auto-model-router 0.2.26 → 0.2.28

package/README.md

@@ -102,6 +102,29 @@ score nearly as well. If your workload needs a frontier model on hard turns,
 raise the tier price ceiling and `qualityExponent` — measured thresholds are in
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
+### Real-world — a week on the live ledger
+
+The suites above are small and clean. To measure the economics on *actual*
+usage we replayed a week of real omp traffic from the router's own ledger —
+**6 918 billed turns across 299 conversations, 7 days, 410:1 input-to-output,
+68% cache hit** — and repriced the identical token stream against a single Opus 5
+model with its own cache namespace.
+
+| | auto-model-router | Claude Opus 5 (single-model) |
+| --- | --- | --- |
+| Spend over the week | **$61.69** | $921.20 |
+| Per turn | **$0.0089** | $0.133 |
+| Extrapolated / month | **$263** | $3 932 |
+
+**≈15× cheaper, ~93% saved** — a four-figure monthly bill becomes a three-figure
+one. This baseline is deliberately conservative: one cache namespace, with each
+conversation's cache replayed on the real turn gaps. A naive like-for-like
+repricing at Opus rates reports ~31×, but on a single model the replayed context
+is cache reads at $0.50/MTok, so ≈15× is the number we stand behind. Unlike the
+core suite, sustained work on a large codebase is dominated by the conversation
+resent each turn rather than per-token price — exactly where a single frontier
+model gets expensive and routing's per-turn cache awareness pays off.
+
 ### Scope
 
 These are small, self-contained tasks of one to three files, solved in under 25
@@ -111,11 +134,6 @@ separates. The cost multiple varied between 14× and 32× across runs depending
 which task the baseline stalled on — treat "well over an order of magnitude" as
 the claim, not a specific figure.
 
-For sustained work on a large codebase the economics differ: cost there is
-dominated by the conversation being resent each turn rather than by per-token
-price. Replaying a week of real omp traffic (6 918 billed turns, 410:1
-input-to-output) against a single-model baseline gives **≈15×**.
-
 Harness, tasks and raw per-turn data:
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
@@ -666,13 +684,13 @@ and brief:
 ```bash
 export AGENTDOX_URL=http://localhost:3003
 export AGENTDOX_TOKEN=<pat with read+write on the scope>
-export AGENTDOX_SCOPE=ashlands        # fallback only; see below
+export AGENTDOX_SCOPE=myproject       # fallback only; see below
 ```
 
 Setting a URL and a token is enough to turn it on.
 
 The scope is **derived per workspace** from the directory basename
-(`E:/projects/ashlands` → `ashlands`), and that derivation wins. `AGENTDOX_SCOPE` /
+(`E:/projects/myproject` → `myproject`), and that derivation wins. `AGENTDOX_SCOPE` /
 `context.defaultScope` is only a fallback for workspaces it cannot resolve, because one router
 install serves every project on the machine — a slug pinned there would be sent for all of
 them, injecting one project's context into another's work. A single configured token also

package/omp-extension/router-embed.ts

@@ -23,7 +23,7 @@ import { appendFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-import { ompModelsPath, syncModelsYml } from "../src/cli/config-cmd.ts";
+import { ompModelsPath } from "../src/cli/config-cmd.ts";
 import { loadConfig } from "../src/config/load.ts";
 import { startServer } from "../src/server/http.ts";
 import type { StartedServer } from "../src/server/http.ts";
@@ -207,20 +207,39 @@ export default function (pi: ExtensionAPI): void {
 		// default — never take this path, so sessions stay independent.
 		if (requestedPort !== 0 && (await probeEmbed(requestedPort))) {
 			writeEmbedPort(portFile, requestedPort);
-			syncModelsYml(cfg, requestedPort);
 			registerRouterProvider(pi, requestedPort, cfg, sessionId);
 			pi.setLabel(`auto-model-router embed (shared :${requestedPort})`);
 			return;
 		}
 
