary are, so `/cost` and `/status` include them without any one message
 reading as three times the price of its neighbours. `/cost` also names how many
 of those paid requests were empty at their ceiling.
 
-You can point that class at a different model — the **reflex** row in
-`/settings` → Providers, or the whole crew in one word with `/crew` — or pin the
+You can point that row at a different model — the **reflex** row in
+`/settings` → Providers — or pin the
 `reflex` role by itself under `pinned roles`. A change is live: the next turn's
 pair uses it.
 
diff --git a/internal/manual/chat/worker-harness.md b/internal/manual/chat/worker-harness.md
index 4cf60e4752..6d5233870e 100644
--- a/internal/manual/chat/worker-harness.md
+++ b/internal/manual/chat/worker-harness.md
@@ -174,8 +174,9 @@ aside, and none of it starts on the older engine instead.
 **A task whose run could not start says so, and nothing else starts.** If the run's
 plan could not be opened or its copy could not be cut, the answer is
 `task N did not start: <the reason>. Nothing is running for it and nothing was
-started in its place; propose it again, or tell the person what stopped it.` A typed
-`/task` answers the same sentence. It reads as a failure, never as `task N started`,
+started in its place.` A typed `/task` answers the same sentence; the model, reading
+it at the proposal door, is told besides to propose it again or tell you what stopped
+it — words for the model, never shown to you. It reads as a failure, never as `task N started`,
 and the task is not quietly put on the older engine's tree. Only a build with no run
 engine at all, or a conversation with nowhere to keep a plan, uses the older engine,
 because there the run road was never there to take.
@@ -695,24 +696,22 @@ Every task a run launches sits in one of two **seats**, and each seat is a model
 named on a door or in the profile:
 
 - **`--model` is the work seat** — the model a leaf that does the work itself
-  runs on. `codeaf do` reads it from `--model`, then `CODEAF_MODEL`, then the
-  profile's crew, then this build's default; a `/task` in a conversation reads it
-  from the conversation's own worker row. A root is born a leaf, so its first
+  runs on. `codeaf do` reads it from `--model`, then `CODEAF_MODEL`, then a
+  `/crew pin`, then the worker the crew picks for this task; a `/task` in a
+  conversation takes the worker its crew picked for it. A root is born a leaf, so its first
   launch rides this seat, and so does every task the plan adds under it.
 - **`--plan-model` is the plan seat** — the model the root and every task that
   has children run their coordinating turns on. `codeaf do` resolves it the same
-  way from `--plan-model`, then `CODEAF_PLAN_MODEL`, then the crew; a
-  conversation takes it from its mastermind row. A leaf that splits moves onto
+  way from `--plan-model`, then `CODEAF_PLAN_MODEL`, then a `/crew pin`, then
+  the crew picked for this task; a `/task` takes its crew's planner. A leaf that splits moves onto
   this seat for the turns where it is a coordinator.
 - **`--check-model` is the check seat**: the model a check the review round
   adds reads a finished leaf against. `codeaf do` resolves it from
-  `--check-model`, then the `CODEAF_CHECK_MODEL` environment value, then a plan
-  seat pinned by `--plan-model` or `CODEAF_PLAN_MODEL`. A run pinned to two models checks on
-  the plan seat and no third model appears from the profile. A `/task` has no flags, so
-  its check reads `CODEAF_CHECK_MODEL` alone. Without those pins,
-  the check takes the crew's careful row, the same row a conversation's checker rides. The
-  **probe** seat is the one the profile's own `low` row answers alone: nothing
-  on a door names it, so a probe runs on the crew you set in `/crew`.
+  `--check-model`, then the `CODEAF_CHECK_MODEL` environment value, then a
+  `/crew pin`, then the checker the crew picks for this task. **It never inherits the
+  plan seat**: a `--plan-model` says who plans and nothing about who checks. A `/task`
+  takes its crew's checker. The **probe** seat is the one the profile's own
+  **small work** row answers alone: nothing on a door names it, and no crew pin moves it.
 
 The seat a person names is the seat **every** launch takes — a task launched
 after the door resolved the seats still runs on them, not on whichever row the
diff --git a/internal/manual/chat_test.go b/internal/manual/chat_test.go
index 81abc87aac..cd952e3d8e 100644
--- a/internal/manual/chat_test.go
+++ b/internal/manual/chat_test.go
@@ -1364,7 +1364,7 @@ func TestTheChatManualAnswersTheQuestionsPeopleAsk(t *testing.T) {
 		{"why won't you change my approval mode", "permissions"},
 		{"why won't permissions show the rules on the machine I used with host", "running-on-another-machine"},
 		{"did cache clean delete the cache on my laptop or the remote machine", "running-on-another-machine"},
-		{"why didn't crew max change the crew on the remote machine", "running-on-another-machine"},
+		{"why didn't /crew pin change the crew on the remote machine", "running-on-another-machine"},
 		{"why does remember over host not say whether memory is off", "running-on-another-machine"},
 		{"does subharness know whether the remote machine has saved programs", "running-on-another-machine"},
 		{"what does the indented part mean", "keys"},
@@ -1924,36 +1924,28 @@ func TestTheChatManualAnswersTheQuestionsPeopleAsk(t *testing.T) {
 		{"it started answering and then handed the work over", "tasks"},
 		{"why did my reply stop halfway and become a task", "tasks"},
 
-		// The fifteenth wave: the crew that looks like it did nothing. `/crew max`
-		// writes four class models and the session picks them up on its next
-		// call — and the model on the status line does not move, because that one
-		// is the CONVERSATION's and the crew never touches it. So a person reads
-		// the confirmation, looks at a frame that says exactly what it said
-		// before, and asks these in front of it.
+		// The fifteenth wave: the crew that looks like it did nothing. `/crew pin`
+		// moves the next task's seat — and the model on the status line does not
+		// move, because that one is the CONVERSATION's and the crew never touches
+		// it. So a person reads the confirmation, looks at a frame that says
+		// exactly what it said before, and asks these in front of it.
 		{"I changed the crew but the model didn't change", "models-and-cost"},
 		{"why does the bottom still show the old model after /crew", "models-and-cost"},
 		{"does /crew change the model I'm talking to", "models-and-cost"},
-		// A crew older than the worker class: the run says `inherited` and the
-		// person asks about the word, or about the model they never picked.
-		{"why does my run say inherited", "models-and-cost"},
-		{"my crew was set before the work seat existed", "models-and-cost"},
-		// And the same substitution met in the conversation, where the person
-		// has no models line to read the word off — they ask about the task.
+		// The crew picked per task: the person meets a model they never named on
+		// a task's crew line and asks where it came from.
 		{"why is my task running on a model I did not pick", "models-and-cost"},
-		{"my work seat is inherited from small work", "models-and-cost"},
+		{"which model does a task run on", "models-and-cost"},
 		// The same crew question asked from outside the conversation, by
 		// somebody whose runs happen with nobody watching.
 		{"what models does a headless run use", "models-and-cost"},
-		// The onboarding wave: the five seats. /crew and /model became two dials
-		// a person can see as two — the confirm line names the model it left
-		// alone, bare /crew opens with seat one, and the status line carries
-		// `crew max` beside the model — and these are the questions the framing
-		// invites.
-		{"what are the five models", "models-and-cost"},
+		// The panel and its shortcuts, asked the ways the panel invites.
 		{"does /crew change my chat model", "models-and-cost"},
 		{"why did my model not change", "models-and-cost"},
-		{"what does crew max on the status line mean", "models-and-cost"},
-		{"what is the you talk to line in /crew", "commands"},
+		{"how do I pin the checker", "models-and-cost"},
+		{"what is the daily cap on the crew", "models-and-cost"},
+		{"what does /redo stronger do", "models-and-cost"},
+		{"my old crew preset is gone", "models-and-cost"},
 
 		{"how do I quit", "keys"},
 		{"how do I exit codeaf", "keys"},
diff --git a/internal/manual/pages/models.md b/internal/manual/pages/models.md
index a186a093e8..a7626fa0ca 100644
--- a/internal/manual/pages/models.md
+++ b/internal/manual/pages/models.md
@@ -79,27 +79,27 @@ than inventing a description.
 
 ## Which models a run from the shell uses
 
-`codeaf do`, `exec`, `plan`, `run`, `revise` and `run subharness` seat two models — one
-that works, one that plans — and both resolve the same way. First answer wins:
+`codeaf do`, `exec`, `plan`, `run` and `revise` seat a crew of three — a **worker**, a
+**planner** and a **checker** — and each seat resolves on its own ladder. First answer wins:
 
-1. `--model` / `--plan-model` on the command line
-2. `CODEAF_MODEL` / `CODEAF_PLAN_MODEL` in the environment
-3. the crew in this profile — the mastermind class plans, the small-work class works
-4. the model this build ships with
+1. `--model` / `--plan-model` / `--check-model` on the command line — a pin for this run only
+2. `CODEAF_MODEL` / `CODEAF_PLAN_MODEL` / `CODEAF_CHECK_MODEL` in the environment — the same
+3. a seat pinned in this profile with `/crew pin`
+4. the crew picked for this task, from what kind of work it is and the models you allow
 
-The crew is the same one `/crew` sets in the chat, so a machine told `frugal` there runs
-frugal here. It answers only where a crew has actually been set; an untouched profile takes
-the build's default. `CODEAF_HOME` and `CODEAF_PROFILE_DIR` decide which profile is asked.
-A seat computed from the catalog says so where the preset would be — `crew frugal,
-computed from the catalog` — and one computed with what your runs measured says `crew
-frugal, learned`; the **picked from** row in the chat's settings decides which, and a
-pick of `catalog` or `learn` seats a run from the shell exactly as it seats the chat.
+The checker never inherits the planner. The profile is the same one `/crew` sets in the
+chat, so a checker pinned there is the checker here; `CODEAF_HOME` and `CODEAF_PROFILE_DIR`
+decide which profile is asked. `codeaf do` also takes `--best`, `--cheap` and
+`--pin seat=model[@provider]` for one task.
 
-Every one of those runs opens with a line on stderr naming both seats and what chose each:
+Every one of those runs opens with a line on stderr naming the seats and what chose each,
+and under it the crew line:
 
 ```
-models: work z-ai/glm-5.3-flash (crew frugal) · plan z-ai/glm-5.3-flash (crew frugal)
+models: worker z-ai/glm-5.3-flash (routed) · planner z-ai/glm-5.3-flash (routed) · checker moonshotai/kimi-k3 (pinned)
+crew: bugfix · worker glm-5.3-flash (openrouter) · checker 📌 kimi-k3 · est $0.023
 ```
 
-`codeaf do --json` carries the same four facts as `model`, `plan_model`, `model_source`
-and `plan_model_source`.
+`codeaf do --json` carries the same facts as `model`, `plan_model`, `check_model`,
+`model_source`, `plan_model_source` and `check_model_source`, with `class`, `crew` and
+`est_usd` beside them.
diff --git a/internal/manual/pages/surfaces.md b/internal/manual/pages/surfaces.md
index 9702a0518d..477c31db42 100644
--- a/internal/manual/pages/surfaces.md
+++ b/internal/manual/pages/surfaces.md
@@ -162,9 +162,12 @@ locally.
   stop with Ctrl+C: the last line on the error stream is `record kept at
   <path>`, and that directory holds the whole record as `graph.db`. `--keep`
   keeps it whatever happened, and so does `CODEAF_DEBUG` set to anything but
-  `0`, `false` or `off`. It runs on this profile's crew unless `--model`,
-  `--plan-model` or the matching variables name something else, and it opens by
-  saying which of those chose its two models.
+  `0`, `false` or `off`. It runs on a crew picked for the run — with any `/crew pin` this profile holds —
+  unless `--model`, `--plan-model`, `--check-model`, `--pin seat=model[@provider]` or the
+  matching variables pin a seat for it, and it opens by saying which of those chose its
+  models. `--best` and `--cheap` move that one run's crew. It is held to the per-task
+  limit set in `/crew` ($5 unless set), which `-yes-spend` does not lift; `-yes-spend`
+  answers the daily cap and the plan-price question.
 - `codeaf wake` — run one bounded pass and exit. This is what the standing watch
   timer runs; you can run it by hand too.
 - `codeaf doctor` — the brain's path and size, whether a resident is alive, the
diff --git a/internal/manual/truth_test.go b/internal/manual/truth_test.go
index 47909166d1..ebf1d19216 100644
--- a/internal/manual/truth_test.go
+++ b/internal/manual/truth_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/Agent-Field/codeaf/internal/approval"
 	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/ctxbudget"
 	"github.com/Agent-Field/codeaf/internal/effort"
 	executor "github.com/Agent-Field/codeaf/internal/exec"
@@ -107,11 +108,9 @@ func TestEveryFigureAChatPageQuotesComesFromTheCodeThatOwnsIt(t *testing.T) {
 // crew's own three by five — is appended by [crewFacts].
 func quotedFacts(t *testing.T) []quotedFact {
 	t.Helper()
-	seats, notSeats := counted(len(config.ModelTiers))
-	presets, notPresets := counted(len(config.CrewPresets))
-	// The chooser reads one seat more than the crew has: the model you talk to,
-	// which it shows and deliberately cannot move.
-	chooser, notChooser := counted(len(config.ModelTiers) + 1)
+	seats, notSeats := counted(len(crewroute.Seats))
+	decay, notDecay := counted(sourceNumber(t, "../router/crew.go", "redoDecayAfter"))
+	steps, notSteps := counted(sourceNumber(t, "../router/crew.go", "redoOffsetCeiling"))
 	shortlist, notShortlist := counted(sourceNumber(t, "../session/taskmodel.go", "taskModelShortlist"))
 	minutesWord, notMinutesWord := counted(int(standing.Interval / time.Minute))
 
@@ -175,38 +174,55 @@ func quotedFacts(t *testing.T) []quotedFact {
 		value:  strconv.Itoa(sourceByteLimit(t, "../skills/regular.go", "maxPluginJSONBytes") / (1 << 20)),
 		quotes: []quotedIn{{"skills-from-other-tools", "over %s MiB"}},
 	}, {
-		fact: "how many models the crew is", owner: "config.ModelTiers", value: seats, others: notSeats,
+		// THE CREW IS THREE SEATS, and every page that counts them counts
+		// them from the router's own list.
+		fact: "how many seats the crew is", owner: "crewroute.Seats", value: seats, others: notSeats,
 		quotes: []quotedIn{
-			{"commands", "the %s models codeaf uses on its own behalf"},
-			{"commands", "The other %s — reflex, small work"},
-			{"commands", "picking one puts all %s back"},
-			{"commands", "sets the %s and confirms"},
-			{"commands", "each of the %s classes funds"},
-			{"commands", "of the %s classes are **select** rows"},
-			{"getting-started", "the %s models codeaf uses on its own behalf"},
-			{"getting-started", "The crew is the %s class rows"},
-			{"screen", "the preset the %s models codeaf"},
-			{"permissions", "one of the %s crew classes"},
-			{"permissions", "set all %s at once"},
-			{"models-and-cost", "worked out from the %s"},
-			{"what-i-remember", "the cheapest of the %s crew classes"},
+			{"models-and-cost", "The crew is %s seats"},
+			{"commands", "the %s seats a task runs on"},
+			{"getting-started", "the crew is %s seats"},
 		},
 	}, {
-		fact: "how many crew presets there are", owner: "config.CrewPresets", value: presets, others: notPresets,
+		// THE TWO NUMBERS `/redo stronger` TEACHES WITH are the log reader's
+		// own, so a page promising a decay the code does not keep names itself.
+		fact: "how many accepted tasks decay a learned step", owner: "router.redoDecayAfter",
+		value: decay, others: notDecay,
+		quotes: []quotedIn{{"models-and-cost", "after %s accepted task"}},
+	}, {
+		fact: "how many steps a class can learn", owner: "router.redoOffsetCeiling",
+		value: steps, others: notSteps,
+		quotes: []quotedIn{{"models-and-cost", "at most %s steps"}},
+	}, {
+		// THE ONE-TASK WORDS are the router's, on the chat door and the
+		// headless one alike.
+		fact: "the word for the strongest crew", owner: "crewroute.EffortBest",
+		value: string(crewroute.EffortBest),
 		quotes: []quotedIn{
-			{"commands", "Then the %s presets"},
-			{"getting-started", "draws the %s presets"},
-			{"models-and-cost", "opens all %s as a chooser"},
-			{"models-and-cost", "same near-free models in all %s"},
+			{"tasks", "`/task --%s <brief>`"},
+			{"running-from-the-terminal", "`--%s`"},
 		},
 	}, {
-		fact: "how many seats the crew chooser reads", owner: "config.ModelTiers and the seat you talk to",
-		value: chooser, others: notChooser,
+		fact: "the word for the cheapest crew", owner: "crewroute.EffortCheap",
+		value: string(crewroute.EffortCheap),
 		quotes: []quotedIn{
-			{"commands", "codeaf runs **%s model seats**"},
-			{"commands", "the %s-seat reading"},
-			{"commands", "reads all %s and sets the"},
+			{"tasks", "`/task --%s <brief>`"},
+			{"running-from-the-terminal", "`--%s`"},
 		},
+	}, {
+		// The mark a pinned seat wears on a headless line.
+		fact: "the mark a pinned seat wears headless", owner: "config.PinMark",
+		value:  config.PinMark,
+		quotes: []quotedIn{{"running-from-the-terminal", "checker %s kimi-k3"}},
+	}, {
+		// The rule an untouched profile allows.
+		fact: "the allowed rule nobody wrote", owner: "config.CrewAllowedAt",
+		value:  config.CrewAllowedAt(t.TempDir()).String(),
+		quotes: []quotedIn{{"models-and-cost", "An unwritten rule is `%s`"}},
+	}, {
+		// THE MIGRATION'S ONE LINE, as the function that writes it says it.
+		fact: "the line a migrated profile is told", owner: "config.MigrateCrew",
+		value:  migrationLine(t),
+		quotes: []quotedIn{{"models-and-cost", "%s"}},
 	}, {
 		fact: "how long a shortlist of models is", owner: "session.taskModelShortlist",
 		value: shortlist, others: notShortlist,
@@ -307,111 +323,24 @@ func quotedFacts(t *testing.T) []quotedFact {
 			{"adaptive-runs", "picked up again from 9 recorded turns — it was still working when it ran out of %s"},
 		},
 	}}
-	return append(facts, crewFacts(t)...)
+	return facts
 }
 
-// crewFacts is the crew table as the pages copy it out by hand: the chooser's
-// line for each preset, and the models page's row for each seat.
-//
-// IT PINS THE MAPPING AND NOT ONLY THE IDS. A fact per id would go green on a
-// page that had frugal's worker and max's worker the wrong way round, because
-// both ids are on the page somewhere. So a fact is a whole LINE — every seat of
-// one preset in order, or one seat across all three presets in order — built
-// from [config.CrewModels] with the seat words the settings registry owns. Point
-// a preset at a better model and the page still printing the old table names
-// itself.
-func crewFacts(t *testing.T) []quotedFact {
-	t.Helper()
-	seats := seatLabels(t)
-	crews := make(map[string]map[string]string, len(config.CrewPresets))
-	facts := make([]quotedFact, 0, 2*len(config.CrewPresets)+len(config.ModelTiers)+1)
-	for _, preset := range config.CrewPresets {
-		crews[preset], _ = config.CrewModels(preset)
-		line := make([]string, 0, len(config.ModelTiers))
-		for _, tier := range config.ModelTiers {
-			line = append(line, seats[tier]+" "+crews[preset][tier])
-		}
-		facts = append(facts,
-			quotedFact{
-				fact: preset + "'s own line", owner: "config.CrewLine(" + strconv.Quote(preset) + ")",
-				value:  config.CrewLine(preset),
-				quotes: []quotedIn{{"commands", "%s"}, {"models-and-cost", "%s"}},
-			},
-			quotedFact{
-				fact: preset + "'s row in the crew chooser", owner: "config.CrewModels(" + strconv.Quote(preset) + ")",
-				value:  strings.Join(line, " · "),
-				quotes: []quotedIn{{"commands", "%s"}},
-			})
-	}
-	for _, tier := range config.ModelTiers {
-		row := make([]string, 0, len(config.CrewPresets))
-		for _, preset := range config.CrewPresets {
-			row = append(row, "`"+baseModel(crews[preset][tier])+"`")
-		}
-		facts = append(facts, quotedFact{
-			fact: "the " + tier + " seat across the presets", owner: "config.CrewModels",
-			value:  "| " + seats[tier] + " | " + strings.Join(row, " | ") + " |",
-			quotes: []quotedIn{{"models-and-cost", "%s"}},
-		})
-	}
-	return append(facts, quotedFact{
-		fact: "the shipped mastermind model", owner: "config.DefaultMastermindModel",
-		value:  config.DefaultMastermindModel,
-		others: []string{"z-ai/glm-5.3:high"},
-		quotes: []quotedIn{{
-			"models-and-cost", "| mastermind | `%s` |",
-		}},
-	}, quotedFact{
-		fact: "the line /crew max confirms with", owner: "config.CrewSummary after config.ApplyCrew",
-		value:  crewConfirmLine(t, config.CrewMax),
-		quotes: []quotedIn{{"commands", "%s"}, {"models-and-cost", "%s"}},
-	}, quotedFact{
-		// THE SAME THREE SEATS WITHOUT THE CONFIRM LINE'S OWN PREFIX, which is
-		// how /status prints them and how both pages print /status back at the
-		// reader. It is a second row rather than a second pattern on the one
-		// above because the prefix differs — `crew → ` where the command
-		// confirms, a padded label where the reading is listed — and the four
-		// copies of this line drifted onto a worker the max crew has not used
-		// since the presets moved, with nothing red for it.
-		fact: "max's three classes as /status lists them", owner: "config.CrewClasses under the max crew",
-		value:  strings.TrimPrefix(crewConfirmLine(t, config.CrewMax), "crew → "),
-		quotes: []quotedIn{{"commands", "crew %s"}, {"models-and-cost", "crew %s"}},
-	})
-}
-
-// crewConfirmLine is the sentence a person reads after /crew, taken from the
-// function that builds it rather than rebuilt here: a gate that spelled the line
-// itself would go on passing through a change to the words or the order, which
-// is the drift it exists to catch.
-func crewConfirmLine(t *testing.T, preset string) string {
+// migrationLine is the sentence a profile from before the crew was routed is
+// told once, taken from the function that writes it: a profile holding a
+// retired preset word is migrated in a temporary directory and the line it
+// answers is what the page must quote.
+func migrationLine(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
-	if err := config.ApplyCrew(dir, preset); err != nil {
-		t.Fatalf("the %s crew would not apply: %v", preset, err)
+	if err := os.WriteFile(config.BudgetConfigPath(dir), []byte(`{"models.crew": "balanced"}`), 0o600); err != nil {
+		t.Fatal(err)
 	}
-	return config.CrewSummary(dir)
-}
-
-// seatLabels is the word each crew seat wears on a settings surface, read from
-// the registry that owns it. The chooser and the models page both print these
-// beside the ids, so a gate on a line of ids has to spell them the same way.
-func seatLabels(t *testing.T) map[string]string {
-	t.Helper()
-	registry := config.NewSettings(config.SettingsOptions{ProfileDir: t.TempDir()})
-	labels := make(map[string]string, len(config.ModelTiers))
-	for _, tier := range config.ModelTiers {
-		row, ok := registry.Row(seatKey(tier))
-		if !ok {
-			// A seat with no settings row is worth saying on its own, but it must
-			// not stop the pages being read: the run that adds a seat is exactly
-			// the run that needs the list of pages now behind.
-			t.Errorf("the settings registry has no %s row for the %s seat", seatKey(tier), tier)
-			labels[tier] = tier
-			continue
-		}
-		labels[tier] = row.Label
+	line, err := config.MigrateCrew(dir)
+	if err != nil || line == "" {
+		t.Fatalf("a profile with a retired preset word did not migrate: %q (%v)", line, err)
 	}
-	return labels
+	return line
 }
 
 // seatKey is one seat's settings row, which is also the word the pages print.
@@ -453,11 +382,8 @@ func TestEveryPageQuotingAShippedSentenceQuotesItWhole(t *testing.T) {
 	for _, quoted := range []struct{ page, file, name string }{
 		{"getting-started", "../tui3/onboarding.go", "controlLimitWord"},
 		{"getting-started", "../tui3/onboarding.go", "controlModelWord"},
-		{"getting-started", "../tui3/onboarding.go", "controlCrewWord"},
-		{"commands", "../tui3/crew.go", "crewScopeLine"},
-		{"commands", "../tui3/crew.go", "crewPinLine"},
-		{"commands", "../tui3/crew.go", "crewCustomLine"},
-		{"models-and-cost", "../tui3/crew.go", "crewScopeLine"},
+		{"commands", "../tui3/crew.go", "crewUsage"},
+		{"models-and-cost", "../tui3/crew.go", "crewUsage"},
 	} {
 		onScreen := sourceString(t, quoted.file, quoted.name)
 		if !strings.Contains(pages[quoted.page], onScreen) {
@@ -467,32 +393,26 @@ func TestEveryPageQuotingAShippedSentenceQuotesItWhole(t *testing.T) {
 	}
 }
 
-// THE COMMAND LIST AND THE MANUAL COUNT THE SAME SEATS.
+// THE COMMAND LIST AND THE MANUAL NAME THE SAME SEATS.
 //
-// The row a person reads on /help and the page they read afterwards are two
-// hand-written sentences about one table, and the row is the one nothing was
-// checking. Both are compared to config here rather than to each other, so the
-// failure names the figure rather than only saying they differ.
-func TestTheCrewCommandRowCountsTheSeatsConfigOwns(t *testing.T) {
-	seats, notSeats := counted(len(config.ModelTiers))
+// The rows a person reads on /help and the page they read afterwards are two
+// hand-written sets of sentences about one crew. Both are compared to the
+// router's own seat list here rather than to each other, so the failure names
+// the seat rather than only saying they differ.
+func TestTheCrewCommandRowsNameTheSeatsTheRouterOwns(t *testing.T) {
 	rows := strings.Join(crewCommandRows(t), "\n")
 	if rows == "" {
 		t.Fatal("internal/tui3/commands.go offers no /crew row")
 	}
-	// The two sentences the rows say the count in, as [quotedIn] writes them:
-	// a hole where the figure goes, filled from config rather than from either
-	// sentence. A reword that loses one of them fails here too, loudly, which is
-	// the right answer for a row that has stopped saying how many seats there are.
-	for _, pattern := range []string{"the %s models codeaf uses", "set the %s to"} {
-		if want := fmt.Sprintf(pattern, seats); !strings.Contains(rows, want) {
-			t.Errorf("no /crew row says %q — config.ModelTiers has %d seats:\n%s",
-				want, len(config.ModelTiers), rows)
+	for _, seat := range crewroute.Seats {
+		if !strings.Contains(rows, string(seat)) {
+			t.Errorf("no /crew row names the %s — crewroute.Seats has it:\n%s", seat, rows)
 		}
-		for _, other := range notSeats {
-			if stale := fmt.Sprintf(pattern, other); strings.Contains(rows, stale) {
-				t.Errorf("a /crew row still says %q — config.ModelTiers has %d seats, spelled %q",
-					stale, len(config.ModelTiers), seats)
-			}
+	}
+	pages := flatChatPages(t)
+	for _, seat := range crewroute.Seats {
+		if !strings.Contains(pages["models-and-cost"], "**"+string(seat)+"**") {
+			t.Errorf("models-and-cost never names the %s seat in bold", seat)
 		}
 	}
 }
diff --git a/internal/orchestrate/fuel.go b/internal/orchestrate/fuel.go
index 651a69feab..a1ecc9f56d 100644
--- a/internal/orchestrate/fuel.go
+++ b/internal/orchestrate/fuel.go
@@ -94,7 +94,8 @@ func CatalogPrices(priceNow func(model string) (prompt, completion float64, know
 // all, which is common enough that a run metering only reported costs would
 // have a tank that never empties.
 //
-// The rows are the ids the shipped defaults and crew tables name, each copied
+// The rows are the ids the shipped defaults and the crew router's evidence
+// table name (internal/crewroute's prior.json), each copied
 // from the catalog's published price on the day its row was written; the
 // installed tariff ([CatalogPrices]) is what answers when a catalog is present,
 // and this table is only the fallback behind it.
diff --git a/internal/pool/judge/judge.go b/internal/pool/judge/judge.go
index 56d9539cbf..084dae8fa9 100644
--- a/internal/pool/judge/judge.go
+++ b/internal/pool/judge/judge.go
@@ -7,9 +7,8 @@
 // [Ask], which sends a system and a user prompt and returns the answer. One
 // question is asked per seat, in role order, and each answer is read as one
 // JSON object carrying a score from 0 to 100 and a one-sentence reason. That is
-// the same scale crewpick reads seat quality on and a pool records its
-// role_quality metric in, so a run's seats land on the scale the picker already
-// uses.
+// the scale a pool records its role_quality metric in, so a run's seats land
+// on one scale across every install.
 //
 // THE CALLER OWNS THE CALL. This package touches no disk and no network and
 // holds no credentials: the model, the transport and the bill are the caller's,
diff --git a/internal/pool/judge/judge_test.go b/internal/pool/judge/judge_test.go
index fd62c7219d..f5f449e0c2 100644
--- a/internal/pool/judge/judge_test.go
+++ b/internal/pool/judge/judge_test.go
@@ -167,7 +167,7 @@ func TestARecordWithNoSeatsScoresNothingAndFailsNothing(t *testing.T) {
 	}
 }
 
-func TestPickExcludesCrewModelsAndTheWorkerVendor(t *testing.T) {
+func TestPickExcludesTheCrewsOwnModelsAndTheWorkerVendor(t *testing.T) {
 	models := []catalog.Model{
 		{ID: "worker-vendor/cheap", PromptPrice: 0.1, CompletionPrice: 0.1, CodingIndex: 90, Parameters: []string{"tools"}},
 		{ID: "other/crew-held", PromptPrice: 0.2, CompletionPrice: 0.2, CodingIndex: 90, Parameters: []string{"tools"}},
diff --git a/internal/pool/record/record.go b/internal/pool/record/record.go
index 271627b726..7f84822c49 100644
--- a/internal/pool/record/record.go
+++ b/internal/pool/record/record.go
@@ -4,16 +4,16 @@
 //
 // THE MECHANISM. [Recorder.Record] takes the scores [judge.Judge] answered and
 // does two things with them. Every valid one is observed into the sheet the
-// recorder holds, under the role_quality metric the crew picker reads seat
-// quality from, and one row is appended to the recorder's outbox when it holds
+// recorder holds, under the role_quality metric, and one row is appended to
+// the recorder's outbox when it holds
 // one. A score whose role is not one of the judged seats, or that is not on
 // the 0-100 scale, is skipped and named in the error; the others are recorded
 // however the round went, and the sheet is observed whatever the outbox does.
 // A nil outbox records locally only.
 //
 // The sheet an install keeps of its own scores is its own evidence: it is
-// saved under the pool directory ([OwnSheetName]) and read back as the cells
-// the crew picker's prior blends in beside an index's ([Cells]).
+// saved under the pool directory ([OwnSheetName]) and read back as cells
+// ([Cells]) — which `codeaf pool` lists beside the index's.
 package record
 
 import (
@@ -26,14 +26,12 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Agent-Field/codeaf/internal/crewpick"
 	"github.com/Agent-Field/codeaf/internal/pool/judge"
 	"github.com/Agent-Field/codeaf/internal/pool/outbox"
 	"github.com/Agent-Field/codeaf/internal/pool/tally"
 )
 
-// Metric is the sheet metric a judged seat score is observed under: the word
-// the crew picker reads a measured seat quality from.
+// Metric is the sheet metric a judged seat score is observed under.
 const Metric = "role_quality"
 
 // OwnSheetName is the file the install's own sheet is kept as, under the pool
@@ -225,21 +223,29 @@ func (r *Recorder) Record(scores []judge.Score, judgeModel, door, size, day stri
 	return errors.Join(errs...)
 }
 
+// Cell is one seat's measured quality on a sheet: the seat, the model, the
+// mean of its 0-100 scores and how many stand behind it.
+type Cell struct {
+	Role  string
+	Model string
+	Mean  float64
+	N     int
+}
+
 // Cells reads the sheet's own role_quality cells — the ones recorded with no
-// dim labels — as the cells a prior reads: the seat, the model, the mean of
-// the scores and the count behind them, sorted by seat then model, so the
-// answer is a property of the sheet and never of the order it was observed
-// in. A nil sheet answers no cells.
-func Cells(s *tally.Sheet) []crewpick.Cell {
+// dim labels — sorted by seat then model, so the answer is a property of the
+// sheet and never of the order it was observed in. A nil sheet answers no
+// cells.
+func Cells(s *tally.Sheet) []Cell {
 	if s == nil {
 		return nil
 	}
-	var cells []crewpick.Cell
+	var cells []Cell
 	s.Each(Metric, func(role, model string, dims map[string]string, c tally.Cell) {
 		if dims != nil {
 			return
 		}
-		cells = append(cells, crewpick.Cell{Role: role, Model: model, Mean: c.Mean(), N: int(c.N)})
+		cells = append(cells, Cell{Role: role, Model: model, Mean: c.Mean(), N: int(c.N)})
 	})
 	return cells
 }
diff --git a/internal/pool/record/record_test.go b/internal/pool/record/record_test.go
index 1b639394a6..c7b007b1b0 100644
--- a/internal/pool/record/record_test.go
+++ b/internal/pool/record/record_test.go
@@ -9,7 +9,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Agent-Field/codeaf/internal/crewpick"
 	"github.com/Agent-Field/codeaf/internal/pool/judge"
 	"github.com/Agent-Field/codeaf/internal/pool/outbox"
 	"github.com/Agent-Field/codeaf/internal/pool/tally"
@@ -317,7 +316,7 @@ func TestCellsAnswerSortedAndCarryTheMeanAndCount(t *testing.T) {
 	if len(got) != 3 {
 		t.Fatalf("%d cells answered, want the three plain ones: %+v", len(got), got)
 	}
-	want := []crewpick.Cell{
+	want := []Cell{
 		{Role: "high", Model: "c/top", Mean: 70, N: 1},
 		{Role: "worker", Model: "a/first", Mean: 85, N: 2},
 		{Role: "worker", Model: "b/later", Mean: 60, N: 1},
diff --git a/internal/provider/client.go b/internal/provider/client.go
index a97ea9cdc1..084ab3315e 100644
--- a/internal/provider/client.go
+++ b/internal/provider/client.go
@@ -63,6 +63,13 @@ type Config struct {
 	Effort  Effort
 	Timeout time.Duration
 
+	// RouteGate, when set, is asked before every body this client sends, with
+	// the model the body names and the call's tag ([WithCallTag]); an error
+	// is the call's answer and nothing is sent. It is how a session keeps
+	// EVERY road — a helper, a child's loop, a road that carries a client of
+	// its own — off a route its route health says will not answer, at the one
+	// door every body passes, rather than caller by caller.
+	RouteGate func(ctx context.Context, model, tag string) error
 	// SupportsParameter answers "does this model accept this request field?"
 	// from data already in memory. It must not block or perform I/O; an unknown
 	// answer is reported by returning known=false, never by waiting.
diff --git a/internal/provider/dispatch.go b/internal/provider/dispatch.go
index f485597a6d..89032c2424 100644
--- a/internal/provider/dispatch.go
+++ b/internal/provider/dispatch.go
@@ -260,6 +260,11 @@ func (c *Client) send(ctx context.Context, request *ai.Request, knobs callKnobs,
 	tellRetiredPins(ctx)
 	tellUncarriedPins(ctx)
 	tellTakeover(ctx)
+	if gate := c.config.RouteGate; gate != nil {
+		if err := gate(ctx, c.modelFor(request), callTag(ctx)); err != nil {
+			return nil, err
+		}
+	}
 	var lastErr error
 	// The wait is sized for the reply the request PERMITS — the caller's answer
 	// plus the thinking pass's room — and not for the caller's figure alone.
@@ -529,6 +534,12 @@ func (c *Client) send(ctx context.Context, request *ai.Request, knobs callKnobs,
 			//
 			// The cap is still the cap: [maxProviderWait] bounds one wait
 			// whatever asked for it, which is what keeps an interrupt prompt.
+			// A CALL THAT HANDS A LIMIT BACK DOES NOT SIT IT OUT (patience.go's
+			// [WithoutPatientRateLimits]): its caller's next move is another
+			// route or another model, which beats any window.
+			if handsBackRateLimits(ctx, lastErr) {
+				return nil, lastErr
+			}
 			delay := backoffFor(attempt, providerWait)
 			if move.Kind == control.MoveWait && move.Wait > 0 {
 				delay = min(move.Wait, maxProviderWait)
diff --git a/internal/provider/patience.go b/internal/provider/patience.go
index 83d68bdc2e..71f8a1d4df 100644
--- a/internal/provider/patience.go
+++ b/internal/provider/patience.go
@@ -1,6 +1,9 @@
 package provider
 
-import "context"
+import (
+	"context"
+	"net/http"
+)
 
 // Patience is how ONE OUTBOUND CALL answers a provider that is pacing it, and
 // the two seams here are the whole of it: how long a 429 is worth waiting out,
@@ -67,6 +70,37 @@ func WithPatientRateLimits(ctx context.Context) context.Context {
 	return context.WithValue(ctx, patienceKey{}, true)
 }
 
+// WithoutPatientRateLimits takes the patience off every call made under ctx,
+// whatever an outer context granted: a 429 on every machine the request may
+// use is handed straight back. A crew seat asks this way, because its answer
+// to "not yet" is its next route or its next model, never a wait — a pool at
+// its daily limit that is waited on a minute at a time holds a task for as
+// long as the limit lasts.
+//
+// AND IT NEVER WAITS ON THE SAME MACHINE AFTER A 429: a free move to another
+// machine is still made at once, but the wait that would follow — the
+// machine's named window, or our doubling — is not sat out; the refusal is
+// handed back instead ([handsBackRateLimits]).
+func WithoutPatientRateLimits(ctx context.Context) context.Context {
+	return context.WithValue(context.WithValue(ctx, patienceKey{}, false), handBackKey{}, true)
+}
+
+// handBackKey marks a call that hands a rate limit back rather than wait.
+type handBackKey struct{}
+
+// handsBackRateLimits is whether lastErr is a rate limit this call hands back
+// rather than wait out.
+func handsBackRateLimits(ctx context.Context, lastErr error) bool {
+	if ctx == nil || lastErr == nil {
+		return false
+	}
+	if on, _ := ctx.Value(handBackKey{}).(bool); !on {
+		return false
+	}
+	refusal, ok := RefusalFrom(lastErr)
+	return ok && refusal.Status == http.StatusTooManyRequests
+}
+
 // patientRateLimits reports whether this call waits pacing out.
 func patientRateLimits(ctx context.Context) bool {
 	if ctx == nil {
diff --git a/internal/provider/routefailure.go b/internal/provider/routefailure.go
new file mode 100644
index 0000000000..bf6c9423ae
--- /dev/null
+++ b/internal/provider/routefailure.go
@@ -0,0 +1,146 @@
+package provider
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// WHAT A FAILED CALL SAYS ABOUT THE ROUTE IT WAS SENT ON.
+//
+// The crew router picks a model AND a route to it — a provider, a send id, a
+// price — and when a seat's call fails, what happens next depends on what the
+// failure says about that route: whether the account behind it is out of
+// credit, whether the key is bad, whether this route will never take this
+// model, whether it is only busy. Each provider spells those differently; this
+// is where they are read, once, into a handful of kinds nobody downstream has
+// to re-read from a status or a sentence. The router and the seat fallback see
+// only the kinds (internal/crewroute, internal/session's taskcrew.go).
+//
+// It reads the facts the refusal door already decided about the error
+// ([APIError]'s Payment, Withdrawn, PlanPaused, PlanUnavailable) and the
+// status, and nothing else from the prose but the few phrases providers use
+// for "this model is not available to you here".
+
+// RouteFailure is one kind of route failure.
+type RouteFailure string
+
+const (
+	// RoutePayment is the account behind the route out of credit (402, an
+	// "insufficient credits" refusal): every PAID route on that account is
+	// unaffordable until a paid call on it succeeds again.
+	RoutePayment RouteFailure = "payment"
+	// RouteAuth is the key refused (401): the provider is disconnected until
+	// the person reconnects it.
+	RouteAuth RouteFailure = "auth"
+	// RouteForbidden is this route refusing this model for this account or
+	// plan (403, "only available on…", a data-policy exclusion): the route is
+	// quarantined; the model may still be reachable elsewhere.
+	RouteForbidden RouteFailure = "forbidden"
+	// RouteQuota is a limit reached (429, a paused plan window, a daily cap):
+	// the route cools down until the reset, when one was said.
+	RouteQuota RouteFailure = "quota"
+	// RouteUnavailable is the model not served here any more (404, withdrawn):
+	// the route cools down and the model is demoted.
+	RouteUnavailable RouteFailure = "unavailable"
+	// RouteTransient is a single timeout or 5xx: asked again once, no verdict
+	// about the route.
+	RouteTransient RouteFailure = "transient"
+)
+
+// forbiddenPhrases are how providers word "not for you on this route" in a
+// refusal whose status alone does not say it. Each is a provider's own words.
+var forbiddenPhrases = []string{
+	"only available on",
+	"not available for your",
+	"not allowed to use",
+	"does not have access",
+	"data policy",
+	"guardrail restrictions",
+}
+
+// paymentPhrases are how providers word an empty balance under a status that
+// is not 402.
+var paymentPhrases = []string{
+	"insufficient credit",
+	"insufficient balance",
+	"insufficient_quota",
+	"credit balance is too low",
+	"requires more credits",
+	"exceeded your current quota",
+}
+
+// RouteFailureOf reads one call's error as a route failure: the kind, and when
+// the route may be asked again if the provider said (zero when it did not). An
+// error that says nothing about the route — a request nothing could serve, a
+// cancelled context — answers "".
+func RouteFailureOf(err error) (RouteFailure, time.Time) {
+	if err == nil || errors.Is(err, context.Canceled) {
+		return "", time.Time{}
+	}
+	var paused *PlanPauseError
+	if errors.As(err, &paused) {
+		return RouteQuota, parseReset(paused.Reset)
+	}
+	refusal, ok := RefusalFrom(err)
+	if !ok {
+		var unavailable *ConnectionUnavailableError
+		if errors.Is(err, context.DeadlineExceeded) || errors.As(err, &unavailable) || terminalTransportFailureFrom(err) {
+			return RouteTransient, time.Time{}
+		}
+		return "", time.Time{}
+	}
+	said := strings.ToLower(refusal.Message + " " + refusal.Raw + " " + refusal.Code)
+	switch {
+	case refusal.Payment || refusal.Status == http.StatusPaymentRequired || holdsAny(said, paymentPhrases):
+		return RoutePayment, time.Time{}
+	case refusal.Status == http.StatusUnauthorized:
+		return RouteAuth, time.Time{}
+	case refusal.PlanPaused || refusal.Status == http.StatusTooManyRequests:
+		return RouteQuota, time.Time{}
+	case refusal.Withdrawn:
+		return RouteUnavailable, time.Time{}
+	case refusal.Status == http.StatusForbidden || refusal.PlanUnavailable || holdsAny(said, forbiddenPhrases):
+		return RouteForbidden, time.Time{}
+	case refusal.Status == http.StatusNotFound:
+		return RouteUnavailable, time.Time{}
+	case refusal.Status >= http.StatusInternalServerError:
+		return RouteTransient, time.Time{}
+	}
+	return "", time.Time{}
+}
+
+// holdsAny is whether text holds any of the phrases.
+func holdsAny(text string, phrases []string) bool {
+	for _, p := range phrases {
+		if strings.Contains(text, p) {
+			return true
+		}
+	}
+	return false
+}
+
+// parseReset reads a reset a provider said, in either of the spellings seen:
+// an RFC 3339 instant, or a clock time today.
+func parseReset(raw string) time.Time {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return time.Time{}
+	}
+	if at, err := time.Parse(time.RFC3339, raw); err == nil {
+		return at
+	}
+	for _, layout := range []string{"15:04", "3:04pm", "3pm"} {
+		if clock, err := time.Parse(layout, strings.ToLower(raw)); err == nil {
+			now := time.Now()
+			at := time.Date(now.Year(), now.Month(), now.Day(), clock.Hour(), clock.Minute(), 0, 0, now.Location())
+			if at.Before(now) {
+				at = at.Add(24 * time.Hour)
+			}
+			return at
+		}
+	}
+	return time.Time{}
+}
diff --git a/internal/provider/routefailure_test.go b/internal/provider/routefailure_test.go
new file mode 100644
index 0000000000..765b500483
--- /dev/null
+++ b/internal/provider/routefailure_test.go
@@ -0,0 +1,70 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+)
+
+// EVERY PROVIDER'S WORDS FOR ONE FAILURE READ AS ONE KIND. The bodies are the
+// shapes each provider answers with — OpenRouter's envelope, OpenAI's, a
+// Fireworks-style detail, Anthropic's — and the router downstream sees only
+// the kind.
+func TestRouteFailureReadsEachProvidersWordsAsOneKind(t *testing.T) {
+	cases := []struct {
+		name   string
+		status int
+		body   string
+		want   RouteFailure
+	}{
+		{"openrouter no credit", 402, `{"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}`, RoutePayment},
+		{"openai quota is a balance", 429, `{"error":{"message":"You exceeded your current quota, please check your plan and billing details.","type":"insufficient_quota","code":"insufficient_quota"}}`, RoutePayment},
+		{"anthropic low balance", 400, `{"type":"error","error":{"type":"invalid_request_error","message":"Your credit balance is too low to access the Anthropic API."}}`, RoutePayment},
+		{"bad key", 401, `{"error":{"message":"No auth credentials found","code":401}}`, RouteAuth},
+		{"free pool for harnesses only", 403, `{"error":{"message":"thinkingmachines/inkling-small:free is only available on agentic harnesses","code":403}}`, RouteForbidden},
+		{"privacy excluded every endpoint", 404, `{"error":{"message":"No endpoints found matching your data policy (Free model publication). Configure: https://openrouter.ai/settings/privacy","code":404}}`, RouteForbidden},
+		{"rate limited", 429, `{"error":{"message":"Rate limit exceeded: free-models-per-day. ","code":429}}`, RouteQuota},
+		{"model gone", 404, `{"error":{"code":"NOT_FOUND","message":"Model not found, inaccessible, and/or not deployed"}}`, RouteUnavailable},
+		{"upstream 5xx", 503, `{"error":{"message":"Service Unavailable","code":503}}`, RouteTransient},
+		{"our own bytes", 400, `{"error":{"message":"messages: at least one message is required","code":400}}`, ""},
+	}
+	for _, tc := range cases {
+		got, _ := RouteFailureOf(apiError(tc.status, []byte(tc.body)))
+		if got != tc.want {
+			t.Errorf("%s (%d): %q, want %q", tc.name, tc.status, got, tc.want)
+		}
+	}
+}
+
+// A WITHDRAWN MODEL AND A PAUSED PLAN ARE READ FROM THE FACTS THE REFUSAL DOOR
+// STAMPED, not from the prose.
+func TestRouteFailureReadsTheStampedFacts(t *testing.T) {
+	withdrawn := &APIError{Status: 404, Withdrawn: true}
+	if got, _ := RouteFailureOf(withdrawn); got != RouteUnavailable {
+		t.Errorf("withdrawn: %q", got)
+	}
+	paid := &APIError{Status: 403, Payment: true}
+	if got, _ := RouteFailureOf(paid); got != RoutePayment {
+		t.Errorf("payment fact: %q", got)
+	}
+	reset := time.Now().Add(2 * time.Hour).UTC().Truncate(time.Second)
+	paused := &PlanPauseError{Reset: reset.Format(time.RFC3339), Cause: fmt.Errorf("paused")}
+	got, at := RouteFailureOf(paused)
+	if got != RouteQuota || !at.Equal(reset) {
+		t.Errorf("paused plan: %q until %v, want quota until %v", got, at, reset)
+	}
+}
+
+// A DEADLINE IS TRANSIENT, A CANCELLATION IS NOBODY'S FAILURE.
+func TestRouteFailureOnTheWire(t *testing.T) {
+	if got, _ := RouteFailureOf(fmt.Errorf("call: %w", context.DeadlineExceeded)); got != RouteTransient {
+		t.Errorf("deadline: %q", got)
+	}
+	if got, _ := RouteFailureOf(fmt.Errorf("call: %w", context.Canceled)); got != "" {
+		t.Errorf("cancelled: %q", got)
+	}
+	if got, _ := RouteFailureOf(nil); got != "" {
+		t.Errorf("nil: %q", got)
+	}
+}
diff --git a/internal/remote/client.go b/internal/remote/client.go
index 5a28082ae4..da2e6594ea 100644
--- a/internal/remote/client.go
+++ b/internal/remote/client.go
@@ -1559,6 +1559,35 @@ func (a *Agent) StartTask(ctx context.Context, brief string, solo bool) (uint64,
 	return started.ID, started.Title, started.Note, nil
 }
 
+// StartTaskEffort is [Agent.StartTask] with the one-task effort word said
+// (`/task --best`, `/task --cheap`); the engine's router reads it for this task
+// and nothing after it.
+func (a *Agent) StartTaskEffort(ctx context.Context, brief string, solo bool, effort string) (uint64, string, string, error) {
+	payload, err := a.c.call(ctx, MethodTaskStart, TaskStartArgs{Brief: brief, Solo: solo, Effort: effort})
+	if err != nil {
+		return 0, "", "", err
+	}
+	var started TaskStarted
+	if err := json.Unmarshal(payload, &started); err != nil {
+		return 0, "", "", err
+	}
+	return started.ID, started.Title, started.Note, nil
+}
+
+// RedoStronger runs a task again on the engine machine with a stronger crew
+// (`/redo stronger`); row 0 is the newest task the conversation started.
+func (a *Agent) RedoStronger(ctx context.Context, row uint64) (uint64, string, error) {
+	payload, err := a.c.call(ctx, MethodTaskRedoStronger, TaskRedoArgs{ID: row})
+	if err != nil {
+		return 0, "", err
+	}
+	var started TaskStarted
+	if err := json.Unmarshal(payload, &started); err != nil {
+		return 0, "", err
+	}
+	return started.ID, started.Title, nil
+}
+
 // StartPlannerRun opens the adaptive form on the engine machine.
 func (a *Agent) StartPlannerRun(ctx context.Context, brief, hint string) (string, string, error) {
 	payload, err := a.c.call(ctx, MethodPlannerStart, PlannerStartArgs{Brief: brief, Hint: hint})
diff --git a/internal/remote/server.go b/internal/remote/server.go
index fb5ac16abd..0530313d10 100644
--- a/internal/remote/server.go
+++ b/internal/remote/server.go
@@ -2306,11 +2306,43 @@ func (s *server) invoke(call Frame) (out json.RawMessage, err error) {
 		if err != nil {
 			return nil, err
 		}
+		// AN EFFORT WORD THIS ENGINE CANNOT HONOUR IS REFUSED, NEVER DROPPED:
+		// the person said how hard to try this task, and a start on the crew
+		// they would have had anyway is the silence version 18 exists to end.
+		if args.Effort != "" {
+			effortDoor, ok := agent.(interface {
+				StartTaskEffort(context.Context, string, bool, string) (uint64, string, string, error)
+			})
+			if !ok {
+				return nil, errors.New("engine: this session cannot choose a task's crew")
+			}
+			id, title, note, err := effortDoor.StartTaskEffort(context.Background(), args.Brief, args.Solo, args.Effort)
+			if err != nil {
+				return nil, err
+			}
+			return json.Marshal(TaskStarted{ID: id, Title: title, Note: note})
+		}
 		id, title, note, err := door.StartTask(context.Background(), args.Brief, args.Solo)
 		if err != nil {
 			return nil, err
 		}
 		return json.Marshal(TaskStarted{ID: id, Title: title, Note: note})
+	case MethodTaskRedoStronger:
+		door, ok := agent.(interface {
+			RedoStronger(context.Context, uint64) (uint64, string, error)
+		})
+		if !ok {
+			return nil, errors.New("engine: this session has no task door")
+		}
+		args, err := arg[TaskRedoArgs](call)
+		if err != nil {
+			return nil, err
+		}
+		id, title, err := door.RedoStronger(context.Background(), args.ID)
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(TaskStarted{ID: id, Title: title})
 	case MethodPlannerStart:
 		door, ok := agent.(interface {
 			StartPlannerRun(context.Context, string, string) (string, string, error)
diff --git a/internal/remote/wire.go b/internal/remote/wire.go
index 88e39f3ff4..343578da83 100644
--- a/internal/remote/wire.go
+++ b/internal/remote/wire.go
@@ -344,7 +344,13 @@ import (
 // ReplaceQuestion. It also carries whether a caller has no approval resolver.
 // Older peers must refuse before a question or an unwatched tool can run under
 // semantics the other side does not understand.
-const Version = 17
+// VERSION 18 IS THE CREW PICKED PER TASK. [TaskStartArgs] carries the one-task
+// effort word (`/task --best`, `/task --cheap`), and [MethodTaskRedoStronger]
+// runs the last task again on a stronger crew. The number moves because both
+// fail as silence on an older engine: a version-17 engine reads `effort` as a
+// field it does not know and starts the task on the crew it would have had,
+// and the person is never told their word did nothing. NEVER TO SILENCE.
+const Version = 18
 
 // AND THE NEWS FRAMES RIDE THAT SAME NUMBER, for the reason the places methods
 // rode version 5's: neither half can be surprised by them. "phase" and "lane"
diff --git a/internal/remote/wire_task.go b/internal/remote/wire_task.go
index 276b6e547f..40230aa5f2 100644
--- a/internal/remote/wire_task.go
+++ b/internal/remote/wire_task.go
@@ -6,15 +6,18 @@ import "time"
 // machine. The surface sends intent; sizing, shaping, admission and spending
 // remain with the session agent that owns the conversation.
 const (
-	MethodTaskStart     = "Task.Start"
-	MethodPlannerStart  = "Task.StartPlanner"
-	MethodTaskRoom      = "Task.Room"
-	MethodTaskSteer     = "Task.Steer"
-	MethodTaskStop      = "Task.Stop"
-	MethodTaskRetry     = "Task.Retry"
-	MethodTaskModel     = "Task.Model"
-	MethodTaskEffort    = "Task.Effort"
-	MethodTaskSetEffort = "Task.SetEffort"
+	MethodTaskStart = "Task.Start"
+	// MethodTaskRedoStronger runs the newest task again with every seat nobody
+	// pinned one step stronger ([session.Agent.RedoStronger]).
+	MethodTaskRedoStronger = "Task.RedoStronger"
+	MethodPlannerStart     = "Task.StartPlanner"
+	MethodTaskRoom         = "Task.Room"
+	MethodTaskSteer        = "Task.Steer"
+	MethodTaskStop         = "Task.Stop"
+	MethodTaskRetry        = "Task.Retry"
+	MethodTaskModel        = "Task.Model"
+	MethodTaskEffort       = "Task.Effort"
+	MethodTaskSetEffort    = "Task.SetEffort"
 	// MethodTaskWatch is the surface saying it draws tasks, and it is the only
 	// one of these that asks for nothing back: what it buys is the engine
 	// pushing "task" frames from then on (tasklane.go). It is sent once per
@@ -152,9 +155,18 @@ type TaskStopped struct {
 // whether they said the work is one worker's ([session.Agent.StartTask]'s solo):
 // that is the one thing the surface knows and the engine cannot, because the
 // word and the standing answer are both read on the surface's side.
+//
+// Effort is the one-task effort word the person said (`best`, `cheap`), read on
+// the surface's side like solo, and empty on every ordinary start.
 type TaskStartArgs struct {
-	Brief string `json:"brief"`
-	Solo  bool   `json:"solo,omitempty"`
+	Brief  string `json:"brief"`
+	Solo   bool   `json:"solo,omitempty"`
+	Effort string `json:"effort,omitempty"`
+}
+
+// TaskRedoArgs names the task to run again stronger; 0 is the newest one.
+type TaskRedoArgs struct {
+	ID uint64 `json:"id,omitempty"`
 }
 
 // PlannerStartArgs also carries the sizing hint used by the adaptive form.
diff --git a/internal/router/crew.go b/internal/router/crew.go
new file mode 100644
index 0000000000..1decbcad7d
--- /dev/null
+++ b/internal/router/crew.go
@@ -0,0 +1,463 @@
+package router
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"math"
+	"os"
+	"sort"
+	"strings"
+	"time"
+)
+
+// A CREW'S DECISION AND ITS OUTCOME, IN THE SAME DIARY AS EVERY OTHER ROUTE.
+//
+// The crew router (internal/crewroute) picks a task's worker, planner and
+// checker from the class of work the task is, and what it learns from —
+// whether the person accepted the result or asked for it redone stronger — is
+// exactly the kind of row this log exists to keep: a decision with the
+// candidates it was made among, and a later row that settles it. So the crew
+// writes here, under [CrewClass], rather than into a second file that would be
+// a second answer to "what did the router do and how did it go".
+//
+// Two rows per task, joined by the call id: the DECISION, written when the
+// crew is picked, and the OUTCOME, written Final when the task is accepted or
+// redone. A reader takes the last row for a call id as the truth, the same
+// rule every other row here keeps.
+
+// CrewClass is the class every crew row is written under.
+const CrewClass = "crew"
+
+// The outcomes a crew row settles with.
+const (
+	// CrewAccepted is a task whose result was kept: it landed, or the person
+	// took it.
+	CrewAccepted = "accepted"
+	// CrewRedone is a task the person asked to be done again by a stronger
+	// crew. It is the learning signal: the class was under-served here.
+	CrewRedone = "redo stronger"
+	// CrewNotKept is a task that ended without a result anybody kept — it
+	// failed, or was stopped. It teaches nothing about the crew's strength.
+	CrewNotKept = "not kept"
+)
+
+// CrewRecord is the crew half of a row.
+type CrewRecord struct {
+	// TaskClass is the class the task was read as — bugfix, openended, other.
+	TaskClass string `json:"task_class"`
+	// TaskSubclass is, for a bugfix, "complex" or "simple", and TaskReach the
+	// signals that made it complex. They are the log's alone: every line a
+	// person reads says bugfix.
+	TaskSubclass string `json:"task_subclass,omitempty"`
+	TaskReach    string `json:"task_reach,omitempty"`
+	// Repo is the repository the task ran in, the key the learned offset is
+	// kept under.
+	Repo   string `json:"repo,omitempty"`
+	Title  string `json:"title,omitempty"`
+	Effort string `json:"effort,omitempty"`
+	Steps  int    `json:"steps,omitempty"`
+	// Seats is seat → the id that ran; Providers seat → the route; Kinds
+	// seat → how that route bills (metered, plan, local).
+	Seats     map[string]string `json:"seats"`
+	Providers map[string]string `json:"providers,omitempty"`
+	Kinds     map[string]string `json:"kinds,omitempty"`
+	Pinned    []string          `json:"pinned,omitempty"`
+	EstUSD    float64           `json:"est_usd,omitempty"`
+	// Failed is seat → the id that failed to start on it, on a row written
+	// when a seat's first call was refused ([LogCrewRoute]), with the kind of
+	// failure, the provider of the route and when it said it may be asked
+	// again. Started is seat → the id whose first call answered. Both are
+	// ROUTE outcomes — did the call work — and never the task's.
+	Failed      map[string]string `json:"failed,omitempty"`
+	FailKind    string            `json:"fail_kind,omitempty"`
+	FailRoute   string            `json:"fail_route,omitempty"`
+	FailUntil   time.Time         `json:"fail_until,omitempty"`
+	Started     map[string]string `json:"started,omitempty"`
+	StartedPaid bool              `json:"started_paid,omitempty"`
+	// Redo is a row of a task that was itself a redo: its acceptance is the
+	// redo's own and decays no offset — only a LATER accepted task of the
+	// class there does.
+	Redo bool `json:"redo,omitempty"`
+	// EstBase is the estimate before this install's learned factor, the one
+	// the factor is learned against ([CrewLog.CostFactor]).
+	EstBase float64 `json:"est_base,omitempty"`
+	// Top is, per seat, the best few candidates the decision weighed, with
+	// their route, quality, cost and score: why the crew is the crew.
+	Top map[string][]CrewScore `json:"top,omitempty"`
+	// Learned is seat → the move this install's own outcomes made to the
+	// seat's model's quality when the crew was picked ([CrewLog.Quality]).
+	Learned map[string]float64 `json:"learned,omitempty"`
+}
+
+// CrewScore is one weighed candidate on a decision row, kept short.
+type CrewScore struct {
+	Model string  `json:"m"`
+	Route string  `json:"r,omitempty"`
+	Q     float64 `json:"q"`
+	C     float64 `json:"c"`
+	S     float64 `json:"s"`
+}
+
+// LogCrewDecision appends a crew's decision row. Best-effort by construction:
+// a log that will not open costs a lesson, never a task.
+func LogCrewDecision(dir, call string, record CrewRecord, candidates []string) {
+	events, err := OpenEvents(dir)
+	if err != nil {
+		return
+	}
+	defer events.Close()
+	events.Append(Event{Call: call, Run: record.Repo, Class: CrewClass, Shape: record.TaskClass,
+		Candidates: candidates, Model: record.Seats["worker"], Crew: &record})
+}
+
+// LogCrewOutcome appends the row that settles a crew's decision.
+func LogCrewOutcome(dir, call string, record CrewRecord, outcome string, costUSD float64) {
+	events, err := OpenEvents(dir)
+	if err != nil {
+		return
+	}
+	defer events.Close()
+	events.Append(Event{Call: call, Run: record.Repo, Class: CrewClass, Shape: record.TaskClass,
+		Model: record.Seats["worker"], Crew: &record, Final: true, Outcome: outcome, Cost: costUSD})
+}
+
+// CrewRouteOutcome is one seat's first call on one route, as the log keeps it:
+// the route answered (Kind empty), or it failed with a kind of failure
+// (internal/provider's RouteFailure words), on a provider, until a time it
+// may be asked again.
+type CrewRouteOutcome struct {
+	At       time.Time
+	Seat     string
+	Send     string
+	Provider string
+	// Paid is whether the route bills per token — a success on a paid route is
+	// what clears an account's payment failure.
+	Paid  bool
+	Kind  string
+	Until time.Time
+}
+
+// LogCrewRoute appends one route outcome for a task's crew. It is not the
+// task's ending, so it is written as a decision row, never a final one.
+func LogCrewRoute(dir, call string, record CrewRecord, outcome CrewRouteOutcome) {
+	events, err := OpenEvents(dir)
+	if err != nil {
+		return
+	}
+	defer events.Close()
+	if outcome.Kind == "" {
+		record.Started = map[string]string{outcome.Seat: outcome.Send}
+		record.StartedPaid = outcome.Paid
+	} else {
+		record.Failed = map[string]string{outcome.Seat: outcome.Send}
+		record.FailKind, record.FailRoute, record.FailUntil = outcome.Kind, outcome.Provider, outcome.Until
+	}
+	events.Append(Event{Call: call, Run: record.Repo, Class: CrewClass, Shape: record.TaskClass,
+		Model: outcome.Send, Crew: &record})
+}
+
+// crewOutcomesFor is how far back route outcomes are read: longer than the
+// longest quarantine any of them sets.
+const crewOutcomesFor = 14 * 24 * time.Hour
+
+// CrewTask is one task as the log remembers it.
+type CrewTask struct {
+	At      time.Time
+	Call    string
+	Record  CrewRecord
+	Outcome string
+	CostUSD float64
+	Settled bool
+}
+
+// CrewLog is what the log says about crews.
+type CrewLog struct {
+	// SpentUSD is today's settled crew spend; Tasks, OnPlan and Local count
+	// today's tasks, and how many of them ran their worker on a subscription
+	// plan or a local model.
+	SpentUSD float64
+	Tasks    int
+	OnPlan   int
+	Local    int
+	// ProviderUSD is today's settled crew spend by the provider that carried
+	// it ([crewProviderShares]), for the /crew panel's list of providers.
+	ProviderUSD map[string]float64
+	// Recent is the last few tasks, newest first.
+	Recent []CrewTask
+	// Offsets is the learned escalation offset per repository and class,
+	// keyed repo + "\x00" + class.
+	Offsets map[string]int
+	// LastGood is the crew of the newest task whose result was kept — the
+	// crew known to work on this install, a seat's last resort before the
+	// person's own model when nothing routed can start.
+	LastGood *CrewRecord
+	// Routes are the recent first-call outcomes of every route a crew seat
+	// was sent on, oldest first — what route health is read from.
+	Routes []CrewRouteOutcome
+	// CostFactor is, per class, what this install's recent paid tasks cost
+	// against the estimate they were routed with — the geometric mean of
+	// actual over estimate, shrunk toward one while there are few, and kept
+	// within a factor of three. A class with no settled paid task has none.
+	CostFactor map[string]float64
+	// Quality is this install's learned move to a model's quality in a seat,
+	// keyed [QualityKey] with the id the seat ran: every settled task moves
+	// each of its seats' models a small step toward +learnBound when its
+	// result was kept, toward −learnBound when it was redone stronger, and
+	// half as far down when it was not kept. The move never leaves
+	// ±learnBound quality points.
+	Quality map[string]float64
+}
+
+// The per-install quality update: how far one task moves a model's learned
+// quality toward the bound, and the bound itself, in quality points.
+const (
+	learnRate  = 0.1
+	learnBound = 1.0
+)
+
+// QualityKey is the key [CrewLog.Quality] is kept under: the class, the seat
+// and the id the seat ran.
+func QualityKey(class, seat, model string) string {
+	return class + "\x00" + seat + "\x00" + strings.ToLower(strings.TrimSpace(model))
+}
+
+// outcomeSignal is how a settled task reads for the models that sat it: +1
+// kept, −1 redone stronger, −½ not kept, 0 for anything else.
+func outcomeSignal(outcome string) float64 {
+	switch outcome {
+	case CrewAccepted:
+		return 1
+	case CrewRedone:
+		return -1
+	case CrewNotKept:
+		return -0.5
+	}
+	return 0
+}
+
+// learnedQuality reads [CrewLog.Quality] off the settled tasks, oldest first.
+func learnedQuality(order []string, tasks map[string]*CrewTask) map[string]float64 {
+	out := map[string]float64{}
+	for _, call := range order {
+		task := tasks[call]
+		signal := outcomeSignal(task.Outcome)
+		if !task.Settled || signal == 0 {
+			continue
+		}
+		for seat, model := range task.Record.Seats {
+			if strings.TrimSpace(model) == "" {
+				continue
+			}
+			key := QualityKey(task.Record.TaskClass, seat, model)
+			out[key] += learnRate * (signal*learnBound - out[key])
+		}
+	}
+	return out
+}
+
+// The cost factor's three numbers: how many recent tasks it reads, how many
+// tasks' worth of "the estimate was right" it starts from, and how far it may
+// move the estimate.
+const (
+	costFactorTasks = 30
+	costFactorPrior = 4.0
+	costFactorLimit = 3.0
+)
+
+// costFactors reads [CrewLog.CostFactor] off the settled tasks, oldest first.
+func costFactors(order []string, tasks map[string]*CrewTask) map[string]float64 {
+	logs := map[string][]float64{}
+	for i := len(order) - 1; i >= 0; i-- {
+		task := tasks[order[i]]
+		class := task.Record.TaskClass
+		base := task.Record.EstBase
+		if base <= 0 {
+			base = task.Record.EstUSD
+		}
+		if !task.Settled || base <= 0 || task.CostUSD <= 0 || len(logs[class]) >= costFactorTasks {
+			continue
+		}
+		logs[class] = append(logs[class], math.Log(task.CostUSD/base))
+	}
+	out := map[string]float64{}
+	for class, ls := range logs {
+		var sum float64
+		for _, l := range ls {
+			sum += l
+		}
+		n := float64(len(ls))
+		f := math.Exp(sum / (n + costFactorPrior))
+		out[class] = math.Min(costFactorLimit, math.Max(1/costFactorLimit, f))
+	}
+	return out
+}
+
+// The learning rule's two numbers. A redo raises its repository and class by
+// one step, to at most redoOffsetCeiling; redoDecayAfter accepted tasks of that
+// class there take a step back off, so a class that was under-served once is
+// not overpaid for ever.
+const (
+	redoOffsetCeiling = 3
+	redoDecayAfter    = 1
+	// crewRecent is how many tasks the panel lists.
+	crewRecent = 8
+	// crewTailBytes is how much of the log is read: the crew rows are a few
+	// hundred bytes among every routed turn, and a day's tasks and the offsets
+	// that matter live in the recent tail, not in months of history.
+	crewTailBytes = 8 << 20
+)
+
+// ReadCrewLog reads the crew rows out of the log's tail. now decides which
+// day is today, in the local time zone the person lives in.
+func ReadCrewLog(dir string, now time.Time) CrewLog {
+	out := CrewLog{Offsets: map[string]int{}, ProviderUSD: map[string]float64{}}
+	path, err := statePath(dir, "router-events.jsonl")
+	if err != nil {
+		return out
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		return out
+	}
+	defer file.Close()
+	if info, err := file.Stat(); err == nil && info.Size() > crewTailBytes {
+		if _, err := file.Seek(info.Size()-crewTailBytes, io.SeekStart); err != nil {
+			return out
+		}
+	}
+	tasks := map[string]*CrewTask{}
+	var order []string
+	needle := []byte(`"class":"` + CrewClass + `"`)
+	scanner := bufio.NewScanner(file)
+	scanner.Buffer(make([]byte, 64<<10), 4<<20)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		if !bytes.Contains(line, needle) {
+			continue
+		}
+		var row Event
+		if json.Unmarshal(line, &row) != nil || row.Class != CrewClass || row.Crew == nil {
+			continue
+		}
+		if len(row.Crew.Failed) > 0 || len(row.Crew.Started) > 0 {
+			// A ROUTE OUTCOME is a lesson about a route, not a new state of the
+			// task: the task's own rows stay as they were.
+			if now.Sub(row.At) < crewOutcomesFor {
+				for seat, send := range row.Crew.Failed {
+					out.Routes = append(out.Routes, CrewRouteOutcome{At: row.At, Seat: seat, Send: send,
+						Provider: row.Crew.FailRoute, Kind: row.Crew.FailKind, Until: row.Crew.FailUntil})
+				}
+				for seat, send := range row.Crew.Started {
+					out.Routes = append(out.Routes, CrewRouteOutcome{At: row.At, Seat: seat, Send: send,
+						Provider: row.Crew.Providers[seat], Paid: row.Crew.StartedPaid})
+				}
+			}
+			continue
+		}
+		task, seen := tasks[row.Call]
+		if !seen {
+			task = &CrewTask{At: row.At, Call: row.Call}
+			tasks[row.Call] = task
+			order = append(order, row.Call)
+		}
+		task.Record = *row.Crew
+		if row.Final {
+			task.Outcome, task.CostUSD, task.Settled = row.Outcome, row.Cost, true
+			task.At = row.At
+		}
+	}
+	sort.SliceStable(order, func(i, j int) bool { return tasks[order[i]].At.Before(tasks[order[j]].At) })
+	out.CostFactor = costFactors(order, tasks)
+	out.Quality = learnedQuality(order, tasks)
+	year, month, day := now.Local().Date()
+	accepted := map[string]int{}
+	for _, call := range order {
+		task := tasks[call]
+		key := task.Record.Repo + "\x00" + task.Record.TaskClass
+		switch task.Outcome {
+		case CrewRedone:
+			if out.Offsets[key] < redoOffsetCeiling {
+				out.Offsets[key]++
+			}
+			accepted[key] = 0
+		case CrewAccepted:
+			record := task.Record
+			out.LastGood = &record
+			if record.Redo {
+				// THE REDO'S OWN ACCEPTANCE TEACHES NOTHING NEW: the step it
+				// added is for the NEXT task of the class here to start on.
+				break
+			}
+			accepted[key]++
+			if accepted[key] >= redoDecayAfter && out.Offsets[key] > 0 {
+				out.Offsets[key]--
+				accepted[key] = 0
+			}
+		}
+		if y, m, d := task.At.Local().Date(); y == year && m == month && d == day {
+			out.Tasks++
+			out.SpentUSD += task.CostUSD
+			for provider, share := range crewProviderShares(task.Record, task.CostUSD) {
+				out.ProviderUSD[provider] += share
+			}
+			switch task.Record.Kinds["worker"] {
+			case "plan":
+				out.OnPlan++
+			case "local":
+				out.Local++
+			}
+		}
+	}
+	for key, offset := range out.Offsets {
+		if offset == 0 {
+			delete(out.Offsets, key)
+		}
+	}
+	for i := len(order) - 1; i >= 0 && len(out.Recent) < crewRecent; i-- {
+		out.Recent = append(out.Recent, *tasks[order[i]])
+	}
+	return out
+}
+
+// crewProviderShares is one task's cost laid on the providers that carried it.
+//
+// THE LOG KEEPS A TASK'S COST WHOLE and each seat's provider beside it, not a
+// cost per seat, so the share is by seat: the cost is split evenly across the
+// seats that rode a metered route, because a plan or a local model adds
+// nothing to what a task costs. A task whose seats all rode a plan or a local
+// model — or that names no provider at all — lays its cost, if it has one, on
+// nobody rather than on a provider that cannot have charged it.
+func crewProviderShares(record CrewRecord, costUSD float64) map[string]float64 {
+	if costUSD <= 0 {
+		return nil
+	}
+	var metered []string
+	for seat, provider := range record.Providers {
+		if provider == "" {
+			continue
+		}
+		if kind := record.Kinds[seat]; kind == "plan" || kind == "local" {
+			continue
+		}
+		metered = append(metered, provider)
+	}
+	if len(metered) == 0 {
+		return nil
+	}
+	out := map[string]float64{}
+	for _, provider := range metered {
+		out[provider] += costUSD / float64(len(metered))
+	}
+	return out
+}
+
+// CrewCallID names one task's crew rows. It is the task's own identity where
+// the caller has one — a redo must settle the SAME call — and fresh otherwise.
+func CrewCallID(identity string) string {
+	if identity = strings.TrimSpace(identity); identity != "" {
+		return "crew:" + identity
+	}
+	return "crew:" + callID()
+}
diff --git a/internal/router/crew_test.go b/internal/router/crew_test.go
new file mode 100644
index 0000000000..179d9b7cd7
--- /dev/null
+++ b/internal/router/crew_test.go
@@ -0,0 +1,145 @@
+package router
+
+import (
+	"testing"
+	"time"
+)
+
+func TestTheCrewLogKeepsTodayAndLearnsFromRedos(t *testing.T) {
+	dir := t.TempDir()
+	fix := CrewRecord{TaskClass: "bugfix", Repo: "repo", Seats: map[string]string{"worker": "z-ai/glm-5.3-flash"},
+		Kinds: map[string]string{"worker": "metered"}}
+	onPlan := fix
+	onPlan.Repo = "other"
+	onPlan.Kinds = map[string]string{"worker": "plan"}
+	LogCrewDecision(dir, "crew:a", fix, []string{"z-ai/glm-5.3-flash"})
+	LogCrewOutcome(dir, "crew:a", fix, CrewRedone, 0.02)
+	LogCrewDecision(dir, "crew:b", onPlan, nil)
+	LogCrewOutcome(dir, "crew:b", onPlan, CrewAccepted, 0)
+	LogCrewDecision(dir, "crew:c", fix, nil)
+
+	log := ReadCrewLog(dir, time.Now())
+	if log.Tasks != 3 || log.OnPlan != 1 {
+		t.Errorf("today: %d tasks, %d on a plan; want 3 and 1", log.Tasks, log.OnPlan)
+	}
+	if log.SpentUSD != 0.02 {
+		t.Errorf("today's spend %v, want the settled 0.02", log.SpentUSD)
+	}
+	if got := log.Offsets["repo\x00bugfix"]; got != 1 {
+		t.Errorf("one redo left an offset of %d", got)
+	}
+	if len(log.Recent) != 3 || log.Recent[0].Call != "crew:c" || log.Recent[0].Settled {
+		t.Errorf("recent %+v, want the unsettled c first", log.Recent)
+	}
+	// Enough accepted fixes take the step back off.
+	for i := 0; i < redoDecayAfter; i++ {
+		call := CrewCallID("")
+		LogCrewDecision(dir, call, fix, nil)
+		LogCrewOutcome(dir, call, fix, CrewAccepted, 0.01)
+	}
+	if got := ReadCrewLog(dir, time.Now()).Offsets["repo\x00bugfix"]; got != 0 {
+		t.Errorf("after %d accepted fixes the offset is still %d", redoDecayAfter, got)
+	}
+	// Yesterday's spend is not today's.
+	if got := ReadCrewLog(dir, time.Now().Add(48*time.Hour)); got.Tasks != 0 || got.SpentUSD != 0 {
+		t.Errorf("two days on: %d tasks, $%v", got.Tasks, got.SpentUSD)
+	}
+}
+
+// TODAY'S SPEND IS LAID ON THE PROVIDERS THAT CARRIED IT, a metered seat an
+// even share, and a plan or local seat nothing.
+func TestTheCrewLogSplitsTodayByProvider(t *testing.T) {
+	dir := t.TempDir()
+	mixed := CrewRecord{TaskClass: "bugfix", Seats: map[string]string{"worker": "a", "planner": "b", "checker": "c"},
+		Providers: map[string]string{"worker": "openrouter", "planner": "deepseek", "checker": "codex"},
+		Kinds:     map[string]string{"worker": "metered", "planner": "metered", "checker": "plan"}}
+	LogCrewDecision(dir, "crew:m", mixed, nil)
+	LogCrewOutcome(dir, "crew:m", mixed, CrewAccepted, 0.04)
+	got := ReadCrewLog(dir, time.Now()).ProviderUSD
+	if len(got) != 2 || got["openrouter"] != 0.02 || got["deepseek"] != 0.02 {
+		t.Fatalf("by provider %v, want openrouter and deepseek at 0.02 each", got)
+	}
+	if _, ok := got["codex"]; ok {
+		t.Fatal("a plan seat was charged a share")
+	}
+}
+
+// A REDO'S OWN ACCEPTANCE KEEPS THE STEP IT TAUGHT: the offset a redo adds is
+// for the NEXT task of the class there, and only a later accepted task takes
+// it back off.
+func TestARedoIsNotDecayedByItsOwnAcceptance(t *testing.T) {
+	dir := t.TempDir()
+	first := CrewRecord{TaskClass: "bugfix", Repo: "repo", Seats: map[string]string{"worker": "z-ai/glm-5.3-flash"}}
+	LogCrewDecision(dir, "crew:a", first, nil)
+	LogCrewOutcome(dir, "crew:a", first, CrewRedone, 0.01)
+	redo := first
+	redo.Redo = true
+	LogCrewDecision(dir, "crew:b", redo, nil)
+	LogCrewOutcome(dir, "crew:b", redo, CrewAccepted, 0.02)
+	if got := ReadCrewLog(dir, time.Now()).Offsets["repo\x00bugfix"]; got != 1 {
+		t.Fatalf("after the redo was accepted the offset is %d, want the step it taught", got)
+	}
+	LogCrewDecision(dir, "crew:c", first, nil)
+	LogCrewOutcome(dir, "crew:c", first, CrewAccepted, 0.01)
+	if got := ReadCrewLog(dir, time.Now()).Offsets["repo\x00bugfix"]; got != 0 {
+		t.Errorf("a later accepted task left the offset at %d", got)
+	}
+}
+
+// THE ESTIMATE LEARNS FROM THIS INSTALL'S TASKS: tasks of a class that cost
+// twice their estimate move the next one's up, shrunk toward the estimate
+// while there are few, and a class with none learns nothing.
+func TestTheCostFactorLearnsFromSettledTasks(t *testing.T) {
+	dir := t.TempDir()
+	for i := 0; i < 12; i++ {
+		record := CrewRecord{TaskClass: "bugfix", Repo: "repo", Seats: map[string]string{"worker": "z-ai/glm-5.3"}, EstUSD: 0.1, EstBase: 0.1}
+		call := CrewCallID("")
+		LogCrewDecision(dir, call, record, nil)
+		LogCrewOutcome(dir, call, record, CrewAccepted, 0.2)
+	}
+	log := ReadCrewLog(dir, time.Now())
+	f := log.CostFactor["bugfix"]
+	if f < 1.5 || f >= 2 {
+		t.Errorf("twelve tasks at twice their estimate learned a factor of %.2f, want most of the way to 2", f)
+	}
+	if _, ok := log.CostFactor["openended"]; ok {
+		t.Error("a class with no tasks learned a factor")
+	}
+}
+
+// AN INSTALL'S OWN OUTCOMES MOVE A MODEL'S QUALITY, WITHIN BOUNDS: kept
+// results raise it, redos lower it, and no run of either takes it past the
+// bound.
+func TestInstallOutcomesMoveQualityWithinBounds(t *testing.T) {
+	dir := t.TempDir()
+	record := CrewRecord{TaskClass: "openended", Seats: map[string]string{"worker": "z-ai/glm-5.3-flash", "checker": "moonshotai/kimi-k3"}}
+	key := QualityKey("openended", "checker", "moonshotai/kimi-k3")
+	for i := 0; i < 3; i++ {
+		call := CrewCallID("")
+		LogCrewDecision(dir, call, record, nil)
+		LogCrewOutcome(dir, call, record, CrewAccepted, 0.1)
+	}
+	up := ReadCrewLog(dir, time.Now()).Quality[key]
+	if up <= 0 || up >= learnBound {
+		t.Fatalf("three kept results moved the checker by %v", up)
+	}
+	call := CrewCallID("")
+	LogCrewDecision(dir, call, record, nil)
+	LogCrewOutcome(dir, call, record, CrewRedone, 0.1)
+	down := ReadCrewLog(dir, time.Now()).Quality[key]
+	if down >= up {
+		t.Fatalf("a redo left the checker at %v from %v", down, up)
+	}
+	for i := 0; i < 200; i++ {
+		call := CrewCallID("")
+		LogCrewDecision(dir, call, record, nil)
+		LogCrewOutcome(dir, call, record, CrewRedone, 0.1)
+	}
+	floor := ReadCrewLog(dir, time.Now()).Quality[key]
+	if floor < -learnBound-1e-9 || floor > -0.9*learnBound {
+		t.Fatalf("two hundred redos left the checker at %v, want near but not past %v", floor, -learnBound)
+	}
+	if got := ReadCrewLog(dir, time.Now()).Quality[QualityKey("bugfix", "checker", "moonshotai/kimi-k3")]; got != 0 {
+		t.Fatalf("an open-ended outcome moved the model on fixes by %v", got)
+	}
+}
diff --git a/internal/router/events.go b/internal/router/events.go
index b9fe7587e4..4c76646623 100644
--- a/internal/router/events.go
+++ b/internal/router/events.go
@@ -84,6 +84,11 @@ type Event struct {
 	// what was tried.
 	Retries int `json:"retries,omitempty"`
 
