@bitkyc08/opencodex 2.22.0 → 2.23.0

package/src/lib/errors.ts

@@ -143,6 +143,15 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(text)) {
     return { message, type: "invalid_request_error", code: CYBER_POLICY_ERROR_CODE };
   }
+  // A LOCAL preflight refusal keeps its own code (#1524). The message necessarily says
+  // "context window" -- that is what it is refusing on -- so the generic remap below would
+  // rewrite it to `context_length_exceeded` and make it indistinguishable from an UPSTREAM
+  // verdict. The two need opposite fallback handling: ours means "this candidate does not
+  // fit", theirs means "the request is impossible", so collapsing them ended the chain at
+  // the first candidate that was merely too small.
+  if (type === "input_admission_refused") {
+    return { message, type: "invalid_request_error", code: "input_admission_refused" };
+  }
   if (
     text.includes("context_length_exceeded") ||
     text.includes("context window") ||

package/src/lib/lab-activation.ts

@@ -13,7 +13,7 @@
  * therefore completes before `startServer` returns, inside the same synchronous turn as
  * `Bun.serve`, so no request can observe an unregistered slot.
  *
- * See devlog/_plan/260814_lab_core_decoupling/080_activation_is_synchronous.md
+ * See devlog/_fin/260814_lab_core_decoupling/080_activation_is_synchronous.md
  *
  * Startup degrades, explicit operator action reports. This asymmetry is deliberate: an
  * invalid automation config disables automation with a warning here, but the management

package/src/lib/optional-shutdown-hooks.ts

@@ -16,7 +16,7 @@
  * absolute deadline, so a hook that throws must not prevent its siblings — or
  * `server.stop` — from running.
  *
- * See devlog/_plan/260814_lab_core_decoupling/010_lifecycle_shutdown_registry.md
+ * See devlog/_fin/260814_lab_core_decoupling/010_lifecycle_shutdown_registry.md
  */
 
 type ShutdownHook = () => void;

package/src/providers/quota.ts

@@ -237,21 +237,27 @@ function providerLabel(providerId: string): string {
 }
 
 function normalizeResetAt(value: unknown): number | undefined {
-  if (typeof value === "number" && Number.isFinite(value)) return value > 10_000_000_000 ? value : value * 1000;
+  if (typeof value === "number" && Number.isFinite(value)) return epochMillis(value);
   if (typeof value === "string" && value.trim()) {
     const trimmed = value.trim();
     // Cursor Connect RPC returns billingCycleEnd as a unix-ms decimal string ("1771077734000").
     // Date.parse treats that as invalid; numeric epoch strings must be handled explicitly.
-    if (/^\d+(\.\d+)?$/.test(trimmed)) {
+    if (/^[+-]?\d+(\.\d+)?$/.test(trimmed)) {
       const numeric = Number(trimmed);
-      if (Number.isFinite(numeric)) return numeric > 10_000_000_000 ? numeric : numeric * 1000;
+      return epochMillis(numeric);
     }
     const parsed = Date.parse(trimmed);
-    return Number.isFinite(parsed) ? parsed : undefined;
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
   }
   return undefined;
 }
 
+/** Unix 0 / negative values are sentinels, not reset clocks (Command Code fiveHour.resetAt: 0). */
+function epochMillis(value: number): number | undefined {
+  if (!Number.isFinite(value) || value <= 0) return undefined;
+  return value > 10_000_000_000 ? value : value * 1000;
+}
+
 function toFiniteNumber(value: unknown): number | undefined {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim()) {

