auto-model-router 0.2.27 → 0.2.29

package/CLAUDE.md

@@ -119,8 +119,9 @@ read/write client is `src/context/agentdox.ts` (assemble / createSession / appen
 Beyond consuming agentdox as an agent, `src/context/` is the **router↔agentdox bridge**: it
 injects shared project context into every routed turn and records turns back, attributed to
 the model that served them. See `docs/AGENTDOX-BRIDGE.md` for the current state, how to run
-it, and the open issue. Design rationale lives in
-`E:/projects/agentdox/docs/architecture/router-context-bridge.md`.
+it, and the open issue. Design rationale is the **decision log in the agentdox project brief**
+for scope `omp-router` (read it with `context_brief`) — the bridge decisions and the evidence
+behind them are recorded there as they are made.
 
 Turning the bridge on for the router itself (distinct from the MCP wiring above):
 

package/README.md

@@ -102,6 +102,29 @@ score nearly as well. If your workload needs a frontier model on hard turns,
 raise the tier price ceiling and `qualityExponent` — measured thresholds are in
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
+### Real-world — a week on the live ledger
+
+The suites above are small and clean. To measure the economics on *actual*
+usage we replayed a week of real omp traffic from the router's own ledger —
+**6 918 billed turns across 299 conversations, 7 days, 410:1 input-to-output,
+68% cache hit** — and repriced the identical token stream against a single Opus 5
+model with its own cache namespace.
+
+| | auto-model-router | Claude Opus 5 (single-model) |
+| --- | --- | --- |
+| Spend over the week | **$61.69** | $921.20 |
+| Per turn | **$0.0089** | $0.133 |
+| Extrapolated / month | **$263** | $3 932 |
+
+**≈15× cheaper, ~93% saved** — a four-figure monthly bill becomes a three-figure
+one. This baseline is deliberately conservative: one cache namespace, with each
+conversation's cache replayed on the real turn gaps. A naive like-for-like
+repricing at Opus rates reports ~31×, but on a single model the replayed context
+is cache reads at $0.50/MTok, so ≈15× is the number we stand behind. Unlike the
+core suite, sustained work on a large codebase is dominated by the conversation
+resent each turn rather than per-token price — exactly where a single frontier
+model gets expensive and routing's per-turn cache awareness pays off.
+
 ### Scope
 
 These are small, self-contained tasks of one to three files, solved in under 25
@@ -111,11 +134,6 @@ separates. The cost multiple varied between 14× and 32× across runs depending
 which task the baseline stalled on — treat "well over an order of magnitude" as
 the claim, not a specific figure.
 
-For sustained work on a large codebase the economics differ: cost there is
-dominated by the conversation being resent each turn rather than by per-token
-price. Replaying a week of real omp traffic (6 918 billed turns, 410:1
-input-to-output) against a single-model baseline gives **≈15×**.
-
 Harness, tasks and raw per-turn data:
 [`docs/routing-benchmark-findings.md`](docs/routing-benchmark-findings.md).
 
@@ -659,20 +677,20 @@ has none of the project knowledge the last one built up. Because every harness
 routes through this one provider, the router is the single place that can fix
 that for all of them at once.
 
-Point it at an [agentdox](https://github.com/…/agentdox) server and every turn —
+Point it at an [agentdox](https://github.com/drewappling/agentdox) server and every turn —
 whatever model wins the routing decision — carries the same project memory, docs,
 and brief:
 
 ```bash
 export AGENTDOX_URL=http://localhost:3003
 export AGENTDOX_TOKEN=<pat with read+write on the scope>
-export AGENTDOX_SCOPE=ashlands        # fallback only; see below
+export AGENTDOX_SCOPE=myproject       # fallback only; see below
 ```
 
 Setting a URL and a token is enough to turn it on.
 
 The scope is **derived per workspace** from the directory basename
-(`E:/projects/ashlands` → `ashlands`), and that derivation wins. `AGENTDOX_SCOPE` /
+(`E:/projects/myproject` → `myproject`), and that derivation wins. `AGENTDOX_SCOPE` /
 `context.defaultScope` is only a fallback for workspaces it cannot resolve, because one router
 install serves every project on the machine — a slug pinned there would be sent for all of
 them, injecting one project's context into another's work. A single configured token also
@@ -726,8 +744,9 @@ not a dependency. If it is unreachable the turn routes and dispatches normally,
 and a pinned block keeps being served.
 
