diff --git a/AGENTS.md b/AGENTS.md
index fd9fbbd..3fe11d7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -54,6 +54,11 @@ Protected tests:
   hosted tier, so a repository that had not added its secret yet went green
   while running on another vendor's model and CodeBoarding's money, silently.
   Any change that reintroduces a credential fallback breaks this test.
+  Since 7 October 2026 (licensing spec D-16, Svilen's call), a workflow that
+  names no `llm` is resolved from the provider inputs that are set, and runs on
+  hosting when none is. That covers only workflows that named nothing; a named
+  provider still runs on that provider or fails, and the job summary says which
+  source an unnamed workflow got and why.
 
 ## Releases
 
diff --git a/README.md b/README.md
index 838c669..b6b97ef 100644
--- a/README.md
+++ b/README.md
@@ -50,9 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: CodeBoarding/CodeBoarding-action@v1
-        with:
-          llm: hosted   # or a provider name -- see Authentication
+      - uses: CodeBoarding/CodeBoarding-action@v1   # CodeBoarding hosting; to use your own key, see Authentication
 ```
 
 Automatic runs review both draft and non-draft pull requests and update one sticky **CodeBoarding review** comment. Opening, reopening, or pushing a commit runs analysis; changing only the draft state does not. A trusted repository owner, member, or collaborator can comment `/codeboarding` to analyze the current PR head again, including on fork PRs; every command creates a new result comment.
@@ -106,36 +104,41 @@ Every review comment ends with a machine-readable HTML comment, `<!-- codeboardi
 
 ## Authentication and providers
 
-The `llm` input is required and says where analysis credentials come from. There are
-two answers, and the action never picks one for you:
+Wire the key you want to use, and the action uses it. Wire nothing, and it runs on
+CodeBoarding hosting:
 
 ```yaml
-    with:
-      llm: hosted                                        # CodeBoarding's hosted tier, on your plan
+    - uses: CodeBoarding/CodeBoarding-action@v1          # CodeBoarding hosting, on your plan
 ```
 ```yaml
-    with:
-      llm: anthropic                                     # your own provider key
-      anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+    - uses: CodeBoarding/CodeBoarding-action@v1
+      with:
+        anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}   # your own key, called directly
 ```
 
-`hosted` runs through CodeBoarding's proxy and needs `id-token: write`, which
+The optional `llm` input names the source outright: `hosted` or a provider. You need it
+only when inputs for more than one provider are set, or when you want a missing key to
+fail the run rather than fall back to hosting.
+
+Hosting runs through CodeBoarding's proxy and needs `id-token: write`, which
 mints short-lived credentials per request and stores no LLM secret in your repository. A
 provider key is used directly and needs no OIDC permission.
 
-**An empty value is never a fallback.** If you name a provider and its key is missing --
-because the secret does not exist yet, or is misspelt — the run fails in its first
-seconds and says which input and which secret to fix. It does not quietly analyze on
-CodeBoarding's hosted tier instead. That was the old behaviour, and it meant a repository
-could report an Anthropic review that Anthropic never produced.
-
-The same rule makes the combinations explicit rather than order-dependent:
+**Check the first line of the job summary after adding a key.** GitHub reads a secret that
+does not exist, or is misspelt, as an empty string, so a workflow without `llm` whose only
+key is missing runs on hosting. The log's first line and the summary's "Chosen" row say
+which source the run used and why. **A named provider never falls back:** with
+`llm: anthropic` and the key missing, the run fails in its first seconds and says which
+input and which secret to fix.
 
 | Workflow says | Result |
 |---|---|
-| nothing | refused: `llm` is required |
-| `llm: hosted` | CodeBoarding's hosted tier, on the plan of whoever the run is charged to |
+| nothing | CodeBoarding hosting, on the plan of whoever the run is charged to |
+| `anthropic_api_key` only | Anthropic, directly |
+| `anthropic_api_key` + `openai_api_key` | refused: set `llm` to pick one |
+| `llm: hosted` | CodeBoarding hosting |
 | `llm: hosted` + any provider key | refused: pick one |
+| hosting + `model`, `agent_model` or `parsing_model` | refused: hosting chooses its own models |
 | `llm: license` | refused: license keys are retired, use `llm: hosted` |
 | `llm: anthropic` + `anthropic_api_key` | Anthropic, directly |
 | `llm: anthropic`, key empty or absent | refused: names the input and the secret |
@@ -253,6 +256,8 @@ Precedence is intentionally simple:
 
 Set only `model` when both jobs should use the same model. Set either specialized input only when that job needs a different model. Model identifiers are not secrets and can be stored in GitHub repository variables.
