@lawaty/lacode 2.3.0-beta.3 → 2.3.0-beta.5

package/CHANGELOG.md

@@ -9,6 +9,29 @@ commit as the changelog entry it describes.
 
 ## [Unreleased]
 
+## [2.3.0-beta.5] — bench in place, cheap recovery, visible slots
+
+### Added
+
+- Pool: selection retains current pool members unless the run proved them hard-dead (gone, credential, agreement, credit). Head and tail are never vacated by a failed scan; a healthy-but-capped model is still decided by the caps, and a catalogue removal on a clean scan vacates the slot.
+- Pool: the refresh benches kept-but-transiently-failed members in place with a flat `scan-kept` cooling record (never a strike) and clears stale benches for members that answered. The runtime re-admits a benched model on the first answering probe.
+- Pool: degraded retries run a canary over the current members first (`--canary`) and scan fully only when one stops answering. The scorer learned `--probe-models`, `--deprioritize-providers`, `--current-pool`, and `--out` to support it.
+- Pool: the status page is now hint-only. Sick providers probe last; nothing is ever skipped or benched because of the page.
+- Pool: `pool_status` shows each cooling slot's absolute expiry, the structural verdict (head/tail/count vs the 10-slot contract), the last refresh age, and the live status hint.
+
+### Changed
+
+- Pool: per-request probe deadline is 12 seconds (was 45); `--timeout MS` still overrides it.
+
+## [2.3.0-beta.4] — status never benches, structure is the contract
+
+### Fixed
+
+- Pool: only a hard outage (a gating `go`/`free` service reporting `down`) with a structurally intact pool may skip a refresh scan. A mere `degraded` never skips, because models routinely answer while the status page says degraded. Paid-tier (`payg`) and roll-up (`inference`) components can no longer freeze the free pool.
+- Pool: the fail-closed guard now enforces structure, not just count. A selection that drops the opencode-go head or the opencode tail is refused even at full count, and the keep threshold is anchored to the contract pool size (10) instead of the current file, so repeated writes can no longer ratchet the pool down. `--force-write` overrides the guard for a genuinely changed catalogue.
+- Pool: per-request probe deadline is 12 seconds (was 45), so a flapping provider stretches a scan far less; `--timeout MS` still overrides it.
+- Pool: a failed scorer run or a refused write now schedules a 5-minute recheck like every other failed run, instead of waiting for the next 6-hour slot.
+
 ## [2.3.0-beta.3] — persist autonomy modes in global config
 
 ### Changed

package/dist/index.js

@@ -39,6 +39,7 @@ var UNAVAILABLE_COOLDOWN_MS = 60 * 1e3;
 var UNAVAILABLE_REASON = "endpoint-unavailable";
 var PROVIDER_DEGRADED_REASON = "provider-degraded";
 var PROVIDER_DEGRADED_COOLDOWN_MS = 30 * 60 * 1e3;
+var SCAN_KEPT_REASON = "scan-kept";
 var PROVIDER_DEGRADED_WINDOW_MS = 10 * 60 * 1e3;
 var PROVIDER_DEGRADED_MIN_MODELS = 2;
 var TRANSIENT_DEGRADATION_REASONS = /^(?:no answer|no-answer|hang|timeout|timed out|endpoint-unavailable|provider-degraded|empty response|network|server)$/i;
@@ -695,7 +696,7 @@ function readLimits(s) {
     try {
       const strike = JSON.parse(readFileSync2(path4, "utf8"));
       if (typeof strike.until !== "number" || typeof strike.model !== "string") continue;
-      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON;
+      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON && strike.reason !== SCAN_KEPT_REASON;
       if (strike.until > now) {
         cooling.set(strike.model, strike);
         if (countsAsStrike) memory.set(strike.model, strike);
@@ -2527,7 +2528,9 @@ async function maybeSelfUpdate(opts) {
 }
 
 // src/plugins/agent-pool.ts
-import { unwatchFile, watchFile } from "node:fs";
+import { readFileSync as readFileSync5, unwatchFile, watchFile } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
 import { tool } from "@opencode-ai/plugin";
 
 // src/lib/probe.ts
@@ -3179,6 +3182,43 @@ function estimateContextTokens(prompt) {
   if (typeof prompt !== "string" || prompt.length === 0) return void 0;
   return Math.ceil(prompt.length / 4) + CONTEXT_HEADROOM_TOKENS;
 }
+var poolHealthLines = (slots, now) => {
+  const lines = [];
+  const heads = slots.filter((slot) => slot.model.startsWith("opencode-go/"));
+  const headOk = heads.length > 0 && slots.slice(0, heads.length).every((slot) => slot.model.startsWith("opencode-go/"));
+  const tail = slots[slots.length - 1];
+  const tailOk = !!tail && tail.model.startsWith("opencode/") && tail.bucket === "opencode";
+  const verdict = headOk && tailOk ? "intact" : "BROKEN";
+  lines.push(
+    `pool structure: ${verdict} (${slots.length}/10 slots, head=${headOk ? `${heads.length} opencode-go` : "missing"}, tail=${tailOk ? tail.model : "missing"})`
+  );
+  try {
+    const text = readFileSync5(join6(homedir4(), ".config", "lacode", "pool.txt"), "utf8");
+    const stamp = /^#\s*Refreshed\s+(\S+)/m.exec(text)?.[1];
+    if (stamp) {
+      const ageMs = now - Date.parse(stamp);
+      if (Number.isFinite(ageMs) && ageMs >= 0) {
+        const mins = Math.floor(ageMs / 6e4);
+        lines.push(`last refresh: ${mins < 60 ? `${mins}m ago` : `${Math.floor(mins / 60)}h${mins % 60}m ago`} (${stamp})`);
+      }
+    }
+  } catch {
+  }
+  try {
+    const raw = readFileSync5(join6(homedir4(), ".config", "lacode", "provider-status.json"), "utf8");
+    const status = JSON.parse(raw);
+    if (status && typeof status === "object") {
+      const ageS = typeof status.checkedAt === "number" ? Math.max(0, Math.round((now - status.checkedAt) / 1e3)) : -1;
+      const bad = (status.services ?? []).filter((entry) => String(entry?.status ?? "") !== "operational");
+      const detail = bad.length > 0 ? `: ${bad.map((entry) => `${entry.service}=${entry.status}`).join(", ")}` : "";
+      lines.push(
+        `status page: ${status.ok === false ? "unreachable" : status.overall ?? "unknown"}${detail}${ageS >= 0 ? ` (checked ${ageS}s ago)` : ""}`
+      );
+    }
+  } catch {
+  }
+  return lines;
+};
 var agentPoolHooks = (async ({ client, serverUrl, directory }, options) => {
   const opts = options ?? {};
   const notify = opts.notify ?? ((title, message) => void notifyDesktop(title, message));
@@ -4278,8 +4318,9 @@ ${detail}` : detail;
             const users = entry && entry.bases.size > 0 ? [...entry.bases].map(([b, n]) => `${b}x${n}`).join(" ") : "idle";
             const strike = snap.cooling.get(slot.model);
             const status = s.catalog.get(slot.model);
+            const untilClock = strike ? new Date(strike.until).toISOString().slice(11, 19) + "Z" : "";
             const notes = [
-              strike ? `UNAVAILABLE (COOLING ${Math.ceil((strike.until - now) / 1e3)}s, ${strike.reason}, strike ${strike.strikes})` : "",
+              strike ? `UNAVAILABLE (COOLING ${Math.ceil((strike.until - now) / 1e3)}s left, until ${untilClock}, ${strike.reason}, strike ${strike.strikes})` : "",
               !providerReady(s, slot.model) ? `UNAVAILABLE (provider-unconfigured: ${providerOf(slot.model)}; run \`opencode auth login ${providerOf(slot.model)}\`)` : "",
               status && status !== "active" && status !== "unknown" ? `catalog:${status}` : ""
             ].filter(Boolean);
@@ -4313,6 +4354,7 @@ one ordered pass in slot order: each slot fills to its weight, then overflow goe
               ...sharedBuckets.length ? [`buckets: ${sharedBuckets.map(([name, entry]) => `${name} ${entry.seats} seat(s)${entry.cooling ? " COOLING" : ""}`).join("; ")}`] : [],
               ...degradedProviders.length ? [`provider degraded: ${degradedProviders.join(", ")} (flat window; a probe re-admits a model when it answers)`] : [],
               ...slots.map(line),
+              ...poolHealthLines(slots, now),
               "",
               "by process:",
               `  ${s.id} (this process): ${snap.own.size} claim(s)`,
@@ -4380,11 +4422,11 @@ one ordered pass in slot order: each slot fills to its weight, then overflow goe
 
