legion-llm 0.15.0 → 0.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2620e9731075a26249c5f8bad24610953eac37892f17212d1275a0a66b2497d8
-  data.tar.gz: f13b135f8276958450683397e26defa62098c892ac50f40642593606e878960d
+  metadata.gz: c27dbb3d54472859916263b21e60e5150b8deb3b1138cfcb7c7d7e28d5ebbc1d
+  data.tar.gz: 3e4fb810c2ea38c895a98abd3cb432e3805a3faf35cdfecb5ad3e2347aa47046
 SHA512:
-  metadata.gz: b3d6cd8d597e522fca27a92dc62e27ecbb4ca3237136110544a23bf5f94e2159290c24c9365252693674e4f5898d2bdf654f85a80eab9740bb6e72e010747ef2
-  data.tar.gz: 2fa40ab507a7725517d27143e8d78f985e67ebebd2314e0811c673f8b83d2d004ed051b98c5aa1aedbc6da04eed0e34ec152292d80c16cc7ffe2e112a235f2f4
+  metadata.gz: c0f36cfb05fdf100e7c706dbfa254fd486afb1de6c7beb3644ca56f0504283168fe676fb8b5299222d06d4206db469af98b0498fe22d04adc1ec1ea8fc1212cb
+  data.tar.gz: f365e296fc5c77dba031187153c8f77cb454737b6637a199102e598a1e80beb3a26b68481888266bbd0c6a5943aa00eef6b5a11905ee60f6ada38f6861667290

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Legion LLM Changelog
 
+## [0.15.1] - 2026-08-01
+
+### Fixed
+- **`rag_enabled?` shadow-default made setting un-disableable.** The `rag_setting(key, default)` helper used `Legion::Settings.dig(:llm, :rag, key) || default`, which evaluates `false || true` → `true` for any boolean setting. Setting `llm.rag.enabled = false` was silently ignored. Deleted `rag_setting`, `rag_settings`, `settings_value`, and `trivial_patterns` wrapper methods entirely. All call sites now use direct bracket access (`Legion::Settings[:llm][:rag][:key]`) per legionio-standards.md §3. Defaults live exclusively in `rag_defaults` in `settings.rb`.
+- **Circuit-breaker half-open starvation recovery.** When all providers tripped simultaneously, the half-open probe slot was never offered because the sweep only ran when a request arrived — but requests were already being rejected. Added a background sweep thread (`routing.health.circuit_breaker.sweep_interval_seconds`, default 30) that promotes one tripped provider to half-open regardless of inbound traffic.
+- **Provider connections not closed on shutdown (CLOSE_WAIT accumulation).** `Legion::LLM.shutdown` now iterates all registered provider connections and calls `disconnect`/`close`, preventing socket leak under container orchestration restarts.
+- **Client-side SSE write failures no longer trip the upstream provider's circuit breaker.** A dead client socket (`Puma::ConnectionError: Socket timeout writing data`, `Errno::EPIPE`/`ECONNRESET`, `StreamClosed`) mid- or end-stream was being counted as an upstream provider failure: it reported provider `:error`, tripped the vLLM lane's circuit, and escalated to `EscalationExhausted` — failing over because the *client* went away. Once both `gemma-4-31b` lanes tripped, every 31b request hit `NoLaneAvailable` until process restart, despite the upstream being healthy for weeks. Root cause: `Puma::ConnectionError` is a `RuntimeError`, not an `IOError`, so the `StreamAssembler`'s `rescue IOError, Errno::EPIPE` guards let it escape raw into the executor's escalation loop, whose failure path never consulted the existing `client_stream_error?` helper. The circuit breaker now answers only "is the upstream provider broken?": client-write/disconnect, SSE/canonical-parse/translation, and daemon/programming errors (`NoMethodError`/`ArgumentError`/`NotImplementedError`) never report provider health, trip a circuit, or escalate; a client disconnect converts to a clean cancellation that still emits its ledger event. Genuine provider errors (5xx, connection-refused-to-provider, provider 401) still trip and escalate exactly as before. Fix is provider-agnostic (no provider-name conditionals).
+
 ## [0.15.0] - 2026-07-24
 