-		// Bind. If a FIXED port was requested and something else holds it, fall
-		// back to an ephemeral one rather than leaving this session with no
-		// provider at all. An ephemeral request that fails is a real error.
+		// ADOPT THE ADVERTISED PORT. This is the fix for "provider error: Unable
+		// to connect" on every real turn while utility calls kept working.
+		//
+		// omp resolves `modelRoles.default` (auto-model-router/auto) from
+		// models.yml during STARTUP — before this extension loads, so before we
+		// can bind or register anything. That resolved handle is a SNAPSHOT: a
+		// later registerProvider replaces the registry entry but cannot rewrite
+		// a handle omp already built. models.yml names the port of the LAST
+		// session that wrote it, which after a normal restart is the session the
+		// user just closed — a dead socket. Utility calls (title generation,
+		// auto-thinking) resolve AFTER our registration and so hit the live port,
+		// which is exactly the asymmetry that made this look like a router fault.
+		// Measured in the field via embed.log:
+		//   embed ready pid=61872 port=54985 models.yml-advertised=50596
+		//
+		// So bind the port omp already resolved against, whenever nothing holds
+		// it. Each session still runs its OWN router — this only chooses which
+		// port that router listens on. A live peer holding it means the handle
+		// works anyway (that peer serves it), and we fall back to ephemeral.
+		const advertised = modelsYmlPort(readModelsYml());
+		if (requestedPort === 0 && advertised !== null) cfg.server.port = advertised;
+
+		// Fall back to an ephemeral port when the preferred one is taken, rather
+		// than leaving this session with no provider at all.
 		let started: StartedServer;
 		try {
 			started = startServer(cfg);
-		} catch (err) {
-			if (requestedPort === 0) throw err;
+		} catch {
 			cfg.server.port = 0;
 			started = startServer(cfg);
 		}
@@ -232,18 +251,23 @@ export default function (pi: ExtensionAPI): void {
 		// Publish the port; subagents and the toast read it from here.
 		writeEmbedPort(portFile, actualPort);
 
-		// Keep models.yml pointing at this port. Headless runs (`-p`) and
-		// subagent processes resolve models from models.yml in a FRESH registry
-		// — extension registration does not reach them — so without this they
-		// fail with "Model not found" when no interactive session is live
-		// (the print-mode gap the external benchmark hit).
-		const advertised = modelsYmlPort(readModelsYml());
-		const syncAction = syncModelsYml(cfg, actualPort);
+		// models.yml is deliberately NOT written. The port belongs to THIS
+		// process and changes every launch, so persisting it into a file omp
+		// reads at STARTUP — before this extension loads — makes a dead port
+		// authoritative for the next session's `modelRoles.default`, and that
+		// handle is a snapshot no later registration can repair. That is the
+		// regression this whole class of failure came from. The provider is
+		// registered dynamically below instead, which is what worked before the
+		// file was ever written.
+		//
+		// `auto-model-router config --write` still exists for anyone who wants a
+		// static block on purpose; the adoption above keeps such a block
+		// harmless by binding whatever port it names when that port is free.
 
 		// Register BEFORE any await: everything omp resolves after this point
 		// picks up the live URL, so the registration must not sit behind I/O.
 		registerRouterProvider(pi, actualPort, cfg, sessionId);
-		pi.setLabel(`auto-model-router embed :${actualPort}${syncAction === null ? "" : ` (models.yml ${syncAction})`}`);
+		pi.setLabel(`auto-model-router embed :${actualPort}`);
 
 		// NO `session_shutdown` teardown. That event is emitted from session
 		// DISPOSAL — including omp's provider-refresh / extension-reload path,
@@ -259,7 +283,7 @@ export default function (pi: ExtensionAPI): void {
 		writeEmbedLog(
 			`embed ready pid=${process.pid} port=${actualPort}` +
 				` models.yml-advertised=${advertised ?? "none"}` +
-				` sync=${syncAction ?? "current"}` +
+				` models.yml-untouched` +
 				` self-probe=${(await probeEmbed(actualPort)) ? "ok" : "FAILED"}` +
 				` session=${sessionId}`,
 		);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.2.26",
+  "version": "0.2.28",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/cli/config-cmd.ts

@@ -317,44 +317,6 @@ export function ompModelsPath(): string {
 	if (agentDir !== undefined && agentDir !== "") return join(agentDir, "models.yml");
 	return join(homedir(), ".omp", "agent", "models.yml");
 }
-/**
- * Keeps omp's models.yml carrying an up-to-date `auto-model-router` provider
- * block pointing at `port`, silently. The embedded extension calls this every
- * time the main session binds its router, so headless (`-p`) runs, subagent
- * processes, and any other consumer that builds a FRESH model registry (which
- * extension registration does NOT reach) still resolve
- * `auto-model-router/auto` — they read models.yml, not the live registry.
- *
- * Same splice + validation as `config --write`, minus the console output and
- * the backup: this runs on every session start, and a `.bak` per launch would
- * churn the directory. Failure to write is logged by the caller, never thrown —
- * a read-only models.yml must degrade to "registration only", which is the
- * pre-existing behavior.
- *
- * Returns the splice action, or null when nothing was written (already
- * current, or the write failed).
- */
-export function syncModelsYml(cfg: RouterConfig, port: number, target = ompModelsPath()): SpliceResult["action"] | null {
-	try {
-		const pointed: RouterConfig = { ...cfg, server: { ...cfg.server, port } };
-		const block = renderProviderBlock(pointed, null);
-		const existing = existsSync(target) ? readFileSync(target, "utf8") : "";
-		const result = spliceProviderBlock(existing, block);
-		if (result.action === "replaced") {
-			// The guards make "replaced" cheap to detect but the text may still be
-			// byte-identical (same port, same costs): skip the write so the file
-			// mtime stays stable for tools watching it.
-			if (result.text === existing) return null;
-		}
-		assertUsableModelsYaml(result.text);
-		mkdirSync(dirname(target), { recursive: true });
-		writeFileSync(target, result.text, "utf8");
-		return result.action;
-	} catch {
-		return null;
-	}
-}
-
 /** omp's models.yml location: `$PI_CODING_AGENT_DIR` relocates the whole agent dir. */
 