 `GET /health` reports the bridge's URL, default scope, and `recordTurns` — never
-the token. Design notes: `docs/architecture/router-context-bridge.md` in the
-agentdox repo. Live check: `bun tools/agentdox-e2e.ts`.
+the token. Design notes: [`docs/AGENTDOX-BRIDGE.md`](docs/AGENTDOX-BRIDGE.md).
+Server side: the [agentdox repo](https://github.com/drewappling/agentdox).
+Live check: `bun tools/agentdox-e2e.ts`.
 
 ---
 

package/docs/AGENTDOX-BRIDGE.md

@@ -1,10 +1,11 @@
 # agentdox bridge — handoff
 
-**Status:** implemented, typechecks clean, 439 tests pass, injection verified end-to-end
+**Status:** implemented, typechecks clean, 502 tests pass, injection verified end-to-end
 through omp. The write-back faults in §5 and §6 are **fixed**; `context.recordTurns` is on.
 
-Design rationale (why it is built this way):
-`E:/projects/agentdox/docs/architecture/router-context-bridge.md`.
+Design rationale (why it is built this way) is the decision log in the agentdox project
+brief for scope `omp-router` — read it with `context_brief`. The agentdox server itself:
+[github.com/drewappling/agentdox](https://github.com/drewappling/agentdox).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/config/defaults.ts

@@ -71,6 +71,11 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		// Shared trust by default: more samples, demotion guard stays effective
 		// even with a tiny guardrail-narrowed catalog.
 		trustScopedByHarness: false,
+		// 0 = all-time, the shipped behaviour. Reliability is slow-moving, so a
+		// wide sample is right on the merits; a window exists to bound the
+		// per-slug scan once history is large, and it changes routing, so it is
+		// opt-in after a replay run prices it.
+		trustWindowDays: 0,
 		contextHeadroom: 1.25,
 		// Latency scoring is off by default (weight 0): opt in after establishing a
 		// baseline. Expected total wait (TTFT + expected completion / throughput)
@@ -93,6 +98,10 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		toolAxis: "coding",
 		chatAxis: "intelligence",
 		agenticLoopDepth: 3,
+		// Shipped values, unchanged. See ClassifierConfig.reasoningWeights: a
+		// harness that pins the level for a whole session turns these into a
+		// constant tier offset, in which case `medium` belongs near 0.
+		reasoningWeights: { medium: 0.14, high: 0.24, xhigh: 0.3, max: 0.34 },
 	},
 	escalation: {
 		enabled: true,

package/src/config/schema.ts

@@ -67,6 +67,7 @@ const filters = z.strictObject({
 	minTrust: z.number().min(0).max(1).optional(),
 	minTrustSamples: z.number().int().nonnegative().optional(),
 	trustScopedByHarness: z.boolean().optional(),
+	trustWindowDays: z.number().nonnegative().optional(),
 	contextHeadroom: z.number().positive().optional(),
 	latencyWeight: z.number().nonnegative().optional(),
 	latencyReferenceMs: z.number().positive().optional(),
@@ -84,6 +85,14 @@ const classifier = z.strictObject({
 	toolAxis: qualityAxis.optional(),
 	chatAxis: qualityAxis.optional(),
 	agenticLoopDepth: z.number().int().nonnegative().optional(),
+	reasoningWeights: z
+		.strictObject({
+			medium: z.number().nonnegative().optional(),
+			high: z.number().nonnegative().optional(),
+			xhigh: z.number().nonnegative().optional(),
+			max: z.number().nonnegative().optional(),
+		})
+		.optional(),
 });
 