 ### Changed

data/lib/legion/llm/api/stream_assembler.rb

@@ -149,7 +149,9 @@ module Legion
           handle_text_delta(adapted.text) if adapted.text && !adapted.text.empty?
         rescue StreamClosed
           raise
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
           raise StreamClosed, e.message
         end
@@ -182,7 +184,9 @@ module Legion
           guard { @emitter.on_done(stop_reason: stop_reason, usage: usage, model: resolved_model(final_response)) }
           emit_failover_trailers!
           @phase = :finished
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -195,7 +199,9 @@ module Legion
           start! unless @started
           guard { @emitter.on_error(message: error.message, type: type, status_code: status) }
           @phase = :finished
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -253,7 +259,9 @@ module Legion
           @full_thinking_signature = nil
           @phase = :before_first_byte
           @failover_chain << :failover_marker
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -287,7 +295,9 @@ module Legion
           return if @closed
 
           guard { @emitter.on_keep_alive }
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
         end
 
@@ -325,11 +335,29 @@ module Legion
         def guard
           yield
           true
-        rescue IOError, Errno::EPIPE => e
+        rescue StandardError => e
+          raise unless client_write_error?(e)
+
           mark_closed!(e)
           false
         end
 
+        # A failure writing the SSE response back to the HTTP client — the client socket
+        # died (disconnect / VPN bounce / timeout). NOT a provider failure. Puma::ConnectionError
+        # ("Socket timeout writing data") is a RuntimeError, NOT an IOError, so the historical
+        # `rescue IOError, Errno::EPIPE` guards let it escape into the executor, where it was
+        # misattributed to the upstream provider and tripped a healthy lane's circuit. Matched
+        # by class name so the assembler need not require puma. Everything else re-raises.
+        def client_write_error?(error)
+          name = error.class.name.to_s
+          name.include?('Puma::ConnectionError') ||
+            error.is_a?(Errno::EPIPE) ||
+            error.is_a?(Errno::ECONNRESET) ||
+            error.is_a?(Errno::ECONNABORTED) ||
+            error.is_a?(EOFError) ||
+            error.is_a?(IOError)
+        end
+
         def mark_closed!(error)
           return if @closed
 

data/lib/legion/llm/call/registry.rb

@@ -113,6 +113,24 @@ module Legion
           @mutex.synchronize { @registry.dup.freeze }
         end
 
+        def disconnect_all!
+          @mutex.synchronize do
+            count = 0
+            @registry.each_value do |entries|
+              entries.each_value do |entry|
+                adapter = entry[:adapter]
+                next unless adapter.respond_to?(:provider) && adapter.provider.respond_to?(:disconnect)
+
+                adapter.provider.disconnect
+                count += 1
+              rescue StandardError => e
+                log.warn("[llm][registry] disconnect failed: #{e.message}")
+              end
+            end
+            log.info("[llm][registry] disconnect_all count=#{count}")
+          end
+        end
+
         def reset!
           @mutex.synchronize do
             count = @registry.values.sum(&:size)

