@qadanm/opencode-smart-router 0.4.0 → 0.6.1

package/src/server/controller.ts

@@ -20,7 +20,12 @@ import { repairMessages } from "../core/reprompt.js"
 import { providerProtocol } from "../core/models/protocol.js"
 import { PromptRouteTracker } from "./route-tracker.js"
 import { buildProviderUsageReport } from "../core/quota/report.js"
-import { resolvePlan, resolvePlanWithReason } from "../core/plans/catalog.js"
+import {
+  OPENDESIGN_DESIGN_PLAN_MODELS,
+  OPENDESIGN_PLAN_MODEL_POOL,
+  resolvePlan,
+  resolvePlanWithReason,
+} from "../core/plans/catalog.js"
 import { loadSettings, validateSettings, type SettingsLoadResult } from "../core/config.js"
 import { writeSettingsPatch } from "../core/config-writer.js"
 import { describeConsoleReading, parseConsolePage, type UsageReading } from "../core/plan-page.js"
@@ -51,12 +56,10 @@ import { decidePremium, evaluateEligibility } from "../core/policy/eligibility.j
 import { sharedCore, type RuntimeOverrides } from "./shared-core.js"
 import {
   ChangeNotifier,
-  buildIndicatorTitle,
   formatQuotaLines,
   indicatorState,
   providerShort,
   quotaStateLabel,
-  resolveBaseTitle,
   stripTitlePrefix,
   type Indicator,
 } from "../core/ui.js"
@@ -80,6 +83,7 @@ import {
   unique,
   usd,
 } from "../core/util.js"
+import { containHook, withDeadline } from "./containment.js"
 
 interface ControllerOptions {
   readonly ctx: any
@@ -172,7 +176,6 @@ const applyRuntime = (base: RouterSettings, runtime: RuntimeOverrides): RouterSe
   if (runtime.mode) next.mode = runtime.mode
   if (runtime.paused === true) next.enabled = false
   if (typeof runtime.dryRun === "boolean") next.dryRun = runtime.dryRun
-  if (typeof runtime.titleIndicator === "boolean") next.ui.titleIndicator = runtime.titleIndicator
   if (typeof runtime.compactMode === "boolean") {
     next.ui.compactMode = runtime.compactMode
     next.ui.compact = runtime.compactMode
@@ -379,6 +382,8 @@ export class RouterController {
   }
 
   private modelList: unknown = []
+  /** Shared in-flight discovery; see ensureModelsLoaded(). */
+  private modelLoadPromise?: Promise<void>
 
   async initialize(): Promise<() => void | Promise<void>> {
     // Before anything reads settings: a provider the user never configured
@@ -937,7 +942,7 @@ export class RouterController {
       state,
       ...(ref ? { provider: providerShort(ref.providerID), model: ref.id } : {}),
       ...(model ? { modelLabel: model.name } : ref ? { modelLabel: ref.id } : {}),
-      ...(session?.indicatorTitle ? { title: session.indicatorTitle } : {}),
+
     }
   }
 
@@ -954,6 +959,19 @@ export class RouterController {
     return next
   }
 
+  /**
+   * The router never renames a session.
+   *
+   * A chat title is the owner's name for the work, and a plugin that rewrites it
+   * to advertise which model it picked trades the owner's memory for the
+   * plugin's status line. Status lives in the panel, the terminal footer and the
+   * decision record instead.
+   *
+   * One exception remains, and it only runs against titles this plugin wrote in
+   * an older version: a single pass that strips the prefix when the session is
+   * next touched, so upgrades heal instead of leaving `AUTO · OD · model`
+   * forever.
+   */
   private async applyTitleNow(sessionID: string) {
     const session = this.ledger.getSession(sessionID)
     if (!session) return
@@ -966,7 +984,7 @@ export class RouterController {
     if (!this.projectMatches(info?.projectID, info?.location?.directory)) return
     const currentTitle = typeof info?.title === "string" ? info.title : undefined
 
-    if (!this.settings.ui.titleIndicator) {
+    {
       /**
        * The indicator is off. If a previous version of this plugin left its
        * prefix on the title, put the name back once, the first time the session
@@ -986,67 +1004,27 @@ export class RouterController {
       return
     }
 