+	// Crew is the crew half of a [CrewClass] row: the task's class, the seat
+	// each model sat, the route and the estimate (crew.go). Nil on every row
+	// about a single model call.
+	Crew *CrewRecord `json:"crew,omitempty"`
+
 	PromptTokens     int     `json:"prompt_tokens,omitempty"`
 	CompletionTokens int     `json:"completion_tokens,omitempty"`
 	CachedTokens     int     `json:"cached_tokens,omitempty"`
diff --git a/internal/run/enginewire.go b/internal/run/enginewire.go
index e29c7649d3..a4c200c21b 100644
--- a/internal/run/enginewire.go
+++ b/internal/run/enginewire.go
@@ -11,6 +11,7 @@ package run
 
 import (
 	"context"
+	"strings"
 
 	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/plandb"
@@ -48,7 +49,7 @@ func (engine) Start(ctx context.Context, spec session.RunSpec) session.RunSummar
 		Factory: CrewFactory(spec.Store, spec.Workspace, spec.ProfileDir, Seats{
 			Work:  spec.WorkModel,
 			Plan:  spec.PlanModel,
-			Check: chatCheckSeat(),
+			Check: chatCheckSeat(spec.CheckModel),
 		}, spec.CompleterFor),
 		OnSpend: spec.OnSpend,
 		Gate:    spec.Admission,
@@ -73,18 +74,19 @@ func (engine) Start(ctx context.Context, spec session.RunSpec) session.RunSummar
 	}
 }
 
-// chatCheckSeat is the check seat a chat's run rides: the check seat's own
-// ladder ([config.CheckSeat]) with no flag, because a conversation has none,
-// and with no pinned plan seat, because a conversation's plan seat is its own
-// mastermind row rather than a pin — so CODEAF_CHECK_MODEL, and empty
-// otherwise, which the crew factory fills from the profile's careful row.
+// chatCheckSeat is the check seat a chat's run rides: the checker the router
+// picked for this task when the run was routed, and otherwise the check seat's
+// own environment rung, CODEAF_CHECK_MODEL — empty past both, which the crew
+// factory fills from the profile's checker row ([config.TierSeatAt]).
 //
-// ONE LADDER, TWO DOORS. `codeaf do` resolves the same seat through the same
-// function with its `--check-model` flag in front, so the environment rung the
-// manual documents is one rung and not a promise one door kept and the other
-// did not.
-func chatCheckSeat() string {
-	return config.CheckSeat("", config.Seat{}).Model
+// THE CHECK SEAT NEVER INHERITS THE PLAN SEAT. It once did, when only the plan
+// seat was named, so a person who pinned a planner had their work graded by
+// it; a pin on the planner says something about planning and nothing else.
+func chatCheckSeat(routed string) string {
+	if routed = strings.TrimSpace(routed); routed != "" {
+		return routed
+	}
+	return config.CheckEnvModel()
 }
 
 // runLimitOf is the seam's one mapping of the limit fact: the run's words and
diff --git a/internal/session/clientdoor.go b/internal/session/clientdoor.go
index e10d658975..e138b28563 100644
--- a/internal/session/clientdoor.go
+++ b/internal/session/clientdoor.go
@@ -567,6 +567,33 @@ func (a *Agent) completeWithModel(ctx context.Context, purpose callPurpose, mess
 // missing default-service key moved the call onto the live seat; asking the pool
 // a second time afterwards could observe a different model or source set.
 func (a *Agent) completeWithNamedModel(ctx context.Context, purpose callPurpose, messages []ai.Message, model string, options ...ai.Option) (*ai.Response, string, error) {
+	// AN AUXILIARY CALL NEVER ASKS A ROUTE HEALTH SAYS WILL NOT ANSWER
+	// (taskcrew.go's [Agent.healthyModel]).
+	model = a.healthyModel(ctx, purpose, model)
+	// A HELPER'S CALL IS PRICED LIKE A SEAT'S: against the crew's day cap —
+	// and, made for a task, that task's limit — before it is made, and on the
+	// day after. A crew seat's own call is its
+	// task's guard's (taskcrew.go), and the person's turn is theirs.
+	var helper *SpendGuard
+	var held float64
+	if purpose != purposeTurn && !isCrewSeatCall(ctx) {
+		task := crewTaskOf(ctx)
+		if stopped := task.stoppedAction(); stopped != "" {
+			// A TASK THAT STOPPED ON ITS ACTION buys no more helpers: every
+			// route it could reach already said no.
+			return nil, model, crewStopped{action: stopped}
+		}
+		helper = a.helperGuard(task)
+		var err error
+		if held, err = helper.before(model, messages, options); err != nil {
+			return nil, model, err
+		}
+		if helper != nil {
+			// NOBODY WAITS ON A HELPER, so it never sits out a limit: a 429
+			// comes back at once and the errand's next rung is asked.
+			ctx = provider.WithoutPatientRateLimits(ctx)
+		}
+	}
 	client, wire, called, err := a.completerFor(model)
 	if err != nil {
 		return nil, called, err
@@ -579,6 +606,10 @@ func (a *Agent) completeWithNamedModel(ctx context.Context, purpose callPurpose,
 	// A CALL UNDER A TOLD WINDOW IS TOLD IT HERE, at the last moment the context
 	// is this package's to change (callwindow.go says why it cannot be earlier).
 	response, err := client.CompleteWithMessages(toldItsWindow(ctx), messages, append(options, ai.WithModel(wire))...)
+	if helper != nil {
+		helper.after(model, response, held)
+		crewTaskOf(ctx).addHelperSpend(response)
+	}
 	return response, called, err
 }
 
@@ -625,6 +656,7 @@ func (c Config) clientConfig(model string, timeout time.Duration) provider.Confi
 	if configured.ModelPrice == nil {
 		configured.ModelPrice = c.ModelPrice
 	}
+	configured.RouteGate = c.routeGate(model, configured.Model)
 	return configured
 }
 
diff --git a/internal/session/crewkept_test.go b/internal/session/crewkept_test.go
new file mode 100644
index 0000000000..b60aa4eebe
--- /dev/null
+++ b/internal/session/crewkept_test.go
@@ -0,0 +1,57 @@
+package session
+
+import (
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/router"
+)
+
+// A FINISHED RUN NOBODY REFUSED IS ACCEPTED — a deliberate keep on its branch
+// and an answer with nothing to land included — so the redo offset decays on
+// work that went well rather than climbing for ever.
+func TestACrewsWorkIsKeptUnlessItsLandingWasRefused(t *testing.T) {
+	cases := []struct {
+		outcome string
+		landing RunLanding
+		kept    bool
+	}{
+		{beltRunOutcomeDone, RunLanding{Home: mergeMerged}, true},
+		{beltRunOutcomeDone, RunLanding{Home: mergeInPlace}, true},
+		{beltRunOutcomeDone, RunLanding{Home: mergeKept}, true},
+		{beltRunOutcomeDone, RunLanding{}, true},
+		{beltRunOutcomeDone, RunLanding{Home: mergeConflicted}, false},
+		{beltRunOutcomeDone, RunLanding{Home: mergeAborted}, false},
+		{beltRunOutcomeDone, RunLanding{Home: mergeKept, Branch: "task/fix", Refused: "its work is kept on task/fix and did not go into main"}, true},
+		{beltRunOutcomeDone, RunLanding{Refused: "the checker said no"}, false},
+		{"failed", RunLanding{Home: mergeKept}, false},
+	}
+	for _, tc := range cases {
+		if got := crewKept(tc.outcome, tc.landing); got != tc.kept {
+			t.Errorf("%s / %+v: kept %v, want %v", tc.outcome, tc.landing, got, tc.kept)
+		}
+	}
+}
+
+// A TASK KEPT ON ITS BRANCH TAKES A REDO'S STEP BACK OFF. The landing is the
+// exact shape [Agent.landBeltRun] hands back for a deliberate keep — the keep
+// sentence in Refused — and the offset a redo left must decay on it.
+func TestAKeptBranchIsAcceptedAndDecaysTheRedoOffset(t *testing.T) {
+	dir := t.TempDir()
+	record := router.CrewRecord{TaskClass: "bugfix", Repo: "repo", Seats: map[string]string{"worker": "z-ai/glm-5.3-flash"}}
+	router.LogCrewDecision(dir, "crew:a", record, nil)
+	router.LogCrewOutcome(dir, "crew:a", record, router.CrewRedone, 0.02)
+	if got := router.ReadCrewLog(dir, time.Now()).Offsets["repo\x00bugfix"]; got != 1 {
+		t.Fatalf("a redo left an offset of %d", got)
+	}
+	landing := RunLanding{Home: mergeKept, Branch: "task/fix", Refused: "its work is kept on task/fix and did not go into main"}
+	outcome := router.CrewNotKept
+	if crewKept(beltRunOutcomeDone, landing) {
+		outcome = router.CrewAccepted
+	}
+	router.LogCrewDecision(dir, "crew:b", record, nil)
+	router.LogCrewOutcome(dir, "crew:b", record, outcome, 0.01)
+	if got := router.ReadCrewLog(dir, time.Now()).Offsets["repo\x00bugfix"]; got != 0 {
+		t.Errorf("a task kept on its branch left the offset at %d (outcome %q)", got, outcome)
+	}
+}
diff --git a/internal/session/crewladder_test.go b/internal/session/crewladder_test.go
new file mode 100644
index 0000000000..bcf511a990
--- /dev/null
+++ b/internal/session/crewladder_test.go
@@ -0,0 +1,546 @@
+package session
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+	"github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/provider"
+	"github.com/Agent-Field/codeaf/internal/roles"
+)
+
+// crewStub is the provider the owner's verification stood up: every paid id
+// answers 402 out of credit (or 401, a refused key), and each free pool
+// answers as the test says — 200, or 429 at its limit.
+type crewStub struct {
+	*httptest.Server
+	mu    sync.Mutex
+	asked []string
+	paid  int
+	free  map[string]int
+	only  map[string]int
+	// cost is what each answered call reports it cost; zero reports none.
+	cost float64
+}
+
+func newCrewStub(t *testing.T, paid int, free map[string]int) *crewStub {
+	t.Helper()
+	stub := &crewStub{paid: paid, free: free}
+	stub.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !answersChatOnly(w, r) {
+			return
+		}
+		raw, _ := io.ReadAll(r.Body)
+		var body struct {
+			Model string `json:"model"`
+		}
+		_ = json.Unmarshal(raw, &body)
+		stub.mu.Lock()
+		stub.asked = append(stub.asked, body.Model)
+		status := stub.paid
+		if strings.HasSuffix(body.Model, ":free") {
+			status = stub.free[body.Model]
+		}
+		if forced, ok := stub.only[body.Model]; ok {
+			status = forced
+		}
+		stub.mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		switch status {
+		case http.StatusOK:
+			reply := map[string]any{"model": body.Model, "choices": []any{map[string]any{
+				"index": 0, "finish_reason": "stop", "message": map[string]any{"role": "assistant", "content": "done"}}}}
+			if stub.cost > 0 {
+				reply["usage"] = map[string]any{"prompt_tokens": 10, "completion_tokens": 2, "total_tokens": 12, "cost": stub.cost}
+			}
+			_ = json.NewEncoder(w).Encode(reply)
+		case http.StatusPaymentRequired:
+			w.WriteHeader(status)
+			_, _ = io.WriteString(w, `{"error":{"message":"Insufficient credits. Add more using https://openrouter.ai/settings/credits","code":402}}`)
+		case http.StatusForbidden:
+			w.WriteHeader(status)
+			_, _ = io.WriteString(w, `{"error":{"message":"this model is only available on agentic harnesses","code":403}}`)
+		case http.StatusUnauthorized:
+			w.WriteHeader(status)
+			_, _ = io.WriteString(w, `{"error":{"message":"No auth credentials found","code":401}}`)
+		default:
+			w.Header().Set("Retry-After", "3600")
+			w.WriteHeader(http.StatusTooManyRequests)
+			_, _ = io.WriteString(w, `{"error":{"message":"Rate limit exceeded: free-models-per-day. ","code":429}}`)
+		}
+	}))
+	t.Cleanup(stub.Close)
+	return stub
+}
+
+func (s *crewStub) models() []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]string(nil), s.asked...)
+}
+
+// crewStubAgent is a conversation on the stub with the crew routed over a
+// profile whose catalog holds a measured model, its free pool, and a free
+// stranger that publishes too little to be a first pick.
+func crewStubAgent(t *testing.T, stub *crewStub) (*Agent, string) {
+	t.Helper()
+	t.Setenv("OPENROUTER_API_KEY", "")
+	t.Setenv("CODEAF_BASE_URL", "")
+	dir := t.TempDir()
+	if err := config.WriteAPIKey(dir, "sk-or-v1-crewstub-0123456789"); err != nil {
+		t.Fatal(err)
+	}
+	previous := config.CrewCatalog
+	t.Cleanup(func() { config.CrewCatalog = previous })
+	rows := []catalog.Model{
+		{ID: "z-ai/glm-5.3-flash", OpenWeights: true, PromptPrice: 1.5e-7, CompletionPrice: 5e-7,
+			IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ContextLength: 1310720, Parameters: []string{"tools"}},
+		{ID: "z-ai/glm-5.3-flash:free", OpenWeights: true,
+			IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ContextLength: 1310720, Parameters: []string{"tools"}},
+		{ID: "vendor/stranger:free", ContextLength: 262144, CodingIndex: 40, Parameters: []string{"tools"}},
+	}
+	config.CrewCatalog = func() []catalog.Model { return rows }
+	agent, err := New(Config{
+		Workspace: t.TempDir(), Model: "somelab/the-chat-model", ProfileDir: dir,
+		Sources:   modelsource.NewSet(modelsource.Connected{Source: modelsource.DefaultSource(stub.URL), Key: "sk-or-v1-crewstub-0123456789", Address: stub.URL}),
+		RouteCrew: func(ask config.CrewAsk) (crewroute.Decision, error) { return config.RouteCrew(dir, ask) },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = agent.Close() })
+	return agent, dir
+}
+
+// askWorker routes one task and makes its worker's first call through the
+// seat ladder, as the run engine does.
+func askWorker(t *testing.T, agent *Agent, row uint64) (*beltRun, error) {
+	t.Helper()
+	crew, err := agent.routeTaskCrew(t.Context(), row, "fix: the parser crashes on empty input", "Traceback: ValueError")
+	if err != nil {
+		return nil, err
+	}
+	run := &beltRun{row: row, crew: crew}
+	worker := crew.current().Seat(crewroute.Worker).Send
+	_, err = crewSeatCompleter{agent: agent, run: run}.CompleteWithMessages(t.Context(),
+		[]ai.Message{textMessage("user", "fix it")}, ai.WithModel(worker))
+	return run, err
+}
+
+// THE OWNER'S STUB SEQUENCE, end to end: every paid call is out of credit.
+// The worker's paid route refuses, the seat falls to the model's own free pool
+// and the task proceeds; the NEXT task is routed (the paid route probed again,
+// never refused at decision time) and, with that pool at its limit, falls to
+// the next free pool; with every pool at its limit the task stops on the one
+// action.
+func TestTheSeatLadderReachesTheFreePoolsOnAnAccountOutOfCredit(t *testing.T) {
+	free := map[string]int{"z-ai/glm-5.3-flash:free": http.StatusOK, "vendor/stranger:free": http.StatusOK}
+	stub := newCrewStub(t, http.StatusPaymentRequired, free)
+	agent, _ := crewStubAgent(t, stub)
+
+	run, err := askWorker(t, agent, 1)
+	if err != nil {
+		t.Fatalf("task 1: %v (asked %v)", err, stub.models())
+	}
+	if got := stub.models(); len(got) != 2 || got[0] != "z-ai/glm-5.3-flash" || got[1] != "z-ai/glm-5.3-flash:free" {
+		t.Fatalf("task 1 asked %v, want the paid route then its free pool", got)
+	}
+	line := run.crew.current().Line("", -1)
+	if !strings.HasPrefix(line, "running on fallback crew") || !strings.Contains(line, "free routes in use (may log prompts)") {
+		t.Errorf("task 1's line %q does not say the fallback and the free pool", line)
+	}
+
+	stub.mu.Lock()
+	stub.asked, stub.free["z-ai/glm-5.3-flash:free"] = nil, http.StatusTooManyRequests
+	stub.mu.Unlock()
+	if _, err := askWorker(t, agent, 2); err != nil {
+		t.Fatalf("task 2: %v (asked %v)", err, stub.models())
+	}
+	if got := stub.models(); len(got) < 2 || got[0] != "z-ai/glm-5.3-flash" || got[len(got)-1] != "vendor/stranger:free" {
+		t.Fatalf("task 2 asked %v, want the paid probe, then the free pools down to the one that answers", got)
+	}
+
+	stub.mu.Lock()
+	stub.free["vendor/stranger:free"] = http.StatusTooManyRequests
+	stub.mu.Unlock()
+	run, err = askWorker(t, agent, 3)
+	var stopped crewStopped
+	if !errors.As(err, &stopped) || stopped.action != "add credit on openrouter to continue" {
+		t.Fatalf("task 3 ended %v, want the one action", err)
+	}
+	if got := run.crew.current().Stopped; got != "add credit on openrouter to continue" {
+		t.Errorf("the decision records %q as where it stopped", got)
+	}
+}
+
+// A REFUSED KEY STOPS ON RECONNECTING, and credit coming back is seen by the
+// very next task: its first call probes the paid route, answers, and the
+// crew runs as picked.
+func TestARefusedKeyAsksToReconnectAndRestoredCreditIsSeenAtOnce(t *testing.T) {
+	stub := newCrewStub(t, http.StatusUnauthorized, map[string]int{})
+	agent, _ := crewStubAgent(t, stub)
+	_, err := askWorker(t, agent, 1)
+	var stopped crewStopped
+	if !errors.As(err, &stopped) || stopped.action != "reconnect openrouter with /connect" {
+		t.Fatalf("a refused key ended %v, want the reconnect action", err)
+	}
+
+	stub.mu.Lock()
+	stub.paid, stub.asked = http.StatusOK, nil
+	stub.mu.Unlock()
+	run, err := askWorker(t, agent, 2)
+	if err != nil {
+		t.Fatalf("with the key good again: %v", err)
+	}
+	if got := stub.models(); len(got) != 1 || got[0] != "z-ai/glm-5.3-flash" {
+		t.Errorf("the next task asked %v, want the paid route once", got)
+	}
+	if line := run.crew.current().Line("", -1); strings.Contains(line, "fallback") {
+		t.Errorf("a recovered account still reads as fallback: %q", line)
+	}
+}
+
+// NOTHING THIS TASK DOES ASKS A QUARANTINED ROUTE: a route that refused a
+// model is left out of the next task's crew, and a call the run makes on a
+// tier the crew does not seat — the same model by its tier's row — is handed
+// a healthy route instead. The stub counts zero requests for it.
+func TestNoCallReachesAQuarantinedRoute(t *testing.T) {
+	stub := newCrewStub(t, http.StatusOK, map[string]int{})
+	stub.only = map[string]int{"z-ai/glm-5.3-flash": http.StatusForbidden}
+	agent, _ := crewStubAgent(t, stub)
+	previous := config.CrewCatalog
+	rows := append(previous(), catalog.Model{ID: "deepseek/deepseek-v4-flash", OpenWeights: true, PromptPrice: 8.246e-8, CompletionPrice: 1.6492e-7,
+		IntelligenceIndex: 24.2, CodingIndex: 56.2, AgenticIndex: 22.2, ContextLength: 1048576, Parameters: []string{"tools"}})
+	config.CrewCatalog = func() []catalog.Model { return rows }
+
+	if _, err := askWorker(t, agent, 1); err != nil {
+		t.Fatalf("task 1: %v (asked %v)", err, stub.models())
+	}
+	stub.mu.Lock()
+	stub.asked = nil
+	stub.mu.Unlock()
+	run, err := askWorker(t, agent, 2)
+	if err != nil {
+		t.Fatalf("task 2: %v (asked %v)", err, stub.models())
+	}
+	// The run engine seats a tier the crew does not name on that tier's row.
+	if _, err := (crewSeatCompleter{agent: agent, run: run}).CompleteWithMessages(t.Context(),
+		[]ai.Message{textMessage("user", "a small errand")}, ai.WithModel("z-ai/glm-5.3-flash")); err != nil {
+		t.Fatalf("the errand: %v", err)
+	}
+	// And the end-of-task helper — the run summary, a worker-role errand whose
+	// floor is the conversation's model — with the person talking to the very
+	// model whose route was quarantined.
+	agent.SetModel("z-ai/glm-5.3-flash")
+	if _, _, err := agent.callRole(t.Context(), roles.RoleWorker, agent.Model(), []ai.Message{textMessage("user", "summarise the run")}, ai.WithMaxTokens(320)); err != nil {
+		t.Fatalf("the run summary: %v", err)
+	}
+	for _, model := range stub.models() {
+		if model == "z-ai/glm-5.3-flash" {
+			t.Fatalf("task 2 asked the quarantined route: %v", stub.models())
+		}
+	}
+}
+
+// A TASK THAT RAN ON ITS RESCUE AND FAILED ENDS ON THE CREDIT ACTION: a
+// stronger crew is out of reach on an account out of credit, so the line
+// never offers "/redo stronger" there.
+func TestAFailedRescuedTaskEndsOnTheCreditAction(t *testing.T) {
+	crew := &taskCrew{decision: crewroute.Decision{Class: crewroute.Bugfix}, broke: map[string]bool{"openrouter": true}}
+	if got := crew.stoppedIfCutOff().Stopped; got != "add credit on openrouter to continue" {
+		t.Errorf("a failed task on an account out of credit stops on %q", got)
+	}
+	clean := &taskCrew{decision: crewroute.Decision{Class: crewroute.Bugfix}}
+	if got := clean.stoppedIfCutOff().Stopped; got != "" {
+		t.Errorf("a failed task that saw no account cut off stops on %q, want the redo offer", got)
+	}
+}
+
+// EVERY ROUTE DOWN ENDS IN SECONDS: paid calls out of credit, every free pool
+// at its daily limit with a Retry-After of an hour. The seat tries at most
+// three free pools, asks none of them twice — a patient task context
+// notwithstanding — and stops on the one action.
+func TestEveryRouteDownStopsWithinThreeFreePools(t *testing.T) {
+	stub := newCrewStub(t, http.StatusPaymentRequired, map[string]int{})
+	agent, _ := crewStubAgent(t, stub)
+	previous := config.CrewCatalog
+	rows := previous()
+	for _, id := range []string{"a/one:free", "b/two:free", "c/three:free", "d/four:free", "e/five:free", "f/six:free"} {
+		rows = append(rows, catalog.Model{ID: id, ContextLength: 262144, CodingIndex: 40, Parameters: []string{"tools"}})
+	}
+	config.CrewCatalog = func() []catalog.Model { return rows }
+
+	crew, err := agent.routeTaskCrew(t.Context(), 1, "fix: the parser crashes on empty input", "Traceback")
+	if err != nil {
+		t.Fatal(err)
+	}
+	run := &beltRun{row: 1, crew: crew}
+	began := time.Now()
+	// EVERY SEAT, AND THE WORKER AGAIN: the engine asks each seat, and asks a
+	// seat that failed again. A pool that answered 429 is rested for the
+	// whole task, whichever seat meets it next.
+	routed := crew.current()
+	keys := []string{routed.Seat(crewroute.Worker).Send, routed.Seat(crewroute.Planner).Send,
+		routed.Seat(crewroute.Checker).Send, routed.Seat(crewroute.Worker).Send}
+	for i, key := range keys {
+		_, err = crewSeatCompleter{agent: agent, run: run}.CompleteWithMessages(provider.WithPatientRateLimits(t.Context()),
+			[]ai.Message{textMessage("user", "fix it")}, ai.WithModel(key))
+		var stopped crewStopped
+		if !errors.As(err, &stopped) || stopped.action != "add credit on openrouter to continue" {
+			t.Fatalf("call %d on %s: every route down ended %v, want the one action", i, key, err)
+		}
+	}
+	if took := time.Since(began); took > 30*time.Second {
+		t.Errorf("reaching the action took %v", took)
+	}
+	asked := map[string]int{}
+	for _, model := range stub.models() {
+		if strings.HasSuffix(model, ":free") {
+			asked[model]++
+		}
+	}
+	if len(asked) > 3*len(crewroute.Seats) {
+		t.Errorf("the seats walked %d free pools: %v", len(asked), asked)
+	}
+	for model, n := range asked {
+		if n > 1 {
+			t.Errorf("%s was asked %d times in one task through an hour's Retry-After", model, n)
+		}
+	}
+}
+
+// THE 403 HOME, END TO END: the worker's paid route refuses on this task and
+// the seat moves to its free pool. Every call after that — the run's
+// worker-role errand at a large answer ceiling, and a client built for the
+// model and called directly, the lowest road there is — is refused at the
+// provider's door without a request, though route health had been read (and
+// cached) a moment before the refusal. The stub counts the seat's own first
+// call and nothing else.
+func TestNoRoadReachesARouteThatRefusedThisTask(t *testing.T) {
+	stub := newCrewStub(t, http.StatusOK, map[string]int{"z-ai/glm-5.3-flash:free": http.StatusOK})
+	stub.only = map[string]int{"z-ai/glm-5.3-flash": http.StatusForbidden}
+	agent, dir := crewStubAgent(t, stub)
+	if !config.CrewRouteAnswers(dir, "z-ai/glm-5.3-flash") {
+		t.Fatal("the route was resting before anything refused it")
+	}
+	if _, err := askWorker(t, agent, 1); err != nil {
+		t.Fatalf("task 1: %v (asked %v)", err, stub.models())
+	}
+	glm := func() int {
+		n := 0
+		for _, model := range stub.models() {
+			if model == "z-ai/glm-5.3-flash" {
+				n++
+			}
+		}
+		return n
+	}
+	if n := glm(); n != 1 {
+		t.Fatalf("the seat asked the paid route %d times, want its one first call (%v)", n, stub.models())
+	}
+	_, _, _ = agent.callRole(t.Context(), roles.RoleWorker, "z-ai/glm-5.3-flash",
+		[]ai.Message{textMessage("user", "summarise the task")}, ai.WithMaxTokens(6400))
+	client, wire, _, err := agent.completerFor("z-ai/glm-5.3-flash")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = client.CompleteWithMessages(provider.WithCallTag(t.Context(), "worker"),
+		[]ai.Message{textMessage("user", "one more errand")}, ai.WithModel(wire), ai.WithMaxTokens(6400))
+	var resting errRouteResting
+	if !errors.As(err, &resting) {
+		t.Errorf("a direct call on the resting route ended %v, want it refused at the door (%v)", err, stub.models())
+	}
+	if n := glm(); n != 1 {
+		t.Errorf("the resting route was asked %d times after the seat left it: %v", n-1, stub.models())
+	}
+}
+
+// THE CHAT'S TASK ROAD CARRIES THE REACH: a task started in a conversation is
+// routed through the same RouteCrew, and the hermes report's worker sits a
+// rung above the one-line fix's.
+func TestAChatTaskWithReachGetsTheStrongerWorker(t *testing.T) {
+	stub := newCrewStub(t, http.StatusOK, map[string]int{})
+	agent, _ := crewStubAgent(t, stub)
+	previous := config.CrewCatalog
+	rows := append(previous(), catalog.Model{ID: "moonshotai/kimi-k3", OpenWeights: true, PromptPrice: 3e-6, CompletionPrice: 1.5e-5,
+		IntelligenceIndex: 43.6, CodingIndex: 76.2, AgenticIndex: 50, ContextLength: 1048576, Parameters: []string{"tools"}})
+	config.CrewCatalog = func() []catalog.Model { return rows }
+	report, err := os.ReadFile("../crewroute/testdata/hermes-7680.md")
+	if err != nil {
+		t.Fatal(err)
+	}
+	title, brief, _ := strings.Cut(string(report), "\n")
+	hard, err := agent.routeTaskCrew(t.Context(), 1, title, brief)
+	if err != nil {
+		t.Fatal(err)
+	}
+	simple, err := agent.routeTaskCrew(t.Context(), 2, "fix: typo in the loop bound of paginate() skips the last page", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	h, s := hard.current(), simple.current()
+	if h.Subclass != "complex" || s.Subclass != "simple" {
+		t.Fatalf("subclasses %q and %q", h.Subclass, s.Subclass)
+	}
+	if h.Seat(crewroute.Worker).Quality <= s.Seat(crewroute.Worker).Quality {
+		t.Errorf("the complex task's worker %s is no stronger than %s", h.Seat(crewroute.Worker).Model, s.Seat(crewroute.Worker).Model)
+	}
+}
+
+// crewStubAgentOnDefault is [crewStubAgent] on the DEFAULT profile — the
+// empty ProfileDir every ordinary launch has, resolved to CODEAF_HOME — which
+// is the state every crew guard once read as "no profile" and switched off.
+func crewStubAgentOnDefault(t *testing.T, stub *crewStub, values map[string]any) *Agent {
+	t.Helper()
+	agent, dir := crewStubAgent(t, stub)
+	if len(values) > 0 {
+		raw, err := os.ReadFile(filepath.Join(dir, "config.json"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		held := map[string]any{}
+		_ = json.Unmarshal(raw, &held)
+		for k, v := range values {
+			held[k] = v
+		}
+		out, _ := json.Marshal(held)
+		if err := os.WriteFile(filepath.Join(dir, "config.json"), out, 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	defaulted, err := New(Config{
+		Workspace: t.TempDir(), Model: "somelab/the-chat-model", ProfileDir: "",
+		Sources:   modelsource.NewSet(modelsource.Connected{Source: modelsource.DefaultSource(stub.URL), Key: "sk-or-v1-crewstub-0123456789", Address: stub.URL}),
+		RouteCrew: func(ask config.CrewAsk) (crewroute.Decision, error) { return config.RouteCrew("", ask) },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = defaulted.Close() })
+	_ = agent
+	// The default profile is the home directory: every crew read below
+	// resolves the empty ProfileDir there, as an ordinary launch does.
+	t.Setenv("CODEAF_HOME", dir)
+	t.Setenv(config.ProfileDirEnv, "")
+	return defaulted
+}
+
+// THE 403 HOME ON THE DEFAULT PROFILE: after the seat's own first call, no
+// helper — the run summary at its widened ceiling — and no client built for
+// the refused model reaches it. Every guard once bailed on an empty profile
+// directory, which is what every ordinary launch has.
+func TestTheDefaultProfileKeepsHelpersOffARefusedRoute(t *testing.T) {
+	stub := newCrewStub(t, http.StatusOK, map[string]int{"z-ai/glm-5.3-flash:free": http.StatusOK})
+	stub.only = map[string]int{"z-ai/glm-5.3-flash": http.StatusForbidden}
+	agent := crewStubAgentOnDefault(t, stub, nil)
+	if _, err := askWorker(t, agent, 1); err != nil {
+		t.Fatalf("task 1: %v (asked %v)", err, stub.models())
+	}
+	_, _, _ = agent.callRole(t.Context(), roles.RoleWorker, "z-ai/glm-5.3-flash",
+		[]ai.Message{textMessage("user", "summarise the task")}, ai.WithMaxTokens(320))
+	client, wire, _, err := agent.completerFor("z-ai/glm-5.3-flash")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = client.CompleteWithMessages(provider.WithCallTag(t.Context(), "worker"),
+		[]ai.Message{textMessage("user", "one more errand")}, ai.WithModel(wire))
+	n := 0
+	for _, model := range stub.models() {
+		if model == "z-ai/glm-5.3-flash" {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("the refused route was asked %d times, want only the seat's first call: %v", n, stub.models())
+	}
+}
+
+// THE TINY CAP ON THE DEFAULT PROFILE, seats and helpers alike: a $0.01 day
+// at $0.004 a call makes two calls and refuses the third, whichever of a seat
+// or a helper asks it, and the task's line carries the helper's spend.
+func TestATinyCapHoldsSeatsAndHelpersOnTheDefaultProfile(t *testing.T) {
+	stub := newCrewStub(t, http.StatusOK, map[string]int{})
+	stub.cost = 0.004
+	agent := crewStubAgentOnDefault(t, stub, map[string]any{config.KeyCrewCap: 0.01})
+	run, err := askWorker(t, agent, 1)
+	if err != nil {
+		t.Fatalf("the first seat call: %v", err)
+	}
+	ctx := withCrewTask(t.Context(), run.crew)
+	if _, _, err := agent.callRole(ctx, roles.RoleWorker, agent.Model(),
+		[]ai.Message{textMessage("user", "summarise the task")}, ai.WithMaxTokens(320)); err != nil {
+		t.Fatalf("the helper under the cap: %v", err)
+	}
+	worker := run.crew.current().Seat(crewroute.Worker).Send
+	_, err = crewSeatCompleter{agent: agent, run: run}.CompleteWithMessages(t.Context(),
+		[]ai.Message{textMessage("user", "and again")}, ai.WithModel(worker))
+	var stopped crewStopped
+	if !errors.As(err, &stopped) || !strings.Contains(stopped.action, "daily cap of $0.010") {
+		t.Fatalf("the call over the cap ended %v", err)
+	}
+	if got := len(stub.models()); got != 2 {
+		t.Errorf("the stub was asked %d times, want 2 ($0.008 under a $0.01 cap): %v", got, stub.models())
+	}
+	if got := run.crew.taskSpent(0.004); got < 0.008-1e-9 {
+		t.Errorf("the task's line carries $%.3f, want the helper's spend too", got)
+	}
+}
+
+// A CREW'S LAST WORD ENDS THE TURN AT ONCE. A seat that ran out of routes
+// answers its action wrapping the provider's refusal — a 429 with an hour's
+// Retry-After — and the turn that meets it ends in well under a second
+// rather than sitting out a backoff and asking the crew again.
+func TestACrewStopEndsTheTurnWithoutABackoff(t *testing.T) {
+	limited := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Retry-After", "3600")
+		w.WriteHeader(http.StatusTooManyRequests)
+		_, _ = io.WriteString(w, `{"error":{"message":"Rate limit exceeded: free-models-per-day.","code":429}}`)
+	}))
+	t.Cleanup(limited.Close)
+	client, err := provider.NewClient(provider.Config{BaseURL: limited.URL, Model: "vendor/pool:free", APIKey: "sk-test"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, cause := client.CompleteWithMessages(provider.WithoutPatientRateLimits(t.Context()), []ai.Message{textMessage("user", "hi")})
+	if cause == nil {
+		t.Fatal("the limited pool answered")
+	}
+	asked := 0
+	completer := &scriptedCompleter{steps: []step{
+		func(context.Context, []ai.Message) (*ai.Response, error) {
+			asked++
+			return nil, crewStopped{action: "add credit on openrouter to continue", cause: cause}
+		},
+		func(context.Context, []ai.Message) (*ai.Response, error) {
+			asked++
+			return nil, crewStopped{action: "add credit on openrouter to continue", cause: cause}
+		},
+	}}
+	agent, _ := newTestAgent(t, completer, nil)
+	began := time.Now()
+	events, err := agent.Submit(t.Context(), "work")
+	if err != nil {
+		t.Fatal(err)
+	}
+	drain(t, events)
+	if took := time.Since(began); took > 2*time.Second {
+		t.Errorf("the turn took %v to end on the crew's action", took)
+	}
+	if asked != 1 {
+		t.Errorf("the crew was asked %d times, want once", asked)
+	}
+}
diff --git a/internal/session/fuelrows_test.go b/internal/session/fuelrows_test.go
index 616416e82f..9e87dfe479 100644
--- a/internal/session/fuelrows_test.go
+++ b/internal/session/fuelrows_test.go
@@ -3,41 +3,38 @@ package session
 // THE FUEL TABLE HAS TO KNOW EVERY MODEL THIS BUILD SHIPS. The table is the
 // fallback an orchestrated run meters against when no catalog reader is
 // installed, so a shipped id with no row is a seat that quietly bills at the
-// unpriced rate — the most expensive default seat in particular. This pins the
-// five shipped defaults and every id in both crew tables to a real row, so a
-// new default or a moved crew seat fails the build until the table is repaid.
+// unpriced rate. This pins the two shipped small-work defaults to a real row,
+// so a new default fails the build until the table is repaid.
 
 import (
 	"testing"
 
 	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/orchestrate"
 )
 
-// TestEveryShippedModelHasAFuelRow: every default and every crew-table id
-// resolves to a known fuel row rather than falling through to unpriced.
+// TestEveryShippedModelHasAFuelRow: every default resolves to a known fuel
+// row rather than falling through to unpriced.
 func TestEveryShippedModelHasAFuelRow(t *testing.T) {
-	shipped := []string{
-		config.DefaultReflexModel,
-		config.DefaultLowModel,
-		config.DefaultWorkerModel,
-		config.DefaultHighModel,
-		config.DefaultMastermindModel,
-	}
-	for _, source := range config.CrewSources {
-		for _, preset := range config.CrewPresets {
-			models, ok := config.CrewModelsForSource(source, preset)
-			if !ok {
-				t.Fatalf("the %s crew has no %s preset", source, preset)
-			}
-			for _, model := range models {
-				shipped = append(shipped, model)
-			}
-		}
-	}
+	shipped := []string{config.DefaultReflexModel, config.DefaultLowModel}
 	for _, id := range shipped {
-		if _, known := orchestrate.PriceOf(id); !known {
+		if _, known := orchestrate.PriceOf(id); !known && !datedRowFor(id) {
 			t.Errorf("no fuel row for shipped model %q", id)
 		}
 	}
 }
+
+// datedRowFor reports whether the table holds a dated build of a lineage id.
+// A default may name a model by its lineage (`deepseek/deepseek-v4-flash`)
+// and the table by the build the catalog serves (`…-0731`); the undated id is a
+// retired row the table must NOT hold (orchestrate's TestRetiredIdsAreStrangers),
+// so the lineage is matched here rather than priced there.
+func datedRowFor(lineage string) bool {
+	for _, dated := range []string{"deepseek/deepseek-v4-flash-0731", "qwen/qwen3.8-max-0902"} {
+		if _, known := orchestrate.PriceOf(dated); known && crewroute.Lineage(dated) == lineage {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/session/gatelaw_test.go b/internal/session/gatelaw_test.go
new file mode 100644
index 0000000000..4235e6011b
--- /dev/null
+++ b/internal/session/gatelaw_test.go
@@ -0,0 +1,71 @@
+package session
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// EVERY CLIENT THIS PACKAGE BUILDS CARRIES THE ROUTE GATE. The gate is set in
+// [Config.clientConfig] and nowhere else, so the law is that every
+// provider.NewClient in this package is handed a Config that function built —
+// directly, or through [Config.documentConfig] — in the same function. A
+// client built from anything else would be a road that reaches a route its
+// crew was routed around, which is how a run summary on a second road asked a
+// refused model twice a task.
+func TestEveryProviderClientIsBuiltThroughTheGatedConfig(t *testing.T) {
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(token.NewFileSet(), name, nil, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, decl := range file.Decls {
+			fn, ok := decl.(*ast.FuncDecl)
+			if !ok || fn.Body == nil {
+				continue
+			}
+			builds, gated := false, false
+			ast.Inspect(fn.Body, func(n ast.Node) bool {
+				call, ok := n.(*ast.CallExpr)
+				if !ok {
+					return true
+				}
+				sel, ok := call.Fun.(*ast.SelectorExpr)
+				if !ok {
+					return true
+				}
+				if pkg, ok := sel.X.(*ast.Ident); ok && pkg.Name == "provider" && sel.Sel.Name == "NewClient" {
+					builds = true
+				}
+				if sel.Sel.Name == "clientConfig" || sel.Sel.Name == "documentConfig" {
+					gated = true
+				}
+				return true
+			})
+			if builds && !gated {
+				t.Errorf("%s: %s builds a provider client from a Config clientConfig did not make", name, fn.Name.Name)
+			}
+		}
+	}
+	routed := Config{RouteCrew: func(config.CrewAsk) (crewroute.Decision, error) { return crewroute.Decision{}, nil }}
+	if routed.clientConfig("vendor/model", 0).RouteGate == nil {
+		t.Error("a conversation with crews builds its clients without the route gate")
+	}
+	if routed.documentConfig(0).RouteGate == nil {
+		t.Error("the document road builds its client without the route gate")
+	}
+}
diff --git a/internal/session/loop.go b/internal/session/loop.go
index 1dc25ecc5f..a76f2c7864 100644
--- a/internal/session/loop.go
+++ b/internal/session/loop.go
@@ -2221,6 +2221,14 @@ func (a *Agent) completeWithRetryReasoning(ctx context.Context, hub *eventHub, m
 		// asking again is the right move, and then whether there is time to —
 		// and the line is written once, at the end of this switch, carrying the
 		// answer that was acted on (taxonomy_boundary.go's [Agent.weighLadder]).
+		if crewFinal(err) {
+			// A CREW'S LAST WORD IS NOT A WIRE FAILURE: the seat walked its
+			// ladder, a line of spend was met, or the route is resting, and the
+			// answer names what to do. Weighed as the provider error underneath
+			// it — a 429 with an hour's Retry-After — it bought a minute's
+			// backoff and another ask of a crew that had already said no.
+			return nil, model, err
+		}
 		verdict, evidence := a.weighLadder(err, ladder)
 		// ── AND WHETHER THERE IS TIME TO ASK AGAIN IS PART OF THE SAME READING ──
 		//
diff --git a/internal/session/promptprofile.go b/internal/session/promptprofile.go
index 607d000b44..4f463b6977 100644
--- a/internal/session/promptprofile.go
+++ b/internal/session/promptprofile.go
@@ -35,7 +35,7 @@ package session
 // a hundred and twenty-eight thousand tokens of room. That is a NORMAL SYSTEM and
 // it must get the full page: the seat rule would have taken sections off the page,
 // shelved `propose_task` and `tasks`, and turned saved memories OFF for anybody
-// who picked the frugal preset and then chose that same model in chat — silently,
+// whose crew ran on an open model and who then chose that same model in chat — silently,
 // with nothing on screen saying so, because a derived profile has no row anywhere
 // for a person to read. Open weights are a licence, not a size. A model that is
 // genuinely small announces it the way every other model does: llama.cpp, ollama
diff --git a/internal/session/promptprofile_test.go b/internal/session/promptprofile_test.go
index ab46f52290..c17db754e3 100644
--- a/internal/session/promptprofile_test.go
+++ b/internal/session/promptprofile_test.go
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	configpkg "github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/exec/bare"
 )
 
@@ -75,14 +76,16 @@ func TestTheCatalogsWindowOutranksTheConfiguredOne(t *testing.T) {
 
 // THE CREW'S WORKER SEAT IS NOT A TRIGGER, AND A BIG WINDOW ON IT GETS THE WHOLE
 // PAGE. An earlier draft went lean whenever the conversation rode the crew's
-// `worker` model, which is `z-ai/glm-5.3-flash` through the balanced preset and
-// `z-ai/glm-5.3` at max — models served with a hundred and
-// twenty-eight thousand tokens of room. That would have dropped sections, shelved
-// `propose_task` and turned saved memories off for anybody who picked a preset and
-// then chose that same model in chat, with nothing on screen saying so. Open
-// weights are a licence, not a size.
+// `worker` model — open-weight models like `z-ai/glm-5.3-flash`, served with a
+// hundred and twenty-eight thousand tokens of room. That would have dropped
+// sections, shelved `propose_task` and turned saved memories off for anybody who
+// pinned such a worker and then chose that same model in chat, with nothing on
+// screen saying so. Open weights are a licence, not a size.
 func TestTheWorkerSeatWithALargeWindowGetsTheFullPageByteForByte(t *testing.T) {
 	profileDir := t.TempDir()
+	if err := configpkg.SetCrewPin(profileDir, crewroute.Worker, "z-ai/glm-5.3-flash"); err != nil {
+		t.Fatal(err)
+	}
 	seat := configpkg.TierModelAt(profileDir, configpkg.ModelTierWorker)
 	if strings.TrimSpace(seat) == "" {
 		t.Fatal("the crew has no worker model, so this test is asserting against nothing")
diff --git a/internal/session/runsummary.go b/internal/session/runsummary.go
index ae9ec14015..657ecf275a 100644
--- a/internal/session/runsummary.go
+++ b/internal/session/runsummary.go
@@ -85,6 +85,9 @@ func (a *Agent) RefreshRunSummary(ctx context.Context, rootID string, lastLook t
 	}
 	input := runSummaryInput(family, questions, rootID, lastLook, a.summaryNow(), stored.Summary)
 	closeStore()
+	if crewTaskOf(ctx) == nil {
+		ctx = withCrewTask(ctx, a.liveCrewFor(rootID))
+	}
 	response, _, err := a.callRole(ctx, roles.RoleWorker, a.model, []ai.Message{
 		textMessage("system", runSummaryPrompt), textMessage("user", input),
 	}, ai.WithMaxTokens(320))
diff --git a/internal/session/session.go b/internal/session/session.go
index 32ac525bee..384488d1b3 100644
--- a/internal/session/session.go
+++ b/internal/session/session.go
@@ -21,6 +21,8 @@ package session
 
 import (
 	"context"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -1467,6 +1469,13 @@ type Config struct {
 	// model — roles.Resolve's floor, not a failure.
 	RolesSource func(key string) (string, bool)
 
+	// RouteCrew picks one task's crew — worker, planner and checker — for the
+	// task in the ask (internal/config's RouteCrew over this profile, wired by
+	// the surface). NIL IS NO ROUTER: the run's seats are then the role
+	// ladder's, as they were before crews were routed, and no crew row is
+	// logged. It is never a model this package chooses (taskcrew.go).
+	RouteCrew func(config.CrewAsk) (crewroute.Decision, error)
+
 	// SupportsImages reports whether a model can read image content parts. It
 	// gates [Agent.SubmitImage] and NIL IS FALSE — the opposite of every other
 	// nil-is-permissive hook here, and deliberately so: a model that cannot see
@@ -2231,6 +2240,10 @@ type Config struct {
 // events — every Submit streams, whether it started the turn or steered it.
 // The methods live in agent.go; the loop they drive lives in loop.go.
 type Agent struct {
+	// crewDayHeld is the day's spend crews and their helpers are held to
+	// ([Agent.crewDay]), read once.
+	crewDayOnce sync.Once
+	crewDayHeld *SpendDay
 	// Clarification streams and their deferred history share the agent lock.
 	// questionParent is installed before a child becomes reachable.
 	questionParent     func(Event)
@@ -3254,6 +3267,9 @@ type Agent struct {
 	// one store ([Agent.lockBeltStart]). It is never taken while beltMu is
 	// held; beltMu is taken inside it.
 	beltStartMu sync.Mutex
+	// crews is every task's crew this conversation routed, by row: what its
+	// log row settles with and what `/redo stronger` escalates (taskcrew.go).
+	crews crewBook
 	// taskAnswers is the proposals a person owes an answer to, keyed by the id
 	// the EventTaskProposal carried. It is consent's pending-id machinery for a
 	// question whose CLOCK can be held: the wait ends on an answer, on an active
diff --git a/internal/session/spendguard.go b/internal/session/spendguard.go
new file mode 100644
index 0000000000..8ac685005d
--- /dev/null
+++ b/internal/session/spendguard.go
@@ -0,0 +1,346 @@
+package session
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+)
+
+// A SEAT'S NEXT CALL IS PRICED BEFORE IT IS MADE.
+//
+// A run's dollar limit is read off what its workers have already spent
+// (internal/run's countLiveSpend), so a limit is reached only by the call that
+// crosses it — and one long checker round on a dear model is many calls, each
+// of which started under the line, so one checker round can overrun a small
+// day's cap several times over before the limit is read. The guard answers the
+// question BEFORE each call instead: what the day has spent, plus what this
+// call is expected to cost, against the day's cap; and, for a seat given one,
+// what the seat has spent on this task, plus this call, against its own
+// ceiling. A call that would cross either is not made, and the call ends on
+// the one sentence that says which line it met.
+//
+// The estimate is the call's prompt read at a token per four bytes, priced at
+// the model's prompt price (its cache-read price once the seat has called it
+// before, when the provider publishes one), and its completion ceiling priced
+// at the completion price. What the call actually cost — the provider's own
+// figure when it gives one, the tokens it reports priced otherwise — is added
+// after, so the next estimate starts from the truth.
+
+// SpendPrice is a model's price per token: prompt, completion and cache read.
+// ok is false for a model nobody prices, whose calls the guard does not stop.
+type SpendPrice func(model string) (prompt, completion, cacheRead float64, ok bool)
+
+// SpendDay is today's spend as this process knows it: what the ledger said
+// when the process looked, and every guarded call since.
+type SpendDay struct {
+	mu    sync.Mutex
+	usd   float64
+	since float64
+	// held is what calls in flight were estimated at: a call is priced
+	// against the day AND every call already on its way, so seats asked at
+	// the same moment cannot all pass on one figure.
+	held float64
+	// last is each model's most recent actual call cost today. A call is
+	// estimated at no less: a price sheet that says a call costs a tenth of a
+	// cent is not believed after the provider charged four tenths for one.
+	last map[string]float64
+}
+
+// NewSpendDay is a day that had spent base when it was read.
+func NewSpendDay(base float64) *SpendDay { return &SpendDay{usd: base} }
+
+// Total is what the day has spent.
+func (d *SpendDay) Total() float64 {
+	if d == nil {
+		return 0
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.usd + d.since
+}
+
+// hold prices one call to model at est — raised to the model's last actual
+// cost — against the cap (none when capUSD is zero) and, when it fits, holds
+// it until [SpendDay.settle]. It answers what was held.
+func (d *SpendDay) hold(model string, est, capUSD float64) (float64, bool) {
+	if d == nil {
+		return 0, true
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if last := d.last[model]; last > est {
+		est = last
+	}
+	if capUSD > 0 && d.usd+d.since+d.held+est > capUSD {
+		return 0, false
+	}
+	d.held += est
+	return est, true
+}
+
+// settle releases a call's hold and books what it actually cost.
+func (d *SpendDay) settle(model string, held, usd float64) {
+	if d == nil {
+		return
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.held -= held
+	if d.held < 0 {
+		d.held = 0
+	}
+	if usd <= 0 {
+		return
+	}
+	d.since += usd
+	if d.last == nil {
+		d.last = map[string]float64{}
+	}
+	d.last[model] = usd
+}
+
+// lastCost is model's most recent actual call cost today.
+func (d *SpendDay) lastCost(model string) float64 {
+	if d == nil {
+		return 0
+	}
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.last[model]
+}
+
+// SpendGuard holds a task's seat calls to the day's cap and to each seat's
+// own ceiling. The zero parts are off: no Day or no Cap is no day cap, and a
+// model with no Ceilings entry has no ceiling of its own.
+type SpendGuard struct {
+	Price SpendPrice
+	Day   *SpendDay
+	// Cap is the day's limit in dollars and CapAction the sentence a call it
+	// stops ends on.
+	Cap       float64
+	CapAction string
+	// Ceilings are a model's own spend ceiling on this task, and
+	// CeilingAction the sentence (with the ceiling's dollars) a call it stops
+	// ends on.
+	Ceilings      map[string]float64
+	CeilingAction string
+	// TaskCap is the most the task may spend in dollars, across every model
+	// this guard prices, and TaskAction the sentence a call it stops ends on.
+	// Zero is no per-task limit.
+	TaskCap    float64
+	TaskAction string
+	// Task is the tally TaskCap is read against. Guards that share one hold
+	// the seats and the helpers of one task to one limit; nil is a tally of
+	// the guard's own, made on its first call.
+	Task *SpendTask
+
+	mu    sync.Mutex
+	spent map[string]float64
+}
+
+// SpendTask is what one task has spent and holds in flight, across every
+// guarded call made for it.
+type SpendTask struct {
+	mu    sync.Mutex
+	spent float64
+	held  float64
+}
+
+// Total is what the task has spent.
+func (t *SpendTask) Total() float64 {
+	if t == nil {
+		return 0
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.spent
+}
+
+// hold holds est against capUSD (none when zero) and answers whether it fit.
+func (t *SpendTask) hold(est, capUSD float64) bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if capUSD > 0 && t.spent+t.held+est > capUSD {
+		return false
+	}
+	t.held += est
+	return true
+}
+
+// settle releases a hold and books what the call cost.
+func (t *SpendTask) settle(held, usd float64) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.held -= held
+	if t.held < 0 {
+		t.held = 0
+	}
+	if usd > 0 {
+		t.spent += usd
+	}
+}
+
+// tally is the guard's task tally, made on first use.
+func (g *SpendGuard) tally() *SpendTask {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	if g.Task == nil {
+		g.Task = &SpendTask{}
+	}
+	return g.Task
+}
+
+// ErrSpendStopped is a call the guard did not make. Its text is the one
+// sentence that says which line it met.
+type ErrSpendStopped struct{ Action string }
+
+func (e ErrSpendStopped) Error() string { return e.Action }
+
+// spendCompletionGuess is the completion a call that names no ceiling is
+// priced at.
+const spendCompletionGuess = 2000
+
+// Wrap is next with the guard in front of it, for calls to model.
+func (g *SpendGuard) Wrap(model string, next Completer) Completer {
+	if g == nil {
+		return next
+	}
+	guarded := guardedCompleter{guard: g, model: model, next: next}
+	if chain, ok := next.(modelChain); ok {
+		return guardedChain{guardedCompleter: guarded, chain: chain}
+	}
+	return guarded
+}
+
+// before is whether a call to model with these messages may be made, and
+// what it holds on the day until [SpendGuard.after] settles it.
+func (g *SpendGuard) before(model string, messages []ai.Message, options []ai.Option) (float64, error) {
+	if g == nil {
+		return 0, nil
+	}
+	var prompt, completion, cacheRead float64
+	ok := false
+	if g.Price != nil {
+		prompt, completion, cacheRead, ok = g.Price(model)
+	}
+	if !ok {
+		// A call nobody prices is not estimated, but a task already at its
+		// limit makes no more calls of any kind.
+		if g.TaskCap > 0 && g.tally().Total() >= g.TaskCap {
+			return 0, ErrSpendStopped{Action: g.TaskAction}
+		}
+		return 0, nil
+	}
+	g.mu.Lock()
+	seatSpent := g.spent[model]
+	g.mu.Unlock()
+	est := g.estimate(messages, options, prompt, completion, cacheRead, seatSpent > 0)
+	if last := g.Day.lastCost(model); last > est {
+		est = last
+	}
+	if ceiling := g.Ceilings[model]; ceiling > 0 && seatSpent+est > ceiling {
+		return 0, ErrSpendStopped{Action: fmt.Sprintf(g.CeilingAction, ceiling)}
+	}
+	task := g.tally()
+	if !task.hold(est, g.TaskCap) {
+		return 0, ErrSpendStopped{Action: g.TaskAction}
+	}
+	held, fits := g.Day.hold(model, est, g.Cap)
+	if !fits {
+		task.settle(est, 0)
+		return 0, ErrSpendStopped{Action: g.CapAction}
+	}
+	if g.Day == nil {
+		held = est
+	}
+	return held, nil
+}
+
+// estimate is one call's expected cost.
+func (g *SpendGuard) estimate(messages []ai.Message, options []ai.Option, prompt, completion, cacheRead float64, warm bool) float64 {
+	raw, _ := json.Marshal(messages)
+	tokens := float64(len(raw)) / 4
+	var request ai.Request
+	for _, option := range options {
+		_ = option(&request)
+	}
+	out := float64(spendCompletionGuess)
+	if request.MaxTokens != nil && *request.MaxTokens > 0 {
+		out = float64(*request.MaxTokens)
+	}
+	in := prompt
+	if warm && cacheRead > 0 {
+		in = cacheRead
+	}
+	return tokens*in + out*completion
+}
+
+// after releases what before held and records what a call to model cost.
+func (g *SpendGuard) after(model string, response *ai.Response, held float64) {
+	if g == nil {
+		return
+	}
+	task := g.tally()
+	if response == nil || response.Usage == nil {
+		g.Day.settle(model, held, 0)
+		task.settle(held, 0)
+		return
+	}
+	usd := 0.0
+	if response.Usage.Cost != nil {
+		usd = *response.Usage.Cost
+	} else if g.Price != nil {
+		if prompt, completion, cacheRead, ok := g.Price(model); ok {
+			cached := float64(response.Usage.CacheReadTokens())
+			usd = (float64(response.Usage.PromptTokens)-cached)*prompt + cached*cacheRead +
+				float64(response.Usage.CompletionTokens)*completion
+		}
+	}
+	g.Day.settle(model, held, usd)
+	task.settle(held, usd)
+	if usd <= 0 {
+		return
+	}
+	g.mu.Lock()
+	if g.spent == nil {
+		g.spent = map[string]float64{}
+	}
+	g.spent[model] += usd
+	g.mu.Unlock()
+}
+
+// guardedCompleter is one model's completer behind the guard.
+type guardedCompleter struct {
+	guard *SpendGuard
+	model string
+	next  Completer
+}
+
+func (c guardedCompleter) CompleteWithMessages(ctx context.Context, messages []ai.Message, options ...ai.Option) (*ai.Response, error) {
+	model := c.model
+	var request ai.Request
+	for _, option := range options {
+		_ = option(&request)
+	}
+	if request.Model != "" {
+		model = request.Model
+	}
+	held, err := c.guard.before(model, messages, options)
+	if err != nil {
+		return nil, err
+	}
+	response, err := c.next.CompleteWithMessages(ctx, messages, options...)
+	c.guard.after(model, response, held)
+	return response, err
+}
+
+// guardedChain keeps the model chain of a completer that has one.
+type guardedChain struct {
+	guardedCompleter
+	chain modelChain
+}
+
+func (c guardedChain) FallbackModels(model string) []string { return c.chain.FallbackModels(model) }
diff --git a/internal/session/spendguard_test.go b/internal/session/spendguard_test.go
new file mode 100644
index 0000000000..e795e96851
--- /dev/null
+++ b/internal/session/spendguard_test.go
@@ -0,0 +1,146 @@
+package session
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// spendingCompleter answers every call at a fixed cost, as the provider's own
+// usage figure, and counts what it was asked.
+type spendingCompleter struct {
+	usd   float64
+	calls int
+}
+
+func (c *spendingCompleter) CompleteWithMessages(context.Context, []ai.Message, ...ai.Option) (*ai.Response, error) {
+	c.calls++
+	cost := c.usd
+	return &ai.Response{Choices: []ai.Choice{{Message: textMessage("assistant", "ok")}},
+		Usage: &ai.Usage{PromptTokens: 1000, CompletionTokens: 100, Cost: &cost}}, nil
+}
+
+// kimiPrice is a checker's prices per token.
+func kimiPrice(string) (float64, float64, float64, bool) { return 3e-6, 1.5e-5, 3e-7, true }
+
+// A DEAR CHECKER UNDER A SMALL DAY: an open-ended task under a $0.25 day whose
+// checker would run far past its estimate. Every call is priced before it is
+// made: the checker stops at its own ceiling, three times its estimate, and
+// the day never passes its cap by more than one call's misjudgement.
+func TestTheCheckerStopsAtItsCeilingAndTheDayAtItsCap(t *testing.T) {
+	messages := []ai.Message{textMessage("user", strings.Repeat("the diff and the tests ", 800))}
+	checker := &spendingCompleter{usd: 0.06}
+	guard := &SpendGuard{Price: kimiPrice, Day: NewSpendDay(0), Cap: 1, CapAction: "today's spending limit of $1.00 is reached · raise it with /budget",
+		Ceilings: map[string]float64{"moonshotai/kimi-k3": 0.0882 * 3}, CeilingAction: "the check stopped at its spend ceiling of $%.2f"}
+	seat := guard.Wrap("moonshotai/kimi-k3", checker)
+	var stopped ErrSpendStopped
+	for i := 0; i < 20; i++ {
+		if _, err := seat.CompleteWithMessages(t.Context(), messages, ai.WithMaxTokens(2000)); err != nil {
+			if !errors.As(err, &stopped) {
+				t.Fatalf("call %d: %v", i, err)
+			}
+			break
+		}
+	}
+	if !strings.HasPrefix(stopped.Action, "the check stopped at its spend ceiling of $0.26") {
+		t.Fatalf("the checker ended on %q after %d calls", stopped.Action, checker.calls)
+	}
+	if spent := guard.Day.Total(); spent > 0.0882*3 {
+		t.Errorf("the checker spent $%.3f", spent)
+	}
+
+	// The day's cap binds a seat with no ceiling of its own, before its call.
+	worker := &spendingCompleter{usd: 0.05}
+	day := &SpendGuard{Price: kimiPrice, Day: NewSpendDay(0.23), Cap: 0.25, CapAction: "cap reached"}
+	seat = day.Wrap("z-ai/glm-5.3", worker)
+	_, err := seat.CompleteWithMessages(t.Context(), messages, ai.WithMaxTokens(2000))
+	if !errors.As(err, &stopped) || stopped.Action != "cap reached" || worker.calls != 0 {
+		t.Errorf("a call that would cross the cap: %v after %d calls", err, worker.calls)
+	}
+}
+
+// A TASK STOPS AT ITS LIMIT: seats on two models and a helper share one
+// tally. The call that would take the task past the limit is not made, and
+// the task ends on the limit's sentence.
+func TestATaskStopsAtItsLimitAcrossEveryModel(t *testing.T) {
+	messages := []ai.Message{textMessage("user", "the brief")}
+	worker := &spendingCompleter{usd: 1.5}
+	checker := &spendingCompleter{usd: 1.5}
+	guard := &SpendGuard{Price: kimiPrice, Day: NewSpendDay(0), TaskCap: 5, TaskAction: config.CrewTaskCapAction(5)}
+	seats := []Completer{guard.Wrap("z-ai/glm-5.3", worker), guard.Wrap("moonshotai/kimi-k3", checker)}
+	var stopped ErrSpendStopped
+	made := 0
+	for i := 0; i < 10; i++ {
+		_, err := seats[i%2].CompleteWithMessages(t.Context(), messages, ai.WithMaxTokens(2000))
+		if err != nil {
+			if !errors.As(err, &stopped) {
+				t.Fatalf("call %d: %v", i, err)
+			}
+			break
+		}
+		made++
+	}
+	if stopped.Action != "this task reached its $5 limit · raise it in /crew" {
+		t.Fatalf("the task ended on %q", stopped.Action)
+	}
+	if made != 3 || worker.calls+checker.calls != 3 {
+		t.Fatalf("%d calls were made (%d worker, %d checker), want 3", made, worker.calls, checker.calls)
+	}
+	if spent := guard.Task.Total(); spent > 5 {
+		t.Fatalf("the task spent $%.2f past its $5 limit", spent)
+	}
+
+	// A helper made for the same task is held to the same tally.
+	helper := &SpendGuard{Price: kimiPrice, Day: guard.Day, TaskCap: guard.TaskCap, TaskAction: guard.TaskAction, Task: guard.tally()}
+	aux := &spendingCompleter{usd: 1.5}
+	if _, err := helper.Wrap("z-ai/glm-5.3", aux).CompleteWithMessages(t.Context(), messages); !errors.As(err, &stopped) || aux.calls != 0 {
+		t.Fatalf("a helper past the task's limit: %v after %d calls", err, aux.calls)
+	}
+
+	// The checker's own ceiling still binds inside the task's limit.
+	ceilinged := &SpendGuard{Price: kimiPrice, Day: NewSpendDay(0), TaskCap: 5, TaskAction: config.CrewTaskCapAction(5),
+		Ceilings: map[string]float64{"moonshotai/kimi-k3": 0.5}, CeilingAction: "the check stopped at its spend ceiling of $%.2f"}
+	check := &spendingCompleter{usd: 0.4}
+	seat := ceilinged.Wrap("moonshotai/kimi-k3", check)
+	var err error
+	for i := 0; i < 5 && err == nil; i++ {
+		_, err = seat.CompleteWithMessages(t.Context(), messages, ai.WithMaxTokens(2000))
+	}
+	if !errors.As(err, &stopped) || !strings.HasPrefix(stopped.Action, "the check stopped at its spend ceiling") {
+		t.Fatalf("the ceiling inside the task's limit: %v", err)
+	}
+}
+
+// THE PER-TASK LIMIT IS ON EVERY CREW GUARD, whether or not the daily limit
+// is (withDaily false is how --yes-spend builds it), and on a helper's guard
+// for a task, which shares the task's tally.
+func TestTheTaskLimitIsOnEveryGuard(t *testing.T) {
+	dir := t.TempDir()
+	for _, withDaily := range []bool{true, false} {
+		guard := CrewSpendGuard(dir, crewroute.Decision{}, withDaily)
+		if guard.TaskCap != 5 || guard.TaskAction != "this task reached its $5 limit · raise it in /crew" {
+			t.Fatalf("withDaily=%v: task cap %v, %q", withDaily, guard.TaskCap, guard.TaskAction)
+		}
+	}
+	if err := config.SetCrewTaskCap(dir, "2.5"); err != nil {
+		t.Fatal(err)
+	}
+	if guard := TaskSpendGuard(dir); guard.TaskCap != 2.5 || guard.TaskAction != "this task reached its $2.50 limit · raise it in /crew" {
+		t.Fatalf("a set limit reads %v, %q", guard.TaskCap, guard.TaskAction)
+	}
+	crew := &taskCrew{guard: crewSpendGuard(dir, crewroute.Decision{}, false)}
+	a := &Agent{config: Config{ProfileDir: dir, RouteCrew: func(config.CrewAsk) (crewroute.Decision, error) { return crewroute.Decision{}, nil }}}
+	helper := a.helperGuard(crew)
+	if helper.TaskCap != 2.5 || helper.Task != crew.guard.Task {
+		t.Fatalf("a helper for the task is held to %v on its own tally", helper.TaskCap)
+	}
+	if loose := a.helperGuard(nil); loose.TaskCap != 0 {
+		t.Fatalf("a helper for no task is held to a task limit of %v", loose.TaskCap)
+	}
+}
diff --git a/internal/session/task.go b/internal/session/task.go
index 0e0292aef1..ef1635ce93 100644
--- a/internal/session/task.go
+++ b/internal/session/task.go
@@ -77,6 +77,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -188,9 +189,10 @@ var taskSchemaJSON = `{"type":"object","properties":{` +
 	`"acceptance":{"type":"string","description":"Done when: the observable condition somebody else could check without taking the task's word for it"},` +
 	expectsSchemaJSON + `,` +
 	checksSchemaJSON + `,` +
-	`"depends_on":{"type":"array","items":{"type":"integer"},"description":"Ids that must finish first, only ones propose_task returned in this session. Its brief is given their reports; an unknown or failed id refuses the proposal"},` +
-	`"wide":{"type":"boolean","description":"Optional. True when the work is wider than one pair of hands. Say true whenever you judged it broad; a wrong true costs nothing"},` +
-	`"model":{"type":"string","description":"Optional, only where the person asked for one: a catalog id or part of one, never a class word, so resolve \"fast\" to a concrete model. A word fitting several is shown to the person to settle"},` +
+	`"depends_on":{"type":"array","items":{"type":"integer"},"description":"Ids that must finish first, only ones propose_task returned. Its brief is given their reports; an unknown or failed id refuses the proposal"},` +
+	`"wide":{"type":"boolean","description":"Optional. True when the work is wider than one pair of hands; a wrong true costs nothing"},` +
+	`"model":{"type":"string","description":"Optional, only where the person asked for one: a catalog id or part of one, never a class word. A word fitting several is shown to the person to settle"},` +
+	`"effort":{"type":"string","enum":["best","cheap"],"description":"Only when the person asked"},` +
 	`"max_steps":{"type":"integer","description":"Optional. Finished tool calls per progress checkpoint (default ` + strconv.Itoa(taskMaxSteps) + `); work still advancing is given more."},` +
 	`"no_progress":{"type":"integer","description":"Optional. Tool calls in a row that may add nothing before it is stopped as stuck (default ` + strconv.Itoa(taskNoProgress) + `). Raise it for work that must read a great deal first"}` +
 	`},"required":["title","summary","brief","deliverable","acceptance"],"additionalProperties":false}`
@@ -211,12 +213,15 @@ type taskArguments struct {
 	// Checks is the repeatable verification this proposal puts the work under:
 	// the only commands its independent checker will be allowed to run
 	// (task_checks.go). Optional, and the harness never writes one either.
-	Checks     []string `json:"checks,omitempty"`
-	DependsOn  []uint64 `json:"depends_on"`
-	Wide       bool     `json:"wide"`
-	Model      string   `json:"model"`
-	MaxSteps   int      `json:"max_steps"`
-	NoProgress int      `json:"no_progress"`
+	Checks    []string `json:"checks,omitempty"`
+	DependsOn []uint64 `json:"depends_on"`
+	Wide      bool     `json:"wide"`
+	Model     string   `json:"model"`
+	// Effort is the person's one-task word for how hard to try — best or
+	// cheap — which moves this task's crew and nothing after it (taskcrew.go).
+	Effort     string `json:"effort"`
+	MaxSteps   int    `json:"max_steps"`
+	NoProgress int    `json:"no_progress"`
 }
 
