auto-model-router 0.1.0

package/src/router/classify.ts

@@ -0,0 +1,329 @@
+/**
+ * Complexity classification: a weighted heuristic over Features, with an
+ * optional LLM adjudicator for turns the heuristic cannot call confidently.
+ */
+
+import type { CatalogSource } from "../catalog/types.ts";
+import type { QualityAxis, RouterConfig } from "../config/types.ts";
+import { forecast } from "../cost/forecast.ts";
+import type { Ledger } from "../cost/types.ts";
+import { estimateTokens } from "../tokens/estimate.ts";
+import type { UpstreamClient } from "../upstream/types.ts";
+import { sha256Hex } from "../util/hash.ts";
+import type { NormRequest, ReasoningLevel } from "../wire/types.ts";
+import type { Classification, Features, TaskType, Tier } from "./types.ts";
+
+/**
+ * Heuristic scorer: a weighted linear sum over Features, clamped to 0-1 and
+ * bucketed into tiers. The weights encode two economic facts:
+ *
+ *  - A tool-result continuation is the cheapest kind of turn in agent traffic
+ *    (read tool output, take the next mechanical step) and the largest cost
+ *    lever, so it carries the dominant NEGATIVE weight.
+ *  - Failure signals cost money twice: a cheap model that flounders gets
+ *    escalated and the turn is paid for twice. So a failed tool result, a
+ *    repeated tool call, complexity keywords, and an explicit reasoning
+ *    request carry the dominant POSITIVE weights.
+ */
+const BASE = 0.3;
+const W_TOOL_CONTINUATION = -0.28; // dominant negative
+const W_COMPLEXITY_KEYWORD = 0.1;
+const CAP_COMPLEXITY = 0.3;
+const W_TRIVIALITY_KEYWORD = -0.09;
+const CAP_TRIVIALITY = -0.27;
+const W_TOOL_FAILED = 0.26; // dominant positive: retry loops are expensive
+const W_REPEATED_CALL = 0.14; // the model is stuck
+const W_TERSE = -0.1;
+const W_CODE_BLOCK = 0.04;
+const CAP_CODE = 0.08;
+const W_DIFF = 0.05;
+const W_QUESTION = 0.03;
+const CAP_QUESTION = 0.06;
+const W_LARGE_CONTENT = 0.05;
+const W_HUGE_CONTENT = 0.1;
+const W_TURN_DEPTH = 0.004; // long conversations accumulate entangled context
+const CAP_TURN_DEPTH = 0.08;
+const W_LOOP_DEPTH = -0.008; // deep loops are mechanical
+const CAP_LOOP_DEPTH = -0.06;
+const W_AUTONOMOUS_LOOP = 0.06; // but a loop this long implies a substantial underlying task
+const W_IMAGES = 0.04;
+const W_TOOLS_OFFERED = 0.03;
+
+/** Score bucket boundaries: [trivial, simple, moderate, hard]. */
+const BOUNDARIES: readonly [number, number, number] = [0.25, 0.5, 0.75];
+
+/** A client that asks for reasoning is stating expected difficulty directly. */
+function reasoningWeight(level: ReasoningLevel | undefined): number {
+	switch (level) {
+		case "medium":
+			return 0.14;
+		case "high":
+			return 0.24;
+		case "xhigh":
+			return 0.3;
+		case "max":
+			return 0.34;
+		default:
+			// off/minimal/low/undefined: no stated difficulty above the baseline.
