auto-model-router 0.4.3 → 0.4.5

package/.gitattributes

@@ -0,0 +1,2 @@
+# SQLite fixtures must never get line-ending conversion (core.autocrlf is on for this checkout).
+*.db binary

package/.omp-plugin/marketplace.json

@@ -7,14 +7,14 @@
   },
   "metadata": {
     "description": "auto-model-router: a local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
-    "version": "0.4.3",
+    "version": "0.4.5",
     "pluginRoot": "."
   },
   "plugins": [
     {
       "name": "auto-model-router",
       "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter. Runs in-process, routes per turn by price and task complexity, with budget caps, mid-stream escalation, and cache-aware hysteresis.",
-      "version": "0.4.3",
+      "version": "0.4.5",
       "author": {
         "name": "drewappling",
         "email": "drewappling@gmail.com"

package/README.md

@@ -562,7 +562,9 @@ as the placeholder — empty input keeps it, `-` clears an optional field,
 credentials show as `set`/`unset` and are never echoed. `Save and exit` writes the merged config
 (schema-checked and backed up first). Tier, task, filter, classifier,
 hysteresis, exploration, compaction, cache and budget changes hot-reload;
-restart omp for `server`, `openrouter`, `ollama`, `context` and `ledger`.
+restart omp for `server` (except `subagentProfile`), `openrouter`, `context`,
+`ledger.path` and the Ollama connection keys; `ollama.costBias`,
+`ollama.biasUntilUsage` and `ledger.retentionDays` hot-reload too.
 
 ### Via `auto-model-router config` (text wizard / CLI)
 
@@ -822,6 +824,12 @@ is a ledger row (`requestedModel` `digest`) and the report totals them.
 | `maxCostUsd` | `0.02` | Skip when the digest itself would cost more. |
 | `timeoutMs` | `25000` | The raw result stands if the cheap model is slower. |
 
+Quality signal: when the agent later calls the same tool with the same
+primary argument (re-reads a digested file, re-runs a digested grep), the
+router marks that digest's ledger row wasted. The report's `digests` line
+shows the re-run rate; a high rate means the digest is dropping what the
+task needed, and `digest.maxOutputTokens` or `digest.model` is the lever.
+
 ### `report` — usage-report options
 
 | Key | Default | Meaning |
@@ -829,6 +837,14 @@ is a ledger row (`requestedModel` `digest`) and the report totals them.
 | `baselines` | `anthropic/claude-opus-5`, `anthropic/claude-sonnet-5` | Models the report prices the window's traffic on as a single-model counterfactual. Unknown slugs are skipped. |
 | `dailySummary` | `true` | Post the daily summary (below) into the transcript at the first interactive omp session start of each day. Hot-reloads. |
 
+### `harnessSwitch` — harness-side model switch (experimental)
+
+| Key | Default | Meaning |
+| --- | --- | --- |
+| `enabled` | `false` | Let the `router-switch` extension move omp's active model for mapped tiers. |
+| `models` | `{}` | Tier → harness model as `provider/id` in omp's own registry, e.g. `hard: anthropic/claude-opus-4-8`. A tier serves itself and every tier above it up to the next mapped one; unmapped tiers stay on the router. |
+| `minConfidence` | `0.6` | Advice below this heuristic confidence leaves the model where it is. |
+
 ### `ledger` — cost measurement
 
 | Key | Default | Meaning |
@@ -838,6 +854,7 @@ is a ledger row (`requestedModel` `digest`) and the report totals them.
 | `blendMinSamples` | `25` | Turns before the measured blend replaces the fallback. |
 | `fallbackBlend` | input `1.5`, output `7.5` | Pre-measurement blend (USD/Mtok) for omp's cost display. |
 | `conversationTtlMs` | `604800000` (7 d) | Drop conversation state untouched this long. |
+| `retentionDays` | `365` | Delete ledger rows older than this, checked hourly; `0` keeps everything. The ledger grows about 2.5 MB a day under steady use. Freed pages are reused, so the file stops growing rather than shrinking. |
 
 ### Top-level
 
@@ -920,6 +937,35 @@ router handles for you: no `models[]` fallback cascade, no `tool_choice`,
 `reasoning_effort` instead of the `reasoning` object, and no `cache_control`
 markers (they are stripped before dispatch).
 
