auto-model-router 0.2.27 → 0.2.28

package/README.md

@@ -102,6 +102,29 @@ score nearly as well. If your workload needs a frontier model on hard turns,
 raise the tier price ceiling and `qualityExponent` — measured thresholds are in
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
+### Real-world — a week on the live ledger
+
+The suites above are small and clean. To measure the economics on *actual*
+usage we replayed a week of real omp traffic from the router's own ledger —
+**6 918 billed turns across 299 conversations, 7 days, 410:1 input-to-output,
+68% cache hit** — and repriced the identical token stream against a single Opus 5
+model with its own cache namespace.
+
+| | auto-model-router | Claude Opus 5 (single-model) |
+| --- | --- | --- |
+| Spend over the week | **$61.69** | $921.20 |
+| Per turn | **$0.0089** | $0.133 |
+| Extrapolated / month | **$263** | $3 932 |
+
+**≈15× cheaper, ~93% saved** — a four-figure monthly bill becomes a three-figure
+one. This baseline is deliberately conservative: one cache namespace, with each
+conversation's cache replayed on the real turn gaps. A naive like-for-like
+repricing at Opus rates reports ~31×, but on a single model the replayed context
+is cache reads at $0.50/MTok, so ≈15× is the number we stand behind. Unlike the
+core suite, sustained work on a large codebase is dominated by the conversation
+resent each turn rather than per-token price — exactly where a single frontier
+model gets expensive and routing's per-turn cache awareness pays off.
+
 ### Scope
 
 These are small, self-contained tasks of one to three files, solved in under 25
@@ -111,11 +134,6 @@ separates. The cost multiple varied between 14× and 32× across runs depending
 which task the baseline stalled on — treat "well over an order of magnitude" as
 the claim, not a specific figure.
 
-For sustained work on a large codebase the economics differ: cost there is
-dominated by the conversation being resent each turn rather than by per-token
-price. Replaying a week of real omp traffic (6 918 billed turns, 410:1
-input-to-output) against a single-model baseline gives **≈15×**.
-
 Harness, tasks and raw per-turn data:
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
@@ -666,13 +684,13 @@ and brief:
 ```bash
 export AGENTDOX_URL=http://localhost:3003
 export AGENTDOX_TOKEN=<pat with read+write on the scope>
-export AGENTDOX_SCOPE=ashlands        # fallback only; see below
+export AGENTDOX_SCOPE=myproject       # fallback only; see below
 ```
 
 Setting a URL and a token is enough to turn it on.
 
 The scope is **derived per workspace** from the directory basename
-(`E:/projects/ashlands` → `ashlands`), and that derivation wins. `AGENTDOX_SCOPE` /
+(`E:/projects/myproject` → `myproject`), and that derivation wins. `AGENTDOX_SCOPE` /
 `context.defaultScope` is only a fallback for workspaces it cannot resolve, because one router
 install serves every project on the machine — a slug pinned there would be sent for all of
 them, injecting one project's context into another's work. A single configured token also

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/config/defaults.ts

@@ -71,6 +71,11 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		// Shared trust by default: more samples, demotion guard stays effective
 		// even with a tiny guardrail-narrowed catalog.
 		trustScopedByHarness: false,
+		// 0 = all-time, the shipped behaviour. Reliability is slow-moving, so a
+		// wide sample is right on the merits; a window exists to bound the
+		// per-slug scan once history is large, and it changes routing, so it is
+		// opt-in after a replay run prices it.
+		trustWindowDays: 0,
 		contextHeadroom: 1.25,
 		// Latency scoring is off by default (weight 0): opt in after establishing a
 		// baseline. Expected total wait (TTFT + expected completion / throughput)

package/src/config/schema.ts

@@ -67,6 +67,7 @@ const filters = z.strictObject({
 	minTrust: z.number().min(0).max(1).optional(),
 	minTrustSamples: z.number().int().nonnegative().optional(),
 	trustScopedByHarness: z.boolean().optional(),
+	trustWindowDays: z.number().nonnegative().optional(),
 	contextHeadroom: z.number().positive().optional(),
 	latencyWeight: z.number().nonnegative().optional(),
 	latencyReferenceMs: z.number().positive().optional(),