 // taskSpec is one node's settled instruction: what the person was shown, and
@@ -338,6 +343,10 @@ type taskSpec struct {
 	modelWord    string
 	model        string
 	modelOptions []string
+	// crewEffort is the one-task crew word the proposal carried — best, cheap,
+	// or empty for the router's own knee (taskcrew.go). It is not `effort`
+	// below, which is how hard the model thinks, not which models the crew is.
+	crewEffort crewroute.Effort
 	// effort is the rung this node's workers ask the model for, empty when
 	// nobody has set one and the ladder's next rung down decides
 	// (internal/effort). It travels the same road `model` travels — set at
@@ -842,7 +851,7 @@ func (p *stagedProposal) Commit(ctx context.Context) (string, bool, error) {
 		// before it: in a batch committed at one moment none of the hand-offs
 		// could see a live run beforehand, and the one that opened the run is
 		// decided under the start lock ([Agent.startOrJoinTaskRun]).
-		joined, err := a.startOrJoinTaskRun(context.WithoutCancel(ctx), p.id, spec.title, description, spec.dependsOn, p.stand, question)
+		joined, err := a.startOrJoinTaskRun(withCrewWish(context.WithoutCancel(ctx), crewWish{effort: spec.crewEffort}), p.id, spec.title, description, spec.dependsOn, p.stand, question)
 		if refusal := (standsElsewhereError{}); errors.As(err, &refusal) {
 			return refusal.Error(), true, nil
 		}
@@ -854,7 +863,7 @@ func (p *stagedProposal) Commit(ctx context.Context) (string, bool, error) {
 			return receipt, false, nil
 		}
 		if !errors.Is(err, errRunRoadUnavailable) {
-			return withElsewhere(runDidNotStart(p.id, err), elsewhere), true, nil
+			return withElsewhere(runDidNotStartToModel(p.id, err), elsewhere), true, nil
 		}
 	}
 	state := graph.admit(p.id, spec)
@@ -991,6 +1000,13 @@ func parseTaskArguments(args json.RawMessage) (taskSpec, string) {
 		maxSteps:   parsed.MaxSteps,
 		noProgress: parsed.NoProgress,
 	}
+	if word := strings.TrimSpace(parsed.Effort); word != "" {
+		effort, ok := crewroute.ParseEffort(word)
+		if !ok {
+			return spec, "Invalid arguments: effort is best or cheap, or left out"
+		}
+		spec.crewEffort = effort
+	}
 	// A NEGATIVE THRESHOLD IS A MISTAKE WORTH SAYING OUT LOUD, where an absent
 	// one is not: omitting the field means "use the default" and is the ordinary
 	// case, but a model that asked for -1 steps meant something it did not say,
diff --git a/internal/session/task_contract.go b/internal/session/task_contract.go
index bd487227ef..12e3efbdfe 100644
--- a/internal/session/task_contract.go
+++ b/internal/session/task_contract.go
@@ -1,6 +1,7 @@
 package session
 
 import (
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"strconv"
 	"strings"
 	"time"
@@ -786,6 +787,12 @@ type TaskNotice struct {
 	Model string
 	// NextModel is a saved continuation choice; Model still names the last attempt.
 	NextModel string
+	// Crew is the crew the router picked for this task — the class it read the
+	// task as, each seat's model and route, which seats were pinned, and the
+	// estimate — and nil on work that was not routed (taskcrew.go). The card
+	// draws its crew line from it, with CostUSD as the actual beside the
+	// estimate once there is one.
+	Crew *crewroute.Decision
 	// CostUSD is what this node's own agent has spent, live while it runs and
 	// frozen once it lands. Zero means nobody published a price — an unpriced
 	// model, or a node that has not started — and it is NOT the same claim as
diff --git a/internal/session/task_run_belt.go b/internal/session/task_run_belt.go
index f261ee5ff7..c9d0796b10 100644
--- a/internal/session/task_run_belt.go
+++ b/internal/session/task_run_belt.go
@@ -34,6 +34,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/router"
 	"math"
 	"os"
 	"strconv"
@@ -112,6 +114,11 @@ type RunSpec struct {
 	// probe rides are named by no door and stay the profile's.
 	WorkModel string
 	PlanModel string
+	// CheckModel is the checker the task's crew was routed to, and empty when
+	// the run was not routed — the engine then reads the check seat's own
+	// environment rung and the profile's checker row, and never the plan
+	// seat's model.
+	CheckModel string
 	// CompleterFor answers the provider a worker is seated on. The door hands
 	// the conversation's own — a run worker's calls go out the way the
 	// conversation's do — and a nil one lets the engine build each worker's
@@ -247,6 +254,10 @@ type beltRun struct {
 	// It is the same reading the row published to the surface carries, so the
 	// tree and the row cannot disagree about when the work began.
 	born time.Time
+	// crew is the crew the router picked for this run, nil when this session
+	// has no router or the run was carried on from an earlier launch
+	// (taskcrew.go). It seats the run's spec and rides its rows.
+	crew *taskCrew
 }
 
 // startTaskRun is StartTask's second road, taken whenever the bash belt is asked
@@ -303,9 +314,19 @@ var errRunRoadUnavailable = errors.New("the run road is unavailable")
 // IT MUST NOT READ LIKE SUCCESS. A receipt that said `task N started` over work
 // that never started is one output with two meanings, and the person reading it
 // cannot tell them apart; so this one opens on the one fact that differs.
+//
+// IT IS SAID TO THE PERSON, so it carries no instruction meant for the model:
+// the proposal door, whose answer the model reads, adds that itself
+// ([runDidNotStartToModel]).
 func runDidNotStart(id uint64, err error) string {
 	reason := strings.TrimSuffix(strings.TrimSpace(err.Error()), ".")
-	return fmt.Sprintf("task %d did not start: %s. Nothing is running for it and nothing was started in its place; propose it again, or tell the person what stopped it.", id, reason)
+	return fmt.Sprintf("task %d did not start: %s. Nothing is running for it and nothing was started in its place.", id, reason)
+}
+
+// runDidNotStartToModel is [runDidNotStart] as the model reads it at the
+// proposal door: the same facts, and what it may do next.
+func runDidNotStartToModel(id uint64, err error) string {
+	return runDidNotStart(id, err) + " Propose it again, or tell the person what stopped it."
 }
 
 // standsElsewhereError is the one refusal that STAYS AT THE RUN'S DOOR: a task
@@ -394,6 +415,13 @@ func (a *Agent) startOrJoinTaskRun(ctx context.Context, id uint64, title, brief
 		return true, nil
 	}
 
+	// THE CREW IS PICKED BEFORE ANYTHING IS OPENED, so a task the router
+	// refuses — the daily cap, a seat nothing allowed can sit — leaves no store
+	// and no copy behind it (taskcrew.go).
+	crew, err := a.routeTaskCrew(ctx, id, title, brief)
+	if err != nil {
+		return false, err
+	}
 	plan, store, err := a.openBeltRunStore(g, path, storeID, title, brief, false)
 	if err != nil {
 		return false, err
@@ -421,7 +449,7 @@ func (a *Agent) startOrJoinTaskRun(ctx context.Context, id uint64, title, brief
 	run := &beltRun{
 		plan: plan, store: store, root: store.RootID(), row: id, title: title,
 		workspace: tree.dir, ground: canonicalPath(stand.dir), tree: tree, cut: cut,
-		born: born, over: make(chan struct{}),
+		born: born, over: make(chan struct{}), crew: crew,
 	}
 	a.installBeltRun(g, run)
 	// THE COPY IS WRITTEN DOWN IN THE SAME BREATH THE RUN IS PUBLISHED, because
@@ -437,6 +465,8 @@ func (a *Agent) startOrJoinTaskRun(ctx context.Context, id uint64, title, brief
 		// twice rather than two pieces of work ([TaskNotice.PlanTask]). In
 		// [planStoreID]'s spelling, which is the one the plan read answers under.
 		PlanTask: planStoreID(storeID),
+		Crew:     run.crewDecision(),
+		Model:    run.crewWorker(),
 	})
 
 	go a.driveBeltRun(runCtx, engine, run, a.beltRunSpec(run, brief))
@@ -564,6 +594,15 @@ func (a *Agent) beltRunSpec(run *beltRun, brief string) RunSpec {
 	source := roles.Source(a.config.RolesSource)
 	workSeat, _ := roles.TierModel(source, roles.TierWorker)
 	planSeat, _ := roles.TierModel(source, roles.TierMastermind)
+	checkSeat := ""
+	// A ROUTED RUN IS SEATED ON ITS OWN CREW, all three seats, and the check
+	// seat is the checker the router picked for this task — never the plan
+	// seat's model by inheritance (taskcrew.go).
+	if d := run.crewDecision(); d != nil {
+		workSeat = d.Seat(crewroute.Worker).Send
+		planSeat = d.Seat(crewroute.Planner).Send
+		checkSeat = d.Seat(crewroute.Checker).Send
+	}
 
 	wallLeft, _ := a.config.Budget.Left()
 	if a.config.Budget.Wall > 0 && !a.startedAt.IsZero() {
@@ -590,7 +629,8 @@ func (a *Agent) beltRunSpec(run *beltRun, brief string) RunSpec {
 		ProfileDir:   a.config.ProfileDir,
 		WorkModel:    workSeat,
 		PlanModel:    planSeat,
-		CompleterFor: func(string) Completer { return a.beltRunCompleter() },
+		CheckModel:   checkSeat,
+		CompleterFor: func(string) Completer { return a.crewRunCompleter(run) },
 	}
 }
 
@@ -634,6 +674,16 @@ func (a *Agent) setBeltRunMachineHold(run *beltRun, ids []string) {
 	}
 }
 
+// crewRunCompleter is the completer a run's seats call through: the
+// conversation's account-aware view, with the routed crew's seat fallback in
+// front of it when the run was routed (taskcrew.go).
+func (a *Agent) crewRunCompleter(run *beltRun) Completer {
+	if run == nil || run.crew == nil {
+		return a.beltRunCompleter()
+	}
+	return crewSeatCompleter{agent: a, run: run}
+}
+
 // openBeltRunStore opens the conversation's store for a run. A NEW REQUEST GETS
 // A STORE OF ITS OWN, seeded under its own root with its own words; whatever
 // store it finds there is set aside first ([setAsideRunStore]). Only carryOn —
@@ -757,7 +807,7 @@ func (a *Agent) installBeltRun(g *TaskGraph, run *beltRun) {
 // halfway through would send the place back to guessing by title exactly when
 // the work ended, which is the moment a person goes looking for its page.
 func (a *Agent) publishRunRow(g *TaskGraph, notice TaskNotice) {
-	if notice.Copy == nil || notice.PlanTask == "" {
+	if notice.Copy == nil || notice.PlanTask == "" || notice.Crew == nil {
 		for _, kept := range g.runRows(notice.ID) {
 			if kept.ID != notice.ID {
 				continue
@@ -768,6 +818,9 @@ func (a *Agent) publishRunRow(g *TaskGraph, notice TaskNotice) {
 			if notice.PlanTask == "" && kept.PlanTask != "" {
 				notice.PlanTask = kept.PlanTask
 			}
+			if notice.Crew == nil && kept.Crew != nil {
+				notice.Crew = kept.Crew
+			}
 			break
 		}
 	}
@@ -842,6 +895,7 @@ func (a *Agent) driveBeltRun(ctx context.Context, engine RunEngine, run *beltRun
 		// A RUN A PERSON STOPPED IS NOT LANDED. Its work is kept where the stop's
 		// own sentence said it would be, and the ending is the stop's (stoprun.go).
 		a.settleStoppedBeltRun(run, why, summary.Cut)
+		a.settleTaskCrew(run.row, router.CrewNotKept, summary.USD)
 		return
 	}
 	if closing && summary.Outcome != beltRunOutcomeDone {
@@ -866,7 +920,7 @@ func (a *Agent) driveBeltRun(ctx context.Context, engine RunEngine, run *beltRun
 	// owns the short beltRunSummaryDeadline: refusal, malformed output, or a
 	// slow provider leaves the stored reading alone and cannot hold the run
 	// beyond that bound. RefreshRunSummary itself declines without a store.
-	refreshCtx, cancelRefresh := context.WithTimeout(ctx, beltRunSummaryDeadline)
+	refreshCtx, cancelRefresh := context.WithTimeout(withCrewTask(ctx, run.crew), beltRunSummaryDeadline)
 	a.RefreshRunSummary(refreshCtx, run.root, time.Time{})
 	cancelRefresh()
 	if _, err := run.store.AddNote(run.root, run.root, beltRunOutcomeNote(run.store, run.root, summary, landing)); err != nil {
@@ -876,6 +930,40 @@ func (a *Agent) driveBeltRun(ctx context.Context, engine RunEngine, run *beltRun
 	}
 	a.deliverBeltRunLanding(run, summary, landing)
 	a.settleBeltRun(run, summary, landing)
+	// THE CREW'S OUTCOME is the TASK's — was the result kept — and never the
+	// route's, which the seats' first calls wrote already (taskcrew.go). A run
+	// that finished and whose landing nobody refused is accepted: merged, in
+	// place, KEPT on its branch on purpose (a protected branch, a clean repo
+	// on main), or nothing to land because the work was an answer. Only a
+	// refused, conflicted or abandoned landing is not kept. A later
+	// `/redo stronger` overwrites it.
+	outcome := router.CrewNotKept
+	if crewKept(summary.Outcome, landing) {
+		outcome = router.CrewAccepted
+	}
+	a.settleTaskCrew(run.row, outcome, run.crew.taskSpent(summary.USD))
+}
+
+// crewKept is whether a run's ending counts as its crew's work kept: it
+// finished, and its landing was neither refused, conflicted nor abandoned.
+//
+// HOW THE WORK CAME HOME IS READ FIRST. A run whose work was kept on its
+// branch on purpose carries the sentence naming that branch in Refused too
+// ([Agent.landBeltRun] writes the road's own words there, for the outcome
+// note), and that sentence is an account of a keep, not a refusal. Only a
+// landing with no homecoming at all is judged by Refused: the engine's own
+// refusal to land.
+func crewKept(outcome string, landing RunLanding) bool {
+	if outcome != beltRunOutcomeDone {
+		return false
+	}
+	switch landing.Home {
+	case mergeConflicted, mergeAborted:
+		return false
+	case "":
+		return landing.Refused == ""
+	}
+	return true
 }
 
 // releaseBeltRun is the last thing every run does: it is cleared off the Agent,
@@ -1120,6 +1208,19 @@ func (a *Agent) beltRunNotice(run *beltRun, summary RunSummary, landing RunLandi
 		Ending: beltRunLimitEnding(summary.Limit),
 		Report: report, Result: summary.Result,
 		Changed: landing.Changed,
+		// THE CREW THAT DID IT AND WHAT IT COST, beside the estimate it was
+		// picked under, for the card's crew line.
+		Crew: run.crewDecision(), Model: run.crewWorker(), CostUSD: run.crew.taskSpent(summary.USD),
+	}
+	if state == TaskFailed && run.crew != nil {
+		decision := run.crew.stoppedIfCutOff()
+		notice.Crew = &decision
+	}
+	if run.crew != nil && !run.crew.anyStarted() {
+		// A CREW NO SEAT OF WHICH EVER ANSWERED WROTE NOTHING: whatever the
+		// landing counted is the run's own scaffolding, and "1 file" under a
+		// run that never started claims work nobody did.
+		notice.Changed = nil
 	}
 	if landing.Branch != "" {
 		notice.Branch = landing.Branch
@@ -1217,3 +1318,21 @@ func planArchivePaths(path string) []string {
 	}
 	return paths
 }
+
+// crewDecision is the run's routed crew, nil when it was not routed.
+func (run *beltRun) crewDecision() *crewroute.Decision {
+	if run == nil || run.crew == nil {
+		return nil
+	}
+	decision := run.crew.current()
+	return &decision
+}
+
+// crewWorker is the routed worker's id, the model the run's row names; empty
+// when the run was not routed.
+func (run *beltRun) crewWorker() string {
+	if d := run.crewDecision(); d != nil {
+		return d.Seat(crewroute.Worker).Model
+	}
+	return ""
+}
diff --git a/internal/session/taskcrew.go b/internal/session/taskcrew.go
new file mode 100644
index 0000000000..227b67dc9d
--- /dev/null
+++ b/internal/session/taskcrew.go
@@ -0,0 +1,991 @@
+package session
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Agent-Field/agentfield/sdk/go/ai"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/provider"
+	"github.com/Agent-Field/codeaf/internal/router"
+)
+
+// A TASK'S CREW IS PICKED FOR THAT TASK, AT THE MOMENT IT STARTS.
+//
+// The /crew panel says what is allowed and what is pinned, and that persists;
+// the words in the ask say how hard to try THIS task, and nothing else sticks.
+// So every run this conversation starts asks the router (internal/crewroute,
+// through [Config.RouteCrew]) for its worker, planner and checker, with the
+// task's own title and brief to classify and the one-task effort word the
+// person or the conversation said — `/task --best`, `/task --cheap`, or the
+// `effort` field of a hand-off. The decision rides the run's spec into the
+// engine's crew factory, rides its row to the surface (the card's crew line),
+// and is written to the router's log twice: once when it is made, once when
+// the task settles, which is what the router learns from.
+//
+// THE ROUTER IS OPTIONAL HERE AND NOTHING IS INVENTED WITHOUT IT. A session no
+// door gave a router — a test, the harness — runs its tasks on its role
+// ladder's seats the way it always has; the crew is a surface's decision to
+// wire, never a model this package names.
+//
+// A HAND-OFF THAT JOINS A RUN ALREADY UNDERWAY RIDES THAT RUN'S CREW. A run is
+// one crew factory, seated once; the joined work is a child of its root.
+
+// crewWish is what a hand-off asked of its crew: the one-task effort word, and
+// for a redo the crew it is asking to beat. It travels on the context the start
+// door is handed, because that door has half a dozen callers and every one of
+// them but two asks nothing of the crew.
+type crewWish struct {
+	effort   crewroute.Effort
+	stronger *crewroute.Decision
+	// again is a redo of a crew that never started: the next-best models at
+	// the same cost, because nothing ran to be too weak.
+	again *crewroute.Decision
+}
+
+type crewWishKey struct{}
+
+// withCrewWish hands a start door the crew wish; an empty wish is no value.
+func withCrewWish(ctx context.Context, wish crewWish) context.Context {
+	if wish.effort == "" && wish.stronger == nil && wish.again == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, crewWishKey{}, wish)
+}
+
+func crewWishOf(ctx context.Context) crewWish {
+	wish, _ := ctx.Value(crewWishKey{}).(crewWish)
+	return wish
+}
+
+// taskCrew is one task's crew as this conversation remembers it: enough to
+// settle its log row and to redo it stronger.
+type taskCrew struct {
+	call    string
+	title   string
+	brief   string
+	repo    string
+	costUSD float64
+	settled string
+
+	// mu guards the three fields under it, which the run's completer moves
+	// from the engine's goroutines while the row and the log read them.
+	mu       sync.Mutex
+	decision crewroute.Decision
+	// started are the send ids that have answered a call on this task: a seat
+	// whose model has answered once has started, and a later refusal is the
+	// work's to handle, not a reason to change the crew.
+	started map[string]bool
+	// swaps are the send ids the engine asks for and where their seat moved.
+	swaps map[string]string
+	// original is each seat's send id as routed — what the engine asks for —
+	// and ladders each unpinned seat's rungs as routed.
+	original map[crewroute.Seat]string
+	ladders  map[crewroute.Seat][]crewroute.Pick
+	// bad are routes that failed here; broke are accounts that ran out of
+	// credit here; gone are providers whose key was refused here.
+	bad, broke, gone map[string]bool
+	// guard holds every seat call to the day's cap and the checker to its
+	// own ceiling (spendguard.go); nil when nothing prices the crew.
+	guard *SpendGuard
+	// freeTried is how many free pools each seat has been moved onto in this
+	// task: at most crewFreePools, so a task on an account out of credit
+	// whose every free pool is at its limit stops on its action in seconds,
+	// not after walking every pool the catalog lists.
+	freeTried map[crewroute.Seat]int
+	// failed is how each send that failed its first call on this task failed:
+	// it is not asked again on this task, by any seat.
+	failed map[string]crewFailure
+	// helperUSD is what helper calls made for this task cost — its run's
+	// closing summary — added to the seats' spend on the crew line.
+	helperUSD float64
+	// day and dayAtStart are the conversation's guarded day and what it had
+	// spent when this task was routed: a helper the surface asked for before
+	// the run was registered (its first summary) carries no task, and is on
+	// this task's line through the day's own figure.
+	day        *SpendDay
+	dayAtStart float64
+}
+
+// current is the crew as it stands, fallbacks taken.
+func (c *taskCrew) current() crewroute.Decision {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.decision
+}
+
+// crewBook is the conversation's crews by row. It is a small map guarded by
+// its own lock, so neither the belt's locks nor the agent's are ever held
+// across a router call.
+type crewBook struct {
+	mu   sync.Mutex
+	rows map[uint64]*taskCrew
+}
+
+func (b *crewBook) put(row uint64, crew *taskCrew) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.rows == nil {
+		b.rows = map[uint64]*taskCrew{}
+	}
+	b.rows[row] = crew
+}
+
+func (b *crewBook) get(row uint64) *taskCrew {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.rows[row]
+}
+
+// latest is the newest row with a crew — the task `/redo stronger` means when
+// it names none.
+func (b *crewBook) latest() (uint64, *taskCrew) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	var best uint64
+	for row := range b.rows {
+		if row > best {
+			best = row
+		}
+	}
+	return best, b.rows[best]
+}
+
+// routeTaskCrew asks the router for one task's crew. It answers nil and no
+// error when this session has no router — the ladder's seats then stand.
+//
+// AT THE DAILY CAP THE TASK DOES NOT START, and the refusal says the cap, what
+// was spent and the two ways on: raise it, or say `--cheap`. A conversation
+// has nobody to answer a yes/no at the moment a hand-off is committed, and a
+// cap that spends anyway is not a cap.
+func (a *Agent) routeTaskCrew(ctx context.Context, row uint64, title, brief string) (*taskCrew, error) {
+	route := a.config.RouteCrew
+	if route == nil {
+		return nil, nil
+	}
+	wish := crewWishOf(ctx)
+	repo := canonicalPath(a.config.Workspace)
+	decision, err := route(config.CrewAsk{
+		Task:   crewroute.Task{Text: strings.TrimSpace(title + "\n\n" + brief)},
+		Effort: wish.effort, Stronger: wish.stronger, Again: wish.again, Repo: repo,
+		ChatModel: a.Model(),
+	})
+	if errors.Is(err, config.ErrCrewAtCap) {
+		spent, capUSD := config.CrewHistory(a.config.ProfileDir).SpentUSD, config.CrewCapAt(a.config.ProfileDir)
+		return nil, fmt.Errorf("today's crew spend (%s) has reached the daily cap of %s · raise it with /crew cap, or ask for this task with --cheap",
+			crewroute.Money(spent), crewroute.Money(capUSD))
+	}
+	if err != nil {
+		return nil, err
+	}
+	crew := &taskCrew{
+		call: router.CrewCallID(a.journalID() + ":" + strconv.FormatUint(row, 10)), decision: decision,
+		title: title, brief: brief, repo: repo,
+		original: map[crewroute.Seat]string{}, ladders: decision.Ladder,
+	}
+	for _, pick := range decision.Crew {
+		crew.original[pick.Seat] = pick.Send
+	}
+	crew.guard = crewSpendGuard(a.config.ProfileDir, decision, false)
+	crew.guard.Day = a.crewDay()
+	crew.day, crew.dayAtStart = a.crewDay(), a.crewDay().Total()
+	a.crews.put(row, crew)
+	config.LogCrewDecision(a.config.ProfileDir, crew.call, decision, repo, title)
+	return crew, nil
+}
+
+// settleTaskCrew writes a task's crew outcome once: accepted when the work
+// came home, not kept otherwise. A redo overwrites it later with its own row,
+// and the log reads the last row for a call as the truth.
+func (a *Agent) settleTaskCrew(row uint64, outcome string, costUSD float64) {
+	crew := a.crews.get(row)
+	if crew == nil || a.config.RouteCrew == nil {
+		return
+	}
+	a.crews.mu.Lock()
+	if crew.settled != "" {
+		a.crews.mu.Unlock()
+		return
+	}
+	crew.settled, crew.costUSD = outcome, costUSD
+	a.crews.mu.Unlock()
+	config.LogCrewOutcome(a.config.ProfileDir, crew.call, crew.current(), crew.repo, crew.title, outcome, costUSD)
+}
+
+// ErrNoCrewToRedo is `/redo stronger` in a conversation that has started no
+// routed task.
+var ErrNoCrewToRedo = errors.New("no task here to redo · /redo stronger follows a task this conversation started")
+
+// RedoStronger runs a task again with a stronger crew: every seat nobody
+// pinned steps up one ([crewroute.Decide] with Stronger set), and the router's
+// log is told the first crew under-served this class here, so the next task of
+// the class in this repository starts a step higher until enough accepted
+// work decays it back. row 0 means the newest task this conversation started.
+//
+// IT IS ONE TASK'S ASK AND NOTHING STICKS: the pins and the allowed rule are
+// the panel's, untouched. A crew already at the top answers
+// [crewroute.ErrStrongest] in words, and nothing starts.
+func (a *Agent) RedoStronger(ctx context.Context, row uint64) (uint64, string, error) {
+	var crew *taskCrew
+	if row == 0 {
+		row, crew = a.crews.latest()
+	} else {
+		crew = a.crews.get(row)
+	}
+	if crew == nil {
+		return 0, "", ErrNoCrewToRedo
+	}
+	// A RUN STILL GOING IS JOINED, NOT REDONE: a hand-off meeting a live run
+	// becomes a child of it and rides its crew, which is the one thing a redo
+	// is asking not to happen.
+	a.beltMu.Lock()
+	live := a.beltRun != nil
+	a.beltMu.Unlock()
+	if live {
+		return 0, "", errors.New("the work is still running · stop it first, then /redo stronger")
+	}
+	prior := crew.current()
+	// A CREW THAT NEVER STARTED IS ASKED AGAIN, NOT ESCALATED: no seat answered
+	// a call, so nothing ran to be too weak, and the redo takes the next-best
+	// models at the same cost ([crewroute.Request.Again]).
+	wish := crewWish{stronger: &prior}
+	if !crew.anyStarted() {
+		wish = crewWish{again: &prior}
+	}
+	id, title, _, err := a.startTaskRun(withCrewWish(ctx, wish), crew.brief, true, "")
+	if err != nil {
+		if strings.Contains(err.Error(), crewroute.ErrStrongest.Error()) {
+			return 0, "", errors.New("this crew is already the strongest allowed · pin a stronger model with /crew pin, or widen /crew models")
+		}
+		return 0, "", err
+	}
+	// THE LESSON IS WRITTEN ONLY ONCE THE STRONGER CREW IS REALLY GOING: a
+	// redo refused at the top of the ladder taught nothing about the class.
+	a.crews.mu.Lock()
+	crew.settled = router.CrewRedone
+	cost := crew.costUSD
+	a.crews.mu.Unlock()
+	config.LogCrewOutcome(a.config.ProfileDir, crew.call, crew.current(), crew.repo, crew.title, router.CrewRedone, cost)
+	return id, title, nil
+}
+
+// StartTaskEffort is [Agent.StartTask] with the one-task effort word said:
+// `/task --best` and `/task --cheap`. The word moves this task's crew and
+// nothing after it.
+func (a *Agent) StartTaskEffort(ctx context.Context, brief string, solo bool, effort string) (uint64, string, string, error) {
+	word, _ := crewroute.ParseEffort(effort)
+	return a.StartTask(withCrewWish(ctx, crewWish{effort: word}), brief, solo)
+}
+
+// ── A SEAT WHOSE MODEL FAILS TO START: THE DEGRADATION LADDER ──────────────
+//
+// A routed model can be listed, priced and allowed and still refuse the first
+// request a task sends it: an account out of credit, a key refused, a route
+// that will not take this model, a limit reached, a model withdrawn. The task
+// used to end there, in its first second, on a crew nobody chose. Now the
+// failure is read into one kind (internal/provider's RouteFailure), written to
+// the router's log as the ROUTE's outcome ([config.LogCrewRoute]) — which is
+// what route health is learned from — and the seat walks its ladder, inside
+// the task:
+//
+//  1. the same model on its next healthy route;
+//  2. the next qualified models for the seat at a similar cost;
+//  3. the seat as the last crew that completed a task here ran it;
+//  4. the model the person is talking to, when it can sit the seat.
+//
+// The first two are the router's ([crewroute.Decision.Ladder]); the last two
+// only this install knows ([config.CrewRescue]). A rung on a route this task
+// has already seen fail — or on an account it has seen run out of credit, or a
+// provider whose key was refused — is stepped over. With nothing left the call
+// ends on ONE action read off the kind ("add credit on …", "reconnect …",
+// "the limit resets at …"), never on the refusal's own text.
+//
+// A transient failure — a timeout, one 5xx — is asked again once first.
+// ONLY A FIRST CALL COUNTS: a route that has answered once on this task has
+// started, and a later error is the work's own to handle. A cancelled context
+// is somebody stopping the work. A PINNED SEAT IS NEVER MOVED — the person
+// chose it — and its failure ends on the same one action.
+
+// crewSeatCompleter is the run's completer with the ladder in front. It asks
+// through the one model door ([Agent.completeWithModel]) — the account-aware
+// road [modelRoutingCompleter] takes — naming the seat's current send.
+type crewSeatCompleter struct {
+	agent *Agent
+	run   *beltRun
+}
+
+func (c crewSeatCompleter) CompleteWithMessages(ctx context.Context, messages []ai.Message, options ...ai.Option) (*ai.Response, error) {
+	crew := c.run.crew
+	key, err := c.seatKey(options)
+	if err != nil {
+		return nil, err
+	}
+	if !crew.seats(key) {
+		// NOT A SEAT OF THIS CREW: a tier the run asks for that the crew does
+		// not name (a probe, a small errand). It is an auxiliary call, and it
+		// goes through the route-health guard like every other one — never
+		// to a route this task's crew was routed around.
+		// It is a call of this task, so it counts against the task's limit.
+		return c.agent.completeWithModel(withCrewTask(ctx, crew), purposeInherited, messages, key, options...)
+	}
+	retried := false
+	for {
+		current := crew.sendFor(key)
+		if failed, ok := crew.failedHere(current); ok {
+			// A SEND THAT FAILED ON THIS TASK IS NOT ASKED AGAIN, by this seat
+			// or any other: a pool that answered 429 with an hour's
+			// Retry-After is rested for the task, and the seat walks on — or
+			// ends on its action — without another request.
+			if action, moved := c.agent.moveCrewSeat(c.run, key, current, failed.kind, failed.until); !moved {
+				return nil, crewSeatEnd(action, failed.err)
+			}
+			continue
+		}
+		held, err := crew.guard.before(current, messages, options)
+		if err != nil {
+			// THE CALL THAT WOULD CROSS THE LINE IS NOT MADE, and the line
+			// says which line it met — never "/redo stronger".
+			return nil, c.agent.stopCrew(c.run, err)
+		}
+		// A SEAT NEVER WAITS OUT A LIMIT: a 429 goes back at once, and the
+		// seat moves to its next route or model ([provider.WithoutPatientRateLimits]).
+		response, err := c.agent.completeWithModel(provider.WithoutPatientRateLimits(asCrewSeatCall(ctx)), purposeInherited, messages, current, options...)
+		crew.guard.after(current, response, held)
+		if err == nil {
+			c.agent.crewAnswered(c.run, current)
+			return response, nil
+		}
+		if ctx.Err() != nil || crew.hasStarted(current) {
+			return response, err
+		}
+		kind, until := provider.RouteFailureOf(err)
+		if kind == "" {
+			return response, err
+		}
+		if kind == provider.RouteTransient && !retried {
+			retried = true
+			continue
+		}
+		retried = false
+		crew.noteFailed(current, crewFailure{kind: kind, until: until, err: err})
+		if action, moved := c.agent.moveCrewSeat(c.run, key, current, kind, until); !moved {
+			if action == "" {
+				return response, err
+			}
+			return response, crewStopped{action: action, cause: err}
+		}
+	}
+}
+
+// seatKey is the send id a seat call names — the seat as routed — or the
+// conversation's model when it names none.
+func (c crewSeatCompleter) seatKey(options []ai.Option) (string, error) {
+	var request ai.Request
+	for _, option := range options {
+		if err := option(&request); err != nil {
+			return "", err
+		}
+	}
+	if key := strings.TrimSpace(request.Model); key != "" {
+		return key, nil
+	}
+	return c.agent.Model(), nil
+}
+
+// crewFailure is how a send failed its first call on this task.
+type crewFailure struct {
+	kind  provider.RouteFailure
+	until time.Time
+	err   error
+}
+
+// noteFailed remembers how send failed on this task.
+func (c *taskCrew) noteFailed(send string, failure crewFailure) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.failed == nil {
+		c.failed = map[string]crewFailure{}
+	}
+	c.failed[send] = failure
+}
+
+// failedHere is how send failed on this task, if it did and never answered.
+func (c *taskCrew) failedHere(send string) (crewFailure, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	failure, ok := c.failed[send]
+	return failure, ok && !c.started[send]
+}
+
+// crewFinal is whether err is a crew's own last word — a seat with nowhere
+// left to go, a call a spend line stopped, a route resting — which ends the
+// turn it reaches rather than being retried as the failure under it.
+func crewFinal(err error) bool {
+	var stopped crewStopped
+	var spend ErrSpendStopped
+	var resting errRouteResting
+	return errors.As(err, &stopped) || errors.As(err, &spend) || errors.As(err, &resting)
+}
+
+// crewSeatEnd is the error a seat with nowhere left to go ends on: its one
+// action when the failures name one, the failure itself otherwise.
+func crewSeatEnd(action string, cause error) error {
+	if action == "" {
+		return cause
+	}
+	return crewStopped{action: action, cause: cause}
+}
+
+// crewSeatCallKey marks a context as a crew seat's own call, which walks its
+// own ladder and must reach exactly the route it names ([Agent.healthyModel]).
+type crewSeatCallKey struct{}
+
+func asCrewSeatCall(ctx context.Context) context.Context {
+	return context.WithValue(ctx, crewSeatCallKey{}, true)
+}
+
+func isCrewSeatCall(ctx context.Context) bool {
+	on, _ := ctx.Value(crewSeatCallKey{}).(bool)
+	return on
+}
+
+// healthyModel is the model an auxiliary call asks: model, unless route
+// health says model's route will not answer, in which case the router's
+// healthy pick ([config.CrewHealthySend]). THE PERSON'S TURN, THEIR OWN
+// MODEL AND A CREW SEAT'S CALL ARE NEVER REROUTED: the first two are the
+// person's choice, and a seat walks its own ladder and says so on its line.
+func (a *Agent) healthyModel(ctx context.Context, purpose callPurpose, model string) string {
+	// AN EMPTY ProfileDir IS THE DEFAULT PROFILE, not no profile: every
+	// ordinary launch leaves it empty (config.ProfileDir is the override
+	// variable) and every read below resolves it to the home directory.
+	if a.config.RouteCrew == nil || isCrewSeatCall(ctx) || strings.TrimSpace(model) == "" {
+		return model
+	}
+	// ONLY THE PERSON'S OWN TURN ON THEIR OWN MODEL is theirs to send where
+	// they chose. An errand that falls back to the conversation's model —
+	// a run summary, a title — is still an errand, and is not sent to a route
+	// that refused that model a minute ago.
+	chat := a.Model()
+	if purpose == purposeTurn && model == chat {
+		return model
+	}
+	return config.CrewHealthySend(a.config.ProfileDir, model, chat)
+}
+
+// routeGate is the provider's last word on a route ([provider.Config.RouteGate]):
+// a body naming a model whose route health says will not answer is not sent,
+// WHICHEVER ROAD IT CAME BY — the door's own reroute ([Agent.healthyModel])
+// runs first, and this is what holds when a road skipped it. Two calls pass:
+// a crew seat's own, which walks its ladder and probes an account the task
+// is routed to, and the person's turn, whose model is theirs. send is the id
+// the client was built for and wire how it is spelled on the wire.
+func (c Config) routeGate(send, wire string) func(context.Context, string, string) error {
+	if c.RouteCrew == nil {
+		return nil
+	}
+	dir := c.ProfileDir
+	return func(ctx context.Context, model, tag string) error {
+		if isCrewSeatCall(ctx) || tag == string(purposeTurn) {
+			return nil
+		}
+		asked := strings.TrimSpace(model)
+		if asked == "" || asked == wire {
+			asked = send
+		}
+		if config.CrewRouteAnswers(dir, asked) {
+			return nil
+		}
+		return errRouteResting{model: asked}
+	}
+}
+
+// errRouteResting is a call the route gate did not send.
+type errRouteResting struct{ model string }
+
+func (e errRouteResting) Error() string {
+	return e.model + " was not asked: its route refused it recently and is resting"
+}
+
+// crewSpendGuard is a crew's spend guard: its prices, the day as the usage
+// ledger has it, the day's cap (the daily spending limit too when withDaily),
+// the per-task limit — which withDaily does not touch — and the checker's
+// ceiling.
+func crewSpendGuard(profileDir string, d crewroute.Decision, withDaily bool) *SpendGuard {
+	capUSD, action := config.CrewSpendCap(profileDir, withDaily)
+	taskCap, taskAction := config.CrewTaskSpendCap(profileDir)
+	guard := &SpendGuard{
+		Price: config.CrewCallPrice, Cap: capUSD, CapAction: action,
+		Ceilings: config.CrewSeatCeilings(d), CeilingAction: config.CrewCheckCeilingAction,
+		TaskCap: taskCap, TaskAction: taskAction, Task: &SpendTask{},
+	}
+	if capUSD > 0 {
+		guard.Day = NewSpendDay(spentTodayOnLedger())
+	}
+	return guard
+}
+
+// crewDay is the day's spend this conversation holds its crews and their
+// helpers to: the usage ledger's figure when first asked, and every guarded
+// call after — seats and helpers alike — so a helper's call counts against
+// the cap a seat's next call is priced under, and the other way round.
+func (a *Agent) crewDay() *SpendDay {
+	a.crewDayOnce.Do(func() { a.crewDayHeld = NewSpendDay(spentTodayOnLedger()) })
+	return a.crewDayHeld
+}
+
+// helperGuard is the guard an auxiliary call in a conversation with crews is
+// held to: the crew's day cap, on the same day its seats are priced against,
+// and — for a call made for a task — that task's limit, on the same tally its
+// seats are priced against. Nil where there is no crew — a conversation under
+// --one-model.
+func (a *Agent) helperGuard(crew *taskCrew) *SpendGuard {
+	if a.config.RouteCrew == nil {
+		return nil
+	}
+	guard := &SpendGuard{Price: config.CrewCallPrice, Day: a.crewDay()}
+	if capUSD, action := config.CrewSpendCap(a.config.ProfileDir, false); capUSD > 0 {
+		guard.Cap, guard.CapAction = capUSD, action
+	}
+	if crew != nil && crew.guard != nil {
+		guard.TaskCap, guard.TaskAction, guard.Task = crew.guard.TaskCap, crew.guard.TaskAction, crew.guard.tally()
+	}
+	return guard
+}
+
+// crewTaskKey marks a helper call made for one task — its run's closing
+// summary — so what it cost is on that task's crew line.
+type crewTaskKey struct{}
+
+func withCrewTask(ctx context.Context, crew *taskCrew) context.Context {
+	if crew == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, crewTaskKey{}, crew)
+}
+
+func crewTaskOf(ctx context.Context) *taskCrew {
+	crew, _ := ctx.Value(crewTaskKey{}).(*taskCrew)
+	return crew
+}
+
+// addHelperSpend puts a helper call's cost on the task it was made for.
+func (c *taskCrew) addHelperSpend(response *ai.Response) {
+	if c == nil || response == nil || response.Usage == nil || response.Usage.Cost == nil || *response.Usage.Cost <= 0 {
+		return
+	}
+	c.mu.Lock()
+	c.helperUSD += *response.Usage.Cost
+	c.mu.Unlock()
+}
+
+// liveCrewFor is the crew of the run this conversation is driving under
+// root, when there is one: a summary a surface asks for while the run is live
+// is that task's helper, and its cost is on that task's line.
+func (a *Agent) liveCrewFor(root string) *taskCrew {
+	a.beltMu.Lock()
+	defer a.beltMu.Unlock()
+	if a.beltRun == nil || a.beltRun.root != root {
+		return nil
+	}
+	return a.beltRun.crew
+}
+
+// stoppedAction is the action this task stopped on, if it stopped on one or
+// saw its account cut off.
+func (c *taskCrew) stoppedAction() string {
+	if c == nil {
+		return ""
+	}
+	return c.stoppedIfCutOff().Stopped
+}
+
+// helperSpent is what helpers spent on this task.
+func (c *taskCrew) helperSpent() float64 {
+	if c == nil {
+		return 0
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.helperUSD
+}
+
+// taskSpent is what this task cost for its crew line and its log row: the
+// seats' spend and the helpers made for it, or — when more — every guarded
+// call the conversation made since the task was routed, which a conversation
+// running one task at a time spent on this task.
+func (c *taskCrew) taskSpent(seats float64) float64 {
+	if c == nil {
+		return seats
+	}
+	spent := seats + c.helperSpent()
+	if c.day != nil {
+		if since := c.day.Total() - c.dayAtStart; since > spent {
+			spent = since
+		}
+	}
+	return spent
+}
+
+// CrewSpendGuard is [crewSpendGuard] for a headless run's seats.
+func CrewSpendGuard(profileDir string, d crewroute.Decision, withDaily bool) *SpendGuard {
+	return crewSpendGuard(profileDir, d, withDaily)
+}
+
+// TaskSpendGuard is the guard a headless run with no routed crew is held to:
+// the per-task limit alone.
+func TaskSpendGuard(profileDir string) *SpendGuard {
+	taskCap, taskAction := config.CrewTaskSpendCap(profileDir)
+	return &SpendGuard{Price: config.CrewCallPrice, TaskCap: taskCap, TaskAction: taskAction, Task: &SpendTask{}}
+}
+
+// spentTodayOnLedger is today's spend as the usage ledger has it; nothing
+// when the ledger cannot be read.
+func spentTodayOnLedger() float64 {
+	now := time.Now()
+	lines, err := ReadUsage(UsageLedgerPath(), now.Add(-48*time.Hour))
+	if err != nil {
+		return 0
+	}
+	return SpendToday(lines, now)
+}
+
+// stopCrew records a guard's stop on the crew — the line leads with it — and
+// answers the error the seat call ends on.
+func (a *Agent) stopCrew(run *beltRun, err error) error {
+	var stopped ErrSpendStopped
+	if !errors.As(err, &stopped) {
+		return err
+	}
+	crew := run.crew
+	crew.mu.Lock()
+	crew.decision.Stopped = stopped.Action
+	decision := crew.decision
+	crew.mu.Unlock()
+	a.republishCrew(run, decision, stopped.Action)
+	return crewStopped{action: stopped.Action, cause: err}
+}
+
+// crewStopped is a seat with nowhere left to go: its text is the one action,
+// and the refusal underneath stays reachable for whoever reads it.
+type crewStopped struct {
+	action string
+	cause  error
+}
+
+func (e crewStopped) Error() string { return e.action }
+func (e crewStopped) Unwrap() error { return e.cause }
+
+// seats is whether key is one of this crew's seats as routed — what the run
+// engine asks for when it calls a seat. original is written once, when the
+// crew is routed, and only read after.
+func (c *taskCrew) seats(key string) bool {
+	for _, send := range c.original {
+		if send == key {
+			return true
+		}
+	}
+	return false
+}
+
+// sendFor is the send id a request for key goes to now: key, or where the
+// seat has moved.
+func (c *taskCrew) sendFor(key string) string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if to := c.swaps[key]; to != "" {
+		return to
+	}
+	return key
+}
+
+// hasStarted is whether a send id has answered a call on this task.
+func (c *taskCrew) hasStarted(send string) bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.started[send]
+}
+
+// anyStarted is whether any seat answered a call on this task.
+func (c *taskCrew) anyStarted() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return len(c.started) > 0
+}
+
+// crewAnswered notes that a send id answered its first call on this task, and
+// writes the route's success to the router's log once.
+func (a *Agent) crewAnswered(run *beltRun, send string) {
+	crew := run.crew
+	crew.mu.Lock()
+	if crew.started[send] {
+		crew.mu.Unlock()
+		return
+	}
+	if crew.started == nil {
+		crew.started = map[string]bool{}
+	}
+	crew.started[send] = true
+	decision := crew.decision
+	crew.mu.Unlock()
+	for _, seat := range crewroute.Seats {
+		if pick := decision.Seat(seat); pick.Send == send {
+			config.LogCrewRoute(a.config.ProfileDir, crew.call, decision, crew.repo, crew.title, seat, pick, "", time.Time{})
+		}
+	}
+}
+
+// moveCrewSeat moves every unpinned seat whose calls go to key, and which is
+// on current, one rung down its ladder. It answers false and the one action
+// when there is nowhere to go.
+func (a *Agent) moveCrewSeat(run *beltRun, key, current string, kind provider.RouteFailure, until time.Time) (string, bool) {
+	crew := run.crew
+	crew.mu.Lock()
+	provided := a.crewFailedLocked(crew, current, kind, until)
+	decision, next := crew.decision, crewroute.Pick{}
+	for _, seat := range crewroute.Seats {
+		pick := decision.Seat(seat)
+		if pick.Send != current || pick.Pinned || crew.original[seat] != key {
+			continue
+		}
+		rung, ok := crew.takeRungLocked(seat, append(append([]crewroute.Pick(nil), crew.ladders[seat]...),
+			config.CrewRescue(a.config.ProfileDir, decision.Class, seat, a.Model())...))
+		if !ok {
+			continue
+		}
+		decision = withFreeNotice(decision.WithRung(seat, rung, crewWhy(kind, provided)), rung)
+		if next.Send == "" {
+			next = rung
+		}
+	}
+	if next.Send == "" {
+		action := crew.actionLocked(kind, provided, until)
+		stopped := crewStopsOn(kind) || len(crew.broke) > 0 || len(crew.gone) > 0
+		if stopped {
+			// THE CAUSE IS KNOWN, SO THE LINE SAYS THE ONE THING TO DO — and
+			// not "/redo stronger", which no stronger crew on the same
+			// account could make work.
+			decision.Stopped = action
+			crew.decision = decision
+		}
+		crew.mu.Unlock()
+		if stopped {
+			a.republishCrew(run, decision, current+" could not start · "+action)
+		}
+		return action, false
+	}
+	if crew.swaps == nil {
+		crew.swaps = map[string]string{}
+	}
+	crew.swaps[key], crew.decision = next.Send, decision
+	crew.mu.Unlock()
+	a.republishCrew(run, decision, fmt.Sprintf("%s could not start (%s) · moved to %s", current, crewWhy(kind, provided), next.Send))
+	return "", true
+}
+
+// crewFailedLocked writes a failed first call to the router's log for every
+// seat on current, and marks what this task must not ask again: the route, an
+// account out of credit, a provider whose key was refused. It answers the
+// provider the route was on. The caller holds crew.mu.
+func (a *Agent) crewFailedLocked(crew *taskCrew, current string, kind provider.RouteFailure, until time.Time) string {
+	var provided string
+	// A send another seat already found failed is written down once.
+	again := crew.bad[current]
+	for _, seat := range crewroute.Seats {
+		if pick := crew.decision.Seat(seat); pick.Send == current {
+			provided = pick.Provider
+			if again {
+				continue
+			}
+			config.LogCrewRoute(a.config.ProfileDir, crew.call, crew.decision, crew.repo, crew.title, seat, pick, string(kind), until)
+		}
+	}
+	if crew.bad == nil {
+		crew.bad, crew.broke, crew.gone = map[string]bool{}, map[string]bool{}, map[string]bool{}
+	}
+	crew.bad[current] = true
+	switch kind {
+	case provider.RoutePayment:
+		crew.broke[provided] = true
+	case provider.RouteAuth:
+		crew.gone[provided] = true
+	}
+	return provided
+}
+
+// republishCrew puts a moved crew on the run's row, so the card's crew line
+// says it, and leaves a note on the plan.
+func (a *Agent) republishCrew(run *beltRun, decision crewroute.Decision, note string) {
+	g := a.graph()
+	if g == nil {
+		return
+	}
+	for _, kept := range g.runRows(run.row) {
+		if kept.ID != run.row {
+			continue
+		}
+		kept.Crew = &decision
+		kept.Model = decision.Seat(crewroute.Worker).Model
+		a.publishRunRow(g, kept)
+		break
+	}
+	g.planNote(note)
+}
+
+// nextRung is the first rung this task has not seen fail: not a route that
+// failed here, not a paid route on an account that ran out of credit here, not
+// a provider whose key was refused here. The caller holds c.mu.
+func (c *taskCrew) nextRung(ladder []crewroute.Pick) (crewroute.Pick, bool) {
+	for _, rung := range ladder {
+		switch {
+		case rung.Send == "" || c.bad[rung.Send] || c.gone[rung.Provider]:
+		case rung.Kind == crewroute.Metered && c.broke[rung.Provider]:
+		default:
+			return rung, true
+		}
+	}
+	return crewroute.Pick{}, false
+}
+
+// actionLocked is the one thing to do when a seat has nowhere left to go,
+// read off EVERYTHING this task saw fail rather than the last failure alone:
+// an account out of credit is the cause even when the free pool tried after
+// it was at its limit, and a refused key is the cause of every call after it.
+// The caller holds c.mu.
+func (c *taskCrew) actionLocked(kind provider.RouteFailure, on string, until time.Time) string {
+	switch {
+	case len(c.broke) > 0:
+		return crewActionFor(provider.RoutePayment, strings.Join(crewKeys(c.broke), ", "), until)
+	case len(c.gone) > 0:
+		return crewActionFor(provider.RouteAuth, strings.Join(crewKeys(c.gone), ", "), until)
+	}
+	return crewActionFor(kind, on, until)
+}
+
+// stoppedIfCutOff is the crew as a failed task ends it: when this task saw an
+// account run out of credit or a key refused, a stronger crew is out of reach
+// on it too, so the one action is what the line ends on — never "/redo
+// stronger". A crew that already stopped on its action, or saw neither, is
+// left as it is.
+func (c *taskCrew) stoppedIfCutOff() crewroute.Decision {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.decision.Stopped == "" && (len(c.broke) > 0 || len(c.gone) > 0) {
+		c.decision.Stopped = c.actionLocked("", "", time.Time{})
+	}
+	return c.decision
+}
+
+// takeRungLocked is the seat's next rung this task has not seen fail, within
+// its free pools, counted when it is a free pool. The caller holds c.mu.
+func (c *taskCrew) takeRungLocked(seat crewroute.Seat, rungs []crewroute.Pick) (crewroute.Pick, bool) {
+	rung, ok := c.nextRung(c.withinFreePools(seat, rungs))
+	if ok && rung.Kind == crewroute.Free {
+		if c.freeTried == nil {
+			c.freeTried = map[crewroute.Seat]int{}
+		}
+		c.freeTried[seat]++
+	}
+	return rung, ok
+}
+
+// withFreeNotice is d with the free-pool notice when rung is a free pool.
+func withFreeNotice(d crewroute.Decision, rung crewroute.Pick) crewroute.Decision {
+	if rung.Kind == crewroute.Free && !strings.Contains(d.Note, "free routes in use") {
+		d.Note = strings.TrimSpace(d.Note + " " + crewFreeNotice)
+	}
+	return d
+}
+
+// withinFreePools is rungs without the free pools once seat has been moved
+// onto crewFreePools of them in this task. The caller holds c.mu.
+func (c *taskCrew) withinFreePools(seat crewroute.Seat, rungs []crewroute.Pick) []crewroute.Pick {
+	if c.freeTried[seat] < crewFreePools {
+		return rungs
+	}
+	out := rungs[:0]
+	for _, r := range rungs {
+		if r.Kind != crewroute.Free {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// crewFreePools is how many free pools — models, not attempts — one seat is
+// moved onto in one task.
+const crewFreePools = 3
+
+// crewKeys is a set's members, sorted.
+func crewKeys(set map[string]bool) []string {
+	out := make([]string, 0, len(set))
+	for k, on := range set {
+		if on && k != "" {
+			out = append(out, k)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// crewFreeNotice is what the crew line says when a seat fell to a free pool:
+// the pool may keep what it is sent.
+const crewFreeNotice = "free routes in use (may log prompts)"
+
+// crewStopsOn is whether a seat with nowhere left to go stops the task on its
+// one action: a failure whose cause a person can fix (credit, a key, a
+// limit), where a stronger crew would meet the same wall.
+func crewStopsOn(kind provider.RouteFailure) bool {
+	switch kind {
+	case provider.RoutePayment, provider.RouteAuth, provider.RouteQuota:
+		return true
+	}
+	return false
+}
+
+// crewWhy is a failure as the crew line says why a seat moved.
+func crewWhy(kind provider.RouteFailure, on string) string {
+	if on == "" {
+		on = "its provider"
+	}
+	switch kind {
+	case provider.RoutePayment:
+		return "credit unavailable on " + on
+	case provider.RouteAuth:
+		return "key refused on " + on
+	case provider.RouteForbidden:
+		return "not available on " + on
+	case provider.RouteQuota:
+		return "limit reached on " + on
+	case provider.RouteUnavailable:
+		return "not served on " + on
+	}
+	return on + " not answering"
+}
+
+// crewActionFor is the one thing a person can do when a seat has nowhere left
+// to go, read off what the route said.
+func crewActionFor(kind provider.RouteFailure, on string, until time.Time) string {
+	if on == "" {
+		on = "the provider"
+	}
+	switch kind {
+	case provider.RoutePayment:
+		return "add credit on " + on + " to continue"
+	case provider.RouteAuth:
+		return "reconnect " + on + " with /connect"
+	case provider.RouteQuota:
+		if !until.IsZero() {
+			return "the limit on " + on + " resets at " + until.Local().Format("15:04") + " — try again then"
+		}
+		return "the limit on " + on + " is reached — try again later"
+	}
+	return "no model could start this seat · widen /crew models or pin one with /crew"
+}
diff --git a/internal/session/taskmodel.go b/internal/session/taskmodel.go
index f127a7fc60..23009e6eaf 100644
--- a/internal/session/taskmodel.go
+++ b/internal/session/taskmodel.go
@@ -99,8 +99,8 @@ func (a *Agent) resolveTaskModel(word string) taskModelChoice {
 //
 // THE CREW'S WORKER SEAT SITS BETWEEN THE PIN AND THE CONVERSATION. The worker
 // is the seat that pays most of a task's bill, and until it was on the ladder
-// the crew moved everything about a task except its cost: a person on `frugal`
-// talking to a frontier model handed every task to that frontier model. The
+// the crew moved everything about a task except its cost: a person talking to a
+// frontier model handed every task to that frontier model. The
 // `task.model` row still wins, because it is the more specific answer — one
 // person pinning one thing — and the conversation is still the floor, because
 // a cleared worker row means "follow the conversation" on every tier
diff --git a/internal/session/taskmodel_test.go b/internal/session/taskmodel_test.go
index 3e806f966b..e963ac969b 100644
--- a/internal/session/taskmodel_test.go
+++ b/internal/session/taskmodel_test.go
@@ -179,7 +179,7 @@ func TestTaskModelAmbiguityBecomesAShortlistRatherThanARefusal(t *testing.T) {
 
 // THE CREW'S WORKER SEAT SITS BETWEEN THE CONFIGURED ROW AND THE CONVERSATION.
 // It is the seat that pays most of a task's bill, and before it was on this
-// ladder a person on `frugal` who was talking to a frontier model handed every
+// ladder a person whose crew seated a cheap worker, talking to a frontier model handed every
 // task to that frontier model — the crew moved everything about a task except
 // its cost. The row a person pinned still wins, a cleared seat still falls to
 // the conversation, and a level on the seat stays on the seat.
diff --git a/internal/session/taskseat_test.go b/internal/session/taskseat_test.go
index d8fe85aa53..7954f01fe1 100644
--- a/internal/session/taskseat_test.go
+++ b/internal/session/taskseat_test.go
@@ -13,33 +13,18 @@ import (
 //
 // The engine never reads a profile: the surface hands it a [Config.RolesSource]
 // and a task's model climbs the ladder through that (taskmodel.go's
-// [Agent.defaultTaskModel]). So the defect this test pins was one seam further
-// out — the door built the map by asking a profile older than the worker seat
-// for a row it has never held, got the build's own choice back, and every task
-// started in that conversation ran on a model the person had never named.
-//
-// This is the ENGINE half of the acceptance, driven through the same call the
-// chat door builds its map with (cmd/codeaf's v3Crew, whose own wiring test is
-// [TestTheChatRoleMapSeatsTheInheritedWorkerRow]): the five classes as
-// internal/config resolves them, and the model a task admitted right now would
-// run on.
-func TestATaskOnACrewOlderThanTheWorkerSeatRunsOnTheSmallWorkRow(t *testing.T) {
+// [Agent.defaultTaskModel]). This is the ENGINE half of the acceptance, driven
+// through the same call the chat door builds its map with (cmd/codeaf's
+// v3Crew): the worker row as internal/config resolves it — a pin, or the
+// router's pick — and the model a task admitted right now would run on. No
+// row is ever answered with a model this build chose for everybody.
+func TestATaskRunsOnTheCrewsWorker(t *testing.T) {
 	pinned := "vendor/pinned-small-work"
 	for _, test := range []struct {
 		name  string
 		rows  map[string]string
 		model string
 	}{
-		{
-			name: "a crew written before the worker row runs the row it was split out of",
-			rows: map[string]string{
-				config.KeyTierReflexModel:     "vendor/pinned-reflex",
-				config.KeyTierLowModel:        pinned,
-				config.KeyTierHighModel:       "vendor/pinned-careful",
-				config.KeyTierMastermindModel: "vendor/pinned-thinking",
-			},
-			model: pinned,
-		},
 		{
 			name:  "a pinned worker row is what the task runs on",
 			rows:  map[string]string{config.KeyTierLowModel: pinned, config.KeyTierWorkerModel: "vendor/my-own-worker"},
@@ -54,9 +39,13 @@ func TestATaskOnACrewOlderThanTheWorkerSeatRunsOnTheSmallWorkRow(t *testing.T) {
 			model: "test/model",
 		},
 		{
-			name:  "a profile that has said nothing runs this build's choice",
+			// A profile that has said nothing has an AUTO worker: the router
+			// picks it per task, and with nothing to pick from — no catalog in
+			// this test — the task rides the conversation's model, never a
+			// model this build chose for everybody.
+			name:  "a profile that has said nothing never runs a build-chosen worker",
 			rows:  map[string]string{},
-			model: config.DefaultWorkerModel,
+			model: "test/model",
 		},
 	} {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/internal/tui2/tokens/glyph.go b/internal/tui2/tokens/glyph.go
index 3721985848..2d755e4bf9 100644
--- a/internal/tui2/tokens/glyph.go
+++ b/internal/tui2/tokens/glyph.go
@@ -173,6 +173,13 @@ const (
 	// prompt's mapped-into arrow one slot up: a draft has gone nowhere yet, it
 	// sits on the wrong side of the line that one draws.
 	GlyphDraftUnsent = "✐"
+	// GlyphPinned is a crew seat a PERSON PINNED, beside the seats the router
+	// picks per task (internal/tui3's crew.go). It marks the one seat on a crew
+	// line nothing will move for the next task — the same fact the headless
+	// line marks with a pin. U+2316 POSITION INDICATOR is a fixed point, which is
+	// what a pin is, and it is East_Asian_Width=Neutral and one cell under both
+	// shipping rulers.
+	GlyphPinned = "⌖"
 
 	// The execution voices (5.5). A work record is four speakers and no
 	// labels: the model thinking, the tools it reached for, the reader
@@ -462,6 +469,7 @@ func Glyphs() []GlyphInfo {
 		{"PromptSteer", GlyphPromptSteer, '↦', false},
 		{"ReplyIn", GlyphReplyIn, '↳', false},
 		{"DraftUnsent", GlyphDraftUnsent, '✐', false},
+		{"Pinned", GlyphPinned, '⌖', false},
 		{"Thought", GlyphThought, '✳', false},
 		{"Shell", GlyphShell, '$', false},
 		{"Search", GlyphSearch, '⌕', false},
diff --git a/internal/tui2/tokens/glyphset.go b/internal/tui2/tokens/glyphset.go
index dd5d822c7e..83f88bf13e 100644
--- a/internal/tui2/tokens/glyphset.go
+++ b/internal/tui2/tokens/glyphset.go
@@ -189,6 +189,9 @@ const (
 	// was sent: the ring of them behind /drafts and the ↑ walk's dim end
 	// (internal/tui3's draftring.go, draftpage.go).
 	GDraftUnsent
+	// GPinned marks a crew seat a person pinned, which the router does not move
+	// (internal/tui3's crew.go).
+	GPinned
 	glyphIDCount
 )
 
diff --git a/internal/tui2/tokens/nerdfont.go b/internal/tui2/tokens/nerdfont.go
index e43e5c9a5b..cbe2081298 100644
--- a/internal/tui2/tokens/nerdfont.go
+++ b/internal/tui2/tokens/nerdfont.go
@@ -312,6 +312,14 @@ var vocabulary = []GlyphBinding{
 		ASCII:     "w",
 		UsualTint: TextTertiary, NFAmbiguous: true, AutoUpgrade: true,
 	},
+	// A crew seat a person pinned: the fixed point on the floor, the thumb tack
+	// where a patched font supplies one — a pin at two weights.
+	{
+		ID: GPinned, Name: "Pinned", Meaning: "a crew seat a person pinned; the router leaves it where it is",
+		Plain: GlyphPinned, NerdFont: "\uF08D", NFName: "nf-fa-thumb_tack",
+		ASCII:     "p",
+		UsualTint: TextTertiary, NFAmbiguous: true, AutoUpgrade: true,
+	},
 
 	// -- the execution voices (5.5) ------------------------------------------
 	{
diff --git a/internal/tui2/tokens/testdata/nerdfont_glyphnames.json b/internal/tui2/tokens/testdata/nerdfont_glyphnames.json
index 55613ecef2..946a052867 100644
--- a/internal/tui2/tokens/testdata/nerdfont_glyphnames.json
+++ b/internal/tui2/tokens/testdata/nerdfont_glyphnames.json
@@ -169,5 +169,8 @@
  },
  "nf-fa-pencil_square_o": {
   "code": "f044"
+ },
+ "nf-fa-thumb_tack": {
+  "code": "f08d"
  }
 }
diff --git a/internal/tui3/app.go b/internal/tui3/app.go
index 105239f1c7..50f607fdeb 100644
--- a/internal/tui3/app.go
+++ b/internal/tui3/app.go
@@ -1559,9 +1559,6 @@ type app struct {
 	// pick is the model overlay (palette.go). Closed, it costs the frame
 	// nothing; open, it owns the keyboard and the bottom of the screen.
 	pick picker
-	// crewPick is the three-row /crew chooser (crew.go). It is separate from the
-	// model picker because it has no filter and every item always takes two lines.
-	crewPick crewPicker
 	// effPick is the five-row thinking chooser `/effort` opens (effortchip.go).
 	// It is the crew chooser's shape for the crew chooser's reason: a fixed
 	// ladder is a thing you read rather than a thing you search.
@@ -1781,6 +1778,9 @@ type app struct {
 	// it, because that path runs entirely on session events (harness.go).
 	harn      *subharness.Store
 	harnPanel harnessPanel
+	// crewUI is /crew: the five rows a person changes about the crew, edited
+	// where they stand, over the conversation (crewpanel.go).
+	crewUI crewPanel
 	// harnPick is the filtering list "/harness " opens over that same registry,
 	// and harnChip the name it was answered with — the one harness the next
 	// message will run, held in the tray above the box rather than in the draft
@@ -2457,13 +2457,11 @@ type app struct {
 	// call on the conversation's own model and the crew on disk seats nothing,
 	// so the readings built from it name the flag ([Options.OneModel], #444).
 	oneModel bool
-	// workSeatSaid is whether this session has already asked whether its work
-	// seat was inherited (crew.go's [app.sayWorkSeat]). It is a fact about the
-	// SESSION and not about the profile: the line is a receipt for work that is
-	// starting now, said once where a person is already looking, and a surface
-	// that said it again per task — or per node of one task — would be the
-	// warning-on-every-call this whole mechanism refused headless (#311, #312).
-	workSeatSaid bool
+	// crewSaid is the crew line this session has said for each routed task,
+	// and whether the task has landed (crew.go's [app.sayTaskCrew]): the line
+	// is said once and rewritten in place, so a row that updates twenty times
+	// is one line in the thread.
+	crewSaid map[uint64]crewLineSaid
 	// notices is what this surface has told the person and may tell them next —
 	// the earned hints and the news line, over the profile's ledger (notice.go).
 	notices noticeBoard
@@ -3071,6 +3069,16 @@ func newApp(ctx context.Context, opts Options) *app {
 	// directory having an earlier conversation can see the welcome's list.
 	a.noticeEvent(eventBoot)
 	a.showUnreadProfileKeys(opts.UnreadProfileKeys)
+	// A PROFILE WRITTEN BEFORE CREWS WERE ROUTED IS MIGRATED ONCE, here on the
+	// first frame, and says so in one line: its preset words became auto, the
+	// ids a person wrote stayed pinned (internal/config's crewmigrate.go). A
+	// hosted window's profile is the far machine's, and is not this one's to
+	// migrate.
+	if !a.hosted() {
+		if line, _ := config.MigrateCrew(a.profileDir); line != "" {
+			a.note(line)
+		}
+	}
 	if notice := strings.TrimSpace(opts.Notice); notice != "" {
 		a.note(notice)
 	}
@@ -3754,6 +3762,13 @@ func (a *app) route(msg tea.Msg) (tea.Model, tea.Cmd) {
 		if a.questionDialogWheel(msg) {
 			return a, nil
 		}
+		// THE CREW PANEL TAKES THE WHEEL WHILE IT IS UP: its lists are longer
+		// than its frame, and the conversation under a modal is not live
+		// (crewpanel.go).
+		if a.crewUI.open {
+			a.crewWheel(placeWheelDelta(msg.Mouse().Button))
+			return a, nil
+		}
 		// THE TAB BAR IS READ BEFORE EVERY PLACE'S OWN ROWS, exactly as it is for
 		// the press: it is the router's row, drawn on all seven places in the same
 		// cells, so a wheel answered by the place under it would scroll a list for
@@ -4070,6 +4085,12 @@ func (a *app) route(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if a.harnPanel.open {
 				return a, a.harnessPanelPress(msg.Mouse().Y)
 			}
+			// AND THE CREW PANEL, on the same terms, with the one difference that
+			// it reads the column too: the models row's two arrows are targets of
+			// their own (crewpanel.go).
+			if a.crewUI.open {
+				return a, a.crewPress(msg.Mouse().X, msg.Mouse().Y)
+			}
 			// AND THE PERMISSIONS PANEL IS THE THIRD OF THEM, on the same terms
 			// (permissions.go): a press on a row acts on that row, and a press
 			// anywhere else closes the list.
@@ -4306,6 +4327,12 @@ func (a *app) route(msg tea.Msg) (tea.Model, tea.Cmd) {
 		a.touch()
 		return a, nil
 
+	case crewUndoMsg:
+		// And the crew panel's undo window closing (crewpanel.go): one repaint,
+		// so the tick and the `z undo` offer come down.
+		a.touch()
+		return a, nil
+
 	case tea.MouseMotionMsg:
 		a.sawAPerson()
 		// AND THE CHOOSER OWNS MOTION TOO, ahead of the sweep and ahead of every
@@ -4821,7 +4848,10 @@ func (a *app) route(msg tea.Msg) (tea.Model, tea.Cmd) {
 			// person names this node to any other command on the surface and the
 			// title is how they recognize it in the roster, so those two step up
 			// while the mode word and `started` stay in the note's own dim.
-			a.noteFacts(msg.kind+" task "+msg.id+" started · "+msg.title, msg.id, msg.title)
+			started := msg.kind + " task " + msg.id + " started · " + msg.title
+			if !a.crewAfterStarted(msg.id, started, []string{msg.id, msg.title}) {
+				a.noteFacts(started, msg.id, msg.title)
+			}
 			// AND WHERE THE WORK STANDS, when the engine had something to say
 			// about it: the ground ladder's redirect, said when the work goes
 			// somewhere other than where it was asked to go. Its own dim line
@@ -6194,7 +6224,7 @@ func (a *app) note(text string) { a.noteWritten(text, false, nil) }
 // whole, so a note written into the conversation behind it is written where
 // nobody can read it — and the answers that landed there were the ones a person
 // most needed: `there is no command called /x · / lists them`, /help's key
-// sheet, /status, /cost, `crew · frugal`, a budget that was set. Home has had a
+// sheet, /status, /cost, the /crew panel, a budget that was set. Home has had a
 // line for exactly this since it was built (pages.go's [app.placeMsgLine]) and
 // the dispatcher never reached it.
 //
@@ -7353,12 +7383,10 @@ func (a *app) slash(line string) tea.Cmd {
 		return nil
 
 	case "crew":
-		// The four models codeaf uses on your own behalf, as one word (crew.go).
-		// The bare form is the three presets with yours marked; a word applies
-		// one. An unknown word shows the three and changes nothing, which is the
-		// shape every choice row on this surface refuses in.
-		a.runCrew(rest)
-		return nil
+		// The crew panel and its four shortcuts (crew.go, crewpanel.go): what is
+		// allowed and what is pinned, which persists; nothing else about a crew
+		// sticks.
+		return a.runCrew(rest)
 
 	case "effort":
 		// How hard THIS conversation thinks (effortchip.go). The bare form opens
@@ -7370,6 +7398,11 @@ func (a *app) slash(line string) tea.Cmd {
 	case "task":
 		return a.runTaskCommand(rest)
 
+	case "redo":
+		// `/redo stronger` — the last task again on a stronger crew (crew.go,
+		// taskcommand.go's [app.runRedo]).
+		return a.runRedo(rest)
+
 	case "history":
 		// The place onto every task this MACHINE has run, this session's and every
 		// conversation's before it, across every project (place_tasks.go). It is
diff --git a/internal/tui3/bundle_test.go b/internal/tui3/bundle_test.go
index ed31984e1f..b2e5e423f8 100644
--- a/internal/tui3/bundle_test.go
+++ b/internal/tui3/bundle_test.go
@@ -940,7 +940,9 @@ func TestTheTierRowsAndTheVisionRowAreAnsweredByThePicker(t *testing.T) {
 	// The classes sit on the Providers tab, with the model they answer under
 	// (settings.go's [modelsSection]).
 	toProviders(t, a)
-	for _, row := range []string{config.KeyTierLowModel, config.KeyTierHighModel} {
+	// The seats — worker, planner, checker — are one row that opens /crew
+	// (settings.go's [sheet.crewDoorItem]); the small-work row is the class row left.
+	for _, row := range []string{config.KeyTierLowModel} {
 		cursorTo(t, a, row)
 		if got := a.sheet.items[a.sheet.cursor].meta.widget; got != widgetSelect {
 			t.Fatalf("%s is answered by widget %v, want the picker", row, got)
@@ -987,7 +989,7 @@ func TestEachSlotFiltersTheModelsByWhatItNeeds(t *testing.T) {
 	a.openSettings()
 	toProviders(t, a)
 
-	cursorTo(t, a, config.KeyTierHighModel)
+	cursorTo(t, a, config.KeyTierLowModel)
 	drive(t, a, key("enter"))
 	// Alphabetical, which is what a table opens in on this surface
 	// (pickersort.go). What this test is about is WHICH models are on offer.
@@ -2275,7 +2277,7 @@ func TestTheHintSlotFollowsTheStateAndIsEmptyAtRest(t *testing.T) {
 	a.pick.open = true
 	// The crew rides the end of the picker's hint (crew.go's [app.crewHint]),
 	// and an ordinary launch has one.
-	if got := a.hintWord(); got != "enter switch · esc · crew "+config.DefaultCrew {
+	if got := a.hintWord(); got != "enter switch · esc · crew auto" {
 		t.Fatalf("an open picker offered %q", got)
 	}
 	a.pick.open = false
diff --git a/internal/tui3/commands.go b/internal/tui3/commands.go
index 6cc3bfe2ee..549a0c6124 100644
--- a/internal/tui3/commands.go
+++ b/internal/tui3/commands.go
@@ -256,22 +256,20 @@ var commands = []command{
 	{name: "memories", args: "<query>", desc: "…only the ones matching a word"},
 	{name: "remember", args: "<text>", desc: "keep one thing across conversations"},
 	{name: "forget", args: "<query>", desc: "drop what is remembered about something"},
-	// AND WHAT codeaf WORKS WITH, beside what it knows about you. The five models
-	// it uses on your behalf, answered as one word (crew.go). FIVE, because
-	// [config.CrewModels] sets five seats in every preset — reflex, low, worker,
-	// high and mastermind — and the one these rows used to leave out was the
-	// worker, which is the seat that pays most of a task's bill. Two rows for one
-	// command, the way /model and /export have two: the bare form is the listing
-	// nearly everybody wants, and a single row carrying <preset> would make it
-	// unreachable from this list — [app.runMenu] puts a row that TAKES something
-	// into the draft instead of running it.
+	// AND WHAT codeaf WORKS WITH, beside what it knows about you: the crew a
+	// task runs on — worker, planner, checker — picked per task (crew.go). The
+	// bare form is the panel; the four shortcuts are how anything on it
+	// changes, one row each, because [app.runMenu] puts a row that TAKES
+	// something into the draft instead of running it, and each of these takes
+	// something.
 	//
 	// It sits here, under the memory rows, because those three are "what does it
-	// know" and this is "what does it think WITH", and because position in this
-	// table is a claim about frequency: a person sets their crew once and then
-	// occasionally regrets it, which is exactly where /memories sits too.
-	{name: "crew", desc: "the five models codeaf uses on its own behalf, beside the one you talk to"},
-	{name: "crew", args: "<preset>", desc: "…set the five to frugal, balanced or max · /model stays"},
+	// know" and this is "what does it think WITH".
+	{name: "crew", desc: "the crew tasks run on · picked per task, with your pins, allowed models and daily cap"},
+	{name: "crew", args: "pin <seat> <model[@provider]>", desc: "…pin the worker, planner or checker · /model stays"},
+	{name: "crew", args: "unpin <seat|all>", desc: "…put a seat back on auto"},
+	{name: "crew", args: "models <rule>", desc: "…which models a seat may be picked from · all, open, ≤in/out, ids"},
+	{name: "crew", args: "cap <dollars|off>", desc: "…the most tasks' crews may spend in a day"},
 	// AND HOW HARD THE ONE YOU TALK TO THINKS, under the two rows about WHICH
 	// models it thinks with, because that is the order the two questions arrive
 	// in: a person picks the model and then decides how much of it to spend.
@@ -292,6 +290,12 @@ var commands = []command{
 	{name: "effort", args: "<rung>", desc: "…set it outright · " + effortKey + " walks it, or press it on the seam"},
 	{name: "task", args: "<brief>", desc: "start work you can walk away from", door: sendDoorTask},
 	{name: "task", args: "solo <brief>", desc: "…with one worker, and no sizing call before it", door: sendDoorTask},
+	// HOW HARD TO TRY THIS ONE TASK is said in the ask and sticks to nothing
+	// (crew.go): --best puts the strongest crew the allowed models make on it,
+	// --cheap the cheapest, and neither moves the next task.
+	{name: "task", args: "--best <brief>", desc: "…on the strongest crew allowed, this task only", door: sendDoorTask},
+	{name: "task", args: "--cheap <brief>", desc: "…on the cheapest crew allowed, this task only", door: sendDoorTask},
+	{name: "redo", args: "stronger", desc: "the last task again, on a stronger crew"},
 	// THE THIRD ROW IS GONE, AND ITS ABSENCE IS THE FEATURE. It typed
 	// `adaptive <brief>`, which opened a planner that drew the whole graph before
 	// any of the work had been looked at. The measured road answers that question
diff --git a/internal/tui3/connectpanel.go b/internal/tui3/connectpanel.go
index 4bd1d20502..245c02331a 100644
--- a/internal/tui3/connectpanel.go
+++ b/internal/tui3/connectpanel.go
@@ -103,6 +103,11 @@ const connectFilterHint = "filter · ↑↓ · enter connect · esc close"
 type connectPanel struct {
 	open bool
 
+	// crew is where /crew's providers row was when its `+` opened this panel,
+	// nil otherwise: backing out of the panel — esc, or a press outside it —
+	// stands the crew panel back up there ([app.dismissConnect]).
+	crew *crewReturn
+
 	// groups is the catalog as a person browses it — the held accounts, then one
 	// category per group — and all is those same rows flattened, which is the
 	// STABLE SLICE everything else in here indexes into. Both are built once per
@@ -540,7 +545,7 @@ func (a *app) connectPanelKey(msg tea.KeyPressMsg) tea.Cmd {
 			p.filter.reset()
 			p.rank()
 		default:
-			p.close()
+			a.dismissConnect()
 		}
 
 	case "up", "ctrl+p":
@@ -653,7 +658,7 @@ func (a *app) connectPanelPress(y int) tea.Cmd {
 	if !ok || mark.kind != chromeOverlay {
 		// A press anywhere else closes it, which is what pressing outside a list
 		// means everywhere a list is modal.
-		p.close()
+		a.dismissConnect()
 		a.touch()
 		return nil
 	}
diff --git a/internal/tui3/crew.go b/internal/tui3/crew.go
index 0d7239cffb..67062cc7d9 100644
--- a/internal/tui3/crew.go
+++ b/internal/tui3/crew.go
@@ -1,159 +1,213 @@
 package tui3
 
 import (
+	"strconv"
 	"strings"
 
-	"charm.land/bubbletea/v2"
+	tea "charm.land/bubbletea/v2"
+
 	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/roles"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/session"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
 )
 