 export async function configCommand(args: CliArgs): Promise<void> {

package/src/config/defaults.ts

@@ -71,6 +71,11 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		// Shared trust by default: more samples, demotion guard stays effective
 		// even with a tiny guardrail-narrowed catalog.
 		trustScopedByHarness: false,
+		// 0 = all-time, the shipped behaviour. Reliability is slow-moving, so a
+		// wide sample is right on the merits; a window exists to bound the
+		// per-slug scan once history is large, and it changes routing, so it is
+		// opt-in after a replay run prices it.
+		trustWindowDays: 0,
 		contextHeadroom: 1.25,
 		// Latency scoring is off by default (weight 0): opt in after establishing a
 		// baseline. Expected total wait (TTFT + expected completion / throughput)

package/src/config/schema.ts

@@ -67,6 +67,7 @@ const filters = z.strictObject({
 	minTrust: z.number().min(0).max(1).optional(),
 	minTrustSamples: z.number().int().nonnegative().optional(),
 	trustScopedByHarness: z.boolean().optional(),
+	trustWindowDays: z.number().nonnegative().optional(),
 	contextHeadroom: z.number().positive().optional(),
 	latencyWeight: z.number().nonnegative().optional(),
 	latencyReferenceMs: z.number().positive().optional(),

package/src/config/types.ts

@@ -167,6 +167,22 @@ export interface FilterConfig {
 	 * to learn its own reliability.
 	 */
 	trustScopedByHarness: boolean;
+	/**
+	 * Only count ledger rows from the last N days toward model trust. 0 (the
+	 * default) keeps the all-time behaviour.
+	 *
+	 * Trust is deliberately all-time: reliability is slow-moving, and a wide
+	 * sample keeps the demotion guard stable. The cost is that the per-slug
+	 * trust aggregate scans every row a model ever had, and that runs for each
+	 * candidate on every turn — measured on a real ledger it grows from 0.8 ms at
+	 * 9k rows to 11.6 ms at 75k, i.e. it becomes a per-turn latency tax as
+	 * history accumulates. A window bounds that scan.
+	 *
+	 * Setting it CHANGES ROUTING (smaller denominators move success rates), so
+	 * price it on the ledger with `bun tools/replay.ts --set
+	 * filters.trustWindowDays=N` before enabling.
+	 */
+	trustWindowDays: number;
 	/**
 	 * Headroom multiplier applied to estimated prompt tokens when checking a
 	 * model's context window, absorbing token-estimate error and the response.

package/src/context/bridge.ts

@@ -212,6 +212,10 @@ export function createContextBridge(opts: BridgeOptions): ContextBridge {
 			await queue;
 		},
 
+		pruneBlocks(maxAgeMs: number) {
+			return store.prune(maxAgeMs);
+		},
+
 		close() {
 			closed = true;
 			pending.clear();
@@ -226,6 +230,7 @@ export function createDisabledBridge(): ContextBridge {
 		resolve: async () => null,
 		recordTurn: () => {},
 		flush: async () => {},
+		pruneBlocks: () => 0,
 		close: () => {},
 	};
 }

package/src/context/store.ts

@@ -42,7 +42,16 @@ export function createContextStore(db: Database): ContextBlockStore {
 		VALUES ($key, $scope, $sessionId, $createdAtMs)
 		ON CONFLICT(conversation_key) DO UPDATE SET session_id = excluded.session_id
 	`);
-	const deleteStale: Statement<unknown, [number]> = db.query("DELETE FROM context_blocks WHERE fetched_at_ms < ?");
+	// Age alone is the wrong test: a block older than the staleness TTL may still
+	// be PINNED by a live conversation, and deleting it forces that conversation
+	// to refetch and re-inject different bytes — a prompt-cache miss caused by
+	// housekeeping. Blocks are content-addressed and shared, so the safe set is
+	// "old AND referenced by no conversation".
+	const deleteStale: Statement<unknown, [number]> = db.query(`
+		DELETE FROM context_blocks
+		WHERE fetched_at_ms < ?
+		  AND version NOT IN (SELECT context_version FROM conversations WHERE context_version IS NOT NULL)
+	`);
 
