@ebony-vinyl/dsh-our-free-model 2.8.0 → 2.8.2

package/src/bun-fetch.js

@@ -1,15 +1,17 @@
-import { accessSync, constants, statSync, writeFileSync, mkdtempSync } from 'node:fs';
+import { accessSync, constants, existsSync, mkdirSync, statSync, writeFileSync, mkdtempSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { delimiter, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { PassThrough, Readable } from 'node:stream';
+import { DATA_DIR_NAME, resolveDshHome } from './store.js';
 
 /**
  * The worker source, inlined so the published package stays inside the
  * historical updater's 80-file ceiling (adding a second file overran it).
- * It is written once to a private temporary directory and reused for the
- * process lifetime. It speaks one JSON line on stdin and returns one metadata
- * line plus raw response bytes on stdout; no request content is evaluated.
+ * It is written once to the plugin data directory and reused for the process
+ * lifetime, re-created when an external sweep deletes it. It speaks one JSON
+ * line on stdin and returns one metadata line plus raw response bytes on
+ * stdout; no request content is evaluated.
  */
 const WORKER_SOURCE = `import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
@@ -37,13 +39,34 @@ try {
 
 let workerPath;
 
-/** Materialize the inlined worker once; never executes request content. */
+/**
+ * Materialize the inlined worker; never executes request content.
+ *
+ * The file lives under the plugin's own data directory rather than the OS temp
+ * directory, and its existence is re-checked on every call. Both details are
+ * load-bearing: the path used to be memoized into `tmpdir()`, so a temp sweep
+ * that deleted `ofm-bun-worker-*` left every later request in that process
+ * failing with `Bun worker failed before completing the response` — bun exits 1
+ * on a missing entry script, before it can reach the network — until the whole
+ * plugin was restarted. Re-materializing a missing file makes the sweep
+ * self-healing, and an unwritable home still falls back to temp so the lane
+ * degrades to the previous behavior rather than failing to start.
+ */
 export function bunWorkerPath() {
-  if (workerPath !== undefined) return workerPath;
-  const dir = mkdtempSync(join(tmpdir(), 'ofm-bun-worker-'));
-  const file = join(dir, 'worker.mjs');
-  writeFileSync(file, WORKER_SOURCE, { mode: 0o600 });
-  workerPath = file;
+  if (workerPath !== undefined && existsSync(workerPath)) return workerPath;
+  try {
+    const dir = join(resolveDshHome(), DATA_DIR_NAME, 'run');
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, 'worker.mjs');
+    writeFileSync(file, WORKER_SOURCE, { mode: 0o600 });
+    workerPath = file;
+  } catch {
+    // mkdir may succeed for an existing directory even when writing the worker
+    // fails. Both operations must be covered by the fallback.
+    const dir = mkdtempSync(join(tmpdir(), 'ofm-bun-worker-'));
+    workerPath = join(dir, 'worker.mjs');
+    writeFileSync(workerPath, WORKER_SOURCE, { mode: 0o600 });
+  }
   return workerPath;
 }
 

package/src/catalog.js

@@ -17,8 +17,11 @@ import { baseModelId, isResponsesModel } from './upstream.js'
 /** Free-tier ids the listing does not mark with a `-free` suffix. `big-pickle`
  *  is the lane's own long-standing free id (9router keeps the same id in its
  *  `KNOWN_FREE_OPENCODE_MODELS` for exactly this reason); models.dev prices it
- *  at 0/0. */
-const ALWAYS_FREE = new Set(['union-alpha', 'space-bunny-free', 'big-pickle'])
+ *  at 0/0. `union-alpha` (the lane's Messages-wire id) and `space-bunny-free`
+ *  retired from the live listing in the 2026-10-31 churn and are no longer
+ *  advertised — they stay classified here so a listing that revives them is
+ *  still served, and so the wire tests keep an honest Messages vehicle. */
+const ALWAYS_FREE = new Set(['big-pickle', 'union-alpha', 'space-bunny-free'])
 
 /**
  * Local capability baseline. `contextWindow`/`maxOutput` are the provider's
@@ -126,12 +129,36 @@ const FREE_ID_OVERRIDES = {
     effortPatch: { reasoning_effort: '$effort' },
     effortOffPatch: { reasoning_effort: 'none' },
   },
-  // models.dev: effort low|medium|high|xhigh|max; 1M window, 524288 output.