-// /crew — THE FIVE MODELS codeaf WORKS WITH, ANSWERED IN ONE WORD.
+// /crew — WHAT IS ALLOWED, AND WHAT IS PINNED. NOTHING ELSE STICKS.
+//
+// A task's crew is three seats — the WORKER that does the work, the PLANNER
+// that structures it, the CHECKER that reads the result — and by default all
+// three are AUTO: codeaf reads what kind of task it is and picks each seat for
+// that task, at the point on the quality-for-money curve past which paying more
+// stops buying much (internal/crewroute). The panel is where a person says what
+// PERSISTS: which seat is pinned to which model, which models may be picked at
+// all, and how much the crews may spend in a day. How hard to try ONE task is
+// said in the ask — `/task --best`, `/task --cheap`, or `/redo stronger` after
+// the fact — and moves nothing here.
 //
-// The settings panel has the same five rows and a crew row above them, and this
-// command exists anyway for the reason /model exists beside the model slot: the
-// panel is where you go to READ a decision, and a command is where you go to
-// CHANGE one you have already made up your mind about. Somebody whose planner is
-// not thinking hard enough types `/crew max` and gets one line back; the same
-// person in the panel opens a sheet, walks a tab bar, finds a row and presses a
-// key three times.
+// /model IS UNTOUCHED BY ALL OF IT. The model a person talks to is the
+// conversation's; the crew is the models codeaf spends on its own behalf.
 //
-// The bare form is the FIVE-SEAT READING: the model the person talks to on a
-// line of its own, then the three presets as a chooser. Each preset row keeps
-// the comparison the old listing supplied — its sentence first and the four
-// class models underneath — and the seat above them is the one thing on the
-// list no key can move ([crewPicker.rows] says why it is there anyway).
+// THE BARE FORM IS THE PANEL (crewpanel.go): the five rows a person changes
+// — three seats, the allowed models, the daily cap — edited where they stand.
+// The four shortcuts write the same rows through the same writers and then
+// open the panel with the tick on the row they changed, so a command and the
+// panel cannot disagree about which crew is on:
 //
-// EVERY CREW WRITE GOES THROUGH config's own writers: a preset through
-// [config.ApplyCrew], and the chooser's family-and-preset decision through
-// [config.ApplyCrewUnder] in one file write. A second writer anywhere else is how
-// a command and a panel end up disagreeing about which crew is on.
+//	/crew pin <seat> <model[@provider]>   /crew unpin <seat|all>
+//	/crew models <all|open|≤in/out|list|+model|-model>
+//	/crew cap <dollars|off>   /crew cap task <dollars>
+
+// crewUsage is the one line every refused /crew form answers with.
+const crewUsage = "/crew · /crew pin <worker|planner|checker> <model[@provider]> · /crew unpin <seat|all> · " +
+	"/crew models <all|open|≤in/out|ids…|+id|-id> · /crew cap <dollars|off> · /crew cap task <dollars>"
 
-// runCrew is /crew: the three presets with the current one marked, or one applied.
-func (a *app) runCrew(arg string) {
+// runCrew is /crew: the panel, or one of its four shortcuts. It answers the
+// tick that takes the panel's undo offer down after a shortcut opened it.
+func (a *app) runCrew(arg string) tea.Cmd {
 	a.noticeEvent(eventCrewShown)
 	if a.hosted() {
 		a.note(a.remoteProfileWord("the crew"))
-		return
+		return nil
 	}
-	arg = strings.ToLower(strings.TrimSpace(arg))
-	if arg == "" {
-		a.closeLists()
-		a.crewPick.start(config.CrewAt(a.profileDir), config.CrewSourceAt(a.profileDir),
-			a.crewInheritedLine(), config.CrewPickAt(a.profileDir))
-		a.touch()
-		return
+	arg = strings.TrimSpace(arg)
+	word, rest, _ := strings.Cut(arg, " ")
+	rest = strings.TrimSpace(rest)
+	switch strings.ToLower(word) {
+	case "":
+		a.openCrew()
+		return nil
 	}
-	// THE THREE PICK WORDS, beside the presets: `/crew learn` says where the
-	// seats come from without moving any of them. The row is written alone and
-	// the confirmation is [app.crewApplied]'s, which names the pick beside the
-	// preset ([config.CrewSummaryPick]) — the same word the segment and
-	// /status now carry, so the answer and the frame cannot drift apart.
-	for _, pick := range config.CrewPicks {
-		if arg != pick {
-			continue
-		}
-		if err := config.SetCrewPick(a.profileDir, pick); err != nil {
-			a.note("could not set the pick · " + err.Error())
-			return
+	// EVERY SHORTCUT KEEPS THE ROWS AS THEY STOOD, so the panel it opens can
+	// offer the same undo a change made on the panel offers.
+	before := config.CrewStateAt(a.profileDir)
+	stop := -1
+	switch strings.ToLower(word) {
+	case "pin":
+		stop = a.crewPin(rest)
+	case "unpin":
+		stop = a.crewUnpin(rest)
+	case "models":
+		stop = a.crewAllowedModels(rest)
+	case "cap":
+		stop = a.crewCap(rest)
+	default:
+		a.note("/crew " + arg + " · not a crew form · " + crewUsage)
+	}
+	if stop < 0 {
+		return nil
+	}
+	return a.crewNow(stop, before)
+}
+
+// crewPin is `/crew pin <seat> <model[@provider]>`. A pin outside the allowed
+// models is REFUSED rather than written, because a pin the router would have
+// to break is not a pin ([config.SetCrewPin] says the rule once).
+//
+// Each shortcut answers the panel row it changed, or -1 when it changed
+// nothing — a refusal, or a question it answered with a note.
+func (a *app) crewPin(rest string) int {
+	seatWord, model, _ := strings.Cut(rest, " ")
+	seat, ok := config.ParseCrewSeat(seatWord)
+	model = strings.TrimSpace(model)
+	if !ok || model == "" {
+		a.note("usage: /crew pin <worker|planner|checker> <model[@provider]>")
+		return -1
+	}
+	if err := config.SetCrewPin(a.profileDir, seat, model); err != nil {
+		a.note("could not pin the " + string(seat) + " · " + err.Error())
+		return -1
+	}
+	a.crewApplied()
+	pin, _ := config.CrewPinAt(a.profileDir, seat)
+	a.noteFacts(string(seat)+" "+a.crewMark(tokens.GPinned)+" "+pin.String()+" · every task until you unpin it · "+
+		a.crewUnchangedClause(), pin.String())
+	return crewSeatStop(seat)
+}
+
+// crewUnpin is `/crew unpin <seat|all>`: the seat goes back to auto.
+func (a *app) crewUnpin(rest string) int {
+	rest = strings.ToLower(strings.TrimSpace(rest))
+	if rest == "all" {
+		if err := config.ClearCrewPins(a.profileDir); err != nil {
+			a.note("could not unpin · " + err.Error())
+			return -1
 		}
 		a.crewApplied()
-		return
+		a.note("every seat is auto · codeaf picks the worker, planner and checker for each task")
+		return 0
 	}
-	if _, ok := config.CrewModels(arg); !ok {
-		// AN UNKNOWN WORD CHANGES NOTHING AND SAYS THE SIX, the shape every
-		// choice this surface refuses takes (effortchip.go's [app.runEffort]):
-		// a refusal that only said "no" would leave a person guessing at a word
-		// they were one letter away from, and the words are the answer to the
-		// question they were really asking. The listing is kept under them,
-		// because it is the comparison between the presets the words set.
-		// The listing is a two-column page — a class word, then the model it
-		// would set — so its right-hand column is what THE PAYLOAD RULE lifts,
-		// read back off the text this call just built (payload.go's
-		// [columnFacts]).
-		words := make([]string, 0, len(config.CrewPresets)+len(config.CrewPicks))
-		words = append(words, config.CrewPresets...)
-		words = append(words, config.CrewPicks...)
-		listing := a.crewListing()
-		facts := append(words, columnFacts(listing, false)...)
-		a.noteFacts("/crew "+arg+" · not a crew word · "+strings.Join(words, " · ")+"\n\n"+listing,
-			facts...)
-		return
+	seat, ok := config.ParseCrewSeat(rest)
+	if !ok {
+		a.note("usage: /crew unpin <worker|planner|checker|all>")
+		return -1
+	}
+	if err := config.ClearCrewPin(a.profileDir, seat); err != nil {
+		a.note("could not unpin the " + string(seat) + " · " + err.Error())
+		return -1
 	}
-	a.applyCrew(arg)
+	a.crewApplied()
+	a.note(string(seat) + " is auto · picked for each task")
+	return crewSeatStop(seat)
 }
 
-// applyCrew is the ONE path from either /crew form to the profile write, the
-// settings refresh and the person-facing summary.
-func (a *app) applyCrew(preset string) {
-	if err := config.ApplyCrew(a.profileDir, preset); err != nil {
-		a.note("could not set the crew · " + err.Error())
-		return
+// crewAllowedModels is `/crew models <rule>`: the whole rule, or a `+id`/`-id`
+// changing the rule in force. A bare `/crew models` says the rule.
+func (a *app) crewAllowedModels(rest string) int {
+	if rest == "" {
+		a.noteFacts("allowed models · "+config.CrewAllowedAt(a.profileDir).String(), config.CrewAllowedAt(a.profileDir).String())
+		return -1
+	}
+	var err error
+	switch {
+	case strings.HasPrefix(rest, "+") && !strings.Contains(rest, " "):
+		err = config.ModifyCrewAllowed(a.profileDir, true, strings.TrimPrefix(rest, "+"))
+	case strings.HasPrefix(rest, "-") && !strings.Contains(rest, " "):
+		err = config.ModifyCrewAllowed(a.profileDir, false, strings.TrimPrefix(rest, "-"))
+	default:
+		err = config.SetCrewAllowed(a.profileDir, rest)
+	}
+	if err != nil {
+		a.note("could not set the allowed models · " + err.Error())
+		return -1
 	}
 	a.crewApplied()
+	rule := config.CrewAllowedAt(a.profileDir).String()
+	a.noteFacts("allowed models · "+rule+" · every seat nobody pinned is picked from these", rule)
+	return crewModels
 }
 
-// crewApplied is the tail both crew writes share: the panel rebuild and the
-// person-facing confirmation.
-func (a *app) crewApplied() {
-	// The panel may be holding rows read before this write, so it is rebuilt if
-	// it is open. Everything else is live: the crew source the session resolves
-	// through re-reads on its next call (cmd/codeaf's v3RolesSource).
-	a.refreshSettings()
-	// AND THE CONFIRMATION NAMES WHAT IT DID NOT CHANGE, BY ITS ID. The status
-	// line's model readout is the CONVERSATION's model and the crew never touches
-	// it — so the person who typed /crew to make codeaf think harder reads three
-	// model names, looks down at a bottom row that says exactly what it said
-	// before, and concludes the command did nothing. The clause used to say only
-	// that "the model you talk to is /model", and a person who had not yet
-	// learned the two dials read that as a hint about a command rather than as a
-	// fact about their session; naming the model they are still on, in the same
-	// spelling the status line draws it, makes the unchanged thing something they
-	// can see is unchanged. The clause is on the note rather than in
-	// [config.CrewSummary] because it is an answer to a question this MOMENT
-	// raises: the same summary inside /status is being read by somebody who is
-	// reading a page, not by somebody who just changed one dial of two.
-	//
-	// AND THE FOUR MODELS ARE THE PART THIS LINE IS FOR (payload.go). The prose
-	// around them — `crew →`, the preset word the person has just typed, the three
-	// role words, `you are still talking to` — stays in the dim tier every note
-	// wears, and the ids step up, because "which models am I on now" is the whole
-	// question and it used to be answered at exactly the weight of the sentence
-	// carrying it. /model is a door, so it wears the chip a door wears.
-	facts := config.CrewClassModels(a.profileDir)
-	if id := a.talkingTo(); id != "" {
-		facts = append(facts, id)
-	}
-	// THE SUMMARY IS THE PICK-AWARE ONE ([config.CrewSummaryPick]), so a crew
-	// applied under a pick of catalog or learn confirms with the pick named
-	// beside the preset — the half the frame's segment and /status now carry.
-	// At the default pick it is the line the command has always confirmed
-	// with.
-	a.noteFacts(config.CrewSummaryPick(a.profileDir)+" · "+a.crewUnchangedClause(), facts...)
+// crewCap is `/crew cap <dollars|off>`. The router paces toward it — dearer
+// crews cost more of the day's quality as the day's spend climbs — and at it a
+// task does not start until the person raises it or asks for `--cheap`.
+func (a *app) crewCap(rest string) int {
+	if word, figure, _ := strings.Cut(rest, " "); strings.EqualFold(word, "task") {
+		return a.crewTaskCap(strings.TrimSpace(figure))
+	}
+	if rest == "" {
+		a.note("daily cap · " + a.crewCapWords())
+		return -1
+	}
+	if err := config.SetCrewCap(a.profileDir, rest); err != nil {
+		a.note("could not set the daily cap · " + err.Error())
+		return -1
+	}
+	a.crewApplied()
+	a.note("daily cap · " + a.crewCapWords())
+	return crewCap
 }
 
-// applyCrewUnder is the chooser's enter: the family and the preset are ONE
-// decision, and [config.ApplyCrewUnder] lands them as one file write. Landing
-// them apart would leave a window in which a reader sees the family set to `all`
-// while the five rows still hold open ids, which is the half-written crew the
-// chooser is the one place to promise against.
-func (a *app) applyCrewUnder(source, preset string) {
-	if err := config.ApplyCrewUnder(a.profileDir, source, preset); err != nil {
-		a.note("could not set the crew · " + err.Error())
-		return
+// crewTaskCap is `/crew cap task <dollars>`: the most one task may spend.
+// A call that would take a task past it is not made.
+func (a *app) crewTaskCap(rest string) int {
+	if rest == "" {
+		a.note("per-task limit · " + config.CrewTaskMoney(config.CrewTaskCapAt(a.profileDir)))
+		return -1
+	}
+	if err := config.SetCrewTaskCap(a.profileDir, rest); err != nil {
+		a.note("could not set the per-task limit · " + err.Error())
+		return -1
 	}
 	a.crewApplied()
+	a.note("per-task limit · " + config.CrewTaskMoney(config.CrewTaskCapAt(a.profileDir)))
+	return crewCap
 }
 
-// crewUnchangedClause is the tail of every crew confirmation: the model the
+// crewCapWords is the cap and today's spend, or `none` for no cap.
+func (a *app) crewCapWords() string {
+	spent := config.CrewLogAt(a.profileDir).SpentUSD
+	if capUSD := config.CrewCapAt(a.profileDir); capUSD > 0 {
+		return crewroute.Money(capUSD) + " · " + crewroute.Money(spent) + " spent today"
+	}
+	return "none · " + crewroute.Money(spent) + " spent today"
+}
+
+// crewApplied is the tail every crew write shares: an open panel re-reads and
+// an open settings sheet is rebuilt, because either may be holding rows read
+// before the write ([app.crewRefreshed]).
+func (a *app) crewApplied() { a.crewRefreshed() }
+
+// crewUnchangedClause is the tail of a pin's confirmation: the model the
 // conversation is still on, and the one command that moves it.
-//
-//	you are still talking to deepseek-v4-flash — /model changes that
-//
-// THE EMPTINESS LAW has a sentence-shaped edge here. A session that has not been
-// told its model yet has nothing to name, and "you are still talking to" with a
-// gap after it would be a line that looks cut; the clause says the fact without
-// the id instead, which is still true and still points at the right door.
 func (a *app) crewUnchangedClause() string {
 	if id := a.talkingTo(); id != "" {
 		return "you are still talking to " + id + " — /model changes that"
@@ -163,14 +217,7 @@ func (a *app) crewUnchangedClause() string {
 
 // talkingTo is the conversation's model spelled the way the status line's model
 // segment spells it: the basename, with the reasoning level riding on it when
-// one is set (render.go's [app.identityParts], view.go's [app.statusRow]).
-//
-// It reads a.model and NOT whatever the status row is naming at the moment,
-// because inside a task room the row names the node's model, and the crew
-// confirmation is a fact about the conversation whichever page is open. A person
-// checking the clause against the foot of the frame from outside a room finds
-// the same spelling; from inside one they find the node's, which the room's own
-// lead word already says is a different thing.
+// one is set.
 func (a *app) talkingTo() string {
 	id := modelBase(a.model)
 	if id == "" {
@@ -182,645 +229,222 @@ func (a *app) talkingTo() string {
 	return id
 }
 
-// crewWord is the crew as a page states it: the preset word or `custom`, then
-// the three class names ([config.CrewClasses]). It is what /status prints and
-// what [app.crewHint] shortens.
-//
-// THE EMPTINESS LAW: a window with no crew to read prints nothing rather than a
-// word about a file nobody is writing — and the window with no crew to read is
-// the HOSTED one ([app.crewReading]), never the ordinary launch this used to
-// silence.
-func (a *app) crewWord() string {
-	crew, ok := a.crewReading()
-	if !ok {
-		return ""
-	}
-	return crew.word
-}
+// ── the crew line on a task ──────────────────────────────────────────────────
 
-// crewSegment is the crew in the fewest cells that still answer it — `crew max`,
-// or `crew custom` over four rows the person arranged themselves. It is the
-// status line's crew segment (render.go's [app.telemetry]) and the word the
-// model picker's hint slot borrows ([app.crewHint]).
+// crewLine is one task's crew as the card and its landing say it:
 //
-// ONE SOURCE FOR THE WORD. The status line, the picker's hint, /status's crew
-// line and the settings row all answer "which crew" through [config.CrewAt],
-// which derives the preset from the four live class rows rather than reading a
-// stored word — so none of them can say `max` over a mastermind somebody pinned
-// out of it, and none of them can disagree with the others.
+//	openended · worker glm-5.3-flash (openrouter) · checker (pin) kimi-k3 · $0.108 (est $0.112)
 //
-// THE EMPTINESS LAW: a window with no four rows to read has no segment, and a
-// segment with no text is a segment the row never draws ([app.telemetry] skips
-// it). That window is the hosted one — see [app.crewReading] for why it is not
-// the empty profile directory this guard used to ask about.
-func (a *app) crewSegment() string {
-	crew, ok := a.crewReading()
-	if !ok {
+// actual below zero is not known yet, and the line then ends on the estimate.
+// The pin mark is the vocabulary's own glyph, never a literal.
+func (a *app) crewLine(d *crewroute.Decision, actual float64) string {
+	if d == nil {
 		return ""
 	}
-	return crew.segment
+	return d.Line(crewPinMark(a.linear), actual)
 }
 
-// ── the one reading of the four rows ────────────────────────────────────────
+// crewMark is a mark on the crew's own surfaces — the /crew panel, its
+// notes, the crew line — in the PLAIN tier whatever the icon setting says: a
+// pin, a tick, a ring, a cross, a diamond that every terminal draws. The rich
+// tier's private-use codepoints are a blank cell on a terminal without the
+// font, and on these surfaces a blank is a pinned seat or a connected
+// provider that reads as nothing at all. The linear and ASCII readings keep
+// their own spellings.
+func (a *app) crewMark(id tokens.GlyphID) string {
+	if a.linear || a.pal.ascii {
+		return tokens.ASCII.Glyph(id)
+	}
+	return tokens.Plain.Glyph(id)
+}
 
-// crewReading is the profile's crew as this surface last read it: the preset
-// word [config.CrewAt] derives from the live rows, the pick row's word
-// ([config.CrewPickAt]) when it is not the default one, the three class names
-// beside it, and the settings generation the pair was read at.
-type crewReading struct {
-	// word and segment are the two readings BUILT AT THE READING and not at the
-	// draw. The status line asks for the segment on every frame, and a surface
-	// that joined `"crew " + preset` there would put an allocation on the frame
-	// clock for a sentence that cannot change between two settings writes
-	// (inputsmooth_test.go's allocation law).
-	word    string
-	segment string
-	// clause is the welcome line's tail — `balanced crew` — built here for word
-	// and segment's reason and not at the draw: the welcome box is on the frame
-	// clock too, and under `--one-model` the preset word is not what belongs in
-	// it anyway (welcome.go's [app.welcomeModelLine]).
-	clause  string
-	preset  string
-	classes string
-	// pick is the pick row's word as the reading read it, and is the default
-	// word rather than empty — a surface that wants to know whether the pick
-	// is off the table compares it with [config.CrewPickTable], the way the
-	// word and segment above were built.
-	pick string
-	// dir is the profile the pair was read from, so a surface handed a
-	// different one answers from that one and not from a snapshot of the last.
-	dir string
-	// generation is [config.SettingsGeneration] as of the reading, and taken
-	// separates "read at generation zero" from "never read".
-	generation uint64
-	taken      bool
+// crewPinMark is the pin in a crew line: the plain glyph, ⌖, and never the
+// rich tier's. The line is TEXT kept in the transcript — read back tomorrow,
+// copied out, drawn in a terminal whose font was never asked — and a private-
+// use codepoint there is a blank cell, which is how a pinned checker read as
+// "checker  kimi-k3". Under the linear reading there is no glyph, and the line
+// says the word instead (crewroute's seatModel).
+func crewPinMark(linear bool) string {
+	if linear {
+		return ""
+	}
+	return tokens.Plain.Glyph(tokens.GPinned)
 }
 
-// crewReading is THE ONE READING every crew surface answers from — the status
-// line's segment, the model picker's hint, /status's crew line and the welcome
-// box's clause — and it reports false for a window that has no crew of its own.
-//
-// AN EMPTY PROFILE DIRECTORY IS THE NORMAL CASE, NOT THE ABSENT CASE, AND
-// ABSENCE IS A HOSTED WINDOW. [config.ProfileDir] is CODEAF_PROFILE_DIR, which
-// almost nobody exports, and every reader in internal/config resolves the empty
-// string to this process's own profile in the state root
-// ([config.ProfilePath]) — so the guard these surfaces used to carry was true on
-// very nearly every launch, and the crew segment the status line exists to show
-// was drawn only for the handful of people who had exported that variable
-// (#315). The real absence is a CONNECTION: over --host the crew lives on the
-// far machine and this window's profile is the laptop's, which is the refusal
-// [app.runCrew] already opens with and the fact [app.workSeat] guards on.
-//
-// AND IT IS READ AT THE DOOR AND NOT AT THE DRAW. Answering the status line
-// straight from the profile would put SEVEN config file reads on the frame
-// clock — four for the preset, three for the classes — for four rows that change
-// a few times a year, which is the cost [crewPicker.inherited] refuses for the
-// same reason. The snapshot is invalidated by the ONE counter every persisted
-// write bumps ([config.SettingsGeneration]), so /crew, the settings row and the
-// `change_setting` tool all move it and none of them needs to know this cache
-// exists; what the counter does not see — a config file edited by another
-// process — lands on the next launch, exactly as it does for the role source
-// the tasks resolve through (cmd/codeaf's v3Crew).
-func (a *app) crewReading() (crewReading, bool) {
-	if a.hosted() {
-		return crewReading{}, false
+// sayTaskCrew keeps a routed task's crew line in the thread: ONE line, said
+// when the task starts with the estimate, and REWRITTEN IN PLACE as the task
+// goes — a seat that failed to start and moved to its fallback, and at the end
+// what it cost beside the estimate and the one door to asking again harder.
+// Two lines for one crew read as two crews; the second said nothing the first
+// could not carry.
+func (a *app) sayTaskCrew(notice session.TaskNotice) {
+	if notice.Crew == nil {
+		return
 	}
-	// THE STATUS LINE NAMES WHAT SEATS THE CALL. Under `--one-model` the door
-	// hands the session no roles source and no task model, so every text call
-	// this run makes rides the conversation's own model and the four rows on
-	// disk seat nothing (cmd/codeaf's applyV3Governance). Reading the profile
-	// here drew `crew custom` — a true statement about the file and a false one
-	// about the run — over a crew that was not in force (#444). So the flag is
-	// answered before the rows are, and the reading names the flag.
-	//
-	// ONE ANSWER HERE IS FIVE SURFACES THAT CANNOT DISAGREE, which is the reason
-	// this function exists at all: the status line's segment (render.go's
-	// [app.telemetry]), the model picker's hint ([app.crewHint]), /status's crew
-	// line (statusdeck.go), the settings note (statusnote.go) and the welcome
-	// box's clause (welcome.go's [app.welcomeModelLine]) all read through it.
-	//
-	// AND IT IS FIXED, so the settings generation is not asked. Nothing this
-	// session can do moves it: /crew still writes the four rows and the four
-	// rows still do not seat this run, and the strings are constants no frame
-	// has to build. The model itself is not spelled into the word because every
-	// surface that prints the word prints the model on the row directly above
-	// it, and a second copy here is a second place to drift.
-	if a.oneModel {
-		return crewReading{
-			word:    crewOneModelWord,
-			segment: crewOneModelSegment,
-			clause:  crewOneModelSegment,
-			dir:     a.profileDir,
-			taken:   true,
-		}, true
+	if a.crewSaid == nil {
+		a.crewSaid = map[uint64]crewLineSaid{}
 	}
-	if generation := config.SettingsGeneration(); !a.crew.taken || a.crew.generation != generation || a.crew.dir != a.profileDir {
-		preset, classes := config.CrewAt(a.profileDir), config.CrewClasses(a.profileDir)
-		pick := config.CrewPickAt(a.profileDir)
-		// THE PICK RIDES THE WORD WHEN IT IS NOT THE DEFAULT ONE, in both the
-		// page's word and the status line's segment: `balanced · learn` says
-		// the budget and where the models for it come from in one word, and a
-		// segment that said only `balanced` under a learn pick would be the
-		// half-answer the crew segment exists to prevent. At the default pick
-		// the word is exactly what it has always been — the table is where the
-		// seats have always come from, and a word that named it would say
-		// something a person did not choose.
-		word, segment := preset+" · "+classes, "crew "+preset
-		if pick != config.CrewPickTable {
-			word = preset + " · " + pick + " · " + classes
-			segment = "crew " + preset + " · " + pick
+	said := a.crewSaid[notice.ID]
+	if said.landed {
+		return
+	}
+	lead := "task " + strconv.FormatUint(notice.ID, 10) + " crew · "
+	var text string
+	var facts []string
+	switch notice.State {
+	case session.TaskRunning:
+		text = lead + a.crewLine(notice.Crew, -1)
+		facts = []string{crewroute.ShortModel(notice.Crew.Seat(crewroute.Worker).Model)}
+	case session.TaskFailed:
+		// A TASK THAT FAILED ASKS FOR THE NEXT STEP BY NAME: the stronger crew
+		// is the one thing on this line a person can do about it.
+		// AND THE FAILURE IS SAID FIRST, before any figure: a stopped seat's
+		// one action where the cause is known — no stronger crew would get
+		// past it — and the stronger crew otherwise. Nothing spent names no
+		// money, never a $0.000 that reads as a free success.
+		failed := crewFailedWord
+		if stop := notice.Crew.Stopped; stop != "" {
+			failed = crewStoppedWord + stop
 		}
-		a.crew = crewReading{
-			word:       word,
-			segment:    segment,
-			clause:     preset + " crew",
-			preset:     preset,
-			classes:    classes,
-			pick:       pick,
-			dir:        a.profileDir,
-			generation: generation,
-			taken:      true,
+		actual := notice.CostUSD
+		if actual <= 0 {
+			actual = crewroute.Unspent
 		}
+		text = lead + failed + " · " + a.crewLine(notice.Crew, actual)
+		facts = []string{failed}
+		said.landed = true
+	case session.TaskDone, session.TaskUnverified:
+		text = lead + a.crewLine(notice.Crew, notice.CostUSD) + " · not right? /redo stronger"
+		facts = []string{crewroute.Money(notice.CostUSD)}
+		said.landed = true
+	default:
+		return
 	}
-	return a.crew, true
-}
-
-// The crew as `--one-model` leaves it, spelled once so the segment, the page and
-// the welcome box cannot say it three ways.
-//
-// The segment is `one model` and NOT `crew one model`, because the word `crew`
-// is precisely what is not in force: the status line reads
-// `… · deepseek-v4-flash   one model · …`, two facts and one gap, and neither of
-// them is a preset. The page's word says the whole of it in the register /status
-// already uses — lowercase, a middle dot, no full stop — and answers the
-// question somebody opening /status under the flag is actually asking, which is
-// which model is spending their money.
-const (
-	crewOneModelSegment = "one model"
-	crewOneModelWord    = "one model · every call rides the model you are talking to"
-)
-
-// crewHint is [app.crewSegment] for the hint slot under the model picker
-// (render.go's [app.hintWord]).
-//
-// It is the WORD and not the three class names, and it names no door. The slot
-// is three cells wide in the sense that matters: every cell it takes is a cell
-// the conversation's own name gives up at the other end of the legend
-// (render.go's [app.legend]). And the slot's law is that it names only what the
-// keyboard will do RIGHT NOW — while the picker is open every printable key
-// goes into its filter box, so "/crew" printed there would be a door a person
-// cannot walk through until they press esc. The word alone is a FACT, which is
-// all this slot has to carry: somebody hunting the model they just changed the
-// crew for reads that the crew is a different thing with a name of its own.
-func (a *app) crewHint() string { return a.crewSegment() }
-
-// ── the work seat, and the one line about it ────────────────────────────────
-//
-// A CREW OLDER THAN THE WORK SEAT FILLS IT ANYWAY, AND THE CONVERSATION SAYS SO
-// ONCE.
-//
-// The worker row arrived after the other four (#278), so a crew chosen before it
-// exists on disk as four rows with no worker among them. Headless doors read
-// that shape through the ladder and print one line about it (#311); this surface
-// read the row, found nothing, and handed every task to the build's own worker
-// model without a word — on the surface where most tasks are started, and where
-// there is no `models:` line for a person to notice a word on (#312).
-//
-// So the seat is resolved through the SAME ladder (config.TierSeatAt) and the
-// line is the SAME string (config.Seat.Notice), and it is said in the two places
-// a person is already looking: in the thread, the moment work actually starts on
-// that seat, and on the /crew sheet, which is where somebody goes to check.
-
-// workSeat is this conversation's work seat, resolved the way the role map that
-// runs its tasks resolves it (cmd/codeaf's v3Crew).
-//
-// AN EMPTY profileDir IS THE ORDINARY PROFILE AND NOT THE ABSENCE OF ONE.
-// [config.ProfileDir] is CODEAF_PROFILE_DIR, which almost nobody sets, and every
-// reader in internal/config takes the empty string to mean "this process's own
-// profile" — so a guard on the field would silence the line on precisely the
-// launch it was written for. The absence is a CONNECTION: over --host the crew
-// lives on the far machine and this window's profile is the laptop's, which is
-// the same refusal [app.runCrew] opens with.
-// AND `--one-model` HAS ALREADY ANSWERED THE QUESTION THE SEAT ASKS, so it is
-// empty under the flag for the same shape of reason the connection is. The
-// receipt below exists to report a SUBSTITUTION — a crew written before the
-// worker row existed, so the build's own model spends the person's money without
-// a word — and under the flag there is no substitution: the flag seats every
-// call on the conversation's model, which is the person's own answer to it.
-// Said anyway, "until you pick a crew again" promises that picking one would
-// change what runs, and under the flag it would not (#444). One empty seat takes
-// both surfaces quiet at once — the thread's receipt ([app.sayWorkSeat]) and the
-// /crew sheet's inherited row ([app.crewInheritedLine], which every caller of
-// [crewPicker.start] passes).
-func (a *app) workSeat() config.Seat {
-	if a.hosted() || a.oneModel {
-		return config.Seat{}
-	}
-	return config.TierSeatAt(a.profileDir, config.ModelTierWorker)
-}
-
-// sayWorkSeat puts the one line in the thread, ONCE PER SESSION, and is called
-// where work actually starts on the seat (task.go's [app.taskUpdate]).
-//
-// THE MOMENT IS THE FIRST RUNNING NODE, and not the launch. A person who never
-// hands anything off never meets this seat, and a line at boot about a model
-// nothing has used yet is a notice competing with the greeting for a fact that
-// may never become true. A person who hands off twenty things meets it once.
-//
-// THE QUESTION IS ASKED ONCE TOO. The flag is set whether or not there was
-// anything to say, because the answer cannot change under a session in a way
-// that owes a person a line: picking a crew ends the substitution, and clearing
-// the row is somebody saying "follow the conversation" on purpose. That also
-// keeps the profile off the path of every task update, which is where a file
-// read has no business being.
-//
-// IT IS NOT ONE OF THE HINTS (notice.go). Those age out after a few sessions and
-// go quiet when a person turns hints off, which is right for a tip about a key
-// and wrong for a receipt about which model is spending their money: this is
-// true until they answer it, and it is said every session until they do.
-func (a *app) sayWorkSeat() {
-	if a.workSeatSaid {
+	if text == said.text {
 		return
 	}
-	a.workSeatSaid = true
-	if notice := a.workSeat().Notice(); notice != "" {
-		a.note(notice)
+	if said.text == "" || !a.feed.renote(said.text, text, facts) {
+		a.noteFacts(text, facts...)
 	}
+	said.text, said.facts = text, facts
+	a.crewSaid[notice.ID] = said
 }
 
-// ── the family row: which pool the presets draw from ──────────────────────────
-//
-// models.crew.source says whether the three presets pick their five ids from
-// open models or from all models. THE CONFIG PACKAGE OWNS THE ROW:
-// [config.CrewSourceAt] reads it. [config.SetCrewSource] writes it alone for the
-// settings row, and [config.ApplyCrewUnder] commits it with a preset as one write
-// for this chooser. The two tables behind them answer it.
-//
-// THE SEGMENT DOES NOT NAME THE FAMILY. The chooser reads the row at its open
-// ([app.runCrew]) and enter writes it through [config.ApplyCrewUnder], and the
-// crew word the status segment shows resolves through the same row: it is read
-// there, and it is not printed above the presets.
-
-// crewSourceLead is this row's one word in the chooser. The settings panel labels
-// the same row `model family`; here it is abbreviated to fit one line, and both
-// name the family the presets draw from.
-const crewSourceLead = "family"
-
-// crewPicker is the fixed, bottom-anchored chooser opened by bare /crew. Its
-// zero value is closed, like [picker], and its cursor is an index into
-// [config.CrewPresets].
-type crewPicker struct {
-	open    bool
-	cursor  int
-	current string
-	// source is the family the presets below draw from: open models or all
-	// models. IT IS STAGED AND NOT WRITTEN: ←→ moves the word, and enter
-	// writes it beside the preset as one decision ([app.applyCrewUnder]): flip the family, watch the
-	// preset rows take it, then commit. esc leaves the row exactly as it
-	// was.
-	source string
-	// persistedSource is the family the SAVED crew is in, read at the door beside
-	// current. The row in force is the one the profile holds IN THE FAMILY THE
-	// PROFILE HOLDS: once ←→ moves the staged family, no preset on screen is in
-	// force any more, and a row that kept the mark would name models the profile
-	// does not run.
-	persistedSource string
-	// inherited is the line naming the seat this profile has no row for, or
-	// empty when every row was written. IT IS READ AT THE DOOR AND NOT AT THE
-	// DRAW: the rows are built every frame and the answer is three lines of a
-	// file, so a picker that asked the profile per frame would put a disk read
-	// on the frame clock for a fact that cannot move while the list is up.
-	inherited string
-	// pick is the pick row's word as the door read it, and the default word
-	// rather than empty. IT IS NOT STAGED: the family below is staged and
-	// enter writes it, but a pick word typed at the door is written at once
-	// ([app.runCrew]), so the pick on screen is always the pick in force — a
-	// reading, and not a row the list's keys could move.
-	pick string
+// crewAfterStarted keeps a task's two lines in one order: `started` first,
+// then its crew. The two arrive on different roads — the start answer from
+// the command, the crew on the task's first row — and either can come first;
+// when the crew line is already in the thread, it is rewritten into the
+// started line and said again after it, so the thread reads the same every
+// time. It answers whether it wrote the started line.
+func (a *app) crewAfterStarted(id string, started string, startedFacts []string) bool {
+	n, err := strconv.ParseUint(id, 10, 64)
+	if err != nil {
+		return false
+	}
+	said, ok := a.crewSaid[n]
+	if !ok || said.text == "" || !a.feed.renote(said.text, started, startedFacts) {
+		return false
+	}
+	a.noteFacts(said.text, said.facts...)
+	return true
 }
 
-func (p *crewPicker) start(current, source, inherited, pick string) {
-	// source is already a word this build knows: every caller hands it
-	// [config.CrewSourceAt]'s answer, which folds blank, unknown and retired words
-	// back to the default family. The fold lives there and nowhere else.
-	*p = crewPicker{open: true, current: current, persistedSource: source, inherited: inherited, source: source, pick: pick}
-	for i, preset := range config.CrewPresets {
-		if preset == current {
-			p.cursor = i
-			return
-		}
-	}
+// crewLineSaid is one task's crew line as the thread holds it.
+type crewLineSaid struct {
+	text   string
+	facts  []string
+	landed bool
 }
 
-func (p *crewPicker) close() { *p = crewPicker{} }
+// crewFailedWord ends a failed task's crew line.
+const crewFailedWord = "failed — /redo stronger runs it again on a stronger crew"
 
-func (p *crewPicker) move(delta int) {
-	p.cursor = (p.cursor + delta + len(config.CrewPresets)) % len(config.CrewPresets)
-}
-
-// moveSource walks the two families, ←→ in [crewPickerKey]. It wraps rather
-// than clamps for [move]'s own reason: with two options a clamp would leave
-// one of the two keys a dead key on the word it started at.
-func (p *crewPicker) moveSource(delta int) {
-	at := 0
-	for i, source := range config.CrewSources {
-		if source == p.source {
-			at = i
-		}
-	}
-	p.source = config.CrewSources[(at+delta+len(config.CrewSources))%len(config.CrewSources)]
-}
+// crewStoppedWord leads a failed line whose seat stopped on a cause a person
+// can fix; the action follows it.
+const crewStoppedWord = "failed — "
 
-// The chooser's fixed lines around the three presets, spelled once so the
-// height and the rows cannot count them differently.
-const (
-	// crewScopeLine is the header: what the presets below move, and what they
-	// do not. It is the one sentence the whole surface exists to make plain.
-	crewScopeLine = "the five models codeaf uses on its own behalf — not the one you chat with"
-	// crewSeatLead is seat one's label. It is a plain phrase and not a class word,
-	// because the class words are what the presets change and this seat is not.
-	crewSeatLead = "you talk to"
-	// crewPinLine is the closing note: the door to moving one seat on its own,
-	// which this chooser deliberately does not offer.
-	crewPinLine = "each of the five can be pinned on its own in /settings → Providers"
-	// crewCustomLine is the fourth reading, said as a fact about where the person
-	// is rather than as a fourth row they could pick.
-	crewCustomLine = "yours is none of the three — picking one puts all five back"
-	// crewPickLead is the pick's lead in the chooser — `picked from learn` —
-	// the same words the crew word and the segment ride when the pick is off
-	// its default ([app.crewReading]). It is said as a reading and not a row:
-	// the pick is written by a word at the door, not by anything this list's
-	// keys move.
-	crewPickLead = "picked from "
-	// crewInheritedLead and crewInheritedTail wrap the row a profile older than
-	// a seat never wrote:
-	//
-	//	your work seat is inherited from small work — picking one writes it
-	//
-	// It is said as a fact about a ROW on this sheet, which is what this list is
-	// for, while the thread's line ([config.Seat.Notice], said once when work
-	// starts) is the receipt. `inherited` is the same word the headless models
-	// line prints beside the model, so a person who has seen one surface
-	// recognises the other.
-	crewInheritedLead = "your "
-	crewInheritedMid  = " seat is inherited from "
-	crewInheritedTail = " — picking one writes it"
-	// crewFrameRows is how many of the chooser's rows are not preset rows: the
-	// scope line, seat one, the family selector and the closing note.
-	crewFrameRows = 4
-)
+// ── the one reading every crew surface answers from ─────────────────────────
 
-func (p *crewPicker) height() int {
-	if !p.open {
-		return 0
-	}
-	height := crewFrameRows + len(config.CrewPresets)*2
-	if p.current == config.CrewCustom {
-		height++
-	}
-	if p.pick != "" && p.pick != config.CrewPickTable {
-		height++
-	}
-	if p.inherited != "" {
-		height++
-	}
-	return height
+// crewReading is the profile's crew as this surface last read it: the word
+// /status prints, the status line's segment, the welcome box's clause and the
+// pinned models, read at the door and not at the draw.
+type crewReading struct {
+	word    string
+	segment string
+	clause  string
+	// models are the pinned ids, which /status lifts as its facts.
+	models     []string
+	dir        string
+	generation uint64
+	taken      bool
 }
 
-// rows uses the model picker's bottom-overlay row vocabulary, but always gives
-// the models their own dim line: with three fixed choices, comparison matters
-// more than fitting a fourth choice that does not exist.
+// crewReading is THE ONE READING every crew surface answers from, and reports
+// false for a window that has no crew of its own — the hosted one.
 //
-// THE CHOOSER IS THE FIVE-SEAT READING. codeaf runs five model seats — the one
-// you talk to, then reflex, small work, careful work and mastermind — and until
-// this wave the chooser showed four of them and said nothing about the fifth,
-// which is the one seat a person can see on the frame and the one `/crew` never
-// moves. So the list opens with a header saying what the presets below change
-// and what they do not, then seat one on a line of its own — labelled, with no
-// lead and no ground, so it cannot be mistaken for a row enter would apply —
-// then the three presets exactly as before, and a closing note pointing at the
-// settings row where any one of the five can be pinned by itself. Per-seat
-// picking is NOT built in here: settings already owns it, and a chooser that
-// both applied presets and moved single seats would be two controls wearing one
-// set of keys.
-func (p *crewPicker) rows(width, n int, pal palette, hover int, a *app) []string {
-	if !p.open || n <= 0 {
-		return nil
+// IT IS READ AT THE DOOR AND NOT AT THE DRAW. The status line asks for the
+// segment on every frame; the snapshot is invalidated by the one counter
+// every persisted write bumps ([config.SettingsGeneration]).
+func (a *app) crewReading() (crewReading, bool) {
+	if a.hosted() {
+		return crewReading{}, false
 	}
-	out := make([]string, 0, p.height())
-	out = append(out, pal.dim(fit(crewScopeLine, width)))
-	// Seat one wears the data hue on its id and the dim tier on its label, which
-	// is THE PAYLOAD RULE's own split (payload.go): the id is the answer, the
-	// label is the question. It takes neither the cursor's `›` nor a ground,
-	// because nothing on this list can move it.
-	if id := a.talkingTo(); id != "" {
-		out = append(out, "  "+pal.dim(crewSeatLead+" · ")+pal.data(fit(id, width-2-len(crewSeatLead)-3)))
-	} else {
-		// A session with no model yet has no seat one to show, and a labelled gap
-		// would be a claim about a model nobody has named. The line is kept, empty,
-		// so the chooser's height stays what [crewPicker.height] promised.
-		out = append(out, "")
-	}
-	// THE FAMILY IS A HEADER THE ←→ KEYS WALK, not a fourth row on the ↑↓
-	// list: the presets are one axis and the family is a second one steering
-	// them, and a list that made ↑↓ pass through the family on the way from
-	// frugal to max would be moving an axis the person never aimed at. So the
-	// row sits directly above the presets it steers, it answers to ←→, and the
-	// two options are drawn beside each other so the move it offers is visible
-	// before it is taken.
-	//
-	// THE WORD THE NEXT ENTER WRITES IS THE WORD LIFTED, and the lifted word is
-	// the accent: it is the fact this row answers and the only fact on it. This
-	// row takes no `›` lead and no ground of its own, for a reason of its own
-	// rather than seat one's: it is not on the ↑↓ axis, so no cursor sits on it
-	// for a lead to mark, and the lifted word is its whole mark.
-	words := make([]string, 0, len(config.CrewSources))
-	for _, source := range config.CrewSources {
-		if source == p.source {
-			words = append(words, pal.accent(source+" models"))
-			continue
-		}
-		words = append(words, pal.dim(source+" models"))
-	}
-	out = append(out, fit("  "+pal.dim(crewSourceLead+" ‹ ")+strings.Join(words, pal.dim(" · "))+pal.dim(" ›"), width))
-	for i, preset := range config.CrewPresets {
-		models, _ := config.CrewModelsForSource(p.source, preset)
-		parts := make([]string, 0, len(roles.Tiers))
-		for _, tier := range roles.Tiers {
-			parts = append(parts, strings.TrimSpace(a.crewClassWord(tier))+" "+models[string(tier)])
-		}
-		// THE CREW IN FORCE AND THE CURSOR ARE TWO FACTS, AND A ROW CAN BE BOTH.
-		// The crew a person is actually running is chosen and persistent, so it
-		// takes THE GROUND LADDER's selected step; the cursor is where ↑/↓ has got
-		// to, so it takes the cursor step, the same step the pointer takes.
-		//
-		// This list used to say both with the LEAD and lose one of them: the
-		// current preset borrowed the pointer's own `·`, and because it was tested
-		// first, the cursor's `›` disappeared the moment the cursor landed on the
-		// preset already in force — which is the one row a person is most likely
-		// to arrow onto, and the one moment they most need to know enter is aimed.
-		oncursor, current := i == p.cursor, preset == p.current && p.source == p.persistedSource
-		hovered := hover == len(out) || hover == len(out)+1
-		lead := "  "
-		switch {
-		case oncursor:
-			lead = pal.accent("› ")
-		case hovered:
-			lead = pal.accent("· ")
-		}
-		label := preset + " — " + config.CrewLineFor(p.source, preset)
-		switch {
-		case current:
-			label = pal.accent(label)
-		case oncursor:
-			label = pal.ink(label)
-		default:
-			label = pal.dim(label)
-		}
-		head := lead + fit(label, width-2)
-		// The models are the half of the row a person stopped on it to compare, so
-		// they come up to ink wherever the row wears a ground: dim on a raised
-		// ground is grey on grey.
-		tail := "    " + fit(strings.Join(parts, " · "), width-4)
-		if oncursor || hovered || current {
-			tail = pal.ink(tail)
-		} else {
-			tail = pal.dim(tail)
+	// UNDER `--one-model` THE CREW SEATS NOTHING (#444): every text call rides
+	// the conversation's model, so the reading names the flag.
+	if a.oneModel {
+		return crewReading{word: crewOneModelWord, segment: crewOneModelSegment, clause: crewOneModelSegment, dir: a.profileDir, taken: true}, true
+	}
+	if generation := config.SettingsGeneration(); !a.crew.taken || a.crew.generation != generation || a.crew.dir != a.profileDir {
+		pins := config.CrewPinsAt(a.profileDir)
+		word, segment := "auto · codeaf picks the worker, planner and checker for each task", "crew auto"
+		var models []string
+		if len(pins) > 0 {
+			var said []string
+			for _, seat := range crewroute.Seats {
+				if pin, ok := pins[seat]; ok {
+					said = append(said, string(seat)+" "+pin.String())
+					models = append(models, pin.String())
+				}
+			}
+			word = "auto · pinned " + strings.Join(said, ", ")
+			segment = "crew auto · " + strconv.Itoa(len(pins)) + " pinned"
 		}
-		switch {
-		case current:
-			head, tail = pal.selected(head, width), pal.selected(tail, width)
-		case oncursor, hovered:
-			head, tail = pal.cursor(head, width), pal.cursor(tail, width)
+		if rule := config.CrewAllowedAt(a.profileDir).String(); rule != "all" {
+			word += " · allowed " + rule
 		}
-		out = append(out, head, tail)
-	}
-	// The custom line is about the SAVED crew, so it shows whichever family is
-	// staged: hiding it would drop a row [crewPicker.height] still counts.
-	if p.current == config.CrewCustom {
-		out = append(out, pal.dim(fit(crewCustomLine, width)))
-	}
-	// AND THE PICK, a fact about the saved crew like the custom line above it.
-	// It is said only when it is off the default — the table is where the
-	// seats have always come from, and a line naming it would say something
-	// nobody chose — and it takes no cursor and no ground, because the pick is
-	// not staged here: a word typed at the door writes it at once.
-	if p.pick != "" && p.pick != config.CrewPickTable {
-		out = append(out, pal.dim(fit(crewPickLead+p.pick, width)))
-	}
-	// AND THE ROW NOBODY WROTE, said last among the readings and before the door
-	// out: it is the one fact on this list that is about the person's own five
-	// rows rather than about the three on offer, and the answer to it is the
-	// same enter every row above it takes.
-	if p.inherited != "" {
-		out = append(out, pal.dim(fit(p.inherited, width)))
-	}
-	out = append(out, pal.dim(fit(crewPinLine, width)))
-	if len(out) > n {
-		out = out[:n]
-	}
-	return out
+		a.crew = crewReading{word: word, segment: segment, clause: "auto crew", models: models,
+			dir: a.profileDir, generation: generation, taken: true}
+	}
+	return a.crew, true
 }
 
-// crewInheritedLine is the sheet's own sentence about a seat this profile has no
-// row for, and empty for every profile that wrote all five.
-//
-// ONE READING OF THE SEAT FEEDS BOTH SURFACES. The words differ because the
-// places do — the thread is told what is running right now, the sheet is told
-// which of its rows is not yours — and the FACT is one call to one ladder
-// ([app.workSeat]), so neither surface can name a row the other does not.
-func (a *app) crewInheritedLine() string {
-	seat := a.workSeat()
-	if seat.Source != config.SeatInherited {
+// crewWord is the crew as a page states it (/status).
+func (a *app) crewWord() string {
+	crew, ok := a.crewReading()
+	if !ok {
 		return ""
 	}
-	return crewInheritedLead + string(seat.Role) + crewInheritedMid + seat.FromWords() + crewInheritedTail
-}
-
-func (a *app) crewPickerKey(msg tea.KeyPressMsg) {
-	switch msg.String() {
-	case "esc":
-		a.crewPick.close()
-	case "enter":
-		preset := config.CrewPresets[a.crewPick.cursor]
-		source := a.crewPick.source
-		a.crewPick.close()
-		a.applyCrewUnder(source, preset)
-	case "up", "ctrl+p":
-		a.crewPick.move(-1)
-	case "down", "ctrl+n":
-		a.crewPick.move(1)
-	case "left":
-		a.crewPick.moveSource(-1)
-	case "right":
-		a.crewPick.moveSource(1)
-	}
-	a.touch()
+	return crew.word
 }
 
-// crewListing is the three presets, the current one marked, each with its own
-// line and the four models it would set.
-//
-// The four are named by CLASS and not by tier word, because the classes are what
-// the settings rows are called and a person reading this is being invited to open
-// them. The marked row is marked with the same chip the model picker marks the
-// model in use with, so "this is the one you are on" is one gesture across the
-// surface.
-func (a *app) crewListing() string {
-	current := config.CrewAt(a.profileDir)
-	source := config.CrewSourceAt(a.profileDir)
-	var out strings.Builder
-	// THE WORDS ARE THE SAME IN EITHER FAMILY, so the listing names the pool
-	// whenever it is not the default one: two listings that looked exactly alike
-	// over two different sets of ids is the ambiguity this whole feature is about.
-	if source != config.DefaultCrewSource {
-		out.WriteString(crewSourceLead + " · " + source + " models\n")
-	}
-	for at, preset := range config.CrewPresets {
-		if at > 0 {
-			out.WriteString("\n")
-		}
-		lead := "  "
-		if preset == current {
-			lead = "· "
-		}
-		out.WriteString(lead + preset + " — " + config.CrewLineFor(source, preset) + "\n")
-		models, _ := config.CrewModelsForSource(source, preset)
-		for _, tier := range roles.Tiers {
-			out.WriteString("    " + a.crewClassWord(tier) + "  " + models[string(tier)] + "\n")
-		}
-	}
-	if current == config.CrewCustom {
-		// THE FOURTH READING IS NOT A CHOICE and it is said last, as a fact about
-		// where they are rather than as a fourth row they could pick. Naming the
-		// four live models here would repeat the settings panel; naming the row
-		// that made it custom is what they need to undo it.
-		out.WriteString("\nyours is none of the three — " + config.CrewSummary(a.profileDir) +
-			"\n/crew balanced puts all five back")
+// crewSegment is the status line's crew segment: `crew auto`, or
+// `crew auto · 1 pinned`.
+func (a *app) crewSegment() string {
+	crew, ok := a.crewReading()
+	if !ok {
+		return ""
 	}
-	return strings.TrimRight(out.String(), "\n")
+	return crew.segment
 }
 
-// crewClassWord is a class in the words its own settings row is labelled with,
-// padded so the four ids line up. It reads the skin rather than spelling the
-// words again, for [sheet.tierWord]'s reason: a person told "mastermind" here has
-// to find a row called "mastermind" there.
-func (a *app) crewClassWord(tier roles.Tier) string {
-	word := string(tier)
-	if meta, ok := settingUI[tierSettingKey(tier)]; ok && meta.label != "" {
-		word = meta.label
-	}
-	for len(word) < crewClassWidth {
-		word += " "
-	}
-	return word
-}
+// crewHint is [app.crewSegment] for the hint slot under the model picker.
+func (a *app) crewHint() string { return a.crewSegment() }
 
-// crewClassWidth is the column the class words are padded to — "careful work" is
-// the longest of the four and this is its width. It is a constant rather than a
-// measurement because the four words are fixed and a loop to find the longest of
-// four literals is machinery for nothing.
-const crewClassWidth = 12
+// The crew as `--one-model` leaves it, spelled once.
+const (
+	crewOneModelSegment = "one model"
+	crewOneModelWord    = "one model · every call rides the model you are talking to"
+)
 
 // refreshSettings rebuilds an open settings panel from the registry. A command
 // that wrote a row while the panel was open would otherwise leave the panel
diff --git a/internal/tui3/crew_test.go b/internal/tui3/crew_test.go
index 91cbd4287a..730f4cab6b 100644
--- a/internal/tui3/crew_test.go
+++ b/internal/tui3/crew_test.go
@@ -1,1008 +1,275 @@
 package tui3
 
 import (
-	"encoding/json"
-	"os"
+	"context"
 	"strings"
 	"testing"
 
 	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/roles"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/session"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
 )
 
-// /crew, FROM THE FOUR SIDES A PERSON MEETS IT: the chooser, applying one, a word
-// that is not one of the three, and the reading over a crew somebody assembled
-// themselves.
+// /crew, FROM THE SIDES A PERSON MEETS IT: the panel, the four shortcuts, a
+// form that is none of them, and the crew line a routed task says.
 
-// The bare form is the three presets with yours marked, each naming the four
-// models it would set, and opens on the current one.
-func TestCrewOpensTheThreePresetsOnYours(t *testing.T) {
+// The bare form is the panel: the three seats (all auto on a profile nobody
+// touched), the allowed models and the daily cap, over the conversation rather
+// than written into it (crewpanel_test.go drives it).
+func TestCrewIsThePanel(t *testing.T) {
 	a, _ := sheetApp(t)
-	a.width = 240
 	a.slash("/crew")
-
-	if !a.crewPick.open {
-		t.Fatal("bare /crew did not open the chooser")
-	}
-	if a.crewPick.cursor != 1 {
-		t.Fatalf("the cursor opened on row %d, want balanced at 1", a.crewPick.cursor)
+	if !a.crewUI.open {
+		t.Fatal("/crew opened no panel")
 	}
-	text := plain(strings.Join(a.overlayRows(a.width, a.overlayHeight()), "\n"))
-	for _, preset := range config.CrewPresets {
-		if !strings.Contains(text, preset) {
-			t.Errorf("the listing does not mention %q:\n%s", preset, text)
-		}
-		if !strings.Contains(text, config.CrewLine(preset)) {
-			t.Errorf("the listing does not say what %q is:\n%s", preset, text)
-		}
-		models, _ := config.CrewModels(preset)
-		for _, tier := range roles.Tiers {
-			if !strings.Contains(text, models[string(tier)]) {
-				t.Errorf("the listing does not name %s's %s model:\n%s", preset, tier, text)
-			}
-		}
-	}
-	// THE SHIPPED CREW IS MARKED BY THE GROUND IT WEARS, and it is balanced — the
-	// four tier defaults are that row (internal/config's crew.go).
-	//
-	// The crew in force is the chosen thing, so it takes THE GROUND LADDER's
-	// selected step; the cursor takes the step under it. This list used to say
-	// "in force" with the POINTER's own `·` in the lead, which meant the two
-	// facts fought over one cell — and because the current preset was tested
-	// first, the cursor's own `›` vanished whenever it landed on the preset
-	// already running, which is the row a person arrows onto most.
-	painted := a.overlayRows(a.width, a.overlayHeight())
-	chosen := "\x1b[48;5;" + itoa(int(hueSelected.idx)) + "m"
-	cursorStep := "\x1b[48;5;" + itoa(int(hueCursor.idx)) + "m"
-	var onChosen, onOthers int
-	for _, line := range painted {
-		switch {
-		case strings.Contains(line, config.CrewBalanced):
-			onChosen++
-			if !strings.Contains(line, chosen) {
-				t.Errorf("the crew in force wears no ground:\n%q", line)
-			}
-		case strings.Contains(line, config.CrewFrugal) || strings.Contains(line, config.CrewMax):
-			onOthers++
-			if strings.Contains(line, chosen) {
-				t.Errorf("a preset nobody is on wears the chosen ground:\n%q", line)
-			}
-		}
-	}
-	if onChosen == 0 || onOthers == 0 {
-		t.Fatalf("the listing did not draw the presets it was asked about:\n%s", text)
-	}
-	// The cursor opened on balanced, which is also the crew in force. The louder
-	// step wins the ground and the `›` still says where enter is aimed.
-	if !strings.Contains(strings.Join(painted, "\n"), a.pal.accent("› ")) {
-		t.Errorf("the cursor lost its mark on the row it opened on:\n%s", text)
-	}
-	if strings.Contains(strings.Join(painted, "\n"), cursorStep) {
-		t.Errorf("a second row took the cursor step with no pointer on the list:\n%s", text)
-	}
-	// The four classes are named in the words their own settings rows use, so
-	// somebody told "mastermind" here can find the row there.
-	for _, tier := range roles.Tiers {
-		want := settingUI[tierSettingKey(tier)].label
+	text := strings.Join(plainOverlay(a), "\n")
+	for _, want := range []string{"worker", "planner", "checker", "auto", "models", "‹ all ›", "cap", "none"} {
 		if !strings.Contains(text, want) {
-			t.Errorf("the listing does not use the row's own word %q:\n%s", want, text)
+			t.Errorf("the panel does not say %q:\n%s", want, text)
 		}
 	}
-}
-
-func TestCrewChooserAppliesAndCloses(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.openSettings()
-	toProviders(t, a)
-	a.slash("/crew")
-	a.crewPickerKey(key("down"))
-	a.crewPickerKey(key("enter"))
-
-	if a.crewPick.open {
-		t.Fatal("enter left the crew chooser open")
-	}
-	if got := config.CrewAt(dir); got != config.CrewMax {
-		t.Fatalf("enter applied %q, want max", got)
-	}
-	if got := lastNote(t, a); !strings.Contains(got, "crew → max") {
-		t.Fatalf("the chooser noted %q", got)
-	}
-	refreshed := false
-	for _, row := range a.sheet.rows {
-		if row.Key == config.KeyCrew && row.Value() == config.CrewMax {
-			refreshed = true
+	for _, retired := range []string{"frugal", "balanced", "mastermind", "preset"} {
+		if strings.Contains(text, retired) {
+			t.Errorf("the panel still says the retired %q:\n%s", retired, text)
 		}
 	}
-	if !refreshed {
-		t.Fatal("the open settings rows were not refreshed to max")
-	}
 }
 
-func TestCrewChooserEscChangesNothing(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.slash("/crew")
-	drive(t, a, key("down"))
-	drive(t, a, key("esc"))
-
-	if a.crewPick.open {
-		t.Fatal("esc left the crew chooser open")
+// A PIN IS WRITTEN, SHOWN WITH THE VOCABULARY'S PIN GLYPH, AND UNDONE.
+func TestCrewPinAndUnpin(t *testing.T) {
+	// A pin that names a provider needs that provider connected and a catalog
+	// that lists the model.
+	a, dir := crewLab(t)
+	a.slash("/crew pin checker moonshotai/kimi-k3@openrouter")
+	pin, ok := config.CrewPinAt(dir, crewroute.Checker)
+	if !ok || pin.Model != "moonshotai/kimi-k3" || pin.Provider != "openrouter" {
+		t.Fatalf("the checker pin reads %+v (%v)", pin, ok)
 	}
-	if got := config.CrewAt(dir); got != config.CrewBalanced {
-		t.Fatalf("esc changed the crew to %q", got)
+	if note := lastNote(t, a); !strings.Contains(note, a.icon(tokens.GPinned)) || !strings.Contains(note, "kimi-k3@openrouter") {
+		t.Fatalf("the confirmation does not show the pin: %q", note)
 	}
-}
-
-// A preset writes all five classes and confirms in one line.
-func TestCrewAppliesAPresetAndConfirmsInOneLine(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.slash("/crew max")
-
-	want, _ := config.CrewModels(config.CrewMax)
-	for _, tier := range config.ModelTiers {
-		if got := config.TierModelAt(dir, tier); got != want[tier] {
-			t.Errorf("after /crew max the %s class reads %q, want %q", tier, got, want[tier])
-		}
-	}
-	text := lastNote(t, a)
-	if strings.Count(text, "\n") != 0 {
-		t.Fatalf("the confirmation is more than one line:\n%s", text)
-	}
-	// The three class names come from the table rather than being spelled here:
-	// a preset that moves onto better models must not leave this test asserting
-	// the ids it used to name.
-	for _, part := range []string{
-		"crew → max",
-		"brain " + modelBase(want[config.ModelTierMastermind]),
-		"hands " + modelBase(want[config.ModelTierWorker]),
-		"checks " + modelBase(want[config.ModelTierHigh]),
-	} {
-		if !strings.Contains(text, part) {
-			t.Errorf("the confirmation is missing %q: %q", part, text)
-		}
+	if !a.crewUI.open {
+		t.Fatal("the pin did not open the panel on what it changed")
 	}
-	// AND NO RUNG RIDES A SHIPPED PRESET. A preset buys a bigger planning model
-	// and leaves its generation behaviour to the provider (#665); the `:high`
-	// the max crew used to carry on its brain is an instruction only a person's
-	// own class value may add.
-	if strings.Contains(text, ":high") {
-		t.Errorf("a shipped preset carried a rung: %q", text)
+	if panel := strings.Join(plainOverlay(a), "\n"); !strings.Contains(panel, a.icon(tokens.GPinned)+" kimi-k3 @openrouter") {
+		t.Fatalf("the panel does not mark the pinned seat:\n%s", panel)
 	}
-}
-
-// AN UNKNOWN WORD CHANGES NOTHING AND SAYS THE SIX — the three presets and the
-// three pick words — the shape every choice this surface refuses takes
-// (effortchip.go's [app.runEffort]): a refusal that only said "no" would leave
-// a person guessing at a word they were one letter away from.
-func TestCrewRefusesAWordThatIsNotOneOfTheThree(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.slash("/crew cheap")
-
-	if got := config.CrewAt(dir); got != config.DefaultCrew {
-		t.Fatalf("an unknown word changed the crew to %q", got)
-	}
-	text := lastNote(t, a)
-	if !strings.Contains(text, "not a crew word") {
-		t.Fatalf("the refusal reads %q", text)
-	}
-	words := make([]string, 0, len(config.CrewPresets)+len(config.CrewPicks))
-	words = append(words, config.CrewPresets...)
-	words = append(words, config.CrewPicks...)
-	for _, word := range words {
-		if !strings.Contains(text, word) {
-			t.Errorf("the refusal does not offer %q:\n%s", word, text)
-		}
+	a.slash("/crew unpin checker")
+	if _, ok := config.CrewPinAt(dir, crewroute.Checker); ok {
+		t.Fatal("unpin left the checker pinned")
 	}
-	if got := config.CrewPickAt(dir); got != config.CrewPickTable {
-		t.Fatalf("an unknown word changed the pick to %q", got)
+	// A seat that is not one of the three is refused with the form.
+	a.slash("/crew pin judge vendor/x")
+	if note := lastNote(t, a); !strings.Contains(note, "usage: /crew pin") {
+		t.Fatalf("a pin on an unknown seat said %q", note)
 	}
 }
 
-// A CREW SOMEBODY ASSEMBLED THEMSELVES READS AS CUSTOM, and the listing says how
-// to put it back rather than pretending custom is a fourth choice.
-func TestCrewReadsCustomOverAHandSetClass(t *testing.T) {
+// A PIN OUTSIDE THE ALLOWED MODELS IS REFUSED, not written.
+func TestCrewRefusesAPinOutsideTheAllowedModels(t *testing.T) {
 	a, dir := sheetApp(t)
-	a.slash("/crew balanced")
-	a.openSettings()
-	toProviders(t, a)
-	setRow(t, a, config.KeyTierMastermindModel, "openai/gpt-5")
-	a.closeSettings()
-
-	if got := config.CrewAt(dir); got != config.CrewCustom {
-		t.Fatalf("a hand-set class left the crew reading %q", got)
+	a.slash("/crew models z-ai/glm-5.3-flash")
+	if got := config.CrewAllowedAt(dir).String(); !strings.Contains(got, "glm-5.3-flash") {
+		t.Fatalf("the allowed rule reads %q", got)
 	}
-	a.slash("/crew")
-	text := plain(strings.Join(a.overlayRows(a.width, a.overlayHeight()), "\n"))
-	if !strings.Contains(text, "none of the three") {
-		t.Fatalf("the chooser does not say the crew is nobody's preset:\n%s", text)
-	}
-	if !strings.Contains(text, "picking one puts all five back") {
-		t.Fatalf("the chooser does not say how to put it back:\n%s", text)
-	}
-	if strings.Contains(text, "· "+config.CrewBalanced) {
-		t.Fatalf("balanced is marked over a custom crew:\n%s", text)
+	a.slash("/crew pin worker vendor/elsewhere")
+	if _, ok := config.CrewPinAt(dir, crewroute.Worker); ok {
+		t.Fatal("a pin outside the allowed models was written")
 	}
-
-	// And one word heals all four.
-	a.slash("/crew balanced")
-	if got := config.CrewAt(dir); got != config.CrewBalanced {
-		t.Fatalf("the crew reads %q after balanced was set again", got)
+	if note := lastNote(t, a); !strings.Contains(note, "could not pin") {
+		t.Fatalf("the refusal said %q", note)
 	}
 }
 
-// THE CREW ROW CYCLES, like every other enum row on the sheet, and a custom
-// reading enters the cycle at its first step rather than sticking.
-func TestTheCrewRowCyclesThroughTheThreePresets(t *testing.T) {
+// THE CAP IS WRITTEN AND SAID with today's spend beside it; `off` clears it.
+func TestCrewCap(t *testing.T) {
 	a, dir := sheetApp(t)
-	a.openSettings()
-	toProviders(t, a)
-	cursorTo(t, a, config.KeyCrew)
-
-	drive(t, a, key("enter"))
-	if got := config.CrewAt(dir); got != config.CrewMax {
-		t.Fatalf("enter on balanced landed on %q, want %q", got, config.CrewMax)
-	}
-	drive(t, a, key("enter"))
-	if got := config.CrewAt(dir); got != config.CrewFrugal {
-		t.Fatalf("enter on max landed on %q, want %q", got, config.CrewFrugal)
+	a.slash("/crew cap 5")
+	if got := config.CrewCapAt(dir); got != 5 {
+		t.Fatalf("the cap reads %v", got)
 	}
-	drive(t, a, key("enter"))
-	if got := config.CrewAt(dir); got != config.CrewBalanced {
-		t.Fatalf("enter on frugal landed on %q, want %q", got, config.CrewBalanced)
-	}
-
-	// From custom the cycle starts at the cheapest, which is the one answer that
-	// cannot surprise anybody: it never spends more than the person asked for.
-	setRow(t, a, config.KeyTierLowModel, "openai/gpt-5")
-	if got := config.CrewAt(dir); got != config.CrewCustom {
-		t.Fatalf("the crew reads %q over a hand-set class", got)
-	}
-	cursorTo(t, a, config.KeyCrew)
-	drive(t, a, key("enter"))
-	if got := config.CrewAt(dir); got != config.CrewFrugal {
-		t.Fatalf("enter on custom landed on %q, want %q", got, config.CrewFrugal)
+	if note := lastNote(t, a); !strings.Contains(note, "$5.00") || !strings.Contains(note, "spent today") {
+		t.Fatalf("the cap confirmation said %q", note)
 	}
 }
 
-// THE CREW ROW SAYS WHAT EACH OF THE THREE IS, in the line under it. A cycle row
-// walks its choices in place — there is never a moment where three rows are shown
-// side by side — so this line is the only place the comparison can happen, and it
-// is built from the same table /crew prints from.
-func TestTheCrewRowsLineNamesAllThreePresets(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.openSettings()
-	toProviders(t, a)
-	cursorTo(t, a, config.KeyCrew)
-
-	item, ok := a.sheet.current()
-	if !ok {
-		t.Fatal("the cursor is not on the crew row")
-	}
-	for _, preset := range config.CrewPresets {
-		if !strings.Contains(item.meta.about, preset) {
-			t.Errorf("the crew row's line does not name %q: %q", preset, item.meta.about)
-		}
-		if !strings.Contains(item.meta.about, config.CrewLine(preset)) {
-			t.Errorf("the crew row's line does not say what %q is: %q", preset, item.meta.about)
-		}
-	}
-	if !strings.Contains(item.meta.about, config.CrewCustom) {
-		t.Errorf("the crew row's line does not say what makes it custom: %q", item.meta.about)
-	}
-	// And it is drawn, which is the whole point of a line nobody can see three
-	// rows for.
-	if !strings.Contains(plain(frame(a)), config.CrewLine(config.CrewBalanced)) {
-		t.Fatalf("the crew row's line is not on the screen:\n%s", plain(frame(a)))
-	}
-}
-
-// THE CLASS WORDS ON DISK AND THE TIER NAMES IN THE REGISTRY ARE ONE SET. The
-// listing indexes the preset table by [roles.Tier], and internal/config keys that
-// table by its own tier words; a rename on either side would silently print a
-// blank model beside a class.
-func TestTheTierWordsAndTheClassKeysAreTheSameSet(t *testing.T) {
-	if len(roles.Tiers) != len(config.ModelTiers) {
-		t.Fatalf("internal/roles has %d tiers and internal/config has %d classes",
-			len(roles.Tiers), len(config.ModelTiers))
-	}
-	for at, tier := range roles.Tiers {
-		if string(tier) != config.ModelTiers[at] {
-			t.Errorf("tier %d is %q in internal/roles and %q in internal/config",
-				at, tier, config.ModelTiers[at])
-		}
-		if settingUI[tierSettingKey(tier)].label == "" {
-			t.Errorf("tier %q has no row of its own on the sheet", tier)
-		}
-	}
-}
-
-// ── THE FAMILY ROW: WHICH POOL THE PRESETS DRAW FROM ─────────────────────
-//
-// models.crew.source is one row, and the chooser is where it moves: a header
-// the ←→ keys walk, above the presets it steers, staged until enter commits it
-// beside the preset as one decision.
-
-// THE FAMILY IS SAID ABOVE THE PRESETS, with the keys that move it named in
-// the hint under the ladder: a header row that takes ←→ while the presets
-// below keep ↑↓, so the two axes stay two axes.
-func TestTheCrewChooserNamesTheTwoFamiliesAboveThePresets(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.width = 240
-	a.slash("/crew")
-
-	rows := a.overlayRows(a.width, a.overlayHeight())
-	text := plain(strings.Join(rows, "\n"))
-	// The two families are one row, third on the sheet, sitting directly above
-	// the first preset after the scope line and seat one.
-	family := plain(rows[2])
-	if !strings.Contains(family, "open models") || !strings.Contains(family, "all models") {
-		t.Fatalf("the two families are not one row above the presets:\n%s", text)
-	}
-	for i, preset := range config.CrewPresets {
-		if row := plain(rows[3+2*i]); !strings.Contains(row, preset+" — "+config.CrewLine(preset)) {
-			t.Errorf("row %d is not %s's:\n%q", 3+2*i, preset, row)
-		}
+// THE PER-TASK LIMIT IS `/crew cap task <$>`, said back in whole dollars, and
+// `none` is refused: a task always has a limit.
+func TestCrewCapTask(t *testing.T) {
+	a, dir := sheetApp(t)
+	a.slash("/crew cap task 3")
+	if got := config.CrewTaskCapAt(dir); got != 3 {
+		t.Fatalf("the per-task limit reads %v", got)
 	}
-	// THE SHIPPED FAMILY IS THE WORD LIFTED, and it is the only one: the word
-	// the next enter writes is the fact the row answers, and a second lifted
-	// word would be a second answer on a row with one question.
-	if !strings.Contains(rows[2], a.pal.accent("all models")) {
-		t.Fatalf("the all family is not the word in force:\n%q", rows[2])
-	}
-	if strings.Contains(rows[2], a.pal.accent("open models")) {
-		t.Fatalf("both families are lifted at once:\n%q", rows[2])
-	}
-	// AND ←→ MOVES THE WORD while the preset cursor keeps its place and its
-	// mark: the family is a second axis, not a row the ↑↓ list gained.
-	a.crewPickerKey(key("left"))
-	rows = a.overlayRows(a.width, a.overlayHeight())
-	if !strings.Contains(rows[2], a.pal.accent("open models")) {
-		t.Fatalf("← did not walk the family to open:\n%q", rows[2])
-	}
-	// AND THE PRESETS BELOW IT ANSWER IN THAT FAMILY: a header saying open above
-	// rows still naming frontier models is the contradiction this chooser exists
-	// to prevent, and it is the one regression a header-only check would pass.
-	for i, preset := range config.CrewPresets {
-		if row := plain(rows[3+2*i]); !strings.Contains(row, config.CrewLineFor(config.CrewSourceOpen, preset)) {
-			t.Errorf("row %d under the open family is not %s's open line:\n%q", 3+2*i, preset, row)
-		}
+	if note := lastNote(t, a); !strings.Contains(note, "per-task limit · $3") {
+		t.Fatalf("the confirmation said %q", note)
 	}
-	// AND THE IN-FORCE MARK DOES NOT MOVE WITH THE FAMILY. The row that wears the
-	// selected ground is the preset the profile holds IN THE FAMILY IT HOLDS, so
-	// once ←→ lifts the family no row on screen is in force: one that kept the
-	// mark would name models the profile does not run.
-	if strings.Contains(rows[3+2*1], a.pal.accent("balanced — "+config.CrewLineFor(config.CrewSourceOpen, config.CrewBalanced))) {
-		t.Errorf("the balanced row is still marked in force after ←:\n%q", rows[3+2*1])
+	if got := config.CrewCapAt(dir); got != 0 {
+		t.Fatalf("/crew cap task moved the daily cap to %v", got)
 	}
-	if a.crewPick.cursor != 1 {
-		t.Fatalf("walking the family moved the preset cursor to row %d", a.crewPick.cursor)
+	a.slash("/crew cap task none")
+	if got := config.CrewTaskCapAt(dir); got != 3 {
+		t.Fatalf("none moved the per-task limit to %v", got)
 	}
-	if !strings.Contains(strings.Join(rows, "\n"), a.pal.accent("› ")) {
-		t.Fatalf("the preset cursor lost its mark to the family row:\n%s", plain(strings.Join(rows, "\n")))
+	if note := lastNote(t, a); !strings.Contains(note, "could not set the per-task limit") {
+		t.Fatalf("the refusal said %q", note)
 	}
 }
 
-// THE FAMILY IS READ FROM THE PROFILE, and the chooser opens on the word the
-// person last committed to, not on the default.
-func TestTheCrewChooserOpensOnThePersistedFamily(t *testing.T) {
+// A FORM THAT IS NONE OF THE FOUR changes nothing and says them — and the
+// retired preset words are exactly such forms now.
+func TestCrewRefusesARetiredPresetWord(t *testing.T) {
 	a, dir := sheetApp(t)
-	seed := map[string]any{config.KeyCrewSource: config.CrewSourceAll}
-	encoded, err := json.Marshal(seed)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), encoded, 0o600); err != nil {
-		t.Fatal(err)
+	a.slash("/crew frugal")
+	if note := lastNote(t, a); !strings.Contains(note, "not a crew form") || !strings.Contains(note, "/crew pin") {
+		t.Fatalf("a retired preset word said %q", note)
 	}
-
-	a.slash("/crew")
-	rows := a.overlayRows(a.width, a.overlayHeight())
-	if !strings.Contains(rows[2], a.pal.accent("all models")) {
-		t.Fatalf("the chooser opened on a family other than the persisted one:\n%q", rows[2])
-	}
-	// THE SEGMENT DOES NOT CARRY THE FAMILY, and the frame-disk law is why
-	// (the family section in crew.go says it once): it reads the crew word and
-	// nothing else, so a profile on the all family keeps the same segment shape.
-	if got := a.crewSegment(); got != "crew "+config.CrewBalanced {
-		t.Fatalf("the crew segment reads %q over an all profile", got)
-	}
-	// AND ESC LEAVES THE ROW ALONE: walking a family and walking away writes
-	// nothing, for the esc test's own reason.
-	a.crewPickerKey(key("right"))
-	a.crewPickerKey(key("esc"))
-	if got := config.CrewSourceAt(dir); got != config.CrewSourceAll {
-		t.Fatalf("esc wrote the family to %q", got)
+	if pins := config.CrewPinsAt(dir); len(pins) != 0 {
+		t.Fatalf("a retired word pinned %v", pins)
 	}
 }
 
