claude gateway: retire the auto route — a turn runs where its model id says, and fails closed

[gen16k]

Retires the Claude gateway's auto route and every automatic crossing between
Waired and the real Anthropic API. A turn now runs where its model id says, and
when the side it names cannot answer it fails with a reason Claude Code shows at
once.

Owner ruling: waired-ai/waired#1313, recorded in
docs/decisions/20260903/0333-no-automatic-crossing-to-or-from-anthropic.md
(merged as #1189) and its private twin.

What the gateway does now

• A Waired id is served on a Waired node, or the turn fails with a reason.
• An id the real Anthropic API serves passes through, errors relayed verbatim.
• An id naming neither side is served here — relaying it would only buy a 404
  there, and it keeps the sentinel's claim exact: nothing but a turn carrying a
  real Anthropic model id leaves the machine.

Removed

routeAuto and the per-class route axis; internal/proxy/intercept/fallback.go
(the post-dispatch fallback recorder) and reroute_notice.go (the SSE notice,
#757); passthroughWithLocalDegrade's degrade branch (waired-ai/waired#665),
including for the auto-mode classifier; the agent-not-wired / degraded fail-open
passthrough; the X-Waired-Fallback, X-Waired-Fallback-Allowed,
X-Waired-TTFB-Budget-Ms and X-Waired-Min-Model-Size headers; last_fallback
and desired-claude-routing; waired claude route and the /waired-route
skill; the Stop hook waired claude _fallback-hook and its managed-settings
entry; the tray's main-3 / sub-4 route rows and its fallback note; the
Waired auto — 1M picker row; the statusline's fallback → Anthropic,
fell back → Anthropic and Waired-only segments.

X-Waired-Fallback-Reason and the tray's Recent activity rows are untouched:
those report Waired picking a different computer on your own mesh, which is a
different mechanism from the crossing this removes.

The fail-closed error shape

HTTP 400, with a message naming what could not answer and the two ways out.
Measured against Claude Code 2.1.259 (stub gateway, one status per run):

status	requests sent	what the user sees
400	1	API Error: 400 <our message> — verbatim, at once
401	3	prefixed Failed to authenticate.
403	1	prefixed Failed to authenticate.
404	2	our message discarded → "There's an issue with the selected model…"
409	3	verbatim
422	1	verbatim
429	3	rewrapped as a rate limit
503	3	verbatim, after the retries

400 is the only status shown at once, verbatim, with one request and no
misleading prefix — which also confirms rc5's O14 (waired-ai/waired#1309): a 404
throws our message away, so today's model_not_served and floor 404s lose their
text inside Claude Code.

A condition that clears by itself keeps its retryable shape: weights still
arriving, every peer momentarily at capacity, a runtime still installing stay
503 with a Retry-After. anthropicSelectionStatus decides the two sets once,
so the event ring records the status the client received (waired-agent#740).

Waits

waitPolicyFor split by leg instead of by the intercept's permission header:

• a peer leg keeps the liveness watch and stays uncommitted, so its failure
  can still carry a status that names the peer;
• a local leg is never aborted and writes an SSE keep-alive.

This closes a hole the header hid: a pinned peer leg previously got no wait at
all and hung silently. capacityQueueBudget is now always armed for the same
reason its own comment gives — every leg has nowhere else to go.

Fixes waired-agent#1180

A named peer row whose peer disappears now ends the turn at once with the peer's
name (PinnedPeerUnreachableError gained PeerName, resolved from the mesh
snapshot, grant pseudonym for a Public Share peer per spec §8.5), instead of ten
anonymous API error · Retrying 1/10 attempts.

