**Local models as a first-class peer tier:** endpoints now declare hosting (`local`/`remote`) and capability (`fast`/`mid_tier`/`frontier`) separately, so a self-hosted frontier-class model is no longer permanently misclassified as mid-tier. Per-provider model defaults stop leaking Claude ids into local endpoints, providers that serve real tiers get a model per tier, and `autoctx run` preflights every configured endpoint before spending generation tokens.
**Offline mode:** `AUTOCONTEXT_OFFLINE=1` enforces that the Python engine never initiates an outbound connection, verified by a test that runs a full generation with a socket-level guard and asserts zero connection attempts. Operator-initiated access such as SSH stays in scope, so an airgapped host does not have to be unreachable. The TypeScript engine refuses to start rather than run unenforced.
**Schema-enforced role output:** analyst, coach and architect responses are constrained to a JSON Schema on OpenAI-compatible and Anthropic backends instead of being scraped out of Markdown headings. Measured on llama3.1:8b, analyst format drift went from 100% to 0%. Set `AUTOCONTEXT_CONSTRAINED_OUTPUT=false` to keep the previous behavior.
**Judge scoring correctness:** a reasoning block emitted before the answer could win the judge's score parse, recording 0.05 for a run the judge scored 0.88. Both engines now share one model-JSON extractor that prefers the answer over the scratchpad.
**Refreshed model ids:** shipped defaults move to Claude Opus 5 / Sonnet 5 and the GPT-5.6 family. Cost attribution moves with them; the previous table still priced Opus 4.6 at $15/$75 per M, overstating spend on a default run by roughly 3x.
