@mupt-ai/dari-gateway 0.3.1 → 0.3.3

package/src/runtime/routing_lease.ts

@@ -6,8 +6,6 @@ import {
   type RoutingDecision,
 } from "@mupt-ai/dari-router/policy-engine";
 
-import { deriveFallbackDecision } from "../strategies/fallback_decision.js";
-import { executionProviderForModel } from "../models/execution_provider.js";
 import type { SelectorBackend } from "../strategies/routing.js";
 import {
   routeDecision,
@@ -71,17 +69,7 @@ export function leasedDecision(
   // incumbent cannot hide an available user-owned key behind the lease.
   if (prepared.billable && prepared.credentials.credit_exhausted) return null;
 
-  const fallbackDecision = leaseFallbackDecision({
-    candidates: prepared.routing.candidateResolution.candidates,
-    decision: lease.decision,
-    credentials: prepared.credentials,
-  });
-  // Use attachServingDecision rather than attachDecision so next_model
-  // follows the model that actually serves. When fallback handles a primary
-  // failure, it inherits this countdown and subsequent held turns continue
-  // on the healthy serving pair instead of retrying the failed primary.
   prepared.reporter.attachServingDecision(lease.decision);
-  prepared.reporter.attachFallbackDecision(fallbackDecision);
   prepared.reporter.attachDecisionDetails({
     decision_source: "lease_hold",
     routing_lease: {
@@ -90,49 +78,7 @@ export function leasedDecision(
       turn_in_lease: lease.turnInLease,
     },
   });
-  return { decision: lease.decision, fallbackDecision };
-}
-
-// Wraps a lease-held (or adopted) decision with a runtime-derived fallback so
-// a mid-lease provider failure degrades like any other turn instead of
-// erroring the request. The fallback inherits the remaining commitment so the
-// completed prefix follows the healthy serving pair for the rest of the lease.
-export function committedLeaseDecision(
-  prepared: PreparedRoutedCompletion,
-  decision: RoutingDecision,
-): RoutedDecision {
-  const fallbackDecision = leaseFallbackDecision({
-    candidates: prepared.routing.candidateResolution.candidates,
-    decision,
-    credentials: prepared.credentials,
-  });
-  if (fallbackDecision) prepared.reporter.attachFallbackDecision(fallbackDecision);
-  return fallbackDecision ? { decision, fallbackDecision } : { decision };
-}
-
-export function leaseFallbackDecision(args: {
-  candidates: PreparedRoutedCompletion["routing"]["candidateResolution"]["candidates"];
-  decision: RoutingDecision;
-  credentials: PreparedRoutedCompletion["credentials"];
-}): RoutingDecision | undefined {
-  const fallback = deriveFallbackDecision({
-    candidates: args.candidates,
-    selected: {
-      model: args.decision.selectedModel,
-      reasoningEffort: args.decision.reasoningEffort,
-    },
-    enabled: args.credentials.model_fallback_enabled !== false,
-    requiresDifferentProvider:
-      args.credentials.fallback_requires_different_provider !== false,
-    providerForModel: (model) => executionProviderForModel(args.credentials, model),
-  });
-  if (!fallback || args.decision.leaseTurnsRemaining === undefined) {
-    return fallback;
-  }
-  return {
-    ...fallback,
-    leaseTurnsRemaining: args.decision.leaseTurnsRemaining,
-  };
+  return { decision: lease.decision };
 }
 
 export async function selectorNegotiatesLeases(
@@ -220,7 +166,7 @@ export async function clearPendingLease(
   );
 }
 
-function canServeCommittedPair(
+export function canServeCommittedPair(
   prepared: PreparedRoutedCompletion,
   pair: { model: string; reasoningEffort: string },
 ): boolean {