-  'space-bunny-free': {
-    vision: true, contextWindow: 1048576, maxOutput: 524288,
+  // models.dev (2026-11-06 roster): the live free set as the Oct-31 churn left
+  // it. Numbers are models.dev's published limits; region-gated ids (beam,
+  // crouton, pulse) are marked in REGION_SENSITIVE, not here.
+  'beam-free': {
+    vision: false, contextWindow: 1048576, maxOutput: 131072,
+    efforts: ['low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  'flint-40b-free': {
+    vision: false, contextWindow: 262144, maxOutput: 65536,
     efforts: ['low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
   },
+  'pulse-alpha-free': {
+    vision: true, contextWindow: 1048576, maxOutput: 131072,
+    efforts: ['low', 'high', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  // models.dev: 1M window, 270000 output, effort minimal..max (no `none` —
+  // thinking does not switch off in practice, so the menu starts at minimal).
+  'crouton-alpha-free': {
+    vision: true, contextWindow: 1048576, maxOutput: 262144,
+    efforts: ['minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  // models.dev: 262144/262144, reasoning_options empty → no level menu, so the
+  // free lane's token ladder applies.
+  'nemotron-3.5-lightning-free': {
+    vision: false, contextWindow: 262144, maxOutput: 262144,
+  },
   // models.dev: 1M window, 131072 output, reasoning_options `toggle` only →
   // no level menu, so the free lane's token ladder applies.
   'longcat-2.5-preview-free': {
@@ -145,22 +172,19 @@ const FREE_ID_OVERRIDES = {
 /** Human-facing display names, so a raw upstream id never reaches the picker. */
 const DISPLAY_NAMES = {
   'mimo-v2.6-flash-free': 'MiMo V2.6 Flash',
-  'mimo-v2.5-free': 'MiMo V2.5',
-  'muse-spark-1.3-contributor-free': 'Muse Spark 1.3',
-  'muse-spark-1.2-contributor-free': 'Muse Spark 1.2',
-  'nemotron-3-ultra-free': 'Nemotron 3 Ultra',
+  'beam-free': 'Beam Free',
+  'flint-40b-free': 'Flint 40B Free',
+  'pulse-alpha-free': 'Pulse Alpha Free',
+  'crouton-alpha-free': 'Crouton Alpha Free',
   'nemotron-3.5-lightning-free': 'Nemotron 3.5 Lightning',
-  'ling-3.0-flash-fin-free': 'Ling 3.0 Flash Fin',
-  'space-bunny-free': 'Space Bunny',
-  'union-alpha': 'Union Alpha',
-  'deepseek-v4-flash-free': 'DeepSeek V4 Flash',
   'deepseek-v4.1-flash-free': 'DeepSeek V4.1 Flash',
   'glm-5.3-flash-free': 'GLM 5.3 Flash',
-  'jev-1.13-free': 'Jev 1.13',
 }
 
-/** Ids whose regional availability is known to be egress-dependent. */
-const REGION_SENSITIVE = [/^muse.?spark/]
+/** Ids whose regional availability is known to be egress-dependent. The 2.2
+ * docs name Beam Free, Crouton Alpha Free and Pulse Alpha Free as region-gated;
+ * `muse-spark` kept its marker from the era it served. */
+const REGION_SENSITIVE = [/^muse.?spark/, /^beam/, /crouton/, /pulse-alpha/]
 
 /**
  * Is this id on the免密 lane? The gateway's listing mixes paid and free ids;
@@ -666,3 +690,103 @@ export function reviveKiloCatalog(stored) {
 export function isKiloEntry(entry) {
   return entry?.channel === KILO_CHANNEL
 }
+
+// ── the extension lane ─────────────────────────────────────────────────────────
+
+/** Catalog tag for models an installed extension serves. */
+export const EXTENSION_CHANNEL = 'extension'
+
+/** The built-in lanes an extension may take over (`replaces`). Kept in step
+ *  with the marketplace's policy and with the runtime's takeover: only `kilo`