+			return 0;
+	}
+}
+
+export function scoreHeuristic(f: Features, cfg: RouterConfig): Classification {
+	const reasons: string[] = [];
+	let score = BASE;
+	const add = (delta: number, why: string): void => {
+		if (delta === 0) return;
+		score += delta;
+		reasons.push(`${delta > 0 ? "+" : ""}${delta.toFixed(2)} ${why}`);
+	};
+
+	if (f.isToolResultContinuation) add(W_TOOL_CONTINUATION, "tool-result continuation (mechanical next step)");
+	add(
+		Math.min(f.complexityKeywords.length * W_COMPLEXITY_KEYWORD, CAP_COMPLEXITY),
+		`complexity keywords [${f.complexityKeywords.join(", ")}]`,
+	);
+	add(
+		Math.max(f.trivialityKeywords.length * W_TRIVIALITY_KEYWORD, CAP_TRIVIALITY),
+		`triviality keywords [${f.trivialityKeywords.join(", ")}]`,
+	);
+	if (f.lastToolFailed) add(W_TOOL_FAILED, "last tool result failed");
+	if (f.repeatedToolCall) add(W_REPEATED_CALL, "repeated tool call (model is stuck)");
+	const rw = reasoningWeight(f.requestedReasoning);
+	if (rw > 0) add(rw, `client requested reasoning=${f.requestedReasoning ?? ""}`);
+	if (f.isTerseInstruction) add(W_TERSE, "terse instruction");
+	add(Math.min(f.codeBlocks * W_CODE_BLOCK, CAP_CODE), `${f.codeBlocks} code block(s) in new content`);
+	if (f.looksLikeDiff) add(W_DIFF, "diff in new content");
+	add(Math.min(f.questionCount * W_QUESTION, CAP_QUESTION), `${f.questionCount} question(s)`);
+	if (f.newContentTokens > 8000) add(W_HUGE_CONTENT, "very large new content");
+	else if (f.newContentTokens > 2000) add(W_LARGE_CONTENT, "large new content");
+	add(Math.min(f.turnDepth * W_TURN_DEPTH, CAP_TURN_DEPTH), `conversation depth ${f.turnDepth}`);
+	add(Math.max(f.toolLoopDepth * W_LOOP_DEPTH, CAP_LOOP_DEPTH), `tool loop depth ${f.toolLoopDepth}`);
+	if (f.toolLoopDepth >= cfg.classifier.agenticLoopDepth && f.toolLoopDepth > 0) {
+		add(W_AUTONOMOUS_LOOP, "long autonomous loop implies a substantial task");
+	}
+	if (f.hasImages) add(W_IMAGES, "image input");
+	if (f.toolCount > 0) add(W_TOOLS_OFFERED, `${f.toolCount} tools offered`);
+
+	score = Math.min(1, Math.max(0, score));
+	const tier: Tier = score < BOUNDARIES[0] ? "trivial" : score < BOUNDARIES[1] ? "simple" : score < BOUNDARIES[2] ? "moderate" : "hard";
+
+	// Near a bucket boundary the heuristic is guessing; confidence is the
+	// distance to the nearest boundary, scaled so half a bucket of clearance
+	// reads as fully confident. Low confidence ⇒ eligible for LLM adjudication.
+	let dist = 1;
+	for (const b of BOUNDARIES) dist = Math.min(dist, Math.abs(score - b));
+	const confidence = Math.min(1, dist / 0.125);
+
+	return { tier, task: classifyTask(f), confidence, source: "heuristic", reasons, score };
+}
+
+/** Quality axis rule: deep loops → agentic; tools offered → toolAxis; chat → chatAxis. */
+export function pickQualityAxis(f: Features, cfg: RouterConfig): QualityAxis {
+	if (f.toolLoopDepth >= cfg.classifier.agenticLoopDepth) return "agentic";
+	if (f.toolCount > 0) return cfg.classifier.toolAxis;
+	return cfg.classifier.chatAxis;
+}
+
+/**
+ * Task-type classification: the KIND of work, orthogonal to complexity tier.
+ * Cheap and deterministic — no tokenizer, no model call. Vision is the only
+ * hard signal (image input); the rest are keyword/structural heuristics over
+ * the newest user content. The task selects the quality axis and capability
+ * filters; the tier still bounds cost.
+ */
+export function classifyTask(f: Features): TaskType {
+	if (f.hasImages) return "vision";
+	// Coding: code blocks, diffs, a tool loop, or tools offered — agent tool use
+	// is coding work. Bare chat (no tools, no code) falls through.