data/lib/legion/llm/inference/executor/escalation.rb

@@ -98,6 +98,17 @@ module Legion
               log.error "[llm][escalation] action=request_payload_error provider=#{resolution.provider} " \
                         "instance=#{resolution.instance || 'default'} model=#{resolution.model} " \
                         "error=#{err.message.to_s[0, 500]} daemon_side_payload_bug=true provider_health=false"
+            elsif non_provider_failure?(err)
+              # The circuit breaker answers ONE question: "is the upstream LLM provider
+              # itself broken/down?" Client-side write/disconnect (the client socket died),
+              # SSE/canonical parse/translation (LegionIO's own bugs), and daemon/programming
+              # errors are NOT provider failures. Never report provider health or trip a
+              # circuit for them — doing so misattributes a dead client socket (or our own
+              # bug) to a healthy upstream and trips its lane. This is the dominant field
+              # failure this method previously caused.
+              log.warn "[llm][escalation] action=non_provider_error provider=#{resolution.provider} " \
+                       "instance=#{resolution.instance || 'default'} model=#{resolution.model} " \
+                       "error=#{err.class}: #{err.message.to_s[0, 300]} provider_health=untouched"
             elsif account_specific_error?(err)
               # Account-scoped failure (credit balance, payment, quota). It is
               # deterministic — it will fail every call until the operator tops up —
@@ -222,7 +233,11 @@ module Legion
             emit_error_audit(error, status: status, provider: provider, model: model)
             return if request_payload_error?(error)
             return if context_overflow_error?(error)
-            return if client_stream_error?(error)
+            # Non-provider failures (client-write/disconnect, SSE/parse/translation, daemon
+            # programming errors) never reflect on provider health. The upstream is healthy;
+            # counting these as provider :error trips a live lane's circuit for a dead client
+            # socket or a LegionIO bug — the misattribution behind the field restart-cascade.
+            return if non_provider_failure?(error)
 
             if authentication_error?(error) || config_error?(error)
               Legion::LLM::Router.health_tracker.deny_model( # allowlist:write-side
@@ -400,10 +415,15 @@ module Legion
 
           # Detect client-side stream errors (disconnects, broken pipes, socket timeouts)
           # that originate from writing back to the HTTP client, not from the provider itself.
+          # Puma::ConnectionError is a RuntimeError (NOT an IOError), so it slips past the
+          # StreamAssembler's rescue IOError/EPIPE guards and reaches the executor raw — the
+          # exact class the production logs show tripping the vLLM circuit. StreamClosed is the
+          # assembler's own wrapper raised once the client socket is confirmed dead.
           def client_stream_error?(err)
             name = err.class.name.to_s
             msg  = err.message.to_s
             name.include?('Puma::ConnectionError') ||
+              name.include?('StreamAssembler::StreamClosed') ||
               name.include?('Errno::EPIPE') ||
               (name.include?('IOError') && msg.include?('closed')) ||
               (name.include?('IOError') && msg.include?('already closed')) ||
@@ -416,7 +436,37 @@ module Legion
           # shared daemon code — retrying on a different lane guarantees the same crash. Classified as
           # terminal: raise immediately, never retry, never trip circuits, never push to tried_lanes.
           def internal_error?(err)
-            err.is_a?(::NoMethodError) || err.is_a?(::ArgumentError)
+            err.is_a?(::NoMethodError) || err.is_a?(::ArgumentError) || err.is_a?(::NotImplementedError)
+          end
+
+          # SSE assembly / canonical parse / translation errors originate inside LegionIO's
+          # own stream-assembly and translation layer, not from the upstream provider. Like
+          # daemon/programming errors, they must never trip a provider circuit or escalate to
+          # another lane — the upstream is healthy; the bug is ours. Matched by class name so
+          # this stays provider-agnostic (N×N invariant) and does not couple to lex-llm gems.
+          def sse_translation_error?(err)
+            name = err.class.name.to_s
+            name.include?('JSON::ParseError') ||
+              name.include?('JSON::ParserError')
+          end
+
+          # The circuit breaker answers exactly one question: is the upstream LLM PROVIDER
+          # itself broken/down? These three families are NOT provider failures and must never
+          # trip a circuit, report provider health, or escalate to another lane:
+          #   (1) client-side write/disconnect (client socket died) — client_stream_error?
+          #   (2) SSE assembly / canonical parse / translation (LegionIO's own bugs)
+          #   (3) daemon/programming errors (NoMethodError/ArgumentError) — internal_error?
+          # Provider-agnostic: matches on exception family, never on provider name.
+          def non_provider_failure?(err)
+            client_stream_error?(err) || sse_translation_error?(err) || internal_error?(err)
+          end
+
+          # A client-side write/disconnect is a clean cancellation, not a provider failure.
+          # Distinguished from the broader non_provider_failure? set so the streaming loop can
+          # route it to a clean disconnect exit that STILL emits the ledger/metering event
+          # (invariant #6) while leaving provider health untouched.
+          def client_disconnect_error?(err)
+            client_stream_error?(err)
           end
 