-    const modelRef = session.pinnedModel ?? session.manualModel ?? session.lastModel
-    if (!modelRef) return
-
-    // Adopt a name the router did not write. Never fall back to `session.title`:
-    // that value is the router's own previous output, so reading it back is how
-    // the prefix used to become the name permanently.
-    const baseTitle = resolveBaseTitle({
-      currentTitle,
-      lastWrittenTitle: session.indicatorTitle,
-      storedBase: session.baseTitle,
-    })
-    // Nothing worth annotating. Leave the user's title exactly as it is.
-    if (!baseTitle) return
-
-    const model = this.registry.get(modelRef.providerID, modelRef.id)
-    const indicator = this.indicatorFor(sessionID, { ...session, baseTitle })
-    const nextTitle = buildIndicatorTitle({
-      state: indicator.state,
-      provider: modelRef.providerID,
-      modelLabel: model?.name ?? modelRef.id,
-      baseTitle,
-      compact: this.settings.ui.compactMode || this.settings.ui.compact || this.settings.compactMode || this.settings.compact,
-    })
-    if (currentTitle === nextTitle && session.indicatorTitle === nextTitle) return
-    session.baseTitle = baseTitle
-    session.indicatorTitle = nextTitle
-    session.title = nextTitle
-    this.ledger.patchSession(sessionID, {
-      baseTitle,
-      indicatorTitle: nextTitle,
-      title: nextTitle,
-    })
-    try {
-      await this.ctx.session.update({ sessionID, title: nextTitle })
-    } catch (error) {
-      this.settingsWarnings.push(`Could not update the session title indicator: ${safeError(error)}`)
-    }
-  }
-
-  private async refreshKnownTitles() {
-    const ids = Object.values(this.ledger.data.sessions)
-      .filter((session) => this.ownsSession(session))
-      .map((session) => session.sessionID)
-    await Promise.allSettled(ids.map((sessionID) => this.queueTitle(sessionID)))
   }
 
-  private async restoreTitles() {
+  /** Strips prefixes this plugin wrote. Returns how many titles changed. */
+  private async restoreTitles(): Promise<number> {
+    let restored = 0
     for (const session of Object.values(this.ledger.data.sessions)) {
       if (!this.ownsSession(session)) continue
-      const base = session.baseTitle || stripTitlePrefix(session.title)
-      if (!base) continue
+      const visible = session.title ?? session.indicatorTitle
+      const base = session.baseTitle || stripTitlePrefix(visible)
+      // A title that is only a prefix has no name left to restore. Rewriting it
+      // to the prefix again would keep the damage; leave it for the owner.
+      if (!base || base === visible) continue
       try {
         await this.ctx.session.update({ sessionID: session.sessionID, title: base })
-        this.ledger.patchSession(session.sessionID, {
-          title: base,
-          indicatorTitle: undefined,
-        })
+        this.ledger.patchSession(session.sessionID, { title: base, indicatorTitle: undefined })
+        restored += 1
       } catch (error) {
         this.settingsWarnings.push(`Could not restore session title: ${safeError(error)}`)
       }
     }
+    return restored
   }
 
   private async notifyChange(key: string, message: string) {
@@ -1084,18 +1062,54 @@ export class RouterController {
     return out
   }
 
-  private premiumState(session?: SessionState): PremiumState {    const spent = this.ledger.premiumSpent()
+  private premiumState(session?: SessionState): PremiumState {
+    // Reading budget state must never be able to fail a prompt or a status
+    // request. Every value here degrades to a conservative default, and a
+    // ledger that cannot answer is reported as unknown rather than thrown.
+    const read = <T>(fn: () => T, fallback: T): T => {
+      try {
+        const value = fn()
+        return value === undefined || value === null ? fallback : value
+      } catch {
+        return fallback
+      }
+    }
+    const spent = read(() => this.ledger.premiumSpent(), 0)
     const budget = this.settings.premium.monthlyBudgetUsd
+    // The plan-model pool is the escalation budget of record. Its cap comes
+    // from the resolved plan catalog, not from premium.monthlyBudgetUsd, so
+    // the gate tracks the allowance the account actually has.
+    const planPoolMonthlyUsd = this.planPoolMonthlyUsd()
+    const planPoolSpent = read(
+      () => (typeof this.ledger.planPoolSpent === "function" ? this.ledger.planPoolSpent() : undefined),
+      undefined as number | undefined,
+    )
     return {
       mode: this.settings.premium.mode,
       monthlyBudgetUsd: budget,
       spentUsd: spent,
       remainingUsd: Math.max(0, budget - spent),
+      ...(planPoolMonthlyUsd !== undefined && planPoolSpent !== undefined
+        ? { planPoolRemainingUsd: Math.max(0, planPoolMonthlyUsd - planPoolSpent) }
+        : {}),
       oneShotGranted: session?.premiumOneShot === true,
       ...(session?.premiumOneShotAt ? { oneShotGrantedAt: session.premiumOneShotAt } : {}),
     }
   }
 
