FluxRouter STT: product returns 402 premium_locked where a direct curl with the same key returns 200

[FerroxLabs]

Two measurements of the same FluxRouter STT call disagree, and the code documents a mechanism that would explain it.

Measured 2026-07-31, same FLUX_API_KEY, same model id the product pins:

caller	result
direct curl POST https://api.fluxrouter.ai/v1/audio/transcriptions with model=flux-voice-fast	HTTP 200, exact transcript
direct curl, model=flux-voice	HTTP 200, exact transcript
the same route through the product (lane voice-default-2 V4)	HTTP 402 premium_locked

The curl result was reproduced twice, ~1 hour apart, so this is not a quota that lapsed in between.

Why this is probably ours, not FluxRouter's

crates/wcore-providers/src/flux_image.rs:9-12 states the mechanism plainly:

Gating is paid-only (contract §2): a free / paid-but-uncleared key gets a 402 premium_locked with no provider call and no bill. We reuse T1's parse_flux_402 so the typed entitlement errors are identical to the chat surface.

So the product can emit 402 premium_locked without ever calling FluxRouter. If that gate is on the STT path, it is refusing a request the provider would have served — the key demonstrably has access to these models.

The lane concluded the 402 was "genuine, confirmed via preserved raw-curl control". That conclusion is contradicted by the curl above. One of the two is wrong and it should be settled by measurement, not by preference — it is entirely possible the lane's control differed in some way I cannot see from the report.

Work

1. Determine whether the 402 originates client-side (parse_flux_402 / entitlement gate) or from the wire. The decisive artifact is a packet-level or pre-send log line: did an HTTP request to api.fluxrouter.ai leave the process at all?
2. If client-side: the entitlement gate is applied to a capability the key holds. Scope it to the surfaces it was written for, or teach it the audio route.
3. Prove both directions — a key that genuinely lacks entitlement must still get a 402, or the fix is just a removed check.

Consequence if unfixed: FluxRouter voice transcription is unreachable through the product even though the provider serves it, and FLUX_ROUTER_STT_MODEL is already pinned to flux-voice-fast. The V4 pass in that lane silently ran on GROQ_API_KEY instead.