fix(routing): harden routed pool scheduling

crates/aether-data/contracts/src/repository/candidate_selection/mod.rs

@@ -2,7 +2,8 @@ mod types;
 
 pub use types::{
     MinimalCandidateSelectionReadRepository, MinimalCandidateSelectionRepository,
-    StoredMinimalCandidateSelectionRow, StoredPoolKeyCandidateOrder,
-    StoredPoolKeyCandidateRowsByKeyIdsQuery, StoredPoolKeyCandidateRowsQuery,
-    StoredProviderModelMapping, StoredRequestedModelCandidateRowsQuery,
+    StoredApiFormatCandidateRowsQuery, StoredMinimalCandidateSelectionRow,
+    StoredPoolKeyCandidateOrder, StoredPoolKeyCandidateRowsByKeyIdsQuery,
+    StoredPoolKeyCandidateRowsQuery, StoredProviderModelMapping,
+    StoredRequestedModelCandidateRowsQuery,
 };

crates/aether-data/contracts/src/repository/candidate_selection/types.rs

@@ -89,6 +89,13 @@ pub struct StoredRequestedModelCandidateRowsQuery {
     pub limit: u32,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct StoredApiFormatCandidateRowsQuery {
+    pub api_format: String,
+    pub offset: u32,
+    pub limit: u32,
+}
+
 impl StoredMinimalCandidateSelectionRow {
     pub fn supports_streaming(&self) -> bool {
         self.model_supports_streaming
@@ -119,6 +126,19 @@ pub trait MinimalCandidateSelectionReadRepository: Send + Sync {
         api_format: &str,
     ) -> Result<Vec<StoredMinimalCandidateSelectionRow>, crate::DataLayerError>;
 
+    async fn list_for_exact_api_format_page(
+        &self,
+        query: &StoredApiFormatCandidateRowsQuery,
+    ) -> Result<Vec<StoredMinimalCandidateSelectionRow>, crate::DataLayerError> {
+        Ok(self
+            .list_for_exact_api_format(&query.api_format)
+            .await?
+            .into_iter()
+            .skip(query.offset as usize)
+            .take(query.limit as usize)
+            .collect())
+    }
+
     async fn list_for_exact_api_format_and_global_model(
         &self,
         api_format: &str,

crates/aether-data/contracts/src/repository/pool_scores/helpers.rs

@@ -17,7 +17,10 @@ pub fn merge_score_reason_patch(
 }
 
 pub fn score_with_delta(score: f64, delta_basis_points: Option<i32>) -> f64 {
-    let delta = delta_basis_points.unwrap_or_default() as f64 / 10_000.0;
+    let Some(delta_basis_points) = delta_basis_points else {
+        return score;
+    };
+    let delta = delta_basis_points as f64 / 10_000.0;
     (score + delta).clamp(0.0, 1.0)
 }
 
@@ -46,3 +49,19 @@ pub fn u64_opt_from_i64(
 ) -> Result<Option<u64>, crate::DataLayerError> {
     value.map(|value| u64_from_i64(value, field)).transpose()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::score_with_delta;
+
+    #[test]
+    fn score_without_delta_is_unchanged() {
+        assert_eq!(score_with_delta(1_000.0, None), 1_000.0);
+    }
+
+    #[test]
+    fn score_with_delta_remains_bounded() {
+        assert_eq!(score_with_delta(0.95, Some(1_000)), 1.0);
+        assert_eq!(score_with_delta(0.05, Some(-1_000)), 0.0);
+    }
+}