 	return {
 		get(version) {

package/src/context/types.ts

@@ -77,6 +77,13 @@ export interface ContextBridge {
 	recordTurn(rec: TurnRecord): void;
 	/** Drains the write queue. For tests and shutdown. */
 	flush(): Promise<void>;
+	/**
+	 * Housekeeping: drops stored blocks older than `maxAgeMs` that no
+	 * conversation still pins, returning the count removed. Blocks are
+	 * content-addressed and shared, so nothing else reclaims them — without this
+	 * the table grows for the life of the install.
+	 */
+	pruneBlocks(maxAgeMs: number): number;
 	close(): void;
 }
 
@@ -87,5 +94,11 @@ export interface ContextBlockStore {
 	/** agentdox session id previously opened for a conversation. */
 	sessionFor(conversationKey: string): string | null;
 	bindSession(conversationKey: string, scope: string, sessionId: string): void;
+	/**
+	 * Drops blocks older than `maxAgeMs` that NO conversation still pins.
+	 * Returns the number removed. Referenced blocks are kept regardless of age:
+	 * deleting one would force a live conversation to refetch and re-inject
+	 * different bytes, turning housekeeping into a prompt-cache miss.
+	 */
 	prune(maxAgeMs: number): number;
 }

package/src/cost/ledger.ts

@@ -22,6 +22,7 @@ import type { BlendedRate, Ledger, LedgerEntry, ModelLatency, ModelTrust, UsageC
 
 /** Estimates below this many samples are noise; the default ratio is better. */
 const MIN_CALIBRATION_SAMPLES = 20;
+const DAY_MS = 86_400_000;
 
 // Row shapes below are fixed by our own schema in util/sqlite.ts.
 interface LedgerRow {
@@ -243,9 +244,12 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 	const spendSinceHarnessStmt = db.query(
 		"SELECT COALESCE(SUM(COALESCE(reported_usd, predicted_usd)), 0) AS total FROM ledger WHERE created_at_ms >= ? AND harness_id = ?",
 	);
-	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ?`);
-	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ?`);
-	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger GROUP BY slug`);
+	// `created_at_ms > ?` is always present, with a cutoff of 0 meaning all-time.
+	// One statement shape rather than two keeps the plan (and the index it uses,
+	// idx_ledger_slug_created) identical whether or not a window is configured.
+	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND created_at_ms > ?`);
+	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ? AND created_at_ms > ?`);
+	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger WHERE created_at_ms > ? GROUP BY slug`);
 	const latencyStmt = db.query(
 		`SELECT ${LATENCY_SELECT} FROM (SELECT * FROM ledger WHERE slug = ? ORDER BY created_at_ms DESC LIMIT ${LATENCY_WINDOW_ROWS})`,
 	);
@@ -349,16 +353,21 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 		},
 
 		trust(slug: string, harnessId?: string): ModelTrust | null {
+			// Read the window at CALL time, not at construction: hot reload mutates
+			// the shared config object in place, so a pinned value would ignore an
+			// edit until restart. 0 => cutoff 0 => every row qualifies.
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
 			const row =
 				harnessId !== undefined && harnessId !== ""
-					? (trustHarnessStmt.get(slug, harnessId) as TrustRow | null)
-					: (trustStmt.get(slug) as TrustRow | null);
+					? (trustHarnessStmt.get(slug, harnessId, cutoff) as TrustRow | null)
+					: (trustStmt.get(slug, cutoff) as TrustRow | null);
 			if (row === null || row.attempts === 0) return null;
 			return toTrust(slug, row);
 		},
 
 		allTrust(): ModelTrust[] {
-			const rows = allTrustStmt.all() as (TrustRow & { slug: string })[];
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
+			const rows = allTrustStmt.all(cutoff) as (TrustRow & { slug: string })[];
 			return rows.map((row) => toTrust(row.slug, row));
 		},
 

package/src/server/http.ts

@@ -218,6 +218,8 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		log.warn("initial catalog fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	});
 
+	// One housekeeping timer for both tables. `unref`'d so it never holds the
+	// process open.
 	const pruneTimer = setInterval(() => {
 		try {
 			const dropped = conversations.prune(cfg.ledger.conversationTtlMs);
@@ -225,6 +227,16 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		} catch (err) {
 			log.warn("conversation prune failed", { error: err instanceof Error ? err.message : String(err) });
 		}
+		try {
+			// Past the staleness TTL every pin refreshes anyway, so an unreferenced
+			// block of that age has no future reader. Nothing else reclaims these:
+			// blocks are content-addressed and shared, so they accumulated for the
+			// life of the install (measured: 220 rows / 2.7 MB, 68 unreferenced).
+			const dropped = context.pruneBlocks(cfg.context.maxStalenessMs);
+			if (dropped > 0) log.debug("pruned unreferenced context blocks", { dropped });
+		} catch (err) {
+			log.warn("context block prune failed", { error: err instanceof Error ? err.message : String(err) });
+		}
 	}, 60_000);
 	pruneTimer.unref();
 

