dsh-autotier 0.2.2 → 0.2.5

package/src/config.ts

@@ -7,6 +7,7 @@
  * @module dsh-autotier/config
  */
 
+import { isVolatile, type Volatile } from '@deepseek-ai/cosmokit'
 import {
   COST_MODES,
   EFFORT_IDS,
@@ -26,6 +27,7 @@ import type {
   ScenarioToggles,
   TierConfig,
   VisionConfig,
+  VolatileConfig,
 } from './schema.ts'
 
 export { Config } from './schema.ts'
@@ -39,8 +41,52 @@ export type {
   ScenarioToggles,
   TierConfig,
   VisionConfig,
+  VolatileConfig,
 } from './schema.ts'
 
+/**
+ * Read one config field that may arrive as a live reference or as plain data.
+ * The Loader hands `apply` a `VolatileConfig` (every section is a reference);
+ * a programmatic mount, a test, or `scripts/` hands plain data. Both faces feed
+ * the same resolver, so neither can drift from the other.
+ *
+ * `Volatile.get()` answers a deeply-readonly snapshot. The resolvers below read
+ * these values and then produce their own frozen output, so the read-only view
+ * is exactly the contract wanted; the cast re-widens it to the mutable field
+ * type so those signatures do not have to carry `readonly` everywhere.
+ *
+ * @param value - the field as handed to the plugin.
+ * @returns the current snapshot value.
+ */
+function unwrap<T>(value: Volatile<T> | T): T | undefined {
+  return isVolatile(value) ? (value.get() as T | undefined) : value
+}
+
+/**
+ * Read the plain-data config out of either accepted face.
+ *
+ * `exactOptionalPropertyTypes` is on, so an absent section is omitted rather
+ * than set to `undefined`: the resolvers below treat "key absent" and "key
+ * undefined" alike, but only the omitted form is assignable to `Config`.
+ *
+ * @param raw - the plugin configuration as received.
+ * @returns the plain-data config every resolver below reads.
+ */
+function plain(raw: Config | VolatileConfig | undefined): Config {
+  if (raw === undefined) return {}
+  const tiers = unwrap(raw.tiers)
+  const intent = unwrap(raw.intent)
+  const guard = unwrap(raw.guard)
+  const escalation = unwrap(raw.escalation)
+  return {
+    ...tiers === undefined ? {} : { tiers },
+    ...intent === undefined ? {} : { intent },
+    ...guard === undefined ? {} : { guard },
+    ...escalation === undefined ? {} : { escalation },
+    ...raw.routingMode === undefined ? {} : { routingMode: raw.routingMode },
+  }
+}
+
 /** One resolved fallback landing. */
 export interface ResolvedFallbackEntry {
   provider: string
@@ -314,12 +360,23 @@ function effectiveLanding(tier: ResolvedTierConfig): string {
  * Resolve raw config to the frozen runtime policy, re-judging every default,
  * bound and cross-field requirement.
  *
- * @param raw - raw loader config; `undefined` for a bare row.
+ * The cross-field judgement is the whole reason this module exists, and it is
+ * NOT expressed in the Schemastery schema: the host validates a form write
+ * against the schema alone, so a violation this function catches (a strong and
+ * a cheap tier landing on the same route, `hysteresis.toCheap >= toStrong`, a
+ * rule with neither a pattern nor a tool) would otherwise persist and only fail
+ * later. Every actor that can change the configuration therefore routes through
+ * here — the Loader at mount, and `settings.ts` on each `loader/volatile-update`
+ * — and refuses the change instead of storing something unroutable.
+ *
+ * @param raw - raw loader config; `undefined` for a bare row. Accepts both the
+ *   Loader's `VolatileConfig` face and the plain-data `Config` face.
  * @returns the frozen resolved config.
  * @throws {Error} when a value is out of bounds or a cross-field requirement fails.
  */
-export function resolveConfig(raw: Config | undefined): ResolvedConfig {
-  const tiers = raw?.tiers ?? {}
+export function resolveConfig(raw: Config | VolatileConfig | undefined): ResolvedConfig {
+  const source = plain(raw)
+  const tiers = source.tiers ?? {}
   const strong = resolveTier('strong', tiers.strong, DEFAULT_STRONG)
   const cheap = resolveTier('cheap', tiers.cheap, DEFAULT_CHEAP)
   const strongTriple = effectiveLanding(strong)
@@ -336,23 +393,24 @@ export function resolveConfig(raw: Config | undefined): ResolvedConfig {
         model: text('tiers.vision.model', tiers.vision?.model, DEFAULT_VISION.model),
       },
     },
-    intent: resolveIntent(raw?.intent),
-    guard: resolveGuard(raw?.guard),
-    escalation: resolveEscalation(raw?.escalation),
-    routingMode: member('routingMode', raw?.routingMode, 'auto', ROUTING_MODES),
+    intent: resolveIntent(source.intent),
+    guard: resolveGuard(source.guard),
+    escalation: resolveEscalation(source.escalation),
+    routingMode: member('routingMode', source.routingMode, 'auto', ROUTING_MODES),
   }
   return deepFreeze(resolved)
 }
 
