router: the Public Share refusal names which of your settings declined (#1201, #1252)

[gen16k]

A turn refused on the Waired public share entry told the operator the
opposite of what had happened. The /model picker hides the row when Public
Share is off, but the id still arrives — a session keeps whichever entry it
last picked, and the pre-#1185 spelling is still routed for exactly that
reason — and the refusal came back as:

No mesh peer is available (routing=public-share-only: no public machine is
reachable right now); local state="ready". Pick an Anthropic model in /model …

Nobody was unreachable. The operator's own posture was off, and while it is
off the grant acquirer releases every held grant, so the map holds no provider
and the reachability arm fires. Not vague — false.

Why it read that way

peerOnlyMissNote had three arms, and publicGateFor collapsed four
causes into one zero publicGate: policy unwired, mode off, never consented,
and the per-class Main/Sub toggles. All four produce auto == false, so
the arm that names the posture was unreachable for them, and they fell through
to the two arms that describe the world.

A fifth cause was invisible too: peers dropped by the consumer's own Public
Share size floor were not counted anywhere — publicShortfall.belowFloor
counts only the operator's Inputs.MinModelSize.

What this does

publicGate records which switch refused. Five explicit returns from
publicGateFor, with consent tested before mode: EffectiveMode already
folds "never consented" into "off" before the policy reaches the router, so a
mode-first order leaves that case permanently unnameable. The reason is taken
from the gate the attempt actually used rather than re-read from the policy —
the policy is republished under an atomic pointer while a selection runs, and
a waired public use --off landing in between would explain the refusal with
a posture that did not cause it. (Same hazard effectivePref avoids by
reading the routing preference once and handing it down.)

The settings arms come before the reachability arm. That ordering is the
defect. Reachability still comes before the auto comparison, which the old code
already had right: with nobody lending, no comparison ran, so "none was better"
would be equally untrue.

The consumer's size floor is its own shortfall. Two floors, two settings,
two commands — waired public use --min-model-size and
waired worker set --min-model-size. buildMeshCandidates now returns a named
meshDrops tally rather than a bare int, and the public count deliberately
does not feed the SizeFloorError wrapper, which names the operator's
command. It is also kept off publicGate, even though the pointer travels for
free: pinnedNodeCandidates shares that gate and discards its floor count, so
a gate-carried counter would silently absorb pin-pass drops.

The refusal leads with the entry that declined. The operator picked one row
in /model; no mesh peer is available … local state="ready" answered with
two Waired-internal facts about a machine the turn was never going to run on.
ModelNotReadyError gains PublicShare, and Error() a third arm on the same
discriminant it already branches on. local state stays everywhere else —
#828 put it there deliberately, on branches where it is the next fact an
operator reads.

The operator's routing floor stands aside on a public-only turn. It
disqualified this host's engine, which this route never intended to use, so
waired worker set --min-model-size is the wrong switch to send someone to.
Owner ruling 2026-09-06, narrowing #1128's floor-first order by this one case
and recorded in
docs/decisions/20260906/0410-the-public-entry-answers-for-its-own-refusal.md.

The wording reuses only vocabulary waired public status already prints
(Use public nodes, Consented, Smallest model accepted, Main agent,
Sub agents) and names the command that changes each setting, per owner
ruling 2026-09-06. Nothing new is coined.

Also fixes #1252 — the reason could be replaced by a retry

meshMiss stamps the error with this host's local model state, and
ModelIsArriving read nothing but that field. On the branches that refuse to
run here — peer-only, public-only, pinned — a host midway through a download
therefore answered every refusal with 503 overloaded_error +
Retry-After: 30. The client retries, the reason is never shown, and the
retries end only when an unrelated download does. That is #788's defect
reintroduced through a field that means something different on the branch that
set it, and it would have made this PR's wording invisible on exactly the hosts
most likely to hit it.

ModelNotReadyError.LocalArrivalAnswers now states whether local arrival is
evidence at all. False by default, on purpose: the inverted polarity would
have touched two production sites instead of six, but its zero value is the
unsafe direction, and a future never-consults-local branch that forgets the
flag would silently restore the ten-silent-503s failure. The safe direction's
worst case is a 400 for a genuinely downloading local model, which #1180
already ruled is an acceptable end for a turn.

ModelIsArriving has four readers and they move together (#740): the Anthropic
surface (503 → 400 fail-closed), the OpenAI surface (503 → 404
model_not_served), selectionErrorReason/selectionStatus, and management's
/explain dry run.

Tests

• internal/router/public_refusal_note_test.go (new): publicGateFor's table
  including the consent-before-mode row; every arm of the reason function plus
  an assertion that no two causes produce the same sentence; the two arms
  that had no test at all before; the public floor counted as its own
  shortfall and not as the operator's; and the floor-ordering ruling.
• The end-to-end refusal test runs each cause against two maps — grants
  released (what a posture-off host actually looks like, and the shape that
  produced the false sentence) and a grant still held (the propagation window).
  Checked by mutation: restoring the old arm order fails three subtests.
• internal/router/model_not_ready_test.go: ModelIsArriving per constructor,
  and a SelectK-level pair where peer-preferred must still answer true —
  that row is the regression guard for the whole change.
• internal/gateway/public_share_refusal_test.go (new): the body a client
  actually receives, asserted verbatim, plus the absence of Retry-After.
  Nothing pinned that before — the router tests stop at err.Error().
• internal/gateway/selection_error_test.go gains the row where the same
  arriving state answers 404 because the branch never looked locally.

This PR inverts an existing assertion. public_only_test.go's
"posture off admits nothing at all" asserted only err != nil, which is how
the wrong sentence shipped; it is now a table over the causes, each of which
must name its own switch and must not say "reachable". Its sibling keeps its
two rows and gains a note that "the two ways" was a count taken before this.

Test-after rather than test-first: the branch table could not be written until
the measurement below established which arm the posture-off case actually
lands on.

Checks

go build ./..., go test ./..., gofmt -l,
golangci-lint run --max-same-issues=0 (cache cleaned first), the decision-log
guard, i18n-pair-guard.sh, and npm run i18n:check (32 pairs in sync).

Notes for reviewers

• ModelNotReadyError is an exported type with exported fields. A
  construction outside this repository takes LocalArrivalAnswers: false and
  answers 400 where it used to answer 503 — the fail-closed direction, but
  worth a grep on the monorepo side.
• Not changed, and stated as today's behaviour: /anthropic/v1/models still
  advertises waired/public unconditionally, including on a host with Public
  Share off. The picker drops it; the model list does not, because the
  intercept has to be able to route an id a client still holds. Routing and
  advertising are separate questions and the second one has other readers.
• The pinned branch (routing=pinned) gets the router: a peer-only refusal borrows this host's download and answers 503 instead of saying why #1252 status fix but no reason
  table; its note stays the fixed string it was.

Fixes #1201
Fixes #1252
Refs waired-ai/waired#1313

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJUUSmAfbRdjER1seDdjXm

[github-actions]

📘 Docs preview — the preview channel for this PR has been deleted now that it is closed.