package/src/runtime/runtime_reporter.ts

@@ -46,7 +46,6 @@ export type ReportableProviderOutcome =
 export type ProviderAttemptReport = {
   model: string;
   reasoning_effort: string;
-  role: "primary" | "fallback";
   attempt: number;
   outcome: "completed" | "error" | "terminal_error" | "canceled";
 };
@@ -65,7 +64,6 @@ export type RoutedRuntimeReporter = {
   attachSelectorRun(run: SelectorRun): void;
   attachSpeculativeSelectorRun(run: SelectorRun, servingDecision: RoutingDecision): void;
   attachDecision(decision: RoutingDecision): void;
-  attachFallbackDecision(decision: RoutingDecision | undefined): void;
   attachServingDecision(decision: RoutingDecision): void;
   recordProviderAttempt(attempt: ProviderAttemptRecord): void;
   modelCost(attempt?: ProviderAttemptRecord): number | null;
@@ -94,7 +92,6 @@ export function createExperimentRoutedRuntimeReporter(): ExperimentRoutedRuntime
     attachSelectorRun() {},
     attachSpeculativeSelectorRun() {},
     attachDecision() {},
-    attachFallbackDecision() {},
     attachServingDecision() {},
     recordProviderAttempt() {},
     modelCost() { return null; },

package/src/runtime/session_pin.ts

@@ -0,0 +1,61 @@
+import type { RoutingDecision } from "@mupt-ai/dari-router/policy-engine";
+
+import { gatewayPlatform } from "../platform/platform.js";
+import type { RoutedDecision } from "../strategies/route_decision.js";
+import type { ServedDecision } from "../types.js";
+import type { PreparedRoutedCompletion } from "./prepare_routed_completion.js";
+import { canServeCommittedPair } from "./routing_lease.js";
+
+// The session's pinned pair, while this request may still serve it. A pin
+// that can no longer serve (model disabled, credits exhausted, image input on
+// a text-only model) falls through to selection, which moves the pin.
+export function sessionPinHoldDecision(
+  prepared: PreparedRoutedCompletion,
+): ServedDecision | null {
+  const pin = prepared.sessionPin?.pin;
+  if (pin === null || pin === undefined) return null;
+  if (!canServeCommittedPair(prepared, pin)) return null;
+  return {
+    selectedModel: pin.model,
+    reasoningEffort: pin.reasoningEffort,
+    reason: `Session pin: ${pin.model}/${pin.reasoningEffort} serves this whole session.`,
+    sessionPinned: true,
+  };
+}
+
+// A pinned session never holds leases: the pin outlives any countdown.
+export function sessionPinnedSelection(routed: RoutedDecision): RoutedDecision {
+  const pinned = (decision: RoutingDecision): ServedDecision => ({ ...unleased(decision), sessionPinned: true });
+  return {
+    ...routed,
+    decision: pinned(routed.decision),
+    ...(routed.run === undefined ? {} : { run: { ...routed.run, decision: pinned(routed.run.decision) } }),
+  };
+}
+
+function unleased(decision: RoutingDecision): RoutingDecision {
+  const { leaseTurnsRemaining: _, ...rest } = decision;
+  return rest;
+}
+
+// A failed write only costs the pin: the next turn selects again.
+export async function pinSession(
+  prepared: PreparedRoutedCompletion,
+  decision: RoutingDecision,
+): Promise<void> {
+  if (prepared.sessionPin === undefined) return;
+  const pin = { model: decision.selectedModel, reasoningEffort: decision.reasoningEffort };
+  try {
+    await gatewayPlatform().writeSessionPin({
+      routerId: prepared.routerId,
+      pinKey: prepared.sessionPin.key,
+      ...pin,
+    });
+  } catch (error) {
+    gatewayPlatform().captureOperationalError(error, {
+      code: "session_pin_write_failed",
+      requestId: prepared.requestId,
+      routerId: prepared.routerId,
+    });
+  }
+}

package/src/self_host/config.ts

@@ -14,8 +14,8 @@ import {
  *       - anthropic/claude-sonnet-5-5
  *       - id: openai/gpt-5.5
  *         thinking: [medium, high]
- *     fallback: true        # retry on the next model when a provider fails
  *     subscriptions: true   # serve with connected Claude Code / ChatGPT plans
+ *     sessionPinning: false # route each session and subagent once, then keep its model
  * providers:                # optional: OpenAI-compatible or self-run endpoints
  *   local:
  *     baseUrl: http://localhost:8000/v1
@@ -44,10 +44,9 @@ export type ProviderEndpointConfig = {
 
 export type RouterConfig = {
   models: RouterModelConfig[];
-  fallback: boolean;
-  fallbackRequiresDifferentProvider: boolean;
   retries: number;
   subscriptions: boolean;
+  sessionPinning: boolean;
   zdr: boolean;
 };
 