 const escalation = z.strictObject({

package/src/config/types.ts

@@ -167,6 +167,22 @@ export interface FilterConfig {
 	 * to learn its own reliability.
 	 */
 	trustScopedByHarness: boolean;
+	/**
+	 * Only count ledger rows from the last N days toward model trust. 0 (the
+	 * default) keeps the all-time behaviour.
+	 *
+	 * Trust is deliberately all-time: reliability is slow-moving, and a wide
+	 * sample keeps the demotion guard stable. The cost is that the per-slug
+	 * trust aggregate scans every row a model ever had, and that runs for each
+	 * candidate on every turn — measured on a real ledger it grows from 0.8 ms at
+	 * 9k rows to 11.6 ms at 75k, i.e. it becomes a per-turn latency tax as
+	 * history accumulates. A window bounds that scan.
+	 *
+	 * Setting it CHANGES ROUTING (smaller denominators move success rates), so
+	 * price it on the ledger with `bun tools/replay.ts --set
+	 * filters.trustWindowDays=N` before enabling.
+	 */
+	trustWindowDays: number;
 	/**
 	 * Headroom multiplier applied to estimated prompt tokens when checking a
 	 * model's context window, absorbing token-estimate error and the response.
@@ -213,6 +229,28 @@ export interface ClassifierConfig {
 	chatAxis: QualityAxis;
 	/** Tool-loop depth above which the agentic axis takes over. */
 	agenticLoopDepth: number;
+	/**
+	 * Score added when the CLIENT asks for a reasoning effort, per level. The
+	 * premise is that asking for reasoning states expected difficulty directly.
+	 *
+	 * That premise fails when a harness sets the level once for a whole session:
+	 * a constant cannot discriminate difficulty between turns, but it still
+	 * shifts every turn's score. Measured on a live day: the requested level
+	 * never changed within 111 of 115 conversations, `medium` (+0.14, over half
+	 * of a 0.25-wide tier band) rode on 41.6% of dispatches, and 64 of 119
+	 * `hard` dispatches reached that tier ONLY because of it — $6.66 billed
+	 * against $0.16 for the same tokens on the moderate pick.
+	 *
+	 * Tune per deployment: a harness that raises the level deliberately for hard
+	 * turns wants these weights, one that pins it session-wide wants `medium`
+	 * near zero. Defaults preserve the shipped behaviour.
+	 */
+	reasoningWeights: {
+		medium: number;
+		high: number;
+		xhigh: number;
+		max: number;
+	};
 }
 
 export interface EscalationConfig {

package/src/context/bridge.ts

@@ -212,6 +212,10 @@ export function createContextBridge(opts: BridgeOptions): ContextBridge {
 			await queue;
 		},
 
+		pruneBlocks(maxAgeMs: number) {
+			return store.prune(maxAgeMs);
+		},
+
 		close() {
 			closed = true;
 			pending.clear();
@@ -226,6 +230,7 @@ export function createDisabledBridge(): ContextBridge {
 		resolve: async () => null,
 		recordTurn: () => {},
 		flush: async () => {},
+		pruneBlocks: () => 0,
 		close: () => {},
 	};
 }

package/src/context/store.ts

@@ -42,7 +42,16 @@ export function createContextStore(db: Database): ContextBlockStore {
 		VALUES ($key, $scope, $sessionId, $createdAtMs)
 		ON CONFLICT(conversation_key) DO UPDATE SET session_id = excluded.session_id
 	`);
-	const deleteStale: Statement<unknown, [number]> = db.query("DELETE FROM context_blocks WHERE fetched_at_ms < ?");
+	// Age alone is the wrong test: a block older than the staleness TTL may still
+	// be PINNED by a live conversation, and deleting it forces that conversation
+	// to refetch and re-inject different bytes — a prompt-cache miss caused by
+	// housekeeping. Blocks are content-addressed and shared, so the safe set is
+	// "old AND referenced by no conversation".
+	const deleteStale: Statement<unknown, [number]> = db.query(`
+		DELETE FROM context_blocks
+		WHERE fetched_at_ms < ?
+		  AND version NOT IN (SELECT context_version FROM conversations WHERE context_version IS NOT NULL)
+	`);
 
 	return {
 		get(version) {

package/src/context/types.ts

@@ -77,6 +77,13 @@ export interface ContextBridge {
 	recordTurn(rec: TurnRecord): void;
 	/** Drains the write queue. For tests and shutdown. */
 	flush(): Promise<void>;
+	/**
+	 * Housekeeping: drops stored blocks older than `maxAgeMs` that no
+	 * conversation still pins, returning the count removed. Blocks are
+	 * content-addressed and shared, so nothing else reclaims them — without this
+	 * the table grows for the life of the install.
+	 */
+	pruneBlocks(maxAgeMs: number): number;
 	close(): void;
 }
 
@@ -87,5 +94,11 @@ export interface ContextBlockStore {
 	/** agentdox session id previously opened for a conversation. */
 	sessionFor(conversationKey: string): string | null;
 	bindSession(conversationKey: string, scope: string, sessionId: string): void;
+	/**
+	 * Drops blocks older than `maxAgeMs` that NO conversation still pins.
+	 * Returns the number removed. Referenced blocks are kept regardless of age:
+	 * deleting one would force a live conversation to refetch and re-inject
+	 * different bytes, turning housekeeping into a prompt-cache miss.
+	 */
 	prune(maxAgeMs: number): number;
 }

package/src/cost/ledger.ts

@@ -22,6 +22,7 @@ import type { BlendedRate, Ledger, LedgerEntry, ModelLatency, ModelTrust, UsageC
 