package/src/config/types.ts

@@ -167,6 +167,22 @@ export interface FilterConfig {
 	 * to learn its own reliability.
 	 */
 	trustScopedByHarness: boolean;
+	/**
+	 * Only count ledger rows from the last N days toward model trust. 0 (the
+	 * default) keeps the all-time behaviour.
+	 *
+	 * Trust is deliberately all-time: reliability is slow-moving, and a wide
+	 * sample keeps the demotion guard stable. The cost is that the per-slug
+	 * trust aggregate scans every row a model ever had, and that runs for each
+	 * candidate on every turn — measured on a real ledger it grows from 0.8 ms at
+	 * 9k rows to 11.6 ms at 75k, i.e. it becomes a per-turn latency tax as
+	 * history accumulates. A window bounds that scan.
+	 *
+	 * Setting it CHANGES ROUTING (smaller denominators move success rates), so
+	 * price it on the ledger with `bun tools/replay.ts --set
+	 * filters.trustWindowDays=N` before enabling.
+	 */
+	trustWindowDays: number;
 	/**
 	 * Headroom multiplier applied to estimated prompt tokens when checking a
 	 * model's context window, absorbing token-estimate error and the response.

package/src/context/bridge.ts

@@ -212,6 +212,10 @@ export function createContextBridge(opts: BridgeOptions): ContextBridge {
 			await queue;
 		},
 
+		pruneBlocks(maxAgeMs: number) {
+			return store.prune(maxAgeMs);
+		},
+
 		close() {
 			closed = true;
 			pending.clear();
@@ -226,6 +230,7 @@ export function createDisabledBridge(): ContextBridge {
 		resolve: async () => null,
 		recordTurn: () => {},
 		flush: async () => {},
+		pruneBlocks: () => 0,
 		close: () => {},
 	};
 }

package/src/context/store.ts

@@ -42,7 +42,16 @@ export function createContextStore(db: Database): ContextBlockStore {
 		VALUES ($key, $scope, $sessionId, $createdAtMs)
 		ON CONFLICT(conversation_key) DO UPDATE SET session_id = excluded.session_id
 	`);
-	const deleteStale: Statement<unknown, [number]> = db.query("DELETE FROM context_blocks WHERE fetched_at_ms < ?");
+	// Age alone is the wrong test: a block older than the staleness TTL may still
+	// be PINNED by a live conversation, and deleting it forces that conversation
+	// to refetch and re-inject different bytes — a prompt-cache miss caused by
+	// housekeeping. Blocks are content-addressed and shared, so the safe set is
+	// "old AND referenced by no conversation".
+	const deleteStale: Statement<unknown, [number]> = db.query(`
+		DELETE FROM context_blocks
+		WHERE fetched_at_ms < ?
+		  AND version NOT IN (SELECT context_version FROM conversations WHERE context_version IS NOT NULL)
+	`);
 
 	return {
 		get(version) {

package/src/context/types.ts

@@ -77,6 +77,13 @@ export interface ContextBridge {
 	recordTurn(rec: TurnRecord): void;
 	/** Drains the write queue. For tests and shutdown. */
 	flush(): Promise<void>;
+	/**
+	 * Housekeeping: drops stored blocks older than `maxAgeMs` that no
+	 * conversation still pins, returning the count removed. Blocks are
+	 * content-addressed and shared, so nothing else reclaims them — without this
+	 * the table grows for the life of the install.
+	 */
+	pruneBlocks(maxAgeMs: number): number;
 	close(): void;
 }
 
@@ -87,5 +94,11 @@ export interface ContextBlockStore {
 	/** agentdox session id previously opened for a conversation. */
 	sessionFor(conversationKey: string): string | null;
 	bindSession(conversationKey: string, scope: string, sessionId: string): void;
+	/**
+	 * Drops blocks older than `maxAgeMs` that NO conversation still pins.
+	 * Returns the number removed. Referenced blocks are kept regardless of age:
+	 * deleting one would force a live conversation to refetch and re-inject
+	 * different bytes, turning housekeeping into a prompt-cache miss.
+	 */
 	prune(maxAgeMs: number): number;
 }

package/src/cost/ledger.ts

@@ -22,6 +22,7 @@ import type { BlendedRate, Ledger, LedgerEntry, ModelLatency, ModelTrust, UsageC
 
 /** Estimates below this many samples are noise; the default ratio is better. */
 const MIN_CALIBRATION_SAMPLES = 20;
+const DAY_MS = 86_400_000;
 