@@ -66,7 +65,10 @@ const MODEL_ID_PATTERN = /^[a-z0-9][a-z0-9.-]*\/\S+$/;
 export async function loadGatewayConfig(path: string): Promise<GatewayConfig> {
   const file = Bun.file(path);
   if (!(await file.exists())) {
-    throw new Error(`Gateway config not found at ${path}.`);
+    throw new Error(
+      `Gateway config not found at ${path}. Write one from dari-gateway.example.yaml, `
+        + "or set DARI_GATEWAY_CONFIG (in the container image, mount it at /config/dari-gateway.yaml).",
+    );
   }
   const text = await file.text();
   const raw: unknown = path.endsWith(".json") ? JSON.parse(text) : Bun.YAML.parse(text);
@@ -129,11 +131,9 @@ function parseRouter(id: string, raw: unknown): RouterConfig {
   }
   return {
     models,
-    fallback: optionalBoolean(raw.fallback, `routers.${id}.fallback`) ?? true,
-    fallbackRequiresDifferentProvider:
-      optionalBoolean(raw.fallbackRequiresDifferentProvider, `routers.${id}.fallbackRequiresDifferentProvider`) ?? false,
     retries: optionalRetries(raw.retries, `routers.${id}.retries`) ?? 1,
     subscriptions: optionalBoolean(raw.subscriptions, `routers.${id}.subscriptions`) ?? true,
+    sessionPinning: optionalBoolean(raw.sessionPinning, `routers.${id}.sessionPinning`) ?? false,
     zdr: optionalBoolean(raw.zdr, `routers.${id}.zdr`) ?? false,
   };
 }

package/src/self_host/main.ts

@@ -12,8 +12,9 @@ import { createPrioritySelectorBackend } from "../strategies/priority_selector.j
 import type { SelectorBackend } from "../strategies/routing.js";
 import { loadGatewayConfig } from "./config.js";
 import { createSelfHostedPlatform } from "./platform.js";
-import { gatewayKeyIndex } from "./resolve.js";
+import { gatewayKeyIndex, providersWithoutCredentials } from "./resolve.js";
 import { PrefixStore } from "./prefix_store.js";
+import { SessionPinStore } from "./session_pin_store.js";
 import { handleSubscriptionRequest, SubscriptionStore } from "./subscriptions/index.js";
 
 const SUBSCRIPTION_ROUTES = "/v1/organizations/current/credentials";
@@ -27,7 +28,8 @@ const SUBSCRIPTION_ROUTES = "/v1/organizations/current/credentials";
  *   state (default `dari-gateway.db`). It holds subscription tokens.
  * - `DARI_AUTO_ROUTING_API_KEY`: choose among a router's models with Dari
  *   Auto Routing; without it, `dari/routing` serves the first listed model.
- * - `PORT` (default 8080), and each provider's standard API key variable.
+ * - `PORT` (default 8080), `DARI_GATEWAY_HOST` (default 127.0.0.1; the container
+ *   image sets 0.0.0.0), and each provider's standard API key variable.
  */
 export async function startSelfHostedGateway(env: Record<string, string> = process.env as Record<string, string>) {
   const gatewayKeys = (env.DARI_GATEWAY_KEYS ?? "")
@@ -45,21 +47,35 @@ export async function startSelfHostedGateway(env: Record<string, string> = proce
   db.exec("PRAGMA journal_mode = WAL");
   const subscriptions = new SubscriptionStore(db);
   const prefixes = new PrefixStore(db);
+  const sessionPins = new SessionPinStore(db);
   // Pi's provider auth reads each provider's standard key variable, such as
   // OPENAI_API_KEY, from this environment only.
   const piModels = builtinModels({
     authContext: { env: async (name) => env[name], fileExists: async () => false },
   });
 