+  /**
+   * The monthly cap of the OpenDesign plan-model pool for the configured plan,
+   * when the model pool is the one escalation draws from. Undefined for any
+   * other configuration, which leaves the gate on the legacy premium budget.
+   */
+  private planPoolMonthlyUsd(): number | undefined {
+    const provider = this.settings.providers.opendesign
+    if (!provider?.enabled) return undefined
+    const plan = resolvePlan("opendesign", provider.plan)
+    if (!plan) return undefined
+    return plan.pools.find((pool) => pool.id === OPENDESIGN_PLAN_MODEL_POOL)?.monthlyUsd
+  }
+
   private quotaSnapshots() {
     return this.quota
       ? this.quota.read().map((snapshot) => {
@@ -1262,20 +1276,9 @@ export class RouterController {
     const ref = session.lastModel
     const model = ref ? this.registry.get(ref.providerID, ref.id) : undefined
     const label = model?.name ?? ref?.id ?? "current model"
-    const blockedTitle = buildIndicatorTitle({
-      state: "BLOCKED",
-      provider: ref?.providerID,
-      modelLabel: label,
-      baseTitle: session.baseTitle || session.title,
-    })
-    session.indicatorTitle = blockedTitle
-    session.title = blockedTitle
-    this.ledger.patchSession(sessionID, { indicatorTitle: blockedTitle, title: blockedTitle })
-    try {
-      await this.ctx.session.update({ sessionID, title: blockedTitle })
-    } catch {
-      // The decision still carries the reason.
-    }
+    // Blocking a prompt must not rename the owner's chat. The refusal lives in
+    // the decision record, the panel and the notice.
+    this.settingsWarnings.push(`Blocked a prompt: ${reason}`)
     void this.notifyChange(`${sessionID}:blocked:${reason}`, `BLOCKED · ${label} — ${reason}`)
   }
 
@@ -1347,6 +1350,7 @@ export class RouterController {
     void this.ensureContextTokens(sessionID)
 
     if (runtime !== "automatic") {
+      const models = await this.routingModels()
       const task = classifyTask({
         text,
         files: this.classifierFiles(files),
@@ -1358,8 +1362,8 @@ export class RouterController {
         settings,
         mode: settings.mode,
         runtime,
-        models: this.routingModels(),
-        intelligenceFloor: this.routingFloor(this.routingModels()).floor,
+        models: models,
+        intelligenceFloor: this.routingFloor(models).floor,
         current: session.lastModel,
         session,
         quota: this.quotaSnapshots(),
@@ -1374,6 +1378,7 @@ export class RouterController {
       return result.decision
     }
 
+    const models = await this.routingModels()
     const task = classifyTask({
       text,
       files: this.classifierFiles(files),
@@ -1390,8 +1395,8 @@ export class RouterController {
       settings,
       mode: effectiveMode,
       runtime,
-      models: this.routingModels(),
-      intelligenceFloor: this.routingFloor(this.routingModels()).floor,
+      models: models,
+      intelligenceFloor: this.routingFloor(models).floor,
       current: session.lastModel,
       session,
       quota,
@@ -1556,45 +1561,81 @@ export class RouterController {
     return finalDecision
   }
 