+## Harness-side model switch (experimental)
+
+Most engineers reach Claude through a subscription, not an API key, and a
+subscription model cannot be proxied: the router would have to translate to
+Anthropic's wire format and carry omp's OAuth token through a third-party
+process. The `router-switch` extension takes the other route. Before omp
+starts a turn on a user prompt it asks the router which tier the prompt is
+(`POST /v1/router/advise`, the heuristic classifier over the prompt text,
+nothing dispatched or recorded). When that tier is mapped in
+`harnessSwitch.models`, the extension moves omp's active model to the mapped
+harness model; when a later prompt is advised below every mapped tier, it
+moves back to the router model it left. A model the user picked by hand is
+never touched. Native turns bill the subscription and never reach the
+ledger; the router serves and accounts for the rest.
+
+```yaml
+# ~/.auto-model-router/config.yml
+harnessSwitch:
+  enabled: true
+  models:
+    hard: anthropic/claude-opus-4-8
+```
+
+Install `omp-extension/router-switch.ts` beside the embed extension and
+restart omp. Known limits of the prototype: the advice sees only the prompt
+text, not the conversation, so a hard task that only becomes hard three tool
+calls in stays on the router (the router's own escalation still applies
+there); and the switch happens at prompt boundaries, never mid-turn.
+
 ## Multiple coding harnesses, one router
 
 A single embedded router can serve several omp sessions without them stepping

package/bunfig.toml

@@ -0,0 +1,2 @@
+[test]
+preload = ["./test/support/preload.ts"]

package/omp-extension/pi-coding-agent.d.ts

@@ -109,6 +109,12 @@ declare module "@oh-my-pi/pi-coding-agent" {
 		/** Interval whose errors omp isolates, and whose handle `clearTimer` cancels. */
 		setInterval(handler: () => void | Promise<void>, ms: number): unknown;
 		clearTimer(timer: unknown): void;
+		/** The active model, when one is set. (Real type: `Model`.) */
+		model: { provider: string; id: string } | undefined;
+		/** Looks a model up in omp's registry by provider and id. */
+		modelRegistry: { find(provider: string, modelId: string): unknown };
+		/** Sets the session's active model; false when omp has no key for it. */
+		setModel(model: unknown): Promise<boolean>;
 	}
 
