feature: harden confidence escalation across model and reasoning budgets

Summary

Harden the confidence cascade's correctness, verifier semantics, observability, and escalation policy, then support bounded escalation across model choice, reasoning effort, and token budget.

Parent hardening tracker: #2336

Blocked by: #1456, #2855, #2857, #2858, #2861 Related E2E coverage: #2859

Current behavior and gaps

Confidence sorts candidate models by size, cost, or AutoMix-style value, calls them sequentially, and stops when logprob/margin/hybrid/self/external verification meets a threshold. Concrete gaps include:

• filtered logprob/margin uses numeric zero as “not present,” although zero can be valid;
• external AutoMix verification is called without available request/RAG context and acceptance is recomputed from confidence rather than honoring the verifier's escalation decision;
• self-verification uses the same model that generated the answer, creating correlated errors;
• exhausting all candidates below threshold silently returns the last answer without a response-level low-confidence trace;
• per-ModelRef reasoning controls are not applied through one common Looper call path;
• escalation has no request-wide remaining budget check.

Proposed phases

Correctness and trace

• Add explicit presence fields for filtered scores.
• Emit every score, method, threshold, accepted state, model, usage, and latency through #2855.
• Mark below-threshold exhaustion explicitly and define fail, warn/fallback, and abstain policies.
• Align documented token filters/escalation values with implemented validation.

Verifier hardening

• Adapt to #2857.
• Pass trusted question/context separately from candidate text.
• Honor a typed accept|escalate|abstain result when provided.
• Allow an independent verifier model/service and record its cost.

Multi-axis escalation

Support explicit policies such as:

• model cascade: cheap/small to strong/expensive;
• reasoning-effort cascade on the same model;
• increasing completion-token budget;
• bounded combinations ordered by estimated marginal cost.

Each step reserves #1456/#2861 budget before dispatch.

Research context

Recent 2025–2026 TTS work shows that longer reasoning is non-monotonic and verification quality is decisive. This issue must calibrate escalation against fixed-budget direct and parallel baselines rather than assume “think longer” always helps.

Non-goals

• Do not make Confidence invoke Fusion/ReMoM in this issue.
• Do not implement adaptive-N candidate voting.
• Do not treat self-confidence as calibrated correctness without evaluation.

Acceptance criteria

• Filtered score presence is explicit and zero-valued scores are evaluated correctly.
• External verifier context and escalation decisions are respected and traced.
• Below-threshold exhaustion has an explicit response/replay outcome.
• All Looper model calls share correct ModelRef reasoning controls.
• Model, reasoning-effort, and token-budget escalation are explicit validated modes with hard total budgets.
• Thresholds and policies have held-out calibration artifacts.
• Fixed-budget benchmarks compare always-cheap, always-frontier, existing cascade, and each new escalation axis.
• E2E covers accepted-first, escalation, verifier error, exhaustion, and budget refusal.