Your model calls, now evidence-routed.

A serve through rungs 02 to 04 is disclosed, never silent: x-finest-requested-model and x-finest-served-model diverge, the receipt records the exact rule as resolved_by_lineage with its basis, and the console lists the request as Matched instead of Served as asked. A match by name is not an evidence-gated demotion: the match itself adds no fee, and the savings share applies only where sealed evidence separately serves the request cheaper.

A name no rung recognizes is refused with 404 model_not_found in your SDK's own error dialect, reading is not an admitted model on this gateway. When a served name is close enough, the message names up to three of them, so a typo answers itself; a string with nothing close gets the unadorned refusal. Under strict matching the refusal instead names the model the ladder would have served, which is the one fact a strict caller needs to decide what to do next.

curl -s "$FINEST_GATEWAY_URL/v1/public/served-models"

{
  "models":  ["<model>", "<provider>/<model>"],
  "aliases": ["<retired-model>", "<provider>/<retired-model>"]
}

Token counting is answered on the Anthropic wire, proxied to Anthropic's own counter so every answer comes from one declared tokenizer: a Claude model counts on its own, and a non-Anthropic pin counts on the claude-sonnet-5 basis rather than its vendor's. It is free and unreceipted, with a per-key rate limit that answers 429 rate_limited above roughly two calls a second. The Anthropic-wire model listing is the curated Claude Code catalog, narrower by design than the OpenAI-shaped listing. Under the TypeScript shim both of those Anthropic paths currently go direct to the provider unreceipted, because the shim treats every Anthropic path except Messages as unsupported; call them on the gateway base URL when you want the Finest answer. The TypeScript shim keeps embeddings, Responses, images, audio, files, batch calls, and other unsupported official-client paths direct and unreceipted. Pure key swap clients do not have that bypass. Portable request parsing rejects fields it cannot preserve instead of dropping them. Provider-semantic errors pass through unchanged. Streamed requests serve under the same evidence law as buffered ones, and every streamed serve is receipted with the models and prices it actually carried. stream_options.include_usage: true is part of the portable subset on every model: a managed stream always answers with one final usage chunk, so asking for it by name serves canonically rather than forcing verbatim forwarding.

Some substitutes reason before they answer, and that reasoning spends the same max_tokens budget as the visible reply. Below a measured floor a tight cap can be consumed before any output exists, so requests under the floor are served exactly as asked at pass-through price; the receipt names the floor. The default floor is 4096 tokens. A substitute sealed at a lower cap carries its own floor, and the floor is never higher than the cap its evidence was measured at.

A request served as asked for this reason carries x-finest-eligible-max-tokens: the max_tokens that would make it eligible for a substitute. The receipt sentence says the same thing, and the console shows the eligible cap beside the row. Your request is never rewritten: max_tokens stays exactly what you sent.

1. 01

   Freeze the job

   Bind prompt, schema, provider, endpoint, model revision, decoding, effort, adapter, prices, and corpus identity.

2. 02

   Replay both arms

   Run paired items through the governed worker and retain errors, refusals, tokens, latency, and grader versions.

3. 03

   Confirm once

   Apply preregistered quality, safety, economics, and worst-stratum gates on an untouched confirmation split.

4. 04

   Publish or abstain

   Only a passing immutable record may authorize serving. A failed or incomplete result publishes no switch.