 	export interface CommandDefinition {

package/omp-extension/router-switch.ts

@@ -0,0 +1,100 @@
+/**
+ * omp extension: harness-side model switch (experimental).
+ *
+ * Before omp starts a turn on a user prompt, ask the router which tier the
+ * prompt is, and when that tier is mapped to a harness-native model in the
+ * router's `harnessSwitch.models` (a Claude subscription model, typically),
+ * move omp's active model there; when a later prompt is advised below the
+ * mapped tiers, move back to the router model we left. A model the user
+ * picked by hand is never touched.
+ *
+ * Nothing is proxied and no token leaves omp: the native turns bill the
+ * subscription, the router serves the rest and keeps the ledger for those.
+ * Off unless `harnessSwitch.enabled` is set in the router config.
+ *
+ *   # ~/.omp/agent/config.yml
+ *   extensions:
+ *     - /path/to/auto-model-router/omp-extension/router-embed.ts
+ *     - /path/to/auto-model-router/omp-extension/router-switch.ts
+ */
+
+import type { ExtensionAPI } from "@oh-my-pi/pi-coding-agent";
+
+import { EMBED_PROVIDER_ID } from "./embed-logic.ts";
+import { routerAuthHeaders, routerBaseUrl } from "./router-url.ts";
+import { DISABLED_SWITCH, decideSwitch, parseSwitchPolicy, type SwitchPolicy, type TierName } from "./switch-logic.ts";
+
+const HARNESS_ID = process.env.OMP_HARNESS_ID ?? "";
+const POLICY_TTL_MS = 60_000;
+
+export default function (pi: ExtensionAPI): void {
+	pi.setLabel("auto-model-router switch");
+
+	let policy: SwitchPolicy = DISABLED_SWITCH;
+	let policyAtMs = 0;
+	let switchedTo: string | null = null;
+	let returnTo: string | null = null;
+
+	async function refreshPolicy(): Promise<void> {
+		if (Date.now() - policyAtMs < POLICY_TTL_MS) return;
+		policyAtMs = Date.now();
+		try {
+			const res = await fetch(`${routerBaseUrl()}/v1/router/advise/policy`, { headers: routerAuthHeaders(), signal: AbortSignal.timeout(2_000) });
+			policy = res.ok ? parseSwitchPolicy(await res.json()) : DISABLED_SWITCH;
+		} catch {
+			policy = DISABLED_SWITCH;
+		}
+	}
+
+	pi.on("session_start", async () => {
+		policyAtMs = 0;
+		switchedTo = null;
+		returnTo = null;
+		await refreshPolicy();
+	});
+
+	pi.on("before_agent_start", async (event, ctx) => {
+		const e = event as { prompt?: string };
+		if (typeof e.prompt !== "string" || e.prompt.trim() === "") return undefined;
+		await refreshPolicy();
+		if (!policy.enabled) return undefined;
+		const activeModel = ctx.model;
+		const active = activeModel === undefined ? null : `${activeModel.provider}/${activeModel.id}`;
+		const activeIsRouter = activeModel?.provider === EMBED_PROVIDER_ID;
+		let advised: { tier: TierName; confidence: number };
+		try {
+			const res = await fetch(`${routerBaseUrl()}/v1/router/advise`, {
+				method: "POST",
+				headers: { ...routerAuthHeaders(), "content-type": "application/json" },
+				body: JSON.stringify({ ompSessionId: ctx.sessionManager.getSessionId(), harnessId: HARNESS_ID, text: e.prompt.slice(0, 8_000) }),
+				signal: AbortSignal.timeout(2_000),
+			});
+			if (!res.ok) return undefined;
+			advised = (await res.json()) as { tier: TierName; confidence: number };
+		} catch {
+			return undefined;
+		}
+		const decision = decideSwitch({ policy, advised, active, activeIsRouter, switchedTo, returnTo });
+		if (decision.action === "none") return undefined;
+		const [provider = "", ...rest] = decision.model.split("/");
+		const target = ctx.modelRegistry.find(provider, rest.join("/"));
+		if (target === undefined) {
+			if (ctx.hasUI) ctx.ui.notify(`router switch: ${decision.model} is not in omp's model registry`, "warn");
+			return undefined;
+		}
+		const ok = await ctx.setModel(target);
+		if (!ok) {
+			if (ctx.hasUI) ctx.ui.notify(`router switch: omp has no key for ${decision.model}`, "warn");
+			return undefined;
+		}
+		if (decision.action === "up") {
+			if (activeIsRouter) returnTo = active;
+			switchedTo = decision.model;
+		} else {
+			switchedTo = null;
+			returnTo = null;
+		}
+		if (ctx.hasUI) ctx.ui.notify(`router switch: ${decision.reason}`, "info");
+		return undefined;
+	});
+}

