# Changelog v0.5.13 - 2026-06-02

### Added
- **Auto-heal the active router set on startup.** When the daemon starts,
  it waits for the first probe burst to populate health data, then runs
  `autoHealActiveSet()` to swap any broken model in the active set
  (`AUTH_ERROR` or `STALE` state) for a working alternative. The picker
  prefers the same provider first, then falls through to cross-provider
  candidates, and skips providers whose every probe has been broken.
  Three passes run at 8s, 24s, and 40s after startup so a freshly-added
  replacement that turns out to be broken gets replaced again. The result:
  a new user with a half-broken key set lands on a usable default set
  by the time the Web Dashboard renders, and the Playground's `fcm`
  virtual model starts returning successful responses immediately.
- **`router.userCustomized` + `router.autoHeal` config flags.** The first
  manual edit to the active set (add / remove / reorder / sync /
  activate / rename) flips `userCustomized` to `true` and `autoHeal`
  to `false` so the user's manual choices are never undone on the next
  daemon start. New users get `userCustomized: false` and `autoHeal:
  true` by default, which is what powers the M6 "default to working
  models" promise.
- **`/api/router/status` exposes `autoHeal`, `userCustomized`, and
  `brokenModelCount`.** The Web Router Dashboard reads these to surface
  an amber banner when broken models remain in the active set, with a
  one-click "Fix now" button that re-runs the same `sync-set` probe
  pipeline the CLI uses.
- **Amber "models not responding" banner in the Web Router Dashboard.**
  Shown when the daemon reports `brokenModelCount > 0`, with a
  dismissable X so the user can ignore it after acknowledging the
  problem. The "Fix now" button re-runs the probe-based heal and reloads
  the dashboard state.
- **4 new unit tests** for the auto-heal path: no-op when user-customized,
  no-op when auto-heal is disabled, no-op when no broken models, and
  the user-edit-flags-customization round-trip. **All 515 tests pass.**

### Notes
- The auto-heal is best-effort: if the user has only one working
  provider, the healed set will shrink to that one provider's top
  model. That's still better than the previous behavior of showing
  three models that all 401.
- The new broken-model banner is intentionally subtle (amber, not red)
  because the auto-heal already does its best to recover. It's there
  for the "user has 0 working keys" edge case so the user can click
  through to "Fix now" / "Sync best" and either get a working set or
  see the toast explaining the situation.

### How the picker works (M6)
```
For each broken model in the active set:
  1. Same provider — pick a working model of the same provider
     (skipping models that the circuit breaker already knows are broken).
  2. Cross-provider — fall through to any working model across all
     providers, sorted by static tier + swe score.
  3. If neither yields a working model, leave the broken entry in
     place and log a warning (the Web UI surfaces this in the
     "models not responding" banner).
```