 
+On CodeBoarding hosting, CodeBoarding pays for the tokens and chooses the models. A hosting run that sets any of the three model inputs, or an `AGENT_MODEL` or `PARSING_MODEL` in the job's environment, is refused in its first seconds with the line to remove. A workflow without `llm` that sets a model but whose key secret is missing lands here too, so the refusal also says to check the secret. The model inputs apply when the run uses your own provider key.
+
 ## Keep the baseline current
 
 Sync mode commits only Core's persisted incremental-analysis state under `.codeboarding/`:
@@ -303,7 +308,6 @@ jobs:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
           mode: sync
-          llm: hosted
           target_branch: main
           force_full: ${{ inputs.force_full || false }}
 ```
@@ -324,7 +328,6 @@ permissions:
       - uses: CodeBoarding/CodeBoarding-action@v1
         with:
           mode: sync
-          llm: hosted
           target_branch: main
           sync_strategy: pull_request
 ```
@@ -338,11 +341,11 @@ With the default `github.token`, the repository or organization must allow GitHu
 | Input | Mode | Default | Description |
 |---|---|---|---|
 | `mode` | both | `review` | `review` or `sync`. |
-| `llm` | both | **required** | `hosted` or a provider name. No default. |
+| `llm` | both | empty | `hosted` or a provider name. Empty: the provider inputs that are set decide. |
 | `<provider>_api_key` | both | empty | That provider's key, e.g. `anthropic_api_key`. See [Providers](#providers). |
 | `<provider>_base_url` | both | empty | That provider's endpoint, where it has one. |
 | `aws_bedrock_region` | both | empty | Bedrock region. Core defaults to `us-east-1`. |
-| `model` | both | empty | Default model for both analysis and parsing. |
+| `model` | both | empty | Default model for both analysis and parsing. Own key only: a hosting run that sets it is refused. |
 | `agent_model` | both | empty | Analysis-only override for `model`. |
 | `parsing_model` | both | empty | Parsing-only override for `model`. |
 | `depth_cap` | both | `2` | Positive integer maximum analysis depth, including full-analysis fallbacks, capped by the plan of whoever the run is charged to (3 on Free). Changing it rebuilds incompatible state. |
diff --git a/action.yml b/action.yml
index 2bc66c9..75d6481 100644
--- a/action.yml
+++ b/action.yml
@@ -10,8 +10,9 @@ inputs:
     required: false
     default: 'review'
   llm:
-    description: 'Required. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel).'
-    required: true
+    description: 'Optional. Where analysis credentials come from: hosted or a provider name (anthropic, aws_bedrock, cerebras, deepseek, glm, google, kimi, litellm, ollama, openai, openrouter, orcarouter, vercel). Without it, the provider inputs that are set decide: none means hosted, one provider means that provider. A named provider never falls back.'
+    required: false
+    default: ''
   # Anthropic - selected by llm: anthropic
   anthropic_api_key:
     description: 'Anthropic API key, used when llm is anthropic. Sets ANTHROPIC_API_KEY.'
@@ -110,15 +111,15 @@ inputs:
     required: false
     default: ''
   model:
-    description: 'Optional model used for both analysis and parsing.'
+    description: 'Optional model used for both analysis and parsing. Not allowed on CodeBoarding hosting, which chooses its own models: the run is refused.'
     required: false
     default: ''
   agent_model:
-    description: 'Optional analysis-model override. Takes precedence over model.'