package/omp-extension/switch-logic.ts

@@ -0,0 +1,81 @@
+/**
+ * Pure decision logic behind the harness-side model switch (router-switch.ts):
+ * given the router's advice for a prompt and what model omp is on, say whether
+ * to move up to a harness-native model, back to the router, or stay put.
+ * Free of omp types so it is unit-testable.
+ */
+
+export const TIERS = ["trivial", "simple", "moderate", "hard"] as const;
+export type TierName = (typeof TIERS)[number];
+
+export interface SwitchPolicy {
+	enabled: boolean;
+	/** Tier → harness model (`provider/id`) that serves that tier and above, up to the next configured tier. */
+	models: Partial<Record<TierName, string>>;
+	/** Advice below this confidence never moves the model. */
+	minConfidence: number;
+}
+
+export const DISABLED_SWITCH: SwitchPolicy = { enabled: false, models: {}, minConfidence: 1 };
+
+export function parseSwitchPolicy(raw: unknown): SwitchPolicy {
+	if (raw === null || typeof raw !== "object") return DISABLED_SWITCH;
+	const r = raw as Record<string, unknown>;
+	const models: Partial<Record<TierName, string>> = {};
+	if (r.models !== null && typeof r.models === "object") {
+		for (const t of TIERS) {
+			const v = (r.models as Record<string, unknown>)[t];
+			if (typeof v === "string" && v.includes("/")) models[t] = v;
+		}
+	}
+	return {
+		enabled: r.enabled === true,
+		models,
+		minConfidence: typeof r.minConfidence === "number" ? r.minConfidence : 0.6,
+	};
+}
+
+/** The harness model configured for the highest tier at or below `tier`, if any. */
+export function nativeModelFor(policy: SwitchPolicy, tier: TierName): string | undefined {
+	for (let i = TIERS.indexOf(tier); i >= 0; i--) {
+		const m = policy.models[TIERS[i]!];
+		if (m !== undefined) return m;
+	}
+	return undefined;
+}
+
+export interface SwitchInput {
+	policy: SwitchPolicy;
+	advised: { tier: TierName; confidence: number };
+	/** omp's active model as `provider/id`, or null when none. */
+	active: string | null;
+	/** True when the active model belongs to the router's provider. */
+	activeIsRouter: boolean;
+	/** The harness model this extension last switched TO, if omp is still on it. */
+	switchedTo: string | null;
+	/** The router model omp was on before the switch, to return to. */
+	returnTo: string | null;
+}
+
+export type SwitchDecision =
+	| { action: "up"; model: string; reason: string }
+	| { action: "back"; model: string; reason: string }
+	| { action: "none"; reason: string };
+
+export function decideSwitch(input: SwitchInput): SwitchDecision {
+	const { policy, advised, active, activeIsRouter, switchedTo, returnTo } = input;
+	if (!policy.enabled) return { action: "none", reason: "harnessSwitch.enabled is off" };
+	const onOurSwitch = switchedTo !== null && active === switchedTo;
+	// The user picked something else by hand: never fight a manual choice.
+	if (!activeIsRouter && !onOurSwitch) return { action: "none", reason: `active model ${active ?? "(none)"} was chosen by the user` };
+	const native = nativeModelFor(policy, advised.tier);
+	if (native === undefined) {
+		if (onOurSwitch && returnTo !== null) return { action: "back", model: returnTo, reason: `${advised.tier} work: back to the router` };
+		return { action: "none", reason: `${advised.tier} work stays on the router` };
+	}
+	if (advised.confidence < policy.minConfidence) {
+		return { action: "none", reason: `${advised.tier} at confidence ${advised.confidence.toFixed(2)} < ${policy.minConfidence}` };
+	}
+	if (active === native) return { action: "none", reason: `already on ${native}` };
+	return { action: "up", model: native, reason: `${advised.tier} work (confidence ${advised.confidence.toFixed(2)}) → ${native}` };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",

package/src/catalog/composite.ts

@@ -23,6 +23,8 @@ export interface CompositeBias {
 	/** Plan usage fraction at which the bias switches off (list price). */
 	biasUntilUsage: number;
 	usage: OllamaUsageSource;
+	/** When given, read on every use instead of the static pair, so a config hot reload applies. */
+	live?: () => { costBias: number; biasUntilUsage: number };
 }
 
 export function createCompositeCatalog(
@@ -39,7 +41,8 @@ export function createCompositeCatalog(
 
 	/** The multiplier in force from the latest usage reading (no network). */
 	function currentBias(): number {
-		return effectiveOllamaBias(bias.costBias, bias.biasUntilUsage, bias.usage.peek());
+		const b = bias.live?.() ?? bias;
+		return effectiveOllamaBias(b.costBias, b.biasUntilUsage, bias.usage.peek());
 	}
 
 	function combine(base: CatalogSnapshot, models: readonly CatalogModel[]): CatalogSnapshot {

