Model failover restores availability, but changes which financial institutions share decision errors. We formulate outage-contingent routing through a local market-impact response matrix and study expected squared price displacement. A symmetric construction shows that a shared backup can leave an order-one concentration floor as the number of primary endpoints grows, while balanced fallback risk decreases inversely with the surviving endpoint count. For indivisible decisions, we derive the exact second moment of independent randomized routing and an effective-exposure granularity that determines its gap from fractional allocation. Conditional-expectation rounding gives a finite-agent bound without coupled quotas; a separate swap procedure preserves endpoint counts and is assessed against dual lower bounds. Across 60 synthetic portfolio networks and 11,340 scenario evaluations, the latter reduces risk by 6.57% and 10.53% for single and double endpoint removals at the central feedback setting with independent errors. A replay of 1,024 recorded API responses on constructed rebalancing tasks gives a smaller held-out reduction of 3.30% (paired bootstrap interval 2.07--4.57%). Strongly aligned errors, inferior endpoints, and indivisibility limit diversification. The contribution is an auditable routing stress test and implementation analysis, not an estimate of real-market crash probabilities.
Figures & tables
Figure 1: Eight equally weighted primary endpoints, followed by removal of four. A common surviving backup concentrates exposure at endpoint 5; balanced redistribution attains the continuous minimum. Labels carry no quality ranking; errors are centered and independent with unit variance. The illustration concerns financial exposure, not inference throughput.
Figure 2: Exact consequences of Theorem 1 with r=K/2 . Left: a shared backup leaves a nonzero concentration limit. Right: common error limits the relative improvement. These are analytical constructions, not estimates of outage likelihood.
Error correlation
Removed
Mean reduction
95% interval
Mean gap to bound
0.0
1
6.57
[5.99, 7.17]
2.49
0.0
2
10.53
[9.93, 11.14]
2.73
0.3
1
2.58
[2.33, 2.84]
0.84
0.3
2
4.54
[4.23, 4.84]
1.03
0.8
1
0.43
[0.38, 0.48]
0.13
0.8
2
0.79
[0.74, 0.85]
0.17
Table 1: Synthetic results at β=0.4 . Reductions and gaps are percentages. Intervals resample 60 network-level mean reductions; all removal subsets of each size are included.
Figure 3: Matched-count comparison. Left: one point per network, averaged over removals of the given size; β=0.4,γ=0 . Right: means and network bootstrap intervals as common error increases. The common component is invariant to routing.
Figure 4: Four-endpoint indivisible-routing effects. Left: 20-seed means with descriptive 1.96-standard-error bars, normalized by the fractional lower bound. The dashed line is a relaxation, not an executable random policy. Right: exact uniform-routing cases; orthogonal exposures retain a factor-four gap at every population size.
Assignment objective
Reduction (%)
95% interval
CER (full second moment)
3.30
[2.07, 4.57]
Diagonal second moment
1.20
[0.74, 1.67]
Equal-variance exposure balance
0.13
[-0.04, 0.38]
Ridge-envelope diagnostic
2.85
[1.77, 3.97]
Common best (different counts)
4.53
[2.75, 6.32]
Table 2: Held-out API replay. The first four policies preserve baseline quotas. Common best changes counts and uses the survivor with smallest calibration second moment. Intervals condition on fitted policies; exploratory comparisons have no multiplicity adjustment.
Figure 5: Recorded-error replay. Left: uncentered calibration error alignment; rounding to 1.00 does not imply exact equality. Right: held-out reductions and paired task intervals. The asterisk denotes different endpoint counts. All four pinned model versions use one vendor.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Endpoint
Valid
RMSE (bp)
MAE (bp)
Within 1 bp
GPT-4.1-nano
123/128
5211.1
4218.1
0/128
GPT-4.1-mini
128/128
4563.3
3802.0
0/128
GPT-4o-mini
127/128
5345.8
4293.4
1/128
GPT-4.1
107/128
4484.6
3462.6
0/128
Appendix
Table 3: Held-out one-shot calculations. Errors are basis points of initial NAV after zero-trade fallback. Valid means a parsed finite number with normal completion, not a correct answer. Poor task performance limits the replay’s interpretation.