 /**
- * Judge a configuration without keeping the resolved value. This is the
- * save-time hook the `autotier` settings namespace registers, so a user write
- * that violates a cross-field requirement is refused at the write instead of
- * silently disabling the plugin.
+ * Judge a configuration without keeping the resolved value.
  *
  * @param value - the configuration to judge.
  * @throws {Error} when the configuration is invalid.
+ * @deprecated The host no longer offers a `settings.register` validate hook, so
+ *   this is no longer wired as a save-time gate. {@link resolveConfig} is the
+ *   single judge and is called directly at mount and on every live update; this
+ *   alias remains exported because it is part of the plugin's published surface.
  */
-export function validateConfig(value: Config): void {
+export function validateConfig(value: Config | VolatileConfig): void {
   resolveConfig(value)
 }

package/src/index.ts

@@ -18,16 +18,18 @@
 import type { Context } from '@deepseek-ai/cordis'
 import type { SessionId } from '@deepseek-ai/dsh-session'
 import { registerTierCommand } from './command.ts'
-import { Config, resolveConfig, validateConfig, type Config as AutotierConfig } from './config.ts'
+import { resolveConfig, type Config as AutotierConfig, type VolatileConfig } from './config.ts'
 import { registerGuardHook } from './guard.ts'
 import { AutotierRouter } from './routing.ts'
+import { assertTierDefaultsInCatalog } from './preflight.ts'
 import { AutotierService } from './service.ts'
+import { bindSettings } from './settings.ts'
 import { AgentStateStore, registerTierProjection } from './state.ts'
 import { TierRemoteService } from './tier-remote.ts'
 import { registerTierTools } from './tools.ts'
 
 export { Config, resolveConfig, validateConfig } from './config.ts'
-export type { Config as AutotierConfig, ResolvedConfig } from './config.ts'
+export type { Config as AutotierConfig, ResolvedConfig, VolatileConfig } from './config.ts'
 export type {
   AutotierStatus,
   CostMode,
@@ -126,27 +128,29 @@ export const name = 'dsh-autotier'
 export const inject = ['settings', 'llm', 'tools', 'commands', 'sessions']
 