 // src/plugins/context-autoupdate.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync6, readdirSync as readdirSync3, statSync as statSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import * as path3 from "node:path";
 
 // src/lib/map-schema.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import * as path from "node:path";
 var PROVISIONAL_DAYS = 30;
 var MAP_SPECS = [
@@ -4537,7 +4579,7 @@ var resolvePointer = (root, pointer, section) => {
   if (!stat.isFile()) return { exists: false };
   let text;
   try {
-    if (stat.size <= 512 * 1024) text = readFileSync5(absolute, "utf8");
+    if (stat.size <= 512 * 1024) text = readFileSync6(absolute, "utf8");
   } catch {
     text = void 0;
   }
@@ -4786,7 +4828,7 @@ var maintainMap = (root, mapDir, now = Date.now()) => {
     if (!existsSync3(absolute)) continue;
     let before;
     try {
-      before = readFileSync5(absolute, "utf8");
+      before = readFileSync6(absolute, "utf8");
     } catch {
       continue;
     }
@@ -4814,7 +4856,7 @@ var auditMap = (root, mapDir, now = Date.now()) => {
     }
     let text;
     try {
-      text = readFileSync5(absolute, "utf8");
+      text = readFileSync6(absolute, "utf8");
     } catch {
       violations.push({ file: spec.file, kind: "missing-file", detail: "unreadable" });
       continue;
@@ -4893,7 +4935,7 @@ var parseJsonc = (raw) => {
 };
 
 // src/lib/writer-rule.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import * as path2 from "node:path";
 var CONTEXT_DIR = path2.join(".opencode", "context");
 var WRITER = "context";
@@ -4933,7 +4975,7 @@ var agentsForm = (mapDir, projectRoot) => {
 var verifyWriterRule = (configPath, mapDir, projectRoot) => {
   let raw;
   try {
-    raw = readFileSync6(configPath, "utf8");
+    raw = readFileSync7(configPath, "utf8");
   } catch {
     return void 0;
   }
@@ -4978,25 +5020,25 @@ var verifyWriterRule = (configPath, mapDir, projectRoot) => {
 };
 
 // src/lib/timeline.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, join as join8, resolve as resolve3 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync8, renameSync as renameSync4, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname3, join as join9, resolve as resolve3 } from "node:path";
 var TIMELINE_STATE_VERSION = 1;
 function timelineDir() {
   const env = process.env.LACODE_TIMELINE_DIR;
   if (env) return resolve3(env);
-  return join8(homedir4(), ".local/share/opencode/lacode/timeline");
+  return join9(homedir5(), ".local/share/opencode/lacode/timeline");
 }
 function assertValidSessionID(sessionID) {
   if (!/^[A-Za-z0-9_.-]+$/.test(sessionID)) throw new Error("invalid sessionID");
 }
 function timelineFile(sessionID) {
   assertValidSessionID(sessionID);
-  return join8(timelineDir(), sessionID + ".jsonl");
+  return join9(timelineDir(), sessionID + ".jsonl");
 }
 function timelineStateFile(sessionID) {
   assertValidSessionID(sessionID);
-  return join8(timelineDir(), sessionID + ".state.json");
+  return join9(timelineDir(), sessionID + ".state.json");
 }
 function normalizeThrough(through) {
   if (!through || typeof through !== "object") return void 0;
@@ -5043,7 +5085,7 @@ function appendEntriesAt(file, texts, now, through) {
 function readEntriesAt(file, limit) {
   let raw = "";
   try {
-    raw = readFileSync7(file, "utf8");
+    raw = readFileSync8(file, "utf8");
   } catch {
     return [];
   }
@@ -5096,7 +5138,7 @@ function normalizePersistedState(raw) {
 }
 function readTimelineState(sessionID) {
   try {
-    const raw = readFileSync7(timelineStateFile(sessionID), "utf8");
+    const raw = readFileSync8(timelineStateFile(sessionID), "utf8");
     return normalizePersistedState(JSON.parse(raw));
   } catch {
     return void 0;
@@ -5522,7 +5564,7 @@ var changedSince = (before, dir) => {
   return changed;
 };
 var RETAIN_TRANSCRIPTS = 20;
-var transcriptDir = () => process.env.LACODE_TRANSCRIPT_DIR ?? path3.join(homedir5(), ".local", "share", "opencode", "lacode", "cartographer");
+var transcriptDir = () => process.env.LACODE_TRANSCRIPT_DIR ?? path3.join(homedir6(), ".local", "share", "opencode", "lacode", "cartographer");
 var retireSession = async (client, directory, sessionID, mode, log) => {
   try {
     const transcript = await client.session.messages({ path: { id: sessionID }, query: { directory } }).then((r) => r.data).catch(() => void 0);
@@ -5778,15 +5820,15 @@ var contextAutoUpdateHooks = (async ({ client, directory }, options) => {
 });
 
 // src/lib/feedback.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname5, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, renameSync as renameSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname5, join as join11 } from "node:path";
 var FEEDBACK_HINT_ENV = "LACODE_NO_FEEDBACK_HINT";
 var FEEDBACK_HINT = "Enjoying lacode? Bugs, ideas, or a quick note on how you use it: github.com/lawaty/lacode/issues (a \u2B50 on the repo helps others find it)";
-var feedbackStatePath = () => join10(homedir6(), ".local", "share", "opencode", "lacode", "feedback.json");
+var feedbackStatePath = () => join11(homedir7(), ".local", "share", "opencode", "lacode", "feedback.json");
 function readFeedbackState(path4 = feedbackStatePath()) {
   try {
-    const parsed = JSON.parse(readFileSync8(path4, "utf8"));
+    const parsed = JSON.parse(readFileSync9(path4, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
     return parsed;
   } catch (error) {
@@ -5860,9 +5902,9 @@ async function feedbackHooks(input, options, deps = {}) {
 