 // Row shapes below are fixed by our own schema in util/sqlite.ts.
 interface LedgerRow {
@@ -243,9 +244,12 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 	const spendSinceHarnessStmt = db.query(
 		"SELECT COALESCE(SUM(COALESCE(reported_usd, predicted_usd)), 0) AS total FROM ledger WHERE created_at_ms >= ? AND harness_id = ?",
 	);
-	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ?`);
-	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ?`);
-	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger GROUP BY slug`);
+	// `created_at_ms > ?` is always present, with a cutoff of 0 meaning all-time.
+	// One statement shape rather than two keeps the plan (and the index it uses,
+	// idx_ledger_slug_created) identical whether or not a window is configured.
+	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND created_at_ms > ?`);
+	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ? AND created_at_ms > ?`);
+	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger WHERE created_at_ms > ? GROUP BY slug`);
 	const latencyStmt = db.query(
 		`SELECT ${LATENCY_SELECT} FROM (SELECT * FROM ledger WHERE slug = ? ORDER BY created_at_ms DESC LIMIT ${LATENCY_WINDOW_ROWS})`,
 	);
@@ -349,16 +353,21 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 		},
 
 		trust(slug: string, harnessId?: string): ModelTrust | null {
+			// Read the window at CALL time, not at construction: hot reload mutates
+			// the shared config object in place, so a pinned value would ignore an
+			// edit until restart. 0 => cutoff 0 => every row qualifies.
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
 			const row =
 				harnessId !== undefined && harnessId !== ""
-					? (trustHarnessStmt.get(slug, harnessId) as TrustRow | null)
-					: (trustStmt.get(slug) as TrustRow | null);
+					? (trustHarnessStmt.get(slug, harnessId, cutoff) as TrustRow | null)
+					: (trustStmt.get(slug, cutoff) as TrustRow | null);
 			if (row === null || row.attempts === 0) return null;
 			return toTrust(slug, row);
 		},
 
 		allTrust(): ModelTrust[] {
-			const rows = allTrustStmt.all() as (TrustRow & { slug: string })[];
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
+			const rows = allTrustStmt.all(cutoff) as (TrustRow & { slug: string })[];
 			return rows.map((row) => toTrust(row.slug, row));
 		},
 

package/src/server/http.ts

@@ -218,6 +218,8 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		log.warn("initial catalog fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	});
 
+	// One housekeeping timer for both tables. `unref`'d so it never holds the
+	// process open.
 	const pruneTimer = setInterval(() => {
 		try {
 			const dropped = conversations.prune(cfg.ledger.conversationTtlMs);
@@ -225,6 +227,16 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		} catch (err) {
 			log.warn("conversation prune failed", { error: err instanceof Error ? err.message : String(err) });
 		}
+		try {
+			// Past the staleness TTL every pin refreshes anyway, so an unreferenced
+			// block of that age has no future reader. Nothing else reclaims these:
+			// blocks are content-addressed and shared, so they accumulated for the
+			// life of the install (measured: 220 rows / 2.7 MB, 68 unreferenced).
+			const dropped = context.pruneBlocks(cfg.context.maxStalenessMs);
+			if (dropped > 0) log.debug("pruned unreferenced context blocks", { dropped });
+		} catch (err) {
+			log.warn("context block prune failed", { error: err instanceof Error ? err.message : String(err) });
+		}
 	}, 60_000);
 	pruneTimer.unref();
 

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 13;
+const USER_VERSION = 14;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -71,6 +71,11 @@ CREATE TABLE IF NOT EXISTS ledger (
 CREATE INDEX IF NOT EXISTS idx_ledger_conversation ON ledger (conversation_key);
 CREATE INDEX IF NOT EXISTS idx_ledger_created ON ledger (created_at_ms);
 CREATE INDEX IF NOT EXISTS idx_ledger_slug ON ledger (slug);
+-- Per-slug newest-first reads: the latency window (newest N rows for one slug)
+-- and any windowed trust. With only idx_ledger_slug those sorted every row the
+-- slug ever had; measured on a real ledger, the latency statement went from
+-- 5-10ms and RISING with history to a flat 0.04-0.08ms.
+CREATE INDEX IF NOT EXISTS idx_ledger_slug_created ON ledger (slug, created_at_ms DESC);
 
 CREATE TABLE IF NOT EXISTS token_calibration (
   tokenizer TEXT PRIMARY KEY,
@@ -230,6 +235,11 @@ ALTER TABLE conversations ADD COLUMN compaction_plan TEXT;
 // is on. Another new table via the idempotent MIGRATIONS block; version bump
 // only, no ALTER guard.
 