 /**
- * Mount the plugin: judge the configuration, register the `autotier` settings
- * namespace, publish the `ctx.autotier` service, and wire the routing listeners,
- * the `/tier` command and the two read-only tools.
+ * Mount the plugin: judge the configuration, claim the settings page policy,
+ * publish the `ctx.autotier` service, and wire the routing listeners, the
+ * `/tier` command and the two read-only tools.
  *
  * @param ctx - the plugin context.
- * @param config - the raw row configuration; every field is optional.
- * @throws {Error} when the configuration fails the cross-field judgement.
+ * @param config - the Loader's volatile row configuration. Also accepts the
+ *   plain-data `AutotierConfig` face, so a programmatic mount or a test can
+ *   pass literal values.
+ * @throws {Error} when the configuration fails the cross-field judgement, or
+ *   when a default tier model id is absent from a new-generation host catalogue.
  */
-export function apply(ctx: Context, config: AutotierConfig = {}): void {
-  // Resolve first so a bad row fails at mount, before any namespace is
-  // registered (fail loud, and leave no half-mounted state behind).
+export async function apply(ctx: Context, config: AutotierConfig | VolatileConfig = {}): Promise<void> {
+  // Resolve first so a bad row fails at mount, before any service is published
+  // (fail loud, and leave no half-mounted state behind).
   const resolved = resolveConfig(config)
-  // Consumer: the plugin reads and validates the shared settings namespace.
-  const scope = ctx.settings.register('autotier', Config, {
-    base: config,
-    applies: 'live',
-    validate: (value) => {
-      validateConfig(value)
-    },
-  })
-  const service = new AutotierService(ctx, { scope, config: resolved })
+  // Mount-time catalogue membership gate: on the 0.1.6 catalogue generation a
+  // default tier id outside the catalogue fails the mount loudly instead of
+  // silently degrading to a text-only passthrough (see assertTierDefaultsInCatalog).
+  await assertTierDefaultsInCatalog(ctx, resolved.tiers)
+  const service = new AutotierService(ctx, { config: resolved })
+  // Settings: claim this instance's page policy and follow live edits. Replaces
+  // the removed `ctx.settings.register('autotier', Config, { base, validate })`.
+  bindSettings({ ctx, config: config as VolatileConfig, service })
   registerTierProjection(ctx)
   const states = new AgentStateStore()
   new AutotierRouter({ ctx, service, states })

package/src/judge.ts

@@ -8,10 +8,31 @@
  */
 
 import type { Context } from '@deepseek-ai/cordis'
-import { BlockAssembler, createUserMessage, type GenerateOptions } from '@deepseek-ai/dsh-llm'
+import {
+  BlockAssembler,
+  boundContextSummary,
+  createUserMessage,
+  type ContextFormed,
+  type GenerateOptions,
+} from '@deepseek-ai/dsh-llm'
 import type { ResolvedConfig } from './config.ts'
 import type { Scenario, TierId } from './types.ts'
 
+/**
+ * This plugin's own message-source kind.
+ *
+ * The harness has no shared catch-all `plugin` kind: `MessageSourceMap` is a
+ * merge-extensible sum type, each producer declares its own `kind` in its own
+ * module, and the session format's physical-row admission rejects the retired
+ * `kind === 'plugin'` wrapper outright (`session-format-v3-to-v4`
+ * `assertV4SourceRowAdmission`, which nothing at runtime can bypass).
+ */
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'dsh-autotier': { kind: 'dsh-autotier' } & ContextFormed
+  }
+}
+
 /** The label vocabulary the judge is asked to choose from. */
 export const JUDGE_LABELS: readonly { readonly label: string; readonly scenario: Scenario }[] = [
   { label: 'coding', scenario: 'coding' },
@@ -117,7 +138,14 @@ export async function runJudge(
     model: route.model,
     messages: [createUserMessage({
       content: [{ type: 'text', text: prompt }],
-      source: { kind: 'plugin', plugin: 'dsh-autotier' },
+      // A producer-owned kind with a `notice` form: the one-line account is
+      // committed to the durable log, so a reader can tell why an extra model
+      // call happened without expanding the row.
+      source: {
+        kind: 'dsh-autotier',
+        form: 'notice',
+        summary: boundContextSummary(`autotier judge: classify intent (${route.provider}/${route.model})`),
+      },
     })],
     temperature: config.intent.judge.temperature,
     maxTokens: config.intent.judge.maxTokens,

package/src/preflight.ts

@@ -14,7 +14,7 @@
  */
 
 import type { Context } from '@deepseek-ai/cordis'
-import type { ResolvedTierConfig } from './config.ts'
+import type { ResolvedConfig, ResolvedTierConfig } from './config.ts'
 import type { TierRoute } from './types.ts'
 