Figure 6: Secondary absolute-displacement tail check for one declared network, with independent errors. Heavy tails raise ES despite unchanged second moments. CER’s ES improvement here is smaller than its quadratic-risk improvement.
Adaptive model routing selects models or specialized experts per input to balance prediction quality, computational cost, latency, and resource constraints.
When an agent handling a payment exception loses money, the agent-step attribution methods this paper compares against will name one of its actions. They will do so even when a settlement message was dropped and the agent never had a chance: they intervene on agent actions and do not expose infrastructure faults as intervenable variables, so every dollar they explain is charged to a decision. We take a benchmark whose fault process is explicit and replayable, decompose each episode's realised delivery schedule into named, individually repairable messages, and intervene on both the agent's choices and the infrastructure's. A telescoping identity splits any policy's loss exactly three ways: an infrastructure effect, a policy differential against the best implementable policy, and a reference-policy residual. Two of the three can be negative, so none is a share; Shapley then divides the first into signed allocations over individual messages. One result is structural and needs no corpus: an agent-only baseline identifies no infrastructure cause, because its model contains no variable that could name one. What 545 planted episodes across 3 policies measure is the size of that consequence. It misfiles 100% of infrastructure episodes and charges $114,383.40 to the agent. Repairing what it names recovers 0.0% of the available loss; repairing a minimal sufficient set recovers 100.0%. Scoring messages one at a time is not merely imprecise: 27.8% (95% CI: 23.3--32.3%) of episodes do not decompose additively. We evaluate deterministic programmatic policies rather than language-model agents, which is what makes replay exact and which limits external validity to stochastic agents. The prevalence figures are properties of this generator, not field rates.
Set-based language model routing aims to increase the coverage of the event where at least one model answers a query correctly while controlling the number of inference calls made. Existing risk-controlled routing policies bound the all-miss risk (the probability that every model in the selected set fails) by calibrating a single conformal threshold and applying it to a nested family of model sets. Because each model is scored in isolation, these policies ignore the dependence structure of model failures. Models that share training data or architecture tend to fail on the same queries, so two individually strong models can be jointly redundant while a weaker but complementary model covers the queries that the others miss. To account for this dependence, which existing risk-controlled policies ignore, we propose CopRoute, which orders models by how many new queries each one answers correctly beyond those already selected, decides per query how far down that order to go, and then picks the smallest cutoff that still meets the target risk. We show that CopRoute's ordering attains, on the design data, the best guarantee any efficient fixed-ordering algorithm can give for the average number of calls to the first correct model, and that a separate calibration step certifies the all-miss risk of the deployed sets. On RouterBench and RouterEval, CopRoute attains the fewest certified calls on nine of ten datasets at a target risk of 0.05 and on eight of ten at 0.10, making up to 79 percent fewer calls (median 24 percent) than the state-of-the-art risk-controlled policy at the same certified all-miss risk.
Coding agents increasingly operate in executable environments where a failed attempt produces actionable feedback rather than merely an incorrect answer. Existing cost-aware systems typically treat such failures as cascade decisions: try a cheap model first, then escalate hard cases to a stronger and more expensive model. In coding, however, execution feedback can also make further cheap-model recovery worthwhile, raising a budgeted deployment question: when should an agent spend more cheap compute, and when should it escalate? We formulate this post-failure decision as recovery routing over heterogeneous actions and train a supervised router from execution rollouts. To make the same router usable under changing budgets, we add a Conformal Risk Control (CRC) layer that selects a deployment-time cost penalty without retraining and provides marginal expected-cost control under exchangeability. Across held-out failures from five coding benchmarks, cheap recovery and escalation exhibit complementary success patterns. The calibrated frontier improves over fixed actions, prompt-only routers, and a binary cascade baseline; in the main GPT-5.4-nano/GPT-5.4 setting, one CRC-calibrated frontier point exceeds always-escalate solve rate while using 35% of its mean recovery cost. Code is available at https://github.com/Qijia-He/agent-budget-control.
Qijia He, Jiayi Cheng, Chenqian Le +8
University of Washington · New York University · ByteDance +1