Fixes waired-agent#1183

localRequest builds the local-inference request from an allowlist instead of
cloning: Content-Type, Accept, Accept-Encoding, anthropic-version,
anthropic-beta, x-claude-code-* and waired's own X-Waired-*. Everything
else — Authorization, x-api-key, Cookie, Proxy-Authorization,
User-Agent, and any header this build has not heard of — is not copied, so a
header added upstream is dropped by default rather than forwarded by default.
The passthrough leg stays byte-exact, as the gateway contract requires.

waired no longer sets Claude Code's default model

Owner ruling 2026-09-04, recorded in
docs/decisions/20260904/0146-waired-does-not-set-claude-codes-default-model.md,
which partially supersedes 20260828/0252 §4. §4 was safe only while a Waired
turn could still be carried to the real Anthropic API; with turns failing closed
a written Waired default would break every session on a computer with no engine
and no peer (rc5 had exactly such a host). A value already in the file is left
alone, and waired claude disable still removes one Waired wrote.

Inverted tests, each saying so at its site

• TestWaitPolicyFor's "peer, no header (pinned route) → no wait" row.
• claudemanaged: Write removes a retired Stop hook instead of installing one.
• TestAnthropicMessages_PinnedPeerUnreachable…: 503 → 400, and Retry-After
  must now be absent (a fail-closed pin has nothing to wait for).
• selection_error_test's contract table is now per-surface: the Claude side
  fails closed, the OpenAI side is unchanged (other clients, other retry rules).
• The sentinel's escape signature: a degraded 2xx / masked 502 → an
  upstream-unreachable 502 on a leg that claims to be served locally.

Verification

• gofmt / go vet (+ -tags prod, + proto) / golangci-lint run /
  go test ./... / make verify-cross / make ci-lint-local (34 guards) all
  green locally.
• docs-site: npm run i18n:check — 32 page pairs in sync; npm run build OK.
• The 400 measurement above, against a real claude binary.
• Real-hardware verification (sv-mag + sv-macmini) is planned once this is
  merged: single-machine fail-closed, the named-peer repro for claude: when a named peer row's peer disappears, the client just shows "API error · Retrying 1/10" — no peer name, no reason #1180, an
  Anthropic id under a blackholed upstream, and that waired claude enable
  leaves ~/.claude/settings.json alone.

Notes for the lanes waiting on this

• waired-agent#1168 / gateway: a thinking-only local reply is retried once, then surfaces as engine_truncated_stream on a 200 stream #1179 (L89): the local_status_* fallback vocabulary is
  gone; engine_request_failed and engine_truncated_stream are untouched.
  The ratified minimum-model-size phrasing (waired-agent#1128 — "a large model",
  never "a large model or larger") moved from the deleted reroute notice into
  internal/gateway/anthropic.go's modelTooSmallDetail, and should collapse
  into the router's own error text when router: two error texts that mislead — a ready model called "not in ready state", and a hidden reason for the public entry (0.0.3-rc5) #1178 moves the rule there.
• waired-agent#1185: claude-waired-auto keeps its spelling and now means
  "any Waired node, fail-closed"; the id redesign and the modelPicker move are
  still yours. Note that waired claude enable no longer writes a default model
  at all, which changes that issue's last bullet.

Fixes #1184
Fixes #1183
Fixes #1180
Refs waired-ai/waired#1313
Refs waired-ai/waired#1312

🤖 Generated with Claude Code

https://claude.ai/code/session_012FKTcq342KkitvJxaviMdR

[github-actions]

📘 Docs preview — the preview channel for this PR has been deleted now that it is closed.

[gen16k]

Real-hardware verification — sv-mag (linux, vLLM 0.28.0 / gpt-oss-20b)

Ran against this branch's build, installed over the host's binaries and the
daemon restarted. Everything below is verbatim.