-// CHOOSING A FAMILY AND A PRESET WRITES BOTH ROWS, as one decision and one file
-// write: the family and the five ids land together through
-// [config.ApplyCrewUnder].
-func TestChoosingAFamilyAndAPresetWritesTheSourceRow(t *testing.T) {
+// THE STATUS SEGMENT names the crew in the fewest cells: auto, and how many
+// seats are pinned when any is.
+func TestCrewSegment(t *testing.T) {
 	a, dir := sheetApp(t)
-	// A NEIGHBOUR THE WRITE MUST NOT TOUCH, because the family row lands
-	// through the same whole-file read-and-replace config's own writer uses.
-	seed := map[string]any{"test.neighbour": true}
-	encoded, err := json.Marshal(seed)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), encoded, 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	a.slash("/crew")
-	a.crewPickerKey(key("left"))
-	a.crewPickerKey(key("enter"))
-
-	if a.crewPick.open {
-		t.Fatal("enter left the chooser open")
-	}
-	// ← walked the family OFF the default, so the row is written: this is the
-	// case the family row exists for, and the one a write that skipped an
-	// unchanged family would still have to land.
-	if got := config.CrewSourceAt(dir); got != config.CrewSourceOpen {
-		t.Fatalf("enter wrote the family %q, want open", got)
-	}
-	if got := config.CrewAt(dir); got != config.CrewBalanced {
-		t.Fatalf("enter applied %q, want balanced", got)
-	}
-	open, _ := config.CrewModelsForSource(config.CrewSourceOpen, config.CrewBalanced)
-	for _, tier := range config.ModelTiers {
-		if got := config.TierModelAt(dir, tier); got != open[tier] {
-			t.Errorf("enter wrote %s as %q, want the open family's %q", tier, got, open[tier])
-		}
-	}
-	// The neighbour survived the one write.
-	data, err := os.ReadFile(config.BudgetConfigPath(dir))
-	if err != nil {
-		t.Fatal(err)
-	}
-	held := make(map[string]json.RawMessage)
-	if err := json.Unmarshal(data, &held); err != nil {
-		t.Fatal(err)
+	if got := a.crewSegment(); got != "crew auto" {
+		t.Fatalf("an untouched profile's segment is %q", got)
 	}
-	if string(held["test.neighbour"]) != "true" {
-		t.Fatalf("the family write lost its neighbour: %s", data)
-	}
-	// AND THE SEGMENT KEEPS ITS SHAPE: it reads the crew word and not the family
-	// (the family section in crew.go says it once).
-	if got := a.crewSegment(); got != "crew "+config.CrewBalanced {
-		t.Fatalf("the crew segment reads %q after the write", got)
-	}
-}
-
-// A ROW NOBODY WROTE READS AS THE SHIPPED FAMILY, and so does a word this build
-// does not know: the chooser offers two options and a stray string off the disk
-// is not a third.
-func TestTheCrewSourceRowDefaultsToAll(t *testing.T) {
-	dir := t.TempDir()
-	if got := config.CrewSourceAt(dir); got != config.CrewSourceAll {
-		t.Fatalf("a profile with no row read %q", got)
-	}
-	for _, row := range []string{
-		`{"models.crew.source": true}`,
-		`{"models.crew.source": "everyone"}`,
-		`{`,
-	} {
-		if err := os.WriteFile(config.BudgetConfigPath(dir), []byte(row), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if got := config.CrewSourceAt(dir); got != config.CrewSourceAll {
-			t.Fatalf("the row %s read %q, want all", row, got)
-		}
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), []byte(`{"models.crew.source": "open"}`), 0o600); err != nil {
+	if err := config.SetCrewPin(dir, crewroute.Planner, "vendor/planner"); err != nil {
 		t.Fatal(err)
 	}
-	if got := config.CrewSourceAt(dir); got != config.CrewSourceOpen {
-		t.Fatalf("the open row read %q", got)
+	if got := a.crewSegment(); got != "crew auto · 1 pinned" {
+		t.Fatalf("a profile with one pin reads %q", got)
 	}
 }
 
-// ── THE CREW IS READABLE WHERE PEOPLE GO TO CHECK ───────────────────────────
-//
-// /crew writes four class models and the session picks them up on its next
-// call, and NOTHING ON THE FRAME MOVES: the status line's model readout is the
-// conversation's model, which the crew never touches. Before these three
-// surfaces existed, the whole of the evidence was one note that scrolled away,
-// and a person who set the crew and then went to look for it concluded the
-// command had not worked.
-
-// /status NAMES THE CREW, directly under the model it is not.
-func TestStatusNamesTheCrewUnderTheModel(t *testing.T) {
+// A ROUTED TASK SAYS ITS CREW when it starts, with the estimate, and when it
+// lands, with the actual beside the estimate and the door to asking again.
+func TestARoutedTaskSaysItsCrewTwice(t *testing.T) {
 	a, _ := sheetApp(t)
-	a.slash("/crew max")
-
-	a.slash("/status")
-	text := lastNote(t, a)
-	lines := strings.Split(text, "\n")
-	at := -1
-	for i, line := range lines {
-		if strings.HasPrefix(line, "crew ") {
-			at = i
-		}
-	}
-	if at < 0 {
-		t.Fatalf("/status says nothing about the crew:\n%s", text)
-	}
-	// The preset word first, then the same three class names the confirmation
-	// prints — base names, in [config.CrewClasses]'s own order, read off the
-	// table rather than spelled here.
-	max, _ := config.CrewModels(config.CrewMax)
-	for _, want := range []string{
-		config.CrewMax,
-		"brain " + modelBase(max[config.ModelTierMastermind]),
-		"hands " + modelBase(max[config.ModelTierWorker]),
-		"checks " + modelBase(max[config.ModelTierHigh]),
-	} {
-		if !strings.Contains(lines[at], want) {
-			t.Errorf("the crew line lost %q: %q", want, lines[at])
-		}
+	crew := &crewroute.Decision{Class: crewroute.Bugfix, EstUSD: 0.02, Crew: []crewroute.Pick{
+		{Seat: crewroute.Worker, Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+		{Seat: crewroute.Planner, Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+		{Seat: crewroute.Checker, Model: "moonshotai/kimi-k3", Provider: "openrouter", Pinned: true},
+	}}
+	a.sayTaskCrew(session.TaskNotice{ID: 7, State: session.TaskRunning, Crew: crew})
+	a.sayTaskCrew(session.TaskNotice{ID: 7, State: session.TaskRunning, Crew: crew})
+	started := lastNote(t, a)
+	if !strings.Contains(started, "task 7 crew · bugfix · worker glm-5.3-flash (openrouter)") || !strings.Contains(started, "est $0.020") {
+		t.Fatalf("the start line reads %q", started)
 	}
-	if strings.Contains(lines[at], ":high") {
-		t.Errorf("/status shows a rung on a shipped preset's brain: %q", lines[at])
+	if !strings.Contains(started, a.icon(tokens.GPinned)+" kimi-k3") {
+		t.Fatalf("the pinned checker is not marked: %q", started)
 	}
-	// AND IT IS THE LINE UNDER THE MODEL, because the two are read together or
-	// not at all: one is what the conversation talks to, the other is what codeaf
-	// makes its own calls on.
-	if at == 0 || !strings.HasPrefix(lines[at-1], "model ") {
-		t.Fatalf("the crew line does not sit under the model line:\n%s", text)
-	}
-}
-
-// A CREW SOMEBODY ASSEMBLED THEMSELVES READS AS CUSTOM HERE TOO. The word is
-// derived from the four live rows, so the line cannot say "max" over a class
-// that was hand-set out of it.
-func TestStatusSaysCustomOverAHandSetClass(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.slash("/crew max")
-	a.openSettings()
-	toProviders(t, a)
-	setRow(t, a, config.KeyTierMastermindModel, "openai/gpt-5")
-	a.closeSettings()
-
-	a.slash("/status")
-	text := lastNote(t, a)
-	line := ""
-	for _, row := range strings.Split(text, "\n") {
-		if strings.HasPrefix(row, "crew ") {
-			line = row
+	count := 0
+	for _, e := range a.entries {
+		if e.kind == entryNote && strings.Contains(e.text, "task 7 crew") {
+			count++
 		}
 	}
-	if line == "" {
-		t.Fatalf("/status says nothing about the crew:\n%s", text)
+	if count != 1 {
+		t.Fatalf("the start line was said %d times", count)
 	}
-	if !strings.Contains(line, config.CrewCustom) {
-		t.Fatalf("the crew line reads %q over a hand-set class, want custom", line)
-	}
-	if strings.Contains(line, config.CrewMax) {
-		t.Fatalf("the crew line still claims the preset it left: %q", line)
-	}
-	if !strings.Contains(line, "brain gpt-5") {
-		t.Fatalf("the crew line does not name the class that was hand-set: %q", line)
+	a.sayTaskCrew(session.TaskNotice{ID: 7, State: session.TaskDone, Crew: crew, CostUSD: 0.018})
+	if landed := lastNote(t, a); !strings.Contains(landed, "$0.018 (est $0.020)") || !strings.Contains(landed, "/redo stronger") {
+		t.Fatalf("the landing line reads %q", landed)
 	}
 }
 
-// THE EMPTINESS LAW, AIMED AT THE RIGHT FACT: a window with no four tier rows
-// to read has no crew line at all — not a label with a default beside it, which
-// would be a claim about a file nobody is writing. That window is the HOSTED
-// one, where the crew lives on the far machine.
-func TestStatusSaysNothingAboutACrewInAHostedWindow(t *testing.T) {
-	a := newTestApp(&fakeAgent{model: "m"})
-	a.model = "m"
-	a.host = "devbox"
-
-	a.slash("/status")
-	for _, line := range strings.Split(lastNote(t, a), "\n") {
-		if strings.HasPrefix(line, "crew") {
-			t.Fatalf("a hosted window grew a crew line: %q", line)
-		}
-	}
+// crewEffortAgent is a task door that records the effort word it was handed.
+type crewEffortAgent struct {
+	*fakeAgent
+	effort, brief string
+	redone        bool
 }
 
-// AND AN EMPTY PROFILE DIRECTORY IS THE ORDINARY LAUNCH, WHICH HAS A CREW.
-//
-// CODEAF_PROFILE_DIR is exported by almost nobody, so the empty string is what
-// nearly every launch carries and internal/config resolves it to this process's
-// own profile in the state root. The guard that read it as "no profile" left the
-// crew off /status, off the status line and out of the picker's hint on every
-// one of those launches (#315).
-func TestAnEmptyProfileDirectoryIsTheOrdinaryProfileAndStillHasACrew(t *testing.T) {
-	// THE SURFACE IS OPENED THE WAY A BARE `codeaf` OPENS IT — NO PROFILE
-	// DIRECTORY NAMED — which is the very fact this test is about. It is
-	// [ordinaryLaunch] and not [newTestApp] for that reason: [newTestApp] now gives
-	// every app a profile of its own, and this test means the launch that names
-	// none. [ordinaryLaunch] still gives it a state root of this test's own, so the
-	// profile it resolves is this test's and not the run's.
-	a := ordinaryLaunch(t, Options{}, nil)
-	a.model = "m"
-	if a.profileDir != "" {
-		t.Fatalf("this app names a profile at %q and cannot test the ordinary launch", a.profileDir)
-	}
-
-	if word := a.crewWord(); !strings.HasPrefix(word, config.CrewBalanced+" ·") {
-		t.Fatalf("the ordinary launch reads its crew as %q", word)
-	}
-	if got := a.crewSegment(); got != "crew "+config.CrewBalanced {
-		t.Fatalf("the ordinary launch's crew segment reads %q", got)
-	}
-	a.slash("/status")
-	if got := noteFact(lastNote(t, a), "crew"); !strings.HasPrefix(got, config.CrewBalanced+" ·") {
-		t.Fatalf("/status says the crew as %q on an ordinary launch:\n%s", got, lastNote(t, a))
-	}
+func (c *crewEffortAgent) StartTask(ctx context.Context, brief string, solo bool) (uint64, string, string, error) {
+	c.brief = brief
+	return 1, brief, "", nil
 }
 
-// THE MODEL PICKER SAYS THE CREW'S NAME BESIDE ITS KEYS, because this list is
-// where a person lands hunting for a change /crew did not make here. It is the
-// word alone: the slot's cells come out of the conversation's name at the other
-// end of the legend, and every printable key is going into the filter box, so a
-// command named here would be a door that cannot be walked through.
-func TestTheModelPickerNamesTheCrewInTheHintSlot(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.slash("/crew max")
-	a.pick.open = true
-
-	if got := a.hintWord(); got != "enter switch · esc · crew max" {
-		t.Fatalf("the picker's hint reads %q", got)
-	}
-
-	// And a hosted window — the one window with no crew of its own — is the hint
-	// exactly as it was.
-	hostedWindow := newTestApp(&fakeAgent{model: "m"})
-	hostedWindow.host = "devbox"
-	hostedWindow.pick.open = true
-	if got := hostedWindow.hintWord(); got != "enter switch · esc" {
-		t.Fatalf("the hint in a hosted window reads %q", got)
-	}
+func (c *crewEffortAgent) StartTaskEffort(ctx context.Context, brief string, solo bool, effort string) (uint64, string, string, error) {
+	c.brief, c.effort = brief, effort
+	return 1, brief, "", nil
 }
 
-// AND THE CONFIRMATION NAMES WHAT IT DID NOT CHANGE, in the same line and at
-// the moment the question is raised: the conversation's model by id, spelled as
-// the status line spells it, and the one command that moves it. It is still one
-// line.
-func TestTheCrewConfirmationPointsAtTheModelItDidNotChange(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.slash("/crew max")
-
-	text := lastNote(t, a)
-	if strings.Count(text, "\n") != 0 {
-		t.Fatalf("the confirmation is more than one line:\n%s", text)
-	}
-	if !strings.HasSuffix(text, "· you are still talking to gpt-4.1-mini — /model changes that") {
-		t.Fatalf("the confirmation does not name the model it left alone: %q", text)
-	}
-	// The id is the status line's spelling — the basename — and not the routing
-	// address, so a person can check the clause against the foot of the frame.
-	if strings.Contains(text, "openai/gpt-4.1-mini") {
-		t.Fatalf("the confirmation spells the model as a routing address: %q", text)
-	}
-	// AND THE SPELLING FOLLOWS THE REASONING LEVEL, because the status line's does.
-	// Set on the AGENT rather than through ctrl+t, which is a session that was
-	// dialled somewhere this surface did not watch — so the level is learned the
-	// way the frame clock learns it (reasoninglevel.go).
-	a.agent.SetReasoningFor("openai/gpt-4.1-mini", "high")
-	settleLevels(a, "openai/gpt-4.1-mini")
-	a.slash("/crew balanced")
-	if text := lastNote(t, a); !strings.Contains(text, "you are still talking to gpt-4.1-mini:high —") {
-		t.Fatalf("the confirmation lost the level the status line shows: %q", text)
-	}
+func (c *crewEffortAgent) RedoStronger(ctx context.Context, row uint64) (uint64, string, error) {
+	c.redone = true
+	return 2, "again", nil
 }
 
-// ── THE FIVE SEATS ──────────────────────────────────────────────────────────
-//
-// codeaf runs five model seats — the one you talk to, plus reflex, small work,
-// careful work and mastermind — and /crew moves only the last four. Every
-// surface that names the crew now names the fifth seat beside it, so the two
-// dials are visibly two dials.
-
-// BARE /crew IS THE FIVE-SEAT READING: a scope line saying what the presets
-// change and what they do not, seat one on a line of its own, the three presets
-// exactly as before, and a closing line pointing at where a single seat is
-// pinned.
-func TestBareCrewReadsTheFiveSeats(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.width = 240
-	a.slash("/crew")
-
-	rows := a.overlayRows(a.width, a.overlayHeight())
-	if len(rows) != a.crewPick.height() {
-		t.Fatalf("the chooser drew %d rows and promised %d", len(rows), a.crewPick.height())
-	}
-	text := plain(strings.Join(rows, "\n"))
-	if !strings.HasPrefix(plain(rows[0]), crewScopeLine) {
-		t.Fatalf("the chooser does not open with the scope line:\n%s", text)
-	}
-	if seat := plain(rows[1]); !strings.Contains(seat, crewSeatLead+" · gpt-4.1-mini") {
-		t.Fatalf("seat one is not the second row:\n%s", text)
-	}
-	if !strings.HasSuffix(plain(rows[len(rows)-1]), crewPinLine) {
-		t.Fatalf("the chooser does not close on the pinning note:\n%s", text)
-	}
-	// SEAT ONE IS NOT A ROW ENTER COULD APPLY: it wears no lead, no cursor and no
-	// ground, and the cursor still opens on the crew in force below it.
-	if strings.Contains(rows[1], a.pal.accent("› ")) {
-		t.Fatalf("seat one took the cursor:\n%q", rows[1])
-	}
-	if strings.Contains(rows[1], "\x1b[48;5;"+itoa(int(hueSelected.idx))+"m") {
-		t.Fatalf("seat one wears the chosen ground:\n%q", rows[1])
-	}
-	if a.crewPick.cursor != 1 {
-		t.Fatalf("the cursor opened on row %d, want balanced at 1", a.crewPick.cursor)
-	}
-	// The presets follow, in their own order, after the three reading lines: the
-	// scope line, seat one and the family selector.
-	for i, preset := range config.CrewPresets {
-		if row := plain(rows[3+2*i]); !strings.Contains(row, preset+" — "+config.CrewLine(preset)) {
-			t.Errorf("row %d is not %s's:\n%q", 3+2*i, preset, row)
+// `/task --best` and `/task --cheap` hand the word to the session and keep it
+// out of the brief; a task without either uses the ordinary door.
+func TestTaskEffortWordsReachTheSession(t *testing.T) {
+	for _, c := range []struct{ typed, effort, brief string }{
+		{"/task --best fix the parser", "best", "fix the parser"},
+		{"/task --cheap rename the flag", "cheap", "rename the flag"},
+		{"/task fix the parser --best", "", "fix the parser --best"},
+	} {
+		a, _ := sheetApp(t)
+		door := &crewEffortAgent{fakeAgent: &fakeAgent{model: "openai/gpt-4.1-mini"}}
+		a.agent = door
+		runCmd(a.runTaskCommand(strings.TrimPrefix(c.typed, "/task ")))
+		if door.effort != c.effort || door.brief != c.brief {
+			t.Errorf("%q reached the session as effort %q brief %q", c.typed, door.effort, door.brief)
 		}
 	}
-	// And enter still applies the preset under the cursor, seat one untouched.
-	a.crewPickerKey(key("down"))
-	a.crewPickerKey(key("enter"))
-	if got := config.CrewAt(a.profileDir); got != config.CrewMax {
-		t.Fatalf("enter applied %q, want max", got)
-	}
-	if a.model != "openai/gpt-4.1-mini" {
-		t.Fatalf("the chooser moved the conversation's model to %q", a.model)
-	}
 }
 
-// THE CREW IS SAID ON THE PAGES AND NOT ON THE ROW, and every page says the
-// same word — /status, the sheet, the picker's hint and the chooser all derive
-// it from the four live rows through one function.
-//
-// It stood at the head of the telemetry, across the gap from the conversation's
-// model, until 2026-09-09. It is a SETTING rather than a measurement and it is
-// said in full elsewhere, so it came off a row that is read at a glance and
-// acted on segment by segment (foot.go's [groupOff]).
-func TestTheCrewWordIsSaidTheSameWayOnEveryPageThatSaysIt(t *testing.T) {
+// `/redo stronger` is the one form of /redo, and it reaches the session.
+func TestRedoStrongerReachesTheSession(t *testing.T) {
 	a, _ := sheetApp(t)
-	a.width = 200
-	a.slash("/crew max")
-
-	if line := plain(a.legend(a.width)); strings.Contains(line, "crew") {
-		t.Fatalf("the status line is still naming the crew:\n%q", line)
-	}
-	if segGroup(segCrew) != groupOff {
-		t.Fatalf("the crew is drawn on the status row: %v", segGroup(segCrew))
-	}
-	// ONE SOURCE FOR THE WORD, wherever it is said.
-	if a.crewHint() != a.crewSegment() {
-		t.Fatalf("the hint says %q and the segment says %q", a.crewHint(), a.crewSegment())
-	}
-	a.slash("/status")
-	if got := noteFact(lastNote(t, a), "crew"); !strings.HasPrefix(got, "max ·") {
-		t.Fatalf("/status reads %q rather than the same word:\n%s", got, lastNote(t, a))
+	door := &crewEffortAgent{fakeAgent: &fakeAgent{model: "openai/gpt-4.1-mini"}}
+	a.agent = door
+	runCmd(a.runRedo("stronger"))
+	if !door.redone {
+		t.Fatal("/redo stronger never reached the session")
 	}
-	// A hand-set seat turns every reading to custom at once.
-	a.openSettings()
-	toProviders(t, a)
-	setRow(t, a, config.KeyTierMastermindModel, "openai/gpt-5")
-	a.closeSettings()
-	if got := a.crewSegment(); got != "crew custom" {
-		t.Fatalf("the crew reads %q after a hand-set seat, want crew custom", got)
+	door.redone = false
+	runCmd(a.runRedo("harder"))
+	if door.redone {
+		t.Fatal("/redo with another word reached the session")
 	}
-	if got := deckValue(a.deckItems(), "crew"); !strings.HasPrefix(got, config.CrewCustom) {
-		t.Fatalf("the sheet's crew row is %q after a hand-set seat", got)
+	if note := lastNote(t, a); !strings.Contains(note, "usage: /redo stronger") {
+		t.Fatalf("/redo harder said %q", note)
 	}
 }
 
-// THE CREW IS NOT ON THE ROW AT ANY WIDTH. It used to be the first segment a
-// crowded row gave up, which is the shape of a fact that did not belong there:
-// the row is a ledger of things a person acts on from it, and a preset is
-// changed on a page. The bill and the meter keep every width they had.
-func TestTheCrewIsOffTheRowAtEveryWidth(t *testing.T) {
+// A TASK THAT STOPPED ON A CAUSE A PERSON CAN FIX LEADS WITH THE FIX: the one
+// action, first, no "/redo stronger" (a stronger crew meets the same wall),
+// and no $0.000 for a run that spent nothing.
+func TestAStoppedTaskLeadsWithItsOneAction(t *testing.T) {
 	a, _ := sheetApp(t)
-	a.title = "a conversation with a name long enough to crowd"
-	a.ctxWindow, a.ctxTokens = 200_000, 24_000
-	a.cost = 0.31
-
-	for _, width := range []int{200, 100} {
-		row := plain(a.legend(width))
-		if strings.Contains(row, "crew") {
-			t.Fatalf("the %d-column row carries the crew:\n%q", width, row)
-		}
-		// The meter and the state word outlast every width here; the bill is
-		// the last number the seam gives up before the meter ([dropOrder]),
-		// and a long name at a hundred columns costs it.
-		kept := []string{"$0.31", "24k/200k", "idle"}
-		if width < 120 {
-			kept = kept[1:]
-		}
-		for _, want := range kept {
-			if !strings.Contains(row, want) {
-				t.Fatalf("the %d-column row lost %q:\n%q", width, want, row)
-			}
-		}
-	}
-	// The crew is not on the line at all any more (foot.go's [groupOff]), so it
-	// is not on the ladder either: the sheet and /status are where it is said.
-	if segGroup(segCrew) != groupOff {
-		t.Fatalf("the crew is drawn on the status row: %v", segGroup(segCrew))
+	crew := &crewroute.Decision{Class: crewroute.Bugfix, EstUSD: 0.02, Stopped: "add credit on openrouter to continue", Crew: []crewroute.Pick{
+		{Seat: crewroute.Worker, Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+		{Seat: crewroute.Planner, Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+		{Seat: crewroute.Checker, Model: "moonshotai/kimi-k3", Provider: "openrouter"},
+	}}
+	a.sayTaskCrew(session.TaskNotice{ID: 3, State: session.TaskFailed, Crew: crew})
+	line := lastNote(t, a)
+	if !strings.HasPrefix(line, "task 3 crew · failed — add credit on openrouter to continue · ") {
+		t.Errorf("the stopped line reads %q", line)
+	}
+	if strings.Contains(line, "/redo stronger") || strings.Contains(line, "$0.000") {
+		t.Errorf("the stopped line offers a redo or a free success: %q", line)
 	}
 }
 
