Report usage command quotas as percentages

.env.example

@@ -239,6 +239,26 @@ ALLOW_API_KEY_REVEAL=false
 # Default: 10485760 (10 MB)
 # MAX_BODY_SIZE_BYTES=10485760
 
+# Heap-pressure-aware admission for POST /v1/chat/completions (#5152). A large
+# coding-agent "compact" body amplifies into hundreds of MB of transient JS objects
+# on the combo path; concurrent compacts can stack past the V8 heap ceiling and OOM
+# the process. These shed a LARGE body with 503 (Retry-After) only while the heap is
+# already under pressure — healthy heap admits every body untouched.
+# Used by: src/shared/middleware/chatBodyAdmission.ts
+# Bodies below this size skip the guard entirely (heap not even sampled). Default 262144 (256 KB).
+# OMNIROUTE_CHAT_LARGE_BODY_BYTES=262144
+# Hard cap — bodies above this are rejected with 413 before any clone/parse. Default 52428800 (50 MB).
+# OMNIROUTE_CHAT_HARD_MAX_BODY_BYTES=52428800
+# Shed large bodies once heapUsed/heap_size_limit reaches this ratio (0<r<1). Default 0.75.
+# OMNIROUTE_CHAT_HEAP_SHED_RATIO=0.75
+
+# Hard cap (bytes) for a non-streaming upstream response buffered fully into memory
+# (#5152). Past this the upstream reader is cancelled and the request fails fast
+# instead of growing an unbounded string until the V8 heap is exhausted.
+# Used by: open-sse/handlers/chatCore/nonStreamingResponseBody.ts
+# Default: 67108864 (64 MB)
+# OMNIROUTE_MAX_NONSTREAMING_RESPONSE_BYTES=67108864
+
 # CORS configuration — controls which cross-origin browser clients can call the API.
 # Used by: src/server/cors/origins.ts — sets Access-Control-Allow-Origin.
 # Same-origin dashboard requests behind a reverse proxy do not need CORS; set
@@ -654,6 +674,13 @@ PROVIDER_LIMITS_SYNC_SPACING_MS=1500
 # Used by: open-sse/services/compression/engines/rtk/filterLoader.ts.  Default: 0.
 #OMNIROUTE_RTK_TRUST_PROJECT_FILTERS=0
 
+# T02 stacked-pipeline engine circuit-breaker (OPT-IN, default off). When enabled, a compression
+# engine that throws repeatedly across requests is skipped (fail-open) for a cooldown.
+# Used by: open-sse/services/compression/pipelineEngineBreaker.ts.
+#COMPRESSION_PIPELINE_BREAKER_ENABLED=false       # master switch (default false)
+#COMPRESSION_PIPELINE_BREAKER_THRESHOLD=3         # consecutive failures before the engine opens
+#COMPRESSION_PIPELINE_BREAKER_COOLDOWN_MS=30000   # ms the engine stays skipped before a probe
+
 # Skip the postinstall native-runtime warm-up (useful in CI / headless installs). Default: 0.
 # Used by: scripts/postinstall.mjs.
 #OMNIROUTE_SKIP_POSTINSTALL=0
@@ -1245,6 +1272,13 @@ APP_LOG_TO_FILE=true
 # Default: 86400 (24 hours)
 # MODELS_DEV_SYNC_INTERVAL=86400
 
+# Self-correcting context-window reconciler interval in seconds (feature 5004).
+# Pins provider-declared windows from /models discovery as auto:discovery overrides
+# when they diverge from the catalog. Set to 0 to disable. Never overwrites manual overrides.
+# Used by: src/lib/contextWindowResolver.ts
+# Default: 86400 (24 hours)
+# CONTEXT_WINDOW_RECONCILE_INTERVAL=86400
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 20. PROVIDER-SPECIFIC SETTINGS
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1731,6 +1765,11 @@ PLAYGROUND_COMPARE_MAX_COLUMNS=4
 # MEMORY_VEC_TOP_K=20                           # default top-K for vector search
 # MEMORY_RRF_K=60                               # RRF k constant (sqlite-vec hybrid recipe)
 # HF_HUB_ENDPOINT=https://huggingface.co        # override Hugging Face Hub base URL for static potion downloads
+# TV6 typed memory decay (OPT-IN, default off — the sweep DELETES decayed memories)
+# MEMORY_TYPED_DECAY_ENABLED=false              # master switch for the destructive sweep (default off)
+# MEMORY_TYPED_DECAY_EPISODIC_DAYS=30           # episodic TTL in days; 0 = episodic immune too
+# MEMORY_TYPED_DECAY_ACCESS_IMMUNITY=3          # access_count >= N → immune; 0 disables access immunity
+# MEMORY_TYPED_DECAY_SWEEP_INTERVAL=0           # periodic sweep interval (seconds); 0 = no periodic sweep
 # AgentBridge + Traffic Inspector (Group A)
 
 # AgentBridge

.github/workflows/quality.yml

@@ -52,6 +52,10 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:test-runner-api
+      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
+      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
+      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
+      - run: npm run check:mutation-test-coverage
       - run: npm run check:any-budget:t11
       # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
       # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.

.gitignore

@@ -229,3 +229,6 @@ docs/prompts/AGENT-OWNERSHIP-PROTOCOL.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mim.md
 docs/prompts/AGENT-OWNERSHIP-PROTOCOL.omniroute-mid.md
 omniroute.md
+
+# mise configuration
+mise.toml

AGENTS.md

@@ -3,12 +3,12 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **236 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **237 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
 with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.40)**: providers 236 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
+> **Live counts (v3.8.40)**: providers 237 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
 > open-sse services 298 · routing strategies 17 · auto-combo scoring factors 12 ·
 > DB modules 94 · DB migrations 106 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**