+	if (f.codeBlocks > 0 || f.looksLikeDiff || f.toolLoopDepth > 0 || f.toolCount > 0) return "coding";
+	// Data: tabular/structured analysis language.
+	if (f.complexityKeywords.some((k) => k === "optimize" || k === "migrate")) return "data";
+	// Documentation: prose-heavy, explanatory language, no code.
+	if (f.complexityKeywords.some((k) => k === "design" || k === "architecture")) return "documentation";
+	return "chat";
+}
+
+export interface ClassifyDeps {
+	upstream: UpstreamClient;
+	ledger: Ledger | null;
+	catalog: CatalogSource | null;
+}
+
+const ADJUDICATOR_SYSTEM = [
+	"You classify one turn of a coding-agent conversation into a complexity tier.",
+	"trivial: mechanical step, rename, typo, formatting, reading a successful tool result.",
+	"simple: small localized change, single-file edit, straightforward question.",
+	"moderate: multi-file change, debugging, non-obvious design decision.",
+	"hard: architecture, subtle concurrency or correctness bug, security, large refactor.",
+	"Reply with exactly one word: trivial, simple, moderate, or hard.",
+].join("\n");
+
+// The adjudicator answers with one token; a small completion budget is plenty.
+const ADJUDICATOR_COMPLETION_TOKENS = 4;
+// Rough completion size of the turn being classified, for the cost-fraction guard.
+const EST_TURN_COMPLETION_TOKENS = 1024;
+// Hard cap on the user-content excerpt sent to the adjudicator.
+const DIGEST_EXCERPT_CHARS = 400;
+
+/**
+ * Verdict caches are keyed by the config object so separate routers (and
+ * separate tests) never share verdicts. Bounded LRU per config.
+ */
+const verdictCaches = new WeakMap<RouterConfig, Map<string, Tier>>();
+
+function verdictCache(cfg: RouterConfig): Map<string, Tier> {
+	let cache = verdictCaches.get(cfg);
+	if (cache === undefined) {
+		cache = new Map();
+		verdictCaches.set(cfg, cache);
+	}
+	return cache;
+}
+
+function lruGet(cache: Map<string, Tier>, key: string): Tier | undefined {
+	const hit = cache.get(key);
+	if (hit !== undefined) {
+		// Refresh recency: Map preserves insertion order.
+		cache.delete(key);
+		cache.set(key, hit);
+	}
+	return hit;
+}
+
+function lruSet(cache: Map<string, Tier>, key: string, value: Tier, maxSize: number): void {
+	cache.delete(key);
+	cache.set(key, value);
+	while (cache.size > maxSize) {
+		const oldest = cache.keys().next();
+		if (oldest.done) break;
+		cache.delete(oldest.value);
+	}
+}
+
+/**
+ * Compact digest of the request for the adjudicator. Never the whole
+ * conversation: shipping full history to the judge would cost more than the
+ * turn it is classifying.