+    description: 'Optional analysis-model override. Takes precedence over model. Not allowed on CodeBoarding hosting.'
     required: false
     default: ''
   parsing_model:
-    description: 'Optional parsing-model override. Takes precedence over model.'
+    description: 'Optional parsing-model override. Takes precedence over model. Not allowed on CodeBoarding hosting.'
     required: false
     default: ''
   depth_cap:
@@ -254,6 +255,9 @@ runs:
       env:
         ACTION_PATH: ${{ github.action_path }}
         CB_IN_LLM: ${{ inputs.llm }}
+        CB_IN_MODEL: ${{ inputs.model }}
+        CB_IN_AGENT_MODEL: ${{ inputs.agent_model }}
+        CB_IN_PARSING_MODEL: ${{ inputs.parsing_model }}
         CB_IN_ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
         CB_IN_AWS_BEDROCK_API_KEY: ${{ inputs.aws_bedrock_api_key }}
         CB_IN_AWS_BEDROCK_REGION: ${{ inputs.aws_bedrock_region }}
diff --git a/scripts/action/credential_check.py b/scripts/action/credential_check.py
index 1a917de..706b89d 100755
--- a/scripts/action/credential_check.py
+++ b/scripts/action/credential_check.py
@@ -6,10 +6,11 @@
 that same string as the pull request comment, the error annotation and the job summary --
 so the rule and its explanation are written together and cannot drift apart.
 
-One provider, chosen explicitly by the `llm` input, and nothing is ever reached by an
-empty string falling through to a default. A misconfigured run fails here -- before the
-checkout and the engine install -- naming the input and the secret to fix, rather than
-succeeding on someone else's credentials or failing later inside the engine.
+One provider per run. A workflow that names it with `llm` gets that provider or a refusal,
+never a default. A workflow without `llm` gets whatever its set inputs describe: none means
+CodeBoarding hosting, one provider's inputs mean that provider, several are refused. A
+misconfigured run fails here -- before the checkout and the engine install -- naming the
+input and the secret to fix, rather than failing later inside the engine.
 
 Reads the action's inputs from CB_IN_* environment variables (prefixed so that wiring an
 input can never itself set a provider selection variable), and writes the resolved
@@ -31,6 +32,12 @@
 SETTINGS_HINT = "Settings -> Secrets and variables -> Actions"
 TABLE = Path(__file__).resolve().parent / "supported-providers.json"
 
+#: The action's model inputs, and the variables the engine reads a model from. On hosting
+#: CodeBoarding pays for the tokens, so it chooses the models (spec D-13): a run that names
+#: one there is refused. They apply where the run's own provider key pays.
+MODEL_INPUTS = ("model", "agent_model", "parsing_model")
+MODEL_ENVS = ("AGENT_MODEL", "PARSING_MODEL")
+
 
 #: Every reason this module can refuse a configuration.
 #:
@@ -41,7 +48,8 @@
 #: `test_llm_contract.py` asserts every entry here is exercised.
 ERROR_CODES = frozenset(
     {
-        "missing_llm",
+        "several_provider_keys",
+        "hosted_with_model",
         "unknown_llm",
         "missing_provider_key",
         "missing_id_token",
@@ -172,20 +180,56 @@ def _reject_provider_inputs(table: dict, given: dict[str, str]) -> None:
     )
 
 
-def _require_id_token(llm: str, environ: dict[str, str]) -> None:
+def _reject_model_choice(environ: dict[str, str], reason: str) -> None:
+    """Hosting runs on CodeBoarding's models, so a run there that names one is refused.
+
+    Refused rather than ignored: a model named on a hosting run usually means the workflow
+    meant to use its own key and its secret is missing, and an analysis on a model nobody
+    asked for would hide that. The job environment counts too, since the engine reads it.
+    """
+    chosen = [f"`{n}`" for n in MODEL_INPUTS if environ.get(f"CB_IN_{n.upper()}", "").strip()]
+    chosen += [f"`{v}` in the job's environment" for v in MODEL_ENVS if environ.get(v, "").strip()]
+    if not chosen:
+        return
+    what = ", ".join(chosen)
+    verb = "is" if len(chosen) == 1 else "are"
+    if reason:
+        message = (
+            f"{what} {verb} set, but this run uses CodeBoarding hosting because {reason}, and "
+            "hosting runs on CodeBoarding's models. If you meant to use your own provider key, "
+            f"check that its secret exists; otherwise remove {what}."