 /** One cached model capability answer. */
@@ -103,3 +103,70 @@ export class RoutePreflight {
     return safe
   }
 }
+
+/**
+ * Mount-time default-model catalogue membership check.
+ *
+ * The 0.1.6 line removed the deepseek v4-flash* catalogue ids and introduced
+ * `deepseek-flash` (image-capable). On that catalogue generation a default
+ * tier id that is not in the host catalogue must fail the mount loudly —
+ * silently degrading to a text-only passthrough is exactly the N7 regression
+ * this check guards against.
+ *
+ * Generation gate: hosts whose catalogue predates the new vocabulary (e.g.
+ * `0.1.2-rc.1`, where none of the default ids exist) keep the accepted M2
+ * degradation (unlisted id ⇒ text-only) and skip the check with one
+ * documented log line, so mounting on the old compat rows is preserved.
+ *
+ * @param ctx - the plugin context.
+ * @param tiers - the resolved tier landings to verify.
+ * @throws {Error} when the catalogue is the new generation and a default
+ *   model id is not present in it.
+ */
+export async function assertTierDefaultsInCatalog(ctx: Context, tiers: ResolvedConfig['tiers']): Promise<void> {
+  const provider = 'deepseek-official'
+  const llm = ctx.llm
+  // Minimal llm faces (scripted harnesses, pared-down compositions) lack the
+  // catalogue seam; they keep the accepted degraded behavior and skip.
+  if (llm === undefined || typeof llm.listProviders !== 'function' || typeof llm.resolveModelInfo !== 'function') {
+    ctx.logger.info('dsh-autotier: the llm catalogue seam is unavailable; skipping the default-model catalogue check')
+    return
+  }
+  const registered = llm.listProviders().some(entry => entry.id === provider)
+  if (!registered) {
+    ctx.logger.info('dsh-autotier: provider "%s" is not registered; skipping the default-model catalogue check', provider)
+    return
+  }
+  const defaults = [
+    ['strong', tiers.strong.model],
+    ['cheap', tiers.cheap.model],
+    ['vision', tiers.vision.model],
+  ] as const
+  // New-generation probe: the catalogue is the 0.1.6 vocabulary when any of
+  // the default ids resolves; an old catalogue resolves none of them.
+  let newGeneration = false
+  for (const [, model] of defaults) {
+    try {
+      await llm.resolveModelInfo(provider, model)
+      newGeneration = true
+      break
+    } catch {
+      // Old catalogue or absent id: keep probing the other defaults.
+    }
+  }
+  if (!newGeneration) {
+    ctx.logger.info(
+      'dsh-autotier: the host catalogue predates the deepseek-flash vocabulary; skipping the default-model catalogue check (unlisted ids degrade to text-only on this host)',
+    )
+    return
+  }
+  for (const [tier, model] of defaults) {
+    try {
+      await llm.resolveModelInfo(provider, model)
+    } catch {
+      throw new Error(
+        `dsh-autotier: the default ${tier} model "${provider}/${model}" is not in the host catalogue; refusing to mount with a silent text-only landing`,
+      )
+    }
+  }
+}

package/src/routing.ts

@@ -146,6 +146,17 @@ export class AutotierRouter {
     this.ctx.on('agent/error', payload => this.onAgentError(payload.agent, payload.error))
     this.ctx.on('agent/request-error', (payload, next) => this.onRequestError(payload.agent, payload.provider, payload.failure, next))
     this.ctx.on('session/event', (session, event) => this.onSessionEvent(session, event))
+    // Backfill the per-agent state at creation so the first request never pays
+    // the lazy-init path on a hot turn; the listener is synchronous and a
+    // failure here is contained (the lazy path still exists as the fallback).
+    this.ctx.on('agent/created', payload => {
+      try {
+        this.states.for(payload.agent)
+      } catch (error) {
+        this.ctx.logger.warn('dsh-autotier: could not backfill routing state for the created agent (%o)', error)
+      }
+      return undefined
+    })
     this.ctx.effect(() => () => {
       this.disposed = true
       this.lifetime.abort()

package/src/schema.ts

@@ -8,6 +8,7 @@
  * @module dsh-autotier/schema
  */
 
+import type { Volatile } from '@deepseek-ai/cosmokit'
 import z from '@deepseek-ai/schemastery'
 import {
   COST_MODES,
@@ -105,6 +106,11 @@ export interface EscalationConfig {
  * Raw (possibly partial) plugin configuration. Every field is optional because
  * the resolver supplies the defaults; {@link resolveConfig} turns it into the
  * fully-resolved {@link ResolvedConfig}.
+ *
+ * This is the plain-data face of the row: a caller that builds a config in
+ * process (a test, a programmatic mount) passes this shape. The Loader hands
+ * `apply` the {@link VolatileConfig} face below, because every top-level field
+ * of {@link Config} is declared `.volatile()`.
  */
 export interface Config {
   tiers?: { strong?: TierConfig; cheap?: TierConfig; vision?: VisionConfig }
@@ -114,6 +120,31 @@ export interface Config {
   routingMode?: RoutingMode
 }
 