+ */
+function buildDigest(req: NormRequest, f: Features): string {
+	const toolNames = req.tools.length === 0 ? "none" : req.tools.map((t) => t.name).slice(0, 24).join(", ");
+	let excerpt = "(no user content yet)";
+	for (let i = req.messages.length - 1; i >= 0; i--) {
+		const m = req.messages[i];
+		if (m?.role === "user") {
+			excerpt = m.text.length > DIGEST_EXCERPT_CHARS ? `${m.text.slice(0, DIGEST_EXCERPT_CHARS)}...` : m.text;
+			break;
+		}
+	}
+	return [
+		`tools_offered: ${toolNames}`,
+		`tool_result_continuation: ${f.isToolResultContinuation}`,
+		`tool_loop_depth: ${f.toolLoopDepth}`,
+		`last_tool_failed: ${f.lastToolFailed}`,
+		`prompt_tokens_estimate: ${f.promptTokens}`,
+		`newest_user_content: """${excerpt}"""`,
+	].join("\n");
+}
+
+export async function classify(
+	req: NormRequest,
+	f: Features,
+	cfg: RouterConfig,
+	deps: ClassifyDeps,
+): Promise<Classification> {
+	const heuristic = scoreHeuristic(f, cfg);
+	const cc = cfg.classifier;
+	if (cc.ambiguityThreshold <= 0 || heuristic.confidence >= cc.ambiguityThreshold) return heuristic;
+
+	const digest = buildDigest(req, f);
+	const cache = verdictCache(cfg);
+	const fingerprint = sha256Hex(digest);
+	const cached = lruGet(cache, fingerprint);
+	if (cached !== undefined) {
+		return {
+			tier: cached,
+			task: heuristic.task,
+			confidence: 0.9,
+			source: "llm",
+			score: heuristic.score,
+			reasons: [...heuristic.reasons, `adjudicator: ${cached} (cached verdict)`],
+		};
+	}
+
+	// Cost guard: adjudication must be cheap relative to the turn it classifies.
+	const blend = deps.ledger?.blendedRate(cfg.ledger.blendWindowDays) ?? null;
+	const inputRate = (blend?.inputPerMtok ?? cfg.ledger.fallbackBlend.inputPerMtok) / 1e6;
+	const outputRate = (blend?.outputPerMtok ?? cfg.ledger.fallbackBlend.outputPerMtok) / 1e6;
+	const judge = deps.catalog?.find(cc.model);
+	const digestTokens = estimateTokens(Buffer.byteLength(ADJUDICATOR_SYSTEM) + Buffer.byteLength(digest), "unknown", deps.ledger);
+	const adjudicatorUsd =
+		judge !== undefined
+			? forecast(judge, {
+					promptTokens: digestTokens,
+					completionTokens: ADJUDICATOR_COMPLETION_TOKENS,
+					cacheHitRate: 0,
+					images: 0,
+				}).expectedUsd
+			: // Judge slug missing from the catalog: price it at the blend so the guard still bites.
+				digestTokens * inputRate + ADJUDICATOR_COMPLETION_TOKENS * outputRate;
+	const pendingTurnUsd = f.promptTokens * inputRate + EST_TURN_COMPLETION_TOKENS * outputRate;
+	if (adjudicatorUsd > cc.maxCostUsd || adjudicatorUsd > pendingTurnUsd * cc.maxCostFraction) {
+		return {
+			...heuristic,
+			reasons: [...heuristic.reasons, `adjudicator skipped: est $${adjudicatorUsd.toFixed(6)} breaches cost guard`],
+		};
+	}
+
+	const controller = new AbortController();
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<never>((_resolve, reject) => {
+		// Reject even if the upstream implementation ignores the abort signal.
+		timer = setTimeout(() => {
+			controller.abort();
+			reject(new Error(`timed out after ${cc.timeoutMs}ms`));
+		}, cc.timeoutMs);
+	});
+	try {
+		const { text } = await Promise.race([
+			deps.upstream.complete(
+				{
+					model: cc.model,
+					stream: false,
+					max_tokens: ADJUDICATOR_COMPLETION_TOKENS,
+					temperature: 0,
+					messages: [
+						{ role: "system", content: ADJUDICATOR_SYSTEM },
+						{ role: "user", content: digest },
+					],
+				},
+				controller.signal,
+			),
+			timeout,
+		]);
+		const word = text.trim().toLowerCase();
+		if (word === "trivial" || word === "simple" || word === "moderate" || word === "hard") {
+			lruSet(cache, fingerprint, word, cc.cacheSize);
+			return {
+				tier: word,
+				task: heuristic.task,
+				confidence: 0.9,
+				source: "llm",
+				score: heuristic.score,
+				reasons: [...heuristic.reasons, `adjudicator: ${word}`],
+			};
+		}
+		return {
+			...heuristic,
+			reasons: [...heuristic.reasons, `adjudicator reply not a tier word; kept heuristic ${heuristic.tier}`],
+		};
+	} catch (err) {
+		const why = err instanceof Error ? err.message : String(err);
+		return {
+			...heuristic,
+			reasons: [...heuristic.reasons, `adjudicator failed (${why}); kept heuristic ${heuristic.tier}`],
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}

package/src/router/escalate.ts

@@ -0,0 +1,264 @@
+/**
+ * Guarded-probe state machine for mid-stream escalation.