package/src/providers/registry.ts

@@ -452,7 +452,7 @@ const OPENCODE_FREE_DEEPSEEK_MODELS = ["deepseek-v4-flash-free"];
  *
  * Zen's roster is discovered live while this list is static, so it is a dated
  * exception list, not a capability model. Re-probe before extending it.
- * Evidence: devlog/_plan/260805_bug_fix_stack/002_zen_modality_probe.md
+ * Evidence: devlog/_fin/260805_bug_fix_stack/002_zen_modality_probe.md
  */
 const OPENCODE_ZEN_TEXT_ONLY_MODELS = [
   "big-pickle",
@@ -1513,7 +1513,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // finished (28-46 s of silence on long turns). The registry knob itself remains
     // for providers that need it — re-adding one line here restores the old policy.
     // Evidence: https://api-docs.deepseek.com/guides/responses_api/ +
-    // devlog/_plan/260807_deepseek_responses_streaming/000_plan.md.
+    // devlog/_fin/260807_deepseek_responses_streaming/000_plan.md.
     // Current official streams normally carry a real terminal; retain a narrow grace
     // repair for the historical shape that closes after a complete graph without one.
     modelResponsesTerminalRepair: { "deepseek-v4-flash": { graceMs: 5_000 }, "deepseek-v4-pro": { graceMs: 5_000 } },

package/src/responses/parser.ts

@@ -9,10 +9,12 @@ import type {
   OcxThinkingContent,
   OcxTool,
   OcxToolCall,
+  OcxReasoningReplayScopeRef,
 } from "../types";
 import { namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
 import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
+import { lookupReplayThoughtSignature } from "./thought-signature-replay";
 import { compactionItemToText } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
@@ -23,6 +25,21 @@ function isObj(v: unknown): v is Record<string, unknown> {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 
+/**
+ * Wrap a remembered proxy-side signature as provider metadata for a replayed tool call.
+ *
+ * The scope is REQUIRED for a hit. `parseRequest` runs before the route and account are
+ * chosen, so a caller that has not yet bound a replay scope gets nothing rather than a
+ * signature belonging to some other thread that happened to reuse the same `call_id`.
+ */
+function replayThoughtSignatureMetadata(
+  callId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): { google: { thoughtSignature: string } } | undefined {
+  const signature = lookupReplayThoughtSignature(callId, scope);
+  return signature ? { google: { thoughtSignature: signature } } : undefined;
+}
+
 type InputBlock =
   | { type: "input_text"; text: string }
   | { type: "text"; text: string }
@@ -165,13 +182,17 @@ function buildTools(tools: unknown[] | undefined): OcxTool[] | undefined {
       }
     }
     else if (t.type === "custom" && typeof t.name === "string") {
-      // Freeform custom tool (e.g. apply_patch). Chat models can't emit a lark grammar, so expose a
-      // function with a single string `input` carrying the raw tool body; the bridge relays the model's
-      // call back as a custom_tool_call (Codex's freeform handler rejects a function_call → fatal abort).
+      // Freeform custom tools are lowered to a single string `input` because chat models cannot
+      // emit Responses grammar payloads directly. Keep tool-specific input guidance scoped to the
+      // tool that owns it: leaking apply_patch syntax into `exec` or another freeform tool teaches
+      // routed models that the nested helper name is itself a callable top-level tool.
+      const inputDescription = t.name === "apply_patch"
+        ? "Raw tool input. For apply_patch, begin exactly with `*** Begin Patch` (no trailing `***`), then use its standard patch envelope."
+        : "Raw freeform input for this tool.";
       out.push({
         name: t.name,
         description: (t.description as string) ?? "",
-        parameters: { type: "object", properties: { input: { type: "string", description: "Raw tool input. For apply_patch, begin exactly with `*** Begin Patch` (no trailing `***`), then use its standard patch envelope." } }, required: ["input"] },
+        parameters: { type: "object", properties: { input: { type: "string", description: inputDescription } }, required: ["input"] },
         freeform: true,
       });
     }
@@ -294,7 +315,11 @@ function attachPendingReasoningToCallOwner(
 