+/**
+ * What `apply` actually receives from the Loader. Each top-level field is a
+ * `Volatile` reference rather than a value, because the host's settings forms
+ * write through `loader/volatile-update` and a consumer must re-read with
+ * `.get()`.
+ *
+ * `.volatile()` is only legal on a fixed object path, so it sits on each
+ * top-level field — never inside `intent.rules` or `tiers.*.fallback`. Marking
+ * the whole section keeps every nested key live while staying inside that rule:
+ * a form edit of `intent.judge.maxTokens` replaces the `intent` snapshot, and
+ * the routing policy re-resolves from the new one.
+ *
+ * `routingMode` is deliberately NOT volatile: it is the composition default,
+ * and the live per-session switch is `RouteState.override` (written by `/tier`
+ * and the Remote `setMode`). Keeping it plain leaves that surface authoritative
+ * instead of introducing a second, document-backed way to change the mode.
+ */
+export interface VolatileConfig {
+  tiers: Volatile<{ strong?: TierConfig; cheap?: TierConfig; vision?: VisionConfig } | undefined>
+  intent: Volatile<IntentConfig | undefined>
+  guard: Volatile<GuardConfig | undefined>
+  escalation: Volatile<EscalationConfig | undefined>
+  routingMode: RoutingMode
+}
+
 
 /** The default strong tier: the catalog's quality-critical model at high effort. */
 export const DEFAULT_STRONG = {
@@ -126,7 +157,7 @@ export const DEFAULT_STRONG = {
 /** The default cheap tier: the catalog's routine/parallel model at low effort. */
 export const DEFAULT_CHEAP = {
   provider: 'deepseek-official',
-  model: 'deepseek-v4-flash',
+  model: 'deepseek-flash',
   effort: 'low' as const,
   followSession: true,
 }
@@ -134,7 +165,7 @@ export const DEFAULT_CHEAP = {
 /** The default vision landing: the catalog's only image-capable model. */
 export const DEFAULT_VISION = {
   provider: 'deepseek-official',
-  model: 'deepseek-v4-flash-vision-exp',
+  model: 'deepseek-flash',
 }
 
 /**
@@ -167,20 +198,28 @@ const cheapTier = z.object({
   })).default([]),
 })
 
-/** Schemastery schema: the loader validates and fills defaults before `apply`. */
-export const Config: z<Config> = z.object({
+/**
+ * Schemastery schema: the loader validates and fills defaults before `apply`.
+ *
+ * Each top-level section is `.volatile()` so a host settings-form write reaches
+ * a running plugin through `loader/volatile-update`. A section that owns no
+ * live-switchable field (`routingMode`) stays plain: `.volatile()` is an opt-in
+ * that adds a form-editable surface, and inventing one for a field the plugin
+ * already switches per session would give the same behaviour two owners.
+ */
+export const Config: z<Config, VolatileConfig> = z.object({
   tiers: z.object({
     strong: strongTier.default({ ...DEFAULT_STRONG, fallback: [] }),
     cheap: cheapTier.default({ ...DEFAULT_CHEAP, fallback: [] }),
     vision: z.object({
       provider: z.string().default('deepseek-official'),
-      model: z.string().default('deepseek-v4-flash-vision-exp'),
+      model: z.string().default('deepseek-flash'),
     }).default({ ...DEFAULT_VISION }),
   }).default({
     strong: { ...DEFAULT_STRONG, fallback: [] },
     cheap: { ...DEFAULT_CHEAP, fallback: [] },
     vision: { ...DEFAULT_VISION },
-  }),
+  }).volatile(),
   intent: z.object({
     ruleThreshold: z.number().min(0.000001).max(1).default(0.7),
     attemptBand: z.object({
@@ -263,7 +302,7 @@ export const Config: z<Config> = z.object({
       multimodal: true,
     },
     costMode: 'balanced',
-  }),
+  }).volatile(),
   guard: z.object({
     enabled: z.boolean().default(true),
     tiers: z.array(z.union(['cheap'])).default(['cheap']),
@@ -276,7 +315,7 @@ export const Config: z<Config> = z.object({
     whitelist: [],
     protectedPaths: ['.dsh', 'AGENTS.md', 'package.json', '.github/workflows'],
     interopDefend: 'auto',
-  }),
+  }).volatile(),
   escalation: z.object({
     threshold: z.number().step(1).min(1).max(100).default(2),
     windowMs: z.number().min(1).max(86_400_000).default(60_000),
@@ -289,7 +328,7 @@ export const Config: z<Config> = z.object({
     ttlMs: 180_000,
     fallbackTtlMs: 300_000,
     signature: true,
-  }),
+  }).volatile(),
   routingMode: z.union([...ROUTING_MODES]).default('auto'),
 })
 