+// v14: idx_ledger_slug_created (slug, created_at_ms DESC) serves the per-slug
+// newest-first reads — the latency window, and trust when filters.trustWindowDays
+// is set. Created idempotently by the MIGRATIONS block above, so the version bump
+// alone records it; no ALTER guard needed.
+
 export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });

package/test/context-prune.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, test } from "bun:test";
+
+import { createContextStore } from "../src/context/store.ts";
+import { createConversationStore } from "../src/router/state.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `context_blocks` is content-addressed and shared between conversations, so
+ * nothing reclaims a block when the conversation that fetched it goes away.
+ * Until the prune below was wired into the server's housekeeping timer the table
+ * grew for the life of the install (measured on a real install: 220 rows /
+ * 2.7 MB, 68 of them referenced by nothing).
+ *
+ * Age alone is the wrong test, though: a block past the staleness TTL may still
+ * be PINNED, and deleting it forces that conversation to refetch and inject
+ * different bytes — housekeeping causing a prompt-cache miss. So the safe set is
+ * "old AND unreferenced".
+ */
+describe("context block prune", () => {
+	const HOUR = 3_600_000;
+
+	function seed() {
+		const db = openDb(":memory:");
+		const blocks = createContextStore(db);
+		const conversations = createConversationStore(db);
+		const now = Date.now();
+
+		blocks.put("scope", { version: "old-pinned", block: "A", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "old-orphan", block: "B", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "fresh-orphan", block: "C", fetchedAtMs: now });
+
+		// One live conversation still pins `old-pinned`.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "old-pinned";
+		state.contextFetchedAtMs = now - 5 * HOUR;
+		conversations.save(state);
+
+		return { db, blocks };
+	}
+
+	test("drops an old block that nothing references", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.get("old-orphan")).toBeNull();
+		db.close();
+	});
+
+	test("keeps an old block a conversation still pins", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		// Deleting this one would cost that conversation its warm prefix.
+		expect(blocks.get("old-pinned")?.block).toBe("A");
+		db.close();
+	});
+
+	test("keeps a block younger than the age cutoff", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+
+	test("is a no-op once the unreferenced blocks are gone", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.prune(HOUR)).toBe(0);
+		db.close();
+	});
+
+	test("reclaims a block as soon as its last pin is dropped", () => {
+		const { db, blocks } = seed();
+		const conversations = createConversationStore(db);
+		// The conversation moves to a new context version (a refresh), which is
+		// what leaves the old block orphaned in production.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "fresh-orphan";
+		conversations.save(state);
+
+		expect(blocks.prune(HOUR)).toBe(2); // old-pinned is now unreferenced too
+		expect(blocks.get("old-pinned")).toBeNull();
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+});

package/test/failover.test.ts

@@ -44,7 +44,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",

package/test/trust-attribution.test.ts

@@ -244,11 +244,11 @@ describe("v4 migration", () => {
 		}
 	});
 
-	test("schema is at user_version 13", () => {
+	test("schema is at user_version 14", () => {
 		const db = openDb(":memory:");
 		try {
 			const row = db.query("PRAGMA user_version").get() as { user_version: number };
-			expect(row.user_version).toBe(13);
+			expect(row.user_version).toBe(14);
 		} finally {
 			db.close();
 		}