 const REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
-export function parseRequest(body: unknown): OcxParsedRequest {
+export function parseRequest(
+  body: unknown,
+  parseOptions?: { replayCacheScope?: OcxReasoningReplayScopeRef },
+): OcxParsedRequest {
+  const replayCacheScope = parseOptions?.replayCacheScope;
   const replayedInputPrefixLength = previousResponseReplayPrefixLength(body);
   const parsed = responsesRequestSchema.safeParse(body);
   if (!parsed.success) {
@@ -522,8 +547,12 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         };
         // Provider-opaque metadata (e.g. a Gemini thought signature) travels with the call so a
         // history-replayed or previous_response_id turn rebuilds the same signed part instead of
-        // depending on the same-process replay cache (issue #1735).
-        const providerMetadata = providerMetadataFromResponsesFunctionCall(call);
+        // depending on the same-process replay cache (issue #1735). Real clients do not echo
+        // extra_content on replay, so fall back to the proxy-side store keyed by call_id.
+        const providerMetadata = providerMetadataFromResponsesFunctionCall(call)
+          ?? (typeof call.call_id === "string"
+            ? replayThoughtSignatureMetadata(call.call_id, replayCacheScope)
+            : undefined);
         if (providerMetadata) toolCall.providerMetadata = providerMetadata;
         assistantHolderWithReasoning().content.push(toolCall);
         continue;
@@ -531,10 +560,12 @@ export function parseRequest(body: unknown): OcxParsedRequest {
 
       if (effectiveType === "custom_tool_call") {
         const call = item as { id?: string; call_id: string; name: string; input: string };
+        const remembered = typeof call.call_id === "string" ? replayThoughtSignatureMetadata(call.call_id, replayCacheScope) : undefined;
         const toolCall: OcxToolCall = {
           type: "toolCall", id: call.call_id, name: call.name,
           arguments: { input: call.input ?? "" },
           customWireName: call.name,
+          ...(remembered ? { providerMetadata: remembered } : {}),
         };
         assistantHolderWithReasoning().content.push(toolCall);
         continue;
@@ -547,9 +578,11 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const callId = call.call_id ?? call.id;
         if (callId) {
           const command = Array.isArray(call.action?.command) ? call.action.command : [];
+          const remembered = replayThoughtSignatureMetadata(callId, replayCacheScope);
           assistantHolderWithReasoning().content.push({
             type: "toolCall", id: callId, name: "shell",
             arguments: command.length > 0 ? { command } : {},
+            ...(remembered ? { providerMetadata: remembered } : {}),
           });
         }
         continue;
@@ -568,9 +601,11 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // history stays complete (otherwise the model re-issues tool_search forever).
         const call = item as { id?: string; call_id?: string; arguments?: unknown };
         const callId = call.call_id ?? call.id ?? "";
+        const remembered = callId ? replayThoughtSignatureMetadata(callId, replayCacheScope) : undefined;
         assistantHolderWithReasoning().content.push({
           type: "toolCall", id: callId, name: "tool_search",
           arguments: isObj(call.arguments) ? call.arguments : {},
+          ...(remembered ? { providerMetadata: remembered } : {}),
         });
         continue;
       }

package/src/responses/provider-opaque-metadata.ts

@@ -30,7 +30,7 @@ function isObj(value: unknown): value is Record<string, unknown> {
  */
 const MAX_SIGNATURE_BYTES = 64 * 1024;
 
-function isCarryableSignature(value: unknown): value is string {
+export function isCarryableSignature(value: unknown): value is string {
   if (typeof value !== "string" || value.length === 0) return false;
   // Cheap length pre-check: UTF-8 is at most 3 bytes per UTF-16 code unit for the BMP, so this
   // skips the encode for the overwhelmingly common short case.