-// THE EMPTINESS LAW ON THE ROW: a hosted window has no crew to read — it is on
-// the far machine — and the status line says nothing rather than guessing a word.
-func TestTheStatusLineSaysNothingAboutACrewInAHostedWindow(t *testing.T) {
-	a := newTestApp(&fakeAgent{model: "m"})
-	a.model = "m"
-	a.host = "devbox"
-	if line := plain(a.legend(200)); strings.Contains(line, "crew") {
-		t.Fatalf("a hosted window grew a crew segment:\n%q", line)
-	}
-	for _, part := range a.telemetry(200) {
-		if part.kind == segCrew {
-			t.Fatalf("a hosted window assembled a crew segment: %+v", part)
-		}
-	}
-}
-
-// AND AN ORDINARY LAUNCH READS IT ON ITS OWN PAGE, at both the widths a person
-// actually sits at.
-//
-// This is the issue's headline said the way a person meets it: a crew picked in
-// a profile of this test's own, nothing exported into the environment, and the
-// word reachable without a flag or a variable. It was the FRAME that carried it
-// when #315 was fixed — the crew word rode the status row — and since 2026-09-09
-// the row does not carry settings, so what this asserts is the door that
-// replaced it: the sheet and /status, which every width reaches the same way. A
-// hosted window still shows none: its crew is on the far machine.
-func TestAnOrdinaryLaunchCarriesTheCrewOnItsPageAtEveryWidth(t *testing.T) {
-	dir := t.TempDir()
-	if err := config.ApplyCrew(dir, config.CrewMax); err != nil {
-		t.Fatal(err)
-	}
-	for _, width := range []int{80, 120} {
-		// TWO SURFACES OVER ONE PROFILE, ON PURPOSE: the crew the preset put on
-		// `dir` is what both read, so both name the same directory rather than one
-		// of their own.
-		a := newTestAppWithProfile(dir, &fakeAgent{model: "openai/gpt-4.1-mini"})
-		a.model = "openai/gpt-4.1-mini"
-		a.width, a.height = width, 24
-		painted, _, _ := a.frame()
-		if frame := plain(painted); strings.Contains(frame, "crew ") {
-			t.Fatalf("the %d-column frame of an ordinary launch still carries the crew:\n%s", width, frame)
-		}
-		if got := deckValue(a.deckItems(), "crew"); !strings.HasPrefix(got, config.CrewMax) {
-			t.Fatalf("at %d columns the sheet's crew row is %q, want the picked preset", width, got)
-		}
-
-		hostedWindow := newTestAppWithProfile(dir, &fakeAgent{model: "openai/gpt-4.1-mini"})
-		hostedWindow.host = "devbox"
-		hostedWindow.model = "openai/gpt-4.1-mini"
-		hostedWindow.width, hostedWindow.height = width, 24
-		if got := deckValue(hostedWindow.deckItems(), "crew"); got != "" {
-			t.Fatalf("at %d columns a hosted window read a crew: %q", width, got)
-		}
-	}
-}
-
-// AND THE STATUS SHEET CARRIES THE CREW UNDER THE MODEL, the way /status does,
-// because the two are one list: the phone's sheet was the one surface that did
-// not say it.
-func TestTheStatusSheetCarriesTheCrewUnderTheModel(t *testing.T) {
-	a, _ := sheetApp(t)
-	a.slash("/crew max")
-
-	items := a.deckItems()
-	for i, item := range items {
-		if item.label != "crew" {
-			continue
-		}
-		if i == 0 || items[i-1].label != "model" {
-			t.Fatalf("the crew is not under the model: %+v", items)
-		}
-		if item.value != a.crewWord() {
-			t.Fatalf("the sheet's crew reads %q, want %q", item.value, a.crewWord())
-		}
-		// Once, and in full — never a second time as the row's short word.
-		for _, other := range items[i+1:] {
-			if other.label == "crew" || other.value == "crew max" {
-				t.Fatalf("the crew is on the sheet twice: %+v", items)
-			}
-		}
-		return
-	}
-	t.Fatalf("the sheet has no crew line: %+v", items)
-}
-
-// ── the pick row ────────────────────────────────────────────────────────────
-
-// THE THREE PICK WORDS ARE DOOR WORDS, beside the presets: `/crew learn` says
-// where the seats come from and moves no model id, and the confirmation, the
-// crew word and the segment all carry it. `/crew table` is the way back.
-func TestCrewTakesThePickWords(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.slash("/crew learn")
-
-	if got := config.CrewPickAt(dir); got != config.CrewPickLearn {
-		t.Fatalf("/crew learn left the pick reading %q", got)
-	}
-	if got := config.CrewAt(dir); got != config.DefaultCrew {
-		t.Fatalf("a pick word moved the crew to %q", got)
-	}
-	// THE CREW WORD AND THE SEGMENT SAY IT: `balanced · learn` on the page,
-	// `crew balanced · learn` on the status line — the word a person reads in
-	// /status is the word the frame carries.
-	if word := a.crewWord(); !strings.Contains(word, "· learn") {
-		t.Fatalf("the crew word reads %q, want the pick beside the preset", word)
-	}
-	if seg := a.crewSegment(); seg != "crew balanced · learn" {
-		t.Fatalf("the segment reads %q, want crew balanced · learn", seg)
-	}
-	if text := lastNote(t, a); !strings.Contains(text, "crew → "+config.DefaultCrew+" · learn") {
-		t.Fatalf("the confirmation reads %q, want the pick named", text)
-	}
-
-	a.slash("/crew table")
-	if got := config.CrewPickAt(dir); got != config.CrewPickTable {
-		t.Fatalf("/crew table left the pick reading %q", got)
-	}
-	if seg := a.crewSegment(); seg != "crew "+config.DefaultCrew {
-		t.Fatalf("the segment reads %q after the way back, want the plain crew word", seg)
-	}
-}
-
-// THE CHOOSER NAMES THE PICK when it is off the table, and says nothing about
-// the default: the table is where the seats have always come from, and a line
-// naming it would say something nobody chose.
-func TestTheCrewChooserNamesThePickWhenItIsOffTheTable(t *testing.T) {
+// A NEW CONVERSATION'S TASK 1 SAYS ITS CREW, though the last conversation's
+// task 1 had landed: the lines are the conversation's, and go with it.
+func TestANewConversationsTaskSaysItsCrew(t *testing.T) {
 	a, _ := sheetApp(t)
-	a.slash("/crew learn")
-	a.slash("/crew")
-	text := plain(strings.Join(a.overlayRows(a.width, a.overlayHeight()), "\n"))
-	if !strings.Contains(text, "picked from learn") {
-		t.Fatalf("the chooser does not name the pick:\n%s", text)
-	}
-	a.crewPick.close()
-	a.slash("/crew table")
-	a.slash("/crew")
-	text = plain(strings.Join(a.overlayRows(a.width, a.overlayHeight()), "\n"))
-	if strings.Contains(text, "picked from") {
-		t.Fatalf("the chooser names the default pick:\n%s", text)
-	}
-}
-
-// THE PICK ROW SITS UNDER THE CREW ROW AND CYCLES, like every other enum row
-// on the sheet: the crew word above it says how much to spend, and this says
-// where the models for that money come from.
-func TestThePickRowSitsUnderTheCrewRowAndCycles(t *testing.T) {
-	a, dir := sheetApp(t)
-	a.openSettings()
-	toProviders(t, a)
-
-	// THE PLACE: directly under the crew row, before the classes it seats. A
-	// pick row a tab away from the crew word would be two errands on two
-	// screens for one decision.
-	crew, pick := -1, -1
-	for i, item := range a.sheet.items {
-		switch item.row.Key {
-		case config.KeyCrew:
-			crew = i
-		case config.KeyCrewPick:
-			pick = i
-		}
-	}
-	if crew < 0 || pick < 0 {
-		t.Fatalf("the Providers tab holds no crew/pick pair (crew %d, pick %d)", crew, pick)
-	}
-	if pick != crew+1 {
-		t.Fatalf("the pick row sits at %d with the crew at %d, want it directly under", pick, crew)
-
-	}
-
-	cursorTo(t, a, config.KeyCrewPick)
-	drive(t, a, key("enter"))
-	if got := config.CrewPickAt(dir); got != config.CrewPickCatalog {
-		t.Fatalf("enter on table landed on %q, want %q", got, config.CrewPickCatalog)
-	}
-	drive(t, a, key("enter"))
-	if got := config.CrewPickAt(dir); got != config.CrewPickLearn {
-		t.Fatalf("enter on catalog landed on %q, want %q", got, config.CrewPickLearn)
-	}
-	drive(t, a, key("enter"))
-	if got := config.CrewPickAt(dir); got != config.CrewPickTable {
-		t.Fatalf("enter on learn landed on %q, want %q", got, config.CrewPickTable)
+	crew := &crewroute.Decision{Class: crewroute.Bugfix, EstUSD: 0.02, Crew: []crewroute.Pick{
+		{Seat: crewroute.Worker, Model: "z-ai/glm-5.3-flash", Provider: "openrouter"},
+		{Seat: crewroute.Planner, Model: "z-ai/glm-5.3-flash"}, {Seat: crewroute.Checker, Model: "moonshotai/kimi-k3"},
+	}}
+	a.sayTaskCrew(session.TaskNotice{ID: 1, State: session.TaskDone, Crew: crew, CostUSD: 0.01})
+	a.dropTasks()
+	before := len(a.entries)
+	a.sayTaskCrew(session.TaskNotice{ID: 1, State: session.TaskRunning, Crew: crew})
+	if len(a.entries) == before || !strings.Contains(lastNote(t, a), "task 1 crew · bugfix") {
+		t.Fatalf("the new conversation's task 1 said no crew line")
 	}
 }
diff --git a/internal/tui3/crewhint_test.go b/internal/tui3/crewhint_test.go
new file mode 100644
index 0000000000..1fead02074
--- /dev/null
+++ b/internal/tui3/crewhint_test.go
@@ -0,0 +1,50 @@
+package tui3
+
+import (
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+)
+
+// A SEAT'S HINT NAMES ONLY WHAT IT COULD BE GIVEN NOW. The history said
+// inkling-small for the worker, but no offer reaches it any more (its free
+// pool is switched off); the checker's usual model sits behind a provider
+// that is off; the planner's is outside the rule. Each gives way to the
+// router's reachable pick, and where that is unreachable too, to nothing —
+// which the seat draws as "nothing allowed can sit this seat".
+func TestTheSeatHintNamesOnlyAReachableModel(t *testing.T) {
+	offer := func(id string, allowed, served bool) config.CrewOffer {
+		return config.CrewOffer{Model: crewroute.Model{ID: id}, Allowed: allowed, Served: served}
+	}
+	offers := []config.CrewOffer{
+		offer("z-ai/glm-5.3-flash", true, true),
+		offer("moonshotai/kimi-k3", true, false),
+		offer("anthropic/claude-opus-5", false, true),
+	}
+	usual := map[crewroute.Seat]string{
+		crewroute.Worker:  "inkling-small",
+		crewroute.Checker: "kimi-k3",
+		crewroute.Planner: "claude-opus-5",
+	}
+	seen := map[crewroute.Seat]bool{crewroute.Worker: true, crewroute.Checker: true, crewroute.Planner: true}
+	suggest := map[crewroute.Seat]string{
+		crewroute.Worker:  "z-ai/glm-5.3-flash",
+		crewroute.Checker: "moonshotai/kimi-k3",
+		crewroute.Planner: "thinkingmachines/inkling-small:free",
+	}
+	crewReachableUsual(usual, seen, suggest, offers)
+	if usual[crewroute.Worker] != "glm-5.3-flash" || seen[crewroute.Worker] {
+		t.Errorf("worker hint %q (usually=%v), want likely glm-5.3-flash", usual[crewroute.Worker], seen[crewroute.Worker])
+	}
+	if usual[crewroute.Checker] != "" || usual[crewroute.Planner] != "" {
+		t.Errorf("checker %q, planner %q: want no hint where nothing reachable remains", usual[crewroute.Checker], usual[crewroute.Planner])
+	}
+
+	kept := map[crewroute.Seat]string{crewroute.Worker: "glm-5.3-flash"}
+	keptSeen := map[crewroute.Seat]bool{crewroute.Worker: true}
+	crewReachableUsual(kept, keptSeen, map[crewroute.Seat]string{}, offers)
+	if kept[crewroute.Worker] != "glm-5.3-flash" || !keptSeen[crewroute.Worker] {
+		t.Errorf("a reachable usual model was dropped: %q %v", kept[crewroute.Worker], keptSeen[crewroute.Worker])
+	}
+}
diff --git a/internal/tui3/crewpanel.go b/internal/tui3/crewpanel.go
new file mode 100644
index 0000000000..1246374b9b
--- /dev/null
+++ b/internal/tui3/crewpanel.go
@@ -0,0 +1,2391 @@
+package tui3
+
+import (
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+	"github.com/charmbracelet/x/ansi"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/fuzzy"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/router"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
+)
+
+// THE CREW PANEL: /crew with nothing after it.
+//
+//	╭─ crew ─────────────────────────────────────── esc ─╮
+//	│   worker    auto · usually glm-5.3-flash           │
+//	│   planner   auto · usually glm-5.3-flash           │
+//	│ › checker   (pin) kimi-k3                           │
+//	│                                                    │
+//	│   models    ‹ all › (96)                           │
+//	│   providers ✓ openrouter  ✓ codex sub  ○ my-vllm  + │
+//	│   cap       none                                   │
+//	│                                                    │
+//	│   today $1.84 · 14 tasks                           │
+//	╰─ enter change · esc close · ? keys ────────────────╯
+//
+// It is the one place a person changes WHAT IS ALLOWED — which seat is pinned
+// to which model, which models a seat may be picked from, and what the crews
+// may spend in a day — and those three are the whole of what persists about a
+// crew (crew.go's header, internal/config's crew.go). How hard to try ONE task
+// is said in the ask and never here.
+//
+// SIX ROWS, ONE VERB. Three seats, the allowed models, the providers and the
+// cap are the only rows the cursor stops on, and enter is what every one of
+// them answers:
+//
+//   - A SEAT opens the one list this panel has — the models a seat could sit,
+//     `auto` first, the router's own suggestion marked — and enter on a row of
+//     it pins that seat. Unpinning is choosing `auto`, which is the first row
+//     the list opens on, so it is two presses and there is no second verb for it.
+//   - THE MODELS ROW IS EDITED WHERE IT STANDS. ←/→ walk its four answers — all,
+//     open, a price ceiling, custom — and each step is written as it is taken; a
+//     price turns the row into its two ceilings, typed into holes on the row
+//     itself; custom opens the checklist, the one other screen here.
+//   - THE PROVIDERS ROW IS TOGGLED WHERE IT STANDS. It is one chip per
+//     connected provider, ←/→ walk them, and space turns the one under the
+//     cursor off or on; the `+` at its end is /connect. Enter opens the one
+//     screen that says more about each — how it bills, how many models it
+//     serves, what it carried today.
+//   - THE CAP IS TYPED WHERE IT STANDS. A digit on the row starts it, enter
+//     keeps it, an emptied hole is no cap. There is no dialog to open first.
+//
+// EVERY CHANGE IS WRITTEN THE MOMENT IT IS MADE, through the same writers the
+// `/crew` shortcuts use (internal/config's SetCrewPin, SetCrewAllowedRule,
+// SetCrewProviderOn, SetCrewCap), so a refusal is the same refusal whichever door asked. What
+// makes that safe is the undo beside it: the row that changed wears a tick,
+// and for a few seconds the bottom edge offers `z undo`, which puts the rows
+// back exactly as they were ([config.RestoreCrewState]).
+//
+// A PROVIDER TURNED OFF IS A ROUTE TAKEN AWAY, NOT A MODEL. The allowed models
+// are the models row's rule less every model no provider that is still on
+// serves, and the models row counts exactly that; the set of providers turned
+// off is a row of its own beside the rule (internal/crewroute's providers.go
+// argues why it is never a `-x` inside it). Connecting a provider is still
+// what adds one — the row only ever lists connections — so a provider
+// connected tomorrow is on the day it is connected, and the last one on
+// cannot be turned off, because a crew with nothing to route through is no
+// crew at all.
+//
+// ── WHAT IT IS BUILT FROM ──
+//
+// Nothing here is a widget of its own. The block is THE ONE FRAME (frame.go),
+// the frame every object that hangs over the box is drawn in; its rows are the
+// overlay row's lead and ground (palette.go's [overlayLead], [palette.cursor]);
+// its two lists walk with [moveCursor] and [listTop] and filter with the
+// matcher every picker shares ([fuzzyTerms], internal/fuzzy); its filter box is
+// the one-line box in the input line's place, exactly where /model and /connect
+// put theirs (input.go); and its holes are the question form's own
+// `[ value ]` (questioninput.go's [app.questionHole]).
+//
+// ── ONE PANEL, EVERY DOOR ──
+//
+// /crew opens it over the conversation. A place cannot draw an overlay
+// (pages.go's [app.closeModals]), so /crew typed on home, and the settings
+// sheet's `seats` row, step off the place, open this, and esc steps back onto
+// the place they came from — one panel, never an embedded copy that could say
+// something different.
+
+// crewView is which of the panel's screens is up.
+type crewView uint8
+
+const (
+	// crewMain is the six rows.
+	crewMain crewView = iota
+	// crewPicking is the list a seat is pinned from.
+	crewPicking
+	// crewChecking is the custom checklist of allowed models.
+	crewChecking
+	// crewProviding is the providers row laid out, one provider a line.
+	crewProviding
+	// crewKeys is `?`: every key and gesture the panel takes.
+	crewKeys
+)
+
+// The main panel's six stops, in the order the cursor walks them. The three
+// seats come first and in [crewroute.Seats] order, so a stop below crewModels
+// is a seat by its index.
+const (
+	crewModels    = 3
+	crewProviders = 4
+	crewCap       = 5
+	crewStops     = 6
+)
+
+// crewListRows is how many rows either list shows at most — the same ceiling
+// the model picker keeps ([pickerRows]).
+const crewListRows = pickerRows
+
+// crewUndoFor is how long the bottom edge offers `z undo` after a change, and
+// how long the changed row wears its tick.
+const crewUndoFor = 5 * time.Second
+
+// crewNarrow is the width under which the seats drop their "usually" hint.
+// The hint is the one fact on a seat row that is a reading rather than a
+// setting, so it is the first to go, and the row never clips instead.
+const crewNarrow = 70
+
+// Default price ceilings, dollars per million tokens in and out, for the first
+// time the models row is walked onto a price. They are the grammar's own
+// example (crewroute's allowed.go), which admits the cheap open models the
+// router's evidence priced and leaves the frontier out.
+const (
+	crewPriceIn  = 1.0
+	crewPriceOut = 5.0
+)
+
+// The words the panel says. Each is quoted in the manual as it is spelled
+// here, and the e2e suite waits for the title.
+const (
+	crewTitleWord      = "crew"
+	crewMainKeys       = "enter change · esc close · ? keys"
+	crewChipKeys       = "enter change · space toggle · esc close · ? keys"
+	crewProvKeys       = "space or enter toggle · esc back"
+	crewPickKeys       = "type to filter · enter pick · → routes · esc back"
+	crewCheckKeys      = "type to filter · space or enter tick · esc back"
+	crewKeysKeys       = "esc back"
+	crewUndoWord       = "z undo"
+	crewAutoWord       = "auto — codeaf picks per task"
+	crewAnyRouteWord   = "any route · cheapest"
+	crewNoProviderWord = "no providers connected — /connect adds one"
+	crewNothingMatches = "nothing matches"
+	crewAllowFixWord   = "enter to allow it"
+	crewPickHint       = "type to filter"
+	crewProviderOff    = "provider off"
+	crewFreeRoutesWord = "free routes"
+	crewFreeRoutesWhy  = "rate-limited, may log prompts"
+	crewConnectChip    = "+"
+)
+
+// crewModelBases are the four answers the models row walks, in order.
+var crewModelBases = []string{"all", "open", "price", "custom"}
+
+// crewPanel is the whole of /crew. The zero value is closed.
+type crewPanel struct {
+	open bool
+
+	// back is the place /crew was asked for on, which esc stands back up; and
+	// backTab/backCursor are where the settings sheet was when its `seats` row
+	// opened this, so esc lands on that row rather than on the sheet's first tab.
+	back       page
+	backTab    int
+	backCursor int
+
+	// THE READING, taken when the panel opens and again after every write this
+	// panel or a shortcut makes ([crewPanel.read]). A draw never reads the disk.
+	pins      map[crewroute.Seat]config.CrewPin
+	usual     map[crewroute.Seat]string
+	usualSeen map[crewroute.Seat]bool
+	suggest   map[crewroute.Seat]string
+	rule      crewroute.Allowed
+	capUSD    float64
+	taskUSD   float64
+	free      bool
+	providers []config.CrewProvider
+	offers    []config.CrewOffer
+	gaps      []crewroute.Gap
+	log       router.CrewLog
+
+	view   crewView
+	cursor int
+
+	// step is the models row's position when the person has walked it onto
+	// `custom` and not yet ticked anything: nothing is written by landing
+	// there, so the row shows the step until they open the checklist or leave.
+	// -1 is "show the rule in force".
+	step int
+	// priceIn and priceOut are the ceilings the row offers when it is walked
+	// onto a price, remembered from the rule in force or the last one typed.
+	priceIn, priceOut float64
+	// edit is the hole being typed into on the main rows — the cap, or one of
+	// the two price ceilings — and nil when none is.
+	edit *crewHole
+
+	pick  *crewPick
+	check *crewCheck
+
+	// saved is the stop that took the last change, and savedAt when; undo is
+	// the rows as they stood before it. The tick and the `z undo` offer last
+	// [crewUndoFor] from savedAt.
+	saved   int
+	savedAt time.Time
+	undo    *config.CrewState
+	// refusal is the last write a writer refused, in its own words, shown under
+	// the rows until the next key.
+	refusal string
+
+	// owner maps each drawn line to the stop, list row or checklist line it
+	// belongs to, -1 for a line that answers to nothing; arrows are the cells of
+	// the models row's ‹ and ›, so a press on either walks it.
+	owner  []int
+	arrows [2]hudSpan
+	// arrowLine is the drawn line the arrows are on, -1 when not drawn.
+	arrowLine int
+
+	// chip is the providers row's position: a provider by its index in
+	// providers, or len(providers) for the `+` that opens /connect.
+	chip int
+	// chips are the cells of each chip on the drawn row, the `+` last, and
+	// chipLine the drawn line they are on, -1 when not drawn; folded is the
+	// row drawn as its count because the chips did not fit, when ←/→ have
+	// nothing to walk and space opens the list instead.
+	chips    []hudSpan
+	chipLine int
+	folded   bool
+	// prov is the providers list's cursor, and provSaved the line that took
+	// the last change there, which wears the tick while [crewPanel.live].
+	prov      int
+	provSaved int
+}
+
+// crewHole is one hole typed into on the main rows.
+type crewHole struct {
+	// stop is the row the hole is on; price is which ceiling — 0 in, 1 out —
+	// when the stop is the models row, and which limit — 0 daily, 1 per task —
+	// when it is the cap row.
+	stop  int
+	price int
+	box   editor
+}
+
+// crewPick is the seat list.
+type crewPick struct {
+	seat   crewroute.Seat
+	filter editor
+	// rows are what the list can show: `auto`, then every offer, the router's
+	// suggestion first. They are built once, when the list opens.
+	rows []crewPickRow
+	// hits are indexes into rows in rank order, and lines what is DRAWN — a
+	// hit, or one route of the hit whose routes are unfolded under it.
+	hits   []int
+	lines  []crewPickLine
+	cursor int
+	top    int
+	score  []int
+	// tier is each hit's match tier ([crewMatchTier]), which outranks score.
+	tier []int
+	// unfold is the model whose routes are showing, "" when none is.
+	unfold string
+	// refuse is the line whose pin the allowed models refused, and why: the
+	// next enter on it widens the rule and pins.
+	refuse    int
+	refuseWhy string
+}
+
+// crewPickRow is one row the seat list can show.
+type crewPickRow struct {
+	auto      bool
+	offer     config.CrewOffer
+	suggested bool
+	fields    []string
+}
+
+// crewPickLine is one drawn line of the seat list: the row, and which route
+// of it — -1 for the model itself, 0 for "any route", n for its nth route.
+type crewPickLine struct {
+	row   int
+	route int
+}
+
+// crewCheck is the custom checklist.
+//
+// IT IS MODELS ONLY. A provider is taken away on the providers row, where the
+// verdict is a set beside the rule; a `-provider` inside the rule would also
+// read as a vendor, and would be dropped the next time the models row was
+// walked onto a new base.
+type crewCheck struct {
+	filter editor
+	// lines are the models; hits index them.
+	lines  []crewCheckLine
+	hits   []int
+	cursor int
+	top    int
+}
+
+// crewCheckLine is one checklist line: an offer.
+type crewCheckLine struct {
+	offer *config.CrewOffer
+}
+
+func (p *crewPanel) close() { *p = crewPanel{} }
+
+// ── the reading ─────────────────────────────────────────────────────────────
+
+// read takes the profile's crew again: the pins, the rule and the cap, the
+// providers and what they reach, the day's log, and what the router would
+// pick for a seat nobody pinned. It is the ONE place the panel touches the
+// disk, called on open and after every write.
+func (p *crewPanel) read(dir string) {
+	p.pins = config.CrewPinsAt(dir)
+	p.rule = config.CrewAllowedAt(dir)
+	p.capUSD = config.CrewCapAt(dir)
+	p.taskUSD = config.CrewTaskCapAt(dir)
+	p.free = config.CrewFreeRoutesAt(dir)
+	p.providers = config.CrewProvidersAt(dir)
+	p.chip = min(p.chip, len(p.providers))
+	p.offers = config.CrewOffersAt(dir)
+	p.gaps = config.CrewGapsAt(dir)
+	p.log = config.CrewLogAt(dir)
+	p.suggest = map[crewroute.Seat]string{}
+	if d, err := crewroute.Decide(crewroute.Request{Class: crewroute.Other, Candidates: config.CrewCandidatesAt(dir)}); err == nil {
+		for _, seat := range crewroute.Seats {
+			p.suggest[seat] = d.Seat(seat).Model
+		}
+	}
+	p.usual, p.usualSeen = crewUsual(p.log, p.suggest)
+	crewReachableUsual(p.usual, p.usualSeen, p.suggest, p.offers)
+	if p.rule.Base == crewroute.BasePrice {
+		p.priceIn, p.priceOut = p.rule.MaxIn, p.rule.MaxOut
+	}
+	if p.priceIn == 0 && p.priceOut == 0 {
+		p.priceIn, p.priceOut = crewPriceIn, crewPriceOut
+	}
+}
+
+// crewUsual is what each seat USUALLY runs when nobody pinned it: the model
+// the recent tasks seated there most often, newest winning a tie — and, on a
+// profile with no history yet, what the router would seat now. The second
+// answer says which of the two it is, because "usually" is a claim about the
+// past that a fresh install cannot make.
+func crewUsual(log router.CrewLog, suggest map[crewroute.Seat]string) (map[crewroute.Seat]string, map[crewroute.Seat]bool) {
+	usual, seen := map[crewroute.Seat]string{}, map[crewroute.Seat]bool{}
+	for _, seat := range crewroute.Seats {
+		counts, best, top := map[string]int{}, "", 0
+		for _, task := range log.Recent {
+			if slicesHas(task.Record.Pinned, string(seat)) {
+				continue
+			}
+			model := crewroute.ShortModel(task.Record.Seats[string(seat)])
+			if model == "" {
+				continue
+			}
+			counts[model]++
+			if counts[model] > top {
+				best, top = model, counts[model]
+			}
+		}
+		if best != "" {
+			usual[seat], seen[seat] = best, true
+			continue
+		}
+		if model := crewroute.ShortModel(suggest[seat]); model != "" {
+			usual[seat] = model
+		}
+	}
+	return usual, seen
+}
+
+// crewReachableUsual keeps a seat's hint only where it names a model the seat
+// could be given TODAY.
+//
+// "USUALLY" AND "LIKELY" ARE CLAIMS ABOUT NOW, not only about the past: a model
+// the recent tasks ran whose route has since been quarantined, whose provider
+// was turned off, which the allowed rule no longer admits, or which reached
+// the seat only through a free pool now switched off, gives way to what the
+// router would pick now; and where that is not reachable either, the hint is
+// empty, which the seat reads as "nothing allowed can sit this seat". An offer
+// is reachable when the rule admits it on a provider that is on — the offers
+// themselves already left out unhealthy and switched-off free routes
+// ([config.CrewOffersAt]).
+func crewReachableUsual(usual map[crewroute.Seat]string, seen map[crewroute.Seat]bool, suggest map[crewroute.Seat]string, offers []config.CrewOffer) {
+	reachable := map[string]bool{}
+	for _, offer := range offers {
+		if offer.Allowed && offer.Served {
+			reachable[crewroute.ShortModel(offer.Model.ID)] = true
+		}
+	}
+	for _, seat := range crewroute.Seats {
+		if model := usual[seat]; model != "" && reachable[model] {
+			continue
+		}
+		usual[seat], seen[seat] = "", false
+		if model := crewroute.ShortModel(suggest[seat]); reachable[model] {
+			usual[seat] = model
+		}
+	}
+}
+
+// slicesHas says whether a list of words holds one.
+func slicesHas(words []string, word string) bool {
+	for _, w := range words {
+		if w == word {
+			return true
+		}
+	}
+	return false
+}
+
+// modelStep is the models row's position: the step the person walked it to,
+// or the rule in force.
+func (p *crewPanel) modelStep() int {
+	if p.step >= 0 {
+		return p.step
+	}
+	switch {
+	case p.rule.Custom():
+		return 3
+	case p.rule.Base == crewroute.BasePrice:
+		return 2
+	case p.rule.Base == crewroute.BaseOpen:
+		return 1
+	}
+	return 0
+}
+
+// countFor is how many reachable models one step of the models row admits —
+// the dim figure beside it, so walking the row is a way of reading what each
+// answer would leave. A model only a provider turned off serves is not
+// counted on any step: it is not one a seat can be picked from.
+func (p *crewPanel) countFor(step int) int {
+	var rule crewroute.Allowed
+	switch step {
+	case 0:
+		rule = crewroute.Allowed{Base: crewroute.BaseAll}
+	case 1:
+		rule = crewroute.Allowed{Base: crewroute.BaseOpen}
+	case 2:
+		rule = crewroute.Allowed{Base: crewroute.BasePrice, MaxIn: p.priceIn, MaxOut: p.priceOut}
+	default:
+		n := 0
+		for _, offer := range p.offers {
+			if offer.Allowed {
+				n++
+			}
+		}
+		return n
+	}
+	n := 0
+	for _, offer := range p.offers {
+		if offer.Served && rule.AdmitsModel(offer.Model) {
+			n++
+		}
+	}
+	return n
+}
+
+// providersOn is how many connected providers are on.
+func (p *crewPanel) providersOn() int {
+	n := 0
+	for _, provider := range p.providers {
+		if provider.On {
+			n++
+		}
+	}
+	return n
+}
+
+// live is whether the last change still wears its tick and offers its undo.
+func (p *crewPanel) live(now time.Time) bool {
+	return p.saved >= 0 && !p.savedAt.IsZero() && now.Sub(p.savedAt) < crewUndoFor
+}
+
+// ── the app's side: opening, writing, undoing ───────────────────────────────
+
+// openCrew is the panel's one door. A place cannot draw an overlay, so asked
+// from one it steps off onto the conversation first and remembers where it
+// was, which is where esc goes back to.
+func (a *app) openCrew() {
+	if a.hosted() {
+		a.note(a.remoteProfileWord("the crew"))
+		return
+	}
+	back, tab, cursor := a.page, 0, 0
+	if a.at(pageSettings) {
+		tab, cursor = a.sheet.tab, a.sheet.cursor
+	}
+	if a.pageShowing() {
+		a.showPage(pageNone)
+	}
+	a.closeLists()
+	a.dismissWelcome()
+	a.crewUI = crewPanel{open: true, back: back, backTab: tab, backCursor: cursor, saved: -1, step: -1, chipLine: -1, provSaved: -1}
+	a.crewUI.read(a.profileDir)
+	a.touch()
+}
+
+// closeCrew is esc on the main panel: the panel goes, and a place it was
+// opened from stands back up where it was left.
+func (a *app) closeCrew() tea.Cmd {
+	back, tab, cursor := a.crewUI.back, a.crewUI.backTab, a.crewUI.backCursor
+	a.crewUI.close()
+	a.touch()
+	if placeRegistry[back] == nil {
+		return nil
+	}
+	cmd := a.showPage(back)
+	if a.at(pageSettings) {
+		a.sheet.tab = tab
+		a.sheet.build()
+		a.sheet.cursor = a.sheet.clampCursor(cursor)
+	}
+	return cmd
+}
+
+// crewRefreshed is the tail every crew write shares, from this panel or from
+// a shortcut: an open panel re-reads, an open settings sheet rebuilds.
+func (a *app) crewRefreshed() {
+	if a.crewUI.open {
+		a.crewUI.read(a.profileDir)
+	}
+	a.refreshSettings()
+}
+
+// crewWrite is every change the panel makes: the rows as they stood are kept
+// for the undo, the write goes through the writer it names, and a refusal is
+// shown in the writer's own words and changes nothing. It answers the tick
+// that takes the tick and the undo offer back down.
+func (a *app) crewWrite(stop int, write func(dir string) error) tea.Cmd {
+	p := &a.crewUI
+	before := config.CrewStateAt(a.profileDir)
+	if err := write(a.profileDir); err != nil {
+		p.refusal = err.Error()
+		a.touch()
+		return nil
+	}
+	p.refusal = ""
+	p.undo = &before
+	p.saved, p.savedAt = stop, a.now()
+	a.crewRefreshed()
+	a.touch()
+	return surfaceTick(crewUndoFor, func(time.Time) tea.Msg { return crewUndoMsg{} })
+}
+
+// crewUndoMsg is the undo window closing: one repaint, so the tick and the
+// offer come down.
+type crewUndoMsg struct{}
+
+// crewUndo is `z`: the rows put back as they stood before the last change.
+func (a *app) crewUndo() {
+	p := &a.crewUI
+	if p.undo == nil || !p.live(a.now()) {
+		return
+	}
+	if err := config.RestoreCrewState(a.profileDir, *p.undo); err != nil {
+		p.refusal = err.Error()
+		return
+	}
+	p.undo, p.saved, p.step = nil, -1, -1
+	a.crewRefreshed()
+}
+
+// ── keys ────────────────────────────────────────────────────────────────────
+
+// crewKey routes one keypress while the panel owns the keyboard.
+func (a *app) crewKey(msg tea.KeyPressMsg) tea.Cmd {
+	p := &a.crewUI
+	defer a.touch()
+	switch p.view {
+	case crewPicking:
+		return a.crewPickKey(msg)
+	case crewChecking:
+		return a.crewCheckKey(msg)
+	case crewProviding:
+		return a.crewProvKey(msg)
+	case crewKeys:
+		if k := msg.String(); k == "esc" || k == "?" || k == "q" {
+			p.view = crewMain
+		}
+		return nil
+	}
+	if p.edit != nil {
+		return a.crewHoleKey(msg)
+	}
+	key := msg.String()
+	// A REFUSAL IS READ ONCE. It stays until the next key, which is the moment
+	// the person has read it and moved on.
+	p.refusal = ""
+	switch key {
+	case "esc":
+		return a.closeCrew()
+	case "?":
+		p.view = crewKeys
+	case "up", "k", "ctrl+p":
+		a.crewMove(-1)
+	case "down", "j", "ctrl+n":
+		a.crewMove(1)
+	case "home":
+		a.crewMove(-crewStops)
+	case "end":
+		a.crewMove(crewStops)
+	case "z":
+		a.crewUndo()
+	case "left", "h":
+		if p.cursor == crewModels {
+			return a.crewStepModels(-1)
+		}
+		if p.cursor == crewProviders && !p.folded {
+			p.chip = max(0, p.chip-1)
+		}
+	case "right", "l":
+		if p.cursor == crewModels {
+			return a.crewStepModels(1)
+		}
+		if p.cursor == crewProviders && !p.folded {
+			p.chip = min(len(p.providers), p.chip+1)
+		}
+		if p.cursor < crewModels {
+			a.crewOpenPick(crewroute.Seats[p.cursor])
+		}
+	case " ", "space":
+		if p.cursor == crewProviders {
+			return a.crewSpaceChip()
+		}
+		return a.crewEnter()
+	case "enter":
+		return a.crewEnter()
+	case "backspace", "delete":
+		if p.cursor == crewCap {
+			p.edit = &crewHole{stop: crewCap}
+			p.edit.box.setText(crewDollarsWord(p.capUSD))
+			p.edit.box.deleteBackward()
+		}
+	default:
+		if text := msg.Key().Text; p.cursor == crewCap && crewNumeric(text) {
+			// A DIGIT ON THE CAP ROW IS THE CAP BEING TYPED. The hole opens on
+			// the digit rather than on the old figure, because a person typing a
+			// number is saying a new one.
+			p.edit = &crewHole{stop: crewCap}
+			p.edit.box.insert(text)
+		}
+	}
+	return nil
+}
+
+// crewMove walks the six stops, clamping at both ends. Leaving the models
+// row lets go of a step nothing was written for.
+func (a *app) crewMove(delta int) {
+	p := &a.crewUI
+	p.cursor = moveCursor(p.cursor, delta, crewStops)
+	if p.cursor != crewModels {
+		p.step = -1
+	}
+}
+
+// crewEnter is enter on a main row — the one verb.
+func (a *app) crewEnter() tea.Cmd {
+	p := &a.crewUI
+	switch {
+	case p.cursor < crewModels:
+		a.crewOpenPick(crewroute.Seats[p.cursor])
+	case p.cursor == crewModels:
+		switch p.modelStep() {
+		case 2:
+			a.crewEditPrice(0)
+		case 3:
+			a.crewOpenCheck()
+		default:
+			return a.crewStepModels(1)
+		}
+	case p.cursor == crewProviders:
+		if !p.folded && p.chip == len(p.providers) {
+			return a.crewConnect()
+		}
+		a.crewOpenProv()
+	case p.cursor == crewCap:
+		p.edit = &crewHole{stop: crewCap}
+		if p.capUSD > 0 {
+			p.edit.box.setText(crewDollarsWord(p.capUSD))
+		}
+	}
+	return nil
+}
+
+// ── the providers row ───────────────────────────────────────────────────────
+
+// crewSpaceChip is space on the providers row: the chip under the cursor
+// turned off or on, or /connect on the `+`. A row folded to its count has no
+// chip under the cursor, so space there opens the list, where every provider
+// is a line of its own.
+func (a *app) crewSpaceChip() tea.Cmd {
+	p := &a.crewUI
+	switch {
+	case p.folded:
+		a.crewOpenProv()
+		return nil
+	case p.chip >= len(p.providers):
+		return a.crewConnect()
+	}
+	return a.crewToggleProvider(p.chip)
+}
+
+// crewToggleProvider turns one provider off or on, through the writer the
+// shortcut uses — so the last provider on is refused here in the writer's own
+// words ([config.ErrCrewLastProvider]), under the rows, and nothing changes.
+func (a *app) crewToggleProvider(at int) tea.Cmd {
+	p := &a.crewUI
+	if at < 0 || at >= len(p.providers) {
+		return nil
+	}
+	provider := p.providers[at]
+	cmd := a.crewWrite(crewProviders, func(dir string) error { return config.SetCrewProviderOn(dir, provider.ID, !provider.On) })
+	if p.refusal == "" && p.view == crewProviding {
+		p.provSaved = at
+	}
+	return cmd
+}
+
+// crewConnect is the `+`: the panel goes and /connect opens in its place —
+// the one door a provider is added through, never a second copy of it here.
+// A provider connected there is on the next time this panel is read, and
+// backing out of /connect comes back here, to the providers row
+// ([app.dismissConnect]), because that is where the person asked from.
+func (a *app) crewConnect() tea.Cmd {
+	p := &a.crewUI
+	back := &crewReturn{back: p.back, tab: p.backTab, cursor: p.backCursor}
+	p.close()
+	a.openConnect()
+	if a.connPanel.open {
+		a.connPanel.crew = back
+	}
+	a.touch()
+	return nil
+}
+
+// crewReturn is where the crew panel stood when its `+` handed over to
+// /connect: the place it was opened from, which its own esc goes back to.
+type crewReturn struct {
+	back        page
+	tab, cursor int
+}
+
+// dismissConnect is backing out of /connect — esc on the list, or a press off
+// it. Opened from the crew panel's `+`, it stands the crew panel back up on
+// the providers row, cursor on the `+`; opened any other way it just closes.
+func (a *app) dismissConnect() {
+	back := a.connPanel.crew
+	a.connPanel.close()
+	if back == nil {
+		return
+	}
+	a.crewUI = crewPanel{open: true, back: back.back, backTab: back.tab, backCursor: back.cursor,
+		saved: -1, step: -1, chipLine: -1, provSaved: -1, cursor: crewProviders}
+	a.crewUI.read(a.profileDir)
+	a.crewUI.chip = len(a.crewUI.providers)
+}
+
+// crewOpenProv opens the providers list on the provider the row's cursor was
+// on.
+func (a *app) crewOpenProv() {
+	p := &a.crewUI
+	p.view, p.prov, p.provSaved = crewProviding, min(p.chip, max(0, len(p.providers)-1)), -1
+}
+
+// crewProvLines is how many lines the providers list has: a provider a line
+// and the free-routes switch last, which is the list's and never the row's —
+// a free pool is a way a provider can be reached, and the list is where how
+// each one is reached is said.
+func (p *crewPanel) crewProvLines() int {
+	if len(p.providers) == 0 {
+		return 0
+	}
+	return len(p.providers) + 1
+}
+
+// crewProvKey is a key on the providers list. There is no filter: a
+// person has a handful of connections, and every letter is free to mean
+// what it means on the rows — `z` is the undo here too.
+func (a *app) crewProvKey(msg tea.KeyPressMsg) tea.Cmd {
+	p := &a.crewUI
+	p.refusal = ""
+	switch msg.String() {
+	case "esc", "q":
+		p.view, p.cursor = crewMain, crewProviders
+		p.chip = min(p.prov, max(0, len(p.providers)-1))
+	case "up", "k", "ctrl+p":
+		p.prov = moveCursor(p.prov, -1, p.crewProvLines())
+	case "down", "j", "ctrl+n":
+		p.prov = moveCursor(p.prov, 1, p.crewProvLines())
+	case "home":
+		p.prov = 0
+	case "end":
+		p.prov = max(0, p.crewProvLines()-1)
+	case "z":
+		a.crewUndo()
+	case "enter", " ", "space":
+		return a.crewProvToggle()
+	}
+	return nil
+}
+
+// crewProvToggle is space or enter on a line of the providers list: a
+// provider turned off or on, or the free routes.
+func (a *app) crewProvToggle() tea.Cmd {
+	p := &a.crewUI
+	if p.prov == len(p.providers) && len(p.providers) > 0 {
+		free := !p.free
+		cmd := a.crewWrite(crewProviders, func(dir string) error { return config.SetCrewFreeRoutes(dir, free) })
+		if p.refusal == "" {
+			p.provSaved = p.prov
+		}
+		return cmd
+	}
+	return a.crewToggleProvider(p.prov)
+}
+
+// crewStepModels walks the models row one answer, and writes it: `all`,
+// `open` and a price are rules and are written as they are stepped onto;
+// `custom` is a list nobody has ticked yet, so landing on it writes nothing
+// and enter opens the checklist.
+func (a *app) crewStepModels(delta int) tea.Cmd {
+	p := &a.crewUI
+	next := p.modelStep() + delta
+	if next < 0 || next >= len(crewModelBases) {
+		return nil
+	}
+	if next == 3 {
+		p.step = 3
+		if p.rule.Custom() {
+			p.step = -1
+		}
+		return nil
+	}
+	p.step = -1
+	var rule crewroute.Allowed
+	switch next {
+	case 0:
+		rule = p.rule.Rebased(crewroute.BaseAll, 0, 0)
+	case 1:
+		rule = p.rule.Rebased(crewroute.BaseOpen, 0, 0)
+	case 2:
+		rule = p.rule.Rebased(crewroute.BasePrice, p.priceIn, p.priceOut)
+	}
+	return a.crewWrite(crewModels, func(dir string) error { return config.SetCrewAllowedRule(dir, rule) })
+}
+
+// crewEditPrice opens one of the two ceiling holes on the models row.
+func (a *app) crewEditPrice(which int) {
+	p := &a.crewUI
+	p.edit = &crewHole{stop: crewModels, price: which}
+	value := p.priceIn
+	if which == 1 {
+		value = p.priceOut
+	}
+	p.edit.box.setText(strconv.FormatFloat(value, 'f', -1, 64))
+}
+
+// crewHoleKey is a key while a hole on the main rows is being typed into.
+//
+// ENTER KEEPS, ESC LEAVES IT AS IT WAS. On the price row enter on the first
+// ceiling moves to the second — tab does too — and enter on the second writes
+// both, because a price rule is one rule with two numbers in it.
+func (a *app) crewHoleKey(msg tea.KeyPressMsg) tea.Cmd {
+	p := &a.crewUI
+	hole := p.edit
+	switch key := msg.String(); key {
+	case "esc":
+		p.edit = nil
+		return nil
+	case "tab":
+		if hole.stop == crewModels {
+			a.crewKeepPriceHole()
+			a.crewEditPrice(1 - hole.price)
+		}
+		if hole.stop == crewCap {
+			a.crewEditCap(1 - hole.price)
+		}
+		return nil
+	case "enter":
+		if hole.stop == crewCap {
+			p.edit = nil
+			raw := strings.TrimSpace(hole.box.String())
+			if hole.price == 1 {
+				// AN EMPTIED PER-TASK HOLE IS THE DEFAULT: a task always has a limit.
+				if raw == "" {
+					raw = strconv.FormatFloat(config.CrewTaskCapDefault, 'f', -1, 64)
+				}
+				return a.crewWrite(crewCap, func(dir string) error { return config.SetCrewTaskCap(dir, raw) })
+			}
+			if raw == "" {
+				raw = "none"
+			}
+			return a.crewWrite(crewCap, func(dir string) error { return config.SetCrewCap(dir, raw) })
+		}
+		if !a.crewKeepPriceHole() {
+			return nil
+		}
+		if hole.price == 0 {
+			a.crewEditPrice(1)
+			return nil
+		}
+		p.edit = nil
+		rule := p.rule.Rebased(crewroute.BasePrice, p.priceIn, p.priceOut)
+		return a.crewWrite(crewModels, func(dir string) error { return config.SetCrewAllowedRule(dir, rule) })
+	case "backspace":
+		hole.box.deleteBackward()
+	case "ctrl+u":
+		hole.box.killToStart()
+	case "ctrl+k":
+		hole.box.killToEnd()
+	default:
+		if text := msg.Key().Text; crewNumeric(text) {
+			hole.box.insert(text)
+		}
+	}
+	return nil
+}
+
+// crewEditCap opens one of the cap row's two holes: 0 the daily cap, 1 the
+// per-task limit, holding the figure in force.
+func (a *app) crewEditCap(which int) {
+	p := &a.crewUI
+	p.edit = &crewHole{stop: crewCap, price: which}
+	if which == 1 {
+		p.edit.box.setText(crewDollarsWord(p.taskUSD))
+		return
+	}
+	p.edit.box.setText(crewDollarsWord(p.capUSD))
+}
+
+// crewKeepPriceHole reads the price hole being typed into back into the
+// ceiling it is for, and refuses — out loud, under the rows — a figure that is
+// not a number of dollars.
+func (a *app) crewKeepPriceHole() bool {
+	p := &a.crewUI
+	raw := strings.TrimPrefix(strings.TrimSpace(p.edit.box.String()), "$")
+	value, err := strconv.ParseFloat(raw, 64)
+	if err != nil || value < 0 {
+		p.refusal = "a ceiling is dollars per million tokens — a number, like 1 or 0.5"
+		return false
+	}
+	if p.edit.price == 0 {
+		p.priceIn = value
+	} else {
+		p.priceOut = value
+	}
+	return true
+}
+
+// crewNumeric is whether a typed key belongs in a dollar hole.
+func crewNumeric(text string) bool {
+	if text == "" {
+		return false
+	}
+	for _, r := range text {
+		if (r < '0' || r > '9') && r != '.' && r != '$' {
+			return false
+		}
+	}
+	return true
+}
+
+// crewDollarsWord is a cap as the hole holds it: the plain figure.
+func crewDollarsWord(usd float64) string {
+	if usd <= 0 {
+		return ""
+	}
+	return strconv.FormatFloat(usd, 'f', -1, 64)
+}
+
+// ── the seat list ───────────────────────────────────────────────────────────
+
+// crewOpenPick opens the list one seat is pinned from.
+//
+// IT OPENS ON `auto`, NOT ON THE PIN. The pin is marked where it stands, and the
+// cursor on the first row is what makes unpinning two presses — the second
+// verb this panel refuses to have.
+func (a *app) crewOpenPick(seat crewroute.Seat) {
+	p := &a.crewUI
+	pick := &crewPick{seat: seat, refuse: -1}
+	pick.rows = append(pick.rows, crewPickRow{auto: true, fields: []string{"auto", "codeaf picks per task"}})
+	suggested := crewroute.Lineage(p.suggest[seat])
+	var rest []crewPickRow
+	for _, offer := range p.offers {
+		row := crewPickRow{offer: offer, fields: []string{offer.Model.ID, crewroute.ShortModel(offer.Model.ID)}}
+		for _, r := range offer.Routes {
+			row.fields = append(row.fields, r.Provider)
+		}
+		if suggested != "" && crewroute.Lineage(offer.Model.ID) == suggested {
+			row.suggested = true
+			pick.rows = append(pick.rows, row)
+			continue
+		}
+		rest = append(rest, row)
+	}
+	// ALLOWED FIRST, THEN BY NAME. A model the rule leaves out is still a row
+	// — the list says why rather than hiding it — but it is not what a person
+	// reading down for a model to pin is looking for first.
+	sort.SliceStable(rest, func(i, j int) bool {
+		if rest[i].offer.Allowed != rest[j].offer.Allowed {
+			return rest[i].offer.Allowed
+		}
+		return rest[i].offer.Model.ID < rest[j].offer.Model.ID
+	})
+	pick.rows = append(pick.rows, rest...)
+	pick.score = make([]int, len(pick.rows))
+	pick.rank()
+	p.pick, p.view = pick, crewPicking
+}
+
+// rank narrows the list to the filter — every term must match, scored by the
+// matcher every picker shares — and lays the drawn lines out again.
+//
+// A MODEL NAME IS TYPED FROM ITS FRONT. The shared matcher takes any
+// subsequence, which is right for a command palette and wrong for a list of
+// model ids: `kim` finds kimi-k3, and also gro-k-IM-agine and K-rea-2-medIum,
+// which nobody typing three letters of a name meant. So the matcher decides
+// only WHETHER a row matches, and how strongly within its tier; the tier
+// decides the order first ([crewMatchTier]) — a prefix of the id or the name,
+// then a prefix of a word inside it, then anywhere inside it, then a
+// subsequence — and a subsequence-only row is shown only when nothing matched
+// better, because then it is the best the list has.
+func (k *crewPick) rank() {
+	query := strings.TrimSpace(k.filter.String())
+	words := strings.Fields(strings.ToLower(query))
+	ft := fuzzyTerms(words)
+	k.hits = k.hits[:0]
+	if len(k.tier) != len(k.rows) {
+		k.tier = make([]int, len(k.rows))
+	}
+	strong := false
+	for i, row := range k.rows {
+		if len(ft) == 0 {
+			k.hits = append(k.hits, i)
+			continue
+		}
+		total, hit := fuzzy.ScoreFields(row.fields, ft)
+		if !hit {
+			continue
+		}
+		k.score[i], k.tier[i] = total, crewMatchTier(row.fields, words)
+		strong = strong || k.tier[i] < crewTierSubsequence
+		k.hits = append(k.hits, i)
+	}
+	if len(ft) > 0 {
+		if strong {
+			kept := k.hits[:0]
+			for _, at := range k.hits {
+				if k.tier[at] < crewTierSubsequence {
+					kept = append(kept, at)
+				}
+			}
+			k.hits = kept
+		}
+		sort.SliceStable(k.hits, func(a, b int) bool {
+			ta, tb := k.tier[k.hits[a]], k.tier[k.hits[b]]
+			if ta != tb {
+				return ta < tb
+			}
+			return k.score[k.hits[a]] > k.score[k.hits[b]]
+		})
+	}
+	k.cursor, k.top, k.refuse = 0, 0, -1
+	k.relist()
+}
+
+// The seat list's match tiers, strongest first.
+const (
+	// crewTierPrefix is a field the word begins: `kim` of kimi-k3, `deep` of
+	// deepseek/deepseek-v4-flash.
+	crewTierPrefix = iota
+	// crewTierWord is a word inside a field the word begins, after a `/`, a
+	// `-`, a `.` or a space: `flash` of glm-5.3-flash.
+	crewTierWord
+	// crewTierInside is the word anywhere inside a field.
+	crewTierInside
+	// crewTierSubsequence is the word's letters in order, with gaps — the
+	// matcher's own verdict and nothing stronger.
+	crewTierSubsequence
+)
+
+// crewMatchTier is how strongly a row matches every typed word: the weakest
+// of the words' own tiers, each word's the strongest over the row's fields.
+func crewMatchTier(fields, words []string) int {
+	tier := crewTierPrefix
+	for _, word := range words {
+		best := crewTierSubsequence
+		for _, field := range fields {
+			field = strings.ToLower(field)
+			switch {
+			case strings.HasPrefix(field, word):
+				best = crewTierPrefix
+			case crewWordPrefix(field, word):
+				best = min(best, crewTierWord)
+			case strings.Contains(field, word):
+				best = min(best, crewTierInside)
+			}
+		}
+		tier = max(tier, best)
+	}
+	return tier
+}
+
+// crewWordPrefix is whether a word begins some word inside a field.
+func crewWordPrefix(field, word string) bool {
+	for i := 1; i < len(field); i++ {
+		switch field[i-1] {
+		case '/', '-', '.', ' ', '_', ':':
+			if strings.HasPrefix(field[i:], word) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// relist lays out the drawn lines: every hit, and the routes of the unfolded
+// one under it.
+func (k *crewPick) relist() {
+	k.lines = k.lines[:0]
+	for _, at := range k.hits {
+		k.lines = append(k.lines, crewPickLine{row: at, route: -1})
+		row := k.rows[at]
+		if row.auto || row.offer.Model.ID != k.unfold {
+			continue
+		}
+		k.lines = append(k.lines, crewPickLine{row: at, route: 0})
+		for n := range row.offer.Routes {
+			k.lines = append(k.lines, crewPickLine{row: at, route: n + 1})
+		}
+	}
+	if k.cursor >= len(k.lines) {
+		k.cursor = max(0, len(k.lines)-1)
+	}
+}
+
+func (k *crewPick) move(delta int) {
+	k.cursor = moveCursor(k.cursor, delta, len(k.lines))
+	k.refuse = -1
+	k.top = listTop(k.cursor, k.top, len(k.lines), crewListRows)
+}
+
+// crewPickKey is a key on the seat list.
+func (a *app) crewPickKey(msg tea.KeyPressMsg) tea.Cmd {
+	p := &a.crewUI
+	k := p.pick
+	switch msg.String() {
+	case "esc":
+		// BACK ONE LEVEL: a refusal first, then a folded route list, then the
+		// list itself — the key never takes two steps at once.
+		switch {
+		case k.refuse >= 0:
+			k.refuse = -1
+		case k.unfold != "":
+			a.crewFold(k)
+		default:
+			p.pick, p.view = nil, crewMain
+		}
+		return nil
+	case "enter":
+		return a.crewPickEnter()
+	case "right":
+		if at := k.cursor; at < len(k.lines) {
+			line := k.lines[at]
+			if row := k.rows[line.row]; !row.auto && line.route < 0 && len(row.offer.Routes) > 0 {
+				k.unfold = row.offer.Model.ID
+				k.relist()
+				return nil
+			}
+		}
+	case "left":
+		if k.unfold != "" {
+			a.crewFold(k)
+			return nil
+		}
+	}
+	listNavigate(msg, &k.filter, k.move, k.rank, crewListRows)
+	return nil
+}
+
+// crewFold closes the route list and puts the cursor back on its model.
+func (a *app) crewFold(k *crewPick) {
+	model := k.unfold
+	k.unfold = ""
+	k.refuse = -1
+	k.relist()
+	for i, line := range k.lines {
+		if row := k.rows[line.row]; !row.auto && row.offer.Model.ID == model {
+			k.cursor = i
+		}
+	}
+	k.top = listTop(k.cursor, k.top, len(k.lines), crewListRows)
+}
+
+// crewPickEnter is enter on the seat list: auto unpins, a model pins, a route
+// pins that model to that provider — and a pin the allowed models refuse is
+// answered on its own row, with the one key that lets it in.
+func (a *app) crewPickEnter() tea.Cmd {
+	p := &a.crewUI
+	k := p.pick
+	if k.cursor >= len(k.lines) {
+		return nil
+	}
+	line := k.lines[k.cursor]
+	row := k.rows[line.row]
+	seat := k.seat
+	stop := crewSeatStop(seat)
+	done := func(cmd tea.Cmd) tea.Cmd {
+		if p.refusal == "" {
+			p.pick, p.view, p.cursor = nil, crewMain, stop
+		}
+		return cmd
+	}
+	if row.auto {
+		return done(a.crewWrite(stop, func(dir string) error { return config.ClearCrewPin(dir, seat) }))
+	}
+	raw := row.offer.Model.ID
+	provider := ""
+	if line.route > 0 && line.route-1 < len(row.offer.Routes) {
+		route := row.offer.Routes[line.route-1]
+		provider = route.Provider
+		if route.Kind == crewroute.Free && !crewroute.IsFree(raw) {
+			// THE FREE POOL IS THE CHOICE: the pin names it, or it would run on
+			// the paid route of the same provider.
+			raw += ":free"
+		}
+		raw += "@" + provider
+	}
+	if k.refuse == k.cursor {
+		// THE SECOND ENTER IS THE FIX: the rule is widened by exactly this model
+		// — and this provider, where it was the provider the rule left out — and
+		// the pin is written in the same breath, so the undo takes both back.
+		rule := p.rule
+		if !rule.AdmitsModel(row.offer.Model) {
+			rule, _ = rule.Toggled(row.offer.Model, true)
+		}
+		if provider != "" && !rule.AdmitsRoute(provider) {
+			rule = rule.RouteToggled(provider, true)
+		}
+		return done(a.crewWrite(stop, func(dir string) error {
+			if err := config.SetCrewAllowedRule(dir, rule); err != nil {
+				return err
+			}
+			return config.SetCrewPin(dir, seat, raw)
+		}))
+	}
+	pin, _, err := config.ParseCrewPin(raw)
+	if err == nil {
+		err = config.CrewPinAllowed(a.profileDir, pin)
+	}
+	if err != nil && crewWidenable(p.rule, row.offer, provider) {
+		k.refuse, k.refuseWhy = k.cursor, crewRefusalWord(p.rule, row.offer, provider)
+		return nil
+	}
+	return done(a.crewWrite(stop, func(dir string) error { return config.SetCrewPin(dir, seat, raw) }))
+}
+
+// crewWidenable is whether the allowed rule is what refused this pin — the one
+// refusal the panel can fix on the spot. A provider that is not connected is
+// not the rule's to fix, and its refusal is shown as the writer words it.
+func crewWidenable(rule crewroute.Allowed, offer config.CrewOffer, provider string) bool {
+	if !rule.AdmitsModel(offer.Model) {
+		return true
+	}
+	return provider != "" && !rule.AdmitsRoute(provider)
+}
+
+// crewRefusalWord is the refusal under a row the allowed models leave out.
+func crewRefusalWord(rule crewroute.Allowed, offer config.CrewOffer, provider string) string {
+	name := crewroute.ShortModel(offer.Model.ID)
+	if rule.AdmitsModel(offer.Model) && provider != "" {
+		return provider + " is a provider your allowed models leave out (" + rule.String() + ") — " + crewAllowFixWord
+	}
+	return name + " is not in your allowed models (" + rule.String() + ") — " + crewAllowFixWord
+}
+
+// crewSeatStop is a seat's row on the main panel.
+func crewSeatStop(seat crewroute.Seat) int {
+	for i, s := range crewroute.Seats {
+		if s == seat {
+			return i
+		}
+	}
+	return 0
+}
+
+// ── the custom checklist ────────────────────────────────────────────────────
+
+// crewOpenCheck opens the checklist: every model a connected provider
+// reaches, each ticked where the rule admits it.
+func (a *app) crewOpenCheck() {
+	p := &a.crewUI
+	check := &crewCheck{}
+	for i := range p.offers {
+		check.lines = append(check.lines, crewCheckLine{offer: &p.offers[i]})
+	}
+	check.rank()
+	p.check, p.view, p.step = check, crewChecking, -1
+}
+
+// rank narrows the checklist to the filter, in its own order: a checklist is
+// read down, and one that reordered itself under a tick would move the row a
+// person had just pressed.
+func (c *crewCheck) rank() {
+	ft := fuzzyTerms(strings.Fields(strings.ToLower(c.filter.String())))
+	c.hits = c.hits[:0]
+	for i, line := range c.lines {
+		if len(ft) > 0 {
+			fields := []string{line.offer.Model.ID, crewroute.ShortModel(line.offer.Model.ID)}
+			if _, hit := fuzzy.ScoreFields(fields, ft); !hit {
+				continue
+			}
+		}
+		c.hits = append(c.hits, i)
+	}
+	c.cursor, c.top = 0, 0
+}
+
+func (c *crewCheck) move(delta int) {
+	c.cursor = moveCursor(c.cursor, delta, len(c.hits))
+	c.top = listTop(c.cursor, c.top, len(c.hits), crewListRows)
+}
+
+// ticked is whether one checklist line is admitted by the rule in force.
+func (p *crewPanel) ticked(line crewCheckLine) bool {
+	return p.rule.AdmitsModel(line.offer.Model)
+}
+
+// crewCheckKey is a key on the checklist. Space and enter tick; every other
+// printable key is the filter.
+func (a *app) crewCheckKey(msg tea.KeyPressMsg) tea.Cmd {
+	p := &a.crewUI
+	c := p.check
+	p.refusal = ""
+	switch msg.String() {
+	case "esc":
+		p.check, p.view = nil, crewMain
+		return nil
+	case "enter", " ", "space":
+		return a.crewTick()
+	}
+	listNavigate(msg, &c.filter, c.move, c.rank, crewListRows)
+	return nil
+}
+
+// crewTick flips the line under the cursor, in the shortest rule that says it
+// ([crewroute.Allowed.Toggled]).
+func (a *app) crewTick() tea.Cmd {
+	p := &a.crewUI
+	c := p.check
+	if c.cursor >= len(c.hits) {
+		return nil
+	}
+	line := c.lines[c.hits[c.cursor]]
+	rule, ok := p.rule.Toggled(line.offer.Model, !p.ticked(line))
+	if !ok {
+		p.refusal = "a list keeps one model at least — tick another before this one"
+		return nil
+	}
+	return a.crewWrite(crewModels, func(dir string) error { return config.SetCrewAllowedRule(dir, rule) })
+}
+
+// ── drawing ─────────────────────────────────────────────────────────────────
+
+// crewHeight is how many lines the panel wants: its rows and the frame's two
+// edges. The overlay's own clamp ([app.overlayHeight]) keeps the status line
+// and the box on a short terminal, and the draw windows the rows into what
+// is left.
+func (a *app) crewHeight(width int) int {
+	if !a.crewUI.open {
+		return 0
+	}
+	rows, _ := a.crewRows(width)
+	return len(rows) + 2
+}
+
+// crewDraw is the panel's block, exactly n lines.
+func (a *app) crewDraw(width, n, hover int) []string {
+	p := &a.crewUI
+	if n <= 0 || !p.open {
+		return nil
+	}
+	// The pointer's line counts from the block's first line, which is the top
+	// edge; the rows count from the line under it.
+	rowHover := -1
+	if hover > 0 {
+		rowHover = hover - 1
+	}
+	rows, owner := a.crewRowsHover(width, rowHover)
+	room := n - 2
+	if room < 1 {
+		// A FRAME WITH NO ROOM FOR A ROW DRAWS THE ROWS BARE: two edges and
+		// nothing between them say less than one row alone.
+		room = n
+		rows, owner = crewWindow(rows, owner, p.focusLine(owner), room)
+		p.owner = owner
+		p.arrowLine = crewArrowLine(owner, p, crewModels)
+		p.chipLine = crewArrowLine(owner, p, crewProviders)
+		return crewPad(rows, n)
+	}
+	rows, owner = crewWindow(rows, owner, p.focusLine(owner), room)
+	title, keys := a.crewEdges()
+	aside := a.pal.dim("esc")
+	// THE UNDO IS OFFERED WHERE `z` MEANS IT: on the six rows and the providers
+	// list, which has no filter. In a filtered list the letter is the filter's,
+	// and in a hole it is nothing, so an offer drawn there would be a key that
+	// does something else.
+	keysAside := ""
+	if (p.view == crewMain || p.view == crewProviding) && p.edit == nil && p.live(a.now()) && p.undo != nil {
+		keysAside = a.pal.dim(crewUndoWord)
+	}
+	lines, _ := framed{title: title, aside: aside, keys: a.pal.dim(keys), keysAside: keysAside}.draw(a.pal, width, rows)
+	p.owner = append(append([]int{-1}, owner...), -1)
+	p.arrowLine = crewArrowLine(p.owner, p, crewModels)
+	p.chipLine = crewArrowLine(p.owner, p, crewProviders)
+	return crewPad(lines, n)
+}
+
+// crewArrowLine is the drawn line of one main row — the models row, whose
+// arrows a press walks, or the providers row, whose chips a press toggles —
+// and -1 when the main rows are not up.
+func crewArrowLine(owner []int, p *crewPanel, stop int) int {
+	if p.view != crewMain {
+		return -1
+	}
+	for i, at := range owner {
+		if at == stop {
+			return i
+		}
+	}
+	return -1
+}
+
+// crewPad makes a block exactly n lines, which is what the frame reserved.
+func crewPad(lines []string, n int) []string {
+	if len(lines) > n {
+		return lines[:n]
+	}
+	for len(lines) < n {
+		lines = append(lines, "")
+	}
+	return lines
+}
+
+// focusLine is the row the window must keep in view: the cursor's.
+func (p *crewPanel) focusLine(owner []int) int {
+	want := p.cursor
+	switch p.view {
+	case crewPicking:
+		want = p.pick.cursor
+	case crewChecking:
+		want = p.check.cursor
+	case crewProviding:
+		want = p.prov
+	case crewKeys:
+		return 0
+	}
+	for i, at := range owner {
+		if at == want {
+			return i
+		}
+	}
+	return 0
+}
+
+// crewWindow cuts rows to room lines, keeping the focused one in view.
+func crewWindow(rows []string, owner []int, focus, room int) ([]string, []int) {
+	if len(rows) <= room {
+		return rows, owner
+	}
+	top := listTop(focus, 0, len(rows), room)
+	return rows[top : top+room], owner[top : top+room]
+}
+
+// crewEdges is what the frame's two edges say for the view that is up.
+func (a *app) crewEdges() (string, string) {
+	p := &a.crewUI
+	title := a.pal.muted(crewTitleWord)
+	switch p.view {
+	case crewPicking:
+		return a.pal.muted(crewTitleWord + " · " + string(p.pick.seat)), crewPickKeys
+	case crewChecking:
+		n := p.countFor(3)
+		return a.pal.muted(crewTitleWord + " · allowed models · " + strconv.Itoa(n) + " of " + strconv.Itoa(len(p.offers))), crewCheckKeys
+	case crewKeys:
+		return a.pal.muted(crewTitleWord + " · keys"), crewKeysKeys
+	case crewProviding:
+		return a.pal.muted(crewTitleWord + " · providers · " + strconv.Itoa(p.providersOn()) + " of " + strconv.Itoa(len(p.providers)) + " on"), crewProvKeys
+	}
+	if p.cursor == crewProviders && p.edit == nil {
+		// SPACE IS SAID WHERE IT MEANS SOMETHING OF ITS OWN. On every other row it
+		// is enter, which the edge already says.
+		return title, crewChipKeys
+	}
+	return title, crewMainKeys
+}
+
+// crewRows is the view's rows inside the frame, and the owner of each.
+func (a *app) crewRows(width int) ([]string, []int) { return a.crewRowsHover(width, -1) }
+
+func (a *app) crewRowsHover(width, hover int) ([]string, []int) {
+	inner := frameInner(width)
+	switch a.crewUI.view {
+	case crewPicking:
+		return a.crewPickRows(inner, hover)
+	case crewChecking:
+		return a.crewCheckRows(inner, hover)
+	case crewKeys:
+		return a.crewKeyRows(inner)
+	case crewProviding:
+		return a.crewProvRows(inner, hover)
+	}
+	return a.crewMainRows(inner, hover)
+}
+
+// crewRowLine is one row: the overlay row's lead and ground over text the caller
+// painted, set to the width and never past it. marked is THE ONE THIS SEAT IS
+// ON — the pin, or auto — and it takes the ground ladder's selected step the
+// way the model in use does on /model's list ([overlayRowCore] argues the
+// ladder), which outranks the cursor's on the row they share.
+func (a *app) crewRowLine(text string, selected, hovered, marked bool, width int) string {
+	line := overlayLead(selected, hovered, a.pal) + text
+	if ansi.StringWidth(line) > width {
+		line = ansi.Truncate(line, width, "…")
+	}
+	switch {
+	case marked:
+		return a.pal.selected(line, width)
+	case selected, hovered:
+		return a.pal.cursor(line, width)
+	}
+	return line
+}
+
+// crewSaid is a sentence under the rows — a warning, a refusal — WRAPPED and
+// never cut: the half of a refusal past the edge is usually the half that
+// says what to do about it.
+func crewSaid(text string, width int, paint func(string) string) []string {
+	var out []string
+	for i, line := range wrap(text, max(1, width-4)) {
+		lead := "  "
+		if i > 0 {
+			lead = "    "
+		}
+		out = append(out, paint(lead+line))
+	}
+	return out
+}
+
+// crewLabel is a main row's name, set in its column.
+func (a *app) crewLabel(word string, selected bool) string {
+	cell := word + strings.Repeat(" ", max(1, 10-len(word)))
+	if selected {
+		return a.pal.bold(a.pal.ink(cell))
+	}
+	return a.pal.muted(cell)
+}
+
+// crewMainRows is the five rows, the day under them, and whatever cannot work.
+func (a *app) crewMainRows(width, hover int) ([]string, []int) {
+	p := &a.crewUI
+	var rows []string
+	var owner []int
+	add := func(line string, at int) {
+		rows = append(rows, line)
+		owner = append(owner, at)
+	}
+	now := a.now()
+	for i, seat := range crewroute.Seats {
+		value := a.crewSeatValue(seat, width)
+		if p.live(now) && p.saved == i {
+			value += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+		}
+		add(a.crewRowLine(a.crewLabel(string(seat), p.cursor == i)+value, p.cursor == i, hover == len(rows), false, width), i)
+	}
+	add("", -1)
+	models := a.crewModelsValue()
+	if p.live(now) && p.saved == crewModels {
+		models += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+	}
+	modelsLine := a.crewRowLine(a.crewLabel("models", p.cursor == crewModels)+models, p.cursor == crewModels, hover == len(rows), false, width)
+	p.arrows = crewArrowSpans(modelsLine)
+	add(modelsLine, crewModels)
+	add(a.crewProvidersLine(width, hover == len(rows)), crewProviders)
+	capValue := a.crewCapValue()
+	if p.live(now) && p.saved == crewCap {
+		capValue += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+	}
+	add(a.crewRowLine(a.crewLabel("cap", p.cursor == crewCap)+capValue, p.cursor == crewCap, hover == len(rows), false, width), crewCap)
+	if day := a.crewTodayWord(); day != "" {
+		add("", -1)
+		add(a.pal.dim(fit("  "+day, width)), -1)
+	}
+	for _, warning := range a.crewWarnings() {
+		for _, line := range crewSaid(warning, width, a.pal.warn) {
+			add(line, -1)
+		}
+	}
+	if p.refusal != "" {
+		for _, line := range crewSaid(a.crewMark(tokens.GFailed)+" "+p.refusal, width, a.pal.bad) {
+			add(line, -1)
+		}
+	}
+	return rows, owner
+}
+
+// crewSeatValue is a seat's value: `auto` with what it usually runs, or the
+// pin glyph and the model with its route when one was pinned — and the word
+// `unavailable` where the pin cannot run on anything connected.
+func (a *app) crewSeatValue(seat crewroute.Seat, width int) string {
+	p := &a.crewUI
+	pin, pinned := p.pins[seat]
+	if !pinned {
+		usual := p.usual[seat]
+		if len(p.providers) == 0 {
+			// NOTHING CONNECTED IS SAID ONCE, under the rows, with the command
+			// that fixes it — not three times, once per seat, as though each of
+			// them had its own problem.
+			return a.pal.ink("auto")
+		}
+		if usual == "" {
+			return a.pal.ink("auto") + a.pal.warn(" · nothing allowed can sit this seat")
+		}
+		if width < crewNarrow {
+			return a.pal.ink("auto")
+		}
+		word := " · likely "
+		if p.usualSeen[seat] {
+			word = " · usually "
+		}
+		return a.pal.ink("auto") + a.pal.dim(word+usual)
+	}
+	value := a.crewMark(tokens.GPinned) + " " + a.pal.data(crewroute.ShortModel(pin.Model))
+	if pin.Provider != "" {
+		value += a.pal.dim(" @" + pin.Provider)
+	}
+	if why := p.pinTrouble(pin); why != "" {
+		value += "  " + a.pal.warn(why)
+	}
+	return value
+}
+
+// pinTrouble is why a pin cannot run on what is connected, or "": its
+// provider is not connected, or no connected provider reaches its model.
+//
+// A PIN WHOSE ONLY PROVIDER IS TURNED OFF says so rather than `unavailable`:
+// the provider is still connected, and the fix is a space on the providers
+// row, not a trip to /connect.
+func (p *crewPanel) pinTrouble(pin config.CrewPin) string {
+	if pin.Provider != "" {
+		for _, provider := range p.providers {
+			if provider.ID == pin.Provider {
+				if !provider.On {
+					return crewProviderOff
+				}
+				return ""
+			}
+		}
+		return "unavailable · " + pin.Provider + " is not connected"
+	}
+	// A pin written with a connection's own prefix is reached by that
+	// connection whether or not the catalog knows the model.
+	for _, provider := range p.providers {
+		if provider.ID != modelsource.DefaultID && strings.HasPrefix(strings.ToLower(pin.Model), strings.ToLower(provider.Written)+"/") {
+			if !provider.On {
+				return crewProviderOff
+			}
+			return ""
+		}
+	}
+	// A PINNED FREE POOL RUNS whatever the free-routes switch says — a pin is
+	// the person's own choice, and the switch governs only what the router
+	// picks — so it is reachable wherever the default service is on.
+	if crewroute.IsFree(strings.TrimPrefix(pin.Model, "openrouter/")) {
+		for _, provider := range p.providers {
+			if provider.ID == modelsource.DefaultID {
+				if !provider.On {
+					return crewProviderOff
+				}
+				return ""
+			}
+		}
+	}
+	lineage := crewroute.Lineage(strings.TrimPrefix(pin.Model, "openrouter/"))
+	for _, offer := range p.offers {
+		if crewroute.Lineage(offer.Model.ID) == lineage {
+			if !offer.Served {
+				return crewProviderOff
+			}
+			return ""
+		}
+	}
+	return "unavailable"
+}
+
+// crewModelsValue is the models row: the answer between its two arrows, and
+// what it admits. On a price it is the two ceilings as holes; on custom, the
+// rule it stands for.
+func (a *app) crewModelsValue() string {
+	p := &a.crewUI
+	step := p.modelStep()
+	value := a.pal.dim("‹ ") + a.pal.ink(crewModelBases[step]) + a.pal.dim(" ›")
+	switch step {
+	case 2:
+		value += "  " + a.pal.dim("≤ $") + a.crewHole(0, p.priceIn) + a.pal.dim(" in / $") + a.crewHole(1, p.priceOut) + a.pal.dim(" out")
+	case 3:
+		if p.rule.Custom() {
+			value += "  " + a.pal.dim(p.rule.String())
+		} else {
+			value += "  " + a.pal.dim("enter to pick")
+		}
+	}
+	if step != 3 || p.rule.Custom() {
+		value += a.pal.dim(" (" + strconv.Itoa(p.countFor(step)) + ")")
+	}
+	return value
+}
+
+// crewHole is one price ceiling: `[ 1 ]`, painted as the question form paints
+// a hole, with the one being typed into in bold ink.
+func (a *app) crewHole(which int, value float64) string {
+	p := &a.crewUI
+	text := strconv.FormatFloat(value, 'f', -1, 64)
+	if p.edit != nil && p.edit.stop == crewModels && p.edit.price == which {
+		return a.pal.bold(a.pal.ink("[ " + p.edit.box.String() + " ]"))
+	}
+	return a.pal.dim("[ ") + a.pal.ink(text) + a.pal.dim(" ]")
+}
+
+// crewCapValue is the cap row: the per-task limit and the daily cap (none,
+// or the figure), either one the hole being typed. Tab in a hole moves to the
+// other.
+func (a *app) crewCapValue() string {
+	p := &a.crewUI
+	hole := func(text string) string { return a.pal.bold(a.pal.ink("$[ " + text + " ]")) }
+	task := a.pal.ink(config.CrewTaskMoney(p.taskUSD))
+	daily := a.pal.ink("none")
+	if p.capUSD > 0 {
+		daily = a.pal.ink(crewroute.Money(p.capUSD))
+	}
+	if p.edit != nil && p.edit.stop == crewCap {
+		if p.edit.price == 1 {
+			return a.pal.dim("per task ") + hole(p.edit.box.String()) + a.pal.dim(" · daily ") + daily +
+				a.pal.dim(" · empty is "+config.CrewTaskMoney(config.CrewTaskCapDefault)+" · tab daily")
+		}
+		return a.pal.dim("per task ") + task + a.pal.dim(" · daily ") + hole(p.edit.box.String()) +
+			a.pal.dim(" · empty is none · tab per task")
+	}
+	return a.pal.dim("per task ") + task + a.pal.dim(" · daily ") + daily
+}
+
+// crewChipRoom is the cells a providers row keeps free past its chips, for
+// the tick a toggle leaves — so the row that just changed never folds or
+// unfolds under the tick it wears.
+const crewChipRoom = 3
+
+// crewChipWords is one provider as its chip says it: the name, and the kind
+// hint where how it bills is not a key — `sub` for a subscription, `local`
+// for a model on this machine when local is asked for. A custom endpoint
+// is the prefix the person wrote for it, which is the name they gave it —
+// its id and its catalog name are the same for every custom endpoint.
+func crewChipWords(provider config.CrewProvider, local bool) (string, string) {
+	name := provider.ID
+	switch {
+	case modelsource.IsCustomID(provider.ID):
+		if provider.Written != "" {
+			name = provider.Written
+		}
+	case provider.Kind == crewroute.Plan:
+		return name, "sub"
+	case provider.Kind == crewroute.Local && local:
+		return name, "local"
+	}
+	return name, ""
+}
+
+// crewProvidersLine is the providers row, drawn, with the cells of every chip
+// found on it for the pointer.
+//
+// THE CHIPS FOLD RATHER THAN CLIP. A row that does not fit drops its `local`
+// hints first — the one word on it a person can do without — and then says
+// only how many are on, `3 of 4 on`, with enter the way to the list that has
+// room for every one. A chip cut in half would be a toggle nobody could read.
+func (a *app) crewProvidersLine(width int, hovered bool) string {
+	p := &a.crewUI
+	selected := p.cursor == crewProviders
+	room := width - ansi.StringWidth(overlayLead(false, false, a.pal)) - ansi.StringWidth(ansi.Strip(a.crewLabel("providers", false))) - crewChipRoom
+	var words []string
+	value := ""
+	p.folded = false
+	for _, local := range []bool{true, false} {
+		value, words = a.crewChips(local, selected)
+		if ansi.StringWidth(ansi.Strip(value)) <= room {
+			break
+		}
+		value, words = "", nil
+	}
+	if value == "" {
+		p.folded = true
+		value = a.pal.ink(strconv.Itoa(p.providersOn())+" of "+strconv.Itoa(len(p.providers))) + a.pal.dim(" on")
+	}
+	if p.live(a.now()) && p.saved == crewProviders {
+		value += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+	}
+	line := a.crewRowLine(a.crewLabel("providers", selected)+value, selected, hovered, false, width)
+	p.chips = crewChipSpans(line, words)
+	return line
+}
+
+// crewChips is the chips, painted — on in ink behind a tick, off dim behind an
+// empty circle, the cursor's in bold when the row has the cursor — and the
+// plain words of each, in order, the `+` last.
+func (a *app) crewChips(local, selected bool) (string, []string) {
+	p := &a.crewUI
+	var parts, words []string
+	for i, provider := range p.providers {
+		name, hint := crewChipWords(provider, local)
+		mark, ink := a.crewMark(tokens.GSettled), a.pal.ink
+		if !provider.On {
+			mark, ink = a.crewMark(tokens.GQueued), a.pal.dim
+		}
+		plainWord := mark + " " + name
+		text := ink(mark) + " " + ink(name)
+		if selected && p.chip == i {
+			text = a.pal.bold(ink(mark + " " + name))
+		}
+		if hint != "" {
+			plainWord += " " + hint
+			text += a.pal.dim(" " + hint)
+		}
+		parts, words = append(parts, text), append(words, plainWord)
+	}
+	plus := a.pal.dim(crewConnectChip)
+	if selected && p.chip == len(p.providers) {
+		plus = a.pal.bold(a.pal.ink(crewConnectChip))
+	}
+	parts, words = append(parts, plus), append(words, crewConnectChip)
+	return strings.Join(parts, "  "), words
+}
+
+// crewChipSpans finds each chip's cells on the drawn row, in order, so a
+// press on one toggles it — the models row's arrows found the same way
+// ([crewArrowSpans]).
+func crewChipSpans(line string, words []string) []hudSpan {
+	if len(words) == 0 {
+		return nil
+	}
+	plainLine := ansi.Strip(line)
+	from := strings.Index(plainLine, "providers")
+	if from < 0 {
+		return nil
+	}
+	from += len("providers")
+	spans := make([]hudSpan, 0, len(words))
+	for _, word := range words {
+		at := strings.Index(plainLine[from:], word)
+		if at < 0 {
+			return nil
+		}
+		start := ansi.StringWidth(plainLine[:from+at])
+		spans = append(spans, hudSpan{from: start, to: start + ansi.StringWidth(word)})
+		from += at + len(word)
+	}
+	return spans
+}
+
+// crewKindWord is how a provider bills, as the providers list says it.
+func crewKindWord(provider config.CrewProvider) string {
+	switch {
+	case modelsource.IsCustomID(provider.ID):
+		return "custom endpoint"
+	case provider.Kind == crewroute.Plan:
+		return "subscription"
+	case provider.Kind == crewroute.Local:
+		return "local"
+	}
+	return "api key"
+}
+
+// crewServedWord is how many of the models a seat could be pinned to one
+// provider serves. A custom endpoint serves models the catalog does not
+// describe, which a pin that names it reaches and nothing else does.
+func (p *crewPanel) crewServedWord(provider config.CrewProvider) string {
+	n := 0
+	for _, offer := range p.offers {
+		for _, r := range offer.Routes {
+			if r.Provider == provider.ID {
+				n++
+				break
+			}
+		}
+	}
+	switch {
+	case n == 0 && modelsource.IsCustomID(provider.ID):
+		return "pins only"
+	case n == 1:
+		return "1 model"
+	}
+	return strconv.Itoa(n) + " models"
+}
+
+// crewDayWord is what one provider carried today, as the providers list says it.
+func (p *crewPanel) crewDayWord(provider config.CrewProvider) string {
+	if usd := p.log.ProviderUSD[provider.ID]; usd > 0 {
+		return "today " + crewroute.Money(usd)
+	}
+	return "nothing today"
+}
+
+// crewProvRows is the providers list: one provider a line — on or off, its
+// name, how it bills, how many models it serves and what it carried today,
+// the day's share laid on it by the seats it carried (internal/router's
+// crew.go). Columns line up, because a list of four is read down.
+func (a *app) crewProvRows(width, hover int) ([]string, []int) {
+	p := &a.crewUI
+	if len(p.providers) == 0 {
+		return []string{a.pal.dim(fit("  "+crewNoProviderWord, width))}, []int{-1}
+	}
+	nameW, kindW, servedW, dayW := 0, 0, 0, 0
+	for _, provider := range p.providers {
+		name, _ := crewChipWords(provider, false)
+		nameW = max(nameW, ansi.StringWidth(name))
+		kindW = max(kindW, ansi.StringWidth(crewKindWord(provider)))
+		servedW = max(servedW, ansi.StringWidth(p.crewServedWord(provider)))
+		dayW = max(dayW, ansi.StringWidth(p.crewDayWord(provider)))
+	}
+	// THE STATE WORD NEVER GOES. A line is the mark, the name and `on` or `off`
+	// first; the facts between them give way when the frame is narrow, the day's
+	// spend first, then how many models, then how it bills — the order a person
+	// deciding whether to switch a provider off needs them least.
+	pad := func(word string, w int) string { return word + strings.Repeat(" ", max(0, w-ansi.StringWidth(word))) }
+	room := width - ansi.StringWidth(overlayLead(false, false, a.pal)) - crewChipRoom
+	fixed := 2 + nameW + 2 + 3
+	facts := 0
+	for _, n := range []int{3, 2, 1} {
+		w := fixed + kindW + 2
+		if n >= 2 {
+			w += servedW
+		}
+		if n >= 3 {
+			w += 3 + dayW
+		}
+		if w <= room {
+			facts = n
+			break
+		}
+	}
+	var rows []string
+	var owner []int
+	now := a.now()
+	for i, provider := range p.providers {
+		name, _ := crewChipWords(provider, false)
+		mark, ink, state := a.crewMark(tokens.GSettled), a.pal.ink, "on"
+		if !provider.On {
+			mark, ink, state = a.crewMark(tokens.GQueued), a.pal.dim, "off"
+		}
+		var fact string
+		switch facts {
+		case 3:
+			fact = pad(crewKindWord(provider), kindW) + "  " + pad(p.crewServedWord(provider), servedW) + " · " + pad(p.crewDayWord(provider), dayW)
+		case 2:
+			fact = pad(crewKindWord(provider), kindW) + "  " + pad(p.crewServedWord(provider), servedW)
+		case 1:
+			fact = pad(crewKindWord(provider), kindW)
+		}
+		text := ink(mark) + " " + ink(pad(name, nameW)) + "  "
+		if fact != "" {
+			text += a.pal.dim(fact) + "  "
+		}
+		text += ink(state)
+		if p.live(now) && p.saved == crewProviders && p.provSaved == i {
+			text += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+		}
+		rows = append(rows, a.crewRowLine(text, i == p.prov, hover == len(rows), false, width))
+		owner = append(owner, i)
+	}
+	// THE FREE ROUTES, apart from the providers and after them: a switch about
+	// every provider at once, and off unless somebody turned it on, because a
+	// free pool may keep what it is sent.
+	rows, owner = append(rows, ""), append(owner, -1)
+	at := len(p.providers)
+	state, ink := "off", a.pal.dim
+	if p.free {
+		state, ink = "on", a.pal.ink
+	}
+	text := a.pal.ink(crewFreeRoutesWord) + "  " + ink(state) + a.pal.dim(" · "+crewFreeRoutesWhy)
+	if p.live(now) && p.saved == crewProviders && p.provSaved == at {
+		text += "  " + a.pal.add(a.crewMark(tokens.GSettled))
+	}
+	rows = append(rows, a.crewRowLine(text, p.prov == at, hover == len(rows), false, width))
+	owner = append(owner, at)
+	if p.refusal != "" {
+		for _, said := range crewSaid(a.crewMark(tokens.GFailed)+" "+p.refusal, width, a.pal.bad) {
+			rows = append(rows, said)
+			owner = append(owner, -1)
+		}
+	}
+	return rows, owner
+}
+
+// crewTodayWord is the one dim line about the day: what the crews spent and
+// how many tasks they ran. A day with nothing in it says nothing.
+func (a *app) crewTodayWord() string {
+	log := a.crewUI.log
+	if log.Tasks == 0 && log.SpentUSD <= 0 {
+		return ""
+	}
+	day := "today " + crewroute.Money(log.SpentUSD)
+	if log.Tasks > 0 {
+		day += " · " + strconv.Itoa(log.Tasks) + " task"
+		if log.Tasks != 1 {
+			day += "s"
+		}
+		if log.OnPlan > 0 {
+			day += ", " + strconv.Itoa(log.OnPlan) + " on a plan"
+		}
+		if log.Local > 0 {
+			day += ", " + strconv.Itoa(log.Local) + " local"
+		}
+	}
+	if capUSD := a.crewUI.capUSD; capUSD > 0 && log.SpentUSD >= capUSD {
+		day += " · at the cap"
+	}
+	return day
+}
+
+// crewWarnings is what cannot work, one line each: no provider at all, a
+// crew that rides one model, and the allowed models leaving a class of work
+// without the seat that class needs.
+func (a *app) crewWarnings() []string {
+	p := &a.crewUI
+	var out []string
+	if a.oneModel {
+		out = append(out, crewOneModelWord)
+	}
+	if len(p.providers) == 0 {
+		out = append(out, crewNoProviderWord)
+		return out
+	}
+	// A SEAT NOTHING ALLOWED CAN SIT ALREADY SAYS SO ON ITS ROW, and that is the
+	// larger trouble: a warning that the checker will be weak beside a seat that
+	// cannot be sat at all is the smaller half of the same sentence.
+	for _, seat := range crewroute.Seats {
+		if _, pinned := p.pins[seat]; !pinned && p.usual[seat] == "" {
+			return out
+		}
+	}
+	for _, gap := range p.gaps {
+		out = append(out, gap.Line)
+	}
+	return out
+}
+
+// crewArrowSpans finds the models row's two arrows in the drawn line, by
+// cell, so a press on either walks the row.
+func crewArrowSpans(line string) [2]hudSpan {
+	plainLine := ansi.Strip(line)
+	var spans [2]hudSpan
+	cells := 0
+	for _, r := range plainLine {
+		w := ansi.StringWidth(string(r))
+		switch r {
+		case '‹':
+			spans[0] = hudSpan{from: cells, to: cells + w}
+		case '›':
+			if cells > 2 {
+				spans[1] = hudSpan{from: cells, to: cells + w}
+			}
+		}
+		cells += w
+	}
+	return spans
+}
+
+// crewPickRows is the seat list's rows.
+func (a *app) crewPickRows(width, hover int) ([]string, []int) {
+	p := &a.crewUI
+	k := p.pick
+	var rows []string
+	var owner []int
+	if len(k.lines) == 0 {
+		return []string{a.pal.dim(fit("  "+crewNothingMatches, width))}, []int{-1}
+	}
+	pin, pinned := p.pins[k.seat]
+	k.top = listTop(k.cursor, k.top, len(k.lines), crewListRows)
+	for at := k.top; at < len(k.lines) && at < k.top+crewListRows; at++ {
+		line := k.lines[at]
+		row := k.rows[line.row]
+		selected, hovered := at == k.cursor, hover == len(rows)
+		var text string
+		marked := false
+		switch {
+		case row.auto:
+			text = "  " + a.pal.ink(crewAutoWord)
+			marked = !pinned
+		case line.route < 0:
+			current := pinned && crewroute.Lineage(pin.Model) == crewroute.Lineage(row.offer.Model.ID)
+			text = a.crewOfferText(row, current, width)
+			marked = current && k.unfold != row.offer.Model.ID
+		default:
+			// A ROUTE HANGS UNDER ITS MODEL, two cells further in than the name
+			// it belongs to — the fold /model's list draws ([laneIndent]).
+			text = strings.Repeat(" ", 4) + a.crewRouteText(row.offer, line.route, pin, pinned)
+			marked = crewRouteMarked(row.offer, line.route, pin, pinned)
+		}
+		rows = append(rows, a.crewRowLine(text, selected, hovered, marked, width))
+		owner = append(owner, at)
+		if k.refuse == at {
+			for _, said := range crewSaid(a.crewMark(tokens.GFailed)+" "+k.refuseWhy, width, a.pal.warn) {
+				rows = append(rows, said)
+				owner = append(owner, -1)
+			}
+		}
+	}
+	if p.refusal != "" {
+		for _, said := range crewSaid(a.crewMark(tokens.GFailed)+" "+p.refusal, width, a.pal.bad) {
+			rows = append(rows, said)
+			owner = append(owner, -1)
+		}
+	}
+	return rows, owner
+}
+
+// crewRouteMarked is whether one route line is the pin this seat is on.
+func crewRouteMarked(offer config.CrewOffer, route int, pin config.CrewPin, pinned bool) bool {
+	if !pinned || crewroute.Lineage(pin.Model) != crewroute.Lineage(offer.Model.ID) {
+		return false
+	}
+	if route == 0 {
+		return pin.Provider == ""
+	}
+	return route-1 < len(offer.Routes) && offer.Routes[route-1].Provider == pin.Provider
+}
+
+// crewOfferText is one model on the seat list: the suggestion's star, the
+// name, the price in and out per million, and one provider — `+n` for the
+// rest, which → lays out.
+func (a *app) crewOfferText(row crewPickRow, current bool, width int) string {
+	offer := row.offer
+	name := offer.Model.ID
+	if width < crewNarrow {
+		name = crewroute.ShortModel(name)
+	}
+	lead := "  "
+	if row.suggested {
+		lead = a.pal.warn(a.crewMark(tokens.GRecommended)) + " "
+	}
+	ink := a.pal.ink
+	if !offer.Allowed {
+		ink = a.pal.dim
+	}
+	text := lead + ink(name)
+	if current {
+		text += " " + a.crewMark(tokens.GPinned)
+	}
+	facts := []string{crewPerM(offer.Model)}
+	if len(offer.Routes) > 0 {
+		provider := offer.Routes[0].Provider
+		if extra := len(offer.Routes) - 1; extra > 0 {
+			provider += " +" + strconv.Itoa(extra)
+		}
+		facts = append(facts, provider)
+	}
+	switch {
+	case !offer.Served:
+		facts = append(facts, crewProviderOff)
+	case !offer.Allowed:
+		facts = append(facts, "not allowed")
+	}
+	if row.suggested {
+		facts = append(facts, "suggested")
+	}
+	return text + "  " + a.pal.dim(strings.Join(facts, " · "))
+}
+
+// crewRouteText is one route under an unfolded model: "any route" first, then
+// each provider with how it bills.
+func (a *app) crewRouteText(offer config.CrewOffer, route int, pin config.CrewPin, pinned bool) string {
+	if route == 0 {
+		return a.pal.ink(crewAnyRouteWord)
+	}
+	r := offer.Routes[route-1]
+	return a.pal.ink(r.Provider) + a.pal.dim(" · "+string(r.Kind))
+}
+
+// crewPerM is a model's price as the list shows it: dollars per million
+// tokens in and out, cents at most.
+func crewPerM(m crewroute.Model) string {
+	return "$" + crewCents(m.PromptPrice*1e6) + "/$" + crewCents(m.CompletionPrice*1e6)
+}
+
+// crewCents spells a price to the cent: whole dollars bare, anything else to
+// two places, so a column of prices reads as money ($0.50, not $0.5).
+func crewCents(usd float64) string {
+	cents := math.Round(usd * 100)
+	if math.Mod(cents, 100) == 0 {
+		return strconv.FormatFloat(cents/100, 'f', 0, 64)
+	}
+	return strconv.FormatFloat(cents/100, 'f', 2, 64)
+}
+
+// crewCheckRows is the checklist's rows: a tick where the rule admits the
+// line, nothing where it does not.
+func (a *app) crewCheckRows(width, hover int) ([]string, []int) {
+	p := &a.crewUI
+	c := p.check
+	if len(c.hits) == 0 {
+		return []string{a.pal.dim(fit("  "+crewNothingMatches, width))}, []int{-1}
+	}
+	var rows []string
+	var owner []int
+	c.top = listTop(c.cursor, c.top, len(c.hits), crewListRows)
+	for at := c.top; at < len(c.hits) && at < c.top+crewListRows; at++ {
+		line := c.lines[c.hits[at]]
+		mark := "  "
+		if p.ticked(line) {
+			mark = a.pal.ink(a.crewMark(tokens.GSettled)) + " "
+		}
+		text := mark + a.pal.ink(line.offer.Model.ID) + a.pal.dim("  "+crewPerM(line.offer.Model))
+		if !line.offer.Served {
+			text += a.pal.dim(" · " + crewProviderOff)
+		}
+		rows = append(rows, a.crewRowLine(text, at == c.cursor, hover == len(rows), false, width))
+		owner = append(owner, at)
+	}
+	if p.refusal != "" {
+		rows = append(rows, a.pal.bad(fit("  "+a.crewMark(tokens.GFailed)+" "+p.refusal, width)))
+		owner = append(owner, -1)
+	}
+	return rows, owner
+}
+
+// crewKeyLines is `?`: every key the panel takes, and the pointer's share.
+var crewKeyLines = [][2]string{
+	{"↑↓  j k", "move"},
+	{"enter", "change the row · pick · tick"},
+	{"←→", "walk the models row · the providers · a model's routes"},
+	{"space", "turn the provider under the cursor off or on"},
+	{"0-9", "type the daily cap, or a price ceiling"},
+	{"tab", "the cap row's other limit · the other price ceiling"},
+	{"type", "filter a list"},
+	{"z", "undo the last change, for a few seconds"},
+	{"esc", "back one level · close"},
+	{"click", "a row is enter · ‹ › walk the models row · a provider toggles"},
+	{"wheel", "scrolls a list"},
+}
+
+// crewKeyRows draws the key list.
+func (a *app) crewKeyRows(width int) ([]string, []int) {
+	var rows []string
+	var owner []int
+	for _, pair := range crewKeyLines {
+		cell := pair[0] + strings.Repeat(" ", max(1, 10-ansi.StringWidth(pair[0])))
+		rows = append(rows, fit("  "+a.pal.ink(cell)+a.pal.dim(pair[1]), width))
+		owner = append(owner, -1)
+	}
+	return rows, owner
+}
+
+// ── the pointer ─────────────────────────────────────────────────────────────
+
+// crewPress is a press on the panel. A PRESS ON A ROW IS ENTER ON IT — the one
+// click grammar every list here keeps — and a press on one of the models row's
+// arrows walks it. A press anywhere off the panel closes it, which is what
+// pressing outside a modal list means everywhere on this surface.
+func (a *app) crewPress(x, y int) tea.Cmd {
+	p := &a.crewUI
+	mark, ok := a.chromeAt(y)
+	if !ok || mark.kind != chromeOverlay {
+		if p.view == crewMain && p.edit == nil {
+			return a.closeCrew()
+		}
+		return nil
+	}
+	at := -1
+	if mark.index >= 0 && mark.index < len(p.owner) {
+		at = p.owner[mark.index]
+	}
+	defer a.touch()
+	// A HOLE BEING TYPED INTO IS NOT A LIST: a press elsewhere is swallowed and
+	// esc is the way out, which is the way out of every box here.
+	if p.edit != nil || at < 0 {
+		return nil
+	}
+	x -= 1 // the frame's side cell
+	switch p.view {
+	case crewMain:
+		p.cursor = at
+		if at == crewModels && mark.index == p.arrowLine {
+			switch {
+			case p.arrows[0].holds(x):
+				return a.crewStepModels(-1)
+			case p.arrows[1].holds(x):
+				return a.crewStepModels(1)
+			}
+		}
+		if at == crewProviders && mark.index == p.chipLine && !p.folded {
+			// A PRESS ON A CHIP IS SPACE ON IT; a press on the row's name or its
+			// empty end is enter on the row, the list, as on every other row.
+			for i, span := range p.chips {
+				if span.holds(x) {
+					p.chip = i
+					return a.crewSpaceChip()
+				}
+			}
+		}
+		return a.crewEnter()
+	case crewPicking:
+		p.pick.cursor = at
+		return a.crewPickEnter()
+	case crewChecking:
+		p.check.cursor = at
+		return a.crewTick()
+	case crewProviding:
+		p.prov = at
+		return a.crewProvToggle()
+	}
+	return nil
+}
+
+// crewWheel walks whichever list is up, a row a notch — the one wheel an
+// overlay here takes, because it is the one with lists longer than its frame.
+func (a *app) crewWheel(delta int) {
+	p := &a.crewUI
+	switch p.view {
+	case crewPicking:
+		p.pick.move(delta)
+	case crewChecking:
+		p.check.move(delta)
+	case crewProviding:
+		p.prov = moveCursor(p.prov, delta, p.crewProvLines())
+	case crewMain:
+		if p.edit == nil {
+			a.crewMove(delta)
+		}
+	}
+	a.touch()
+}
+
+// crewBox is the one-line box under the panel while a list is up — its
+// filter, in the place every overlay's filter stands — and nil otherwise.
+func (a *app) crewBox() *editor {
+	switch p := &a.crewUI; {
+	case !p.open:
+		return nil
+	case p.view == crewPicking:
+		return &p.pick.filter
+	case p.view == crewChecking:
+		return &p.check.filter
+	}
+	return nil
+}
+
+// crewNow is the reading a shortcut hands the panel after it wrote: the panel
+// opens — or, open already, re-reads — with the tick on the row the shortcut
+// changed.
+func (a *app) crewNow(stop int, before config.CrewState) tea.Cmd {
+	if a.hosted() {
+		return nil
+	}
+	if !a.crewUI.open {
+		a.openCrew()
+	} else {
+		a.crewUI.read(a.profileDir)
+	}
+	p := &a.crewUI
+	if p.view != crewMain {
+		p.view, p.pick, p.check = crewMain, nil, nil
+	}
+	p.provSaved = -1
+	p.cursor, p.undo = stop, &before
+	p.saved, p.savedAt = stop, a.now()
+	a.touch()
+	return surfaceTick(crewUndoFor, func(time.Time) tea.Msg { return crewUndoMsg{} })
+}
diff --git a/internal/tui3/crewpanel_test.go b/internal/tui3/crewpanel_test.go
new file mode 100644
index 0000000000..be47fe2596
--- /dev/null
+++ b/internal/tui3/crewpanel_test.go
@@ -0,0 +1,648 @@
+package tui3
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+	"github.com/charmbracelet/x/ansi"
+
+	modelcatalog "github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
+)
+
+// THE CREW PANEL, DRIVEN THE WAY A PERSON DRIVES IT: the keys of the five
+// journeys the panel was designed around, counted, and the screens each one
+// leaves behind — the panel, the seat list, a price being typed, the
+// checklist, a narrow window, a machine with nothing connected, and the undo
+// offer.
+
+// crewLab is a surface with a provider key and a small catalog behind it, the
+// ordinary state a crew is chosen in. The catalog is the one internal/config's
+// own crew tests route over, so a figure here is a figure there.
+func crewLab(t *testing.T) (*app, string) {
+	t.Helper()
+	for _, name := range []string{config.APIKeyEnv, "OPENAI_API_KEY", config.ModelEnv, config.PlanModelEnv,
+		config.CheckModelEnv, "CODEAF_BASE_URL", "DEEPSEEK_API_KEY", "ZHIPU_API_KEY", "MOONSHOT_API_KEY",
+		"MINIMAX_API_KEY", "DASHSCOPE_API_KEY"} {
+		t.Setenv(name, "")
+	}
+	a, dir := sheetApp(t)
+	t.Setenv(config.APIKeyEnv, "sk-or-v1-crewpanel-0123456789")
+	previous := config.CrewCatalog
+	t.Cleanup(func() { config.CrewCatalog = previous })
+	rows := []modelcatalog.Model{
+		{ID: "z-ai/glm-5.3-flash", CanonicalSlug: "z-ai/glm-5.3-flash-20260826", OpenWeights: true, PromptPrice: 1.5e-7, CompletionPrice: 5e-7, CacheReadPrice: 5e-8,
+			IntelligenceIndex: 41.8, CodingIndex: 71.5, AgenticIndex: 50.9, ArenaElo: 1348, ContextLength: 1310720, Parameters: []string{"tools"}},
+		{ID: "moonshotai/kimi-k3", CanonicalSlug: "moonshotai/kimi-k3-20260715", OpenWeights: true, PromptPrice: 3e-6, CompletionPrice: 1.5e-5, CacheReadPrice: 3e-7,
+			IntelligenceIndex: 43.6, CodingIndex: 76.2, AgenticIndex: 50, ArenaElo: 1421, ContextLength: 1048576, Parameters: []string{"tools"}},
+		{ID: "deepseek/deepseek-v4-flash", CanonicalSlug: "deepseek/deepseek-v4-flash-20260423", OpenWeights: true, PromptPrice: 8.246e-8, CompletionPrice: 1.6492e-7, CacheReadPrice: 1.6492e-8,
+			IntelligenceIndex: 24.2, CodingIndex: 56.2, AgenticIndex: 22.2, ArenaElo: 1216, ContextLength: 1048576, Parameters: []string{"tools"}},
+		{ID: "anthropic/claude-opus-5", CanonicalSlug: "anthropic/claude-opus-5-20260723", PromptPrice: 5e-6, CompletionPrice: 2.5e-5, CacheReadPrice: 5e-7,
+			IntelligenceIndex: 50.8, CodingIndex: 78, AgenticIndex: 56.5, ArenaElo: 1372, ContextLength: 1000000, Parameters: []string{"tools"}},
+	}
+	config.CrewCatalog = func() []modelcatalog.Model { return rows }
+	now := time.Date(2026, 9, 24, 12, 0, 0, 0, time.UTC)
+	a.clock = func() time.Time { return now }
+	a.width, a.height = 100, 40
+	return a, dir
+}
+
+// crewScreen is the panel's block as a reader sees it.
+func crewScreen(a *app) string { return strings.Join(plainOverlay(a), "\n") }
+
+// press drives keys and counts them, so a journey's cost is a number a test
+// can hold the design to.
+type crewJourney struct {
+	t     *testing.T
+	a     *app
+	count int
+}
+
+func (j *crewJourney) keys(names ...string) {
+	j.t.Helper()
+	for _, name := range names {
+		drive(j.t, j.a, key(name))
+		j.count++
+	}
+}
+
+func (j *crewJourney) typed(text string) {
+	j.t.Helper()
+	for _, r := range text {
+		drive(j.t, j.a, key(string(r)))
+		j.count++
+	}
+}
+
+// open is `/crew` and enter, which is one step of a journey however many
+// letters it takes to type.
+func (j *crewJourney) open() {
+	j.t.Helper()
+	typeLine(j.t, j.a, "/crew")
+	j.count++
+	if !j.a.crewUI.open {
+		j.t.Fatalf("/crew opened nothing:\n%s", plain(mustFrame(j.a)))
+	}
+}
+
+// ── the five journeys ───────────────────────────────────────────────────────
+
+// CHECK: /crew, esc. The panel says the three seats, the models, the
+// providers and the cap, and esc takes it down.
+func TestCrewJourneyCheck(t *testing.T) {
+	a, _ := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	screen := crewScreen(a)
+	for _, want := range []string{crewTitleWord, "worker", "planner", "checker", "auto",
+		"models", "‹ all ›", "providers", "cap", "none", crewMainKeys, "esc"} {
+		if !strings.Contains(screen, want) {
+			t.Errorf("the panel does not say %q:\n%s", want, screen)
+		}
+	}
+	// THE ONE CONNECTED PROVIDER IS A CHIP, on, with the `+` beside it.
+	if row := crewLineWith(t, screen, "providers"); !strings.Contains(row, a.icon(tokens.GSettled)+" openrouter  "+crewConnectChip) {
+		t.Errorf("the providers row reads %q", row)
+	}
+	j.keys("esc")
+	if a.crewUI.open {
+		t.Fatal("esc left the panel up")
+	}
+	if j.count != 2 {
+		t.Fatalf("checking the crew took %d steps", j.count)
+	}
+	t.Logf("check: %d steps", j.count)
+}
+
+// PIN THE CHECKER: /crew ↓↓ enter "kim" enter — and the panel comes back with
+// the pin on the row and a tick beside it.
+func TestCrewJourneyPinAndUnpin(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "enter")
+	if a.crewUI.view != crewPicking || a.crewUI.pick.seat != crewroute.Checker {
+		t.Fatalf("enter on the checker opened %v", a.crewUI.view)
+	}
+	j.typed("kim")
+	j.keys("enter")
+	pin, ok := config.CrewPinAt(dir, crewroute.Checker)
+	if !ok || pin.Model != "moonshotai/kimi-k3" || pin.Provider != "" {
+		t.Fatalf("the checker reads %+v (%v)", pin, ok)
+	}
+	if j.count != 8 {
+		t.Fatalf("pinning the checker took %d steps, want 8 (/crew ↓ ↓ enter k i m enter)", j.count)
+	}
+	t.Logf("pin checker: %d steps", j.count)
+	screen := crewScreen(a)
+	if a.crewUI.view != crewMain || a.crewUI.cursor != 2 {
+		t.Fatalf("the panel did not come back to the checker:\n%s", screen)
+	}
+	row := crewLineWith(t, screen, "checker")
+	if !strings.Contains(row, a.icon(tokens.GPinned)+" kimi-k3") || !strings.Contains(row, a.icon(tokens.GSettled)) {
+		t.Fatalf("the checker row does not show the pin and its tick: %q", row)
+	}
+	if !strings.Contains(screen, crewUndoWord) {
+		t.Fatalf("a change offers no undo:\n%s", screen)
+	}
+
+	// UNPIN: enter enter. The list opens on `auto`, which is the whole of why
+	// unpinning needs no verb of its own.
+	u := &crewJourney{t: t, a: a}
+	u.keys("enter")
+	if list := crewScreen(a); !strings.Contains(crewLineWith(t, list, "codeaf picks per task"), "›") {
+		t.Fatalf("the list did not open on auto:\n%s", list)
+	}
+	u.keys("enter")
+	if _, ok := config.CrewPinAt(dir, crewroute.Checker); ok {
+		t.Fatal("choosing auto left the checker pinned")
+	}
+	if u.count != 2 {
+		t.Fatalf("unpinning took %d steps", u.count)
+	}
+	t.Logf("unpin: %d steps", u.count)
+}
+
+// OPEN-WEIGHT ONLY: ↓↓↓ →. The models row is walked where it stands, and the
+// step is written as it is taken.
+func TestCrewJourneyOpenWeightOnly(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down", "right")
+	if got := config.CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("the allowed rule reads %q", got)
+	}
+	row := crewLineWith(t, crewScreen(a), "models")
+	// The catalog has three open models of four, and the row counts them.
+	if !strings.Contains(row, "‹ open ›") || !strings.Contains(row, "(3)") {
+		t.Fatalf("the models row reads %q", row)
+	}
+	if j.count != 5 {
+		t.Fatalf("open-weight only took %d steps", j.count)
+	}
+	t.Logf("open-weight only: %d steps", j.count)
+}
+
+// SET A CAP: move to cap, type 5, enter. And the hole refuses what is not a
+// dollar amount, and an emptied hole is no cap.
+func TestCrewJourneyCap(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down", "down", "down")
+	j.typed("5")
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "$[ 5 ]") {
+		t.Fatalf("typing on the cap row did not open its hole: %q", row)
+	}
+	j.keys("enter")
+	if got := config.CrewCapAt(dir); got != 5 {
+		t.Fatalf("the cap reads %v", got)
+	}
+	if j.count != 8 {
+		t.Fatalf("setting the cap took %d steps", j.count)
+	}
+	t.Logf("set cap: %d steps", j.count)
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "per task $5 · daily $5.00") {
+		t.Fatalf("the cap row reads %q", row)
+	}
+
+	// A FIGURE THAT IS NOT DOLLARS IS REFUSED and the cap stays.
+	j.typed("5..5")
+	j.keys("enter")
+	if got := config.CrewCapAt(dir); got != 5 {
+		t.Fatalf("a bad figure moved the cap to %v", got)
+	}
+	if screen := crewScreen(a); !strings.Contains(screen, "not a dollar amount") {
+		t.Fatalf("the refusal was not said:\n%s", screen)
+	}
+	// AND AN EMPTIED HOLE IS NONE.
+	j.keys("enter", "backspace", "backspace", "backspace", "backspace", "enter")
+	if got := config.CrewCapAt(dir); got != 0 {
+		t.Fatalf("an emptied hole left the cap at %v", got)
+	}
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "none") {
+		t.Fatalf("the cap row reads %q", row)
+	}
+}
+
+// SET THE PER-TASK LIMIT on the same row: enter, tab to the per-task hole,
+// type, enter. An emptied per-task hole is the default, never no limit.
+func TestCrewJourneyTaskCap(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down", "down", "down")
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "per task $5 · daily none") {
+		t.Fatalf("the cap row reads %q", row)
+	}
+	j.keys("enter", "tab")
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "per task $[ 5 ]") {
+		t.Fatalf("tab did not open the per-task hole: %q", row)
+	}
+	j.keys("backspace")
+	j.typed("12")
+	j.keys("enter")
+	if got := config.CrewTaskCapAt(dir); got != 12 {
+		t.Fatalf("the per-task limit reads %v", got)
+	}
+	if got := config.CrewCapAt(dir); got != 0 {
+		t.Fatalf("setting the per-task limit moved the daily cap to %v", got)
+	}
+	if row := crewLineWith(t, crewScreen(a), "cap"); !strings.Contains(row, "per task $12 · daily none") {
+		t.Fatalf("the cap row reads %q", row)
+	}
+	j.keys("enter", "tab", "backspace", "backspace", "enter")
+	if got := config.CrewTaskCapAt(dir); got != 5 {
+		t.Fatalf("an emptied per-task hole left the limit at %v", got)
+	}
+}
+
+// ── the seat list ───────────────────────────────────────────────────────────
+
+// A PIN OUTSIDE THE ALLOWED MODELS IS REFUSED ON ITS OWN ROW, and the next
+// enter lets the model in and pins it — one key to fix it, both undone
+// together.
+func TestCrewRefusesAPinOutsideTheRuleAndOffersTheFix(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewAllowed(dir, "open"); err != nil {
+		t.Fatal(err)
+	}
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("enter")
+	j.typed("opus")
+	if row := crewLineWith(t, crewScreen(a), "claude-opus-5"); !strings.Contains(row, "not allowed") {
+		t.Fatalf("a model the rule leaves out is not marked: %q", row)
+	}
+	j.keys("enter")
+	if _, ok := config.CrewPinAt(dir, crewroute.Worker); ok {
+		t.Fatal("a pin outside the allowed models was written")
+	}
+	screen := crewScreen(a)
+	if !strings.Contains(screen, "claude-opus-5 is not in your allowed models (open) — "+crewAllowFixWord) {
+		t.Fatalf("the refusal is not on the row:\n%s", screen)
+	}
+	j.keys("enter")
+	pin, ok := config.CrewPinAt(dir, crewroute.Worker)
+	if !ok || pin.Model != "anthropic/claude-opus-5" {
+		t.Fatalf("the fix did not pin: %+v", pin)
+	}
+	if got := config.CrewAllowedAt(dir).String(); got != "open +anthropic/claude-opus-5" {
+		t.Fatalf("the fix widened the rule to %q", got)
+	}
+	// AND ONE z TAKES BOTH BACK.
+	j.keys("z")
+	if _, ok := config.CrewPinAt(dir, crewroute.Worker); ok {
+		t.Fatal("undo left the pin")
+	}
+	if got := config.CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("undo left the rule at %q", got)
+	}
+}
+
+// THE LIST IS AUTO FIRST, THE ROUTER'S SUGGESTION NEXT AND MARKED, and every
+// row says its price and one provider. → lays a model's routes out under it,
+// and a route pins that provider.
+func TestCrewSeatListShapeAndRoutes(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("enter")
+	lines := plainOverlay(a)
+	if !strings.Contains(lines[1], crewAutoWord) {
+		t.Fatalf("the list does not open on auto:\n%s", strings.Join(lines, "\n"))
+	}
+	if !strings.Contains(lines[2], a.icon(tokens.GRecommended)) || !strings.Contains(lines[2], "suggested") {
+		t.Fatalf("the suggestion is not second and marked:\n%s", strings.Join(lines, "\n"))
+	}
+	if row := crewLineWith(t, strings.Join(lines, "\n"), "kimi-k3"); !strings.Contains(row, "$3/$15") || !strings.Contains(row, "openrouter") {
+		t.Fatalf("a row does not say its price and provider: %q", row)
+	}
+	j.typed("kimi")
+	j.keys("right")
+	screen := crewScreen(a)
+	if !strings.Contains(screen, crewAnyRouteWord) || !strings.Contains(crewLineWith(t, screen, "metered"), "openrouter") {
+		t.Fatalf("→ did not lay out the routes:\n%s", screen)
+	}
+	j.keys("down", "down", "enter")
+	pin, ok := config.CrewPinAt(dir, crewroute.Worker)
+	if !ok || pin.String() != "moonshotai/kimi-k3@openrouter" {
+		t.Fatalf("the route pinned %+v", pin)
+	}
+	if row := crewLineWith(t, crewScreen(a), "worker"); !strings.Contains(row, "@openrouter") {
+		t.Fatalf("a pinned route is not on the seat: %q", row)
+	}
+}
+
+// ESC GOES BACK EXACTLY ONE LEVEL: the routes, then the list, then the panel.
+func TestCrewEscIsOneLevel(t *testing.T) {
+	a, _ := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("enter")
+	j.typed("kimi")
+	j.keys("right", "esc")
+	if a.crewUI.view != crewPicking || a.crewUI.pick.unfold != "" {
+		t.Fatal("esc on the routes did not fold them and stop")
+	}
+	j.keys("esc")
+	if a.crewUI.view != crewMain || !a.crewUI.open {
+		t.Fatal("esc on the list did not come back to the panel")
+	}
+	j.keys("esc")
+	if a.crewUI.open {
+		t.Fatal("esc on the panel did not close it")
+	}
+}
+
+// ── the models row ──────────────────────────────────────────────────────────
+
+// A PRICE IS TYPED INTO THE ROW: two holes, the in ceiling then the out one,
+// written as one rule.
+func TestCrewPriceIsTypedOnTheRow(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down", "right", "right")
+	if got := config.CrewAllowedAt(dir).String(); got != "≤1/5" {
+		t.Fatalf("stepping onto price wrote %q", got)
+	}
+	j.keys("enter", "ctrl+u")
+	j.typed("0.5")
+	row := crewLineWith(t, crewScreen(a), "models")
+	if !strings.Contains(row, "≤ $[ 0.5 ] in / $[ 5 ] out") {
+		t.Fatalf("the price row is not two holes: %q", row)
+	}
+	j.keys("enter", "ctrl+u")
+	j.typed("2")
+	j.keys("enter")
+	if got := config.CrewAllowedAt(dir).String(); got != "≤0.5/2" {
+		t.Fatalf("the ceilings wrote %q", got)
+	}
+	// Two models of four are under half a dollar in and two out.
+	if row := crewLineWith(t, crewScreen(a), "models"); !strings.Contains(row, "(2)") {
+		t.Fatalf("the row does not count what the price admits: %q", row)
+	}
+}
+
+// CUSTOM IS THE CHECKLIST: the models, each ticked where the rule admits it —
+// and a tick writes the shortest rule that says it. A provider is not a line
+// of it: providers are the providers row's.
+func TestCrewChecklist(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewAllowed(dir, "open -deepseek"); err != nil {
+		t.Fatal(err)
+	}
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down")
+	if row := crewLineWith(t, crewScreen(a), "models"); !strings.Contains(row, "‹ custom ›") || !strings.Contains(row, "open -deepseek") {
+		t.Fatalf("a rule with an exception is not custom: %q", row)
+	}
+	j.keys("enter")
+	if a.crewUI.view != crewChecking {
+		t.Fatal("enter on custom did not open the checklist")
+	}
+	screen := crewScreen(a)
+	if strings.Contains(screen, "whole provider") || strings.Contains(screen, "  openrouter") {
+		t.Fatalf("the checklist still lists a provider:\n%s", screen)
+	}
+	if strings.Contains(crewLineWith(t, screen, "deepseek-v4-flash"), a.icon(tokens.GSettled)) {
+		t.Fatalf("an excluded model is ticked:\n%s", screen)
+	}
+	j.typed("kimi")
+	j.keys(" ")
+	if got := config.CrewAllowedAt(dir).String(); got != "open -deepseek -moonshotai/kimi-k3" {
+		t.Fatalf("unticking kimi wrote %q", got)
+	}
+	j.keys(" ")
+	if got := config.CrewAllowedAt(dir).String(); got != "open -deepseek" {
+		t.Fatalf("ticking it back wrote %q", got)
+	}
+	j.keys("esc")
+	if a.crewUI.view != crewMain {
+		t.Fatal("esc on the checklist did not come back to the panel")
+	}
+}
+
+// ── what cannot work ────────────────────────────────────────────────────────
+
+// NO PROVIDER IS THE ONE WARNING, with the command that fixes it.
+func TestCrewWithNoProviderSaysSo(t *testing.T) {
+	a, _ := crewLab(t)
+	t.Setenv(config.APIKeyEnv, "")
+	typeLine(t, a, "/crew")
+	if screen := crewScreen(a); !strings.Contains(screen, crewNoProviderWord) {
+		t.Fatalf("no provider was not said:\n%s", screen)
+	}
+}
+
+// A PIN WHOSE PROVIDER WENT AWAY IS MARKED ON ITS ROW.
+func TestCrewMarksAnUnavailablePin(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3@openrouter"); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(config.APIKeyEnv, "")
+	typeLine(t, a, "/crew")
+	if row := crewLineWith(t, crewScreen(a), "checker"); !strings.Contains(row, "unavailable · openrouter is not connected") {
+		t.Fatalf("an unreachable pin is not marked: %q", row)
+	}
+}
+
+// A NARROW WINDOW DROPS THE HINTS FIRST AND CLIPS NOTHING.
+func TestCrewAtANarrowWidth(t *testing.T) {
+	a, _ := crewLab(t)
+	a.width = 56
+	typeLine(t, a, "/crew")
+	for _, line := range plainOverlay(a) {
+		if w := ansi.StringWidth(line); w > a.width {
+			t.Fatalf("a line runs to %d cells on a %d-cell frame: %q", w, a.width, line)
+		}
+		if strings.Contains(line, "usually") || strings.Contains(line, "likely") {
+			t.Fatalf("a narrow frame kept the hint: %q", line)
+		}
+		if strings.Contains(line, "…") {
+			t.Fatalf("a narrow frame clipped a row: %q", line)
+		}
+	}
+}
+
+// ── undo ────────────────────────────────────────────────────────────────────
+
+// Z PUTS THE ROWS BACK, and only while the offer is on the edge.
+func TestCrewUndoIsAWindow(t *testing.T) {
+	a, dir := crewLab(t)
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	j.keys("down", "down", "down", "right")
+	j.keys("z")
+	if got := config.CrewAllowedAt(dir).String(); got != "all" {
+		t.Fatalf("undo left the rule at %q", got)
+	}
+	j.keys("right")
+	later := a.now().Add(crewUndoFor + time.Second)
+	a.clock = func() time.Time { return later }
+	if strings.Contains(crewScreen(a), crewUndoWord) {
+		t.Fatal("the undo offer outlived its window")
+	}
+	j.keys("z")
+	if got := config.CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("a late z undid the change: %q", got)
+	}
+}
+
+// ── the pointer, the keys, the shortcuts, settings ──────────────────────────
+
+// A PRESS ON A ROW IS ENTER ON IT, and a press on an arrow walks the row.
+func TestCrewTakesThePointer(t *testing.T) {
+	a, dir := crewLab(t)
+	typeLine(t, a, "/crew")
+	crewClick(t, a, "checker", "checker")
+	if a.crewUI.view != crewPicking || a.crewUI.pick.seat != crewroute.Checker {
+		t.Fatal("a press on the checker did not open its list")
+	}
+	drive(t, a, key("esc"))
+	crewClick(t, a, "models", "›")
+	if got := config.CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("a press on › wrote %q", got)
+	}
+	crewClick(t, a, "models", "‹")
+	if got := config.CrewAllowedAt(dir).String(); got != "all" {
+		t.Fatalf("a press on ‹ wrote %q", got)
+	}
+}
+
+// crewClick presses the drawn line holding line, on the cell where at is.
+func crewClick(t *testing.T, a *app, line, at string) {
+	t.Helper()
+	_, height := a.size()
+	frameLines := strings.Split(plain(mustFrame(a)), "\n")
+	for y := 0; y < height && y < len(frameLines); y++ {
+		mark, ok := a.chromeAt(y)
+		if !ok || mark.kind != chromeOverlay || !strings.Contains(frameLines[y], line) {
+			continue
+		}
+		x := strings.Index(frameLines[y], at)
+		if at == "›" {
+			x = strings.LastIndex(frameLines[y], at)
+		}
+		x = ansi.StringWidth(frameLines[y][:x])
+		drive(t, a, tea.MouseClickMsg{X: x, Y: y, Button: tea.MouseLeft})
+		return
+	}
+	t.Fatalf("no panel line holds %q:\n%s", line, strings.Join(frameLines, "\n"))
+}
+
+// ? IS THE KEY LIST, the pointer's gestures included.
+func TestCrewKeysView(t *testing.T) {
+	a, _ := crewLab(t)
+	typeLine(t, a, "/crew")
+	drive(t, a, key("?"))
+	screen := crewScreen(a)
+	for _, want := range []string{"enter", "esc", "click", "wheel", "undo"} {
+		if !strings.Contains(screen, want) {
+			t.Errorf("the key list does not say %q:\n%s", want, screen)
+		}
+	}
+	drive(t, a, key("esc"))
+	if a.crewUI.view != crewMain {
+		t.Fatal("esc on the key list did not come back")
+	}
+}
+
+// A SHORTCUT WRITES THE SAME ROW AND OPENS THE PANEL WITH THE TICK ON IT.
+func TestCrewShortcutOpensThePanelOnItsRow(t *testing.T) {
+	a, _ := crewLab(t)
+	typeLine(t, a, "/crew pin checker moonshotai/kimi-k3")
+	if !a.crewUI.open || a.crewUI.cursor != 2 {
+		t.Fatalf("the shortcut did not open the panel on the checker (open %v, cursor %d)", a.crewUI.open, a.crewUI.cursor)
+	}
+	if row := crewLineWith(t, crewScreen(a), "checker"); !strings.Contains(row, a.icon(tokens.GSettled)) {
+		t.Fatalf("the changed row has no tick: %q", row)
+	}
+}
+
+// SETTINGS HAS ONE `seats` ROW WHERE THE THREE SEAT ROWS WERE, and it opens
+// the panel; esc on the panel comes back to it.
+func TestSettingsSeatsRowOpensTheCrewPanel(t *testing.T) {
+	a, _ := crewLab(t)
+	a.openSettings()
+	for settingTabs[a.sheet.tab] != tabProviders {
+		a.sheet.tabBy(1)
+	}
+	door := -1
+	for i, item := range a.sheet.items {
+		if item.crewDoor {
+			door = i
+		}
+		if item.row.Key != "" && crewSeatKey(item.row.Key) {
+			t.Fatalf("the Providers tab still draws the seat row %s", item.row.Key)
+		}
+	}
+	if door < 0 {
+		t.Fatal("the Providers tab has no seats row")
+	}
+	a.sheet.cursor = door
+	runCmd(a.activate())
+	if !a.crewUI.open || a.at(pageSettings) {
+		t.Fatal("the seats row did not open the crew panel")
+	}
+	drive(t, a, key("esc"))
+	if !a.at(pageSettings) || settingTabs[a.sheet.tab] != tabProviders || a.sheet.cursor != door {
+		t.Fatalf("esc did not come back to the seats row (settings %v, tab %s, cursor %d)",
+			a.at(pageSettings), settingTabs[a.sheet.tab], a.sheet.cursor)
+	}
+	// AND A SEARCH FOR A SEAT FINDS THE ONE DOOR.
+	typeText(t, a, "checker")
+	found := false
+	for _, item := range a.sheet.items {
+		if item.crewDoor {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("a search for the checker does not find the seats row")
+	}
+}
+
+// crewLineWith is the one line of a block holding want.
+func crewLineWith(t *testing.T, screen, want string) string {
+	t.Helper()
+	for _, line := range strings.Split(screen, "\n") {
+		if strings.Contains(line, want) {
+			return line
+		}
+	}
+	t.Fatalf("no line holds %q:\n%s", want, screen)
+	return ""
+}
+
+// THE CREW'S MARKS ARE DRAWN BY EVERY TERMINAL: with the rich icon tier on, the
+// panel's pin, ticks and rings are still the plain tier's, because a terminal
+// without the font draws a private-use codepoint as a blank cell — a pinned
+// checker that reads as "checker  kimi-k3".
+func TestTheCrewPanelDrawsNoPrivateUseMarks(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	a.iconMode = config.IconsRich
+	a.settleIcons()
+	j := &crewJourney{t: t, a: a}
+	j.open()
+	screen := crewScreen(a)
+	for _, r := range screen {
+		if (r >= 0xE000 && r <= 0xF8FF) || r >= 0xF0000 {
+			t.Fatalf("the panel draws %U, a private-use mark:\n%s", r, screen)
+		}
+	}
+	if !strings.Contains(screen, tokens.Plain.Glyph(tokens.GPinned)) || !strings.Contains(screen, tokens.Plain.Glyph(tokens.GSettled)) {
+		t.Errorf("the panel does not draw the plain pin and tick:\n%s", screen)
+	}
+}
diff --git a/internal/tui3/crewproviders_test.go b/internal/tui3/crewproviders_test.go
new file mode 100644
index 0000000000..52bef4999e
--- /dev/null
+++ b/internal/tui3/crewproviders_test.go
@@ -0,0 +1,401 @@
+package tui3
+
+import (
+	"strings"
+	"testing"
+
+	modelcatalog "github.com/Agent-Field/codeaf/internal/catalog"
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/modelsource"
+	"github.com/Agent-Field/codeaf/internal/router"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
+)
+
+// THE PROVIDERS ROW, DRIVEN: the chips walked and toggled, the last one on
+// refused, a pin left on a provider turned off, the models count following,
+// the `+` handing over to /connect, the row read back from the profile and
+// undone, the fold at a narrow width, and the list enter opens.
+
+// crewProvidersLab is [crewLab] with four connections: the OpenRouter key, the
+// Z.ai coding plan, a local Ollama and a custom endpoint — one of each kind a
+// chip says.
+func crewProvidersLab(t *testing.T) (*app, string) {
+	t.Helper()
+	a, dir := crewLab(t)
+	custom := config.PrepareCustomSource(dir, "http://127.0.0.1:9001/v1", "my-vllm")
+	custom.Key, custom.Order = "sk-my-vllm-0123456789", 3
+	if err := config.WriteSources(dir, []config.PersistedSource{
+		{ID: "z-ai", Written: "z-ai", Key: "zai-key-0123456789", Door: "coding-plan", Order: 1},
+		{ID: "ollama", Written: "ollama", Order: 2},
+		custom,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return a, dir
+}
+
+// crewToProviders opens the panel with the cursor on the providers row.
+func crewToProviders(t *testing.T, a *app) {
+	t.Helper()
+	if !a.crewUI.open {
+		typeLine(t, a, "/crew")
+	}
+	for i := 0; a.crewUI.cursor != crewProviders; i++ {
+		if !a.crewUI.open || a.crewUI.view != crewMain || i > crewStops {
+			t.Fatalf("the panel never reached the providers row:\n%s", crewScreen(a))
+		}
+		drive(t, a, key("down"))
+	}
+}
+
+// crewChipOf is the index of one provider's chip.
+func crewChipOf(t *testing.T, a *app, id string) int {
+	t.Helper()
+	for i, provider := range a.crewUI.providers {
+		if provider.ID == id {
+			return i
+		}
+	}
+	t.Fatalf("no chip for %s among %+v", id, a.crewUI.providers)
+	return -1
+}
+
+// ←/→ WALK THE CHIPS AND SPACE TOGGLES THE ONE UNDER THE CURSOR: the row goes
+// ○ and dim, wears the tick, offers the undo, and the profile holds the row —
+// read back by a panel opened afresh — until z puts it back.
+func TestCrewProvidersToggleAndUndo(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	crewToProviders(t, a)
+	if footer := crewScreen(a); !strings.Contains(footer, crewChipKeys) {
+		t.Fatalf("the footer on the providers row does not offer space:\n%s", footer)
+	}
+	drive(t, a, key("right"))
+	if a.crewUI.chip != crewChipOf(t, a, "z-ai") {
+		t.Fatalf("→ left the cursor on chip %d", a.crewUI.chip)
+	}
+	drive(t, a, key(" "))
+	if off := config.CrewProvidersOffAt(dir); !off["z-ai"] || len(off) != 1 {
+		t.Fatalf("space wrote %v", off)
+	}
+	row := crewLineWith(t, crewScreen(a), "providers")
+	if !strings.Contains(row, a.icon(tokens.GQueued)+" z-ai sub") || !strings.HasSuffix(strings.TrimRight(strings.TrimSuffix(row, "│"), " "), a.icon(tokens.GSettled)) {
+		t.Fatalf("the row does not show z-ai off and the tick: %q", row)
+	}
+	if !strings.Contains(crewScreen(a), crewUndoWord) {
+		t.Fatal("a toggle offers no undo")
+	}
+	// PERSISTED: a panel opened afresh reads it off the profile.
+	drive(t, a, key("esc"))
+	typeLine(t, a, "/crew")
+	if row := crewLineWith(t, crewScreen(a), "providers"); !strings.Contains(row, a.icon(tokens.GQueued)+" z-ai") {
+		t.Fatalf("a reopened panel reads %q", row)
+	}
+	crewToProviders(t, a)
+	drive(t, a, key("right"), key(" "), key("z"))
+	if off := config.CrewProvidersOffAt(dir); !off["z-ai"] {
+		t.Fatalf("undo of turning it back on reads %v", off)
+	}
+	drive(t, a, key(" "))
+	if off := config.CrewProvidersOffAt(dir); len(off) != 0 {
+		t.Fatalf("turning the last one back on left %v", off)
+	}
+	// AND THE FOOTER SAYS SPACE ONLY THERE.
+	drive(t, a, key("down"))
+	if screen := crewScreen(a); strings.Contains(screen, "space toggle") {
+		t.Fatalf("the cap row's footer offers space:\n%s", screen)
+	}
+}
+
+// THE LAST PROVIDER ON STAYS ON, refused under the rows in the writer's words.
+func TestCrewProvidersRefuseTheLastOne(t *testing.T) {
+	a, dir := crewLab(t)
+	crewToProviders(t, a)
+	drive(t, a, key(" "))
+	if off := config.CrewProvidersOffAt(dir); len(off) != 0 {
+		t.Fatalf("the last provider was turned off: %v", off)
+	}
+	screen := crewScreen(a)
+	if !strings.Contains(screen, config.ErrCrewLastProvider.Error()) {
+		t.Fatalf("the refusal was not said:\n%s", screen)
+	}
+	if strings.Contains(screen, crewUndoWord) {
+		t.Fatal("a refused toggle offers an undo")
+	}
+}
+
+// A PIN WHOSE ONLY PROVIDER IS OFF SAYS SO on its seat, and the models row
+// counts only what a provider still on serves.
+func TestCrewProvidersOffWarnsThePinAndNarrowsTheCount(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "z-ai/glm-5.3-flash@z-ai"); err != nil {
+		t.Fatal(err)
+	}
+	crewToProviders(t, a)
+	if row := crewLineWith(t, crewScreen(a), "models"); !strings.Contains(row, "(4)") {
+		t.Fatalf("the models row reads %q", row)
+	}
+	drive(t, a, key("right"), key(" "))
+	if row := crewLineWith(t, crewScreen(a), "checker"); !strings.Contains(row, crewProviderOff) {
+		t.Fatalf("the pin on z-ai does not say its provider is off: %q", row)
+	}
+	// Z.ai back on, OpenRouter off: only the plan's own model is served.
+	drive(t, a, key(" "), key("left"), key(" "))
+	if off := config.CrewProvidersOffAt(dir); !off["openrouter"] || len(off) != 1 {
+		t.Fatalf("the row reads %v", off)
+	}
+	screen := crewScreen(a)
+	if row := crewLineWith(t, screen, "models"); !strings.Contains(row, "(1)") {
+		t.Fatalf("the models row does not count what the providers on serve: %q", row)
+	}
+	if row := crewLineWith(t, screen, "checker"); strings.Contains(row, crewProviderOff) {
+		t.Fatalf("the pin warns with its provider back on: %q", row)
+	}
+	for _, c := range config.CrewCandidatesAt(dir) {
+		for _, r := range c.Routes {
+			if r.Provider == "openrouter" {
+				t.Fatalf("%s is still routed through openrouter", c.Model.ID)
+			}
+		}
+	}
+}
+
+// THE `+` IS /connect: the panel goes and the connect list comes up.
+func TestCrewProvidersPlusOpensConnect(t *testing.T) {
+	a, _ := crewLab(t)
+	a.modelCatalog = []modelsource.Source{{ID: "deepseek", Name: "DeepSeek", Written: "deepseek"}}
+	crewToProviders(t, a)
+	drive(t, a, key("right"))
+	if a.crewUI.chip != len(a.crewUI.providers) {
+		t.Fatalf("→ did not reach the + (chip %d)", a.crewUI.chip)
+	}
+	drive(t, a, key(" "))
+	if a.crewUI.open || !a.connPanel.open {
+		t.Fatalf("the + left crew open %v, connect open %v", a.crewUI.open, a.connPanel.open)
+	}
+	// ESC ON /connect COMES BACK to the crew panel, on the providers row.
+	drive(t, a, key("esc"))
+	if a.connPanel.open || !a.crewUI.open || a.crewUI.cursor != crewProviders || a.crewUI.chip != len(a.crewUI.providers) {
+		t.Fatalf("esc on /connect left connect %v, crew %v, cursor %d, chip %d",
+			a.connPanel.open, a.crewUI.open, a.crewUI.cursor, a.crewUI.chip)
+	}
+	// AND /connect opened on its own still just closes.
+	drive(t, a, key("esc"))
+	a.openConnect()
+	drive(t, a, key("esc"))
+	if a.connPanel.open || a.crewUI.open {
+		t.Fatal("esc on a /connect the crew panel did not open brought the crew panel up")
+	}
+}
+
+// A NARROW PROVIDERS LIST KEEPS THE STATE WORD: the day goes first, then the
+// model count, then the kind, and nothing is cut.
+func TestCrewProvidersListNarrow(t *testing.T) {
+	for _, width := range []int{60, 44, 34} {
+		a, _ := crewProvidersLab(t)
+		a.width = width
+		crewToProviders(t, a)
+		drive(t, a, key("enter"))
+		screen := crewScreen(a)
+		for _, id := range []string{"openrouter", "z-ai", "ollama", "my-vllm"} {
+			line := crewLineWith(t, screen, " "+id+" ")
+			if strings.Contains(line, "…") || !(strings.Contains(line, " on ") || strings.Contains(line, " off ")) {
+				t.Errorf("at %d columns the %s line reads %q", width, id, line)
+			}
+		}
+		if width == 60 && (strings.Contains(screen, "nothing today") || !strings.Contains(screen, "subscription")) {
+			t.Errorf("at 60 columns the day should go first and the kind stay:\n%s", screen)
+		}
+	}
+}
+
+// A SEAT NOTHING ALLOWED CAN SIT IS THE ONE WARNING: the weak-checker gap
+// beside it would be the smaller half of the same trouble. And a day of one
+// task says `1 task`.
+func TestCrewWarningsAndTheDay(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewAllowed(dir, "vendor/nothing-here"); err != nil {
+		t.Fatal(err)
+	}
+	record := router.CrewRecord{TaskClass: "bugfix", Seats: map[string]string{"worker": "z-ai/glm-5.3-flash"}}
+	router.LogCrewDecision(config.ProfilePath(dir, ""), "crew:one", record, nil)
+	router.LogCrewOutcome(config.ProfilePath(dir, ""), "crew:one", record, router.CrewAccepted, 0.01)
+	typeLine(t, a, "/crew")
+	screen := crewScreen(a)
+	if !strings.Contains(screen, "nothing allowed can sit this seat") {
+		t.Fatalf("the empty rule is not said on a seat:\n%s", screen)
+	}
+	if strings.Contains(screen, "strong checker") {
+		t.Fatalf("the gap warning stands beside nothing allowed:\n%s", screen)
+	}
+	if !strings.Contains(screen, "· 1 task") || strings.Contains(screen, "1 tasks") {
+		t.Fatalf("one task is not said as one:\n%s", screen)
+	}
+}
+
+// ENTER ON THE MODELS ROW STEPS IT, as → does, until price or custom, where
+// it opens what that answer holds.
+func TestCrewEnterStepsTheModelsRow(t *testing.T) {
+	a, dir := crewLab(t)
+	typeLine(t, a, "/crew")
+	drive(t, a, key("down"), key("down"), key("down"), key("enter"))
+	if got := config.CrewAllowedAt(dir).String(); got != "open" {
+		t.Fatalf("enter on all stepped to %q", got)
+	}
+	drive(t, a, key("enter"))
+	if got := config.CrewAllowedAt(dir).String(); got != "≤1/5" {
+		t.Fatalf("enter on open stepped to %q", got)
+	}
+	drive(t, a, key("enter"))
+	if a.crewUI.edit == nil {
+		t.Fatal("enter on price did not open its ceiling")
+	}
+}
+
+// A PRESS ON A CHIP TOGGLES IT; a press on the row's name opens the list.
+func TestCrewProvidersTakeThePointer(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	typeLine(t, a, "/crew")
+	crewClick(t, a, "providers", "ollama")
+	if off := config.CrewProvidersOffAt(dir); !off["ollama"] {
+		t.Fatalf("a press on the ollama chip wrote %v", off)
+	}
+	crewClick(t, a, "providers", "providers")
+	if a.crewUI.view != crewProviding {
+		t.Fatal("a press on the row's name did not open the list")
+	}
+}
+
+// A NARROW WINDOW FOLDS THE CHIPS INTO THEIR COUNT, and space there opens the
+// list rather than toggling a chip nobody can see.
+func TestCrewProvidersFoldWhenNarrow(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	a.width = 56
+	crewToProviders(t, a)
+	row := crewLineWith(t, crewScreen(a), "providers")
+	if !strings.Contains(row, "4 of 4 on") || strings.Contains(row, "ollama") {
+		t.Fatalf("a narrow row reads %q", row)
+	}
+	drive(t, a, key("right"), key(" "))
+	if len(config.CrewProvidersOffAt(dir)) != 0 {
+		t.Fatal("space on a folded row toggled a chip")
+	}
+	if a.crewUI.view != crewProviding {
+		t.Fatal("space on a folded row did not open the list")
+	}
+}
+
+// THE LIST TOGGLES TOO, ticks the line that changed, undoes with z, and esc
+// comes back to the row on the provider it was on.
+func TestCrewProvidersList(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	crewToProviders(t, a)
+	drive(t, a, key("enter"))
+	if a.crewUI.view != crewProviding {
+		t.Fatal("enter on the providers row did not open the list")
+	}
+	drive(t, a, key("down"), key("down"), key("enter"))
+	if off := config.CrewProvidersOffAt(dir); !off["ollama"] {
+		t.Fatalf("enter on ollama wrote %v", off)
+	}
+	screen := crewScreen(a)
+	if line := crewLineWith(t, screen, "ollama"); !strings.Contains(line, "off") || !strings.Contains(line, a.icon(tokens.GSettled)) {
+		t.Fatalf("the ollama line reads %q", line)
+	}
+	if !strings.Contains(screen, crewUndoWord) {
+		t.Fatalf("the list offers no undo:\n%s", screen)
+	}
+	drive(t, a, key("z"))
+	if off := config.CrewProvidersOffAt(dir); len(off) != 0 {
+		t.Fatalf("z in the list left %v", off)
+	}
+	drive(t, a, key("esc"))
+	if a.crewUI.view != crewMain || a.crewUI.cursor != crewProviders || a.crewUI.chip != crewChipOf(t, a, "ollama") {
+		t.Fatalf("esc came back to view %v cursor %d chip %d", a.crewUI.view, a.crewUI.cursor, a.crewUI.chip)
+	}
+}
+
+// THE FREE ROUTES ARE THE LIST'S LAST LINE, off until turned on, with the
+// tick and the undo every other change has — and never on the main rows.
+func TestCrewProvidersListFreeRoutes(t *testing.T) {
+	a, dir := crewLab(t)
+	crewToProviders(t, a)
+	if strings.Contains(crewScreen(a), crewFreeRoutesWord) {
+		t.Fatal("the free routes are drawn on the main rows")
+	}
+	drive(t, a, key("enter"), key("end"))
+	if line := crewLineWith(t, crewScreen(a), crewFreeRoutesWord); !strings.Contains(line, "off · "+crewFreeRoutesWhy) {
+		t.Fatalf("the free routes line reads %q", line)
+	}
+	drive(t, a, key("enter"))
+	if !config.CrewFreeRoutesAt(dir) {
+		t.Fatal("enter on the free routes did not turn them on")
+	}
+	drive(t, a, key("z"))
+	if config.CrewFreeRoutesAt(dir) {
+		t.Fatal("z left the free routes on")
+	}
+	if strings.Contains(crewLineWith(t, crewScreen(a), crewFreeRoutesWord), " on ") {
+		t.Fatal("the line did not come back off")
+	}
+}
+
+// THE SETTINGS SEATS ROW COUNTS THE PROVIDERS ON.
+func TestSettingsSeatsRowCountsProviders(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	if err := config.SetCrewProviderOn(dir, "ollama", false); err != nil {
+		t.Fatal(err)
+	}
+	a.openSettings()
+	item := a.sheet.crewDoorItem(nil)
+	if !strings.Contains(item.crewValue, "3 of 4 providers") {
+		t.Fatalf("the seats row reads %q", item.crewValue)
+	}
+}
+
+// ── the seat list's filter ──────────────────────────────────────────────────
+
+// A NAME IS FOUND FROM ITS FRONT: a prefix outranks a word inside, which
+// outranks anywhere inside, and a row the letters only match scattered is
+// left out while anything matched better.
+func TestCrewSeatFilterRanksByTier(t *testing.T) {
+	a, _ := crewLab(t)
+	rows := config.CrewCatalog()
+	for _, id := range []string{"x-ai/grok-imagine-2", "krea/krea-2-medium", "google/gemma-4", "z-ai/glm-5.3", "mistral/deepnote-0"} {
+		rows = append(rows, modelcatalog.Model{ID: id, PromptPrice: 1e-7, CompletionPrice: 1e-7, Parameters: []string{"tools"}})
+	}
+	config.CrewCatalog = func() []modelcatalog.Model { return rows }
+	cases := []struct {
+		typed string
+		first []string
+		never []string
+	}{
+		{"kim", []string{"moonshotai/kimi-k3"}, []string{"grok-imagine", "krea-2-medium"}},
+		{"glm", []string{"glm-5.3"}, []string{"gemma-4"}},
+		{"deep", []string{"deepseek/deepseek-v4-flash", "mistral/deepnote-0"}, nil},
+	}
+	for _, tc := range cases {
+		typeLine(t, a, "/crew")
+		drive(t, a, key("enter"))
+		typeText(t, a, tc.typed)
+		k := a.crewUI.pick
+		var got []string
+		for _, at := range k.hits {
+			got = append(got, k.rows[at].offer.Model.ID)
+		}
+		for i, want := range tc.first {
+			if i >= len(got) || !strings.Contains(got[i], want) {
+				t.Errorf("%q ranks %v, want %v first", tc.typed, got, tc.first)
+				break
+			}
+		}
+		for _, id := range got {
+			for _, never := range tc.never {
+				if strings.Contains(id, never) {
+					t.Errorf("%q lists %s among %v", tc.typed, id, got)
+				}
+			}
+		}
+		drive(t, a, key("esc"), key("esc"))
+	}
+}
diff --git a/internal/tui3/crewseat_test.go b/internal/tui3/crewseat_test.go
deleted file mode 100644
index bfa50afb2f..0000000000
--- a/internal/tui3/crewseat_test.go
+++ /dev/null
@@ -1,306 +0,0 @@
-package tui3
-
-import (
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/Agent-Field/codeaf/internal/config"
-	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
-)
-
-// A CREW OLDER THAN THE WORK SEAT, MET IN THE CONVERSATION (#312).
-//
-// #311 gave the headless doors the rung and the line. This surface had neither:
-// a profile written before the worker row existed (#278) handed every task
-// started from the thread to the build's own worker model, and the thread, the
-// rail and the header all said nothing — on the surface where most tasks are
-// started and where there is no `models:` line to carry the word.
-//
-// The line is the SAME line the run prints, said ONCE, at the moment work
-// actually starts on the seat, and the /crew sheet says which of its rows was
-// never written. Both halves are asserted here, and so is the silence on every
-// profile the line is not about.
-
-// crewSeatLab is a surface with a profile of a stated vintage behind it.
-func crewSeatLab(t *testing.T, rows map[string]string) *app {
-	t.Helper()
-	dir := t.TempDir()
-	raw, err := json.Marshal(rows)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(config.BudgetConfigPath(dir), raw, 0o600); err != nil {
-		t.Fatal(err)
-	}
-	a := newTestApp(&fakeAgent{model: "openai/gpt-4.1-mini"})
-	a.profileDir = dir
-	// The app this suite builds has the question pinned as already asked
-	// (tui3_test.go says why); this one has a profile of a stated vintage and is
-	// asking it on purpose.
-	a.workSeatSaid = false
-	return a
-}
-
-// preSeatCrew is the shape a crew applied before the worker row existed has on
-// disk: the four rows there were, and no fifth key.
-var preSeatCrew = map[string]string{
-	config.KeyTierReflexModel:     "vendor/pinned-reflex",
-	config.KeyTierLowModel:        "vendor/pinned-small-work",
-	config.KeyTierHighModel:       "vendor/pinned-careful",
-	config.KeyTierMastermindModel: "vendor/pinned-thinking",
-}
-
-// THE LINE IS SAID ONCE, WHEN THE FIRST NODE STARTS WORKING.
-//
-// Not at the launch — a person who hands nothing off never meets this seat — and
-// not per task, which is the noise the headless half refused for the same
-// reason: a warning that arrives with all of a run's work is one somebody learns
-// to read past, which leaves them exactly where the silence did.
-func TestTheInheritedWorkSeatIsSaidOnceInTheThread(t *testing.T) {
-	a := crewSeatLab(t, preSeatCrew)
-	notice := config.TierSeatAt(a.profileDir, config.ModelTierWorker).Notice()
-	if notice == "" {
-		t.Fatal("the fixture's work seat is not inherited, so this test is about nothing")
-	}
-
-	if got := notesSaying(a, notice); got != 0 {
-		t.Fatalf("the line was said %d times before any work started", got)
-	}
-	a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-	if got := notesSaying(a, notice); got != 1 {
-		t.Fatalf("the first running node said the line %d times, want once", got)
-	}
-	// A second task, a second node of the same task, and the same node updating
-	// again are all the same seat spending the same money.
-	a.taskUpdate(oneRunningNode(42, "porting the parser"))
-	a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-	if got := notesSaying(a, notice); got != 1 {
-		t.Fatalf("two task starts said the line %d times, want once for the session", got)
-	}
-
-	// AND IT IS THE RUN'S OWN SENTENCE, so a person meets one voice on either
-	// surface (internal/config's seats.go).
-	if !strings.Contains(notice, "your crew was set before the work seat existed") {
-		t.Fatalf("the line has been respelled: %q", notice)
-	}
-}
-
-// AND EVERY OTHER SHAPE HEARS NOTHING. The line is a fact about a profile older
-// than a seat, not decoration on a task starting: a row somebody pinned, a row
-// they cleared on purpose and a profile that has said nothing are all answers,
-// and none of them is this one.
-func TestNoOtherProfileIsToldItsWorkSeatWasInherited(t *testing.T) {
-	for name, rows := range map[string]map[string]string{
-		"a pinned worker row": {
-			config.KeyTierLowModel:    "vendor/pinned-small-work",
-			config.KeyTierWorkerModel: "vendor/pinned-worker",
-		},
-		"a worker row cleared on purpose": {
-			config.KeyTierLowModel:    "vendor/pinned-small-work",
-			config.KeyTierWorkerModel: "",
-		},
-		"a profile that has said nothing": {},
-	} {
-		t.Run(name, func(t *testing.T) {
-			a := crewSeatLab(t, rows)
-			a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-			for _, entry := range a.entries {
-				if entry.kind == entryNote && strings.Contains(entry.text, "your crew was set before") {
-					t.Fatalf("%s was told about an inheritance that did not happen: %q", name, entry.text)
-				}
-			}
-			if line := a.crewInheritedLine(); line != "" {
-				t.Fatalf("%s: the crew sheet claims a row it did not inherit: %q", name, line)
-			}
-		})
-	}
-}
-
-// A CONNECTION READS NOBODY'S SEATS. Over --host the crew lives on the far
-// machine and this window's profile is the laptop's, so a line built from it
-// would be a fact about the wrong computer — which is the refusal /crew itself
-// opens with ([app.runCrew]).
-func TestAConnectedSurfaceSaysNothingAboutTheFarMachinesSeats(t *testing.T) {
-	a := crewSeatLab(t, preSeatCrew)
-	a.host = "elsewhere"
-	a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-	if seat := a.workSeat(); seat.Model != "" || seat.Source != "" {
-		t.Fatalf("a connected window seated %q (%s) off the laptop's profile", seat.Model, seat.Source)
-	}
-	if line := a.crewInheritedLine(); line != "" {
-		t.Fatalf("a connected window drew %q on the crew sheet", line)
-	}
-	for _, entry := range a.entries {
-		if entry.kind == entryNote && strings.Contains(entry.text, "your crew was set before") {
-			t.Fatalf("a connected window said %q about the far machine's work", entry.text)
-		}
-	}
-}
-
-// THE /crew SHEET SAYS WHICH ROW IS NOT YOURS, at every width the sheet is
-// drawn at. A receipt in the thread is the moment; the sheet is where somebody
-// goes to check afterwards, and a sheet that showed the inherited row as though
-// the person had pinned it would be the crew word disagreeing with the work.
-func TestTheCrewSheetShowsAnInheritedWorkSeatAtEveryWidth(t *testing.T) {
-	for _, width := range []int{80, 120} {
-		a := crewSeatLab(t, preSeatCrew)
-		a.width, a.height = width, 30
-		a.pal = newPalette(tokens.ANSI256, false)
-		a.runCrew("")
-		if !a.crewPick.open {
-			t.Fatalf("%d columns: /crew opened no chooser", width)
-		}
-		screen := plain(frame(a))
-		if !strings.Contains(screen, "inherited") {
-			t.Fatalf("%d columns: the crew sheet does not say the work row was inherited:\n%s", width, screen)
-		}
-		if !strings.Contains(screen, "small work") {
-			t.Fatalf("%d columns: the sheet does not name the row a person would go and find:\n%s", width, screen)
-		}
-		// The chooser's height and its rows are one arithmetic: a line the rows
-		// draw and the height does not count is a line that eats the row above it.
-		if got, want := len(a.crewPick.rows(width, a.crewPick.height(), a.pal, -1, a)), a.crewPick.height(); got != want {
-			t.Fatalf("%d columns: the chooser drew %d rows and promised %d", width, got, want)
-		}
-	}
-}
-
-// AND PICKING A CREW ENDS IT, which is the promise the line makes. Every preset
-// writes all five rows, so the row that was inherited is a row the person wrote
-// from that moment on, and neither surface says anything more about it.
-func TestPickingACrewWritesTheRowThatWasInherited(t *testing.T) {
-	a := crewSeatLab(t, preSeatCrew)
-	if a.crewInheritedLine() == "" {
-		t.Fatal("the fixture's work seat is not inherited, so this test is about nothing")
-	}
-	a.applyCrew(config.CrewFrugal)
-	if seat := a.workSeat(); seat.Source != config.SeatCrew {
-		t.Fatalf("after /crew frugal the work seat reads %q (%s)", seat.Model, seat.Source)
-	}
-	if line := a.crewInheritedLine(); line != "" {
-		t.Fatalf("the crew sheet still claims an inherited row: %q", line)
-	}
-	if notice := a.workSeat().Notice(); notice != "" {
-		t.Fatalf("the thread would still say %q", notice)
-	}
-}
-
-// THE SEAT THE CONVERSATION READS IS THE SEAT ITS TASKS RUN ON. The role map the
-// door builds resolves the worker row through the same call this surface asks
-// for its line, so the sentence and the work cannot be about two models
-// (cmd/codeaf's v3Crew, and internal/config's TestEveryReadOfATierRowGoesThroughTheLadder).
-func TestTheWorkSeatTheSheetNamesIsTheModelTheWorkerRowResolvesTo(t *testing.T) {
-	a := crewSeatLab(t, preSeatCrew)
-	seat := a.workSeat()
-	if got := config.TierModelAt(a.profileDir, config.ModelTierWorker); got != seat.Model {
-		t.Fatalf("the work seat says %q and the worker row resolves to %q", seat.Model, got)
-	}
-	if seat.Model != preSeatCrew[config.KeyTierLowModel] {
-		t.Fatalf("the work seat runs on %q, want the small-work model the person pinned", seat.Model)
-	}
-	if seat.Model == config.DefaultWorkerModel {
-		t.Fatalf("the work seat fell to the build's default with a whole crew written above it")
-	}
-}
-
-// ── the flag that overrides the crew ────────────────────────────────────────
-//
-// THE STATUS LINE NAMES WHAT SEATS THE CALL (#444).
-//
-// A canary run under `--one-model` on exactly the profile above read `crew
-// custom` for its whole life and, when the first task started, was told its crew
-// was set before the work seat existed and was running on its small work model
-// "until you pick a crew again". Both sentences are true about the file on disk
-// and false about the run: the flag empties the roles source and the task model
-// at the door, so the four rows seat nothing and picking a crew would have
-// changed nothing either.
-
-// oneModelSeatLab is [crewSeatLab] with the launch's flag on, which is the one
-// difference between the two halves below.
-func oneModelSeatLab(t *testing.T, rows map[string]string) *app {
-	t.Helper()
-	a := crewSeatLab(t, rows)
-	a.oneModel = true
-	return a
-}
-
-// UNDER THE FLAG EVERY CREW SURFACE NAMES THE FLAG, AND NO SEAT IS PROMISED.
-//
-// The five readings come through one function on purpose (crew.go's
-// [app.crewReading]), so this asserts all five: if one of them ever grows a
-// second source, this is where it says so.
-func TestUnderOneModelTheCrewSurfacesNameTheFlagAndNoSeatReceiptIsPosted(t *testing.T) {
-	a := oneModelSeatLab(t, preSeatCrew)
-	a.model = "deepseek/deepseek-v4-flash"
-
-	if got := a.crewSegment(); got != crewOneModelSegment {
-		t.Errorf("the status line's crew segment reads %q, want %q", got, crewOneModelSegment)
-	}
-	if got := a.crewWord(); got != crewOneModelWord {
-		t.Errorf("the page's crew word reads %q, want %q", got, crewOneModelWord)
-	}
-	if a.crewHint() != a.crewSegment() {
-		t.Errorf("the picker's hint says %q and the segment says %q", a.crewHint(), a.crewSegment())
-	}
-	if got := a.welcomeModelLine(); !strings.Contains(got, crewOneModelSegment) || strings.Contains(got, "crew") {
-		t.Errorf("the welcome line reads %q, want the flag beside the model and no preset", got)
-	}
-	// AND NOT ONE OF THEM READS THE PRESET the four rows still derive to. The
-	// rows are untouched on disk — that is the flag's own promise — so the word
-	// they make is the one thing this run must not print.
-	a.slash("/status")
-	page := lastNote(t, a)
-	if got := noteFact(page, "crew"); got != crewOneModelWord {
-		t.Errorf("/status reads %q rather than the same word:\n%s", got, page)
-	}
-	if strings.Contains(page, config.CrewCustom) {
-		t.Errorf("/status names the crew the flag overrode:\n%s", page)
-	}
-	if line := plain(a.legend(200)); strings.Contains(line, "crew "+config.CrewCustom) {
-		t.Errorf("the status line still draws the overridden crew:\n%q", line)
-	}
-
-	// AND THE RECEIPT IS NOT OWED. It reports a SUBSTITUTION, and the flag is
-	// the person's own answer to the question it asks.
-	a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-	for _, entry := range a.entries {
-		if entry.kind == entryNote && strings.Contains(entry.text, "your crew was set before") {
-			t.Fatalf("a run under --one-model was promised a crew that seats nothing: %q", entry.text)
-		}
-	}
-	if seat := a.workSeat(); seat.Model != "" || seat.Source != "" {
-		t.Errorf("the flag left a work seat of %q (%s)", seat.Model, seat.Source)
-	}
-	if line := a.crewInheritedLine(); line != "" {
-		t.Errorf("the /crew sheet claims an inherited row under the flag: %q", line)
-	}
-}
-
-// AND WITHOUT THE FLAG THE SAME PROFILE IS TOLD EXACTLY WHAT IT WAS BEFORE.
-// The #311/#314 behaviour is not what was wrong here, and this is the half that
-// says so: one profile, one difference, two readings.
-func TestWithoutOneModelTheSameProfileStillDrawsItsCrewAndSaysTheSeatOnce(t *testing.T) {
-	a := crewSeatLab(t, preSeatCrew)
-	a.model = "deepseek/deepseek-v4-flash"
-
-	if got, want := a.crewSegment(), "crew "+config.CrewCustom; got != want {
-		t.Errorf("the status line's crew segment reads %q, want %q", got, want)
-	}
-	if got := a.crewWord(); !strings.HasPrefix(got, config.CrewCustom+" ·") {
-		t.Errorf("the page's crew word reads %q, want the preset the four rows derive to", got)
-	}
-	if strings.Contains(a.crewWord(), crewOneModelSegment) {
-		t.Errorf("a launch that never typed the flag reads %q", a.crewWord())
-	}
-
-	a.taskUpdate(oneRunningNode(41, "widening the sluice"))
-	notice := config.TierSeatAt(a.profileDir, config.ModelTierWorker).Notice()
-	if notice == "" {
-		t.Fatal("the fixture's work seat is not inherited, so this test is about nothing")
-	}
-	if got := notesSaying(a, notice); got != 1 {
-		t.Fatalf("the receipt was said %d times, want once for the session", got)
-	}
-}
diff --git a/internal/tui3/crewsnap_test.go b/internal/tui3/crewsnap_test.go
new file mode 100644
index 0000000000..bf5de4cfa2
--- /dev/null
+++ b/internal/tui3/crewsnap_test.go
@@ -0,0 +1,241 @@
+package tui3
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/config"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
+	"github.com/Agent-Field/codeaf/internal/router"
+	"github.com/Agent-Field/codeaf/internal/tui2/tokens"
+)
+
+// THE CREW PANEL'S SCREENS, PINNED WORD FOR WORD. Each is the plain text of the
+// block exactly as the overlay draws it at one width, over the catalog crewLab
+// routes on, so a change to what any of them says — a column moved, a word
+// respelled, a warning that grew a second copy — fails here and prints both
+// screens. The marks are the vocabulary's, asked of the surface ({pin}, {tick},
+// {fail}, {star}, {off}), because which repertoire draws them is the terminal's
+// business and not the screen's. The paint is not pinned: the tests beside
+// these assert colour where colour is the subject.
+
+// crewSnap compares a screen against the one it is pinned to.
+func crewSnap(t *testing.T, a *app, name, want string) {
+	t.Helper()
+	want = strings.NewReplacer(
+		"{pin}", a.icon(tokens.GPinned), "{tick}", a.icon(tokens.GSettled),
+		"{fail}", a.icon(tokens.GFailed), "{star}", a.icon(tokens.GRecommended), "{off}", a.icon(tokens.GQueued),
+	).Replace(strings.TrimPrefix(want, "\n"))
+	if got := crewScreen(a); got != want {
+		t.Fatalf("the %s screen moved.\n--- got ---\n%s\n--- want ---\n%s", name, got, want)
+	}
+}
+
+func TestCrewSnapshotPanel(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	typeLine(t, a, "/crew")
+	crewSnap(t, a, "panel", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│› worker    auto · likely glm-5.3-flash                                                           │
+│  planner   auto · likely glm-5.3-flash                                                           │
+│  checker   {pin} kimi-k3                                                                             │
+│                                                                                                  │
+│  models    ‹ all › (4)                                                                           │
+│  providers {tick} openrouter  +                                                                       │
+│  cap       per task $5 · daily none                                                              │
+╰─ enter change · esc close · ? keys ──────────────────────────────────────────────────────────────╯`)
+}
+
+// A WEAK PINNED CHECKER IS WARNED ABOUT BY NAME, under the rows, however strong
+// the other allowed models are: the pin is what runs.
+func TestCrewSnapshotWeakPinnedChecker(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "deepseek/deepseek-v4-flash"); err != nil {
+		t.Fatal(err)
+	}
+	typeLine(t, a, "/crew")
+	crewSnap(t, a, "weak pinned checker", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│› worker    auto · likely glm-5.3-flash                                                           │
+│  planner   auto · likely glm-5.3-flash                                                           │
+│  checker   {pin} deepseek-v4-flash                                                                   │
+│                                                                                                  │
+│  models    ‹ all › (4)                                                                           │
+│  providers {tick} openrouter  +                                                                       │
+│  cap       per task $5 · daily none                                                              │
+│  checker pinned to deepseek-v4-flash · open-ended work will be checked weakly                    │
+╰─ enter change · esc close · ? keys ──────────────────────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotSeatList(t *testing.T) {
+	a, _ := crewLab(t)
+	typeLine(t, a, "/crew")
+	drive(t, a, key("enter"))
+	crewSnap(t, a, "seat list", `
+╭─ crew · worker ──────────────────────────────────────────────────────────────────────────── esc ─╮
+│›   auto — codeaf picks per task                                                                  │
+│  {star} z-ai/glm-5.3-flash  $0.15/$0.50 · openrouter · suggested                                      │
+│    anthropic/claude-opus-5  $5/$25 · openrouter                                                  │
+│    deepseek/deepseek-v4-flash  $0.08/$0.16 · openrouter                                          │
+│    moonshotai/kimi-k3  $3/$15 · openrouter                                                       │
+╰─ type to filter · enter pick · → routes · esc back ──────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotRefusal(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewAllowed(dir, "open"); err != nil {
+		t.Fatal(err)
+	}
+	typeLine(t, a, "/crew")
+	drive(t, a, key("enter"))
+	typeText(t, a, "opus")
+	drive(t, a, key("enter"))
+	crewSnap(t, a, "refusal", `
+╭─ crew · worker ──────────────────────────────────────────────────────────────────────────── esc ─╮
+│›   anthropic/claude-opus-5  $5/$25 · openrouter · not allowed                                    │
+│  {fail} claude-opus-5 is not in your allowed models (open) — enter to allow it                        │
+╰─ type to filter · enter pick · → routes · esc back ──────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotPriceBeingTyped(t *testing.T) {
+	a, _ := crewLab(t)
+	typeLine(t, a, "/crew")
+	drive(t, a, key("down"), key("down"), key("down"), key("right"), key("right"), key("enter"), key("ctrl+u"))
+	typeText(t, a, "0.5")
+	crewSnap(t, a, "price being typed", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│  worker    auto · likely glm-5.3-flash                                                           │
+│  planner   auto · likely glm-5.3-flash                                                           │
+│  checker   auto · likely glm-5.3-flash                                                           │
+│                                                                                                  │
+│› models    ‹ price ›  ≤ $[ 0.5 ] in / $[ 5 ] out (2)  {tick}                                          │
+│  providers {tick} openrouter  +                                                                       │
+│  cap       per task $5 · daily none                                                              │
+╰─ enter change · esc close · ? keys ──────────────────────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotChecklist(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewAllowed(dir, "≤1/5"); err != nil {
+		t.Fatal(err)
+	}
+	typeLine(t, a, "/crew")
+	drive(t, a, key("down"), key("down"), key("down"), key("right"), key("enter"))
+	crewSnap(t, a, "checklist", `
+╭─ crew · allowed models · 2 of 4 ─────────────────────────────────────────────────────────── esc ─╮
+│› {tick} z-ai/glm-5.3-flash  $0.15/$0.50                                                               │
+│    moonshotai/kimi-k3  $3/$15                                                                    │
+│  {tick} deepseek/deepseek-v4-flash  $0.08/$0.16                                                       │
+│    anthropic/claude-opus-5  $5/$25                                                               │
+╰─ type to filter · space or enter tick · esc back ────────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotNarrow(t *testing.T) {
+	a, dir := crewLab(t)
+	if err := config.SetCrewPin(dir, crewroute.Checker, "moonshotai/kimi-k3"); err != nil {
+		t.Fatal(err)
+	}
+	a.width = 56
+	typeLine(t, a, "/crew")
+	crewSnap(t, a, "narrow", `
+╭─ crew ───────────────────────────────────────── esc ─╮
+│› worker    auto                                      │
+│  planner   auto                                      │
+│  checker   {pin} kimi-k3                                 │
+│                                                      │
+│  models    ‹ all › (4)                               │
+│  providers {tick} openrouter  +                           │
+│  cap       per task $5 · daily none                  │
+╰─ enter change · esc close · ? keys ──────────────────╯`)
+}
+
+func TestCrewSnapshotNoProviders(t *testing.T) {
+	a, _ := crewLab(t)
+	t.Setenv(config.APIKeyEnv, "")
+	typeLine(t, a, "/crew")
+	crewSnap(t, a, "no providers", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│› worker    auto                                                                                  │
+│  planner   auto                                                                                  │
+│  checker   auto                                                                                  │
+│                                                                                                  │
+│  models    ‹ all › (0)                                                                           │
+│  providers +                                                                                     │
+│  cap       per task $5 · daily none                                                              │
+│  no providers connected — /connect adds one                                                      │
+╰─ enter change · esc close · ? keys ──────────────────────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotUndoOffer(t *testing.T) {
+	a, _ := crewLab(t)
+	typeLine(t, a, "/crew")
+	drive(t, a, key("down"), key("down"), key("down"), key("right"))
+	crewSnap(t, a, "undo offer", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│  worker    auto · likely glm-5.3-flash                                                           │
+│  planner   auto · likely glm-5.3-flash                                                           │
+│  checker   auto · likely glm-5.3-flash                                                           │
+│                                                                                                  │
+│› models    ‹ open › (3)  {tick}                                                                       │
+│  providers {tick} openrouter  +                                                                       │
+│  cap       per task $5 · daily none                                                              │
+╰─ enter change · esc close · ? keys ───────────────────────────────────────────────────── z undo ─╯`)
+}
+
+func TestCrewSnapshotProvidersRow(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	if err := config.SetCrewProviderOn(dir, "ollama", false); err != nil {
+		t.Fatal(err)
+	}
+	crewToProviders(t, a)
+	crewSnap(t, a, "providers row", `
+╭─ crew ───────────────────────────────────────────────────────────────────────────────────── esc ─╮
+│  worker    auto · likely glm-5.3-flash                                                           │
+│  planner   auto · likely glm-5.3-flash                                                           │
+│  checker   auto · likely glm-5.3-flash                                                           │
+│                                                                                                  │
+│  models    ‹ all › (4)                                                                           │
+│› providers {tick} openrouter  {tick} z-ai sub  {off} ollama local  {tick} my-vllm  +                                │
+│  cap       per task $5 · daily none                                                              │
+╰─ enter change · space toggle · esc close · ? keys ───────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotProvidersList(t *testing.T) {
+	a, dir := crewProvidersLab(t)
+	if err := config.SetCrewProviderOn(dir, "ollama", false); err != nil {
+		t.Fatal(err)
+	}
+	// A task whose worker and planner rode OpenRouter and whose checker rode the
+	// plan: the whole of its cost is OpenRouter's.
+	record := router.CrewRecord{TaskClass: "bugfix", Seats: map[string]string{"worker": "a", "planner": "b", "checker": "c"},
+		Providers: map[string]string{"worker": "openrouter", "planner": "openrouter", "checker": "z-ai"},
+		Kinds:     map[string]string{"worker": "metered", "planner": "metered", "checker": "plan"}}
+	router.LogCrewDecision(config.ProfilePath(dir, ""), "crew:snap", record, nil)
+	router.LogCrewOutcome(config.ProfilePath(dir, ""), "crew:snap", record, router.CrewAccepted, 0.21)
+	crewToProviders(t, a)
+	drive(t, a, key("enter"))
+	crewSnap(t, a, "providers list", `
+╭─ crew · providers · 3 of 4 on ───────────────────────────────────────────────────────────── esc ─╮
+│› {tick} openrouter  api key          4 models  · today $0.210   on                                    │
+│  {tick} z-ai        subscription     1 model   · nothing today  on                                    │
+│  {off} ollama      local            0 models  · nothing today  off                                   │
+│  {tick} my-vllm     custom endpoint  pins only · nothing today  on                                    │
+│                                                                                                  │
+│  free routes  off · rate-limited, may log prompts                                                │
+╰─ space or enter toggle · esc back ───────────────────────────────────────────────────────────────╯`)
+}
+
+func TestCrewSnapshotFreeRoutesOn(t *testing.T) {
+	a, _ := crewLab(t)
+	crewToProviders(t, a)
+	drive(t, a, key("enter"), key("down"), key(" "))
+	crewSnap(t, a, "free routes on", `
+╭─ crew · providers · 1 of 1 on ───────────────────────────────────────────────────────────── esc ─╮
+│  {tick} openrouter  api key  4 models · nothing today  on                                             │
+│                                                                                                  │
+│› free routes  on · rate-limited, may log prompts  {tick}                                              │
+╰─ space or enter toggle · esc back ────────────────────────────────────────────────────── z undo ─╯`)
+}
diff --git a/internal/tui3/detach.go b/internal/tui3/detach.go
index a4be4be1a6..42e311a54b 100644
--- a/internal/tui3/detach.go
+++ b/internal/tui3/detach.go
@@ -377,6 +377,7 @@ func (a *app) clearConversation() {
 	// are drawings rather than questions.
 	a.dropHarnessAsks()
 	a.harnPanel = harnessPanel{}
+	a.crewUI = crewPanel{}
 	a.harnessStep = ""
 	// And the picked harness with them: a chip is a choice about the NEXT
 	// message of this conversation (harnesspick.go).
diff --git a/internal/tui3/effortchip.go b/internal/tui3/effortchip.go
index e725cb9e1d..a1d0d14d97 100644
--- a/internal/tui3/effortchip.go
+++ b/internal/tui3/effortchip.go
@@ -435,8 +435,8 @@ func (a *app) modelOwnLevel() string {
 // effortMenu is the six-row chooser the chip opens: auto and then the whole
 // ladder, cheapest first, with the rung in force marked.
 //
-// Its zero value is closed, like [crewPicker], whose shape this is — a fixed,
-// bottom-anchored list with no filter, because six words is a thing you read
+// Its zero value is closed, like [picker] — a fixed, bottom-anchored list with
+// no filter, because six words is a thing you read
 // rather than a thing you search.
 type effortMenu struct {
 	open   bool
@@ -661,7 +661,7 @@ func (a *app) openEffortMenu() {
 