+        )
+    else:
+        message = (
+            f"`llm: hosted` runs on CodeBoarding's models, but {what} {verb} set. Remove {what}, "
+            "or set `llm` to your provider and wire its key to choose a model."
+        )
+    raise ConfigError("hosted_with_model", message)
+
+
+def _require_id_token(llm: str, environ: dict[str, str], reason: str = "") -> None:
     # Both, because the relay needs both (oidc_relay.py refuses to start without either)
     # and a runner can expose one without the other. Checking only the URL let that case
     # through preflight and turned it into a generic failure after the engine install,
     # which is the whole thing this check exists to prevent.
     if environ.get("ACTIONS_ID_TOKEN_REQUEST_URL") and environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN"):
         return
+    # A run that chose hosting because no key is set may have meant to use a key whose
+    # secret does not exist yet; this is the one refusal that can say so.
+    if reason:
+        problem = (
+            f"This run uses CodeBoarding hosting because {reason}. Hosting authenticates with a "
+            "GitHub OIDC token, which this job cannot mint. If you meant to use your own provider "
+            "key, check that its secret exists."
+        )
+    else:
+        problem = f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint."
     raise ConfigError(
         "missing_id_token",
-        f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint. "
-        "Add `permissions:` with `id-token: write` to the job that uses this action.",
+        f"{problem} Add `permissions:` with `id-token: write` to the job that uses this action.",
         "\n\n".join(
             [
-                f"`llm: {llm}` authenticates with a GitHub OIDC token, which this job cannot mint.",
+                problem,
                 f"In `{workflow_path(environ)}`, the job running this action needs:",
                 "```yaml\n    permissions:\n      id-token: write\n```",
                 "No secret is involved: the token is minted per request and never stored.",
@@ -246,18 +290,30 @@ def resolve(table: dict, environ: dict[str, str]) -> dict:
     llm = environ.get("CB_IN_LLM", "").strip().lower()
     given = read_inputs(table, environ)
 
+    # Without `llm`, the inputs that are set decide (spec D-16), and the plan carries the
+    # reason so the log and the summary say how the run chose. A named `llm` is never
+    # second-guessed: it takes the strict paths below exactly as written.
+    reason = ""
     if not llm:
-        raise ConfigError(
-            "missing_llm",
-            "The `llm` input is required and has no default. Set it to `hosted` "
-            "(CodeBoarding's hosted tier, on your CodeBoarding plan) or one of: "
-            f"{_provider_list(table)}. See {DOCS}.",
-        )
+        providers = sorted({owner_of(table, i) for i in given})
+        if len(providers) > 1:
+            raise ConfigError(
+                "several_provider_keys",
+                f"Inputs for more than one provider are set ({', '.join(f'`{i}`' for i in sorted(given))}). "
+                f"Set `llm` to the one this run should use: {', '.join(providers)}.",
+            )
+        if providers:
+            llm = providers[0]
+            reason = f"only {table['providers'][llm].get('label', llm)}'s inputs are set"
+        else:
+            llm = "hosted"
+            reason = "no provider key is set"
 
     if llm == "hosted":
         _reject_provider_inputs(table, given)
-        _require_id_token(llm, environ)
-        return {"tier": "hosted", "provider": table["hosted_provider"], "env": {}}
+        _reject_model_choice(environ, reason)
+        _require_id_token(llm, environ, reason)
+        return {"tier": "hosted", "provider": table["hosted_provider"], "env": {}, "reason": reason}
 
     # Keys were retired completely, so the answer that ran on one is refused by name rather
     # than as an unknown value: the fix is one word, and the plan it paid for now follows
@@ -288,7 +344,7 @@ def resolve(table: dict, environ: dict[str, str]) -> dict:
         )
 
     env = _resolve_byok(table, name, given, environ)
-    return {"tier": "byok", "provider": name, "env": env}
+    return {"tier": "byok", "provider": name, "env": env, "reason": reason}
 
 
 def _is_endpoint(var: str) -> bool:
@@ -352,6 +408,8 @@ def reported_provider(plan: dict) -> str:
 
 def plan_headline(table: dict, plan: dict) -> str:
     """The one line the log opens with. Same source as the summary, so they cannot drift."""