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 13;
+const USER_VERSION = 14;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -71,6 +71,11 @@ CREATE TABLE IF NOT EXISTS ledger (
 CREATE INDEX IF NOT EXISTS idx_ledger_conversation ON ledger (conversation_key);
 CREATE INDEX IF NOT EXISTS idx_ledger_created ON ledger (created_at_ms);
 CREATE INDEX IF NOT EXISTS idx_ledger_slug ON ledger (slug);
+-- Per-slug newest-first reads: the latency window (newest N rows for one slug)
+-- and any windowed trust. With only idx_ledger_slug those sorted every row the
+-- slug ever had; measured on a real ledger, the latency statement went from
+-- 5-10ms and RISING with history to a flat 0.04-0.08ms.
+CREATE INDEX IF NOT EXISTS idx_ledger_slug_created ON ledger (slug, created_at_ms DESC);
 
 CREATE TABLE IF NOT EXISTS token_calibration (
   tokenizer TEXT PRIMARY KEY,
@@ -230,6 +235,11 @@ ALTER TABLE conversations ADD COLUMN compaction_plan TEXT;
 // is on. Another new table via the idempotent MIGRATIONS block; version bump
 // only, no ALTER guard.
 
+// v14: idx_ledger_slug_created (slug, created_at_ms DESC) serves the per-slug
+// newest-first reads — the latency window, and trust when filters.trustWindowDays
+// is set. Created idempotently by the MIGRATIONS block above, so the version bump
+// alone records it; no ALTER guard needed.
+
 export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });

package/test/context-prune.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, test } from "bun:test";
+
+import { createContextStore } from "../src/context/store.ts";
+import { createConversationStore } from "../src/router/state.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `context_blocks` is content-addressed and shared between conversations, so
+ * nothing reclaims a block when the conversation that fetched it goes away.
+ * Until the prune below was wired into the server's housekeeping timer the table
+ * grew for the life of the install (measured on a real install: 220 rows /
+ * 2.7 MB, 68 of them referenced by nothing).
+ *
+ * Age alone is the wrong test, though: a block past the staleness TTL may still
+ * be PINNED, and deleting it forces that conversation to refetch and inject
+ * different bytes — housekeeping causing a prompt-cache miss. So the safe set is
+ * "old AND unreferenced".
+ */
+describe("context block prune", () => {
+	const HOUR = 3_600_000;
+
+	function seed() {
+		const db = openDb(":memory:");
+		const blocks = createContextStore(db);
+		const conversations = createConversationStore(db);
+		const now = Date.now();
+
+		blocks.put("scope", { version: "old-pinned", block: "A", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "old-orphan", block: "B", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "fresh-orphan", block: "C", fetchedAtMs: now });
+
+		// One live conversation still pins `old-pinned`.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "old-pinned";
+		state.contextFetchedAtMs = now - 5 * HOUR;
+		conversations.save(state);
+
+		return { db, blocks };
+	}
+
+	test("drops an old block that nothing references", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.get("old-orphan")).toBeNull();
+		db.close();
+	});
+
+	test("keeps an old block a conversation still pins", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		// Deleting this one would cost that conversation its warm prefix.
+		expect(blocks.get("old-pinned")?.block).toBe("A");
+		db.close();
+	});
+
+	test("keeps a block younger than the age cutoff", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+
+	test("is a no-op once the unreferenced blocks are gone", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.prune(HOUR)).toBe(0);
+		db.close();
+	});
+
+	test("reclaims a block as soon as its last pin is dropped", () => {
+		const { db, blocks } = seed();
+		const conversations = createConversationStore(db);
+		// The conversation moves to a new context version (a refresh), which is
+		// what leaves the old block orphaned in production.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "fresh-orphan";
+		conversations.save(state);
+
+		expect(blocks.prune(HOUR)).toBe(2); // old-pinned is now unreferenced too
+		expect(blocks.get("old-pinned")).toBeNull();
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+});

package/test/embed-lifecycle.test.ts

@@ -1,28 +1,35 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import type { ExtensionAPI, ExtensionContext, ProviderRegistration } from "@oh-my-pi/pi-coding-agent";
 