+ *  is actually stood down (`laneStandsDown` in src/core/runtime.js), and the
+ *  marketplace validator refuses any other claim — listing a lane here that
+ *  nothing implements would hand an extension the built-in ids and then lose
+ *  its rows to the built-in they collide with. */
+const REPLACEABLE_LANES = new Set(['kilo'])
+
+/** Wire spellings an extension channel may speak. */
+const EXTENSION_WIRES = new Set(['chat', 'responses', 'messages'])
+
+/**
+ * The catalog id one extension model answers to. Extension models are
+ * namespaced (`ext:<plugin>/<model>`) so a third-party roster can never shadow
+ * a built-in id by accident — unless the extension `replaces` that lane, in
+ * which case its models keep the lane's own ids and the built-in rows stand
+ * down (the kilo-free official extension demonstrates exactly this).
+ */
+export function extensionModelId(manifestId, modelId, replaces) {
+  const clean = String(modelId ?? '').trim()
+  if (replaces !== undefined && REPLACEABLE_LANES.has(replaces)) return clean
+  return `ext:${String(manifestId ?? '').trim()}/${clean}`
+}
+
+/** Is this catalog row served by an installed extension? */
+export function isExtensionEntry(entry) {
+  return entry?.channel === EXTENSION_CHANNEL
+}
+
+/** Normalize one `listModels`/manifest model row into a catalog entry, or null. */
+function extensionEntryOf(manifest, row) {
+  if (row === null || typeof row !== 'object' || Array.isArray(row)) return null
+  const modelId = typeof row.id === 'string' ? row.id.trim() : ''
+  if (modelId === '' || modelId.length > 128) return null
+  const wire = EXTENSION_WIRES.has(row.wire) ? row.wire : 'chat'
+  const contextWindow = number(row.contextWindow) ?? 131072
+  const entry = {
+    id: extensionModelId(manifest.id, modelId, manifest.replaces),
+    name: typeof row.name === 'string' && row.name.trim() !== '' ? row.name.trim() : displayModelName(modelId),
+    channel: EXTENSION_CHANNEL,
+    extensionId: manifest.id,
+    extensionName: typeof manifest.name === 'string' ? manifest.name : manifest.id,
+    modelId,
+    wire,
+    vision: row.vision === true,
+    reasoning: row.reasoning !== false,
+    contextWindow,
+    maxOutput: number(row.maxOutput) ?? Math.min(32768, contextWindow),
+    canDisableThinking: true,
+    regionSensitive: false,
+    source: 'manifest',
+  }
+  if (Array.isArray(row.efforts) && row.efforts.length > 0) {
+    const efforts = row.efforts.filter(level => typeof level === 'string' && level !== '').slice(0, 8)
+    if (efforts.length > 0) {
+      entry.efforts = efforts
+      entry.effortDefault = efforts.includes(row.effortDefault) ? row.effortDefault : efforts[efforts.length - 1]
+      // The declared level rides the wire as the model's own effort field — the
+      // extension names its own spelling via `effortKey` when it is not the
+      // common `reasoning_effort`/`reasoning.effort` shapes.
+      const key = typeof row.effortKey === 'string' && row.effortKey.trim() !== '' ? row.effortKey.trim() : null
+      entry.effortPatch = key !== null ? { [key]: '$effort' } : { reasoning_effort: '$effort' }
+      entry.canDisableThinking = efforts.includes('disabled') || efforts.includes('none')
+    }
+  }
+  return entry
+}
+
+/**
+ * Build the extension lane's catalog rows from one installed channel
+ * extension's model list. Rows that repeat an id are dropped.