           def larger_context_lane_available?(lane:, payload:, **)
@@ -442,7 +492,13 @@ module Legion
             return :context_overflow  if context_overflow_error?(error)
             return :payload_error     if request_payload_error?(error)
             return :policy_denied     if error.is_a?(Legion::LLM::ModelNotAllowed)
-            return :internal_error    if internal_error?(error) # terminal before account_specific
+            return :internal_error    if internal_error?(error) # daemon bug; terminal before account_specific (G25)
+            # non_provider (client-write/disconnect, SSE/parse/translation) is terminal and
+            # must be classified BEFORE account_specific/transient: a dead client socket or a
+            # LegionIO parse bug must never trip a provider circuit or escalate to another lane
+            # (senseless — the upstream is healthy). Checked after :internal_error so daemon
+            # programming errors keep their pre-existing, more-specific label (both are terminal).
+            return :non_provider      if non_provider_failure?(error)
             return :account_specific  if authentication_error?(error) ||
                                          config_error?(error) ||
                                          account_specific_error?(error)
@@ -460,7 +516,7 @@ module Legion
 
               payload[:tried_lanes] << lane[:id]
 
-            when :internal_error, :payload_error, :policy_denied
+            when :internal_error, :payload_error, :policy_denied, :non_provider
               raise error
             when :account_specific
               # Account/instance-scoped failure: trip the per-instance circuit.
@@ -479,6 +535,7 @@ module Legion
           rescue StandardError => e
             raise if request_payload_error?(e)
             raise if context_overflow_error?(e)
+            raise if non_provider_failure?(e) # client-write/disconnect + SSE/parse: terminal, never accumulate
 
             handle_exception(e, level: :warn, operation: 'llm.pipeline.classify_and_accumulate_exclusions',
                                 lane: lane[:id])

data/lib/legion/llm/inference/steps/debate.rb

@@ -124,7 +124,7 @@ module Legion
             gaia_trigger = gaia_debate_trigger?(@enrichments)
             return true if gaia_trigger
 
-            settings_value(:debate, :enabled) == true
+            Legion::Settings[:llm][:debate][:enabled] == true
           end
 
           def gaia_debate_trigger?(enrichments)
@@ -193,22 +193,14 @@ module Legion
 
           private
 
-          def debate_settings
-            @debate_settings ||= settings_value(:debate) || {}
-          end
-
-          def debate_setting(key, default = nil)
-            Legion::Settings[:llm][:debate][key] || default
-          end
-
-          def settings_value(*keys, default: nil)
-            Legion::Settings.dig(:llm, *keys) || default
+          def debate_setting(key)
+            Legion::Settings[:llm][:debate][key]
           end
 
           def resolve_debate_rounds(request)
             requested = request.extra.is_a?(Hash) ? request.extra[:debate_rounds] : nil
-            default   = debate_setting(:default_rounds, 1)
-            max       = debate_setting(:max_rounds, 3)
+            default   = debate_setting(:default_rounds)
+            max       = debate_setting(:max_rounds)
 
             rounds = requested ? requested.to_i : default.to_i
             rounds = 1 if rounds < 1
@@ -238,8 +230,8 @@ module Legion
             explicit_challenger = debate_setting(:challenger_model)
             explicit_judge      = debate_setting(:judge_model)
 
