@@ -53,7 +53,7 @@ function includesModel(list: string[] | undefined, modelId: string): boolean {
 }
 
 /**
- * Per-model override lookup for the report rows.
+ * Per-model override lookup for the nine family-aware report rows.
  *
  * Delegates to modelRecordValue so the report reads these maps the way the
  * runtime does -- own properties only, then the pre-colon family, then a
@@ -62,14 +62,37 @@ function includesModel(list: string[] | undefined, modelId: string): boolean {
  * differently-cased key, and walked the prototype chain, so a routed model id
  * of `constructor`/`toString` yielded an Object.prototype function. That last
  * one made buildBehaviorFingerprintV1 throw ("unsupported value type
- * function"), which resolvePassiveRouteSubjectId swallows -- the subject is
- * silently dropped, and the linker contract says implementations do not throw.
- * openai-responses.ts guards modelPreferHostedTools for the same reason.
+ * function"); the caller catches it (`src/routing/compatibility/subject.ts:125`)
+ * and returns no route, so the subject is silently dropped -- and the linker
+ * contract says implementations do not throw.
+ *
+ * Not every override map belongs here. `modelPreferHostedTools` and
+ * `modelOpenRouterRouting` are exact-own at runtime and go through
+ * `exactOwnValue` below; widening those to the family would be this same bug
+ * with the sign flipped.
  */
 function modelValue<T>(map: Record<string, T> | undefined, modelId: string): T | undefined {
   return modelRecordValue(map, modelId);
 }
 
+/**
+ * Exact, own-property lookup for the two maps the runtime resolves that way.
+ *
+ * `modelPreferHostedTools` and `modelOpenRouterRouting` are deliberately exact: the
+ * adapter reads the first through `hasOwnProperty`
+ * (`src/adapters/openai-responses.ts:1001`) and the second through `Object.hasOwn`
+ * (`src/providers/openrouter-routing.ts:89`), and the type documents the first as
+ * "Exact-model hosted tools" (`src/types.ts:1584`). Sending them through
+ * `modelRecordValue` would make the report say a `gpt-oss` entry applies to
+ * `gpt-oss:120b` when the adapter will never apply it -- the same divergence this
+ * file exists to remove, pointed the other way. A bare index is not the answer
+ * either: it walks the prototype chain, which is the bug `modelValue` just fixed.
+ * Neither existing primitive is right for these two, so this is the third one.
+ */
+function exactOwnValue<T>(map: Record<string, T> | undefined, modelId: string): T | undefined {
+  return map !== undefined && Object.hasOwn(map, modelId) ? map[modelId] : undefined;
+}
+
 const CREDENTIAL_HEADER = /(authorization|api[-_]?key|token|secret|credential|cookie)/i;
 
 function nonCredentialHeaderDigest(
@@ -84,7 +107,7 @@ function nonCredentialHeaderDigest(
 }
 
 function effectiveOpenRouterRouting(effective: OcxProviderConfig, modelId: string) {
-  return effective.modelOpenRouterRouting?.[modelId] ?? effective.openRouterRouting;
+  return exactOwnValue(effective.modelOpenRouterRouting, modelId) ?? effective.openRouterRouting;
 }
 
 /**
@@ -199,7 +222,7 @@ export function resolveProductionBehaviorValues(
       effective.parallelToolCalls ?? (upstreamProtocol === "openai-chat"),
     ),
     "tools.hostedPreference": behaviorRow("provider_config", {
-      tools: modelValue(effective.modelPreferHostedTools, modelId) ?? [],
+      tools: exactOwnValue(effective.modelPreferHostedTools, modelId) ?? [],
     }),
     "tools.builtinNameEscaping": behaviorRow("provider_config", effective.escapeBuiltinToolNames === true),
     "cache.forwarding": behaviorRow("provider_config", effective.promptCacheKey === true),
 