 // src/plugins/image-paste.ts
 import { createHash, randomUUID } from "node:crypto";
-import { globSync, mkdirSync as mkdirSync8, readFileSync as readFileSync9, renameSync as renameSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { basename as basename3, join as join11 } from "node:path";
+import { globSync, mkdirSync as mkdirSync8, readFileSync as readFileSync10, renameSync as renameSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { basename as basename3, join as join12 } from "node:path";
 
 // src/lib/clipboard.ts
 import { spawnSync } from "node:child_process";
@@ -6012,8 +6054,8 @@ function splitArguments(input) {
   return out;
 }
 function expandTilde(p) {
-  if (p === "~") return homedir7();
-  if (p.startsWith("~/")) return join11(homedir7(), p.slice(2));
+  if (p === "~") return homedir8();
+  if (p.startsWith("~/")) return join12(homedir8(), p.slice(2));
   return p;
 }
 function expandGlob(p) {
@@ -6029,7 +6071,7 @@ function storeImage(bytes, dir, sessionID, label) {
   if (kind === null) return null;
   const hash = createHash("sha256").update(bytes).digest("hex");
   mkdirSync8(dir, { recursive: true });
-  const target = join11(dir, `${hash}.${kind.ext}`);
+  const target = join12(dir, `${hash}.${kind.ext}`);
   const tmp = `${target}.tmp`;
   writeFileSync9(tmp, bytes, { mode: 384 });
   renameSync6(tmp, target);
@@ -6060,7 +6102,7 @@ async function imagePasteHooks(input, options, deps) {
     if (opts.enabled === false) return {};
     const maxBytes = resolveMaxBytes(opts);
     const maxImages = resolveMaxImages(opts);
-    const dir = opts.dir ?? process.env.LACODE_IMAGE_DIR ?? join11(homedir7(), ".local/share/opencode/lacode/images");
+    const dir = opts.dir ?? process.env.LACODE_IMAGE_DIR ?? join12(homedir8(), ".local/share/opencode/lacode/images");
     const readClipboard = (deps ?? {}).readClipboard ?? readClipboardImage;
     return {
       "command.execute.before": async (cmd, output) => {
@@ -6117,7 +6159,7 @@ async function imagePasteHooks(input, options, deps) {
               }
               let bytes;
               try {
-                bytes = readFileSync9(filePath);
+                bytes = readFileSync10(filePath);
               } catch {
                 skipped.push(name);
                 continue;
@@ -6168,14 +6210,14 @@ async function imagePasteHooks(input, options, deps) {
 }
 
 // src/lib/opencode-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname6, join as join12 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync11, renameSync as renameSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname6, join as join13 } from "node:path";
 import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
 function globalOpencodeConfigPath() {
-  const base = process.env.XDG_CONFIG_HOME ?? join12(homedir8(), ".config");
-  const jsonc = join12(base, "opencode", "opencode.jsonc");
-  return existsSync5(jsonc) ? jsonc : join12(base, "opencode", "opencode.json");
+  const base = process.env.XDG_CONFIG_HOME ?? join13(homedir9(), ".config");
+  const jsonc = join13(base, "opencode", "opencode.jsonc");
+  return existsSync5(jsonc) ? jsonc : join13(base, "opencode", "opencode.json");
 }
 var OpenCodeConfigError = class extends Error {
   constructor(message) {
@@ -6188,7 +6230,7 @@ function isPlainObject(value) {
 }
 function readOpencodeConfig(path4 = globalOpencodeConfigPath()) {
   if (!existsSync5(path4)) return {};
-  const text = readFileSync10(path4, "utf8");
+  const text = readFileSync11(path4, "utf8");
   const errors = [];
   const parsed = parse(text, errors, { allowTrailingComma: true, disallowComments: false });
   if (errors.length > 0) {
@@ -7424,7 +7466,7 @@ async function selfUpdateHooks(input, options) {
 
 // src/plugins/timeline.ts
 import { existsSync as existsSync6, writeFileSync as writeFileSync11, renameSync as renameSync8, rmSync as rmSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { tool as tool2 } from "@opencode-ai/plugin";
 var DEFAULT_INTERVAL_MS = 3e5;
 var MIN_INTERVAL_MS = 1e4;
@@ -7500,7 +7542,7 @@ function errorText(value) {
 }
 var MAX_TASK_CHILDREN_EXPANDED = 40;
 async function expandTaskSessions(client, messages, directory, owned, onError, cursor) {
-  const projectOwnsTooling = existsSync6(join13(directory, "src/plugins/timeline.ts"));
+  const projectOwnsTooling = existsSync6(join14(directory, "src/plugins/timeline.ts"));
   let attempts = 0;
   const expandedMessages = [];
   let startIndex = 0;
@@ -8066,9 +8108,9 @@ function timelineHooks(input, options) {
 
 // src/lib/timer-migration.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync12 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename4, dirname as dirname7, join as join14 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync12, renameSync as renameSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename4, dirname as dirname7, join as join15 } from "node:path";
 var TIMER_MIGRATION_ENV = "LACODE_NO_TIMER_MIGRATION";
 var TIMER_MIGRATION_STATE_VERSION = 1;
 var defaultRun2 = (file, args, options) => new Promise((resolve5, reject) => {
@@ -8082,15 +8124,15 @@ function resolveNodeBinary(execPath = process.execPath) {
   if (existsSync7("/usr/bin/node")) return "/usr/bin/node";
   return "node";
 }
-function timerMigrationStatePath(home = homedir9()) {
-  return join14(home, ".local", "share", "opencode", "lacode", "migrations.json");
+function timerMigrationStatePath(home = homedir10()) {
+  return join15(home, ".local", "share", "opencode", "lacode", "migrations.json");
 }
-function timerMigrationUnitPath(home = homedir9()) {
-  return join14(home, ".config", "systemd", "user", "lacode-refresh-pool.timer");
+function timerMigrationUnitPath(home = homedir10()) {
+  return join15(home, ".config", "systemd", "user", "lacode-refresh-pool.timer");
 }
 function readState2(path4) {
   try {
-    return JSON.parse(readFileSync11(path4, "utf8"));
+    return JSON.parse(readFileSync12(path4, "utf8"));
   } catch {
     return {};
   }
@@ -8109,7 +8151,7 @@ async function runTimerMigration(options = {}) {
   const packageRoot = options.packageRoot ?? PACKAGE_ROOT;
   const version = options.version ?? readInstalledVersion(packageRoot);
   if (!version) return { action: "skipped", reason: "no-version" };
-  const home = options.home ?? homedir9();
+  const home = options.home ?? homedir10();
   const statePath = options.statePath ?? timerMigrationStatePath(home);
   const state2 = readState2(statePath);
   if (state2.timersVersion === version && existsSync7(timerMigrationUnitPath(home))) {
@@ -8121,7 +8163,7 @@ async function runTimerMigration(options = {}) {
   } catch {
     return { action: "skipped", reason: "no-systemd" };
   }
-  const script = join14(packageRoot, "scripts", "refresh-pool.mjs");
+  const script = join15(packageRoot, "scripts", "refresh-pool.mjs");
   if (!existsSync7(script)) return { action: "failed", version, error: `timer script not found: ${script}` };
   try {
     await run(resolveNodeBinary(), [script, "--install-timer", "--stable"], { stdio: "ignore" });