+ */
+export function buildExtensionCatalog(manifest, rows) {
+  if (!manifest || typeof manifest !== 'object' || typeof manifest.id !== 'string') return []
+  const seen = new Set()
+  const entries = []
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const entry = extensionEntryOf(manifest, row)
+    if (entry === null || seen.has(entry.id)) continue
+    seen.add(entry.id)
+    entries.push(entry)
+  }
+  return entries
+}
+
+/**
+ * Which built-in lane an enabled extension takes over, or null. Only one
+ * extension may replace a lane; the first enabled claim wins and the rest are
+ * ignored until the conflict is resolved.
+ */
+export function extensionReplaces(manifest) {
+  const replaces = typeof manifest?.replaces === 'string' ? manifest.replaces : ''
+  return REPLACEABLE_LANES.has(replaces) ? replaces : null
+}

package/src/core.js

@@ -199,15 +199,14 @@ import { fetchKiloListing } from "./kilo.js";
 import { sessionForConversation } from "./upstream.js";
 import { isSubscriptionEntry, subscriptionCatalog } from "./subscription-adapter.js";
 var FALLBACK_CATALOG = buildCatalog([
+  "deepseek-v4.1-flash-free",
+  "glm-5.3-flash-free",
   "mimo-v2.6-flash-free",
-  "mimo-v2.5-free",
-  "ling-3.0-flash-fin-free",
-  "nemotron-3-ultra-free",
   "nemotron-3.5-lightning-free",
-  "space-bunny-free",
-  "muse-spark-1.3-contributor-free",
-  "muse-spark-1.2-contributor-free"
+  "nemotron-3.5-super-vl-free",
+  "flint-40b-free"
 ]);
+var LANE_QUOTA_DEFAULT_MS = 6 * 60 * 60 * 1e3;
 function createRuntimeStores({ dataDir, logger = console }) {
   if (typeof dataDir !== "string" || !path.isAbsolute(dataDir)) {
     throw new TypeError("dataDir must be an absolute path");
@@ -252,7 +251,8 @@ function createModelRuntime({
   },
   onTopology = () => {
   },
-  subscriptionRuntime
+  subscriptionRuntime,
+  extensionRuntime = null
 }) {
   let catalog = materializeCatalog(catalogStore.get().entries ?? []);
   let sealedCatalog = sealedCredential() === null ? [] : buildEacCatalog(catalogStore.get().sealIds ?? []);
@@ -260,6 +260,7 @@ function createModelRuntime({
   let aggregateCatalog = [];
   let subscriptionEntries = [];
   let comboCatalog = [];
+  let extensionCatalog = [];
   let freeCatalog = catalog;
   let egress = availability.get().egress ?? null;
   let gatewayLatency = { ms: 0, at: 0 };
@@ -267,10 +268,13 @@ function createModelRuntime({
   const lifetime = new AbortController();
   let egressGeneration = 0;
   const rebuildCatalog = () => {
+    const replacedLane = extensionRuntime?.replacesLane ?? null;
+    const laneStandsDown = (entry) => replacedLane === "kilo" && isKiloEntry(entry);
     const seen = /* @__PURE__ */ new Set();
     const merged = [];
-    for (const entry of [...freeCatalog, ...sealedCatalog, ...kiloCatalog, ...aggregateCatalog, ...subscriptionEntries]) {
+    for (const entry of [...freeCatalog, ...sealedCatalog, ...kiloCatalog, ...aggregateCatalog, ...extensionCatalog, ...subscriptionEntries]) {
       if (entry === null || entry === void 0 || seen.has(entry.id)) continue;
+      if (laneStandsDown(entry)) continue;
       seen.add(entry.id);
       merged.push(entry);
     }
@@ -287,6 +291,7 @@ function createModelRuntime({
   const mergeCatalogs = () => {
     aggregateCatalog = buildAggregateCatalog(settings.get().aggregate ?? {});
     subscriptionEntries = subscriptionCatalog(subscriptionRuntime);
+    extensionCatalog = extensionRuntime === null ? [] : extensionRuntime.catalog ?? [];
     rebuildCatalog();
   };
   mergeCatalogs();
@@ -295,6 +300,7 @@ function createModelRuntime({
     membership: computeMembership(catalog, availability.get(), settings.get()),