package/src/responses/thought-signature-replay.ts

@@ -0,0 +1,261 @@
+/**
+ * Server-side thought-signature replay store (issue #1735 follow-up).
+ *
+ * Gemini issues a thoughtSignature on the function-call part of a response and requires it
+ * back when the same call is replayed in a later request. The Responses wire carries the
+ * signature in extra_content.google.thought_signature, and a conforming client echoes it on
+ * the replay. Real clients (codex-rs 0.144.x, Codex desktop) do NOT echo extra_content:
+ * they replay history as bare function_call / custom_tool_call items keyed by call_id.
+ * Without the signature Gemini rejects the replayed part with
+ * "Function call is missing a thought_signature in functionCall parts".
+ *
+ * This module is the proxy-side fallback: remember the signature we handed out and re-attach
+ * it on replay even when the client never echoes it. Values stay opaque (never parsed or
+ * re-encoded) and are bounded like the wire metadata.
+ *
+ * SCOPE: a client-visible `call_id` is NOT unique across conversations, accounts, providers
+ * or models. Keying on it alone let one thread's signature overwrite another's, and let a
+ * lookup hand a signature from a different account's turn to the current one. The key is the
+ * same identity the in-process reasoning cache already uses — thread plus exact provider
+ * destination, adapter, model and credential — so a signature can only ever be replayed into
+ * the turn that produced it.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFileAsync, getConfigDir } from "../config";
+import type { OcxProviderOpaqueToolCallMetadata, OcxReasoningReplayScopeRef } from "../types";
+import { isCarryableSignature, responsesExtraContentFromProviderMetadata } from "./provider-opaque-metadata";
+
+const STORE_FILE_NAME = "thought-signature-replay.json";
+
+/** Bound on remembered entries; real signatures are a few hundred bytes, so this stays small. */
+const MAX_ENTRIES = 16_384;
+/**
+ * Total bytes of remembered signature material.
+ *
+ * An entry count alone is not a memory bound: a single signature may be 64KiB, so 16,384
+ * entries is a ~1GiB ceiling. This is the bound that actually holds.
+ */
+const MAX_TOTAL_BYTES = 32 * 1024 * 1024;
+/** A signature is needed for the immediate next turn; a long TTL also covers resumed threads. */
+const TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+type StoredEntry = { sig: string; savedAt: number };
+
+/** Outcome of a remember attempt. `conflict` is a real signal, not a no-op. */
+export type ThoughtSignatureRememberResult =
+  | "stored"
+  | "already-equal"
+  | "conflict"
+  | "unscoped"
+  | "ignored";
+
+let entries = new Map<string, StoredEntry>();
+let totalBytes = 0;
+let loaded = false;
+let persistChain: Promise<void> = Promise.resolve();
+
+function storePath(): string {
+  return join(getConfigDir(), STORE_FILE_NAME);
+}
+
+function nonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+/**
+ * Durable key for one call, or `undefined` when the scope is incomplete.
+ *
+ * Incomplete scope means "do not remember" rather than "remember globally": a partially
+ * identified entry is exactly the cross-thread collision this store exists to prevent.
+ * The reasoning cache's identities are process-local HMACs, so this key deliberately uses
+ * only the stable, non-secret fields that survive a restart.
+ */
+function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined): string | undefined {
+  const identity = scope?.current;
+  if (
+    !nonEmpty(callId)
+    || !nonEmpty(scope?.clientThreadId)
+    || !nonEmpty(identity?.providerName)
+    || !nonEmpty(identity?.adapterName)
+    || !nonEmpty(identity?.modelId)
+  ) return undefined;
+  return JSON.stringify([
+    scope.clientThreadId,
+    identity.providerName,
+    identity.adapterName,
+    identity.modelId,
+    callId,
+  ]);
+}
+
+function load(): void {
+  if (loaded) return;
+  loaded = true;
+  let raw: string;
+  try {
+    raw = readFileSync(storePath(), "utf8");
+  } catch {
+    return; // First run or unreadable file: start empty.
+  }
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || !Array.isArray((parsed as { entries?: unknown }).entries)) {
+      return;
+    }
+    const nowMs = Date.now();
+    for (const entry of (parsed as { entries: unknown[] }).entries) {
+      if (typeof entry !== "object" || entry === null) continue;
+      const { key, sig, savedAt } = entry as { key?: unknown; sig?: unknown; savedAt?: unknown };
+      if (typeof key !== "string" || typeof sig !== "string" || typeof savedAt !== "number") continue;
+      if (savedAt <= nowMs - TTL_MS) continue;
+      if (!isCarryableSignature(sig)) continue;
+      entries.set(key, { sig, savedAt });
+      totalBytes += sig.length;
+    }
+  } catch {
+    // Corrupt store: ignore it; a later remember() rewrites a clean snapshot.
+  }
+  // A loaded snapshot can already exceed the bounds if they were lowered, so enforce them
+  // here rather than waiting for the next write.
+  prune(Date.now());