package/dist/pool.js

@@ -39,6 +39,7 @@ var UNAVAILABLE_COOLDOWN_MS = 60 * 1e3;
 var UNAVAILABLE_REASON = "endpoint-unavailable";
 var PROVIDER_DEGRADED_REASON = "provider-degraded";
 var PROVIDER_DEGRADED_COOLDOWN_MS = 30 * 60 * 1e3;
+var SCAN_KEPT_REASON = "scan-kept";
 var PROVIDER_DEGRADED_WINDOW_MS = 10 * 60 * 1e3;
 var PROVIDER_DEGRADED_MIN_MODELS = 2;
 var TRANSIENT_DEGRADATION_REASONS = /^(?:no answer|no-answer|hang|timeout|timed out|endpoint-unavailable|provider-degraded|empty response|network|server)$/i;
@@ -695,7 +696,7 @@ function readLimits(s) {
     try {
       const strike = JSON.parse(readFileSync2(path, "utf8"));
       if (typeof strike.until !== "number" || typeof strike.model !== "string") continue;
-      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON;
+      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON && strike.reason !== SCAN_KEPT_REASON;
       if (strike.until > now) {
         cooling.set(strike.model, strike);
         if (countsAsStrike) memory.set(strike.model, strike);
@@ -1098,6 +1099,7 @@ export {
   PROVIDER_LIST_TTL_MS,
   QUOTA_COOLDOWN_BASE_MS,
   QUOTA_COOLDOWN_MAX_MS,
+  SCAN_KEPT_REASON,
   SLOTS_WARN_AT,
   STATED_COOLDOWN_MAX_MS,
   STATE_SWEEP_INTERVAL_MS,

package/docs/USER-STORIES.md

@@ -194,12 +194,30 @@ A refresh once replaced a healthy ten-slot pool with a two-slot scan because not
 **Story ID(s) for tests:** US-40
 **Acceptance criteria:**
 - [ ] Given a healthy pool and a scan that returns fewer slots than half of it (minimum four), When the refresh finishes, Then the previous pool file is left untouched, the refusal is logged, and a recheck is scheduled in 5 minutes.
-- [ ] Given opencode's serving path reports degraded on the live status and the current pool is intact, When the refresh runs, Then no scan is started, the pool is kept, and a recheck is scheduled in 5 minutes.
+- [ ] Given a scan that drops the opencode-go head or the opencode tail the current pool has, When the refresh finishes, Then the previous pool is kept even at full count, because the structure is the contract.
+- [ ] Given opencode's serving path reports a hard outage on the live status and the current pool is structurally intact, When the refresh runs, Then no scan is started, the pool is kept, and a recheck is scheduled in 5 minutes.
+- [ ] Given the status reports degraded (latency, elevated errors) rather than down, When the refresh runs, Then the scan proceeds as normal, because models routinely answer while the page says degraded.
 - [ ] Given any failed run with a stated reset hours out, When the retry is scheduled, Then the recheck still happens within 5 minutes; a sooner provider reset is honoured.
 - [ ] Given the degradation lifts, When the next 5-minute recheck runs, Then a full scan restores the pool instead of waiting for the next 6-hour slot.
 - [ ] Given a thin or missing pool, When a fuller scan completes, Then it is always written — the guard only ever blocks shrinking, never recovery.
 - [ ] Given the status endpoint is unreachable, When the refresh runs, Then the scan proceeds as before, because an unknown signal must never block a refresh and the write guard still protects the pool.
 
+### US-41: The pool keeps its structure through any outage and shows its state
+**As a** user relying on the pool, **I want** members to be benched in place instead of deleted, recovery to be cheap, and the slot states visible, **so that** no outage can shrink the pool, no recovery takes longer than minutes, and I can see what each slot is doing.
+
+Selection retains current members unless the run proved them hard-dead (gone, credential, agreement, credit); a healthy-but-capped model is still decided by the caps. The refresh writes a flat `scan-kept` cooling record for every kept-but-transiently-failed member — the runtime already honours it and re-admits the model on the first answering probe — and clears stale benches for members that answered. The status page is a hint only: sick providers probe last, nothing is ever skipped or benched because of it. Degraded retries run a canary over the current members first and scan fully only when one stops answering. `pool_status` shows each cooling slot's absolute expiry, the structural verdict, the last refresh age, and the status hint.
+
+**Story ID(s) for tests:** US-41
+**Acceptance criteria:**
+- [ ] Given a current member whose probe failed transiently, When selection runs, Then the member is retained in place (marked retained) with its pool weight, and head/tail positions are never vacated.
+- [ ] Given a current member that is healthy but capped out, When selection runs, Then it is not retained — the caps decide.
+- [ ] Given a model absent from a cleanly scanned catalogue, When selection runs, Then it is dropped as hard-dead, not retained.
+- [ ] Given a retained member, When the refresh finishes, Then a flat `scan-kept` cooling record benches it without entering the strike memory, and a member that answered has any stale bench cleared.
+- [ ] Given a scan-kept bench, When any probe watches the model answer, Then it is re-admitted without waiting out the window.
+- [ ] Given a degraded page, When the refresh runs, Then sick providers only probe last; nothing is skipped or benched because of the page.
+- [ ] Given a degraded retry, When it runs, Then it probes only the current members first and scans fully only when one stops answering.
+- [ ] Given cooling slots, When `pool_status` renders, Then each shows its absolute expiry, plus the structural verdict, last refresh age, and status hint.
+
 ---
 
 ## Epic C — Hang detection and auto-recovery
@@ -621,6 +639,7 @@ table was filled in.
 | US-31 | B | `tests/stories/b-provider-resilience.test.mjs`, `tests/stories/c-hang-recovery.test.mjs` |
 | US-39 | B | `tests/stories/l-pool-refresh.test.mjs` |
 | US-40 | B | `tests/stories/l-pool-refresh.test.mjs`, `tests/refresh-pool-test.mjs`, `tests/provider-status-test.mjs` |
+| US-41 | B | `tests/stories/l-pool-refresh.test.mjs`, `tests/pool-selection-test.mjs`, `tests/refresh-pool-test.mjs`, `tests/pool-shared-test.mjs`, `tests/provider-status-test.mjs` |
 | US-8 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs` |
 | US-9 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs`, `tests/pool-shared-test.mjs` |
 | US-10 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs`, `tests/pool-timer-test.mjs` |
@@ -654,6 +673,6 @@ The root-level suites under `tests/` are unit-style; the `tests/stories/` suites
 the behavioural layer, written one epic per file with every test name carrying
 its story id. Run everything with `npm test`.
 