-            request_model    = @resolved_model || (request.routing.is_a?(Hash) ? request.routing[:model] : nil) || settings_value(:default_model)
-            request_provider = @resolved_provider || (request.routing.is_a?(Hash) ? request.routing[:provider] : nil) || settings_value(:default_provider)
+            request_model    = @resolved_model || (request.routing.is_a?(Hash) ? request.routing[:model] : nil) || Legion::Settings[:llm][:default_model]
+            request_provider = @resolved_provider || (request.routing.is_a?(Hash) ? request.routing[:provider] : nil) || Legion::Settings[:llm][:default_provider]
 
             advocate_model = explicit_advocate || "#{request_provider}:#{request_model}"
 

data/lib/legion/llm/inference/steps/rag_context.rb

@@ -46,20 +46,8 @@ module Legion
 
           private
 
-          def rag_settings
-            @rag_settings ||= settings_value(:rag, default: {})
-          end
-
-          def rag_setting(key, default = nil)
-            Legion::Settings.dig(:llm, :rag, key) || default
-          end
-
-          def settings_value(*keys, default: nil)
-            Legion::Settings.dig(:llm, *keys) || default
-          end
-
           def rag_enabled?
-            rag_setting(:enabled, true)
+            Legion::Settings[:llm][:rag][:enabled] == true
           end
 
           def substantive_query?
@@ -142,8 +130,8 @@ module Legion
               return explicit
             end
 
-            skip_threshold    = rag_setting(:utilization_skip_threshold, 0.9)
-            compact_threshold = rag_setting(:utilization_compact_threshold, 0.7)
+            skip_threshold    = Legion::Settings[:llm][:rag][:utilization_skip_threshold]
+            compact_threshold = Legion::Settings[:llm][:rag][:utilization_compact_threshold]
 
             strategy = if utilization >= skip_threshold
                          :none
@@ -166,21 +154,16 @@ module Legion
 
           def trivial_query?(query)
             query = content_text(query)
-            max_chars = rag_setting(:trivial_max_chars, 20)
-            configured_patterns = rag_setting(:trivial_patterns)
+            max_chars = Legion::Settings[:llm][:rag][:trivial_max_chars]
+            patterns = Legion::Settings[:llm][:rag][:trivial_patterns]
 
             normalized = query.strip.downcase.gsub(/[^a-z0-9\s]/, '')
-            patterns = configured_patterns || trivial_patterns
             return true if patterns.any? { |p| normalized == p }
-            return true if configured_patterns.nil? && query.length <= max_chars && normalized.split.length <= 1
+            return true if query.length <= max_chars && normalized.split.length <= 1
 
             false
           end
 
-          def trivial_patterns
-            rag_setting(:trivial_patterns, %w[ping pong ding test foobar])
-          end
-
           def apollo_available?
             return true if defined?(::Legion::Extensions::Apollo::Runners::Knowledge)
 
@@ -191,9 +174,9 @@ module Legion
           end
 
           def apollo_retrieve(query:, strategy:)
-            full_limit    = rag_setting(:full_limit, 5)
-            compact_limit = rag_setting(:compact_limit, 3)
-            confidence    = rag_setting(:min_confidence, 0.92)
+            full_limit    = Legion::Settings[:llm][:rag][:full_limit]
+            compact_limit = Legion::Settings[:llm][:rag][:compact_limit]
+            confidence    = Legion::Settings[:llm][:rag][:min_confidence]
             limit = apply_gaia_context_limit(strategy == :rag_compact ? compact_limit : full_limit,
                                              strategy: strategy)
             log_step_debug(:rag_context, :apollo_query, strategy: strategy, limit: limit, min_confidence: confidence)
@@ -205,7 +188,7 @@ module Legion
           end
 
           def filter_excluded_source_agents(result)
-            excluded = Array(rag_setting(:exclude_source_agents, []))
+            excluded = Array(Legion::Settings[:llm][:rag][:exclude_source_agents])
             return result if excluded.empty?
 
