The capability detector should be treated as a versioned contract, not a one-time device check. Model availability, context limits, battery state, and OS policy can change between planning and execution, so every consequential tool call should revalidate capability and permission. I would also keep tool schemas and idempotency keys identical across local and cloud routes; otherwise fallback changes action semantics rather than only the inference location. That makes offline, local, and escalated execution testable with the same scenario suite.