+  const providerApiKey = async (provider: string) => (await piModels.getAuth(provider))?.auth.apiKey;
   const platform = createSelfHostedPlatform({
     config,
     gatewayKeys,
     subscriptions,
     prefixes,
-    providerApiKey: async (provider) => (await piModels.getAuth(provider))?.auth.apiKey,
+    sessionPins,
+    providerApiKey,
     env,
     fetch,
   });
+  // A model without a credential is dropped at request time, so a missing key
+  // would otherwise surface only as a 424 on the first request.
+  for (const [routerId, router] of Object.entries(config.routers)) {
+    const missing = await providersWithoutCredentials({ config, subscriptions, providerApiKey, env }, router);
+    if (missing.length > 0) {
+      console.warn(
+        "dari-gateway router has providers without credentials; their models are not served",
+        JSON.stringify({ router: routerId, providers: missing }),
+      );
+    }
+  }
   const autoRoutingKey = env.DARI_AUTO_ROUTING_API_KEY?.trim();
   const selectorBackend: SelectorBackend = autoRoutingKey
     ? createAutoRoutingSelectorBackend({
@@ -86,10 +102,13 @@ export async function startSelfHostedGateway(env: Record<string, string> = proce
   };
 
   const port = Number(env.PORT ?? "8080");
-  const server = startServer(port, handler);
+  // Loopback unless DARI_GATEWAY_HOST says otherwise (see the doc comment).
+  const hostname = (env.DARI_GATEWAY_HOST ?? "").trim() || "127.0.0.1";
+  const server = startServer(port, handler, { hostname });
   console.info(
     "dari-gateway listening",
     JSON.stringify({
+      hostname,
       port,
       routers: Object.keys(config.routers),
       auto_routing: autoRoutingKey ? "dari" : "priority",
@@ -99,6 +118,10 @@ export async function startSelfHostedGateway(env: Record<string, string> = proce
 }
 
 if (import.meta.main) {
-  const { server, close } = await startSelfHostedGateway();
-  installShutdownHandlers(server, async () => close());
+  // Startup errors are configuration mistakes: print the message, not a stack.
+  const started = await startSelfHostedGateway().catch((error: unknown) => {
+    console.error(`dari-gateway: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  });
+  installShutdownHandlers(started.server, async () => started.close());
 }

package/src/self_host/platform.ts

@@ -1,16 +1,18 @@
 import { errorCode } from "../http/errors.js";
 import type { GatewayPlatform } from "../platform/platform.js";
 import type { PrefixStore } from "./prefix_store.js";
+import type { SessionPinStore } from "./session_pin_store.js";
 import { resolveSelfHostedRouter, type SelfHostedResolverDeps } from "./resolve.js";
 import type { SubscriptionStore } from "./subscriptions/index.js";
 
 /**
- * The self-hosted platform: routers from the config file, subscriptions and
- * prefix-cache state in the gateway's SQLite database, and one content-free
+ * The self-hosted platform: routers from the config file, subscriptions,
+ * prefix-cache state, and session pins in the gateway's SQLite database, and one content-free
  * log line per request.
  */
 export function createSelfHostedPlatform(deps: Omit<SelfHostedResolverDeps, "prefixHits"> & {
   prefixes: PrefixStore;
+  sessionPins: SessionPinStore;
   subscriptions: SubscriptionStore;
 }): GatewayPlatform {
   const resolver: SelfHostedResolverDeps = {
@@ -25,6 +27,10 @@ export function createSelfHostedPlatform(deps: Omit<SelfHostedResolverDeps, "pre
     writePendingLease: async (write) => {
       deps.prefixes.writePendingLease(write, deps.config.routers[write.router_id]?.zdr ?? false);
     },
+    readSessionPin: async (key) => deps.sessionPins.read(key),
+    writeSessionPin: async (write) => {
+      deps.sessionPins.write(write);
+    },
     markSubscriptionUnavailable: async (hold) =>
       hold.credentialId !== undefined &&
       deps.subscriptions.markUnavailable(hold.credentialId, hold.limit.resetsAt, hold.limit.reason),

package/src/self_host/resolve.ts

@@ -58,7 +58,7 @@ export async function resolveSelfHostedRouter(
 ): Promise<ResolvedRouter> {
   const keyIndex = gatewayKeyIndex(deps.gatewayKeys, request.apiKey);
   if (keyIndex === null) {
-    throw new HttpError(401, "Missing or invalid router/API key.", "routing_key_resolution_failed");
+    throw new HttpError(401, "Missing or invalid gateway key.", "authentication_error");
   }
   const router = deps.config.routers[request.routerId];
   if (router === undefined) {
@@ -91,7 +91,10 @@ export async function resolveSelfHostedRouter(
   }
 