             entries = Array(result[:entries])
@@ -275,7 +258,7 @@ module Legion
           end
 
           def conversation_history_retrieval_enabled?
-            rag_setting(:conversation_history_enabled, false) == true
+            Legion::Settings[:llm][:rag][:conversation_history_enabled] == true
           end
 
           def merge_apollo_results(*results)

data/lib/legion/llm/inference/steps/skill_injector.rb

@@ -50,7 +50,7 @@ module Legion
             defined?(Legion::LLM::Skills::Registry) &&
               defined?(Legion::LLM) &&
               Legion::LLM.respond_to?(:settings) &&
-              settings_value(:skills, :enabled) != false
+              Legion::Settings[:llm][:skills][:enabled] != false
           end
 
           def resume_active_skill(conv_id, state)
@@ -131,7 +131,7 @@ module Legion
               log_step_debug(:skill_injector, :auto_skills_skipped, reason: :max_active_skills)
               return
             end
-            if settings_value(:skills, :auto_inject) == false
+            if Legion::Settings[:llm][:skills][:auto_inject] == false
               log_step_debug(:skill_injector, :auto_skills_skipped, reason: :disabled)
               return
             end
@@ -196,14 +196,14 @@ module Legion
           end
 
           def at_max_active_skills?(conv_id)
-            max    = settings_value(:skills, :max_active_skills) || 1
+            max    = Legion::Settings[:llm][:skills][:max_active_skills]
             active = Inference::Conversation.skill_state(conv_id) ? 1 : 0
             active >= max
           end
 
           def skill_disabled?(key)
-            disabled = Array(settings_value(:skills, :disabled_skills) || [])
-            enabled  = Array(settings_value(:skills, :enabled_skills) || [])
+            disabled = Array(Legion::Settings[:llm][:skills][:disabled_skills])
+            enabled  = Array(Legion::Settings[:llm][:skills][:enabled_skills])
             return true if disabled.include?(key)
             return false if enabled.empty?
 
@@ -224,10 +224,6 @@ module Legion
               intent:          @request.extra&.dig(:intent)
             }
           end
-
-          def settings_value(*keys, default: nil)
-            Legion::Settings.dig(:llm, *keys) || default
-          end
         end
       end
     end

data/lib/legion/llm/inference/steps/trigger_match.rb

@@ -205,19 +205,11 @@ module Legion
           end
 
           def trigger_scan_depth
-            tool_trigger_setting(:scan_depth, 10)
+            Legion::Settings[:llm][:tool_trigger][:scan_depth]
           end
 
           def trigger_tool_limit
-            tool_trigger_setting(:tool_limit, 25)
-          end
-
-          def tool_trigger_setting(key, default = nil)
-            Legion::Settings.dig(:llm, :tool_trigger, key) || default
-          end
-
-          def settings_value(*keys, default: nil)
-            Legion::Settings.dig(:llm, *keys) || default
+            Legion::Settings[:llm][:tool_trigger][:tool_limit]
           end
 
           def log_trigger_match(action, **fields)

data/lib/legion/llm/router/health_tracker.rb

@@ -11,16 +11,18 @@ module Legion
         LATENCY_THRESHOLD_MS = 5000
         LATENCY_PENALTY_STEP = -10
 
-        def initialize(window_seconds: 300, failure_threshold: 3, cooldown_seconds: 60)
-          @window_seconds    = window_seconds
-          @failure_threshold = failure_threshold
-          @cooldown_seconds  = cooldown_seconds
-
-          @circuits       = {}
-          @latency_window = {}
-          @handlers       = {}
-          @denied_models  = {}
-          @mutex          = Monitor.new
+        def initialize(window_seconds: 300, failure_threshold: 3, cooldown_seconds: 60, sweep_interval_seconds: 5)
+          @window_seconds         = window_seconds
+          @failure_threshold      = failure_threshold
+          @cooldown_seconds       = cooldown_seconds
+          @sweep_interval_seconds = sweep_interval_seconds
+
+          @circuits        = {}
+          @latency_window  = {}
+          @handlers        = {}
+          @denied_models   = {}
+          @last_sweep_at   = Time.now
+          @mutex           = Monitor.new
 
           register_default_handlers
         end
@@ -159,6 +161,35 @@ module Legion
           end
         end
 