     settings: settings.get(),
     attributionUserAgent,
+    lane: laneRow(),
     routing: {
       quota: subscriptionRuntime?.routingQuota?.() ?? {},
       usage: Object.fromEntries(catalog.map((row) => [row.id, stats.get().models?.[row.id]?.calls ?? 0]))
@@ -303,11 +309,71 @@ function createModelRuntime({
   const emitTopology = () => {
     if (!disposed) onTopology();
   };
+  function laneRow() {
+    return availability.get().lane ?? null;
+  }
+  function setLaneState(laneState, extra = {}) {
+    availability.edit((value) => ({ ...value, lane: { state: laneState, at: Date.now(), ...extra } }));
+    availability.flush();
+    emitTopology();
+  }
+  function laneGate() {
+    const lane = laneRow();
+    if (!lane || lane.state === "ok" || lane.state === void 0) return { ok: true };
+    if (lane.state === "quota") {
+      if (!Number.isFinite(lane.retryAt) || lane.retryAt <= Date.now()) return { ok: true };
+      return { ok: false, state: "quota", retryAt: lane.retryAt, message: lane.message ?? "" };
+    }
+    if (lane.state === "locked") {
+      return { ok: false, state: "locked", message: lane.message ?? "" };
+    }
+    return { ok: true };
+  }
+  function clearLaneBreaker() {
+    const lane = laneRow();
+    if (!lane || lane.state === "ok") return false;
+    setLaneState("ok");
+    return true;
+  }
+  function recordPassiveResult(model, resultState, extra = {}) {
+    availability.edit((value) => ({
+      ...value,
+      results: {
+        ...value.results,
+        [model]: { ...value.results?.[model] ?? {}, state: resultState, source: "passive", at: Date.now(), ...extra }
+      }
+    }));
+    availability.flush();
+  }
+  function noteFreeLaneOutcome({ entry, ok, error } = {}) {
+    if (disposed || !entry || entry.channel) return;
+    if (ok === true) {
+      const lane = laneRow();
+      if (lane && lane.state !== "ok") setLaneState("ok");
+      recordPassiveResult(entry.id, STATE.available);
+      return;
+    }
+    const code = error?.code;
+    if (code === CODE.quota) {
+      const retryAfter = Number(error?.providerRetryAfterMs);
+      const retryAt = Number.isFinite(retryAfter) && retryAfter > 0 ? Date.now() + retryAfter : Date.now() + LANE_QUOTA_DEFAULT_MS;
+      setLaneState("quota", { retryAt, message: String(error?.message ?? "free usage limit reached").slice(0, 300) });
+      recordPassiveResult(entry.id, STATE.throttled);
+      return;
+    }
+    if (code === CODE.laneLocked) {
+      setLaneState("locked", { message: String(error?.message ?? "the free tier answers this client only").slice(0, 300) });
+      recordPassiveResult(entry.id, STATE.unavailable);
+      return;
+    }
+    if (code === CODE.region) recordPassiveResult(entry.id, STATE.regionBlocked);
+  }
   const adapter = new FreeModelAdapter({
     state,
     resolveImage,
     subscriptionRuntime,
     sealedCredential,
+    extensionRuntime,
     recordUsage: (record) => {
       if (disposed) return;
       recordUsage(stats, record);
@@ -316,7 +382,12 @@ function createModelRuntime({
     recordTurn: (record) => {
       if (!disposed) recordTurn(stats, record);
     },
-    warn: (message) => logger.warn?.(message) ?? logger.log?.(message)
+    warn: (message) => logger.warn?.(message) ?? logger.log?.(message),
+    freeLaneGate: laneGate,
+    onFreeLaneOutcome: noteFreeLaneOutcome,
+    onRegionBlocked: (modelId) => {
+      if (!disposed) recordPassiveResult(modelId, STATE.regionBlocked);
+    }
     // Automatic probing is disabled by owner policy: a region refusal from a
     // real turn stays a turn failure and never fires a background probe.