   const models = router.models.filter((model) => credentials.get(providerForModel(model.id)) != null);
-  if (models.length === 0) throw unavailableRouterError(request.routerId, exhausted);
+  if (models.length === 0) {
+    const missing = [...credentials].filter(([, credential]) => credential == null).map(([provider]) => provider);
+    throw unavailableRouterError(request.routerId, exhausted, missing);
+  }
 
   const resolved: ResolvedRouter = {
     router_id: request.routerId,
@@ -104,9 +107,8 @@ export async function resolveSelfHostedRouter(
     subscription_credential_ids: {},
     zdr: router.zdr,
     speculative_routing: false,
+    session_pinning: router.sessionPinning,
     primary_retries: router.retries,
-    model_fallback_enabled: router.fallback,
-    fallback_requires_different_provider: router.fallbackRequiresDifferentProvider,
     lease_context_enabled: false,
     routing_strategy: "dari",
     custom_config: null,
@@ -152,7 +154,10 @@ export async function resolveSelfHostedRouter(
 
 // Configured endpoints read their own key variable, or send a placeholder
 // when they take none; known providers use their standard variable.
-async function providerApiKey(deps: SelfHostedResolverDeps, provider: string): Promise<string | undefined> {
+async function providerApiKey(
+  deps: Pick<SelfHostedResolverDeps, "config" | "providerApiKey" | "env">,
+  provider: string,
+): Promise<string | undefined> {
   const endpoint = deps.config.providers[provider];
   if (endpoint === undefined) return (await deps.providerApiKey(provider))?.trim() || undefined;
   if (endpoint.apiKeyEnv === undefined) return "no-key";
@@ -204,23 +209,48 @@ const SUBSCRIPTION_PLAN_NAMES: Record<SubscriptionProvider, string> = {
   meta_muse: "Muse Code",
 };
 
+/**
+ * Providers a router lists that no credential can serve: no API key and no
+ * connected subscription the router allows. Startup uses this, so it counts a
+ * held subscription as connected (the request-time 424 reports holds) and
+ * checks both harnesses, since startup does not know the client.
+ */
+export async function providersWithoutCredentials(
+  deps: Pick<SelfHostedResolverDeps, "subscriptions" | "providerApiKey" | "config" | "env">,
+  router: RouterConfig,
+): Promise<string[]> {
+  const missing: string[] = [];
+  for (const provider of new Set(router.models.map((model) => providerForModel(model.id)))) {
+    const plans = router.subscriptions
+      ? [subscriptionProviderFor(provider, "claude_code"), subscriptionProviderFor(provider, "muse_code")]
+      : [];
+    const connected = plans.some((plan) => plan !== null && deps.subscriptions.list(plan).length > 0);
+    if (connected) continue;
+    const apiKey = await providerApiKey(deps, provider);
+    if (apiKey === undefined) missing.push(provider);
+  }
+  return missing;
+}
+
 function unavailableRouterError(
   routerId: string,
   exhausted: ReadonlySet<SubscriptionProvider>,
+  missing: readonly string[],
 ): HttpError {
+  const missingNote = missing.length > 0 ? ` Missing providers: ${missing.join(", ")}.` : "";
   if (exhausted.size > 0) {
     const plans = [...exhausted]
       .map((provider) => SUBSCRIPTION_PLAN_NAMES[provider])
       .join(" and ");
     return new HttpError(
       424,
-      `Every connected ${plans} subscription is at its usage limit, and no API key can serve router ${routerId} instead.`,
+      `Every connected ${plans} subscription is at its usage limit, and no API key can serve router ${routerId} instead.${missingNote}`,
       "personal_subscription_unavailable",
     );
   }
   return new HttpError(
     424,
-    `No credentials can serve router ${routerId}: set a provider API key or connect a subscription.`,
+    `No credentials can serve router ${routerId}.${missingNote} Set each provider's API key or connect a subscription that can serve it.`,
     "provider_credentials_missing",
   );
 }