 /** Estimates below this many samples are noise; the default ratio is better. */
 const MIN_CALIBRATION_SAMPLES = 20;
+const DAY_MS = 86_400_000;
 
 // Row shapes below are fixed by our own schema in util/sqlite.ts.
 interface LedgerRow {
@@ -243,9 +244,12 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 	const spendSinceHarnessStmt = db.query(
 		"SELECT COALESCE(SUM(COALESCE(reported_usd, predicted_usd)), 0) AS total FROM ledger WHERE created_at_ms >= ? AND harness_id = ?",
 	);
-	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ?`);
-	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ?`);
-	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger GROUP BY slug`);
+	// `created_at_ms > ?` is always present, with a cutoff of 0 meaning all-time.
+	// One statement shape rather than two keeps the plan (and the index it uses,
+	// idx_ledger_slug_created) identical whether or not a window is configured.
+	const trustStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND created_at_ms > ?`);
+	const trustHarnessStmt = db.query(`SELECT ${TRUST_SELECT} FROM ledger WHERE slug = ? AND harness_id = ? AND created_at_ms > ?`);
+	const allTrustStmt = db.query(`SELECT slug, ${TRUST_SELECT} FROM ledger WHERE created_at_ms > ? GROUP BY slug`);
 	const latencyStmt = db.query(
 		`SELECT ${LATENCY_SELECT} FROM (SELECT * FROM ledger WHERE slug = ? ORDER BY created_at_ms DESC LIMIT ${LATENCY_WINDOW_ROWS})`,
 	);
@@ -349,16 +353,21 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 		},
 
 		trust(slug: string, harnessId?: string): ModelTrust | null {
+			// Read the window at CALL time, not at construction: hot reload mutates
+			// the shared config object in place, so a pinned value would ignore an
+			// edit until restart. 0 => cutoff 0 => every row qualifies.
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
 			const row =
 				harnessId !== undefined && harnessId !== ""
-					? (trustHarnessStmt.get(slug, harnessId) as TrustRow | null)
-					: (trustStmt.get(slug) as TrustRow | null);
+					? (trustHarnessStmt.get(slug, harnessId, cutoff) as TrustRow | null)
+					: (trustStmt.get(slug, cutoff) as TrustRow | null);
 			if (row === null || row.attempts === 0) return null;
 			return toTrust(slug, row);
 		},
 
 		allTrust(): ModelTrust[] {
-			const rows = allTrustStmt.all() as (TrustRow & { slug: string })[];
+			const cutoff = cfg.filters.trustWindowDays > 0 ? Date.now() - cfg.filters.trustWindowDays * DAY_MS : 0;
+			const rows = allTrustStmt.all(cutoff) as (TrustRow & { slug: string })[];
 			return rows.map((row) => toTrust(row.slug, row));
 		},
 

package/src/router/classify.ts

@@ -76,17 +76,24 @@ const W_TOOLS_OFFERED = 0.03;
 /** Score bucket boundaries: [trivial, simple, moderate, hard]. */
 const BOUNDARIES: readonly [number, number, number] = [0.25, 0.5, 0.75];
 
-/** A client that asks for reasoning is stating expected difficulty directly. */
-function reasoningWeight(level: ReasoningLevel | undefined): number {
+/**
+ * Score for a client-stated reasoning effort. The premise is that asking for
+ * reasoning states expected difficulty — true when a harness raises the level
+ * for a hard turn, false when it pins one level for the whole session, where the
+ * "signal" is a constant that lifts every turn's score. Weights are therefore
+ * configurable per deployment; see ClassifierConfig.reasoningWeights.
+ */
+function reasoningWeight(level: ReasoningLevel | undefined, cfg: RouterConfig): number {
+	const w = cfg.classifier.reasoningWeights;
 	switch (level) {
 		case "medium":
-			return 0.14;
+			return w.medium;
 		case "high":
-			return 0.24;
+			return w.high;
 		case "xhigh":
-			return 0.3;
+			return w.xhigh;
 		case "max":
-			return 0.34;
+			return w.max;
 		default:
 			// off/minimal/low/undefined: no stated difficulty above the baseline.
 			return 0;
@@ -113,7 +120,7 @@ export function scoreHeuristic(f: Features, cfg: RouterConfig): Classification {
 	);
 	if (f.lastToolFailed) add(W_TOOL_FAILED, "last tool result failed");
 	if (f.circularToolCall) add(W_CIRCULAR_LOOP, "circular tool call (re-issued a prior call; stuck)");
-	const rw = reasoningWeight(f.requestedReasoning);
+	const rw = reasoningWeight(f.requestedReasoning, cfg);
 	if (rw > 0) add(rw, `client requested reasoning=${f.requestedReasoning ?? ""}`);
 	if (f.isTerseInstruction) add(W_TERSE, "terse instruction");
 	add(Math.min(f.codeBlocks * W_CODE_BLOCK, CAP_CODE), `${f.codeBlocks} code block(s) in new content`);