   });
@@ -324,7 +395,7 @@ function createModelRuntime({
   let catalogRefreshForced = false;
   let catalogRefreshProbed = false;
   async function refreshCatalog(opts) {
-    const { probe = false, force = false, report = false } = opts ?? {};
+    const { probe = false, force = false, report = false, throttleListing = false } = opts ?? {};
     const result = (value) => report ? value : value.catalog;
     if (disposed) return result({ catalog, sources: {} });
     while (catalogRefresh !== null) {
@@ -334,7 +405,7 @@ function createModelRuntime({
       const value = await shared;
       if (disposed || (!force || sharedForced) && (!probe || sharedProbed)) return result(value);
     }
-    const run = refreshCatalogOnce({ probe, force });
+    const run = refreshCatalogOnce({ probe, force, throttleListing });
     catalogRefresh = run;
     catalogRefreshForced = force;
     catalogRefreshProbed = probe;
@@ -348,13 +419,21 @@ function createModelRuntime({
       }
     }
   }
-  async function refreshCatalogOnce({ probe, force }) {
+  const LISTING_MIN_INTERVAL_MS = 10 * 6e4;
+  let lastListingAt = 0;
+  async function refreshCatalogOnce({ probe, force, throttleListing }) {
     const sources = {};
     let ids = [];
-    try {
-      ids = parseListing(await fetchListing());
-    } catch (error) {
-      if (!disposed) logger.warn?.(`our-free-model: model listing refresh failed (${error?.message ?? error}); keeping the cached catalog`);
+    if (throttleListing === true && !force && Date.now() - lastListingAt < LISTING_MIN_INTERVAL_MS && freeCatalog.length > 0) {
+      ids = freeCatalog.map((entry) => entry.id);
+      sources.free = { ok: true, count: freeCatalog.length, skipped: "recent" };
+    } else {
+      try {
+        ids = parseListing(await fetchListing());
+        lastListingAt = Date.now();
+      } catch (error) {
+        if (!disposed) logger.warn?.(`our-free-model: model listing refresh failed (${error?.message ?? error}); keeping the cached catalog`);
+      }
     }
     if (disposed) return { catalog, sources };
     if (ids.length > 0) {
@@ -365,7 +444,7 @@ function createModelRuntime({
     } else {
       freeCatalog = materializeCatalog(catalogStore.get().entries ?? []);
     }
-    sources.free = { ok: ids.length > 0, count: freeCatalog.length };
+    if (sources.free === void 0) sources.free = { ok: ids.length > 0, count: freeCatalog.length };
     sources.sealed = await refreshSealedRoster();
     if (disposed) return { catalog, sources };
     sources.kilo = { ok: await refreshKiloRoster(), count: kiloCatalog.length };
@@ -436,12 +515,13 @@ function createModelRuntime({
   }
   let probeRound = null;
   let probeRoundGeneration = 0;
-  let probeThrottleStreak = 0;
   let probeBackoffUntil = 0;
-  async function runProbeRound() {
+  async function runProbeRound(onlyModel) {
     const generation = egressGeneration;
-    const probeable = catalog.filter((entry) => !isEacEntry(entry) && !isKiloEntry(entry) && !isAggregateEntry(entry) && !isComboEntry(entry) && !isSubscriptionEntry(entry));
-    const results = await probeCatalog(probeable, { attributionUserAgent, signal: lifetime.signal }, (id, result) => {
+    const probeable = catalog.filter((entry) => !entry.channel && !isComboEntry(entry));
+    const targets = typeof onlyModel === "string" && onlyModel !== "" ? probeable.filter((entry) => entry.id === onlyModel) : probeable.filter((entry) => entry.pinned === true).slice(0, 1).length > 0 ? probeable.filter((entry) => entry.pinned === true).slice(0, 1) : probeable.slice(0, 1);
+    if (targets.length === 0) return {};
+    const results = await probeCatalog(targets, { attributionUserAgent, signal: lifetime.signal }, (id, result) => {