package/src/cli/config-wizard.ts

@@ -335,6 +335,14 @@ export const WIZARD_SECTIONS: readonly SectionSpec[] = [
 			{ path: "report.dailySummary", label: "Daily summary at session start", kind: "boolean" },
 		],
 	},
+	{
+		title: "Harness switch",
+		fields: [
+			{ path: "harnessSwitch.enabled", label: "Switch omp's model for mapped tiers (experimental)", kind: "boolean" },
+			{ path: "harnessSwitch.minConfidence", label: "Minimum advice confidence to switch", kind: "number", min: 0, max: 1 },
+			...TIER_NAMES.map((t): FieldSpec => ({ path: `harnessSwitch.models.${t}`, label: `${t}: harness model (provider/id)`, kind: "string", optional: true, hint: "e.g. anthropic/claude-opus-4-8" })),
+		],
+	},
 	{
 		title: "Ledger",
 		fields: [
@@ -344,6 +352,7 @@ export const WIZARD_SECTIONS: readonly SectionSpec[] = [
 			{ path: "ledger.fallbackBlend.inputPerMtok", label: "Fallback blend input $/Mtok", kind: "number", min: 0 },
 			{ path: "ledger.fallbackBlend.outputPerMtok", label: "Fallback blend output $/Mtok", kind: "number", min: 0 },
 			{ path: "ledger.conversationTtlMs", label: "Conversation TTL", kind: "number", min: 1, hint: "ms" },
+			{ path: "ledger.retentionDays", label: "Ledger retention", kind: "number", min: 0, hint: "days; 0 keeps everything" },
 		],
 	},
 	{

package/src/config/defaults.ts

@@ -316,6 +316,12 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		// One transcript message per day, at the first interactive session start.
 		dailySummary: true,
 	},
+	harnessSwitch: {
+		// Off: moving the harness's own model is a visible change the operator opts into.
+		enabled: false,
+		models: {},
+		minConfidence: 0.6,
+	},
 	budget: {
 		// No caps by default; at a configured ceiling, downgrade rather than fail.
 		onExceeded: "downgrade",
@@ -337,6 +343,7 @@ export const DEFAULT_CONFIG: RouterConfig = {
 		// so early cost reporting never underreports.
 		fallbackBlend: { inputPerMtok: 1.5, outputPerMtok: 7.5 },
 		conversationTtlMs: 7 * 24 * 60 * 60 * 1000,
+		retentionDays: 365,
 	},
 	// On by default: an absolute floor that no available model meets is how the
 	// router ends up serving every turn from the cheapest tier.

package/src/config/hot-reload.ts

@@ -90,15 +90,47 @@ export interface WatchConfigOptions {
 }
 
 /**
- * Watches `path` and applies valid changes to `live` in place. `frozen` blocks
- * (top-level names) are re-copied from `pinned` after every reload so file
- * edits to construction-captured blocks cannot silently diverge.
+ * Config paths captured at construction, so a file edit cannot reach the
+ * running process: the socket, the upstream clients, the agentdox bridge, the
+ * ledger file. Everything else, including `ollama.costBias`,
+ * `ollama.biasUntilUsage`, `server.subagentProfile` and `ledger.retentionDays`,
+ * is read at call time and hot-reloads. A bare block name pins the whole
+ * block; `block.key` pins one key and lets its siblings through.
+ */
+export const PINNED_CONFIG_PATHS: readonly string[] = [
+	"server.host",
+	"server.port",
+	"server.apiKey",
+	"server.harnessId",
+	"server.maxConcurrentTurns",
+	"openrouter",
+	"ollama.enabled",
+	"ollama.baseUrl",
+	"ollama.apiKey",
+	"ollama.timeoutMs",
+	"ollama.catalogTtlMs",
+	"ollama.includeLocal",
+	"ollama.prices",
+	"ollama.twins",
+	"ollama.usagePollMs",
+	"ollama.quotaCooldownMs",
+	"ollama.rateLimitCooldownMs",
+	"ollama.planCreditsUsd",
+	"context",
+	"ledger.path",
+];
+
+/**
+ * Watches `path` and applies valid changes to `live` in place. `frozen`
+ * entries are re-copied from `pinned` after every reload so file edits to
+ * construction-captured settings cannot silently diverge: a top-level name
+ * pins the whole block, `block.key` pins one key of it.
  */
 export function watchConfig(
 	path: string,
 	live: RouterConfig,
 	pinned: RouterConfig,
-	frozen: readonly (keyof RouterConfig)[],
+	frozen: readonly string[],
 	opts: WatchConfigOptions = {},
 ): ConfigWatcher {
 	let closed = false;
@@ -119,14 +151,31 @@ export function watchConfig(
 		}
 		lastError = "";
 