 /**
- * The embedded router's lifetime is the PROCESS, not a session.
+ * How the embedded router must behave, pinned against the two failures that
+ * produced "provider error: Unable to connect" on every real turn while utility
+ * calls kept working.
  *
- * omp emits `session_shutdown` from session DISPOSAL, and disposal includes its
- * provider-refresh / extension-reload path — which runs in a throwaway
- * extension host while the real session keeps going. This module is cached per
- * process, so tearing the router down in that handler stopped the LIVE router.
- * Every later turn then failed with Bun's "Unable to connect", while utility
- * calls resolved after a subsequent rebind still worked: exactly the asymmetry
- * seen in the field, where only `toolCount: 0` dispatches reached the ledger and
- * the port named in `embed.port` answered nothing.
+ * 1. THE PORT COMES FROM THIS PROCESS, NOT FROM A FILE. omp resolves
+ *    `modelRoles.default` from models.yml during STARTUP — before this extension
+ *    loads — and that handle is a snapshot no later registerProvider can
+ *    rewrite. So the extension must not persist its ephemeral port into
+ *    models.yml (a dead port then becomes authoritative for the NEXT session),
+ *    and when a block already exists it adopts the port that block names so the
+ *    handle omp built is valid. Measured in the field:
+ *      embed ready pid=61872 port=54985 models.yml-advertised=50596
  *
- * One boot shared by every test here, deliberately: the extension module is
- * cached per process in production too, so this is the real shape.
+ * 2. THE ROUTER'S LIFETIME IS THE PROCESS. omp emits `session_shutdown` from
+ *    session disposal, which includes its provider-refresh / extension-reload
+ *    path running in a throwaway host while the real session continues. This
+ *    module is cached per process, so a teardown there stopped the LIVE router.
+ *
+ * One boot shared by every test, deliberately: the module is cached per process
+ * in production too, so this is the real shape.
  */
 
-const handlers = new Map<string, ((event: unknown, ctx: ExtensionContext) => void | Promise<void>)[]>();
 const registrations: { id: string; baseUrl: string }[] = [];
+const handlers = new Map<string, ((event: unknown, ctx: ExtensionContext) => void | Promise<void>)[]>();
 
 const pi: ExtensionAPI = {
 	setLabel: () => {},
@@ -43,7 +50,7 @@ async function fire(event: string, sessionId: string): Promise<void> {
 	for (const handler of handlers.get(event) ?? []) await handler({ type: event }, ctx);
 }
 
-/** Health-probes the router; used to assert the socket's state, not to wait. */
+/** Health-probes the router: asserts the socket's state, never used as a wait. */
 async function alive(port: number): Promise<boolean> {
 	try {
 		const res = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(2_000) });
@@ -53,64 +60,108 @@ async function alive(port: number): Promise<boolean> {
 	}
 }
 
+const portOfLatestRegistration = (): number =>
+	Number.parseInt(/:(\d+)\//.exec(registrations.at(-1)?.baseUrl ?? "")?.[1] ?? "0", 10);
+
 let home = "";
-let port = 0;
+let modelsYmlPath = "";
+let advertised = 0;
+let modelsYmlBefore = "";
 
 beforeAll(async () => {
 	home = mkdtempSync(join(tmpdir(), "embed-life-"));
+	const agentDir = join(home, "agent");
+	mkdirSync(agentDir, { recursive: true });
+	modelsYmlPath = join(agentDir, "models.yml");
+
+	// A port nothing listens on — the shape a restart leaves behind, since
+	// models.yml names the session the user just closed.
+	const probe = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: () => new Response("x") });
+	advertised = probe.port as number;
+	probe.stop(true);
+
+	writeFileSync(
+		modelsYmlPath,
+		`providers:
+    # BEGIN auto-model-router
+    auto-model-router:
+      baseUrl: http://127.0.0.1:${advertised}/v1
+      api: openai-completions
+      auth: none
+      models:
+        - id: auto
+          name: Auto (auto-model-router)
+    # END auto-model-router
+`,
+		"utf8",
+	);
+	modelsYmlBefore = readFileSync(modelsYmlPath, "utf8");
+
 	process.env.AUTO_MODEL_ROUTER_HOME = home;
 	process.env.AUTO_MODEL_ROUTER_DB = join(home, "router.db");
+	process.env.PI_CODING_AGENT_DIR = agentDir;
+	delete process.env.AUTO_MODEL_ROUTER_PORT;
+
 	const mod = (await import("../omp-extension/router-embed.ts")) as { default: (api: ExtensionAPI) => void };
 	mod.default(pi);
 	await fire("session_start", "session-one");
-	port = Number.parseInt(/:(\d+)\//.exec(registrations.at(-1)?.baseUrl ?? "")?.[1] ?? "0", 10);
 });
 