+ *
+ * While undecided, the probe holds every chunk. It commits (release the
+ * buffer to the client) once the generation proves itself — enough text, or
+ * complete valid tool-call JSON — and escalates when it observes a configured
+ * failure signal. Pure and synchronous: the only impurity is an injectable
+ * clock for the hold-time ceiling.
+ */
+
+import type { EscalationSignal, ProbePlan, ProbeVerdict } from "./types.ts";
+import type { FinishReason, NormRequest, NormToolCall, UpstreamChunk } from "../wire/types.ts";
+
+export interface Probe {
+	/** Returns a verdict once decided, null while still buffering. */
+	observe(chunk: UpstreamChunk): ProbeVerdict | null;
+	/** Stream ended while still undecided; decide from what was held. */
+	verdictOnEnd(): ProbeVerdict;
+	/** Live view of the buffer; do not mutate. Valid until the next observe(). */
+	held(): UpstreamChunk[];
+}
+
+// Refusal openers, matched against the start of the held text. Kept
+// deliberately tight and anchored: a false positive pays for two generations.
+const REFUSAL_OPENERS: readonly RegExp[] = [
+	// "I'm sorry, but I can't ..." / "I am sorry I cannot ..."
+	/^(?:i'?m|i am) sorry,? (?:but )?i (?:can'?t|cannot|won'?t|will not)/i,
+	// "I cannot assist/help/comply/fulfill/provide ..."
+	/^i (?:can'?t|cannot) (?:assist|help|comply|fulfill|provide|generate|create)/i,
+	// "I'm unable to help ..." / "I'm not able to provide ..."
+	/^i'?m (?:not able|unable) to (?:assist|help|comply|fulfill|provide)/i,
+	// "I must decline/refuse ..."
+	/^i must (?:decline|refuse)/i,
+	// "Sorry, I can't ..."
+	/^(?:sorry|apologies),? (?:but )?i (?:can'?t|cannot)/i,
+];
+
+const INVALID = Symbol("invalid-json");
+
+function parseJson(text: string): unknown {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return INVALID;
+	}
+}
+
+// Key-order-insensitive comparison: the same call re-emitted with reordered
+// keys is still a loop. Parsed JSON contains no undefined/functions, so plain
+// per-node stringification is exact.
+function stableStringify(v: unknown): string {
+	if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
+	if (v !== null && typeof v === "object") {
+		const entries = Object.entries(v as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+		return `{${entries.map(([k, val]) => `${JSON.stringify(k)}:${stableStringify(val)}`).join(",")}}`;
+	}
+	return JSON.stringify(v);
+}
+
+interface ToolCallAcc {
+	name: string | null;
+	args: string;
+	sawArgs: boolean;
+}
+
+export function createProbe(
+	plan: ProbePlan,
+	req: NormRequest,
+	triggers: ReadonlySet<string>,
+	now: () => number = Date.now,
+): Probe {
+	const heldChunks: UpstreamChunk[] = [];
+	const toolCalls = new Map<number, ToolCallAcc>();
+	const startedAt = now();
+	let text = "";
+	// Cheap 4-chars-per-token approximation. It only gates WHEN we stop holding
+	// (latency), never money — the ledger uses reported usage.
+	let approxTextTokens = 0;
+	let finishReason: FinishReason | null = null;
+	// Reasoning deltas prove the model is working even before any content
+	// arrives. Used only by the hold-time ceiling, never by the end verdict:
+	// a stream that ENDS having emitted only reasoning really is hollow.