+    if plan.get("reason"):
+        return f"CodeBoarding is running on {_pays(table, plan)}, because {plan['reason']}."
     return f"CodeBoarding is running on {_pays(table, plan)}."
 
 
@@ -366,6 +424,9 @@ def plan_summary(table: dict, plan: dict) -> list[tuple[str, str]]:
     if shown:
         rows.append(("Provider", f"`{shown}`"))
     rows.append(("Credentials", _pays(table, plan)))
+    # Without `llm`, a secret that does not exist reads as empty and the run goes hosted.
+    # This row is how someone who meant to use their own key finds out.
+    rows.append(("Chosen", f"because {plan['reason']}" if plan.get("reason") else "by `llm`"))
     # Only where the run was pointed somewhere other than the default, since that is the
     # setting most likely to be wrong and least likely to be noticed.
     for var, value in sorted(plan["env"].items()):
diff --git a/tests/test_action_auth.py b/tests/test_action_auth.py
index 3ccafc6..ecfcf96 100644
--- a/tests/test_action_auth.py
+++ b/tests/test_action_auth.py
@@ -364,6 +364,53 @@ def test_a_run_the_relay_saw_walled_ends_neutral_and_any_other_failure_does_not(
                 self.assertEqual(scoped.returncode, code, scoped.stderr or scoped.stdout)
                 self.assertEqual("walled=true" in output.read_text(encoding="utf-8"), walled)
 
+    # -- a workflow without `llm` ----------------------------------------------
+
+    _OIDC = {
+        "ACTIONS_ID_TOKEN_REQUEST_URL": "https://oidc.example/token",
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "request-token",
+    }
+
+    def test_an_unnamed_workflow_says_which_source_it_got_and_why(self) -> None:
+        """A secret that does not exist reads as empty, so a workflow meant for its own key
+        can land on hosting. The log's first line and the summary are how anyone finds out."""
+        result, _, outputs = self._preflight(**self._OIDC)
+        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
+        self.assertEqual(outputs["tier"], "hosted")
+        self.assertIn("because no provider key is set", result.stdout)
+        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
+        self.assertIn("| Chosen | because no provider key is set |", summary)
+
+        self.temp_dir.cleanup()
+        self.temp_dir = tempfile.TemporaryDirectory()
+        _, _, keyed = self._preflight(CB_IN_ANTHROPIC_API_KEY="k")
+        self.assertEqual((keyed["tier"], keyed["provider"]), ("byok", "anthropic"))
+
+    # -- model choice ------------------------------------------------------
+
+    def test_a_hosting_run_that_names_a_model_is_refused_before_anything_runs(self) -> None:
+        """Hosting runs on CodeBoarding's models. A model named anyway fails the run in its
+        first seconds, in the log, the summary and the comment's text, and stages nothing."""
+        result, auth_dir, outputs = self._preflight(CB_IN_MODEL="big-model", **self._OIDC)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual(outputs["error"], "hosted_with_model")
+        self.assertIn("check that its secret exists", outputs["message"])
+        self.assertFalse(auth_dir.exists(), "credentials were staged for a refused run")
+        summary = (Path(self.temp_dir.name) / "summary.md").read_text(encoding="utf-8")
+        self.assertIn("CodeBoarding could not start", summary)
+
+    def test_a_model_inherited_from_the_job_counts_as_naming_one(self) -> None:
+        """The engine reads AGENT_MODEL from its environment, so a job-level one would pick a
+        model on CodeBoarding's account as surely as the input."""