 afterAll(async () => {
-	// Release the socket the way the extension intends: on process signals.
+	// Release the socket the way the extension intends: on a process signal.
 	process.emit("SIGTERM");
-	// Poll the real condition rather than guessing a duration; each fetch
-	// attempt yields, so this settles as soon as the socket is actually closed.
-	for (let i = 0; i < 50 && (await alive(port)); i++) {
-		/* keep probing until the port stops answering */
+	// Poll the real condition instead of guessing a duration; each probe yields.
+	for (let i = 0; i < 50 && (await alive(portOfLatestRegistration())); i++) {
+		/* keep probing until the socket stops answering */
 	}
-	// A still-open SQLite handle can hold the file on Windows; the temp dir is
-	// disposable either way.
+	delete process.env.PI_CODING_AGENT_DIR;
 	try {
 		rmSync(home, { recursive: true, force: true });
 	} catch {
-		/* leave it to the OS temp reaper */
+		/* SQLite may still hold the file on Windows; the temp dir is disposable */
 	}
 });
 
-describe("embedded router lifetime", () => {
-	test("binds a router and registers it for the session", () => {
-		expect(port).toBeGreaterThan(0);
-		expect(registrations.at(-1)?.id).toBe("auto-model-router");
+describe("embedded router: port selection", () => {
+	test("adopts the port models.yml advertises, so omp's pre-resolved handle is valid", () => {
+		expect(portOfLatestRegistration()).toBe(advertised);
+	});
+
+	test("the adopted port actually serves", async () => {
+		expect(await alive(advertised)).toBe(true);
 	});
 
-	test("the router answers on the port it registered", async () => {
-		expect(await alive(port)).toBe(true);
+	test("does NOT write its port into models.yml", () => {
+		// Persisting an ephemeral port makes it authoritative for the NEXT
+		// session's startup resolution, which is where the dead handle came from.
+		expect(readFileSync(modelsYmlPath, "utf8")).toBe(modelsYmlBefore);
 	});
 
+	test("publishes the port for subagents and the toast", () => {
+		const portFile = join(home, "embed.port");
+		expect(existsSync(portFile)).toBe(true);
+		expect(readFileSync(portFile, "utf8").trim()).toBe(String(advertised));
+	});
+});
+
+describe("embedded router: lifetime", () => {
 	test("registers NO session_shutdown teardown", () => {
-		// omp fires this from a throwaway host during provider refresh, so a
-		// teardown here kills a router the live session is still using.
+		// omp fires that from a throwaway host during provider refresh, so a
+		// teardown there kills a router the live session is still using.
 		expect(handlers.get("session_shutdown") ?? []).toHaveLength(0);
 	});
 
 	test("a session_shutdown leaves the router running", async () => {
 		await fire("session_shutdown", "session-one");
-		expect(await alive(port)).toBe(true);
+		expect(await alive(advertised)).toBe(true);
 	});
 
 	test("a second session reuses the same port instead of rebinding", async () => {
-		// Rebinding would take a different port and orphan every model handle omp
-		// had already resolved against the first one.
+		// Rebinding would take a different port and orphan every handle omp had
+		// already resolved against the first one.
 		await fire("session_start", "session-two");
-		const latest = Number.parseInt(/:(\d+)\//.exec(registrations.at(-1)?.baseUrl ?? "")?.[1] ?? "0", 10);
-		expect(latest).toBe(port);
-		expect(await alive(port)).toBe(true);
+		expect(portOfLatestRegistration()).toBe(advertised);
+		expect(await alive(advertised)).toBe(true);
 	});
 
 	test("each session still gets its own registration, so per-session tagging survives reuse", () => {

package/test/failover.test.ts

@@ -44,7 +44,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",

package/test/trust-attribution.test.ts

@@ -244,11 +244,11 @@ describe("v4 migration", () => {
 		}
 	});
 
-	test("schema is at user_version 13", () => {
+	test("schema is at user_version 14", () => {
 		const db = openDb(":memory:");
 		try {
 			const row = db.query("PRAGMA user_version").get() as { user_version: number };
-			expect(row.user_version).toBe(13);
+			expect(row.user_version).toBe(14);
 		} finally {
 			db.close();
 		}