+}
+
+function prune(nowMs: number): void {
+  for (const [key, entry] of entries) {
+    if (nowMs - entry.savedAt > TTL_MS) {
+      entries.delete(key);
+      totalBytes -= entry.sig.length;
+    }
+  }
+  if (entries.size <= MAX_ENTRIES && totalBytes <= MAX_TOTAL_BYTES) return;
+  const sorted = [...entries.entries()].sort((a, b) => a[1].savedAt - b[1].savedAt);
+  for (const [key, entry] of sorted) {
+    if (entries.size <= MAX_ENTRIES && totalBytes <= MAX_TOTAL_BYTES) break;
+    entries.delete(key);
+    totalBytes -= entry.sig.length;
+  }
+}
+
+function persist(): Promise<void> {
+  persistChain = persistChain
+    .then(async () => {
+      const snapshot = JSON.stringify({
+        version: 2,
+        entries: [...entries].map(([key, entry]) => ({ key, sig: entry.sig, savedAt: entry.savedAt })),
+      });
+      await atomicWriteFileAsync(storePath(), snapshot);
+    })
+    .catch(() => {
+      // Best-effort persistence: the in-memory store still serves the running process.
+    });
+  return persistChain;
+}
+
+/**
+ * Record the signature that left the proxy on a function-call response item.
+ *
+ * Returns the outcome so a caller can await durability before exposing the item, and so a
+ * genuine conflict is observable instead of silently overwriting. A different signature under
+ * the SAME complete key means two different upstream turns claimed one identity: that is a
+ * corruption signal, and keeping the first value is the fail-closed choice.
+ */
+export function rememberThoughtSignatureForReplay(
+  callId: string,
+  signature: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): { result: ThoughtSignatureRememberResult; durable: Promise<void> } {
+  if (!callId || !isCarryableSignature(signature)) {
+    return { result: "ignored", durable: Promise.resolve() };
+  }
+  const key = keyFor(callId, scope);
+  if (key === undefined) return { result: "unscoped", durable: Promise.resolve() };
+  load();
+  const existing = entries.get(key);
+  if (existing) {
+    if (existing.sig === signature) return { result: "already-equal", durable: Promise.resolve() };
+    return { result: "conflict", durable: Promise.resolve() };
+  }
+  entries.set(key, { sig: signature, savedAt: Date.now() });
+  totalBytes += signature.length;
+  prune(Date.now());
+  return { result: "stored", durable: persist() };
+}
+
+/**
+ * Serialize provider metadata onto an outbound Responses function_call item AND remember the
+ * signature server-side, so a client that replays the call without echoing extra_content can
+ * still be served from the store.
+ */
+export function rememberAndSerializeExtraContent(
+  callId: string,
+  metadata: OcxProviderOpaqueToolCallMetadata | undefined,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): {
+  extra?: { extra_content: { google: { thought_signature: string } } };
+  durable: Promise<void>;
+} {
+  const extra = responsesExtraContentFromProviderMetadata(metadata);
+  if (!extra) return { durable: Promise.resolve() };
+  const { durable } = rememberThoughtSignatureForReplay(
+    callId,
+    extra.extra_content.google.thought_signature,
+    scope,
+  );
+  return { extra, durable };
+}
+
+/**
+ * Remember the signature without serializing it onto the item. Used for freeform tools, whose
+ * Responses items are custom_tool_call blocks that cannot carry extra_content — the signature
+ * still must be stored so the replayed call (which comes back as custom_tool_call and never
+ * echoes metadata) can be re-signed server-side.
+ */
+export function rememberExtraContentForReplay(
+  callId: string,
+  metadata: OcxProviderOpaqueToolCallMetadata | undefined,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): Promise<void> {
+  const extra = responsesExtraContentFromProviderMetadata(metadata);
+  if (!extra) return Promise.resolve();
+  return rememberThoughtSignatureForReplay(
+    callId,
+    extra.extra_content.google.thought_signature,
+    scope,
+  ).durable;
+}
+
+/** Look up a signature previously handed out for this call in THIS scope, if still fresh. */
+export function lookupReplayThoughtSignature(
+  callId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+): string | undefined {
+  const key = keyFor(callId, scope);
+  if (key === undefined) return undefined;
+  load();
+  const entry = entries.get(key);
+  if (!entry) return undefined;
+  if (Date.now() - entry.savedAt > TTL_MS) {
+    entries.delete(key);
+    totalBytes -= entry.sig.length;
+    return undefined;
+  }
+  return entry.sig;
+}
+
+/** Test seams: clear in-memory state and the loaded flag without touching the file. */
+export function resetThoughtSignatureReplayForTests(): void {
+  entries = new Map();
+  totalBytes = 0;
+  loaded = false;
+  persistChain = Promise.resolve();
+}
+
+export function thoughtSignatureReplayCountForTests(): number {
+  return entries.size;
+}
+
+/** Test seam: resolve after the queued snapshot write settles. */
+export function flushThoughtSignatureReplayForTests(): Promise<void> {
+  return persistChain;
+}