package/src/selection.ts

@@ -1,28 +1,42 @@
 /**
- * Session-selection synchronisation and multi-router detection.
+ * Session-selection synchronisation.
  *
  * Two harness facts drive this module:
  *
  * 1. The GUI's model picker reads and writes the `agent-default-model`
- *    settings document, so a router that changes the tier must mirror the
- *    change there — otherwise the picker shows a model nobody is using. The
- *    mirror is best-effort: without `agentDefaultModel` it degrades to a
- *    no-op.
- * 2. A user's explicit choice must win. When the document changes to a value
- *    this module did not write, every live session switches to `delegated`
- *    (routing stops) until `/tier auto`.
+ *    configuration, so a router that changes the tier must mirror the change
+ *    there — otherwise the picker shows a model nobody is using. The mirror is
+ *    best-effort: without `agentDefaultModel` it degrades to a no-op.
+ * 2. A user's explicit choice must win. When the documented selection changes
+ *    to a value this module did not write, every live session switches to
+ *    `delegated` (routing stops) until `/tier auto`.
+ *
+ * Fact 2 used to ride the settings service's `settings/updated` commit event.
+ * That event no longer exists: the `0.1.6`-generation host replaced the
+ * settings *provider* with `SettingsForms` (a schema→form projector), so a
+ * plugin can no longer observe another plugin's document. What survives is the
+ * `agentDefaultModel` service itself, which now answers `currentSelection()` by
+ * reading its own live `Volatile` fields.
+ *
+ * Detection is therefore a comparison rather than a subscription: {@link
+ * SelectionSync.observeExternalSelection} freshly reads the documented selection
+ * and delegates when it differs from the value this module last wrote. It runs
+ * on the path that would otherwise overwrite the user — immediately before a
+ * tier is mirrored — so a user's pick can never be silently replaced by a
+ * routing decision, which is the property the old subscription protected.
  *
  * @module dsh-autotier/selection
  */
 
 import type { Context } from '@deepseek-ai/cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
-import type {} from '@deepseek-ai/dsh-settings'
 import type { AgentStateStore } from './state.ts'
 import type { TierRoute } from './types.ts'
 
 /** The subset of `ctx.agentDefaultModel` this module uses. */
 interface DefaultModelService {
+  /** Read the currently documented selection. */
+  currentSelection(): { provider: string; model: string; reasoningEffort?: string }
   saveSelection(next: { provider: string; model: string; reasoningEffort?: string }): Promise<void>
 }
 
@@ -61,15 +75,6 @@ export class SelectionSync {
   constructor(options: SelectionSyncOptions) {
     this.ctx = options.ctx
     this.states = options.states
-    this.ctx.on('settings/updated', (ns, next) => {
-      if (String(ns) !== 'agent-default-model') return
-      const key = selectionKey(next)
-      if (this.selfWrite === key) {
-        this.selfWrite = undefined
-        return
-      }
-      this.delegateLiveSessions(key)
-    })
   }
 
   /** The optional default-model service. */
@@ -78,13 +83,42 @@ export class SelectionSync {
   }
 