+        # Advance any :open circuits past their cooldown to :half_open and write
+        # the updated health to Inventory lanes. This decouples the open→half_open
+        # transition from inbound traffic — without it, an excluded lane never
+        # receives reports so circuit_state_for_key never fires, and the circuit
+        # stays permanently :open (half-open probe starvation).
+        #
+        # Called by Router.request_lane on every selection so eligible circuits
+        # are already advanced before the soft filter runs. Throttled by
+        # sweep_interval_seconds to avoid per-request overhead under high load.
+        def sweep_circuits!
+          now = Time.now
+          return if (now - @last_sweep_at) < @sweep_interval_seconds
+
+          @last_sweep_at = now
+          @mutex.synchronize do
+            @circuits.each do |key, circuit|
+              next unless circuit[:state] == :open
+              next unless circuit[:opened_at]
+              next unless (now - circuit[:opened_at]) >= @cooldown_seconds
+
+              do_transition_circuit!(key: key, to_state: :half_open)
+              log.info("[llm][health_tracker] action=sweep_half_open provider=#{key} cooldown_elapsed_s=#{(now - circuit[:opened_at]).round}")
+            end
+          end
+        rescue StandardError => e
+          handle_exception(e, level: :warn, handled: true,
+                              operation: 'health_tracker.sweep_circuits!')
+        end
+
         private
 
         # Build key for provider/instance pair: "provider/instance"

data/lib/legion/llm/router.rb

@@ -57,6 +57,10 @@ module Legion
           rng: default_rng,
           **
         )
+          # Advance open circuits past cooldown to half_open before selection
+          # so their lanes carry a positive weight and pass the soft filter.
+          health_tracker.sweep_circuits!
+
           # 0. GAIA Preferred Provider/Model (OP2)
           if type == :inference && (tiers.include?(:gaia) || tiers.include?('gaia'))
             pref_provider = Legion::Settings.dig(:llm, :gaia, :preferred_provider)
@@ -334,9 +338,10 @@ module Legion
           cb = health[:circuit_breaker] || {}
 
           HealthTracker.new(
-            window_seconds:    health.fetch(:window_seconds, 300),
-            failure_threshold: cb.fetch(:failure_threshold, 3),
-            cooldown_seconds:  cb.fetch(:cooldown_seconds, 60)
+            window_seconds:         health.fetch(:window_seconds, 300),
+            failure_threshold:      cb.fetch(:failure_threshold, 3),
+            cooldown_seconds:       cb.fetch(:cooldown_seconds, 60),
+            sweep_interval_seconds: cb.fetch(:sweep_interval_seconds, 5)
           )
         end
       end

data/lib/legion/llm/settings.rb

@@ -272,7 +272,7 @@ module Legion
           },
           health:                     {
             window_seconds:               300,
-            circuit_breaker:              { failure_threshold: 3, cooldown_seconds: 60 },
+            circuit_breaker:              { failure_threshold: 3, cooldown_seconds: 60, sweep_interval_seconds: 5 },
             latency_penalty_threshold_ms: 5000,
             budget:                       { daily_limit_usd: nil, monthly_limit_usd: nil }
           },

data/lib/legion/llm/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module LLM
-    VERSION = '0.15.0'
+    VERSION = '0.15.1'
   end
 end

data/lib/legion/llm.rb

@@ -117,6 +117,7 @@ module Legion
         Legion::Settings[:llm][:connected] = false
         @started = false
         Inventory::Discovery.reset!
+        Call::Registry.disconnect_all!
         Call::Registry.reset!
         # Clear LLM-level embedding ivars that may have been set via instance_variable_set for testing
         @can_embed = nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-llm
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.15.1
 platform: ruby
 authors:
 - Esity