-40/40 stories covered by 376 test case(s); thinnest story has 1.
+41/41 stories covered by 380 test case(s); thinnest story has 1.
 No story is untested. The scan covers the `tests/stories/` suites and the root-level
 `tests/*-test.mjs` suites.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lawaty/lacode",
-  "version": "2.3.0-beta.3",
+  "version": "2.3.0-beta.5",
   "description": "Ultimate opencode setup for Go users — cost-controlled pooled subagents, hang recovery, and notifications for opencode.",
   "license": "MIT",
   "type": "module",

package/scripts/pool-selection.mjs

@@ -49,6 +49,13 @@ const FAILURE_KINDS = [
 // and not-served failures are permanent for this model until a human acts.
 const TRANSIENT_KINDS = new Set(["rate-limited", "credit", "timeout", "network", "server"])
 
+/**
+ * Failure kinds that vacate a pool slot for good: the model is gone, the
+ * credential is wrong, the terms are unsigned, or the balance is empty. Every
+ * other failure mode keeps the slot — benched, not deleted.
+ */
+export const HARD_DEAD_KINDS = new Set(["not-served", "credential", "agreement", "credit"])
+
 export const isTransientKind = (kind) => TRANSIENT_KINDS.has(String(kind ?? "").toLowerCase())
 
 export function classifyFailure({ status, reason, kind } = {}) {
@@ -127,9 +134,84 @@ const rowsOf = (providers) =>
 
 const providerOf = (model) => String(model ?? "").split("/")[0]
 
+/**
+ * Parse pool.txt slot lines into [{ model, weight, bucket?, context? }].
+ * Comments and blanks are ignored; weight defaults to 1.
+ */
+export function parsePoolSlots(text) {
+  const out = []
+  for (const line of String(text ?? "").split(/\r?\n/)) {
+    const code = line.split("#")[0].trim()
+    if (!code || !code.includes("/")) continue
+    const [model, weight] = code.split(/\s+/)
+    if (!model || !model.includes("/")) continue
+    const bucket = /b:([^\s]+)/.exec(code)?.[1]
+    const context = /c:(\d+)/.exec(code)?.[1]
+    out.push({
+      model,
+      weight: Number(weight) > 0 ? Number(weight) : 1,
+      ...(bucket ? { bucket } : {}),
+      context: context ? Number(context) : null,
+    })
+  }
+  return out
+}
+
+/**
+ * Pure structural verdict for a pool slot list (formatted lines or selection
+ * entries). The contract: an opencode-go head (every go slot first, weight 4),
+ * exactly one opencode tail (last, weight 2, b:opencode), POOL_SIZE slots.
+ * Returns { valid, problems[] } — valid covers head+tail; count is reported
+ * separately so a short-but-structured pool reads as short, not broken.
+ */
+export function poolStructureValid(slots) {
+  const problems = []
+  const items = typeof slots === "string" ? String(slots).split(/\r?\n/) : Array.isArray(slots) ? slots : []
+  const lines = items.map((entry) => {
+    if (typeof entry === "string") {
+      const parts = entry.split("#")[0].trim().split(/\s+/)
+      const bucket = /b:([^\s]+)/.exec(entry)?.[1]
+      return { model: parts[0] ?? "", weight: Number(parts[1]) || 0, bucket }
+    }
+    return { model: entry?.model ?? "", weight: Number(entry?.weight) || 0, bucket: entry?.bucket }
+  }).filter((entry) => entry.model.includes("/"))
+  const go = lines.filter((entry) => providerOf(entry.model) === "opencode-go")
+  const tails = lines.filter((entry) => providerOf(entry.model) === "opencode")
+  if (go.length === 0) problems.push("missing opencode-go head")
+  for (let i = 0; i < go.length; i++) {
+    if (lines[i] !== go[i]) {
+      problems.push("opencode-go slots must all come first")
+      break
+    }
+    if (go[i].weight !== 4) {
+      problems.push("opencode-go head slots must have weight 4")
+      break
+    }
+  }
+  if (tails.length !== 1) problems.push(`expected exactly one opencode tail, found ${tails.length}`)
+  else {
+    const tail = tails[0]
+    if (lines[lines.length - 1] !== tail) problems.push("opencode tail slot must be last")
+    if (tail.weight !== 2 || tail.bucket !== "opencode") problems.push("opencode tail must be weight 2 with b:opencode")
+  }
+  if (lines.length !== POOL_SIZE) problems.push(`expected ${POOL_SIZE} slots, found ${lines.length}`)
+  const structural = problems.filter((p) => !p.startsWith(`expected ${POOL_SIZE}`))
+  return { valid: structural.length === 0, problems, count: lines.length }
+}
+
+/**
+ * Hard-dead check for retention: only these failure kinds vacate a slot.
+ */
+export const isHardDeadRow = (row) => {
+  if (!row || row.ok !== false) return false
+  const kind = String(row.kind ?? classifyFailure({ status: row.status, reason: row.reason }) ?? "").toLowerCase()
+  return HARD_DEAD_KINDS.has(kind)
+}
+
 export function selectPool({
   providers,
   previousProviders,
+  currentSlots = [],
   minContext = MIN_CONTEXT,
   minScore = MIN_SCORE,
   poolSize = POOL_SIZE,
@@ -237,14 +319,93 @@ export function selectPool({
 
   const pickedZen = zen.slice(0, zenReserve)
 