+  /**
+   * How long routing may hold a prompt before the prompt is served without it.
+   *
+   * The number is a ceiling on waiting, not a performance target. Routing that
+   * has not finished in this long is not going to improve the request in front
+   * of the owner, and every extra second is a second the editor appears frozen.
+   */
+  private routeBudgetMs(): number {
+    const configured = Number((this.settings as any)?.routing?.routeBudgetMs)
+    if (Number.isFinite(configured) && configured > 0) return Math.min(configured, 60_000)
+    return 10_000
+  }
+
   private async registerHooks() {
     this.registrations.push(
-      await this.ctx.session.hook("prompt", async (event: any) => {
-        const sessionID = event.sessionID
-        if (!sessionID) return
-        try {
-          const probe: any = await this.ctx.session.get({ sessionID })
-          if (!this.projectMatches(probe?.projectID, probe?.location?.directory)) return
-        } catch {
-          // If the location probe fails, the location-scoped hook can still run.
-        }
-        sharedCore.claimSession(sessionID, this.bridgeID)
-        this.remember(this.promptSeen, sessionID)
-        this.pendingHeals.delete(sessionID)
-        if (this.inflight.has(sessionID)) return
-        this.inflight.add(sessionID)
-        try {
-          const decision = await this.routePrompt(sessionID, event.prompt?.text ?? "", event.prompt?.files)
-          if (decision) {
-            // Available to the retry hook, which has no prompt linkage of its
-            // own: a deterministic rejection re-routes this same task.
-            this.promptRoutes.set(sessionID, {
-              messageID: typeof event.messageID === "string" ? event.messageID : undefined,
-              task: decision.task,
-              decision,
-              at: Date.now(),
+      await this.ctx.session.hook("prompt", containHook(
+        async (event: any) => {
+          const sessionID = event.sessionID
+          if (!sessionID) return
+          try {
+            const probe: any = await this.ctx.session.get({ sessionID })
+            if (!this.projectMatches(probe?.projectID, probe?.location?.directory)) return
+          } catch {
+            // If the location probe fails, the location-scoped hook can still run.
+          }
+          sharedCore.claimSession(sessionID, this.bridgeID)
+          this.remember(this.promptSeen, sessionID)
+          this.pendingHeals.delete(sessionID)
+          if (this.inflight.has(sessionID)) return
+          this.inflight.add(sessionID)
+          try {
+            // Routing runs against a deadline. If it cannot finish, the prompt
+            // proceeds unrouted: an optimization that cannot finish is worth
+            // nothing unless it gets out of the way.
+            const decision = await withDeadline({
+              work: () => this.routePrompt(sessionID, event.prompt?.text ?? "", event.prompt?.files),
+              ms: this.routeBudgetMs(),
+              onTimeout: () => {
+                this.settingsWarnings.push(
+                  `Routing did not finish within ${this.routeBudgetMs()}ms; the prompt was served without a route.`,
+                )
+              },
             })
+            if (decision) {
+              // Available to the retry hook, which has no prompt linkage of its
+              // own: a deterministic rejection re-routes this same task.
+              this.promptRoutes.set(sessionID, {
+                messageID: typeof event.messageID === "string" ? event.messageID : undefined,
+                task: decision.task,
+                decision,
+                at: Date.now(),
+              })
+            }
+          } catch (error) {
+            if (error instanceof RouterBlockedError || (error as any)?.name === "RouterBlockedError") throw error
+            await this.handleRoutingFailure(sessionID, event.prompt?.text ?? "", event.prompt?.files, error)
+          } finally {
+            this.inflight.delete(sessionID)
           }
-        } catch (error) {
-          if (error instanceof RouterBlockedError || (error as any)?.name === "RouterBlockedError") throw error
-          await this.handleRoutingFailure(sessionID, event.prompt?.text ?? "", event.prompt?.files, error)
-        } finally {
-          this.inflight.delete(sessionID)
-        }
-      }),
+        },
+        {
+          label: "prompt routing",
+          allowBlocked: true,
+          onContained: (message) => {
+            // A defect inside the router is reported, never escalated to a
+            // refused prompt. The host keeps working; the owner can see why
+            // routing was skipped.
+            this.settingsWarnings.push(`Routing skipped: ${message}`)
+          },
+        },
+      )),
     )
 
     this.registrations.push(
-      await this.ctx.session.hook("model.request", (event: any) => {
+      await this.ctx.session.hook("model.request", containHook((event: any) => {
         if (sharedCore.ownerOf(event.sessionID) !== this.bridgeID) return
         // Latch the request kind so the context hook (whose event carries no
         // kind) can tell the agent loop apart from title and compaction runs.
@@ -1617,7 +1658,10 @@ export class RouterController {
         if (this.settings.privacy.requireZdr && event.model?.providerID === "commandcode") {
           event.headers["x-cmd-zdr"] = "1"
         }
-      }),
+      }, {
+        label: "request bookkeeping",
+        onContained: (message) => this.settingsWarnings.push(`Request bookkeeping skipped: ${message}`),
+      })),
     )
 