package/src/server/http.ts

@@ -218,6 +218,8 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		log.warn("initial catalog fetch failed", { error: err instanceof Error ? err.message : String(err) });
 	});
 
+	// One housekeeping timer for both tables. `unref`'d so it never holds the
+	// process open.
 	const pruneTimer = setInterval(() => {
 		try {
 			const dropped = conversations.prune(cfg.ledger.conversationTtlMs);
@@ -225,6 +227,16 @@ export function startServer(cfg: RouterConfig): StartedServer {
 		} catch (err) {
 			log.warn("conversation prune failed", { error: err instanceof Error ? err.message : String(err) });
 		}
+		try {
+			// Past the staleness TTL every pin refreshes anyway, so an unreferenced
+			// block of that age has no future reader. Nothing else reclaims these:
+			// blocks are content-addressed and shared, so they accumulated for the
+			// life of the install (measured: 220 rows / 2.7 MB, 68 unreferenced).
+			const dropped = context.pruneBlocks(cfg.context.maxStalenessMs);
+			if (dropped > 0) log.debug("pruned unreferenced context blocks", { dropped });
+		} catch (err) {
+			log.warn("context block prune failed", { error: err instanceof Error ? err.message : String(err) });
+		}
 	}, 60_000);
 	pruneTimer.unref();
 

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 13;
+const USER_VERSION = 14;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -71,6 +71,11 @@ CREATE TABLE IF NOT EXISTS ledger (
 CREATE INDEX IF NOT EXISTS idx_ledger_conversation ON ledger (conversation_key);
 CREATE INDEX IF NOT EXISTS idx_ledger_created ON ledger (created_at_ms);
 CREATE INDEX IF NOT EXISTS idx_ledger_slug ON ledger (slug);
+-- Per-slug newest-first reads: the latency window (newest N rows for one slug)
+-- and any windowed trust. With only idx_ledger_slug those sorted every row the
+-- slug ever had; measured on a real ledger, the latency statement went from
+-- 5-10ms and RISING with history to a flat 0.04-0.08ms.
+CREATE INDEX IF NOT EXISTS idx_ledger_slug_created ON ledger (slug, created_at_ms DESC);
 
 CREATE TABLE IF NOT EXISTS token_calibration (
   tokenizer TEXT PRIMARY KEY,
@@ -230,6 +235,11 @@ ALTER TABLE conversations ADD COLUMN compaction_plan TEXT;
 // is on. Another new table via the idempotent MIGRATIONS block; version bump
 // only, no ALTER guard.
 
+// v14: idx_ledger_slug_created (slug, created_at_ms DESC) serves the per-slug
+// newest-first reads — the latency window, and trust when filters.trustWindowDays
+// is set. Created idempotently by the MIGRATIONS block above, so the version bump
+// alone records it; no ALTER guard needed.
+
 export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });

package/test/classify.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
 import { loadConfig } from "../src/config/load.ts";
 import type { RouterConfig } from "../src/config/types.ts";
 import { classify, classifyTask, pickQualityAxis, scoreHeuristic } from "../src/router/classify.ts";
@@ -178,6 +179,35 @@ describe("scoreHeuristic", () => {
 		expect(thinking.score).toBeGreaterThan(plain.score);
 	});
 