-  const selection = [
-    ...go.map((row) => ({ model: row.model, weight: 4, context: row.context ?? null })),
-    ...pickedSmall.map((row) => ({ model: row.model, weight: 2, context: row.context ?? null })),
-    ...pickedLarge.map((row) => ({ model: row.model, weight: 1, context: row.context ?? null })),
-    ...pickedZen.map((row) => ({ model: row.model, weight: 2, bucket: "opencode", context: row.context ?? null })),
+  const warnings = []
+
+  // Pool-level retention: a current member stays unless this run proved it
+  // hard-dead. A healthy-but-unselected model (caps, score floors) is NOT
+  // retained — the caps decided that. A transiently failed, unscanned, or
+  // budget-cut model is retained and benched in place by the writer; only a
+  // catalogue removal on a cleanly scanned provider vacates the slot. Head
+  // and tail are never vacated by a failed or partial scan.
+  const rowByModel = new Map(rows.map((row) => [row.model, row]))
+  const cleanlyScanned = (model) => {
+    const provider = providerOf(model)
+    return scannedProviders.has(provider) && !truncatedProviders.has(provider) && !erroredProviders.has(provider)
+  }
+  const placedModels = new Set([...go, ...cappedSmall, ...cappedLarge, ...pickedZen].map((row) => row.model))
+  const shouldRetain = (model) => {
+    if (!model.includes("/") || placedModels.has(model)) return false
+    const row = rowByModel.get(model)
+    if (row) return row.ok === false && !isHardDeadRow(row)
+    return !cleanlyScanned(model)
+  }
+  const retainedHead = []
+  const retainedMiddle = []
+  let retainedTail = null
+  for (const slot of Array.isArray(currentSlots) ? currentSlots : []) {
+    const model = String(slot?.model ?? "")
+    if (!shouldRetain(model)) continue
+    const weight = Number(slot?.weight)
+    if (providerOf(model) === "opencode-go") {
+      retainedHead.push({ model, weight: 4, context: slot?.context ?? null, retained: true })
+    } else if (providerOf(model) === "opencode") {
+      if (!retainedTail) retainedTail = { model, weight: 2, bucket: "opencode", context: slot?.context ?? null, retained: true }
+    } else {
+      retainedMiddle.push({
+        model,
+        weight: Number.isFinite(weight) && weight > 0 ? weight : 2,
+        ...(slot?.bucket ? { bucket: slot.bucket } : {}),
+        context: slot?.context ?? null,
+        retained: true,
+      })
+    }
+  }
+
+  const toSmall = (row) => ({ model: row.model, weight: 2, context: row.context ?? null })
+  const toLarge = (row) => ({ model: row.model, weight: 1, context: row.context ?? null })
+  const middle = [...pickedSmall.map(toSmall), ...pickedLarge.map(toLarge)]
+  for (const entry of retainedMiddle) {
+    if (!middle.some((existing) => existing.model === entry.model)) middle.push(entry)
+  }
+  if (retainedTail && !pickedZen.some((row) => providerOf(row.model) === "opencode")) {
+    middle.push({ ...retainedTail })
+    retainedTail = { ...retainedTail, placed: true }
+  }
+  const head = [
+    ...retainedHead,
+    ...go.filter((row) => !retainedHead.some((entry) => entry.model === row.model)).map((row) => ({ model: row.model, weight: 4, context: row.context ?? null })),
   ]
+  const tail = pickedZen.map((row) => ({ model: row.model, weight: 2, bucket: "opencode", context: row.context ?? null }))
+  let selection = [...head, ...middle, ...tail]
+  // Fit the contract size without ever vacating head or tail: trim the middle
+  // from the back (lowest score first), skipping retained slots. If even that
+  // cannot fit, the head wins and a warning says so.
+  while (selection.length > poolSize) {
+    let index = -1
+    for (let i = selection.length - 1; i >= 0; i--) {
+      const entry = selection[i]
+      if (!entry.retained && providerOf(entry.model) !== "opencode-go" && providerOf(entry.model) !== "opencode") {
+        index = i
+        break
+      }
+    }
+    if (index === -1) {
+      warnings.push(`pool head exceeds the contract size ${poolSize}; keeping every head slot`)
+      break
+    }
+    selection.splice(index, 1)
+  }
+
+  const retainedCount = selection.filter((entry) => entry.retained).length
+  if (retainedCount > 0) {
+    warnings.push(
+      `retained ${retainedCount} current slot(s) benched in place: ${selection
+        .filter((entry) => entry.retained)
+        .map((entry) => entry.model)
+        .join(", ")}`,
+    )
+  }
 
-  const warnings = []
   for (const entry of Array.isArray(providers) ? providers : []) {
     if (entry?.error) {
       warnings.push(`${entry.provider}: ${entry.error}`)

package/scripts/refresh-pool.mjs

@@ -20,10 +20,11 @@
 
 import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"
 import { execFileSync } from "node:child_process"
-import { homedir, userInfo } from "node:os"
+import { homedir, tmpdir, userInfo } from "node:os"
 import { dirname, join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
-import { fetchProviderStatus } from "./provider-status.mjs"
+import { fetchProviderStatus, statusDeprioritizedProviders } from "./provider-status.mjs"
+import { POOL_SIZE, isTransientFailure, parsePoolSlots, poolStructureValid } from "./pool-selection.mjs"
 
 const HOME = homedir()
 export const DEFAULT_SCORES_PATH = join(HOME, ".config", "lacode", "model-scores.json")
@@ -194,14 +195,47 @@ function writeFileAtomic(path, text) {
   renameSync(tmp, path)
 }
 
-function runScorer(max) {
+function runScorer(max, extraArgs = []) {
   const here = dirname(fileURLToPath(import.meta.url))
   const scorer = resolve(here, "score-models.mjs")
   if (!existsSync(scorer)) throw new Error(`scorer not found: ${scorer}`)
-  const args = [scorer, "--max", String(max)]
+  const args = [scorer, "--max", String(max), ...extraArgs]
   execFileSync(process.execPath, args, { stdio: "inherit" })
 }
 
+/**
+ * Cheap health check: probe exactly the current pool members (no catalogue
+ * sweep). Every member answers → the pool stands as-is: no full scan, no
+ * retry, back to the 6-hour cadence. Anything else → false, and the caller
+ * runs a full scan to verify. Returns true when the pool stands.
+ */
+function runCanary({ currentPoolText, scorerArgs, max }) {
+  const members = parsePoolSlots(currentPoolText).map((slot) => slot.model)
+  if (members.length === 0) return false
+  const tmp = join(tmpdir(), `lacode-canary-${process.pid}.json`)
+  try {
+    runScorer(Math.max(max, members.length), [...scorerArgs, "--probe-models", members.join(","), "--out", tmp])
+    const payload = JSON.parse(readFileSync(tmp, "utf8"))
+    const answered = new Set()
+    for (const entry of payload?.providers ?? []) {
+      for (const row of entry?.rows ?? []) {
+        if (row?.model && row?.ok === true) answered.add(row.model)
+      }
+    }
+    const missing = members.filter((model) => !answered.has(model))
+    if (missing.length === 0) {
+      console.log(`canary healthy: all ${members.length} pool member(s) answered; pool stands, no full scan`)
+      return true
+    }
+    console.log(`canary: ${missing.length} member(s) not answering (${missing.join(", ")}); running a full scan`)
+    return false
+  } finally {
+    try {
+      rmSync(tmp, { force: true })
+    } catch {}
+  }
+}
+
 /**
  * Count the usable model slots in a pool.txt text (comments and blanks ignored).
  */
@@ -210,22 +244,103 @@ export function poolSlotCount(text) {
 }
 