-		const frozenSet = new Set(frozen);
+		const frozenBlocks = new Set(frozen.filter((f) => !f.includes(".")));
+		const frozenKeys = new Map<string, string[]>();
+		for (const f of frozen) {
+			const dot = f.indexOf(".");
+			if (dot < 0) continue;
+			const block = f.slice(0, dot);
+			frozenKeys.set(block, [...(frozenKeys.get(block) ?? []), f.slice(dot + 1)]);
+		}
 		const changed: string[] = [];
 		const next = result.cfg as unknown as Record<string, unknown>;
+		const pinnedRec = pinned as unknown as Record<string, unknown>;
 		for (const key of Object.keys(next)) {
-			// Frozen blocks belong to construction: keep the pinned values.
-			const value = frozenSet.has(key as keyof RouterConfig)
-				? (pinned as unknown as Record<string, unknown>)[key]
-				: next[key];
+			// Frozen blocks belong to construction: keep the pinned values. A
+			// partially frozen block takes the file's siblings and the pinned keys.
+			let value = frozenBlocks.has(key) ? pinnedRec[key] : next[key];
+			const keys = frozenKeys.get(key);
+			if (keys !== undefined && !frozenBlocks.has(key) && value !== null && typeof value === "object") {
+				const merged: Record<string, unknown> = { ...(value as Record<string, unknown>) };
+				const pinnedBlock = (pinnedRec[key] ?? {}) as Record<string, unknown>;
+				for (const k of keys) {
+					if (pinnedBlock[k] === undefined) delete merged[k];
+					else merged[k] = pinnedBlock[k];
+				}
+				value = merged;
+			}
 			const before = JSON.stringify((live as unknown as Record<string, unknown>)[key]);
 			const after = JSON.stringify(value);
 			if (before !== after) changed.push(key);

package/src/config/schema.ts

@@ -229,6 +229,7 @@ const ledger = z.strictObject({
 	blendMinSamples: z.number().int().nonnegative().optional(),
 	fallbackBlend: fallbackBlend.optional(),
 	conversationTtlMs: z.number().positive().optional(),
+	retentionDays: z.number().int().nonnegative().optional(),
 });
 
 // Complete entries: arrays replace wholesale, so a partial profile would
@@ -276,6 +277,13 @@ export const configInputSchema = z.strictObject({
 	budget: budget.optional(),
 	profiles: z.array(profile).optional(),
 	report: z.strictObject({ baselines: z.array(z.string()).optional(), dailySummary: z.boolean().optional() }).optional(),
+	harnessSwitch: z
+		.strictObject({
+			enabled: z.boolean().optional(),
+			models: z.record(tier, z.string().regex(/^[^/]+\/.+$/, "provider/id")).optional(),
+			minConfidence: z.number().min(0).max(1).optional(),
+		})
+		.optional(),
 	digest: z
 		.strictObject({
 			enabled: z.boolean().optional(),

package/src/config/types.ts

@@ -607,6 +607,25 @@ export interface ReportConfig {
 	dailySummary: boolean;
 }
 
+/**
+ * Harness-side model switch (experimental): the router advises a tier for
+ * each user prompt and the harness moves its own active model to a
+ * harness-native one for the mapped tiers. See omp-extension/router-switch.ts.
+ */
+export interface HarnessSwitchConfig {
+	enabled: boolean;
+	/**
+	 * Tier → harness model as `provider/id` in the harness's own registry
+	 * (e.g. `hard: anthropic/claude-opus-4-8`). A tier serves itself and every
+	 * tier above it up to the next mapped one; unmapped low tiers stay on the
+	 * router. Turns on a native model bill the harness's own provider (a
+	 * subscription, typically) and never reach the ledger.
+	 */
+	models: Partial<Record<"trivial" | "simple" | "moderate" | "hard", string>>;
+	/** Advice below this heuristic confidence leaves the model where it is. */
+	minConfidence: number;
+}
+
 export interface BudgetConfig {
 	/** Reject or downgrade when a turn's cold forecast exceeds this, USD. */
 	perTurnUsd?: number;
@@ -657,6 +676,13 @@ export interface LedgerConfig {
 	fallbackBlend: { inputPerMtok: number; outputPerMtok: number };
 	/** Drop conversation state untouched for longer than this, ms. */
 	conversationTtlMs: number;
+	/**
+	 * Delete ledger rows older than this many days (checked hourly). 0 keeps
+	 * everything. The ledger grows ~2.5 MB a day under steady use; trust,
+	 * reports and replay only read windows well inside a year. Freed pages
+	 * are reused, so the file stops growing rather than shrinking.
+	 */
+	retentionDays: number;
 }
 