+        _, _, outputs = self._preflight(CB_IN_LLM="hosted", AGENT_MODEL="inherited", **self._OIDC)
+        self.assertEqual(outputs["error"], "hosted_with_model")
+        self.assertIn("AGENT_MODEL", outputs["message"])
+
+    def test_your_own_key_keeps_its_model_inputs(self) -> None:
+        result, _, outputs = self._preflight(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m")
+        self.assertEqual(result.returncode, 0, result.stderr or result.stdout)
+        self.assertEqual(outputs["provider"], "anthropic")
+
     def test_analysis_refuses_to_run_without_a_resolved_plan(self) -> None:
         scoped = self._with_auth("true")
         self.assertNotEqual(scoped.returncode, 0)
diff --git a/tests/test_action_inputs.py b/tests/test_action_inputs.py
index c1a239b..6d20414 100644
--- a/tests/test_action_inputs.py
+++ b/tests/test_action_inputs.py
@@ -58,10 +58,11 @@ def test_no_declared_provider_input_is_absent_from_the_table(self) -> None:
         declared = {n for n in self.inputs if n.endswith(suffixes) and n != "github_token"}
         self.assertEqual(sorted(declared - table_inputs()), [])
 
-    def test_llm_is_required_and_has_no_default(self) -> None:
+    def test_llm_is_optional_and_empty_by_default(self) -> None:
+        """Empty means "decide from the inputs that are set"; the resolver owns that rule."""
         block = self.inputs["llm"]
-        self.assertIn("required: true", block)
-        self.assertNotIn("default:", block)
+        self.assertIn("required: false", block)
+        self.assertIn("default: ''", block)
 
     def test_depth_is_wired_to_state_identity_and_both_analysis_modes(self) -> None:
         """The workflow's depth_cap is only a request: the preflight's answer, clamped to the
@@ -147,6 +148,12 @@ def test_license_key_is_retired(self) -> None:
         self.assertNotIn("license_key", self.inputs)
         self.assertNotIn("CB_IN_LICENSE_KEY", ACTION)
 
+    def test_model_inputs_reach_the_resolver(self) -> None:
+        """Hosting refuses a named model, which it can only do if it sees the inputs."""
+        for name in ("model", "agent_model", "parsing_model"):
+            with self.subTest(input=name):
+                self.assertIn(f"CB_IN_{name.upper()}: ${{{{ inputs.{name} }}}}", ACTION)
+
     def test_default_workflow_reviews_drafts_on_open_and_new_commits(self) -> None:
         self.assertNotIn("github.event.pull_request.draft", DOGFOOD)
         start = DOGFOOD.index("types:")
diff --git a/tests/test_llm_contract.py b/tests/test_llm_contract.py
index dfb6e2a..b414757 100644
--- a/tests/test_llm_contract.py
+++ b/tests/test_llm_contract.py
@@ -97,10 +97,72 @@ def test_endpoint_only_providers_resolve_without_a_key(self) -> None:
 
     # -- refused shapes ----------------------------------------------------
 
-    def test_an_undeclared_workflow_is_refused_rather_than_defaulted(self) -> None:
+    # -- no `llm`: the inputs that are set decide ---------------------------
+
+    def test_a_workflow_with_nothing_set_runs_on_hosting_and_says_why(self) -> None:
+        plan = self.resolve(**OIDC)
+        self.assertEqual(plan["tier"], "hosted")
+        self.assertEqual(plan["reason"], "no provider key is set")
+
+    def test_hosting_without_an_oidc_token_points_at_a_missing_secret(self) -> None:
+        """Someone who meant to use their own key and has no secret yet lands here, with no
+        `id-token: write` either: the refusal is the one place to tell them."""