   /**
-   * Mirror one applied landing into the default-model document. Repeated
-   * landings with the same value are skipped, so a long cheap run writes once.
+   * Read the documented selection and delegate every live session when it is
+   * no longer the value this module wrote.
+   *
+   * Before this module's first write nothing is delegated, whatever the
+   * document holds: at that point "not ours" describes the composition default
+   * and any selection the user made before the plugin ever routed, and neither
+   * is an override of a routing decision. Once this module owns a write, any
+   * divergence is by construction somebody else's edit.
+   */
+  observeExternalSelection(): void {
+    if (this.selfWrite === undefined) return
+    const service = this.defaultModel
+    if (service === undefined) return
+    let current: unknown
+    try {
+      current = service.currentSelection()
+    } catch (error) {
+      this.ctx.logger.debug('dsh-autotier: could not read the default-model selection: %o', error)
+      return
+    }
+    const key = selectionKey(current)
+    if (key === this.selfWrite) return
+    this.delegateLiveSessions(key)
+  }
+
+  /**
+   * Mirror one applied landing into the default-model document. An external
+   * change to that document is honoured first, so routing never overwrites the
+   * model the user picked. Repeated landings with the same value are skipped,
+   * so a long cheap run writes once.
    * @param route - the landing actually applied.
    */
   noteRoute(route: TierRoute): void {
     const service = this.defaultModel
     if (service === undefined) return
+    this.observeExternalSelection()
     const selection = {
       provider: route.provider,
       model: route.model,

package/src/service.ts

@@ -9,8 +9,7 @@
  */
 
 import { Service, type Context } from '@deepseek-ai/cordis'
-import type { SettingsScope } from '@deepseek-ai/dsh-settings'
-import { resolveConfig, type Config, type ResolvedConfig } from './config.ts'
+import type { ResolvedConfig } from './config.ts'
 import { compileRules, PosteriorTable, type CompiledRule } from './intent.ts'
 import type { AutotierStatus, EffortId, TierRoute } from './types.ts'
 
@@ -23,9 +22,7 @@ declare module '@deepseek-ai/cordis' {
 
 /** Dependencies the service needs from the plugin's `apply`. */
 export interface AutotierServiceOptions {
-  /** The live settings scope; its value is re-resolved on every committed change. */
-  scope: SettingsScope<Config>
-  /** The configuration resolved at mount time (the composition base layer). */
+  /** The configuration resolved at mount time (the composition layer). */
   config: ResolvedConfig
 }
 
@@ -40,30 +37,35 @@ function routeOf(tier: { provider: string; model: string; effort: EffortId; foll
  * plugin unloading removes the service with every listener it owns.
  */
 export class AutotierService extends Service {
-  private readonly scope: SettingsScope<Config>
   private readonly posteriorTable = new PosteriorTable()
   private resolved: ResolvedConfig
   private compiled: CompiledRule[]
 
   /**
-   * Register the service as `ctx.autotier` and start following the settings
-   * namespace.
+   * Register the service as `ctx.autotier`.
    * @param ctx - the owning plugin context.
-   * @param options - the live settings scope and the mount-time configuration.
+   * @param options - the mount-time configuration.
    */
   constructor(ctx: Context, options: AutotierServiceOptions) {
     super(ctx, 'autotier')
-    this.scope = options.scope
     this.resolved = options.config
     this.compiled = compileRules(options.config.intent.rules)
-    ctx.effect(() => this.scope.watch((next) => {
-      // A committed settings write replaces the whole resolved policy. A value
-      // the schema accepted but the cross-field judge rejects keeps the last
-      // good policy: settings.register's validate hook already refused the
-      // write, so reaching here with an invalid value is impossible.
-      this.resolved = resolveConfig(next)
-      this.compiled = compileRules(this.resolved.intent.rules)
-    }))
+  }
+
+  /**
+   * Adopt a configuration a live settings write produced. The caller has
+   * already judged it through {@link resolveConfig}, so this only swaps the
+   * policy and recompiles the rule table.
+   *
+   * The whole policy is replaced, never merged: a settings form submits the
+   * complete Config, so a field the user cleared must fall back to its schema
+   * default rather than keep the previous live value.
+   *
+   * @param config - the newly resolved configuration.
+   */
+  reconfigure(config: ResolvedConfig): void {
+    this.resolved = config
+    this.compiled = compileRules(config.intent.rules)
   }
 
   /** The live resolved configuration. */