package/test/trust-window.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { createLedger } from "../src/cost/ledger.ts";
+import type { LedgerEntry } from "../src/cost/types.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `filters.trustWindowDays` bounds the per-slug trust aggregate, which otherwise
+ * scans every row a model ever had — on every candidate, on every turn. Measured
+ * on a real ledger it grows from 0.8 ms at 9k rows to 11.6 ms at 75k, so it
+ * becomes a per-turn latency tax as history accumulates.
+ *
+ * It defaults to 0 (all-time) because narrowing it CHANGES ROUTING: smaller
+ * denominators move success rates, which moves the demotion guard. These tests
+ * pin both halves of that contract — off is byte-identical to the old behaviour,
+ * and on genuinely excludes old rows.
+ */
+
+const DAY = 86_400_000;
+
+function cfgWith(trustWindowDays: number) {
+	const cfg = structuredClone(DEFAULT_CONFIG);
+	cfg.filters.trustWindowDays = trustWindowDays;
+	cfg.ledger.path = ":memory:";
+	return cfg;
+}
+
+function entry(over: Partial<LedgerEntry>): LedgerEntry {
+	return {
+		id: crypto.randomUUID(),
+		createdAtMs: Date.now(),
+		conversationKey: "k",
+		sessionId: "s",
+		turn: 1,
+		requestedModel: "auto",
+		harnessId: "",
+		ompSessionId: "",
+		slug: "vendor/model",
+		servedSlug: "vendor/model",
+		tier: "simple",
+		classificationSource: "heuristic",
+		reasons: [],
+		features: null,
+		score: null,
+		confidence: null,
+		task: null,
+		classifierReasons: null,
+		exploredFrom: null,
+		holdArm: null,
+		predictedUsd: 0.001,
+		reportedUsd: 0.001,
+		usage: { promptTokens: 10, cachedTokens: 0, cacheWriteTokens: 0, completionTokens: 5, reasoningTokens: 0, images: 0 },
+		attempt: 0,
+		escalationSignal: null,
+		latencyMs: 100,
+		ttftMs: 50,
+		finishReason: "stop",
+		wasted: false,
+		upstreamGenerationId: null,
+		error: null,
+		errorKind: null,
+		promptTokensSaved: null,
+		...over,
+	} as LedgerEntry;
+}
+
+/** Old rows: half of them failures. Recent rows: all clean. */
+function seed(windowDays: number) {
+	const cfg = cfgWith(windowDays);
+	const db = openDb(":memory:");
+	const ledger = createLedger(db, cfg);
+	const now = Date.now();
+	for (let i = 0; i < 10; i++) {
+		ledger.record(
+			entry({
+				createdAtMs: now - 30 * DAY,
+				...(i % 2 === 0 ? { error: "server_error: boom", errorKind: "server_error" } : {}),
+			}),
+		);
+	}
+	for (let i = 0; i < 10; i++) ledger.record(entry({ createdAtMs: now - 1 * DAY }));
+	return { db, ledger, cfg };
+}
+
+describe("filters.trustWindowDays", () => {
+	test("0 means all-time: every row counts", () => {
+		const { db, ledger } = seed(0);
+		const trust = ledger.trust("vendor/model");
+		expect(trust?.attempts).toBe(20);
+		expect(trust?.errors).toBe(5);
+		db.close();
+	});
+
+	test("a window excludes rows older than it", () => {
+		const { db, ledger } = seed(7);
+		const trust = ledger.trust("vendor/model");
+		// Only the 10 recent, clean rows remain.
+		expect(trust?.attempts).toBe(10);
+		expect(trust?.errors).toBe(0);
+		db.close();
+	});
+
+	test("the window moves the success rate, which is why it is opt-in", () => {
+		const all = seed(0);
+		const windowed = seed(7);
+		const allTrust = all.ledger.trust("vendor/model");
+		const winTrust = windowed.ledger.trust("vendor/model");
+		expect(allTrust?.successRate).toBeLessThan(winTrust?.successRate ?? 0);
+		all.db.close();
+		windowed.db.close();
+	});
+
+	test("is read per call, so a hot-reloaded edit takes effect immediately", () => {
+		const { db, ledger, cfg } = seed(0);
+		expect(ledger.trust("vendor/model")?.attempts).toBe(20);
+		// Hot reload mutates the shared config object in place.
+		cfg.filters.trustWindowDays = 7;
+		expect(ledger.trust("vendor/model")?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("allTrust honours the same window", () => {
+		const { db, ledger } = seed(7);
+		const rows = ledger.allTrust();
+		expect(rows).toHaveLength(1);
+		expect(rows[0]?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("ships disabled, so the default install is unchanged", () => {
+		// DEFAULT_CONFIG, not loadConfig: loadConfig reads the machine's real
+		// config.yml, which has broken this suite before.
+		expect(DEFAULT_CONFIG.filters.trustWindowDays).toBe(0);
+	});
+});

package/test/turn.test.ts

@@ -45,7 +45,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",
@@ -583,6 +583,7 @@ describe("agentdox write-back sees the shape of the turn", () => {
 					records.push(rec);
 				},
 				flush: () => Promise.resolve(),
+				pruneBlocks: () => 0,
 				close: () => {},
 			},
 		};