+	let sawReasoning = false;
+	let decided: ProbeVerdict | null = null;
+
+	const commit = (reason: string): ProbeVerdict => (decided = { action: "commit", reason });
+	const escalate = (signal: EscalationSignal, reason: string): ProbeVerdict =>
+		(decided = { action: "escalate", signal, reason });
+
+	const matchesRefusal = (): boolean => {
+		const head = text.trimStart();
+		return head !== "" && REFUSAL_OPENERS.some((re) => re.test(head));
+	};
+
+	const lastAssistantToolCall = (): NormToolCall | null => {
+		for (let i = req.messages.length - 1; i >= 0; i--) {
+			const m = req.messages[i];
+			if (m && m.role === "assistant" && m.toolCalls.length > 0) {
+				return m.toolCalls[m.toolCalls.length - 1] ?? null;
+			}
+		}
+		return null;
+	};
+
+	const isRepeat = (name: string | null, argsParsed: unknown): boolean => {
+		if (!triggers.has("repeat_tool_call") || name === null) return false;
+		const prev = lastAssistantToolCall();
+		if (!prev || prev.name !== name) return false;
+		const prevParsed = parseJson(prev.argsJson);
+		if (prevParsed === INVALID) return false;
+		return stableStringify(prevParsed) === stableStringify(argsParsed);
+	};
+
+	// End-of-stream evaluation, shared by the finish event and verdictOnEnd.
+	const endVerdict = (): ProbeVerdict => {
+		if (toolCalls.size > 0) {
+			let sawValid = false;
+			for (const acc of toolCalls.values()) {
+				// Functions without parameters stream no argument fragments;
+				// absent arguments mean an empty object, not malformed JSON.
+				const parsed = parseJson(acc.args === "" ? "{}" : acc.args);
+				if (parsed === INVALID) continue;
+				sawValid = true;
+				if (isRepeat(acc.name, parsed)) {
+					return escalate("repeat_tool_call", `tool call "${acc.name ?? "?"}" repeats the previous assistant call`);
+				}
+			}
+			if (!sawValid) {
+				if (triggers.has("malformed_tool_args")) {
+					return escalate("malformed_tool_args", "tool-call arguments are not complete valid JSON");
+				}
+				if (finishReason === "length" && triggers.has("length_stop")) {
+					return escalate("length_stop", "hit the length cap mid tool-call arguments");
+				}
+			}
+			return commit(sawValid ? "tool call complete" : "tool call unvalidated; its signals are disabled");
+		}
+
+		const hasText = text.trim() !== "";
+		if (finishReason === "length") {
+			// A length finish on PROSE is the client's own `max_tokens` doing its
+			// job, not a model failure — and escalating cannot fix it, because the
+			// retry runs under the same cap and truncates in the same place. All it
+			// buys is paying twice, at a dearer tier, for the same truncation. The
+			// caller's remedy is a larger cap or a continuation, not a better model.
+			//
+			// A length finish that truncated TOOL-CALL ARGUMENTS is different and
+			// still escalates (above): that output is structurally unusable, and a
+			// different model may emit a well-formed call before the cap.