package/src/router.ts

@@ -715,12 +715,17 @@ function routeByKnownModelPattern(config: OcxConfig, modelId: string): RouteResu
   for (const { providerNames, prefixes } of MODEL_PROVIDER_PATTERNS) {
     if (prefixes.some(prefix => modelId.startsWith(prefix))) {
       const matchingProvider = Object.entries(config.providers).find(
-        ([name]) => providerNames.some(providerName => name === providerName || name.startsWith(`${providerName}-`))
+        ([name, prov]) => prov.disabled !== true && providerNames.some(providerName => name === providerName || name.startsWith(`${providerName}-`))
       );
       if (matchingProvider) {
         const [provName, prov] = matchingProvider;
         return routeResult(provName, prov, modelId, "explicit-provider", "model-pattern");
       }
+      // Deliberately no "first provider with an Anthropic adapter" fallback here. Picking by
+      // object insertion order, without checking `models`, `selectedModels`, `disabledModels` or
+      // discovery state, silently moves a request onto a provider the operator never chose, with
+      // its own privacy and billing consequences (#1697). A classifier turn that needs a specific
+      // target gets it from operator-declared `claudeCode.classifierModel` / `classifierFallbacks`.
     }
   }
   return undefined;

package/src/routing/compatibility/provider-slot.ts

@@ -11,7 +11,7 @@
  * compatibility-gated routing profiles never register one, so the core evidence assembler
  * never reaches the Lab module graph.
  *
- * See devlog/_plan/260814_lab_core_decoupling/030_router_and_startup_activation.md
+ * See devlog/_fin/260814_lab_core_decoupling/030_router_and_startup_activation.md
  */
 import type { OcxConfig } from "../../types";
 import type { NormalizedRoutingProfile } from "../profile";

package/src/routing/evaluator.ts

@@ -21,7 +21,7 @@ import {
   type Unknownable,
 } from "./trace";
 import { getRoutingProfile, policyModelId, type NormalizedRoutingProfile } from "./profile";
-import { healthScore } from "./health";
+import { healthScore, latencyScoreFromEvidence } from "./health";
 import { quotaScore } from "./quota";
 import { costScore } from "./cost";
 import { evaluateCompatibilityForCandidate } from "./compatibility/policy";
@@ -398,10 +398,16 @@ export function evaluatePolicyProfile(
     const healthWeight = profile.optimize.health;
     const quotaWeight = profile.optimize.quota;
     const costWeight = profile.optimize.cost;
+    // `optimize.latency` was normalized into the weight sum but never spent, so whatever
+    // was allocated to it silently became configuredPriority -- i.e. declaration order.
+    // Spend it on the same p50-derived score the health composite already uses.
+    const latencyWeight = profile.optimize.latency;
+    const latencyValue = latencyWeight > 0 ? latencyScoreFromEvidence(health) : null;
     const spentHealth = healthValue !== null ? healthWeight : 0;
     const spentQuota = quotaValue !== null ? quotaWeight : 0;
     const spentCost = costValue !== null ? costWeight : 0;
-    const priorityWeight = Math.max(0, 1 - spentHealth - spentQuota - spentCost);
+    const spentLatency = latencyValue !== null ? latencyWeight : 0;
+    const priorityWeight = Math.max(0, 1 - spentHealth - spentQuota - spentCost - spentLatency);
     const components: RouteScoreEvidence["components"] = { configuredPriority: priorityScore };
     let total = priorityWeight * priorityScore;
     if (healthWeight > 0 && healthValue !== null) {
@@ -416,6 +422,10 @@ export function evaluatePolicyProfile(
       total += costWeight * costValue;
       components.cost = costValue;
     }
+    if (latencyWeight > 0 && latencyValue !== null) {
+      total += latencyWeight * latencyValue;
+      components.latency = latencyValue;
+    }
     if (compatibilityValue !== null) {
       // Compatibility is a penalty-only dimension. A penalized candidate loses
       // a bounded fraction of its existing score; satisfied/allowed evidence

package/src/routing/health.ts

@@ -372,6 +372,20 @@ export function healthEvidenceForCandidate(input: HealthEvidenceInput): RouteHea
   return evidence;
 }
 