+	test("the reasoning weight is configurable, so a session-wide level can be discounted", () => {
+		// A harness that pins one reasoning level for a whole session turns this
+		// "signal" into a constant that lifts every turn's score. Measured live:
+		// the level never changed within 111 of 115 conversations, and 64 of 119
+		// hard dispatches reached that tier ONLY via the weight — $6.66 billed
+		// against $0.16 for the same tokens on the moderate pick.
+		//
+		// DEFAULT_CONFIG, not BASE: BASE is loadConfig({}), which reads this
+		// machine's real config.yml, and this assertion is about shipped values.
+		const features = extractFeatures(
+			parseChatRequest(
+				{ model: "auto", tools: TOOLS, reasoning_effort: "medium", messages: [SYSTEM, { role: "user", content: "tidy this up" }] },
+				new Headers(),
+			),
+			5000,
+		);
+		const shipped = scoreHeuristic(features, DEFAULT_CONFIG);
+		const discounted = scoreHeuristic(features, {
+			...DEFAULT_CONFIG,
+			classifier: { ...DEFAULT_CONFIG.classifier, reasoningWeights: { ...DEFAULT_CONFIG.classifier.reasoningWeights, medium: 0 } },
+		});
+		expect(shipped.score - discounted.score).toBeCloseTo(DEFAULT_CONFIG.classifier.reasoningWeights.medium, 5);
+		expect(discounted.reasons.some((r) => /requested reasoning/.test(r))).toBe(false);
+	});
+
+	test("ships with the historical weights, so enabling a discount is opt-in", () => {
+		expect(DEFAULT_CONFIG.classifier.reasoningWeights).toEqual({ medium: 0.14, high: 0.24, xhigh: 0.3, max: 0.34 });
+	});
+
 	test("always produces a bounded score, a real tier, and its reasoning", () => {
 		const c = scoreHeuristic(featuresFor([SYSTEM, { role: "user", content: "hello" }]), BASE);
 		expect(c.score).toBeGreaterThanOrEqual(0);

package/test/context-prune.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, test } from "bun:test";
+
+import { createContextStore } from "../src/context/store.ts";
+import { createConversationStore } from "../src/router/state.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `context_blocks` is content-addressed and shared between conversations, so
+ * nothing reclaims a block when the conversation that fetched it goes away.
+ * Until the prune below was wired into the server's housekeeping timer the table
+ * grew for the life of the install (measured on a real install: 220 rows /
+ * 2.7 MB, 68 of them referenced by nothing).
+ *
+ * Age alone is the wrong test, though: a block past the staleness TTL may still
+ * be PINNED, and deleting it forces that conversation to refetch and inject
+ * different bytes — housekeeping causing a prompt-cache miss. So the safe set is
+ * "old AND unreferenced".
+ */
+describe("context block prune", () => {
+	const HOUR = 3_600_000;
+
+	function seed() {
+		const db = openDb(":memory:");
+		const blocks = createContextStore(db);
+		const conversations = createConversationStore(db);
+		const now = Date.now();
+
+		blocks.put("scope", { version: "old-pinned", block: "A", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "old-orphan", block: "B", fetchedAtMs: now - 5 * HOUR });
+		blocks.put("scope", { version: "fresh-orphan", block: "C", fetchedAtMs: now });
+
+		// One live conversation still pins `old-pinned`.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "old-pinned";
+		state.contextFetchedAtMs = now - 5 * HOUR;
+		conversations.save(state);
+
+		return { db, blocks };
+	}
+
+	test("drops an old block that nothing references", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.get("old-orphan")).toBeNull();
+		db.close();
+	});
+
+	test("keeps an old block a conversation still pins", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		// Deleting this one would cost that conversation its warm prefix.
+		expect(blocks.get("old-pinned")?.block).toBe("A");
+		db.close();
+	});
+
+	test("keeps a block younger than the age cutoff", () => {
+		const { db, blocks } = seed();
+		blocks.prune(HOUR);
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+
+	test("is a no-op once the unreferenced blocks are gone", () => {
+		const { db, blocks } = seed();
+		expect(blocks.prune(HOUR)).toBe(1);
+		expect(blocks.prune(HOUR)).toBe(0);
+		db.close();
+	});
+
+	test("reclaims a block as soon as its last pin is dropped", () => {
+		const { db, blocks } = seed();
+		const conversations = createConversationStore(db);
+		// The conversation moves to a new context version (a refresh), which is
+		// what leaves the old block orphaned in production.
+		const state = conversations.load("conv-1");
+		state.contextVersion = "fresh-orphan";
+		conversations.save(state);
+
+		expect(blocks.prune(HOUR)).toBe(2); // old-pinned is now unreferenced too
+		expect(blocks.get("old-pinned")).toBeNull();
+		expect(blocks.get("fresh-orphan")?.block).toBe("C");
+		db.close();
+	});
+});

package/test/failover.test.ts

@@ -44,7 +44,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",
@@ -55,6 +55,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			toolAxis: "coding",
 			chatAxis: "intelligence",
 			agenticLoopDepth: 3,
+			reasoningWeights: { medium: 0.14, high: 0.24, xhigh: 0.3, max: 0.34 },
 		},
 		escalation: {
 			enabled: true,

package/test/trust-attribution.test.ts

@@ -244,11 +244,11 @@ describe("v4 migration", () => {
 		}
 	});
 