 /**
- * Pure fail-closed guard. A refresh must never replace a working pool with a
- * degenerate selection: when the new slot count falls below half the previous
- * pool (floored at MIN_POOL_SLOTS), the previous pool is kept. There is no
- * previous pool on a first-ever run, so there is nothing to protect and the
- * guard passes.
+ * Bench-in-place file layout. Must match src/lib/pool.ts: the runtime treats
+ * these files as flat cooling records (never strikes) and re-admits a model
+ * the moment a probe watches it answer.
+ */
+export const SCAN_BENCH_REASON = "scan-kept"
+export const SCAN_BENCH_WINDOW_MS = 45 * 60 * 1000
+export const scanBenchDir = (home = HOME) => join(home, ".local", "share", "opencode", "agent-pool")
+export const scanBenchFile = (model) => `limit.${String(model).replace(/[^a-zA-Z0-9._-]/g, "__")}.json`
+
+/**
+ * Pure bench plan for the current pool members. A member whose current row
+ * failed transiently is benched until its stated reset (else 45 minutes); a
+ * member that answered has any stale bench cleared; an unscanned member is
+ * left alone for lack of evidence. Only pool members are ever touched.
+ */
+export function computeScanBench({ selectionModels, providers, now = Date.now() }) {
+  const currentByModel = new Map()
+  for (const entry of Array.isArray(providers) ? providers : []) {
+    for (const row of Array.isArray(entry?.rows) ? entry.rows : []) {
+      if (row?.model && !currentByModel.has(row.model)) currentByModel.set(row.model, row)
+    }
+  }
+  const bench = []
+  const clear = []
+  for (const model of selectionModels ?? []) {
+    const row = currentByModel.get(model)
+    if (!row) continue
+    if (row.ok !== false) {
+      clear.push(model)
+      continue
+    }
+    if (!isTransientFailure(row)) continue
+    const at = Number(row.retryAfter)
+    bench.push({
+      model,
+      until: Number.isFinite(at) && at > now ? at : now + SCAN_BENCH_WINDOW_MS,
+      kind: String(row.kind ?? "unknown"),
+    })
+  }
+  return { bench, clear }
+}
+
+/** Apply a bench plan with atomic writes; every failure is best-effort. */
+export function applyScanBench({ dir, bench, clear }) {
+  const applied = { benched: [], cleared: [] }
+  try {
+    mkdirSync(dir, { recursive: true })
+  } catch {}
+  for (const { model, until } of bench ?? []) {
+    try {
+      const record = { model, until, strikes: 1, reason: SCAN_BENCH_REASON, last: Date.now() }
+      const tmp = join(dir, `${scanBenchFile(model)}.tmp-${process.pid}`)
+      writeFileSync(tmp, JSON.stringify(record))
+      renameSync(tmp, join(dir, scanBenchFile(model)))
+      applied.benched.push(model)
+    } catch {}
+  }
+  for (const model of clear ?? []) {
+    try {
+      rmSync(join(dir, scanBenchFile(model)), { force: true })
+      applied.cleared.push(model)
+    } catch {}
+  }
+  return applied
+}
+
+/**
+ * Pure fail-closed guard. A refresh must never break the pool's structure or
+ * replace a working pool with a degenerate selection: the new pool must keep
+ * the opencode-go head and the opencode tail the current pool has, and hold at
+ * least half of POOL_SIZE. The baseline is the contract size, never the
+ * current file — a previously shrunk pool can always grow back, but no write
+ * may shrink or behead it. There is no previous pool on a first-ever run, so
+ * there is nothing to protect and the guard passes. `--force-write` is the
+ * human override for a genuinely changed catalogue.
  */
-export function shouldKeepPool({ currentPoolText, newSlotCount }) {
+export function shouldKeepPool({ currentPoolText, newSlots }) {
   const prev = poolSlotCount(currentPoolText ?? "")
   if (prev <= 0) return { keep: false, prev, threshold: 0, reason: "no previous pool to protect" }
-  const threshold = Math.max(MIN_POOL_SLOTS, Math.floor(prev / 2))
-  if (newSlotCount >= threshold) return { keep: false, prev, threshold, reason: "" }
+  const slots = Array.isArray(newSlots) ? newSlots : []
+  const threshold = Math.max(MIN_POOL_SLOTS, Math.floor(POOL_SIZE / 2))
+  const currentCheck = poolStructureValid(currentPoolText)
+  const newCheck = poolStructureValid(slots)
+  if (currentCheck.valid && !newCheck.valid) {
+    return {
+      keep: true,
+      prev,
+      threshold,
+      reason: `new selection breaks the pool structure (${newCheck.problems.join("; ")}); keeping the previous pool`,
+    }
+  }
+  if (slots.filter(isSlotLine).length >= threshold) return { keep: false, prev, threshold, reason: "" }
   return {
     keep: true,
     prev,
     threshold,
-    reason: `new selection has ${newSlotCount} usable slot(s), below the keep threshold of ${threshold} (previous pool had ${prev}); refusing to shrink the pool`,
+    reason: `new selection has ${slots.filter(isSlotLine).length} usable slot(s), below the keep threshold of ${threshold} (contract pool size ${POOL_SIZE}); refusing to shrink the pool`,
   }
 }
 
@@ -251,6 +366,7 @@ export function scheduleRetryIn(seconds, options = {}) {
   const scriptPath = options.scriptPath ?? fileURLToPath(import.meta.url)
   const nodePath = options.nodePath ?? process.execPath
   const home = options.home ?? HOME
+  const extraArgs = Array.isArray(options.args) ? options.args : []
   const nowMs = (options.now ?? Date.now)()
   const path = `${home}/.opencode/bin:/usr/local/bin:/usr/bin:/bin`
   const unit = `lacode-refresh-pool-retry-${Math.floor(nowMs / 1000).toString(36)}`
@@ -266,6 +382,7 @@ export function scheduleRetryIn(seconds, options = {}) {
         `--setenv=PATH=${path}`,
         nodePath,
         scriptPath,
+        ...extraArgs,
       ],
       { stdio: "ignore" },
     )
@@ -287,9 +404,11 @@ export function scheduleRetry(retry, options = {}) {
   return scheduled
 }
 
-/** Schedule a recheck on the degraded cadence (default 5 minutes). */
+/** Schedule a recheck on the degraded cadence (default 5 minutes). Retries run
+ * a cheap canary first and only fall back to a full scan when a pool member
+ * stops answering. */
 export function scheduleRetrySoon(seconds = DEGRADED_RETRY_S, options = {}) {
-  return scheduleRetryIn(seconds, options)
+  return scheduleRetryIn(seconds, { ...options, args: [...(options.args ?? []), "--canary"] })
 }
 
 export function renderTimerUnits(input = {}) {
@@ -380,17 +499,24 @@ function usage() {
                     systemctl --user start lacode-refresh-pool.service
   --print           print the proposed pool.txt and make no changes (alias: --dry-run)
   --dry-run         same as --print
+  --canary          probe only the current pool members; run a full scan only
+                    when one stops answering (used by degraded rechecks)
   --max N           models per provider passed to the scorer (default: 50)
   --scores PATH     scores file (default: ${DEFAULT_SCORES_PATH})
   --pool PATH       pool file to read/compare/write (default: ${DEFAULT_POOL_PATH})
+  --force-write   write the new selection even when the fail-closed guard would
+                    keep the previous pool (human override for a changed catalogue)
   -h, --help        this message
 
-Degradation behaviour: before scanning, the refresh checks
-https://status.opencode.ai/api/status. When opencode's serving path reports
-degraded and the current pool is intact, the scan is skipped, the pool is kept,
-and a recheck is scheduled in 5 minutes. After a scan, a selection below half
-the previous pool (minimum ${MIN_POOL_SLOTS} slots) is never written; the previous pool
-is kept and a 5-minute recheck is scheduled. A retry is always rechecked
+Degradation behaviour: before scanning, the refresh reads
+https://status.opencode.ai/api/status. The page is a hint, never a verdict:
+sick providers are only probed last, and nothing is ever skipped or benched
+because of it. A canary (--canary, used by every degraded recheck) probes only
+the current pool members and runs a full scan solely when one stops answering.
+After a scan, a selection that breaks the pool structure or falls below half
+the contract pool size (minimum ${MIN_POOL_SLOTS} slots) is never written; the
+previous pool is kept, transiently failed members are still benched in place,
+and a 5-minute canary recheck is scheduled. A retry is always rechecked
 within 5 minutes while anything failed, even when the stated reset is hours out.`)
 }
 