       if (disposed || generation !== egressGeneration) return;
       availability.edit((value) => ({
         ...value,
@@ -449,6 +529,7 @@ function createModelRuntime({
           ...value.results,
           [id]: {
             state: result.state,
+            source: "manual",
             ...result.detail === void 0 ? {} : { detail: result.detail },
             ...result.ttftMs === void 0 ? {} : { ttftMs: result.ttftMs },
             latencyMs: result.latencyMs,
@@ -457,28 +538,29 @@ function createModelRuntime({
           }
         }
       }));
-    }, 2);
+    }, 1);
     if (disposed || generation !== egressGeneration) return {};
     availability.update({ at: Date.now(), egress });
     availability.flush();
     const verdicts = Object.values(results);
-    if (verdicts.length > 0 && verdicts.every((row) => row.state === STATE.unavailable)) {
-      logger.warn?.(`our-free-model: the gateway refused all ${verdicts.length} models this round (${verdicts[0].detail ?? "no detail"}); keeping them advertised`);
-    }
     const allThrottled = verdicts.length > 0 && verdicts.every((row) => row.state === STATE.throttled);
-    probeThrottleStreak = allThrottled ? probeThrottleStreak + 1 : 0;
-    probeBackoffUntil = allThrottled ? Date.now() + Math.min(30 * 2 ** (probeThrottleStreak - 1), 120) * 6e4 : 0;
     if (allThrottled) {
-      logger.warn?.(`our-free-model: the probe round hit the lane's quota; availability probes pause for ${Math.round((probeBackoffUntil - Date.now()) / 6e4)} minutes (your own requests are unaffected, and the reprobe button forces a round)`);
+      probeBackoffUntil = Date.now() + 30 * 6e4;
+      logger.warn?.("our-free-model: the manual probe hit the lane quota; the breaker now carries the window");
+    } else {
+      probeBackoffUntil = 0;
     }
     emitTopology();
     return results;
   }
-  async function refreshAvailability(force = false) {
-    if (disposed || !force && probeBackoffUntil > Date.now()) return {};
+  async function refreshAvailability(force = false, { model } = {}) {
+    if (disposed) return {};
+    if (!force && probeBackoffUntil > Date.now()) return {};
+    const gate = laneGate();
+    if (!gate.ok) return { skipped: gate.state, retryAt: gate.retryAt, message: gate.message };
     if (probeRound !== null && probeRoundGeneration === egressGeneration) return probeRound;
     probeRoundGeneration = egressGeneration;
-    const round = runProbeRound();
+    const round = runProbeRound(model);
     probeRound = round;
     try {
       return await round;
@@ -501,10 +583,10 @@ function createModelRuntime({
         egress: seen,
         at: 0,
         results: expire(value.results),
-        manualResults: expire(value.manualResults)
+        manualResults: expire(value.manualResults),
+        lane: { state: "ok", at: Date.now() }
       }));
       availability.flush();
-      probeThrottleStreak = 0;
       probeBackoffUntil = 0;
       emitTopology();
       logger.info?.(`our-free-model: egress changed to ${seen.ip}${seen.country ? ` (${seen.country})` : ""}; previous availability marked stale`);
@@ -558,6 +640,8 @@ function createModelRuntime({
     refreshAvailability,
     watchEgress,
     fetchListing,
+    laneGate,
+    clearLaneBreaker,
     complete: createForwardCompletion({
       adapter,
       signal: lifetime.signal,
@@ -581,6 +665,11 @@ function createModelRuntime({
       emitTopology();
       return catalog;
     },
+    // An extension install/enable/disable/uninstall lands here: the extension
+    // runtime has already rebuilt its own rows, so this is a merge + announce.
+    syncExtensionCatalog() {
+      return this.syncAggregateCatalog();
+    },
     get catalog() {
       return catalog;
     },