-	test("schema is at user_version 13", () => {
+	test("schema is at user_version 14", () => {
 		const db = openDb(":memory:");
 		try {
 			const row = db.query("PRAGMA user_version").get() as { user_version: number };
-			expect(row.user_version).toBe(13);
+			expect(row.user_version).toBe(14);
 		} finally {
 			db.close();
 		}

package/test/trust-window.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
+import { createLedger } from "../src/cost/ledger.ts";
+import type { LedgerEntry } from "../src/cost/types.ts";
+import { openDb } from "../src/util/sqlite.ts";
+
+/**
+ * `filters.trustWindowDays` bounds the per-slug trust aggregate, which otherwise
+ * scans every row a model ever had — on every candidate, on every turn. Measured
+ * on a real ledger it grows from 0.8 ms at 9k rows to 11.6 ms at 75k, so it
+ * becomes a per-turn latency tax as history accumulates.
+ *
+ * It defaults to 0 (all-time) because narrowing it CHANGES ROUTING: smaller
+ * denominators move success rates, which moves the demotion guard. These tests
+ * pin both halves of that contract — off is byte-identical to the old behaviour,
+ * and on genuinely excludes old rows.
+ */
+
+const DAY = 86_400_000;
+
+function cfgWith(trustWindowDays: number) {
+	const cfg = structuredClone(DEFAULT_CONFIG);
+	cfg.filters.trustWindowDays = trustWindowDays;
+	cfg.ledger.path = ":memory:";
+	return cfg;
+}
+
+function entry(over: Partial<LedgerEntry>): LedgerEntry {
+	return {
+		id: crypto.randomUUID(),
+		createdAtMs: Date.now(),
+		conversationKey: "k",
+		sessionId: "s",
+		turn: 1,
+		requestedModel: "auto",
+		harnessId: "",
+		ompSessionId: "",
+		slug: "vendor/model",
+		servedSlug: "vendor/model",
+		tier: "simple",
+		classificationSource: "heuristic",
+		reasons: [],
+		features: null,
+		score: null,
+		confidence: null,
+		task: null,
+		classifierReasons: null,
+		exploredFrom: null,
+		holdArm: null,
+		predictedUsd: 0.001,
+		reportedUsd: 0.001,
+		usage: { promptTokens: 10, cachedTokens: 0, cacheWriteTokens: 0, completionTokens: 5, reasoningTokens: 0, images: 0 },
+		attempt: 0,
+		escalationSignal: null,
+		latencyMs: 100,
+		ttftMs: 50,
+		finishReason: "stop",
+		wasted: false,
+		upstreamGenerationId: null,
+		error: null,
+		errorKind: null,
+		promptTokensSaved: null,
+		...over,
+	} as LedgerEntry;
+}
+
+/** Old rows: half of them failures. Recent rows: all clean. */
+function seed(windowDays: number) {
+	const cfg = cfgWith(windowDays);
+	const db = openDb(":memory:");
+	const ledger = createLedger(db, cfg);
+	const now = Date.now();
+	for (let i = 0; i < 10; i++) {
+		ledger.record(
+			entry({
+				createdAtMs: now - 30 * DAY,
+				...(i % 2 === 0 ? { error: "server_error: boom", errorKind: "server_error" } : {}),
+			}),
+		);
+	}
+	for (let i = 0; i < 10; i++) ledger.record(entry({ createdAtMs: now - 1 * DAY }));
+	return { db, ledger, cfg };
+}
+
+describe("filters.trustWindowDays", () => {
+	test("0 means all-time: every row counts", () => {
+		const { db, ledger } = seed(0);
+		const trust = ledger.trust("vendor/model");
+		expect(trust?.attempts).toBe(20);
+		expect(trust?.errors).toBe(5);
+		db.close();
+	});
+
+	test("a window excludes rows older than it", () => {
+		const { db, ledger } = seed(7);
+		const trust = ledger.trust("vendor/model");
+		// Only the 10 recent, clean rows remain.
+		expect(trust?.attempts).toBe(10);
+		expect(trust?.errors).toBe(0);
+		db.close();
+	});
+
+	test("the window moves the success rate, which is why it is opt-in", () => {
+		const all = seed(0);
+		const windowed = seed(7);
+		const allTrust = all.ledger.trust("vendor/model");
+		const winTrust = windowed.ledger.trust("vendor/model");
+		expect(allTrust?.successRate).toBeLessThan(winTrust?.successRate ?? 0);
+		all.db.close();
+		windowed.db.close();
+	});
+
+	test("is read per call, so a hot-reloaded edit takes effect immediately", () => {
+		const { db, ledger, cfg } = seed(0);
+		expect(ledger.trust("vendor/model")?.attempts).toBe(20);
+		// Hot reload mutates the shared config object in place.
+		cfg.filters.trustWindowDays = 7;
+		expect(ledger.trust("vendor/model")?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("allTrust honours the same window", () => {
+		const { db, ledger } = seed(7);
+		const rows = ledger.allTrust();
+		expect(rows).toHaveLength(1);
+		expect(rows[0]?.attempts).toBe(10);
+		db.close();
+	});
+
+	test("ships disabled, so the default install is unchanged", () => {
+		// DEFAULT_CONFIG, not loadConfig: loadConfig reads the machine's real
+		// config.yml, which has broken this suite before.
+		expect(DEFAULT_CONFIG.filters.trustWindowDays).toBe(0);
+	});
+});