 // effortMenuKey routes one keypress while the chooser is up. It takes EVERY key,
 // which is the idiom the fixed bottom-anchored lists on this surface keep
-// (crew.go's [app.crewPickerKey], input.go's router): a plain letter typed into
+// (input.go's router): a plain letter typed into
 // the box under a list a person is reading is a letter they have to find and
 // delete afterwards. ctrl+c is excepted upstream, as it is for every modal here.
 func (a *app) effortMenuKey(msg tea.KeyPressMsg) tea.Cmd {
diff --git a/internal/tui3/feed.go b/internal/tui3/feed.go
index 9e82311730..98279fb1eb 100644
--- a/internal/tui3/feed.go
+++ b/internal/tui3/feed.go
@@ -1329,6 +1329,23 @@ func (f *feed) noteWritten(text string, block bool, facts []string) {
 	f.touch()
 }
 
+// renote rewrites the newest note saying old to say text instead, IN PLACE —
+// the line keeps its place in the thread, which is what a line that is one
+// fact still being settled wants (a task's crew line, crew.go). It answers
+// false when no note says old, and the caller then says text as a new note.
+func (f *feed) renote(old, text string, facts []string) bool {
+	for i := len(f.entries) - 1; i >= 0; i-- {
+		e := &f.entries[i]
+		if e.kind != entryNote || e.text != old {
+			continue
+		}
+		e.text, e.facts, e.stale = text, facts, true
+		f.touch()
+		return true
+	}
+	return false
+}
+
 // ── AN ATTEMPT THAT NEVER HAPPENED ──────────────────────────────────────────
 
 // retry is a cut request being asked again (internal/provider's streamguard.go).
diff --git a/internal/tui3/firstrun.go b/internal/tui3/firstrun.go
index f28ce5156e..90b08c9430 100644
--- a/internal/tui3/firstrun.go
+++ b/internal/tui3/firstrun.go
@@ -19,9 +19,10 @@ import (
 // said was a provider error. Now the door lets that launch open with no key
 // (cmd/codeaf's chatv3.go) and this screen asks for what a first day needs, in
 // TWO steps: the key every model call rides, and then one screen of controls —
-// the day's spending limit, the model you talk to, and the crew codeaf works
-// with. Under a minute; every control opens on the value already in force; the
-// way out is `Start a conversation`.
+// the day's spending limit and the model you talk to. The crew is not asked:
+// a task's crew is picked per task, and /crew is where it is seen. Under a
+// minute; every control opens on the value already in force; the way out is
+// `Start a conversation`.
 //
 // THE SECOND STEP IS ONE SCREEN AND NOT THREE QUESTIONS. It used to be a crew
 // chooser followed by a rails screen carrying three money rows, which is five
@@ -39,7 +40,7 @@ import (
 //     different because it is not a preference: with no key the default model
 //     provider cannot work, so its one-step connection returns on a later local
 //     interactive launch until it is answered.
-//   - IT ASKS ONLY WHAT IS MISSING. A key in the shell, a crew already chosen,
+//   - IT ASKS ONLY WHAT IS MISSING. A key in the shell, a model already chosen,
 //     a ceiling already written — each drops its step. A person who has some of
 //     it configured sees only the rest, and one who has all of it sees nothing.
 //   - IT STEALS NO KEYSTROKE FROM A CONVERSATION. The first-run questions open
@@ -54,9 +55,9 @@ import (
 // is what it shows before that, and the box's arrival animation starts fresh the
 // moment this screen goes ([app.endSetup]).
 //
-// Every write goes through the settings registry rows — the key row, the crew
-// row, the daily budget row — so what this screen lands in the profile is
-// byte-for-byte what /settings, /crew and a hand edit would have landed, and
+// Every write goes through the settings registry rows — the key row, the chat
+// model row, the daily budget row — so what this screen lands in the profile is
+// byte-for-byte what /settings, /model and a hand edit would have landed, and
 // changing any of it later is those three doors.
 
 // setupStep is one of the two questions.
@@ -92,11 +93,6 @@ type setupFlow struct {
 	//     viewport and a filter over the WHOLE catalog rather than a truncation
 	//     of it, because a form with five rows must still reach two hundred
 	//     models.
-	//   - crewOpen and crewAt are the crew chooser's cursor, which is
-	//     PROVISIONAL; crewPick is the preset a person actually accepted with
-	//     enter, and is empty until they do. That is what makes esc out of the
-	//     chooser choose nothing, and what stops `Start a conversation` writing a
-	//     preset over somebody's hand-pinned tiers.
 	//   - reviewOpen is the optional reading of the settings this screen
 	//     deliberately does not ask about, example is which illustration the
 	//     right-hand column is showing, and seeded says the screen has already
@@ -110,10 +106,6 @@ type setupFlow struct {
 	modelAt    int
 	modelTop   int
 	modelFind  string
-	crewOpen   bool
-	crewAt     int
-	crewPick   string
-	crewSource string
 	reviewOpen bool
 	example    int
 	seeded     bool
@@ -143,23 +135,20 @@ type setupFlow struct {
 // setupSteps is which of the two questions this conversation still needs
 // answered, in the order they are asked. The provider question uses the same
 // answer as enter, so setup cannot ask for a default-service key a connected
-// service carrying this conversation does not need. The controls keep using
-// internal/config's own predicates, so the screen cannot ask for a crew /crew
-// would already report.
+// service carrying this conversation does not need.
 //
-// THE CONTROLS SCREEN IS ONE STEP AND SO IT IS ASKED AS ONE. It carries three
-// controls and it opens when EITHER of the two persisted ones is still unwritten
-// — a profile that has a crew and no limit is shown both, with the crew already
-// on the value it chose, because a screen that dropped the row a person had
-// answered would read as a different screen every time it opened. The chat model
-// is not in the condition: it resolves from the build and from CODEAF_MODEL until
-// somebody chooses, so a profile is never MISSING one.
+// THE CONTROLS SCREEN IS ONE STEP AND SO IT IS ASKED AS ONE. It carries two
+// controls and it opens while the persisted one — the daily limit — is still
+// unwritten. The chat model is not in the condition: it resolves from the
+// build and from CODEAF_MODEL until somebody chooses, so a profile is never
+// MISSING one. The crew is not in it either: a task's crew is picked per task
+// and asks nothing up front.
 func (a *app) setupSteps() []setupStep {
 	steps := make([]setupStep, 0, 2)
 	if a.defaultProviderNeeded() {
 		steps = append(steps, setupKey)
 	}
-	if !config.CrewConfigured(a.profileDir) || !config.DailyBudgetConfigured(a.profileDir) {
+	if !config.DailyBudgetConfigured(a.profileDir) {
 		steps = append(steps, setupControls)
 	}
 	return steps
@@ -185,7 +174,7 @@ func (a *app) setupSteps() []setupStep {
 //
 // THE HOSTED WINDOW IS THE ONE THAT KEEPS ITS EARLY RETURN, and it is the whole
 // of what the old guard was reaching for. What this screen writes — a key, a
-// crew, three spending rails, the marker saying it was shown — lands in the
+// chat model, a spending rail, the marker saying it was shown — lands in the
 // profile of the machine the AGENT is on, and over --host that machine is not
 // this one. A form here would write this laptop's answers about somebody else's
 // session, so a connection is asked nothing.
@@ -250,7 +239,7 @@ func (a *app) endSetup(skipped bool) tea.Cmd {
 	a.cancelSetupAuth()
 	// THE QUESTIONS THIS ESC WALKED PAST GET A DOOR. `setup_seen_at` is stamped
 	// whichever way this screen ended and only the key-only form ever reopens,
-	// so the crew and the day's limit are retired here — silently, until this
+	// so the chat model and the day's limit are retired here — silently, until this
 	// line. It names the step ON SCREEN and the ones under it, because esc left
 	// that one unanswered too, and nothing a person already answered.
 	var later []string
@@ -305,7 +294,7 @@ const setupNoKeyWord = "no openrouter key yet · paste one into /settings, or ex
 // flow. It is a constant because it was SIX spellings of one key and one of them
 // disagreed with the other five: the browser-connect step said `esc not now`,
 // which reads as a promise that the question comes back, and esc on any step
-// stamps `setup_seen_at` and the crew and budget questions never open again
+// stamps `setup_seen_at` and the model and budget questions never open again
 // ([app.endSetup]).
 const setupSkipKeysWord = "esc skips setup"
 
@@ -672,7 +661,7 @@ const (
 // THE TEST IS STRUCTURAL AND NOT A GUESS AT THE PROSE. Every refusal the
 // registry authors is a plain fmt.Errorf with nothing wrapped inside it —
 // `that's not a dollar amount — a number, or none for no limit`,
-// `pick one of: frugal, balanced, max`, `OpenRouter key is set by
+// `pick one of: on, off`, `OpenRouter key is set by
 // OPENROUTER_API_KEY` — while every failure that came off the disk is wrapped
 // around the operating system's own error (internal/config's
 // writeProfileValues wraps each one with %w). So an error that wraps another
diff --git a/internal/tui3/firstrun_test.go b/internal/tui3/firstrun_test.go
index 916696c0bd..81ca4d0fc4 100644
--- a/internal/tui3/firstrun_test.go
+++ b/internal/tui3/firstrun_test.go
@@ -105,15 +105,12 @@ func TestTheSetupOpensOverAnEmptyProfileAndNotOverAConfiguredOne(t *testing.T) {
 		if err := config.WriteAPIKey(dir, "sk-or-v1-0123456789abcdef"); err != nil {
 			t.Fatal(err)
 		}
-		if err := config.ApplyCrew(dir, config.CrewFrugal); err != nil {
-			t.Fatal(err)
-		}
 		if err := config.WriteDailyBudgetUSD(dir, 9); err != nil {
 			t.Fatal(err)
 		}
 	})
 	if b.setup.open {
-		t.Fatal("a profile with all three answered must not be asked")
+		t.Fatal("a profile with the key and the limit answered must not be asked")
 	}
 	if config.SetupSeenAt(dir).IsZero() {
 		t.Fatal("a launch with nothing to ask still records that the setup was met")
@@ -268,7 +265,7 @@ func TestTakingTheControlsAsTheyStandLandsTheDefaultsInTheProfile(t *testing.T)
 	screen := setupScreen(a)
 	for _, want := range []string{
 		"Models and spending", "Keep these choices or change them.",
-		"Daily limit", "Chat model", "Work crew", "Start a conversation",
+		"Daily limit", "Chat model", "Start a conversation",
 	} {
 		if !strings.Contains(screen, want) {
 			t.Fatalf("the controls screen must say %q; got:\n%s", want, screen)
@@ -280,26 +277,28 @@ func TestTakingTheControlsAsTheyStandLandsTheDefaultsInTheProfile(t *testing.T)
 	if want := "$" + setupBudgetDefault(); !strings.Contains(screen, want) {
 		t.Fatalf("the limit must show %s, the amount it will keep; got:\n%s", want, screen)
 	}
-	// THE THREE ONE-LINE EXPLANATIONS ARE ON THE SCREEN, all three at once,
-	// because they are what makes three unfamiliar words into three decisions.
-	for _, want := range []string{controlLimitWord, controlModelWord, controlCrewWord} {
+	// THE ONE-LINE EXPLANATIONS ARE ON THE SCREEN, both at once, because they
+	// are what makes unfamiliar words into decisions.
+	for _, want := range []string{controlLimitWord, controlModelWord} {
 		if !strings.Contains(screen, strings.Join(strings.Fields(want), " ")) {
 			t.Fatalf("the controls screen must explain itself with %q; got:\n%s", want, screen)
 		}
 	}
 
 	// tab down to `Start a conversation`, and take it.
-	pressSetup(a, key("tab"), key("tab"), key("tab"), key("tab"))
+	pressSetup(a, key("tab"), key("tab"), key("tab"))
 	if a.setup.control != controlStart {
-		t.Fatalf("four tabs from the limit reach the way out, got %v", a.setup.control)
+		t.Fatalf("three tabs from the limit reach the way out, got %v", a.setup.control)
 	}
 	pressSetup(a, key("enter"))
 	if a.setup.open {
 		t.Fatal("enter on `Start a conversation` closes the setup")
 	}
 
-	if !config.CrewConfigured(dir) || config.CrewAt(dir) != config.CrewBalanced {
-		t.Fatalf("taking the crew as it stands must write balanced; profile reads %q", config.CrewAt(dir))
+	// AND THE CREW IS NOT WRITTEN: it is auto, picked per task, and nothing
+	// on this screen answers it.
+	if pins := config.CrewPinsAt(dir); len(pins) != 0 {
+		t.Fatalf("taking the controls pinned a seat: %v", pins)
 	}
 	if !config.DailyBudgetConfigured(dir) {
 		t.Fatal("taking the limit as it stands must write it into the profile")
@@ -350,7 +349,7 @@ func TestATypedOrPastedKeyIsWrittenAndHandedToTheSession(t *testing.T) {
 		t.Fatalf("the running session must be handed the key once, got %v", *handed)
 	}
 	// And on the controls screen a typed amount replaces the figure that was
-	// drawn, and the crew chosen in the list is the one that lands.
+	// drawn.
 	if a.setup.step() != setupControls {
 		t.Fatalf("a written key goes on to the controls; step = %v", a.setup.step())
 	}
@@ -361,18 +360,10 @@ func TestATypedOrPastedKeyIsWrittenAndHandedToTheSession(t *testing.T) {
 	if rail, _ := config.DailyBudgetUSDAt(dir); rail != 7.5 {
 		t.Fatalf("a typed ceiling replaces the default, profile reads %v", rail)
 	}
-	pressSetup(a, key("tab"))
-	if a.setup.control != controlCrew {
-		t.Fatalf("the focus is on %v, want the crew", a.setup.control)
-	}
-	pressSetup(a, key("enter"), key("down"), key("enter"))
-	pressSetup(a, key("tab"), key("tab"), key("enter"))
+	pressSetup(a, key("tab"), key("tab"), key("tab"), key("enter"))
 	if a.setup.open {
 		t.Fatalf("`Start a conversation` did not finish the flow: %s", a.setup.refusal)
 	}
-	if config.CrewAt(dir) != config.CrewMax {
-		t.Fatalf("↓ then enter takes the next preset; profile reads %q", config.CrewAt(dir))
-	}
 	for _, e := range a.entries {
 		if e.kind == entryNote && strings.Contains(e.text, "no openrouter key") {
 			t.Fatal("a profile with a key gets no note about a missing one")
@@ -412,8 +403,8 @@ func TestEscSkipsTheWholeFlowAndWritesNothingButTheMarker(t *testing.T) {
 	if cmd == nil || a.welcome.step != 0 {
 		t.Fatal("the box's arrival starts from its first frame when the setup goes")
 	}
-	if config.CrewConfigured(dir) || config.DailyBudgetConfigured(dir) || config.APIKeyConfigured(dir) {
-		t.Fatal("skipping writes none of the three")
+	if len(config.CrewPinsAt(dir)) != 0 || config.DailyBudgetConfigured(dir) || config.APIKeyConfigured(dir) {
+		t.Fatal("skipping writes none of them")
 	}
 	if config.SetupSeenAt(dir).IsZero() {
 		t.Fatal("skipping counts as shown")
diff --git a/internal/tui3/homefate_test.go b/internal/tui3/homefate_test.go
index 31661ce692..1f09bf5d82 100644
--- a/internal/tui3/homefate_test.go
+++ b/internal/tui3/homefate_test.go
@@ -69,8 +69,9 @@ func TestTheFateReadsTheArgumentWhereItChangesTheAnswer(t *testing.T) {
 	}{
 		{"standing", "", fatePlace},
 		{"standing", "keep the tests green", fateNeedsChat},
-		{"crew", "", fateNeedsChat},
-		{"crew", "frugal", fateAnswers},
+		{"crew", "", fateCrew},
+		{"crew", "cap 5", fateCrew},
+		{"redo", "stronger", fateNeedsChat},
 		{"task", "", fatePlace},
 		{"task", "port the parser", fateNeedsChat},
 		{"memory", "", fatePlace},
diff --git a/internal/tui3/homeslash.go b/internal/tui3/homeslash.go
index aeff45f401..542cc0c6b9 100644
--- a/internal/tui3/homeslash.go
+++ b/internal/tui3/homeslash.go
@@ -138,6 +138,8 @@ const (
 //	opens a conversation here first      it opens one AT THE TARGET (homedraft.go)
 //	                                     and runs there, the door `enter` uses
 //	answers here                         a note, echoed onto home's own line
+//	opens the crew panel                 /crew, bare or a shortcut — home steps
+//	                                     aside for it and esc comes back
 //	runs on the conversation behind home  /land /workspace — and they say so
 //	a fresh conversation behind home     /new
 //	closes the conversation behind home  /quit
@@ -158,6 +160,7 @@ const (
 	fateTray         = "onto home's tray"
 	fateNeedsChat    = "opens a conversation here first"
 	fateAnswers      = "answers here"
+	fateCrew         = "opens the crew panel"
 	fateBehind       = "runs on the conversation behind home"
 	fateFresh        = "a fresh conversation behind home"
 	fateQuit         = "closes the conversation behind home"
@@ -169,10 +172,9 @@ const (
 // may touch a disk or a door; and the test that walks [commands] can then ask it
 // about every row without an app.
 //
-// THE ARGUMENT IS PART OF THE QUESTION, because four commands mean two different
+// THE ARGUMENT IS PART OF THE QUESTION, because three commands mean two different
 // things with and without one: `/standing` is a page and `/standing <words>`
-// raises a card in a conversation; `/crew` is a picker and `/crew frugal` is a
-// note; `/task` is the task page and `/task <brief>` starts work; `/memory` is
+// raises a card in a conversation; `/task` is the task page and `/task <brief>` starts work; `/memory` is
 // the place and `/memory <query>` prints. A table keyed on the name alone would
 // send a person to the wrong one of each pair. The drop-up asks with the row's
 // own placeholder ([command.args]), which is empty on exactly the bare rows.
@@ -229,11 +231,15 @@ func homeFate(word, rest string) string {
 		}
 		return fateNeedsChat
 	case "crew":
-		// Bare it is a picker this screen cannot draw; with a word it is a note.
-		if rest == "" {
-			return fateNeedsChat
-		}
-		return fateAnswers
+		// THE PANEL AND ITS FOUR SHORTCUTS ALL OPEN THE PANEL — the bare form to
+		// change something, a shortcut to show what it changed — and a place
+		// cannot draw an overlay, so every form steps off home onto the
+		// conversation behind it, and esc on the panel steps back (crewpanel.go).
+		return fateCrew
+	case "redo":
+		// A redo runs a task this conversation started again, so there has to
+		// be one.
+		return fateNeedsChat
 	case "effort":
 		// BOTH FORMS NEED A CONVERSATION, and that is what tells this apart from
 		// /crew and /model. The crew is the machine's, the model has a target
@@ -333,7 +339,7 @@ func (a *app) homeSlash(line string) tea.Cmd {
 		return tea.Batch(started, a.slash(line))
 	}
 	// AND THE ANSWER OF EVERYTHING ELSE IS ECHOED WHERE IT WAS TYPED. /help,
-	// /status, /cost, /crew frugal, /budget 20 and `there is no command called
+	// /status, /cost, /crew, /budget 20 and `there is no command called
 	// /x · / lists them` all answer with a note, which lands in the conversation
 	// behind this screen — true, kept, and unreadable until you leave. The flag
 	// puts the first line of it on home's own message line as well
diff --git a/internal/tui3/homeslash_test.go b/internal/tui3/homeslash_test.go
index 0b6305beb1..d59b7d68dc 100644
--- a/internal/tui3/homeslash_test.go
+++ b/internal/tui3/homeslash_test.go
@@ -476,14 +476,15 @@ func TestShowPageClosesEveryModalOnTheWayIn(t *testing.T) {
 	a := lab.app(mine)
 
 	a.pick.open, a.roster.open, a.shelf.open = true, true, true
-	a.crewPick.open, a.effPick.open = true, true
+	a.effPick.open = true
 	a.connPanel.open, a.harnPanel.open, a.permPanel.open, a.subPage.open = true, true, true, true
+	a.crewUI.open = true
 	runCmd(a.showPage(pageHome))
 	for name, open := range map[string]bool{
 		"a.pick": a.pick.open, "a.roster": a.roster.open, "a.shelf": a.shelf.open,
-		"a.crewPick": a.crewPick.open, "a.effPick": a.effPick.open,
+		"a.effPick":   a.effPick.open,
 		"a.connPanel": a.connPanel.open, "a.harnPanel": a.harnPanel.open,
-		"a.permPanel": a.permPanel.open, "a.subPage": a.subPage.open,
+		"a.permPanel": a.permPanel.open, "a.subPage": a.subPage.open, "a.crewUI": a.crewUI.open,
 	} {
 		if open {
 			t.Errorf("%s survived a place standing up; it will appear over whatever esc lands on", name)
diff --git a/internal/tui3/host_test.go b/internal/tui3/host_test.go
index 927851c181..7b57c8c3b2 100644
--- a/internal/tui3/host_test.go
+++ b/internal/tui3/host_test.go
@@ -249,7 +249,7 @@ func TestCommandsWithoutAFarDoorNameTheMachineAndTouchNoLocalState(t *testing.T)
 	}{
 		{"cache", func() { a.runCacheCommand("clean now") }},
 		{"permissions", a.openPermissions},
-		{"crew", func() { a.runCrew("frugal") }},
+		{"crew", func() { a.runCrew("cap 5") }},
 		{"memories", func() { a.runMemories("") }},
 		{"memory query", func() { a.runMemories("Ada") }},
 		{"remember", func() { a.runRemember("Ada likes tea") }},
diff --git a/internal/tui3/input.go b/internal/tui3/input.go
index ce7d70a19e..3e9db4386a 100644
--- a/internal/tui3/input.go
+++ b/internal/tui3/input.go
@@ -514,10 +514,6 @@ func (a *app) key(msg tea.KeyPressMsg) tea.Cmd {
 	if a.pick.open && msg.String() != "ctrl+c" {
 		return a.pickerKey(msg)
 	}
-	if a.crewPick.open && msg.String() != "ctrl+c" {
-		a.crewPickerKey(msg)
-		return nil
-	}
 	// AND THE THINKING CHOOSER IS MODAL ON THE CREW CHOOSER'S TERMS AND FOR ITS
 	// REASON (effortchip.go): it is five fixed words with no filter under them, so
 	// a plain letter falling through to the box would be a letter typed into a
@@ -564,6 +560,13 @@ func (a *app) key(msg tea.KeyPressMsg) tea.Cmd {
 		return a.harnessPanelKey(msg)
 	}
 
+	// And the crew panel, on those panels' terms exactly (crewpanel.go): opened
+	// by a command, nothing typed under it — its filters and holes are its own —
+	// and esc stepping back one level at a time until it closes.
+	if a.crewUI.open && msg.String() != "ctrl+c" {
+		return a.crewKey(msg)
+	}
+
 	// And the permissions panel, which is those panels' twin (permissions.go):
 	// opened by a command, nothing typed under it, esc leaves exactly as it was.
 	// Modal also frees a bare d to mean "drop this line" — no draft is under it
@@ -1679,6 +1682,19 @@ func (a *app) inputBlockUnfloored(width int) ([]string, int, int) {
 			return draftBlock(&a.connPanel.filter, a.pal, width, 1, connectFilterHint, "")
 		}
 	}
+	// AND THE CREW PANEL'S TWO LISTS TAKE IT ON THE SAME TERMS: the seat list's
+	// filter and the checklist's are this surface's one-line box, in the place
+	// /model's filter stands (crewpanel.go). A hole on one of its rows is typed
+	// on the row itself, and the caret then has no box to live in and is hidden,
+	// on the law the /connect panel's choice follows above.
+	if a.crewUI.open {
+		if box := a.crewBox(); box != nil {
+			return draftBlock(box, a.pal, width, 1, crewPickHint, "")
+		}
+		if a.crewUI.edit != nil {
+			a.caret = false
+		}
+	}
 	// AND WHERE THE DRAFT ITSELF WOULD BE, ONE DIM LINE WHEN ANOTHER WINDOW HAS
 	// THE KEYBOARD (watching.go). It is read HERE, under every overlay above and
 	// over the draft below, because that is exactly what it is: a stand-in for
diff --git a/internal/tui3/manualcmd_test.go b/internal/tui3/manualcmd_test.go
index 50bbd535ee..4f907578df 100644
--- a/internal/tui3/manualcmd_test.go
+++ b/internal/tui3/manualcmd_test.go
@@ -3,8 +3,6 @@ package tui3
 import (
 	"strings"
 	"testing"
-
-	"github.com/Agent-Field/codeaf/internal/config"
 )
 
 // manualSent runs one /manual form through the dispatch, the way the loop
@@ -103,25 +101,24 @@ func TestManualOnHomeOpensAConversationAndAsksThere(t *testing.T) {
 	}
 }
 
-// THE ROW COUNTS THE SEATS THE CODE ACTUALLY SETS. Both /crew rows said "four"
-// for as long as [config.CrewModels] set five, and the seat they left out was
-// the worker — the one that pays most of a task's bill. A hand-written number
-// beside a table that owns it is a claim that drifts, so this reads the table.
-func TestTheCrewRowsCountTheSeatsConfigSets(t *testing.T) {
-	seats, ok := config.CrewModels(config.DefaultCrew)
-	if !ok {
-		t.Fatalf("config has no crew preset named %q", config.DefaultCrew)
-	}
-	counted := map[int]string{4: "four", 5: "five", 6: "six"}[len(seats)]
-	if counted == "" {
-		t.Fatalf("the crew now has %d seats and nothing here can spell that", len(seats))
-	}
+// THE /crew ROWS NAME THE THREE SEATS A PERSON CAN PIN, by the words the
+// router uses for them, and every shortcut the command takes has a row.
+func TestTheCrewRowsNameTheSeatsAndTheShortcuts(t *testing.T) {
+	var said []string
 	for _, row := range commands {
-		if row.name != "crew" {
-			continue
+		if row.name == "crew" {
+			said = append(said, row.args+" "+row.desc)
 		}
-		if !strings.Contains(row.desc, counted) {
-			t.Errorf("/crew %s says %q; the crew is %s models (%v)", row.args, row.desc, counted, seats)
+	}
+	text := strings.Join(said, "\n")
+	for _, want := range []string{"pin", "unpin", "models", "cap", "worker", "planner", "checker"} {
+		if !strings.Contains(text, want) {
+			t.Errorf("the /crew rows never say %q:\n%s", want, text)
+		}
+	}
+	for _, retired := range []string{"frugal", "balanced", "preset", "mastermind"} {
+		if strings.Contains(text, retired) {
+			t.Errorf("the /crew rows still say the retired %q:\n%s", retired, text)
 		}
 	}
 }
diff --git a/internal/tui3/notice.go b/internal/tui3/notice.go
index 5cc929ef2b..d175179a23 100644
--- a/internal/tui3/notice.go
+++ b/internal/tui3/notice.go
@@ -162,7 +162,7 @@ const (
 	// eventModelListOpened is the model list raised, over a conversation or
 	// over home's draft (palette.go, homedraft.go).
 	eventModelListOpened = "model-list-opened"
-	// eventCrewShown is /crew answered, bare or with a preset (crew.go).
+	// eventCrewShown is /crew answered, bare or with a subcommand (crew.go).
 	eventCrewShown = "crew-shown"
 	// eventBudgetShown is /budget answered, bare or with a figure (budget.go).
 	eventBudgetShown = "budget-shown"
diff --git a/internal/tui3/onboarding.go b/internal/tui3/onboarding.go
index 24b657b2e0..efff900d73 100644
--- a/internal/tui3/onboarding.go
+++ b/internal/tui3/onboarding.go
@@ -23,33 +23,32 @@ import (
 // the one screen that replaced them, and the rule that decided its contents is
 // written in docs/design/onboarding/DESIGN.md: a control belongs here when it is
 // NECESSARY TO WORK, MATERIALLY CHANGES THE FIRST EXPERIENCE, and CAN BE
-// UNDERSTOOD BEFORE THE PERSON HAS USED codeaf. Three pass — the day's limit
+// UNDERSTOOD BEFORE THE PERSON HAS USED codeaf. Two pass — the day's limit
 // (money is consequential and an amount can be chosen with no knowledge of the
-// engine), the chat model, and the crew — and everything else is a setting or a
-// thing to be taught at the moment it happens.
+// engine) and the chat model — and everything else is a setting or a thing to
+// be taught at the moment it happens. THE CREW USED TO BE THE THIRD, as a
+// choice between three preset words; since 2026-09-24 a task's crew is picked
+// per task and asks nothing up front, so it left this screen (/crew is where
+// its pins, allowed models and cap live).
 //
 // SIX LAWS HOLD THIS SCREEN TOGETHER.
 //
 //   - EVERY VALUE ON IT IS THE RESOLVED ONE. Nothing here is a figure this file
-//     knows: the limit, the model and the crew are read back through the settings
+//     knows: the limit and the model are read back through the settings
 //     registry and internal/config, so a profile that already has a limit sees
-//     THEIR limit and not the default, a crew nobody can name reads `Custom`
-//     rather than a preset it is not, and an environment variable that owns a row
-//     is named rather than quietly overwritten.
+//     THEIR limit and not the default, and an environment variable that owns a
+//     row is named rather than quietly overwritten.
 //   - THE DEFAULTS ARE ALREADY CHOSEN. Every row opens on the value that is in
 //     force, so a person who wants none of this presses enter on `Start a
 //     conversation` and has agreed to exactly what they were shown. That is the
 //     whole difference between a form and an interrogation.
 //   - IT WRITES ONLY WHAT IT WAS GIVEN. Leaving this screen writes the day's
-//     limit, because the limit is the field it asked about; it writes a crew ONLY
-//     where the person chose one here or where the profile had none at all. A
-//     setup that applied a preset to somebody's hand-pinned tiers would destroy an
-//     opinion in the act of asking for one ([app.commitSetupCrew]).
-//   - CANCELLING CHOOSES NOTHING. Esc out of either chooser leaves the value that
+//     limit, because the limit is the field it asked about, and nothing else.
+//   - CANCELLING CHOOSES NOTHING. Esc out of the model list leaves the value that
 //     was there before it opened. A cursor is not an answer.
 //   - THE SCREEN IS THREE SENTENCES LONG. Each control carries one line about
-//     what it does and nothing else; the caveats, the exact model ids and the five
-//     crew seats are behind `?`, on the field a person is standing on. A first
+//     what it does and nothing else; the caveats and the exact model ids are
+//     behind `?`, on the field a person is standing on. A first
 //     screen that has to be read before it can be answered is a first screen most
 //     people leave.
 //   - IT SPENDS NOTHING. Opening a model list reads the catalog this process
@@ -69,7 +68,6 @@ type setupControl int
 const (
 	controlLimit setupControl = iota
 	controlChatModel
-	controlCrew
 	controlReview
 	controlStart
 )
@@ -92,7 +90,6 @@ const (
 const (
 	controlLimitLabel = "Daily limit"
 	controlModelLabel = "Chat model"
-	controlCrewLabel  = "Work crew"
 )
 