     // The host emits `model.request` for every model call with the request's
@@ -1650,7 +1694,7 @@ export class RouterController {
     )
 
     this.registrations.push(
-      await this.ctx.session.hook("retry", async (event: any) => {
+      await this.ctx.session.hook("retry", containHook(async (event: any) => {
         if (sharedCore.ownerOf(event.sessionID) !== this.bridgeID) return
         const session = this.ledger.getSession(event.sessionID)
         const assessment = classifyFailure(
@@ -1751,7 +1795,12 @@ export class RouterController {
         } else if (assessment.class === "provider_outage" || assessment.class === "network") {
           if (event.attempt >= 3) event.decision = { retry: false }
         }
-      }),
+      }, {
+        label: "retry handling",
+        // A contained retry failure leaves the host's own policy in place,
+        // which is a working default rather than a blocked turn.
+        onContained: (message) => this.settingsWarnings.push(`Retry handling skipped: ${message}`),
+      })),
     )
   }
 
@@ -1862,13 +1911,14 @@ export class RouterController {
     }
 
     const session = this.sessionState(sessionID)
+    const models = await this.routingModels()
     const result = routeTask({
       task: route.task,
       settings: this.settings,
       mode: session.parentID && this.settings.mode === "premium" ? "balanced" : this.settings.mode,
       runtime: "automatic",
-      models: this.routingModels(),
-      intelligenceFloor: this.routingFloor(this.routingModels()).floor,
+      models: models,
+      intelligenceFloor: this.routingFloor(models).floor,
       current: rejected,
       session,
       quota: this.quotaSnapshots(),
@@ -2042,10 +2092,31 @@ export class RouterController {
   }
 