@@ -8,6 +8,8 @@ import { describe, expect, test } from "bun:test";
 import { resolveProductionBehaviorValues } from "../src/routing/compatibility/behavior";
 import { createOpenAIChatAdapter } from "../src/adapters/openai-chat";
 import { buildBehaviorFingerprintV1 } from "../src/lab/subject/behavior-fingerprint";
+import { resolveOpenRouterRouting } from "../src/providers/openrouter-routing";
+import { modelRecordValue } from "../src/reasoning-effort";
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../src/types";
 
 // ollama-cloud ships `gpt-oss:120b` verbatim (src/providers/registry.ts) and the same
@@ -138,3 +140,61 @@ describe("a prototype-shaped model id resolves to no override", () => {
       .toBe(buildBehaviorFingerprintV1(overrideValues("toString")));
   });
 });
+
+// Not every override map is family-aware, and the two that are not must stay that way.
+// The adapter reads `modelPreferHostedTools` through `hasOwnProperty`
+// (`src/adapters/openai-responses.ts:1001`) and `resolveOpenRouterRouting` reads
+// `modelOpenRouterRouting` through `Object.hasOwn` (`src/providers/openrouter-routing.ts:89`);
+// the type calls the first "Exact-model hosted tools" (`src/types.ts:1584`). Sending
+// these through modelRecordValue would be the divergence above with the sign flipped:
+// the report would claim an override applies that the adapter will never apply.
+const EXACT_ONLY: OcxProviderConfig = {
+  adapter: "openai-responses",
+  baseUrl: "https://openrouter.ai/api/v1",
+  apiKey: "sk-test",
+  authMode: "key",
+  modelPreferHostedTools: { "gpt-oss": ["image_generation"] },
+  modelOpenRouterRouting: { "gpt-oss": { order: ["fireworks"] } },
+} as unknown as OcxProviderConfig;
+
+const exactConfig = { providers: { "ollama-cloud": EXACT_ONLY } } as unknown as OcxConfig;
+
+const exactValues = (modelId: string) =>
+  resolveProductionBehaviorValues(exactConfig, "ollama-cloud", modelId, EXACT_ONLY, "salt")!;
+
+describe("exact-own override maps must not spread to the family", () => {
+  test("the runtime really does not apply the bare-family entry to the :tag model (ground truth)", () => {
+    // openRouter routing is resolvable directly, so this half is executable rather than cited.
+    expect(resolveOpenRouterRouting(EXACT_ONLY, "gpt-oss")).toEqual({ order: ["fireworks"] });
+    expect(resolveOpenRouterRouting(EXACT_ONLY, MODEL)).toBeUndefined();
+
+    // And the divergence is real rather than theoretical: the family-aware primitive
+    // resolves the entry that the adapter's own-property guard does not see.
+    expect(modelRecordValue(EXACT_ONLY.modelPreferHostedTools, MODEL)).toEqual(["image_generation"]);
+    expect(Object.hasOwn(EXACT_ONLY.modelPreferHostedTools!, MODEL)).toBe(false);
+  });
+
+  test("report agrees: the :tag model gets no hosted-tool preference", () => {
+    expect(exactValues(MODEL)["tools.hostedPreference"]!.value).toEqual({ tools: [] });
+  });
+
+  test("report agrees: the :tag model gets no openrouter routing", () => {
+    expect(exactValues(MODEL)["openrouter.order"]!.value).toEqual([]);
+  });
+
+  test("an exact key still resolves on both maps (control)", () => {
+    const v = exactValues("gpt-oss");
+    expect(v["tools.hostedPreference"]!.value).toEqual({ tools: ["image_generation"] });
+    expect(v["openrouter.order"]!.value).toEqual(["fireworks"]);
+  });
+
+  test("a prototype-shaped id resolves neither map", () => {
+    // The bare index this replaced walked the prototype chain here too, so these two
+    // maps had the original bug and must not simply inherit the family-aware fix.
+    for (const modelId of ["constructor", "toString", "valueOf"]) {
+      const v = exactValues(modelId);
+      expect(v["tools.hostedPreference"]!.value).toEqual({ tools: [] });
+      expect(v["openrouter.order"]!.value).toEqual([]);
+    }
+  });
+});