 /**
@@ -795,6 +821,7 @@ export interface RouterConfig {
 	budget: BudgetConfig;
 	report: ReportConfig;
 	digest: DigestConfig;
+	harnessSwitch: HarnessSwitchConfig;
 	profiles: ProfileConfig[];
 	ledger: LedgerConfig;
 	/**

package/src/cost/ledger.ts

@@ -375,6 +375,8 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 	);
 	const ratioStmt = db.query("SELECT est_bytes, actual_tokens, samples FROM token_calibration WHERE tokenizer = ?");
 	const recentStmt = db.query("SELECT * FROM ledger ORDER BY created_at_ms DESC LIMIT ?");
+	const pruneStmt = db.query("DELETE FROM ledger WHERE created_at_ms < ?");
+	const wasteStmt = db.query("UPDATE ledger SET wasted = 1 WHERE id = ?");
 	const providerSpendStmt = db.query(
 		"SELECT COALESCE(SUM(COALESCE(reported_usd, predicted_usd)), 0) AS total FROM ledger WHERE created_at_ms >= ? AND COALESCE(served_slug, slug) LIKE ?",
 	);
@@ -623,6 +625,13 @@ export function createLedger(db: Database, cfg: RouterConfig): Ledger {
 			const row = providerSpendStmt.get(sinceMs, `${slugPrefix}%`) as { total: number } | null;
 			return row?.total ?? 0;
 		},
+		prune(retentionDays: number, nowMs = Date.now()): number {
+			if (retentionDays <= 0) return 0;
+			return pruneStmt.run(nowMs - retentionDays * DAY_MS).changes;
+		},
+		markWasted(id: string): void {
+			wasteStmt.run(id);
+		},
 		latestForSession(ompSessionId: string): LedgerEntry | null {
 			if (ompSessionId === "") return null;
 			const row = sessionStmt.get(ompSessionId, 1) as LedgerRow | null;

package/src/cost/report.ts

@@ -34,6 +34,12 @@ export interface ReportTotals {
 	digests: number;
 	digestSpendUsd: number;
 	digestInputTokens: number;
+	/** Digests the agent went back on: the same tool re-run with the same primary argument afterwards (row marked wasted). */
+	digestReruns: number;
+	/** Forecast accuracy over clean kept rows with a reported cost: mean |predicted − reported| ÷ reported, and the share over-predicted. */
+	forecastSamples: number;
+	forecastMeanError: number;
+	forecastOverShare: number;
 }
 
 export interface ReportRow {
@@ -134,6 +140,8 @@ const COMP = "json_extract(usage, '$.completionTokens')";
 const PROVIDER = "CASE WHEN slug LIKE 'ollama/%' THEN 'ollama' ELSE 'openrouter' END";
 const STREAMED = "ttft_ms IS NOT NULL AND ttft_ms > 0 AND error IS NULL";
 const EST = "json_extract(usage, '$.cachedEstimated') = 1";
+/** Rows a forecast can be judged on: a reported cost, a prediction, clean and kept, not a side call. */
+const FORECASTABLE = "reported_usd > 0 AND predicted_usd IS NOT NULL AND wasted = 0 AND error IS NULL AND requested_model <> 'digest'";
 