         error = self.refuse()
-        self.assertEqual(error.code, "missing_llm")
-        self.assertIn("required", error.message)
+        self.assertEqual(error.code, "missing_id_token")
+        self.assertIn("no provider key is set", error.message)
+        self.assertIn("check that its secret exists", error.message)
+
+    def test_one_providers_key_selects_that_provider(self) -> None:
+        plan = self.resolve(CB_IN_ANTHROPIC_API_KEY="k")
+        self.assertEqual((plan["tier"], plan["provider"]), ("byok", "anthropic"))
+        self.assertEqual(plan["env"], {"ANTHROPIC_API_KEY": "k"})
+        self.assertEqual(plan["reason"], "only Anthropic's inputs are set")
+
+    def test_several_inputs_of_one_provider_still_select_it(self) -> None:
+        plan = self.resolve(CB_IN_AWS_BEDROCK_API_KEY="k", CB_IN_AWS_BEDROCK_REGION="eu-west-1")
+        self.assertEqual(plan["provider"], "aws_bedrock")
+        self.assertEqual(plan["env"]["AWS_DEFAULT_REGION"], "eu-west-1")
+
+    def test_an_endpoint_selects_its_provider(self) -> None:
+        plan = self.resolve(CB_IN_OLLAMA_BASE_URL="http://host:11434")
+        self.assertEqual(plan["provider"], "ollama")
+
+    def test_inputs_that_cannot_select_their_provider_are_refused_not_ignored(self) -> None:
+        """A region alone says "Bedrock" but configures nothing; hosting would be a guess."""
+        error = self.refuse(CB_IN_AWS_BEDROCK_REGION="eu-west-1")
+        self.assertEqual(error.code, "missing_provider_key")
+        self.assertIn("aws_bedrock_api_key", error.message)
+
+    def test_two_providers_are_refused_with_the_inputs_named(self) -> None:
+        error = self.refuse(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_OPENAI_API_KEY="o")
+        self.assertEqual(error.code, "several_provider_keys")
+        self.assertIn("anthropic_api_key", error.message)
+        self.assertIn("openai_api_key", error.message)
+        self.assertIn("`llm`", error.message)
+
+    def test_llm_settles_which_of_several_providers_runs(self) -> None:
+        error = self.refuse(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k", CB_IN_OPENAI_API_KEY="o")
+        self.assertEqual(error.code, "foreign_provider_key")
+
+    def test_hosting_refuses_a_named_model_whichever_way_it_was_chosen(self) -> None:
+        for environ, hint in (
+            ({"CB_IN_LLM": "hosted", "CB_IN_MODEL": "m"}, "set `llm` to your provider"),
+            ({"CB_IN_AGENT_MODEL": "m"}, "check that its secret exists"),
+            ({"CB_IN_PARSING_MODEL": "m", "PARSING_MODEL": "m"}, "`PARSING_MODEL` in the job's environment"),
+        ):
+            with self.subTest(environ=environ):
+                error = self.refuse(**environ, **OIDC)
+                self.assertEqual(error.code, "hosted_with_model")
+                self.assertIn(hint, error.message)
+
+    def test_own_key_runs_choose_their_model_freely(self) -> None:
+        plan = self.resolve(CB_IN_ANTHROPIC_API_KEY="k", CB_IN_MODEL="m", AGENT_MODEL="a")
+        self.assertEqual(plan["provider"], "anthropic")
+
+    def test_a_named_llm_carries_no_reason(self) -> None:
+        """The workflow said what it wanted; there is nothing to explain."""
+        self.assertEqual(self.resolve(CB_IN_LLM="anthropic", CB_IN_ANTHROPIC_API_KEY="k")["reason"], "")
+        self.assertEqual(self.resolve(CB_IN_LLM="hosted", **OIDC)["reason"], "")
 
     def test_a_named_provider_without_its_key_names_the_input_and_the_secret(self) -> None:
         error = self.refuse(CB_IN_LLM="anthropic")
@@ -290,8 +352,9 @@ def test_every_declared_refusal_is_exercised_by_this_file(self) -> None:
         it produces is exactly the set the module declares it can raise, so adding a code
         without a case here fails rather than going unnoticed."""
         cases = [
-            {},
+            {"CB_IN_ANTHROPIC_API_KEY": "k", "CB_IN_OPENAI_API_KEY": "o"},
             {"CB_IN_LLM": "not_a_provider"},
+            {"CB_IN_LLM": "hosted", "CB_IN_MODEL": "m", **OIDC},
             {"CB_IN_LLM": "anthropic"},
             {"CB_IN_LLM": "license", **OIDC},
             {"CB_IN_LLM": "hosted"},