package/test/trust-window.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { createLedger } from "../src/cost/ledger.ts";
+import type { LedgerEntry } from "../src/cost/types.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `filters.trustWindowDays` bounds the per-slug trust aggregate, which otherwise
+ * scans every row a model ever had — on every candidate, on every turn. Measured
+ * on a real ledger it grows from 0.8 ms at 9k rows to 11.6 ms at 75k, so it
+ * becomes a per-turn latency tax as history accumulates.
+ *
+ * It defaults to 0 (all-time) because narrowing it CHANGES ROUTING: smaller
+ * denominators move success rates, which moves the demotion guard. These tests
+ * pin both halves of that contract — off is byte-identical to the old behaviour,
+ * and on genuinely excludes old rows.
+ */
+
+const DAY = 86_400_000;
+
+function cfgWith(trustWindowDays: number) {
+	const cfg = structuredClone(DEFAULT_CONFIG);
+	cfg.filters.trustWindowDays = trustWindowDays;
+	cfg.ledger.path = ":memory:";
+	return cfg;
+}
+
+function entry(over: Partial<LedgerEntry>): LedgerEntry {
+	return {
+		id: crypto.randomUUID(),
+		createdAtMs: Date.now(),
+		conversationKey: "k",
+		sessionId: "s",
+		turn: 1,
+		requestedModel: "auto",
+		harnessId: "",
+		ompSessionId: "",
+		slug: "vendor/model",
+		servedSlug: "vendor/model",
+		tier: "simple",
+		classificationSource: "heuristic",
+		reasons: [],
+		features: null,
+		score: null,
+		confidence: null,
+		task: null,
+		classifierReasons: null,
+		exploredFrom: null,
+		holdArm: null,
+		predictedUsd: 0.001,
+		reportedUsd: 0.001,
+		usage: { promptTokens: 10, cachedTokens: 0, cacheWriteTokens: 0, completionTokens: 5, reasoningTokens: 0, images: 0 },
+		attempt: 0,
+		escalationSignal: null,
+		latencyMs: 100,
+		ttftMs: 50,
+		finishReason: "stop",
+		wasted: false,
+		upstreamGenerationId: null,
+		error: null,
+		errorKind: null,
+		promptTokensSaved: null,
+		...over,
+	} as LedgerEntry;
+}
+
+/** Old rows: half of them failures. Recent rows: all clean. */
+function seed(windowDays: number) {
+	const cfg = cfgWith(windowDays);
+	const db = openDb(":memory:");
+	const ledger = createLedger(db, cfg);
+	const now = Date.now();
+	for (let i = 0; i < 10; i++) {
+		ledger.record(
+			entry({
+				createdAtMs: now - 30 * DAY,
+				...(i % 2 === 0 ? { error: "server_error: boom", errorKind: "server_error" } : {}),
+			}),
+		);
+	}
+	for (let i = 0; i < 10; i++) ledger.record(entry({ createdAtMs: now - 1 * DAY }));
+	return { db, ledger, cfg };
+}
+
+describe("filters.trustWindowDays", () => {
+	test("0 means all-time: every row counts", () => {
+		const { db, ledger } = seed(0);
+		const trust = ledger.trust("vendor/model");
+		expect(trust?.attempts).toBe(20);
+		expect(trust?.errors).toBe(5);
+		db.close();
+	});
+
+	test("a window excludes rows older than it", () => {
+		const { db, ledger } = seed(7);
+		const trust = ledger.trust("vendor/model");
+		// Only the 10 recent, clean rows remain.
+		expect(trust?.attempts).toBe(10);
+		expect(trust?.errors).toBe(0);
+		db.close();
+	});
+
+	test("the window moves the success rate, which is why it is opt-in", () => {
+		const all = seed(0);
+		const windowed = seed(7);
+		const allTrust = all.ledger.trust("vendor/model");
+		const winTrust = windowed.ledger.trust("vendor/model");
+		expect(allTrust?.successRate).toBeLessThan(winTrust?.successRate ?? 0);
+		all.db.close();
+		windowed.db.close();
+	});
+
+	test("is read per call, so a hot-reloaded edit takes effect immediately", () => {
+		const { db, ledger, cfg } = seed(0);
+		expect(ledger.trust("vendor/model")?.attempts).toBe(20);
+		// Hot reload mutates the shared config object in place.
+		cfg.filters.trustWindowDays = 7;
+		expect(ledger.trust("vendor/model")?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("allTrust honours the same window", () => {
+		const { db, ledger } = seed(7);
+		const rows = ledger.allTrust();
+		expect(rows).toHaveLength(1);
+		expect(rows[0]?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("ships disabled, so the default install is unchanged", () => {
+		// DEFAULT_CONFIG, not loadConfig: loadConfig reads the machine's real
+		// config.yml, which has broken this suite before.
+		expect(DEFAULT_CONFIG.filters.trustWindowDays).toBe(0);
+	});
+});

package/test/turn.test.ts

@@ -45,7 +45,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",
@@ -583,6 +583,7 @@ describe("agentdox write-back sees the shape of the turn", () => {
 					records.push(rec);
 				},
 				flush: () => Promise.resolve(),
+				pruneBlocks: () => 0,
 				close: () => {},
 			},
 		};