 // controlLabelWidth is the column the three labels are laid out in. It is wide
@@ -109,7 +106,6 @@ const (
 	controlLimitWord = "When " + product + "'s spending today reaches this amount, " +
 		"new work waits until midnight or you raise it."
 	controlModelWord = "The model you talk to in this conversation."
-	controlCrewWord  = "Models used to plan, run, and check tasks."
 )
 
 // The detail behind `?`, on the field with the focus.
@@ -123,8 +119,8 @@ const (
 	controlLimitDetail = "It counts spending " + product + " records here. Calls already " +
 		"running can carry it a little past. Your provider account has its own controls."
 	controlModelDetail = "It also handles this conversation's tool use. Changing it here is " +
-		"the same choice /model makes, and it is kept for the next launch."
-	controlCrewDetail = "Changing the crew leaves the chat model alone."
+		"the same choice /model makes, and it is kept for the next launch." +
+		" Tasks get their own crew, picked per task · /crew shows it."
 )
 
 // The two spellings of the row under the fields. A fresh profile is told these
@@ -161,7 +157,7 @@ const (
 	controlFromLead   = "from "
 )
 
-// controlTaskPinLead is the line under the crew when a task-model override is in
+// controlTaskPinLead is the line under the chat model when a task-model override is in
 // force. THE CREW ROW WOULD OTHERWISE BE A LIE BY OMISSION: a person who pinned
 // `task.model` has taken the worker seat out of the preset's hands, and a screen
 // offering to change "the models used to run tasks" without saying so would be
@@ -186,7 +182,7 @@ func (a *app) setupControlsKey(name, text string) bool {
 		// open is about the screen itself, and [app.setupControlsPress] handles
 		// that one because leaving is the flow's business rather than this
 		// screen's.
-		if s.modelOpen || s.crewOpen {
+		if s.modelOpen {
 			s.closeChoosers()
 			return true
 		}
@@ -205,10 +201,6 @@ func (a *app) setupControlsKey(name, text string) bool {
 			a.moveSetupModel(1)
 			return true
 		}
-		if s.crewOpen && name != "tab" {
-			s.crewAt = moveCursor(s.crewAt, 1, len(config.CrewPresets))
-			return true
-		}
 		s.focusControl(a, 1)
 		return true
 
@@ -217,10 +209,6 @@ func (a *app) setupControlsKey(name, text string) bool {
 			a.moveSetupModel(-1)
 			return true
 		}
-		if s.crewOpen && name != "shift+tab" {
-			s.crewAt = moveCursor(s.crewAt, -1, len(config.CrewPresets))
-			return true
-		}
 		s.focusControl(a, -1)
 		return true
 
@@ -295,7 +283,7 @@ func (a *app) setupControlsKey(name, text string) bool {
 		a.filterSetupModels(s.modelFind + text)
 		return true
 	}
-	if s.control == controlLimit && !s.crewOpen {
+	if s.control == controlLimit && !s.anyOpen() {
 		s.limitText += text
 		s.limitTyped = true
 	}
@@ -312,13 +300,13 @@ func dropLast(text string) string {
 }
 
 // anyOpen reports whether a chooser is standing under a row.
-func (s *setupFlow) anyOpen() bool { return s.modelOpen || s.crewOpen }
+func (s *setupFlow) anyOpen() bool { return s.modelOpen }
 
 // closeChoosers puts both away and drops what was provisional in them: the model
-// list's filter and cursor, and the crew's cursor. Neither has written anything —
+// list's filter and cursor. It has written nothing —
 // that is what makes esc safe here.
 func (s *setupFlow) closeChoosers() {
-	s.modelOpen, s.crewOpen = false, false
+	s.modelOpen = false
 	s.modelFind = ""
 	s.modelTop = 0
 }
@@ -428,18 +416,6 @@ func (a *app) setupControlsEnter() bool {
 		a.filterSetupModels("")
 		return false
 
-	case controlCrew:
-		if s.crewOpen {
-			// THE CURSOR BECOMES THE ANSWER HERE AND NOWHERE ELSE. Until this
-			// line the crew on the row is whatever the profile reads.
-			s.crewPick = config.CrewPresets[clampIndex(s.crewAt, len(config.CrewPresets))]
-			s.closeChoosers()
-			return false
-		}
-		s.crewOpen = true
-		s.crewAt = a.setupCrewCursor()
-		return false
-
 	case controlReview:
 		s.reviewOpen = !s.reviewOpen
 		return false
@@ -494,47 +470,6 @@ func (a *app) commitSetupLimit() bool {
 	return true
 }
 
-// commitSetupCrew writes a crew, and MOSTLY DOES NOT.
-//
-// THE SETUP MAY NOT PAPER OVER AN OPINION. internal/config says why in its own
-// words: [config.CrewConfigured] is true when ANY of the tier rows, or the
-// family row above them, is in the profile, "because a person who pinned one tier
-// by hand, or chose a family, has an opinion the setup must not paper over with a
-// preset". So a preset is written on exactly two
-// roads — the person chose one in the chooser on this screen, or the profile had
-// no crew of its own at all and the row they were shown is the shipped default,
-// which is the case the first-run flow exists for.
-//
-// The cost of getting this wrong was a real one: a profile with hand-pinned tiers
-// and no daily limit opens this screen, and the old code applied
-// `CrewPresets[0]` — Frugal — to it on the way out, silently, because the cursor
-// started at zero.
-func (a *app) commitSetupCrew() bool {
-	s := &a.setup
-	preset := s.crewPick
-	if preset == "" {
-		if config.CrewConfigured(a.profileDir) {
-			return true
-		}
-		preset = config.CrewAt(a.profileDir)
-		if config.CrewLine(preset) == "" {
-			// Not one of the three, on a profile with nothing written down. There
-			// is no preset to record and nothing to preserve, so nothing is done.
-			return true
-		}
-	}
-	row, ok := a.registry().Row(config.KeyCrew)
-	if !ok {
-		return true
-	}
-	if err := row.Apply(preset); err != nil {
-		s.refusal = setupSaid(err, setupSaveFailedWord)
-		return false
-	}
-	a.refreshSettings()
-	return true
-}
-
 // commitSetupControls is `Start a conversation`. It reports whether the screen is
 // finished.
 //
@@ -544,10 +479,7 @@ func (a *app) commitSetupCrew() bool {
 // live conversation on that model rather than a promise to switch later. A person
 // who opened the list and pressed esc chose nothing and nothing was written.
 func (a *app) commitSetupControls() bool {
-	if !a.commitSetupLimit() {
-		return false
-	}
-	return a.commitSetupCrew()
+	return a.commitSetupLimit()
 }
 
 // takeSetupModel puts the conversation on a model chosen here, THROUGH THE
@@ -654,25 +586,6 @@ func (a *app) setupModelChoices() []Model {
 // under a field that still needs the primary action beneath it.
 const setupModelSlots = 5
 
-// setupCrewCursor is where the crew chooser opens: on the preset in force, so
-// enter confirms rather than changes. A crew that is nobody's preset opens on the
-// default, because there is no row to confirm and the default is the one this
-// screen would otherwise be recommending.
-func (a *app) setupCrewCursor() int {
-	current := a.setupCrewReading()
-	for i, preset := range config.CrewPresets {
-		if preset == current {
-			return i
-		}
-	}
-	for i, preset := range config.CrewPresets {
-		if preset == config.DefaultCrew {
-			return i
-		}
-	}
-	return 0
-}
-
 // setupLimitReading is the day's ceiling as this screen draws it and as it writes
 // it back: the registry row's own reading, which is `$500`, or `no limit` for a
 // profile that has taken the rail off.
@@ -687,16 +600,6 @@ func (a *app) setupLimitReading() string {
 	return config.NoLimitWord
 }
 
-// setupCrewReading is the crew this screen is showing: what was chosen here, or
-// what the profile's five tier rows actually make — which may be
-// [config.CrewCustom], and says so rather than naming a preset it is not.
-func (a *app) setupCrewReading() string {
-	if a.setup.crewPick != "" {
-		return a.setup.crewPick
-	}
-	return config.CrewAt(a.profileDir)
-}
-
 // startSetupControls seeds the screen from the profile, ONCE. Every value on it
 // is the resolved one at the moment the screen is first reached — and it is not
 // re-read afterwards, because a form that reseeded on the way back from the step
@@ -713,11 +616,6 @@ func (a *app) startSetupControls() {
 	s.limitText, s.limitTyped = "", false
 	s.closeChoosers()
 	s.reviewOpen, s.detail = false, false
-	s.crewPick = ""
-	// The family is read HERE, arriving on the screen, and not in the draw: this
-	// screen's rows are drawn every frame and a profile read belongs at a door.
-	s.crewSource = config.CrewSourceAt(a.profileDir)
-	s.crewAt = a.setupCrewCursor()
 	s.example = exampleForControl(controlLimit)
 	// ARRIVING ON THE SCREEN IS THE FIRST OF THE TWO DELIBERATE ACTS, so the
 	// panel plays once here. Coming BACK from the step behind this one does not
@@ -809,7 +707,11 @@ func exampleForControl(control setupControl) int {
 	switch control {
 	case controlLimit:
 		return 2
-	case controlCrew:
+	case controlReview:
+		// THE HAND-OFF EXAMPLE stood beside the crew row, which is gone: a task's
+		// crew is picked per task now and asks nothing here. The review row is
+		// the door to every setting this screen does not ask about, the crew's
+		// among them, so the hand-off stands beside it.
 		return 1
 	}
 	return 0
@@ -903,11 +805,6 @@ func titleWord(word string) string {
 	return string(runes)
 }
 
-// presetWord is a crew preset as a label — `balanced` reads `Balanced` — and it
-// covers [config.CrewCustom] too, which is a reading rather than a preset and
-// still has to be spelled on the row.
-func presetWord(preset string) string { return titleWord(strings.TrimSpace(preset)) }
-
 // ── the drawing ─────────────────────────────────────────────────────────────
 
 // The composition, in cells. At 120×24 it is a 54-cell form, an eight-cell gap
@@ -1180,17 +1077,11 @@ func (a *app) setupControlsForm(width int) *controlsSheet {
 	}
 	f.soft(rankSpacer, "")
 
-	// ── the crew ──
-	f.add(a.setupFieldRow(width, controlCrew, controlCrewLabel, presetWord(a.setupCrewReading()), ""))
-	a.addControlWords(f, width, controlCrew, controlCrewWord, a.setupCrewDetail())
 	if line := a.setupTaskPinRow(width); line != "" {
 		// A TASK-MODEL OVERRIDE IS NOT DETAIL. It is a fact that contradicts the
 		// row above it, so it is on the screen whether or not anybody asked.
 		f.add(line)
 	}
-	if s.crewOpen {
-		f.add(a.setupCrewRows(width)...)
-	}
 	f.soft(rankSpacer, "")
 
 	// ── the optional review ──
@@ -1337,56 +1228,7 @@ func (a *app) setupModelDetail() string {
 	return controlModelDetail
 }
 
-// setupCrewDetail is what `?` says about the crew: the three seats a person
-// actually asks about, read off the profile's own live rows through
-// internal/config's one summary, and then what a crew change does not touch.
-//
-// It is the LIVE reading and not the preset's table, which is the whole point on
-// a profile whose crew is nobody's preset: `Custom` on the row, and the models it
-// is actually made of underneath it.
-func (a *app) setupCrewDetail() string {
-	seats := ""
-	if a.setup.crewPick != "" {
-		// A PRESET TAKEN IN THE CHOOSER IS NOT ON DISK YET, so the seats come off
-		// the preset's own table rather than off the profile — otherwise `?` on a
-		// crew somebody has just chosen would describe the crew they replaced.
-		// The three roles are spelled the way internal/config spells them for the
-		// live reading below, because a person opening this twice must not be
-		// shown one sentence in two shapes.
-		seats = crewPickSeats(a.setup.crewSource, a.setup.crewPick)
-	}
-	if seats == "" {
-		seats = strings.TrimSpace(config.CrewClasses(a.profileDir))
-	}
-	if seats == "" {
-		return controlCrewDetail
-	}
-	return seats + "\n" + controlCrewDetail
-}
-
-// crewPickSeats is one preset's three named seats — `brain … · hands … · checks
-// …` — built from [config.CrewModels] so a preset chosen a moment ago describes
-// itself rather than the profile it has not been written to yet. It answers ""
-// for a word that is not a preset, which is the emptiness law: there is no crew
-// to describe and no placeholder that would be true.
-func crewPickSeats(source, preset string) string {
-	models, ok := config.CrewModelsForSource(source, preset)
-	if !ok {
-		return ""
-	}
-	short := func(tier string) string {
-		id := strings.TrimSpace(models[tier])
-		if at := strings.LastIndex(id, "/"); at >= 0 {
-			id = id[at+1:]
-		}
-		return id
-	}
-	return "brain " + short(config.ModelTierMastermind) +
-		" · hands " + short(config.ModelTierWorker) +
-		" · checks " + short(config.ModelTierHigh)
-}
-
-// setupTaskPinRow is the line under the crew when `task.model` is pinned, and ""
+// setupTaskPinRow is the line under the chat model when `task.model` is pinned, and ""
 // — the emptiness law — when it is not.
 func (a *app) setupTaskPinRow(width int) string {
 	row, ok := a.registry().Row(config.KeyTaskModel)
@@ -1482,70 +1324,6 @@ const setupNoCatalogWord = "no model list on this machine yet · /model finds on
 // setupNoMatchWord is a filter that matched nothing.
 const setupNoMatchWord = "nothing matches · backspace widens it"
 
-// crewChoiceWords is what each preset says about itself ON THIS SCREEN, and it
-// is deliberately NOT [config.CrewLine].
-//
-// The registry's line is written for somebody who already has the vocabulary:
-// `glm-flash works, checks and thinks · pennies a day` names one model three
-// times and makes a claim about money. Both halves are wrong here. Nobody meeting codeaf for the
-// first time can rank `glm-flash` against `kimi-k3`, and — the harder rule —
-// THIS SCREEN MAKES NO CLAIM ABOUT WHAT ANYTHING COSTS. "Pennies a day" is a
-// forecast about somebody else's usage on somebody else's pricing, said on the
-// one screen that also asks them to name a daily ceiling, and a product that
-// guesses at a person's bill next to a field where they set their own limit has
-// put a number in their head that it cannot stand behind.
-//
-// So each line is about THE CHOICE — how much model is put on the work — in the
-// comparative terms the three presets actually differ by. The five model ids are
-// one keystroke away on `?`, which is where an address belongs.
-var crewChoiceWords = map[string]string{
-	config.CrewFrugal:   "The lightest models that can do the work.",
-	config.CrewBalanced: "A stronger model plans and checks; lighter ones do the work.",
-	config.CrewMax:      "The strongest models on the work and the thinking.",
-}
-
-// crewChoiceWord is one preset's line here, falling back to the registry's own
-// for a preset this table has not been taught — which is the one-source rule
-// applied to a gap: a new preset gets a real sentence rather than a blank row,
-// and the blank row is what would have shipped if this map were the only source.
-func crewChoiceWord(preset string) string {
-	if word := crewChoiceWords[strings.ToLower(strings.TrimSpace(preset))]; word != "" {
-		return word
-	}
-	// The fallback is for a preset this screen has not been taught, and it is the
-	// default family's line: setupCrewRows runs inside the draw, so reading the profile
-	// here would put a profile read on the frame clock, and the seats this screen
-	// shows already take the family from a value read at the door.
-	return config.CrewLine(preset)
-}
-
-// setupCrewRows is the chooser under the crew row: the three presets, each with
-// its own compact sentence WHOLE — a comparison a person cannot finish reading is
-// not a comparison — and a word about a crew that is none of the three.
-func (a *app) setupCrewRows(width int) []string {
-	pal := a.pal
-	out := make([]string, 0, len(config.CrewPresets)*2+1)
-	at := clampIndex(a.setup.crewAt, len(config.CrewPresets))
-	for i, preset := range config.CrewPresets {
-		lead, name := "    ", pal.dim(presetWord(preset))
-		if i == at {
-			lead, name = "  "+pal.accent(setupLead), pal.bold(pal.ink(presetWord(preset)))
-		}
-		out = append(out, lead+name)
-		// The sentence is wrapped rather than cut, on its own line, so the three
-		// read as three comparable things at any width this screen has.
-		for _, line := range wrap(crewChoiceWord(preset), width-6) {
-			out = append(out, strings.Repeat(" ", 6)+pal.muted(line))
-		}
-	}
-	if a.setupCrewReading() == config.CrewCustom {
-		// crew.go's own sentence for this state, said in the one place a person
-		// can act on it.
-		out = append(out, strings.Repeat(" ", 4)+pal.dim(fit(crewCustomLine, width-4)))
-	}
-	return out
-}
-
 // setupReviewRow is the row under the fields. Its wording depends on the profile
 // and not on a guess: a profile that has written any of the three down is NOT
 // told they are defaults.
@@ -1672,14 +1450,14 @@ func (a *app) setupControlsKeys(width int) string {
 		switch s.control {
 		case controlLimit:
 			parts = []string{"enter goes on", "tab moves", a.setupBackWord(), "type an amount or none"}
-		case controlChatModel, controlCrew:
+		case controlChatModel:
 			parts = []string{"enter opens the list", "tab moves", a.setupBackWord()}
 		case controlReview:
 			parts = []string{"enter shows them", "tab moves", a.setupBackWord()}
 		case controlStart:
 			parts = []string{"enter starts", "tab moves", a.setupBackWord()}
 		}
-		if s.control <= controlCrew {
+		if s.control <= controlChatModel {
 			parts = append(parts, "? detail")
 		}
 		if w, _ := a.size(); w >= setupWideCols {
diff --git a/internal/tui3/onboarding_test.go b/internal/tui3/onboarding_test.go
index 318fac4ed1..3f2f204973 100644
--- a/internal/tui3/onboarding_test.go
+++ b/internal/tui3/onboarding_test.go
@@ -59,110 +59,6 @@ func walkToControl(t *testing.T, a *app, want setupControl) {
 	t.Fatalf("tab never reached control %v", want)
 }
 
-// A CREW SOMEBODY ARRANGED BY HAND SURVIVES THE SETUP.
-//
-// This is the defect the screen was built around. A profile with hand-pinned
-// tiers and no daily limit still opens the controls screen — the limit is
-// missing — and the old code applied CrewPresets[0], Frugal, to it on the way
-// out, because the chooser's cursor started at zero and leaving committed the
-// cursor. Five model rows replaced, silently, by a form that never mentioned
-// them.
-func TestAHandPinnedCrewIsNotOverwrittenByLeavingTheSetup(t *testing.T) {
-	a, dir := controlsApp(t, func(dir string) {
-		// One seat pinned by hand, which is what config.CrewConfigured is about
-		// and what makes CrewAt read `custom`.
-		seedRow(t, dir, config.KeyTierWorkerModel, "openai/gpt-4.1")
-	})
-	if got := config.CrewAt(dir); got != config.CrewCustom {
-		t.Fatalf("the fixture's crew reads %q, want a crew that is nobody's preset", got)
-	}
-	// THE ROW SAYS SO rather than naming a preset it is not.
-	if screen := setupScreen(a); !strings.Contains(screen, presetWord(config.CrewCustom)) {
-		t.Fatalf("a crew that is none of the three must read %q; got:\n%s",
-			presetWord(config.CrewCustom), screen)
-	}
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if a.setup.open {
-		t.Fatalf("the setup did not finish: %s", a.setup.refusal)
-	}
-	if got := config.TierModelAt(dir, config.ModelTierWorker); got != "openai/gpt-4.1" {
-		t.Fatalf("the worker seat reads %q — the setup wrote a preset over a pinned tier", got)
-	}
-	if got := config.CrewAt(dir); got != config.CrewCustom {
-		t.Fatalf("the crew reads %q after the setup, want it untouched", got)
-	}
-}
-
-// AND A PROFILE WITH NO CREW AT ALL RECORDS THE ONE IT WAS SHOWN. That is the
-// other half of the same rule: nothing to preserve, and the value on the screen
-// becomes the value in the file, so what the person agreed to is what they get.
-func TestAFreshProfileRecordsTheCrewItWasShown(t *testing.T) {
-	a, dir := controlsApp(t, nil)
-	if config.CrewConfigured(dir) {
-		t.Fatal("the fixture already has a crew")
-	}
-	shown := a.setupCrewReading()
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if !config.CrewConfigured(dir) || config.CrewAt(dir) != shown {
-		t.Fatalf("the profile reads %q, want the %q the screen showed", config.CrewAt(dir), shown)
-	}
-}
-
-// ESC OUT OF THE CREW CHOOSER CHOOSES NOTHING.
-//
-// The cursor inside the list is provisional. Walking it to Max and pressing esc
-// must leave the row — and the profile — on what was there before, because a
-// cursor is not an answer.
-func TestEscOutOfTheCrewChooserKeepsTheCrewThatWasThere(t *testing.T) {
-	a, dir := controlsApp(t, nil)
-	before := a.setupCrewReading()
-	walkToControl(t, a, controlCrew)
-	pressSetup(a, key("enter"))
-	if !a.setup.crewOpen {
-		t.Fatal("enter on the crew row did not open the list")
-	}
-	pressSetup(a, key("down"), key("down"), key("esc"))
-	if a.setup.crewOpen {
-		t.Fatal("esc left the list open")
-	}
-	if got := a.setupCrewReading(); got != before {
-		t.Fatalf("the crew row reads %q after esc, want the %q it had", got, before)
-	}
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if got := config.CrewAt(dir); got != before {
-		t.Fatalf("the profile reads %q, want %q — esc committed the cursor", got, before)
-	}
-}
-
-// AND ENTER IN THE CHOOSER IS THE ANSWER. The same walk, ended with enter,
-// lands the preset under the cursor and nothing else.
-func TestEnterInTheCrewChooserTakesThePresetUnderTheCursor(t *testing.T) {
-	a, dir := controlsApp(t, nil)
-	walkToControl(t, a, controlCrew)
-	pressSetup(a, key("enter"))
-	at := a.setup.crewAt
-	pressSetup(a, key("down"))
-	want := config.CrewPresets[a.setup.crewAt]
-	if a.setup.crewAt == at {
-		t.Fatal("↓ did not move the chooser's cursor")
-	}
-	pressSetup(a, key("enter"))
-	if a.setup.crewOpen {
-		t.Fatal("enter left the list open")
-	}
-	if got := a.setupCrewReading(); got != want {
-		t.Fatalf("the row reads %q, want the %q under the cursor", got, want)
-	}
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if got := config.CrewAt(dir); got != want {
-		t.Fatalf("the profile reads %q, want %q", got, want)
-	}
-}
-
 // THE MODEL LIST IS THE WHOLE CATALOG AND NOT THE FIRST FIVE OF IT.
 //
 // The form shows five rows at a time. An earlier build TRUNCATED the catalog to
@@ -331,33 +227,6 @@ func TestAModelThatCouldNotBeSavedSaysSoWithoutClaimingItFailed(t *testing.T) {
 	}
 }
 
-// AN ENVIRONMENT-PINNED ROW IS SHOWN, NAMED, AND NOT OFFERED AS EDITABLE.
-//
-// The registry refuses a write to a pinned row in its own words. A form that
-// opened a chooser over it would be offering a choice that cannot land.
-func TestAPinnedDailyLimitIsNamedAndNeverWritten(t *testing.T) {
-	a, dir := controlsApp(t, func(string) {
-		// The fixture clears every pin before it builds the surface, so the
-		// variable is exported HERE — inside the seed — where it survives.
-		t.Setenv("CODEAF_DAILY_BUDGET", "7")
-	})
-	screen := setupScreen(a)
-	if !strings.Contains(screen, "CODEAF_DAILY_BUDGET") {
-		t.Fatalf("a pinned limit must name the variable that owns it; got:\n%s", screen)
-	}
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if a.setup.open {
-		t.Fatalf("the setup refused to finish over a pinned row: %q", a.setup.refusal)
-	}
-	// Nothing was written into the file: the variable is still the answer.
-	for _, key := range config.NewSettings(config.SettingsOptions{ProfileDir: dir}).PersistedKeys() {
-		if key == config.KeyDailyBudget {
-			t.Fatal("a pinned row was written into the profile")
-		}
-	}
-}
-
 // NO LIMIT IS A FIRST-CLASS ANSWER, typed in the word the screen offers.
 func TestNoneOnTheDailyLimitWritesNoLimit(t *testing.T) {
 	a, dir := controlsApp(t, nil)
@@ -374,37 +243,16 @@ func TestNoneOnTheDailyLimitWritesNoLimit(t *testing.T) {
 	}
 }
 
-// AN UNTOUCHED LIMIT WRITES BACK THE FIGURE IT DREW, and a profile that already
-// had one keeps ITS figure rather than being handed the default.
-func TestAConfiguredLimitIsShownAndKept(t *testing.T) {
-	a, dir := controlsApp(t, func(dir string) {
-		if err := config.WriteDailyBudgetUSD(dir, 12); err != nil {
-			t.Fatal(err)
-		}
-	})
-	if screen := setupScreen(a); !strings.Contains(screen, "$12") {
-		t.Fatalf("the screen must show the profile's own limit; got:\n%s", screen)
-	}
-	walkToControl(t, a, controlStart)
-	pressSetup(a, key("enter"))
-	if amount, err := config.DailyBudgetUSDAt(dir); err != nil || amount != 12 {
-		t.Fatalf("the limit read back as %v (%v), want the 12 it had", amount, err)
-	}
-}
-
 // GOING BACK TO THE CONNECTION AND RETURNING KEEPS WHAT WAS TYPED.
 //
 // startSetupControls seeds the screen from the profile ONCE. A form that re-read
-// itself on the way back would throw away the amount somebody had typed and the
-// crew they had picked before they went to look at something.
+// itself on the way back would throw away the amount somebody had typed before
+// they went to look at something.
 func TestGoingBackToTheConnectionAndReturningKeepsTheFormsEdits(t *testing.T) {
 	a, _ := controlsApp(t, nil)
 	for _, letter := range []string{"4", "2"} {
 		pressSetup(a, key(letter))
 	}
-	walkToControl(t, a, controlCrew)
-	pressSetup(a, key("enter"), key("down"), key("enter"))
-	picked := a.setupCrewReading()
 
 	// esc with a step behind this one goes back rather than leaving.
 	pressSetup(a, key("esc"))
@@ -418,9 +266,6 @@ func TestGoingBackToTheConnectionAndReturningKeepsTheFormsEdits(t *testing.T) {
 	if a.setup.limitText != "42" || !a.setup.limitTyped {
 		t.Fatalf("the typed limit came back as %q (typed=%v)", a.setup.limitText, a.setup.limitTyped)
 	}
-	if got := a.setupCrewReading(); got != picked {
-		t.Fatalf("the crew came back as %q, want the %q that was picked", got, picked)
-	}
 }
 
 // THE DETAIL IS ASKED FOR AND NEVER OFFERED. The screen a person arrives at is
@@ -448,10 +293,10 @@ func TestTheDetailIsBehindAQuestionMarkAndGoesWithTheFocus(t *testing.T) {
 
 // A TASK-MODEL OVERRIDE IS ON THE SCREEN WITHOUT BEING ASKED FOR.
 //
-// It contradicts the crew row above it — the worker seat is out of the preset's
-// hands — so it is a fact rather than a detail, and the emptiness law keeps it
-// off every screen where no override is set.
-func TestATaskModelOverrideIsSaidBesideTheCrew(t *testing.T) {
+// It says the worker seat is out of the router's hands, so it is a fact rather
+// than a detail, and the emptiness law keeps it off every screen where no
+// override is set.
+func TestATaskModelOverrideIsSaid(t *testing.T) {
 	a, _ := controlsApp(t, nil)
 	if strings.Contains(setupScreen(a), controlTaskPinLead) {
 		t.Fatalf("a profile with no override drew a line about one:\n%s", setupScreen(a))
@@ -460,7 +305,7 @@ func TestATaskModelOverrideIsSaidBesideTheCrew(t *testing.T) {
 		seedRow(t, dir, config.KeyTaskModel, "anthropic/claude-opus-5")
 	})
 	if screen := setupScreen(b); !strings.Contains(screen, controlTaskPinLead) {
-		t.Fatalf("a pinned task model must be said beside the crew; got:\n%s", screen)
+		t.Fatalf("a pinned task model must be said; got:\n%s", screen)
 	}
 }
 
@@ -507,7 +352,7 @@ func TestTheControlsScreenStaysUsableDownToFortyColumns(t *testing.T) {
 		frame, _, _ := a.frame()
 		screen := plain(frame)
 		where := itoa(size[0]) + "x" + itoa(size[1])
-		for _, want := range []string{controlLimitLabel, controlModelLabel, controlCrewLabel, controlStartWord} {
+		for _, want := range []string{controlLimitLabel, controlModelLabel, controlStartWord} {
 			if !strings.Contains(screen, want) {
 				t.Fatalf("%s lost %q:\n%s", where, want, screen)
 			}
@@ -655,17 +500,17 @@ func TestTheExampleColumnIsLabelledFollowsTheFocusAndHidesWhenNarrow(t *testing.
 	if again := setupScreen(a); again != screen {
 		t.Fatal("the example moved between two frames with no keypress")
 	}
-	walkToControl(t, a, controlCrew)
-	if want := setupExamples[exampleForControl(controlCrew)].title; !strings.Contains(setupScreen(a), want) {
-		t.Fatalf("the crew's example is %q; got:\n%s", want, setupScreen(a))
+	walkToControl(t, a, controlReview)
+	if want := setupExamples[exampleForControl(controlReview)].title; !strings.Contains(setupScreen(a), want) {
+		t.Fatalf("the review row's example is %q; got:\n%s", want, setupScreen(a))
 	}
 	// ←/→ browse without touching anything.
-	before := a.setupCrewReading()
+	limit := a.setup.limitText
 	pressSetup(a, key("right"))
-	if a.setup.example == exampleForControl(controlCrew) {
+	if a.setup.example == exampleForControl(controlReview) {
 		t.Fatal("→ did not move the example")
 	}
-	if a.setupCrewReading() != before {
+	if a.setup.limitText != limit {
 		t.Fatal("browsing the examples changed a control")
 	}
 	// And below the width the pair needs, the column is gone entirely.
@@ -788,37 +633,6 @@ func TestTheExampleDemonstrationDoesNotAnimateInTheLinearTier(t *testing.T) {
 	}
 }
 
-// THE CREW CHOOSER MAKES NO CLAIM ABOUT WHAT ANYTHING COSTS.
-//
-// The registry's own preset line ends `· pennies a day`, which is a forecast
-// about somebody else's usage on somebody else's pricing — said, before this
-// fix, on the one screen that also asks a person to name their own daily
-// ceiling. The three lines here are about the CHOICE, and each is whole.
-func TestTheCrewChooserDescribesTheChoiceAndPromisesNoPrice(t *testing.T) {
-	a, _ := controlsApp(t, nil)
-	// Read at eighty columns, where the panel is not drawn: the two columns share
-	// every row on a wide frame, and a sentence read across both is not a
-	// sentence either of them said.
-	a.width, a.height = 80, 24
-	walkToControl(t, a, controlCrew)
-	pressSetup(a, key("enter"))
-	screen := setupScreen(a)
-	for _, preset := range config.CrewPresets {
-		if word := crewChoiceWord(preset); !strings.Contains(screen, word) {
-			t.Fatalf("the %s row must carry %q whole; got:\n%s", preset, word, screen)
-		}
-	}
-	// And the registry's own line, cost promise and all, is nowhere on it.
-	for _, preset := range config.CrewPresets {
-		if line := config.CrewLine(preset); strings.Contains(screen, line) {
-			t.Fatalf("the crew chooser inherited the registry's line %q:\n%s", line, screen)
-		}
-	}
-	if strings.Contains(screen, "pennies") {
-		t.Fatalf("the crew chooser promises a price:\n%s", screen)
-	}
-}
-
 // MODEL NAMES ARE READ AS NAMES AND THE ID IS STILL AVAILABLE. The form is a
 // place to decide between two models, not to type an address into.
 func TestModelNamesReadAsNamesAndKeepTheirLevel(t *testing.T) {
@@ -859,8 +673,6 @@ func TestTheControlsScreenSendsNoPrompt(t *testing.T) {
 	a.models = func() []Model { return []Model{{ID: "z/zulu"}, {ID: "openai/gpt-4.1-mini"}} }
 	walkToControl(t, a, controlChatModel)
 	pressSetup(a, key("enter"), key("up"), key("enter"))
-	walkToControl(t, a, controlCrew)
-	pressSetup(a, key("enter"), key("down"), key("enter"))
 	walkToControl(t, a, controlStart)
 	pressSetup(a, key("enter"))
 	if len(agent.sent) != 0 {
diff --git a/internal/tui3/pages.go b/internal/tui3/pages.go
index abf9608cfc..044e329a6d 100644
--- a/internal/tui3/pages.go
+++ b/internal/tui3/pages.go
@@ -2320,10 +2320,10 @@ func (a *app) closeModals() {
 	a.roster.close()
 	a.folder.close()
 	a.shelf.close()
-	a.crewPick.close()
 	a.effPick.close()
 	a.connPanel.close()
 	a.harnPanel.close()
+	a.crewUI.close()
 	a.permPanel.close()
 	a.subPage.close()
 	// AND HOME'S OWN MODEL LIST, which IS drawn where it stands and is still a
diff --git a/internal/tui3/palette.go b/internal/tui3/palette.go
index c12953f9f9..28e57104cd 100644
--- a/internal/tui3/palette.go
+++ b/internal/tui3/palette.go
@@ -3171,8 +3171,6 @@ func (a *app) overlayHeight() int {
 	switch {
 	case a.pick.open:
 		want = a.pick.height(width)
-	case a.crewPick.open:
-		want = a.crewPick.height()
 	case a.effPick.open:
 		want = a.effPick.height()
 	case a.roster.open:
@@ -3183,6 +3181,8 @@ func (a *app) overlayHeight() int {
 		want = a.connPanel.height(width)
 	case a.harnPanel.open:
 		want = a.harnPanel.height(width)
+	case a.crewUI.open:
+		want = a.crewHeight(width)
 	case a.harnPick.open:
 		want = a.harnPick.height(width)
 	case a.skillPick.open:
@@ -3231,8 +3231,6 @@ func (a *app) overlayRows(width, n int) []string {
 	switch {
 	case a.pick.open:
 		return a.pick.rows(width, n, a.pal, hover, a.reasoningFor)
-	case a.crewPick.open:
-		return a.crewPick.rows(width, n, a.pal, hover, a)
 	case a.effPick.open:
 		return a.effPick.rows(width, n, a.pal, hover)
 	case a.roster.open:
@@ -3243,6 +3241,8 @@ func (a *app) overlayRows(width, n int) []string {
 		return a.connPanel.draw(width, n, a.pal, hover)
 	case a.harnPanel.open:
 		return a.harnPanel.draw(width, n, a.pal, hover)
+	case a.crewUI.open:
+		return a.crewDraw(width, n, hover)
 	case a.harnPick.open:
 		return a.harnPick.draw(width, n, a.pal, hover)
 	case a.skillPick.open:
diff --git a/internal/tui3/render.go b/internal/tui3/render.go
index c64b134ddb..df8e40ad8a 100644
--- a/internal/tui3/render.go
+++ b/internal/tui3/render.go
@@ -1882,7 +1882,7 @@ const ctxRingSize = 6
 type hudSeg uint8
 
 const (
-	// segCrew is the crew's preset word — `crew max` — the OTHER model dial,
+	// segCrew is the crew's reading — `crew auto` — the OTHER model dial,
 	// drawn at the head of the telemetry so it stands beside the conversation's
 	// model across the gap (crew.go's [app.crewSegment] says why it is one word).
 	segCrew hudSeg = iota
@@ -3792,8 +3792,8 @@ const hopDoorWord = hopOpenKey + " chats"
 // What replaces it is a slot that only ever names the keys that WORK RIGHT NOW:
 //
 //	the pointer is theirs drag to select · any key ends it
-//	the picker is open    → lanes · enter switch · esc · crew max
-//	  inside a fold       enter choose · ← back · esc · crew max
+//	the picker is open    → lanes · enter switch · esc · crew auto
+//	  inside a fold       enter choose · ← back · esc · crew auto
 //	the sessions are up   enter open · esc
 //	copy mode is on       v select · a block · y yank · esc
 //	rewind is armed       esc again to rewind        (rewind.go's double esc)
@@ -3838,11 +3838,11 @@ func (a *app) hintWord() string {
 		return "drag to select · any key ends it"
 	case a.pick.open:
 		// AND THE CREW IS NAMED BESIDE THE KEYS, because this list is where a
-		// person lands when the crew they just set did not change anything they
-		// can see. The status line's model readout is the conversation's model,
-		// which /crew never touches by design — so somebody who typed `/crew max`
-		// opens /model hunting for the change, and the one word this slot can
-		// afford tells them the crew is a separate thing that is already set.
+		// person lands when a crew change did not change anything they can see.
+		// The status line's model readout is the conversation's model, which
+		// /crew never touches by design — so somebody who pinned a seat opens
+		// /model hunting for the change, and the one word this slot can afford
+		// tells them the crew is a separate thing.
 		// The picker's rows are the list itself and are reused whole inside the
 		// settings panel ([picker.rowsOwned]), so it has no header or foot of its
 		// own to spend on a sentence; this slot is the line that is already there.
@@ -3856,8 +3856,6 @@ func (a *app) hintWord() string {
 			return keys + " · " + crew
 		}
 		return keys
-	case a.crewPick.open:
-		return "↑↓ · ←→ family · enter apply · esc"
 	case a.effPick.open:
 		// The chord is named beside the keys because this list is the only place
 		// on the surface that can teach it: the chip it opens from prints a mark
@@ -3882,6 +3880,10 @@ func (a *app) hintWord() string {
 		// another project cannot be excepted from a place it never reached
 		// ([standingPlace.hint]).
 		return a.orders.hint(a)
+	case a.crewUI.open:
+		// The crew panel prints its keys in its own bottom edge (crewpanel.go),
+		// and a slot repeating them would say the same thing twice on one screen.
+		return ""
 	case a.subPage.open:
 		// /subharness names its verbs here PER ROW, because enter means two
 		// things on the intake card — fill this field in, or start the run — and
diff --git a/internal/tui3/settings.go b/internal/tui3/settings.go
index 9c4a025073..075ae66ab2 100644
--- a/internal/tui3/settings.go
+++ b/internal/tui3/settings.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strconv"
 	"strings"
 
 	tea "charm.land/bubbletea/v2"
@@ -12,6 +13,7 @@ import (
 
 	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/connect"
+	"github.com/Agent-Field/codeaf/internal/crewroute"
 	"github.com/Agent-Field/codeaf/internal/fuzzy"
 	"github.com/Agent-Field/codeaf/internal/modelsource"
 	"github.com/Agent-Field/codeaf/internal/provider"
@@ -345,68 +347,30 @@ var settingUI = map[string]settingMeta{
 		about: "the model a task runs on when you have not asked for another. " +
 			"Blank runs it on the model you are talking to.",
 	},
-	// THE CREW LIVES ON THE PROVIDERS TAB, with the model it answers under.
-	//
-	// It was on Session for four waves, one tab away from the row that says which
-	// model the conversation is on — so "which model does the planning" and
-	// "which model am I talking to" were two errands on two screens, and a person
-	// comparing them had to remember one while they walked to the other. They are
-	// one question: which model answers what (docs/CHAT-V3.md Decision 6 gives
-	// this tab exactly that job, per-role models included). [modelsSection] is
-	// the order they read in.
-	//
-	// EVERY ONE OF THEM IS A MODEL CHOICE AND IS ANSWERED AS ONE. The tier rows
-	// were a text box for four waves, which meant the only way to name the cheap
-	// model was to type its id from memory — in a panel that already knows every
-	// id, what each one holds, what it costs and how it scores.
-	config.KeyCrew: {
-		tab: tabProviders, label: "crew", widget: widgetCycle,
-		// The one line under this row NAMES ALL THREE OPTIONS AND WHAT EACH ONE IS,
-		// and it is built in [init] from the preset table rather than written here:
-		// a cycle row walks its choices in place, so there is no moment at which a
-		// person is shown three rows to compare — the only place the comparison can
-		// happen is the line they are reading while they press the key.
-	},
+	// THE CREW'S THREE SEATS ARE REGISTRY ROWS AND ARE NOT DRAWN AS THREE ROWS.
+	// Each is empty for AUTO — codeaf routes that seat per task — and a model id
+	// written there is a PIN, the same pin `/crew pin` writes (internal/config's
+	// crew.go). They are kept on this map because the map is total over the
+	// registry, and the Providers tab draws them as ONE row, `seats`, whose
+	// enter opens the crew panel ([sheet.crewDoorItem], crewpanel.go): one
+	// place edits a seat, and it is the place that also says which models a
+	// seat may be picked from and what the crews may spend.
 	config.KeyTierReflexModel: {
 		tab: tabProviders, label: "reflex", widget: widgetSelect,
 		about: "near-free · reads every turn — memory, titles, safety",
 	},
 
-	// The row is placed by build(), not by this map, and it sits directly under
-	// the crew word because it changes what that word means rather than pinning a
-	// model of its own: the three presets answer from open weights or from the
-	// whole catalog, and this is the switch.
-	config.KeyCrewSource: {
-		tab: tabProviders, label: "model family", widget: widgetCycle,
-		about: "which models the crew word draws from: open weights, or the whole " +
-			"catalog with closed and frontier models in it. All is the default.",
-	},
-	// WHERE THE CREW'S MODELS COME FROM, beside the crew word itself. The crew
-	// row says how much to spend and this says where the models for that money
-	// are read from when a class row does not hold a person's own id: the rows
-	// this build measured, or the same budgets recomputed off the catalog on
-	// every read, with or without what the Model Pool and the person's own
-	// judged runs measured. The about is the registry's own hint whole, not its
-	// first sentence, because the three words are the answer and the first
-	// sentence alone would send a person hunting for what catalog means.
-	config.KeyCrewPick: {
-		tab: tabProviders, label: "picked from", widget: widgetCycle,
-		about: "where the crew's models come from. table: the rows we measured. " +
-			"catalog: recomputed from today's published prices and scores at your " +
-			"crew's budget. learn: catalog plus the Model Pool's measurements and " +
-			"your own judged runs.",
-	},
 	config.KeyTierLowModel: {
 		tab: tabProviders, label: "small work", widget: widgetSelect,
 		about: "cheap · the small calls — names, digests, the safety gate",
 	},
 	config.KeyTierWorkerModel: {
 		tab: tabProviders, label: "worker", widget: widgetSelect,
-		about: "does the work · every task, its parts, every run node — most of the bill",
+		about: "does the work · every task, its parts, every run node — most of the bill. Empty is auto: routed per task",
 	},
 	config.KeyTierHighModel: {
-		tab: tabProviders, label: "careful work", widget: widgetSelect,
-		about: "careful · checks what must not be wrong — audits, briefs, vision",
+		tab: tabProviders, label: "checker", widget: widgetSelect,
+		about: "reads finished work and checks what must not be wrong. Empty is auto: routed per task",
 	},
 	// The fourth class is the one whose value may name a LEVEL as well as a
 	// model, so it is a TEXT box and not a picker: the picker returns an id, and
@@ -414,8 +378,8 @@ var settingUI = map[string]settingMeta{
 	// picker dials the CONVERSATION's effort and lives on the session; this one is
 	// written down and outlives it.
 	config.KeyTierMastermindModel: {
-		tab: tabProviders, label: "mastermind", widget: widgetText,
-		about: "thinks · plans runs and designs harnesses — add :low, :medium or :high",
+		tab: tabProviders, label: "planner", widget: widgetText,
+		about: "plans runs and designs harnesses — add :low, :medium or :high. Empty is auto: routed per task",
 	},
 	config.KeyModelRoles: {
 		tab: tabProviders, label: "pinned roles", widget: widgetText,
@@ -784,10 +748,6 @@ func init() {
 	// list of models codeaf uses and wants to know which one is theirs. It is the
 	// same row, the same write, the same live seam onto [app.switchModel] — only
 	// the word above the Models section changed.
-	crew := settingUI[config.KeyCrew]
-	crew.about = crewAbout(config.DefaultCrewSource)
-	settingUI[config.KeyCrew] = crew
-
 	talk := settingUI[config.ModelSettingKey(talkSlot)]
 	talk.label = "your model"
 	talk.about = "the model you are talking to. Everything below it is a model codeaf " +
@@ -795,24 +755,6 @@ func init() {
 	settingUI[config.ModelSettingKey(talkSlot)] = talk
 }
 
-// crewAbout is the crew row's one line: the five rows it writes, then each preset
-// with its own sentence, then what makes the row read custom. The sentences are
-// [config.CrewLineFor]'s IN THE FAMILY ON SCREEN, so the panel and /crew say the
-// same words about the same thing and neither names an open model above frontier
-// ids. The init-time value is the default family; [sheet.metaFor] re-says it from
-// the profile, which is where a family that is not the default comes from.
-func crewAbout(source string) string {
-	said := make([]string, 0, len(config.CrewPresets))
-	for _, preset := range config.CrewPresets {
-		said = append(said, preset+" — "+config.CrewLineFor(source, preset))
-	}
-	// The three options lead, because they are what the keypress chooses between
-	// and the panel gives a row's line the width it has: what gets cut on a narrow
-	// terminal should be the footnote, not the choice.
-	return "the five below, chosen as one word: " + strings.Join(said, "; ") +
-		". Answer one yourself and this reads custom."
-}
-
 // modelsSection is the order the Models rows LEAD the Providers tab in: your
 // model, the crew word, the five classes in [roles.Tiers] order, and then the
 // pins with the roles list hanging off them.
@@ -846,11 +788,6 @@ func modelsSectionOrder() []string {
 		config.KeyLaneGuard,
 		config.KeyRouting,
 		config.KeyPromptProfile,
-		config.KeyCrew,
-		// THE PICK ANSWERS THE CREW WORD'S OWN QUESTION ONE LEVEL DOWN — where
-		// the models for that budget come from — so it reads directly under the
-		// crew word, before the classes it seats.
-		config.KeyCrewPick,
 	}
 	for _, tier := range roles.Tiers {
 		order = append(order, tierSettingKey(tier))
@@ -931,6 +868,11 @@ type sheetItem struct {
 	// they are kept by the engine rather than by the registry, and they draw
 	// through this page's own row grammar.
 	autonomy *autonomyRow
+	// crewDoor is set on the Providers tab's one `seats` row, which stands where
+	// the crew's three seat rows would and opens the crew panel (crewpanel.go);
+	// crewValue is what it says about the crew beside its name.
+	crewDoor  bool
+	crewValue string
 	// read is set on a row of the Spending tab that is a RECEIPT and not a
 	// setting — `today`, and the two rails this build has but does not keep a
 	// registry row for (settingspend.go). It hangs here for [sheetItem.conn]'s
@@ -1416,7 +1358,17 @@ func (s *sheet) build() {
 			s.cursor = s.clampCursor(s.cursor)
 			return
 		}
+		door := false
 		for _, row := range s.tabRows() {
+			// THE THREE SEATS ARE ONE ROW HERE, standing where the first of them
+			// would ([sheet.crewDoorItem]).
+			if crewSeatKey(row.Key) {
+				if !door {
+					s.items = append(s.items, s.crewDoorItem(nil))
+					door = true
+				}
+				continue
+			}
 			meta, _ := s.metaFor(row)
 			s.items = append(s.items, sheetItem{row: row, meta: meta})
 			if row.Key == config.KeyAPIKey && !s.sources.Empty() {
@@ -1471,7 +1423,7 @@ func (s *sheet) build() {
 		matched := make([]settingHit, 0, len(s.rows)/len(settingTabs)+1)
 		for _, row := range s.rows {
 			meta, ok := s.metaFor(row)
-			if !ok || meta.tab != title {
+			if !ok || meta.tab != title || crewSeatKey(row.Key) {
 				continue
 			}
 			score, hit, at, n := s.settingMatch(row, meta, title, terms)
@@ -1492,6 +1444,14 @@ func (s *sheet) build() {
 		// the word is not in one — so the section answers the search itself, under
 		// the tab it lives on.
 		if title == tabProviders {
+			// THE SEATS ROW ANSWERS FOR THE THREE IT STANDS FOR: a search for
+			// "checker", "pin" or "cap" finds the one door to all of them.
+			if door := s.crewDoorItem(terms); door.crewDoor {
+				if len(s.items) == start {
+					s.items = append(s.items, sheetItem{head: title})
+				}
+				s.items = append(s.items, door)
+			}
 			if matched := s.roleItems(terms); len(matched) > 0 {
 				if len(s.items) == start {
 					s.items = append(s.items, sheetItem{head: title})
@@ -1534,11 +1494,6 @@ func (s *sheet) metaFor(row config.Setting) (settingMeta, bool) {
 	if ok && row.Key == config.KeySearchProvider {
 		meta.about = config.SearchProviderHintAt(s.profileDir)
 	}
-	// The crew row names three presets in whichever family the profile is on, so
-	// its sentence is read from the profile for the same reason.
-	if ok && row.Key == config.KeyCrew {
-		meta.about = crewAbout(config.CrewSourceAt(s.profileDir))
-	}
 	// AND THE `lane` ROW IS EXPLAINED BY THE ROUTING IN FORCE, because `auto` is
 	// a different promise under `simple` than under the row codeaf ships with —
 	// the same one door the picker's own `auto` row reads (palette.go's
@@ -1940,10 +1895,71 @@ func (s *sheet) roleAbout(row *roleRow) string {
 	if said != "" {
 		said += " · "
 	}
+	// A CREW SEAT IS NOT A ROW ABOVE ANY MORE: the three seats are the one
+	// `seats` row, so a role riding one names the seat and the panel it is
+	// set on rather than pointing up at a row that is not there.
+	class := row.tierLabel + " above"
+	if crewSeatKey(tierSettingKey(row.tier)) {
+		class = "the " + row.tierLabel + " seat (/crew)"
+	}
 	if row.pin != "" {
-		return said + "pinned, so it ignores " + row.tierLabel + " above. del clears the pin."
+		return said + "pinned, so it ignores " + class + ". del clears the pin."
+	}
+	return said + "follows " + class + ". enter pins it to a model of its own."
+}
+
+// crewSeatKey says whether a registry row is one of the crew's three seats.
+func crewSeatKey(key string) bool {
+	for _, seat := range crewroute.Seats {
+		if key == config.CrewSeatKey(seat) {
+			return true
+		}
+	}
+	return false
+}
+
+// crewDoorWords are what the `seats` row is found by in a search: its name,
+// the panel it opens, and the words for what that panel holds.
+var crewDoorWords = []string{"seats", "crew", "worker planner checker pin", "allowed models providers daily cap"}
+
+// crewDoorItem is the `seats` row: the crew's three seat rows as one, whose
+// enter opens the crew panel. Its value is the crew in the fewest words — how
+// many seats are pinned, which models are allowed, how many of the connected
+// providers are on, the cap — read here, on a
+// build, and never on a draw. With terms it is the row only if they match it,
+// and otherwise an item that is not a door.
+func (s *sheet) crewDoorItem(terms []fuzzy.Term) sheetItem {
+	var hitAt, hitLen int
+	if len(terms) > 0 {
+		_, ok, at, n := s.matchHits(crewDoorWords, terms)
+		if !ok {
+			return sheetItem{}
+		}
+		hitAt, hitLen = at, n
+	}
+	seats := "auto"
+	if n := len(config.CrewPinsAt(s.profileDir)); n > 0 {
+		seats = "auto · " + strconv.Itoa(n) + " pinned"
+	}
+	value := seats + " · models " + config.CrewAllowedAt(s.profileDir).String()
+	if providers := config.CrewProvidersAt(s.profileDir); len(providers) > 0 {
+		on := 0
+		for _, provider := range providers {
+			if provider.On {
+				on++
+			}
+		}
+		value += " · " + strconv.Itoa(on) + " of " + strconv.Itoa(len(providers)) + " providers"
+	}
+	value += " · per task " + config.CrewTaskMoney(config.CrewTaskCapAt(s.profileDir))
+	if capUSD := config.CrewCapAt(s.profileDir); capUSD > 0 {
+		value += " · daily " + crewroute.Money(capUSD)
+	}
+	return sheetItem{
+		crewDoor: true, crewValue: value, hitAt: hitAt, hitLen: hitLen,
+		meta: settingMeta{tab: tabProviders, label: "seats",
+			about: "the worker, planner and checker, the models they may be picked from, the providers they may route through, and the per-task and daily caps · enter opens /crew"},
 	}
-	return said + "follows " + row.tierLabel + " above. enter pins it to a model of its own."
 }
 
 // roleFilter is the question a role's picker asks. Two registered roles are not
@@ -2233,6 +2249,13 @@ func (a *app) activate() tea.Cmd {
 	if item.conn != nil {
 		return a.connAct(item.conn)
 	}
+	if item.crewDoor {
+		// THE SEATS ROW OPENS THE CREW PANEL, and the sheet steps aside for it:
+		// a place cannot draw an overlay, and esc on the panel brings this row
+		// back ([app.openCrew]).
+		a.openCrew()
+		return nil
+	}
 	if item.service != nil {
 		if item.service.planPause {
 			a.cyclePlanPause(item.service.id)
@@ -3181,6 +3204,9 @@ func (s *sheet) rowLinesWithin(item sheetItem, selected, hovered bool, width, bo
 	if item.role != nil {
 		return s.roleRowLines(item.role, s.itemHit(item), selected, hovered, width, pal)
 	}
+	if item.crewDoor {
+		return overlayLinesHit(item.meta.label, item.crewValue, s.itemHit(item), selected, false, hovered, width, pal)
+	}
 	if item.autonomy != nil {
 		return s.autonomyRowLines(item.autonomy, s.itemHit(item), selected, hovered, width, pal)
 	}
diff --git a/internal/tui3/settingspend.go b/internal/tui3/settingspend.go
index 492c00a699..979c141a2f 100644
--- a/internal/tui3/settingspend.go
+++ b/internal/tui3/settingspend.go
@@ -24,7 +24,7 @@ import (
 //	 per day           $500
 //	 per conversation  no limit                          this one $0.41
 //	 per plan          asks first above $100
-//	 per task          no limit of its own    it spends against the day and this conversation
+//	 per task          $5 a task                         set in /crew
 //	 per standing run  $5 a firing                       each order may name its own
 //	 practice          $50 of the day
 //
@@ -36,10 +36,9 @@ import (
 //     before the first call of the day it is not there at all (the emptiness
 //     law — a `$0.00 of $500` on a fresh morning is a claim nobody made).
 //   - `per task` and `per standing run` are rails this build HAS and does not
-//     keep a settings row for. A v3 task carries no dollar cap of its own —
-//     docs/LIMITS.md says so in those words — and a standing order's per-firing
-//     rail is written per item on the `stand` tool. The design asked for seven
-//     rows and the honest way to have seven is to SAY what those two rails are,
+//     keep a settings row for. A task's limit is set in /crew, and a standing
+//     order's per-firing rail is written per item on the `stand` tool. The
+//     design asked for seven rows and the honest way to have seven is to SAY what those two rails are,
 //     not to grow two knobs that write nowhere. A row that pretended to edit a
 //     rail nothing reads would be worse than the absence it was covering.
 //
@@ -114,7 +113,7 @@ func (s *sheet) spendingItems() []sheetItem {
 	add(config.KeyDailyBudget)
 	add(config.KeySpendRail)
 	add(config.KeyPlanConsent)
-	items = append(items, sheetItem{read: taskReading()}, sheetItem{read: standingReading()})
+	items = append(items, sheetItem{read: taskReading(s.profileDir)}, sheetItem{read: standingReading()})
 	add(config.KeyPracticeBudget)
 	for _, key := range order {
 		if _, left := mine[key]; left {
@@ -221,17 +220,14 @@ func subCent(usd float64) string {
 	return fmt.Sprintf("$%.4f", usd)
 }
 
-// taskReading is the rail a task actually runs under, said plainly.
-//
-// A TASK HAS NO DOLLAR CAP OF ITS OWN (docs/LIMITS.md). Its bounds are steps and
-// time; its money bound is whatever the conversation that started it carries,
-// which is the row two above this one and the day's row above that. The design
-// asked for a `per task` row and this is the true one: a person who wanted to
-// know what a task may spend now knows, and knows where to go and change it.
-func taskReading() *railReading {
+// taskReading is the per-task limit a crew task runs under: the figure set in
+// /crew, which stops the task's next call once the task has spent it. The task
+// also spends against the day and the conversation that started it.
+func taskReading(profileDir string) *railReading {
+	figure := config.CrewTaskMoney(config.CrewTaskCapAt(profileDir))
 	return &railReading{name: "per task",
-		value:   rowSay("no limit of its own", "no limit"),
-		receipt: rowSay("it spends against the day and this conversation", "against the day and this chat")}
+		value:   rowSay(figure+" a task", figure),
+		receipt: rowSay("set in /crew · it also spends against the day and this conversation", "set in /crew")}
 }
 
 // standingReading is what one firing of a standing order may spend when the
diff --git a/internal/tui3/settingspend_test.go b/internal/tui3/settingspend_test.go
index e84ee601f8..a078db4317 100644
--- a/internal/tui3/settingspend_test.go
+++ b/internal/tui3/settingspend_test.go
@@ -280,7 +280,7 @@ func TestARowsReceiptIsThereWhenItIsKnownAndAbsentWhenItIsNot(t *testing.T) {
 		t.Fatalf("a conversation that spent nothing invented %q", got)
 	}
 	// And the two readings carry theirs.
-	if got := taskReading().receipt.full; !strings.Contains(got, "against the day") {
+	if got := taskReading(t.TempDir()).receipt.full; !strings.Contains(got, "set in /crew") {
 		t.Fatalf("per task's receipt = %q", got)
 	}
 	if got := standingReading().value.full; got != "$5 a firing" {
@@ -436,7 +436,7 @@ func TestAtSixtyColumnsEveryLabelSurvivesAndTheReceiptGoesFirst(t *testing.T) {
 	}
 	// AND EVERY VALUE IS STILL READABLE AT SIXTY.
 	frame := strings.Join(sheetLabels(a), "\n")
-	for _, want := range []string{config.NoLimitWord, "$500", "no limit of its own"} {
+	for _, want := range []string{config.NoLimitWord, "$500", "$5 a task"} {
 		if !strings.Contains(frame, want) {
 			t.Fatalf("%q did not survive sixty columns:\n%s", want, frame)
 		}
diff --git a/internal/tui3/settingsroles_test.go b/internal/tui3/settingsroles_test.go
index c4f266635d..e6a8f0f54b 100644
--- a/internal/tui3/settingsroles_test.go
+++ b/internal/tui3/settingsroles_test.go
@@ -97,15 +97,15 @@ func TestTheRolesSectionSaysWhatAnswersEachRole(t *testing.T) {
 		role       roles.Role
 		tier, want string
 	}{
-		// The two masterminds sit apart from the careful work now: one answer
-		// that decides what every other call does is a different bill from many
-		// short answers that must not be wrong.
-		{roles.RolePlanner, "mastermind", "test/thinking-model"},
-		{roles.RoleDesigner, "mastermind", "test/thinking-model"},
+		// The two planning roles sit on the planner seat, apart from the
+		// checker: one answer that decides what every other call does is a
+		// different bill from many short answers that must not be wrong.
+		{roles.RolePlanner, "planner", "test/thinking-model"},
+		{roles.RoleDesigner, "planner", "test/thinking-model"},
 		// The worker is the seat that does the work, and sits apart from the
 		// small calls beside it.
 		{roles.RoleWorker, "worker", "test/worker-model"},
-		{roles.RoleAuditor, "careful work", "test/careful-model"},
+		{roles.RoleAuditor, "checker", "test/careful-model"},
 		{roles.RoleTitle, "small work", "test/cheap-model"},
 	} {
 		row := roleItem(t, a, c.role)
@@ -149,7 +149,7 @@ func TestTheRolesSectionSaysWhatAnswersEachRole(t *testing.T) {
 	}
 	want := []string{
 		rolesHead + " · reflex", rolesHead + " · small work", rolesHead + " · worker",
-		rolesHead + " · careful work", rolesHead + " · mastermind",
+		rolesHead + " · checker", rolesHead + " · planner",
 	}
 	if strings.Join(heads, "|") != strings.Join(want, "|") {
 		t.Fatalf("the class headings read %v, want %v", heads, want)
@@ -174,19 +174,18 @@ func TestTheRolesSectionSaysWhatAnswersEachRole(t *testing.T) {
 	if !strings.Contains(selected.meta.about, roles.Describe(roles.RolePlanner)) {
 		t.Fatalf("the selected role's line does not say what it is: %q", selected.meta.about)
 	}
-	if !strings.Contains(selected.meta.about, "follows mastermind above") {
+	// THE PLANNER IS A CREW SEAT, and a crew seat is set on the crew panel
+	// rather than on a row above this one (settings.go's [sheet.roleAbout]).
+	if !strings.Contains(selected.meta.about, "follows the planner seat (/crew)") {
 		t.Fatalf("the selected role's line reads %q", selected.meta.about)
 	}
 }
 
-// A ROLE WHOSE CLASS SHIPS WITH A MODEL ANSWERS ON IT, and a role whose class was
-// CLEARED falls to the conversation — [roles.Resolve]'s floor, and not a failure.
-//
-// The first half is new since the crew landed: all five classes arrive pointed at
-// a model (internal/config's crew.go), because a whole crew following the
-// conversation means the most expensive model in the build answering the cheapest
-// questions in it. The second half is the answer a person can still give.
-func TestARoleFollowsItsShippedClassAndThenTheConversation(t *testing.T) {
+// A ROLE ON A SMALL-WORK CLASS ANSWERS ON THE MODEL THAT CLASS SHIPS WITH, a
+// role on a crew seat answers on its pin, and a crew seat nothing pinned — with
+// no catalog to route from — falls to the conversation, [roles.Resolve]'s
+// floor, never a model this build chose for everybody.
+func TestARoleFollowsItsClassAndThenTheConversation(t *testing.T) {
 	a, _ := sheetApp(t)
 	a.openSettings()
 	toProviders(t, a)
@@ -195,22 +194,20 @@ func TestARoleFollowsItsShippedClassAndThenTheConversation(t *testing.T) {
 		role roles.Role
 		want string
 	}{
-		{roles.RolePlanner, config.DefaultMastermindModel},
-		{roles.RoleWorker, config.DefaultWorkerModel},
 		{roles.RoleTitle, config.DefaultLowModel},
-		{roles.RoleAuditor, config.DefaultHighModel},
 		{roles.RoleReflex, config.DefaultReflexModel},
 	} {
 		if got := roleItem(t, a, c.role).model; got != c.want {
 			t.Errorf("%s resolves to %q, want its class's shipped %q", c.role, got, c.want)
 		}
 	}
-
-	// Cleared on purpose is an ANSWER: the class follows the conversation and so
-	// does every role on it.
+	setRow(t, a, config.KeyTierMastermindModel, "vendor/pinned-planner")
+	if got := roleItem(t, a, roles.RolePlanner).model; got != "vendor/pinned-planner" {
+		t.Errorf("with the planner pinned, the planner role resolves to %q", got)
+	}
 	setRow(t, a, config.KeyTierMastermindModel, "")
 	if got := roleItem(t, a, roles.RolePlanner).model; got != a.model {
-		t.Errorf("with the mastermind cleared, the planner resolves to %q, want %q", got, a.model)
+		t.Errorf("with the planner back on auto and nothing to route from, the planner resolves to %q, want %q", got, a.model)
 	}
 }
 
@@ -335,11 +332,11 @@ func TestSearchingFindsARoleByName(t *testing.T) {
 // panel grew, so it must not touch whatever the cursor happens to be on.
 func TestDelOnAnOrdinaryRowChangesNothing(t *testing.T) {
 	a := tieredSheet(t)
-	cursorTo(t, a, config.KeyTierHighModel)
+	cursorTo(t, a, config.KeyTierLowModel)
 	drive(t, a, key("delete"))
 
-	row, _ := a.sheet.registry.Row(config.KeyTierHighModel)
-	if row.Value() != "test/careful-model" {
+	row, _ := a.sheet.registry.Row(config.KeyTierLowModel)
+	if row.Value() != "test/cheap-model" {
 		t.Fatalf("del changed a tier row to %q", row.Value())
 	}
 	if got := roleItem(t, a, roles.RoleWorker); got.pin != "" {
diff --git a/internal/tui3/slotfilter_test.go b/internal/tui3/slotfilter_test.go
index 8136e58f25..8589618d66 100644
--- a/internal/tui3/slotfilter_test.go
+++ b/internal/tui3/slotfilter_test.go
@@ -192,7 +192,7 @@ func TestTheHintSlotFollowsTheKeyboard(t *testing.T) {
 	a.pick.open = true
 	// And the crew rides the end of it on any launch that has one (crew.go's
 	// [app.crewHint]).
-	if got := a.hintWord(); got != "enter switch · esc · crew "+config.DefaultCrew {
+	if got := a.hintWord(); got != "enter switch · esc · crew auto" {
 		t.Fatalf("an open picker offered %q", got)
 	}
 	a.pick.open, a.copy.on = false, false
diff --git a/internal/tui3/statusnote.go b/internal/tui3/statusnote.go
index ba2b0909cf..7295aac936 100644
--- a/internal/tui3/statusnote.go
+++ b/internal/tui3/statusnote.go
@@ -6,7 +6,6 @@ import (
 
 	"github.com/charmbracelet/x/ansi"
 
-	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/session"
 )
 
@@ -198,8 +197,8 @@ func (a *app) statusFacts(text string) []string {
 			// already the lifted fact one row above. So the row keeps its sentence
 			// and stays in the dim tier, which is what a row whose answer is a
 			// sentence should do (#444).
-			if !a.oneModel {
-				out = append(out, config.CrewClassModels(a.profileDir)...)
+			if reading, ok := a.crewReading(); ok && !a.oneModel {
+				out = append(out, reading.models...)
 			}
 			continue
 		}
diff --git a/internal/tui3/task.go b/internal/tui3/task.go
index 06da4be8d0..bb3bb0610f 100644
--- a/internal/tui3/task.go
+++ b/internal/tui3/task.go
@@ -6054,17 +6054,14 @@ func (a *app) taskUpdate(ev session.Event) tea.Cmd {
 		a.landedCard(node)
 	}
 	var pilot tea.Cmd
+	// A ROUTED TASK SAYS ITS CREW TWICE: which crew it got and the estimate
+	// when it starts, and what it cost beside the estimate when it lands
+	// (crew.go's [app.sayTaskCrew], once per end per task).
+	a.sayTaskCrew(*notice)
 	switch notice.State {
 	case session.TaskRunning:
 		// The node is alive, so the surface starts WATCHING it (see [taskPilot]).
 		pilot = a.flyPilot(notice.ID)
-		// AND THIS IS THE MOMENT THE WORK SEAT IS ACTUALLY SPENT, which is where
-		// the one line about a seat nobody pinned belongs (crew.go's
-		// [app.sayWorkSeat], said once per session). It is here rather than at
-		// either door — the /task command's own receipt, and the proposal a
-		// person answers — because both roads end at this fold and a line hung
-		// on one of them would be silent on the other.
-		a.sayWorkSeat()
 	case session.TaskDone, session.TaskFailed, session.TaskUnverified:
 		// UNVERIFIED IS A LANDING. The run is over, the slot is handed back and
 		// the pilot's lane has ended, so a surface that waited for one of the
@@ -6182,6 +6179,10 @@ func (a *app) dropTasks() {
 	a.closeRoom()
 	a.task = nil
 	a.tasks = nil
+	// THE CREW LINES GO WITH THEIR TASKS. They are keyed by task number, and
+	// the next conversation numbers its tasks from 1 again: a line remembered
+	// as landed would silence that conversation's own task 1.
+	a.crewSaid = nil
 	a.typedTaskBriefs = nil
 	a.taskOrder = nil
 	a.taskSeen = nil
diff --git a/internal/tui3/taskcommand.go b/internal/tui3/taskcommand.go
index 4e29b7e005..2fc2869512 100644
--- a/internal/tui3/taskcommand.go
+++ b/internal/tui3/taskcommand.go
@@ -28,6 +28,49 @@ type taskCommandAgent interface {
 	StartTask(context.Context, string, bool) (uint64, string, string, error)
 }
 
+// taskCrewEffortAgent is the session's door for a task with a one-task effort
+// word said: best or cheap (session's taskcrew.go). It is a second interface
+// rather than a wider first one, so a surface or a test double that has only
+// the ordinary door still starts ordinary tasks.
+type taskCrewEffortAgent interface {
+	StartTaskEffort(context.Context, string, bool, string) (uint64, string, string, error)
+}
+
+// redoAgent is the session's door for `/redo stronger`.
+type redoAgent interface {
+	RedoStronger(context.Context, uint64) (uint64, string, error)
+}
+
+// runRedo is `/redo stronger`: the newest task this conversation started, run
+// again with every seat nobody pinned one step stronger. The router's log is
+// told the first crew under-served this kind of work here, so the next task
+// like it starts a step higher until enough accepted work decays it back.
+func (a *app) runRedo(arg string) tea.Cmd {
+	if strings.ToLower(strings.TrimSpace(arg)) != "stronger" {
+		a.note("usage: /redo stronger")
+		return nil
+	}
+	door, ok := a.agent.(redoAgent)
+	if !ok {
+		a.note("could not redo · this session has no task door")
+		return nil
+	}
+	ctx, conv := a.ctx, a.taskBriefConv()
+	return a.offLoop(func() func(bool) tea.Cmd {
+		id, title, err := door.RedoStronger(ctx, 0)
+		started := taskStartedMsg{kind: "single", id: strconv.FormatUint(id, 10), title: title, err: err, conv: conv}
+		return foldTaskStarted(started)
+	})
+}
+
+// foldTaskStarted hands a start's receipt to the ordinary task-start handling,
+// wherever the window is standing: the receipt carries its own conversation.
+func foldTaskStarted(started taskStartedMsg) func(bool) tea.Cmd {
+	return func(bool) tea.Cmd {
+		return func() tea.Msg { return started }
+	}
+}
+
 type taskStartedMsg struct {
 	kind, id, title string
 	err             error
@@ -73,6 +116,13 @@ func (a *app) runTaskCommand(arg string) tea.Cmd {
 	// THE WHOLE VOCABULARY IS TWO FORMS: a brief, or `solo` and a brief. A first
 	// word that is neither of those is simply the beginning of the brief, so the
 	// split is taken once here and the brief defaults to everything typed.
+	// HOW HARD TO TRY THIS ONE TASK comes first when it is said at all —
+	// `/task --best …`, `/task --cheap …` — and moves this task's crew and
+	// nothing after it (crew.go). A flag that is neither is part of the brief.
+	effort := ""
+	if flag, after, _ := strings.Cut(arg, " "); flag == "--best" || flag == "--cheap" {
+		effort, arg = strings.TrimPrefix(flag, "--"), strings.TrimSpace(after)
+	}
 	word, rest, _ := strings.Cut(arg, " ")
 	rest = strings.TrimSpace(rest)
 	brief, solo := arg, false
@@ -99,9 +149,26 @@ func (a *app) runTaskCommand(arg string) tea.Cmd {
 		}
 	}
 	if brief == "" {
-		a.note("usage: /task <brief> · /task solo <brief>")
+		a.note("usage: /task <brief> · /task solo <brief> · /task --best <brief> · /task --cheap <brief>")
 		return nil
 	}
+	if effort != "" {
+		door, ok := a.agent.(taskCrewEffortAgent)
+		if !ok {
+			a.note("this session cannot choose a task's crew · the brief starts on the crew it would have had")
+		} else {
+			solo = solo || config.TaskStartAt(a.profileDir) == config.TaskStartSingle
+			a.noteBeforeTaskStart(brief)
+			ctx, conv := a.ctx, a.taskBriefConv()
+			return a.offLoop(func() func(bool) tea.Cmd {
+				id, title, note, err := door.StartTaskEffort(ctx, brief, solo, effort)
+				return foldTaskStarted(taskStartedMsg{
+					kind: "single", id: strconv.FormatUint(id, 10), title: title,
+					err: err, note: note, brief: brief, conv: conv,
+				})
+			})
+		}
+	}
 	// ONE WORKER'S WORK IS SAID TWO WAYS, and both are the person's own word:
 	// `/task solo` says it outright for this brief, and a standing `single` in
 	// `starting a task` says it in advance for every brief. Either way the engine
@@ -134,6 +201,19 @@ func (a *app) startTaskDoor(door taskCommandAgent, brief string, solo bool) tea.
 	// lands: the door is opened on a goroutine and the window may have moved on
 	// by the time it answers ([app.adoptTypedBrief] is where that matters).
 	conv := a.taskBriefConv()
+	a.noteBeforeTaskStart(brief)
+	return func() tea.Msg {
+		id, title, note, err := door.StartTask(ctx, brief, solo)
+		return taskStartedMsg{
+			kind: "single", id: strconv.FormatUint(id, 10), title: title,
+			err: err, note: note, brief: brief, conv: conv,
+		}
+	}
+}
+
+// noteBeforeTaskStart says the two lines a person is owed in the last moment
+// before a typed task is handed over and paid for — whichever door opens it.
+func (a *app) noteBeforeTaskStart(brief string) {
 	// WHO ELSE IS ALREADY IN THESE FILES, SAID BEFORE THE SPEND. `/task` shows no
 	// proposal card — the person typed the brief, so there is nothing to consent
 	// to — which means this note is the only place the fact can reach them, and
@@ -164,13 +244,6 @@ func (a *app) startTaskDoor(door taskCommandAgent, brief string, solo bool) tea.
 	if line := session.UnsavedEditsNote(a.workspace); line != "" {
 		a.note(line)
 	}
-	return func() tea.Msg {
-		id, title, note, err := door.StartTask(ctx, brief, solo)
-		return taskStartedMsg{
-			kind: "single", id: strconv.FormatUint(id, 10), title: title,
-			err: err, note: note, brief: brief, conv: conv,
-		}
-	}
 }
 
 // taskShapingNote is the forming block's phase word on the one road that still
diff --git a/internal/tui3/tui3_test.go b/internal/tui3/tui3_test.go
index 68c75553c1..8d2183e9b0 100644
--- a/internal/tui3/tui3_test.go
+++ b/internal/tui3/tui3_test.go
@@ -881,15 +881,6 @@ func newTestAppWithProfile(profileDir string, agent Agent) *app {
 	// developer who turned it off in their own codeaf would run a different
 	// suite. The quick behaviour has tests of its own that turn it on outright.
 	a.hopQuick = false
-	// AND IT PINS THE WORK SEAT'S QUESTION AS ALREADY ASKED, for the seventh
-	// time for the reason the six pins above exist. The one line about a crew
-	// older than the work seat is read from the PROFILE (crew.go's
-	// [app.workSeat]), and a bare app has no profile of its own — so a suite run
-	// on a machine whose own crew predates the worker row would grow a note in
-	// every test that starts a node, and one run on a machine whose crew does
-	// not would grow none. A test that means the line builds a profile and asks
-	// for it outright (crewseat_test.go's crewSeatLab).
-	a.workSeatSaid = true
 	// AND IT PINS THE NOTICES TO THIS SESSION, for the eighth time for the same
 	// reason. The ledger is a file in the state root now that an empty profile
 	// directory resolves there like every other persisted thing (#315), and this
diff --git a/internal/tui3/welcome.go b/internal/tui3/welcome.go
index 0cf5206e97..b57cc23a36 100644
--- a/internal/tui3/welcome.go
+++ b/internal/tui3/welcome.go
@@ -1199,7 +1199,7 @@ func (w *welcome) recentName(i int) string {
 }
 
 // welcomeModelLine is the line under the wordmark: what is answering, and which
-// crew stands behind it — `anthropic/claude-sonnet-4.5 · balanced crew`.
+// crew stands behind it — `anthropic/claude-sonnet-4.5 · auto crew`.
 //
 // The model is its whole routing address and not the basename the status row
 // keeps, because this line is where a person who is about to spend their own