 const ROW_SELECT = `
 	COUNT(*) AS dispatches,
@@ -213,6 +221,10 @@ export function buildUsageReport(
 				SUM(CASE WHEN requested_model = 'digest' THEN 1 ELSE 0 END) AS digests,
 				COALESCE(SUM(CASE WHEN requested_model = 'digest' THEN ${USD} ELSE 0 END), 0) AS digest_spend,
 				COALESCE(SUM(CASE WHEN requested_model = 'digest' THEN ${PT} ELSE 0 END), 0) AS digest_input,
+				SUM(CASE WHEN requested_model = 'digest' AND wasted = 1 THEN 1 ELSE 0 END) AS digest_reruns,
+				SUM(CASE WHEN ${FORECASTABLE} THEN 1 ELSE 0 END) AS fc_n,
+				COALESCE(SUM(CASE WHEN ${FORECASTABLE} THEN ABS(predicted_usd - reported_usd) / reported_usd END), 0) AS fc_err,
+				SUM(CASE WHEN ${FORECASTABLE} AND predicted_usd > reported_usd THEN 1 ELSE 0 END) AS fc_over,
 				SUM(CASE WHEN escalation_signal IS NOT NULL THEN 1 ELSE 0 END) AS escalations,
 				SUM(CASE WHEN instr(reasons, 'failover:') > 0 THEN 1 ELSE 0 END) AS failovers,
 				SUM(CASE WHEN error IS NOT NULL THEN 1 ELSE 0 END) AS errors,
@@ -232,6 +244,10 @@ export function buildUsageReport(
 		digests: number | null;
 		digest_spend: number;
 		digest_input: number;
+		digest_reruns: number | null;
+		fc_n: number | null;
+		fc_err: number;
+		fc_over: number | null;
 		escalations: number | null;
 		failovers: number | null;
 		errors: number | null;
@@ -354,6 +370,10 @@ export function buildUsageReport(
 			digests: t.digests ?? 0,
 			digestSpendUsd: t.digest_spend,
 			digestInputTokens: t.digest_input,
+			digestReruns: t.digest_reruns ?? 0,
+			forecastSamples: t.fc_n ?? 0,
+			forecastMeanError: (t.fc_n ?? 0) > 0 ? t.fc_err / (t.fc_n ?? 1) : 0,
+			forecastOverShare: (t.fc_n ?? 0) > 0 ? (t.fc_over ?? 0) / (t.fc_n ?? 1) : 0,
 		},
 		providers,
 		models,
@@ -419,7 +439,12 @@ export function reportView(r: UsageReport, opts: { maxModels?: number } = {}): R
 		);
 	}
 	if (t.digests > 0) {
-		summary.push(`digests: ${num(t.digests)} tool results condensed (${num(t.digestInputTokens)} tok read by a cheap model) for ${usd(t.digestSpendUsd)}`);
+		summary.push(
+			`digests: ${num(t.digests)} tool results condensed (${num(t.digestInputTokens)} tok read by a cheap model) for ${usd(t.digestSpendUsd)} · re-run rate ${pct(t.digestReruns / t.digests)} (${num(t.digestReruns)} fetched again in full)`,
+		);
+	}
+	if (t.forecastSamples > 0) {
+		summary.push(`forecast: mean error ${pct(t.forecastMeanError)} of reported cost over ${num(t.forecastSamples)} turns · ${pct(t.forecastOverShare)} over-predicted`);
 	}
 	if (t.subagentDispatches > 0) {
 		summary.push(`subagents: ${num(t.subagentDispatches)} dispatches, ${usd(t.subagentSpendUsd)} (${pct(t.spendUsd > 0 ? t.subagentSpendUsd / t.spendUsd : 0)} of spend)`);

package/src/cost/types.ts

@@ -303,4 +303,8 @@ export interface Ledger {
 	latestForSession?(ompSessionId: string): LedgerEntry | null;
 	/** Newest entries for an omp session, newest first. Optional. */
 	entriesForSession?(ompSessionId: string, limit: number): LedgerEntry[];
+	/** Deletes rows older than `retentionDays` (0 ⇒ none); returns how many. Optional. */
+	prune?(retentionDays: number, nowMs?: number): number;
+	/** Marks one row wasted after the fact (a digest the agent went back on). Optional. */
+	markWasted?(id: string): void;
 }

package/src/router/compaction.ts

@@ -64,7 +64,7 @@ export function validatePlan(
  * for the resource a call operates on (a `path`, `id`, `query`, ...). Used to
  * detect when a later call supersedes an earlier read of the same resource.
  */
-function primaryArg(argsJson: string): string | null {
+export function primaryArg(argsJson: string): string | null {
 	try {
 		const parsed: unknown = JSON.parse(argsJson);
 		if (parsed !== null && typeof parsed === "object") {