   private async modelResolvable(providerID: string, modelID: string): Promise<boolean> {
-    // The host is the authority, but it is not always reachable. A MISSING API is not
-    // a "no": it means this host cannot answer the question, so fall back to the
-    // previous behaviour of attempting the switch and surfacing whatever happens.
-    // Only an API that answers and returns nothing is treated as a real refusal.
+    // The host is the authority on which models it can serve, and there are two
+    // ways to ask it. Use both, cheapest and most authoritative first.
+    //
+    // 1. The model list this plugin already fetched. It is the closest thing to
+    //    "what this machine can actually serve", but it is not exhaustive: a
+    //    provider read from a gateway (OpenDesign) is merged in separately, and
+    //    a provider that is not configured yet is absent rather than empty. So
+    //    the refusal is scoped to the case that is genuinely knowable: the host
+    //    lists this provider, and does not list this model. That is the state
+    //    that produced "Model unavailable: opencode-go/claude-haiku-5-5" on a
+    //    fresh install (scripts/isolated-e2e.sh, 2026-11-06).
+    const known = unwrap<any>(this.modelList ?? [])
+    if (Array.isArray(known) && known.length > 0) {
+      const providerIsKnown = known.some((entry: any) => entry?.providerID === providerID)
+      if (providerIsKnown) {
+        const modelIsKnown = known.some(
+          (entry: any) => entry?.providerID === providerID && entry?.id === modelID,
+        )
+        if (!modelIsKnown) return false
+      }
+    }
+    // 2. Ask the host directly. A MISSING API is not a "no": it means this host
+    //    cannot answer the question, so fall back to attempting the switch and
+    //    surfacing whatever happens. Only an API that answers and returns
+    //    nothing is treated as a real refusal.
     const get = this.ctx?.model?.get
     if (typeof get !== "function") return true
     try {
@@ -2063,10 +2134,59 @@ export class RouterController {
    * engine applies its own allow-list on top, so this is a convenience rather
    * than the security boundary; the boundary is in `routeTask` and stays there
    * even if a future caller passes the wrong list.
+   *
+   * MODELS THE HOST CANNOT SERVE ARE NOT CANDIDATES.
+   *
+   * The seed catalog describes providers in general; it does not know which of
+   * them are configured on this machine. Offering the whole catalog meant the
+   * router could choose a model OpenCode had never heard of and switch the
+   * session onto it, after which the next step died with "Model unavailable".
+   * Verified on a fresh install in scripts/isolated-e2e.sh (2026-11-06): the
+   * host exposed only its own default model, and routing reached for
+   * `opencode-go/claude-haiku-5-5`.
+   *
+   * The live list is authoritative once it has been read: it is OpenCode's own
+   * catalog plus the OpenDesign gateway's entitled models. Until it has been
+   * read it is empty, and an empty list must not filter anything out, or the
+   * router would have no candidates during startup.
    */
-  private routingModels() {
+  private async routingModels(): Promise<ModelRecord[]> {
     if (this.settings.offline?.enabled) return this.registry.modelsForOffline()
-    return this.registry.approved()
+    const approved = this.registry.approved()
+    // WAIT FOR THE HOST'S MODEL LIST ON THE FIRST ROUTING DECISION.
+    //
+    // Discovery starts in the background during initialize(), so the first
+    // prompt after startup used to route against an empty list -- the exact
+    // window in which the router could pick a seed model this machine cannot
+    // serve. Awaiting it is bounded by the routing deadline, and a discovery
+    // that fails leaves the list empty, which falls back to the old behaviour.
+    await this.ensureModelsLoaded()
+    const live = unwrap<any>(this.modelList ?? [])
+    if (!Array.isArray(live) || live.length === 0) return approved
+    const servable = new Set(live.map((entry: any) => modelKey(entry?.providerID ?? "", entry?.id ?? "")))
+    // No fallback to the unfiltered list. Returning the full catalog when the
+    // intersection is empty is how an unservable model gets chosen anyway: on a
+    // machine whose providers do not match the seed catalog, filtering produced
+    // an empty list, the fallback reinstated every seed model, and the router
+    // switched onto `opencode-go/claude-haiku-5-5` -- a model the host had never
+    // heard of. Verified in scripts/isolated-e2e.sh on 2026-11-06.
+    //
+    // An empty list is the correct answer there. It means "this plugin has
+    // nothing it may usefully route to on this machine", and the router then
+    // leaves the session alone, which is what the host would have done had the
+    // plugin not been installed.
+    return approved.filter((model) => servable.has(model.key))
+  }
+
+  /** One in-flight model discovery shared by every caller. */
+  private async ensureModelsLoaded(): Promise<void> {
+    if (unwrap<any>(this.modelList ?? []).length > 0) return
+    if (!this.modelLoadPromise) {
+      this.modelLoadPromise = this.loadModels().finally(() => {
+        this.modelLoadPromise = undefined
+      })
+    }
+    await this.modelLoadPromise
   }
 