The surfaces lost their route rows

waired claude status before / after the swap:

-fallback hook:      not installed
-main conversation:  auto
-subagents:          same as main  (auto — prefer Waired; visible fallback to Anthropic on failure)
+waired node:        auto (this device or a mesh peer)   (change with `waired worker`)

waired claude route auto → exit 1:

waired: `waired claude route` was removed: a turn runs where its model says, so
choose in Claude Code's /model — a Waired entry to run it on your computers, an
Anthropic model to run it on your Claude subscription. `waired claude status`
shows what the last turn did

The upgrade path cleans up after the retired mechanisms

Seeded managed settings with the retired Stop hook and an operator's own,
plus a stale ~/.claude/skills/waired-route/, then ran sudo waired claude enable:

=== hooks AFTER ===
{"SessionStart":[{"hooks":[{"command":"command -v waired >/dev/null 2>&1 && waired claude _models-cache write --from-managed --peer-entries 5 || true",…}]},
 "Stop":[{"hooks":[{"command":"/usr/local/bin/my-own-stop","type":"command"}]}]}
=== user model AFTER ===
"claude-waired-peer"          # unchanged
=== route skill AFTER ===
ls: cannot access '…/.claude/skills/waired-route': No such file or directory

waired's Stop entry gone, the operator's kept, the SessionStart hook untouched,
the stale slash command removed.

waired writes no default model

Removed model from ~/.claude/settings.json, ran waired claude enable again:

model removed:        "(absent)"
model AFTER enable:   "(absent)"

Picker cache after enable — four rows, and the retired 1M row is not among them:

claude-waired-auto
anthropic-waired-local
claude-waired-peer
claude-waired-peer-sv-macmini-local

A Waired turn runs on Waired

HTTP 200 in 0.267s   # engine ready here
HTTP 200 in 3.700s   # local inference OFF — a peer took it
⚡ waired: on Waired (peer sv-macmini.local: qwen3.5-9b)

The second one is worth noting on its own: with this computer's engine off, the
any-node row was answered by a peer and the footer named the peer and the
model. That is the attribution path #1042/#602 built, unchanged.

… and fails closed when no node can

Local inference off and waired worker set --mode=local-only, so nothing on
Waired can take it:

HTTP 400 in 0.0008s
{"type":"error","error":{"type":"waired_inference_disabled","message":"Local inference is turned off on this host. Pick an Anthropic model in /model to send this turn to the cloud, or run `waired doctor` to see what is missing."}}

Through a real claude binary, same state — shown at once, verbatim, no retry
loop:

API Error: 400 Local inference is turned off on this host. Pick an Anthropic
model in /model to send this turn to the cloud, or run `waired doctor` to see
what is missing.

waired-ai/waired#665 is gone

0.0.0.0 api.anthropic.com in /etc/hosts, daemon restarted so no pooled
connection survives, then a turn naming claude-opus-5:

HTTP 502 in 0.0007s
{"error":{"message":"waired proxy could not reach the upstream API: dial tcp 0.0.0.0:443: connect: connection refused","type":"waired_upstream_unreachable"},"type":"error"}

Not answered by a local model. The response carries no X-Waired-* header at
all, and the daemon recorded the side correctly:

{"last_request_model":"claude-opus-5","last_request_route":"anthropic",…}

— no policy, no last_fallback in the payload any more, and
last_request_route is what the routing sentinel asserts on
(docs/decisions/20260829/1655).

/etc/hosts restored; api.anthropic.com resolves normally again.

Not covered here

• waired-agent#1180's own repro (a named peer row whose peer stops sharing)
  needs a second machine to toggle sharing on, and sv-macmini is held by another
  lane. The error shape and the peer naming are covered by unit tests
  (PinnedPeerUnreachableError.PeerName, selection_error_test.go); the live
  repro is queued.
• A pre-existing display gap this made easier to see: the footer's peer half
  reads the mesh's reachability but not the waired worker mode, so with
  --mode=local-only and the engine off it still rendered
  ⚡ waired: on Waired (peer …) while the turn in fact failed closed. Same
  claim on the old auto branch, so this branch does not introduce it — but the
  red row is now the only warning, which makes it worth its own issue.

Host left on: this branch's build (0.0.0-dev), engine ready, inference on,
sharing on / public off, /etc/hosts restored, managed settings holding only
the SessionStart hook.