package/src/self_host/session_pin_store.ts

@@ -0,0 +1,58 @@
+/**
+ * SQLite storage for session pins: the model and thinking level each session
+ * (and each subagent) of a session-pinning router was routed to on its first
+ * turn. Serving a pin refreshes it at most daily; pins unused for longer than
+ * the retention window are no longer served and are deleted.
+ */
+import type { Database } from "bun:sqlite";
+
+import type { SessionPin, SessionPinKey } from "../platform/platform.js";
+
+const RETENTION_MS = 30 * 24 * 60 * 60_000;
+const REFRESH_MS = 24 * 60 * 60_000;
+
+type PinRow = { model: string; reasoning_effort: SessionPin["reasoningEffort"]; updated_at: number };
+
+export class SessionPinStore {
+  constructor(private readonly db: Database) {
+    db.run(`CREATE TABLE IF NOT EXISTS routing_session_pins (
+      router_id TEXT NOT NULL,
+      pin_key TEXT NOT NULL,
+      model TEXT NOT NULL,
+      reasoning_effort TEXT NOT NULL,
+      updated_at INTEGER NOT NULL,
+      PRIMARY KEY (router_id, pin_key)
+    )`);
+    db.run("CREATE INDEX IF NOT EXISTS ix_routing_session_pins_updated_at ON routing_session_pins (updated_at)");
+  }
+
+  read(key: SessionPinKey, now: Date = new Date()): SessionPin | null {
+    const row = this.db
+      .query<PinRow, [string, string, number]>(
+        `SELECT model, reasoning_effort, updated_at FROM routing_session_pins
+          WHERE router_id = ? AND pin_key = ? AND updated_at >= ?`,
+      )
+      .get(key.routerId, key.pinKey, now.getTime() - RETENTION_MS);
+    if (row === null) return null;
+    if (row.updated_at < now.getTime() - REFRESH_MS) {
+      this.db
+        .query("UPDATE routing_session_pins SET updated_at = ? WHERE router_id = ? AND pin_key = ?")
+        .run(now.getTime(), key.routerId, key.pinKey);
+    }
+    return { model: row.model, reasoningEffort: row.reasoning_effort };
+  }
+
+  write(write: SessionPinKey & SessionPin, now: Date = new Date()): void {
+    this.db.transaction(() => {
+      this.db
+        .query(`INSERT INTO routing_session_pins (router_id, pin_key, model, reasoning_effort, updated_at)
+          VALUES (?, ?, ?, ?, ?)
+          ON CONFLICT (router_id, pin_key) DO UPDATE SET
+            model = excluded.model,
+            reasoning_effort = excluded.reasoning_effort,
+            updated_at = excluded.updated_at`)
+        .run(write.routerId, write.pinKey, write.model, write.reasoningEffort, now.getTime());
+      this.db.query("DELETE FROM routing_session_pins WHERE updated_at < ?").run(now.getTime() - RETENTION_MS);
+    })();
+  }
+}

package/src/strategies/priority_selector.ts

@@ -7,8 +7,7 @@ const PRIORITY_CONTEXT_WINDOW_CHARS = 1_000_000;
 
 /**
  * Serve the router's first eligible model/thinking-level pair, in the order
- * the router lists them. Provider failures still fall back to the next pair
- * when the router enables model fallback.
+ * the router lists them.
  */
 export function createPrioritySelectorBackend(): SelectorBackend {
   return {

package/src/strategies/route_decision.ts

@@ -15,7 +15,6 @@ import type { ResolvedRouter } from "../types.js";
 
 export type RoutedDecision = {
   decision: RoutingDecision;
-  fallbackDecision?: RoutingDecision;
   run?: SelectorRun;
   details?: Record<string, unknown>;
 };
@@ -81,9 +80,6 @@ export async function routeDecision(
       ? { customRules: custom.rules, defaultTarget: custom.defaultTarget }
       : {}),
     selectorBackend: args.selectorBackend,
-    modelFallbackEnabled: credentials.model_fallback_enabled !== false,
-    fallbackRequiresDifferentProvider:
-      credentials.fallback_requires_different_provider !== false,
     executionProviderForModel: (model) =>
       executionProviderForModel(credentials, model),
     imputeEvalScores: credentials.eval_score_imputation === true,
@@ -99,7 +95,6 @@ export async function routeDecision(
   };
   return {
     decision: run.decision,
-    fallbackDecision: run.fallbackDecision,
     run,
     ...(Object.keys(details).length > 0 ? { details } : {}),
   };

package/src/strategies/routing.ts

@@ -34,7 +34,6 @@ import type {
   ProviderAuth,
   ResolvedRouter,
 } from "../types.js";
-import { deriveFallbackDecision } from "./fallback_decision.js";
 import type { SelectorImage } from "./selector_projection.js";
 