   /**
@@ -2468,6 +2588,13 @@ export class RouterController {
       const tokens = tokensFrom(data.tokens)
       const latency = this.stepStarted.get(sessionID) ? Date.now() - (this.stepStarted.get(sessionID) ?? Date.now()) : undefined
       if (model) {
+        // Plan-model-pool identity is resolved from the model id, so every
+        // recorded step attributes its spend to the right allowance: plan
+        // models draw the $120 escalation pool; Design Plan models and every
+        // other provider's models draw their own.
+        const modelRecord = this.registry.get(model.providerID, model.id)
+        const isOpendesignPlanPool =
+          model.providerID === "opendesign" && modelRecord !== undefined && !OPENDESIGN_DESIGN_PLAN_MODELS.has(model.id)
         this.ledger.recordUsage({
           sessionID,
           model,
@@ -2475,7 +2602,8 @@ export class RouterController {
           tokens,
           at: typeof event.created === "number" ? event.created : Date.now(),
           latencyMs: latency,
-          premium: this.registry.get(model.providerID, model.id)?.premium ?? false,
+          premium: modelRecord?.premium ?? false,
+          planPool: isOpendesignPlanPool,
         })
         // A completed step is proof the provider's pre-request path worked,
         // so any run of provider-scoped failures starts over.
@@ -2555,7 +2683,6 @@ export class RouterController {
       setPaused: async (input: any) => {
         this.runtime.paused = Boolean(input.paused)
         this.persistRuntime()
-        void this.refreshKnownTitles()
         void this.notifyChange(
           `global:paused:${Boolean(input.paused)}`,
           input.paused ? "PAUSED · automatic routing is paused" : "AUTO · automatic routing resumed",
@@ -2590,7 +2717,6 @@ export class RouterController {
       setDryRun: async (input: any) => {
         this.runtime.dryRun = Boolean(input.dryRun)
         this.persistRuntime()
-        void this.refreshKnownTitles()
         void this.notifyChange(
           `global:dry-run:${Boolean(input.dryRun)}`,
           input.dryRun ? "DRY RUN · decisions will be explained, not applied" : "AUTO · routing will apply decisions",
@@ -2764,10 +2890,10 @@ export class RouterController {
         return summary
       },
       setTitleIndicator: async (input: any) => {
-        this.runtime.titleIndicator = Boolean(input.enabled)
-        this.persistRuntime()
-        if (input.enabled) await this.refreshKnownTitles()
-        else await this.restoreTitles()
+        // The router no longer renames sessions. `enabled: true` is accepted for
+        // old callers and ignored; `enabled: false` runs the one-time cleanup of
+        // titles written by earlier versions.
+        if (input?.enabled !== true) await this.restoreTitles()
         const summary = this.statusFor()
         void this.emit("status", { summary })
         return summary
@@ -2885,7 +3011,6 @@ export class RouterController {
       await command("router-pause", "Pause automatic routing globally", async ({ sessionID }: any) => {
         this.runtime.paused = true
         this.persistRuntime()
-        void this.refreshKnownTitles()
         void this.notifyChange("global:paused:true", "PAUSED · automatic routing is paused")
         await notice(sessionID, "PAUSED · automatic routing is paused.")
       }),
@@ -2895,7 +3020,6 @@ export class RouterController {
       await command("router-resume", "Resume automatic routing globally", async ({ sessionID }: any) => {
         this.runtime.paused = false
         this.persistRuntime()
-        void this.refreshKnownTitles()
         void this.notifyChange("global:paused:false", "AUTO · automatic routing resumed")
         await notice(sessionID, "AUTO · automatic routing resumed.")
       }),
@@ -2922,7 +3046,6 @@ export class RouterController {
         }
         this.runtime.dryRun = value === "on"
         this.persistRuntime()
-        void this.refreshKnownTitles()
         void this.notifyChange(
           `global:dry-run:${value === "on"}`,
           value === "on" ? "DRY RUN · decisions will be explained, not applied" : "AUTO · routing will apply decisions",
@@ -2932,17 +3055,18 @@ export class RouterController {
     )
 
     this.registrations.push(
-      await command("router-title", "Turn the persistent session-title indicator on or off: /router-title on|off", async ({ sessionID, prompt }: any) => {
+      await command("router-title", "Strip router-written prefixes from existing session titles: /router-title off", async ({ sessionID, prompt }: any) => {
         const value = String(prompt?.text ?? "").trim().split(/\s+/).pop()
-        if (value !== "on" && value !== "off") {
-          await notice(sessionID, "Usage: /router-title on|off")
+        if (value === "on") {
+          await notice(sessionID, "The router no longer renames sessions. Titles stay yours; status lives in the panel and the header.")
           return
         }
-        this.runtime.titleIndicator = value === "on"
-        this.persistRuntime()
-        if (value === "on") await this.refreshKnownTitles()
-        else await this.restoreTitles()
-        await notice(sessionID, value === "on" ? "Session-title indicator enabled." : "Session-title indicator disabled; base titles restored.")
+        if (value !== "off") {
+          await notice(sessionID, "Usage: /router-title off (strips prefixes this plugin wrote in older versions)")
+          return
+        }
+        const restored = await this.restoreTitles()
+        await notice(sessionID, `Cleaned ${restored} session title${restored === 1 ? "" : "s"}. Titles written before the separator was lost cannot be recovered.`)
       }),
     )