+/**
+ * Deterministic latency score in [0,1] from the recorded p50, shared by the health
+ * composite and the standalone `optimize.latency` term so the two cannot drift apart.
+ *
+ * An unmeasured candidate scores the NEUTRAL midpoint, not 0. Punishing it into last
+ * place would make selection depend on which candidate happened to be exercised first,
+ * which is the order-dependence this scoring exists to remove.
+ */
+export function latencyScoreFromEvidence(evidence: RouteHealthEvidence | undefined): number {
+  const p50 = evidence?.recentLatencyMs;
+  if (p50 === undefined) return 0.5;
+  return Math.max(0, Math.min(1, 1 - p50 / HEALTH_SCORE_CONSTANTS.LATENCY_TARGET_MS));
+}
+
 /**
  * Deterministic health score in [0,1]. Returns null when evidence is unknown
  * (no samples) so callers can apply the profile's unknownEvidence policy.
@@ -383,15 +397,12 @@ export function healthScore(evidence: RouteHealthEvidence | undefined, now = Dat
   if (!evidence.sampleCount || evidence.sampleCount < 1) return null;
   const successRate = evidence.successRate ?? 0;
   const incompleteRate = evidence.incompleteStreamRate ?? 0;
-  const p50 = evidence.recentLatencyMs;
-  const latencyScore = p50 === undefined
-    ? 0.5
-    : Math.max(0, Math.min(1, 1 - p50 / HEALTH_SCORE_CONSTANTS.LATENCY_TARGET_MS));
+  const latency = latencyScoreFromEvidence(evidence);
   const consecutive = evidence.failures ?? 0;
   const recoveryScore = 1 - Math.min(1, consecutive / 5);
   const composite = HEALTH_SCORE_CONSTANTS.SUCCESS_WEIGHT * successRate
     + HEALTH_SCORE_CONSTANTS.INCOMPLETE_WEIGHT * (1 - incompleteRate)
-    + HEALTH_SCORE_CONSTANTS.LATENCY_WEIGHT * latencyScore
+    + HEALTH_SCORE_CONSTANTS.LATENCY_WEIGHT * latency
     + HEALTH_SCORE_CONSTANTS.RECOVERY_WEIGHT * recoveryScore;
   const confidence = Math.min(1, evidence.sampleCount / HEALTH_SCORE_CONSTANTS.MIN_CONFIDENCE_SAMPLES);
   const softAvoid = evidence.softAvoidUntilMs !== undefined && evidence.softAvoidUntilMs > now

package/src/routing/history/schema.ts

@@ -3,7 +3,7 @@
  *
  * `usage.jsonl` remains the canonical append-only evidence ledger;
  * `routing-history.sqlite` is a disposable, rebuildable query projection
- * (ADR-1/ADR-8 in devlog/_plan/260804_router_intelligence/000_master_plan.md).
+ * (ADR-1/ADR-8 in devlog/_fin/260804_router_intelligence/000_master_plan.md).
  */
 
 export const HISTORY_SCHEMA_VERSION = 1;

package/src/routing/trace.ts

@@ -2,7 +2,7 @@
  * Route decision trace: bounded, versioned, privacy-safe evidence of WHY a
  * provider/model/account was selected for a request (RI-01).
  *
- * Contract rules (devlog/_plan/260804_router_intelligence/000_master_plan.md):
+ * Contract rules (devlog/_fin/260804_router_intelligence/000_master_plan.md):
  * - One trace per routing decision; fallback EXECUTION attempts stay in the
  *   usage entry's existing `attempts[]` array, never in this trace.
  * - Never persists prompts, message bodies, tool payloads, credentials,