 export function resolveRouter(args: ResolveRouterRequest): Promise<ResolvedRouter> {
@@ -54,7 +53,6 @@ export type SelectorTrace = {
 
 export type SelectorRun = SelectorTrace & {
   decision: RoutingDecision;
-  fallbackDecision?: RoutingDecision;
 };
 
 export type SelectModelArgs = {
@@ -70,8 +68,6 @@ export type SelectModelArgs = {
   customRules?: CustomRouterRule[];
   defaultTarget?: CustomDefaultTarget | null;
   sessionId?: string;
-  modelFallbackEnabled?: boolean;
-  fallbackRequiresDifferentProvider?: boolean;
   executionProviderForModel?: (model: string) => string;
   imputeEvalScores?: boolean;
   imputationReferenceEvals?: RouterEval[];
@@ -171,8 +167,6 @@ export async function selectModel(
     contextWindowChars,
     messages: selectorBackend.prepareMessages?.(safeMessages) ?? safeMessages,
     ...(leaseContextEnabled ? { leaseHistory: args.leaseHistory ?? [] } : {}),
-    modelFallbackEnabled: args.modelFallbackEnabled,
-    fallbackRequiresDifferentProvider: args.fallbackRequiresDifferentProvider,
     imputeEvalScores: args.imputeEvalScores,
     imputationReferenceEvals: args.imputationReferenceEvals,
   });
@@ -285,17 +279,7 @@ function validateSelectorRun(run: SelectorRun, args: SelectModelArgs): SelectorR
       run,
     );
   }
-  const { fallbackDecision: _selectorFallback, ...primaryRun } = run;
-  const fallbackDecision = deriveFallbackDecision({
-    candidates: args.candidates,
-    selected,
-    enabled: args.modelFallbackEnabled,
-    requiresDifferentProvider: args.fallbackRequiresDifferentProvider,
-    providerForModel: args.executionProviderForModel,
-  });
-  return fallbackDecision
-    ? { ...primaryRun, fallbackDecision }
-    : primaryRun;
+  return run;
 }
 
 function requiredSelectorConfig(value: string, label: string): string {

package/src/telemetry/billing_finalization.ts

@@ -14,7 +14,9 @@ export type RoutingBillingProviderAttemptFacts = {
   provider: string;
   model: string;
   provider_key_source: ProviderKeySource;
-  role: "primary" | "fallback";
+  // The control-plane billing contract numbers attempts within a role; every
+  // attempt retries the routed choice, so the role is always primary.
+  role: "primary";
   attempt: number;
   outcome: "completed" | "provider_failed" | "customer_canceled";
   provider_request_id: string | null;
@@ -94,7 +96,6 @@ export function routingBillingProviderAttemptFacts(args: {
   provider: string;
   model: string;
   providerKeySource: ProviderKeySource;
-  role: "primary" | "fallback";
   attempt: number;
   outcome: "completed" | "provider_failed" | "customer_canceled";
   providerMessage: Record<string, unknown> | null;
@@ -129,7 +130,7 @@ export function routingBillingProviderAttemptFacts(args: {
     provider: args.provider,
     model: args.model,
     provider_key_source: args.providerKeySource,
-    role: args.role,
+    role: "primary",
     attempt: args.attempt,
     outcome: args.outcome,
     provider_request_id: providerRequestId(args.providerMessage),

package/src/telemetry/prefix_state.ts

@@ -80,15 +80,10 @@ export function buildCompletedPrefixHit(args: {
 export function leaseCountdownForPrefix(args: {
   served: RoutingDecision | null;
   next: RoutingDecision | null;
-  // True when a completed fallback attempt served this turn. A lease-aware
-  // fallback carries the remaining countdown on the serving decision; an
-  // ordinary fallback has no countdown and ends any primary commitment.
-  fallbackServed?: boolean;
 }): number | null {
-  const granted = args.fallbackServed === true ? args.served : args.next ?? args.served;
+  const granted = args.next ?? args.served;
   const remaining = granted?.leaseTurnsRemaining;
   if (remaining === undefined || remaining === null) return null;
-  if (args.fallbackServed === true) return remaining;
   const servedGrantedPair =
     args.next === null ||
     (args.served !== null &&