package/test/turn.test.ts

@@ -45,7 +45,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			data: { axis: "intelligence", minQuality: 0 },
 			chat: { axis: "intelligence", minQuality: 0 },
 		},
-		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
+		filters: { allow: [], deny: [], includeFree: false, requireToolSupport: true, minTrust: 0.6, minTrustSamples: 5, trustScopedByHarness: false, trustWindowDays: 0, contextHeadroom: 1.2, latencyWeight: 0, latencyReferenceMs: 5000, latencyReferenceTokensPerSec: 30, latencyMinSamples: 20 },
 		classifier: {
 			ambiguityThreshold: 0,
 			model: "test/adjudicator",
@@ -56,6 +56,7 @@ function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 			toolAxis: "coding",
 			chatAxis: "intelligence",
 			agenticLoopDepth: 3,
+			reasoningWeights: { medium: 0.14, high: 0.24, xhigh: 0.3, max: 0.34 },
 		},
 		escalation: {
 			enabled: true,
@@ -583,6 +584,7 @@ describe("agentdox write-back sees the shape of the turn", () => {
 					records.push(rec);
 				},
 				flush: () => Promise.resolve(),
+				pruneBlocks: () => 0,
 				close: () => {},
 			},
 		};

package/tools/replay.ts

@@ -37,8 +37,10 @@
  *    size (`usage.promptTokens`), i.e. the prompt selection actually saw.
  *  - `stickyUntilTurn` was never persisted per turn, so the hysteresis hold
  *    window is absent. This is the main residual gap.
- *  - `requestedReasoning` is the one `Features` field the ledger omits; it
- *    replays as undefined.
+ *  - `requestedReasoning` IS recorded and is now used. It was previously forced
+ *    to undefined here on the belief the ledger omitted it, which under-scored
+ *    ~42% of dispatches and reproduced 27 hard decisions against 120 served.
+ *    Treat replay numbers produced before that fix as biased toward cheap tiers.
  *  - Module constants are not config, so things like CAP_AUTONOMOUS_LOOP cannot
  *    be A/B'd via `--set` — only `RouterConfig` paths can.
  *
@@ -140,10 +142,20 @@ interface Row {
 	created_at_ms: number;
 }
 
-/** Rebuilds the classifier input. The ledger stores 20 of 21 Features fields. */
+/**
+ * Rebuilds the classifier input from the recorded blob.
+ *
+ * `requestedReasoning` IS recorded (JSON.stringify only drops it when the client
+ * sent no level), and it must be used: it is worth up to +0.34 of score, rides
+ * on ~42% of dispatches, and forcing it to undefined — as this did, on the
+ * assumption the ledger omitted it — under-scored every one of those rows.
+ * Measured effect of the bug: replay reproduced 27 hard-tier decisions against
+ * 120 actually served, i.e. it silently biased every comparison toward cheaper
+ * tiers and made reasoning-weight changes look like no-ops.
+ */
 function featuresOf(row: Row, promptTokens: number): Features {
 	const f = JSON.parse(row.features) as Partial<Features>;
-	return { ...(f as Features), promptTokens, requestedReasoning: undefined };
+	return { ...(f as Features), promptTokens };
 }
 
 /**