+			if (!hasText) {
+				if (triggers.has("empty_completion")) {
+					return escalate("empty_completion", "hit the length cap having produced nothing");
+				}
+				return commit("length finish with no content tolerated; signal disabled");
+			}
+			return commit("length finish on prose: the client's max_tokens, not a model failure");
+		}
+		if (req.forcedToolChoice && req.tools.length > 0 && triggers.has("missing_expected_tool_call")) {
+			return escalate("missing_expected_tool_call", "tool choice was forced but the model produced prose");
+		}
+		if (!hasText) {
+			if (triggers.has("empty_completion")) return escalate("empty_completion", "finished with no content");
+			return commit("empty completion tolerated; signal disabled");
+		}
+		if (matchesRefusal() && triggers.has("refusal")) {
+			return escalate("refusal", "completion opens with a refusal");
+		}
+		if (finishReason === "error" && triggers.has("upstream_error")) {
+			return escalate("upstream_error", "upstream reported an error finish");
+		}
+		return commit("completed with content");
+	};
+
+	return {
+		observe(chunk: UpstreamChunk): ProbeVerdict | null {
+			if (decided) return decided;
+			heldChunks.push(chunk);
+			if (!plan.enabled) return commit("probe disabled");
+
+			for (const ev of chunk.events) {
+				switch (ev.type) {
+					case "text":
+						text += ev.delta;
+						approxTextTokens += Math.ceil(ev.delta.length / 4);
+						break;
+					case "reasoning":
+						sawReasoning = true;
+						break;
+					case "tool_call": {
+						let acc = toolCalls.get(ev.index);
+						if (!acc) {
+							acc = { name: null, args: "", sawArgs: false };
+							toolCalls.set(ev.index, acc);
+						}
+						if (ev.name !== undefined) acc.name = ev.name;
+						if (ev.argsDelta !== undefined) {
+							acc.args += ev.argsDelta;
+							acc.sawArgs = true;
+						}
+						break;
+					}
+					case "finish":
+						finishReason = ev.reason;
+						break;
+					default:
+						break;
+				}
+			}
+
+			// Refusal patterns are anchored openers, so they are checkable the
+			// moment text starts arriving — do not wait for the finish event.
+			if (triggers.has("refusal") && text !== "" && matchesRefusal()) {
+				return escalate("refusal", "held text opens with a refusal");
+			}
+			if (finishReason !== null) return endVerdict();
+			if (plan.maxTokens > 0 && approxTextTokens >= plan.maxTokens) {
+				return commit(`held ~${approxTextTokens} text tokens, at the probe budget`);
+			}
+			for (const acc of toolCalls.values()) {
+				if (!acc.sawArgs || acc.args === "") continue;
+				const parsed = parseJson(acc.args);
+				if (parsed === INVALID) continue;
+				// A loop repeats too: check identity against the previous call
+				// before letting a structurally valid call commit.
+				if (isRepeat(acc.name, parsed)) {
+					return escalate("repeat_tool_call", `tool call "${acc.name ?? "?"}" repeats the previous assistant call`);
+				}
+				return commit(`tool call "${acc.name ?? "?"}" arguments are complete valid JSON`);
+			}
+			if (plan.maxHoldMs > 0 && now() - startedAt >= plan.maxHoldMs) {
+				// The ceiling bounds how long we withhold output; the stream is
+				// still OPEN here, so "nothing useful yet" means slow, not broken.
+				//
+				// Committing unconditionally (the original behaviour) blessed a
+				// genuinely stalled stream as served. Running the full end-of-stream
+				// verdict instead over-corrects the other way: a reasoning model
+				// that has emitted only reasoning tokens after 8s is working
+				// normally, and escalating throws away a paid, healthy generation
+				// to re-run it dearer.
+				//
+				// So the ceiling escalates only on the absence of ANY sign of life.
+				// Real end-of-stream hollowness is still caught by `verdictOnEnd`,
+				// where an ended stream that produced only reasoning IS hollow.
+				const aliveButSlow = text !== "" || sawReasoning || toolCalls.size > 0;
+				if (aliveButSlow) return commit("hold ceiling reached while still generating");
+				if (triggers.has("empty_completion")) {
+					return escalate("empty_completion", "hold ceiling reached with no output at all");
+				}
+				return commit("hold ceiling reached; empty-completion signal disabled");
+			}
+			return null;
+		},
+
+		verdictOnEnd(): ProbeVerdict {
+			if (decided) return decided;
+			if (!plan.enabled) return commit("probe disabled");
+			return endVerdict();
+		},
+
+		held(): UpstreamChunk[] {
+			return heldChunks;
+		},
+	};
+}