[santoshkumarradha]

Problem and behavior

Automatic credit recovery could send task context to free routes even when the person had disabled them. Low-balance defaults, remembered and live payment refusals, saved fallback ladders, and already-created helpers now honor the free-routes switch.

With free routes off, a small positive paid balance remains usable. When credit really is unavailable, work is preserved and the user is guided to add credit, connect a provider, or explicitly enable free routes. A current explicit choice of a particular free model remains consent for that model; it does not authorize other automatic free fallbacks.

Helpers recheck current explicit settings rather than treating a cached automatic choice as consent. Malformed current settings fail closed. Subscription and local alternatives remain available, and saved pins and preferences are not rewritten.

Verification

• make pr-ready passed, including fresh command, configuration, engine and end-to-end package tests.
• Actual binary with fake keys and scripted endpoints: low positive balance with free routes OFF made 0 free requests; explicit opt-in selected allowed free defaults.
• Actual terminal automatic task: paid HTTP 402 with free routes OFF made paid=1 / free=0 and showed credit guidance. Enabling consent before the refusal made paid=1 / free=2, completed the real task, and wrote the exact expected mock file.
• A stale-helper regression reproduced the leak on the old code. Both malformed-role and malformed-project cases now make 0 requests; four current explicit-consent controls still succeed. Seat-specific tests also distinguish a pinned worker from an automatic checker using the same model.
• Live normal workflow through OpenRouter passed across five chats: natural memory capture, contextual recall, correction, fresh recall and a delegated file task. All 43 recorded model calls used exactly deepseek/deepseek-v4.1-flash.

The final combined binary also passed all eight scripted credential-boundary and free-consent controls after #1904. Fault injection uses loopback endpoints and mock data; live calls are a separate normal-operation control. No personal memories are included.

Closes #1523