@@ -404,6 +530,7 @@ async function main() {
   const fromScores = argv.includes("--from-scores")
   const printOnly = argv.includes("--print") || argv.includes("--dry-run")
   const noRetry = argv.includes("--no-retry")
+  const forceWrite = argv.includes("--force-write")
   const value = (flag, fallback) => {
     const hit = argv.find((a) => a === flag || a.startsWith(`${flag}=`))
     if (!hit) return fallback
@@ -422,41 +549,46 @@ async function main() {
   }
 
   const currentPoolText = readTextFile(poolPath)
-
-  // Live degradation signal. When opencode's own serving path reports degraded
-  // and the current pool is intact, probing now can only shrink it: keep the
-  // pool untouched and recheck in 5 minutes. A thin pool is still scanned, so
-  // a first-ever run (or a previously clobbered one) can recover, and the
-  // write guard below protects it if the scan comes back degenerate.
-  let providerStatus = { ok: false, providers: [], services: [] }
-  if (!printOnly) {
+  const canary = argv.includes("--canary")
+
+  // Live status is a hint, never a verdict. Gating services that report down
+  // or degraded only reorder probes (sick providers last) so they cannot eat
+  // the scan budget. Nothing is ever skipped or benched because of the page —
+  // only real probe evidence benches a model, and the write guard below
+  // protects the pool if the scan comes back degenerate.
+  let deprioritized = []
+  if (!printOnly && !fromScores) {
     try {
-      providerStatus = await fetchProviderStatus()
+      deprioritized = statusDeprioritizedProviders(await fetchProviderStatus())
     } catch (error) {
-      providerStatus = { ok: false, providers: [], services: [], reason: String(error?.message ?? error) }
+      console.log(`live status unreadable (${String(error?.message ?? error)}); scanning in default order`)
     }
-    if (providerStatus.ok && providerStatus.providers.length > 0 && poolSlotCount(currentPoolText) >= MIN_POOL_SLOTS) {
-      const detail = providerStatus.services.map((entry) => `${entry.service}=${entry.status}`).join(", ")
-      console.log(
-        `opencode status degraded (${detail}); keeping the current pool of ${poolSlotCount(currentPoolText)} slots and rechecking in ${DEGRADED_RETRY_S / 60} minutes`,
-      )
-      if (!noRetry) {
-        const scheduled = scheduleRetrySoon()
-        console.log(
-          scheduled.scheduled
-            ? `scheduled degraded recheck in ${scheduled.seconds}s`
-            : `degraded recheck not scheduled: ${scheduled.reason}`,
-        )
-      }
-      return
+    if (deprioritized.length > 0) {
+      console.log(`status hint: probing ${deprioritized.join(", ")} last`)
     }
   }
+  const scorerArgs = [`--current-pool`, poolPath]
+  if (deprioritized.length > 0) scorerArgs.push(`--deprioritize-providers`, deprioritized.join(","))
+
+  const runFullScan = () => runScorer(max, scorerArgs)
 
   if (!fromScores) {
     try {
-      runScorer(max)
+      if (canary) {
+        runCanary({ poolPath, currentPoolText, scorerArgs, max })
+      } else {
+        runFullScan()
+      }
     } catch (error) {
       console.error(`scorer failed; pool.txt not written: ${String(error?.message ?? error)}`)
+      if (!printOnly && !noRetry) {
+        const scheduled = scheduleRetrySoon()
+        console.log(
+          scheduled.scheduled
+            ? `scheduled degraded recheck in ${scheduled.seconds}s`
+            : `degraded recheck not scheduled: ${scheduled.reason}`,
+        )
+      }
       process.exitCode = 1
       return
     }
@@ -476,12 +608,35 @@ async function main() {
     built = buildPool({ scores, currentPoolText, now: new Date() })
   } catch (error) {
     console.error(`refresh refused (fail closed): ${String(error?.message ?? error)}`)
+    if (!printOnly && !noRetry) {
+      const scheduled = scheduleRetrySoon()
+      console.log(
+        scheduled.scheduled
+          ? `scheduled degraded recheck in ${scheduled.seconds}s`
+          : `degraded recheck not scheduled: ${scheduled.reason}`,
+      )
+    }
     process.exitCode = 1
     return
   }
 
   const oldSlotCount = poolSlotCount(currentPoolText)
   const newSlotCount = built.slots.filter(isSlotLine).length
+
+  // Bench-in-place: a pool member this run failed transiently keeps its slot
+  // and gets a flat cooling record the runtime already honours; a member that
+  // answered has any stale bench cleared. Unscanned members are left alone.
+  // Runs on the write path and the refusal path alike — a kept pool still
+  // learns what the scan found.
+  if (!printOnly) {
+    const plan = computeScanBench({ selectionModels: built.chosen.selected, providers: scores.providers })
+    const applied = applyScanBench({ dir: scanBenchDir(), bench: plan.bench, clear: plan.clear })
+    if (applied.benched.length > 0) {
+      const detail = plan.bench.map((entry) => `${entry.model} (${entry.kind})`).join(", ")
+      console.log(`scan benched in place: ${detail}`)
+    }
+    if (applied.cleared.length > 0) console.log(`scan cleared stale benches: ${applied.cleared.join(", ")}`)
+  }
   const dropped = scores.providers.flatMap((entry) => (Array.isArray(entry?.excluded) ? entry.excluded : []))
   const summary = [
     `selected [${built.chosen.selected.join(", ")}]`,
@@ -491,8 +646,9 @@ async function main() {
 
   // Fail closed on a degenerate selection: keep the previous pool, say so
   // loudly, and recheck in 5 minutes instead of waiting out a long reset.
-  if (!printOnly) {
-    const kept = shouldKeepPool({ currentPoolText, newSlotCount })
+  // --force-write is the human override for a genuinely changed catalogue.
+  if (!printOnly && !forceWrite) {
+    const kept = shouldKeepPool({ currentPoolText, newSlots: built.slots })
     if (kept.keep) {
       console.error(`refresh refused (fail closed): ${kept.reason}`)
       if (!noRetry) {

package/scripts/score-models.mjs

@@ -46,13 +46,14 @@ import {
   classifyFailure,
   isTransientFailure,
   isTransientKind,
+  parsePoolSlots,
   providerRank,
   retryAfterMs,
   selectPool,
 } from "./pool-selection.mjs"
 
 const AUTH = join(homedir(), ".local", "share", "opencode", "auth.json")
-const OUT = join(homedir(), ".config", "lacode", "model-scores.json")
+const DEFAULT_OUT = join(homedir(), ".config", "lacode", "model-scores.json")
 // No default provider list: `opencode models --verbose` with no argument returns
 // every provider opencode knows about, and that is what we scan by default.
 const SESSION_PROVIDERS = new Set(["opencode", "opencode-go"])
@@ -100,11 +101,18 @@ const value = (flag, fallback) => {
     console.log(`Usage: npm run score -- [options]
 
   --providers a,b   restrict the scan to these providers (default: all configured)
+  --probe-models a,b probe exactly these provider/model ids (canary: skips the
+                    catalogue scan for everything else; unscanned providers keep
+                    their previous rows)
+  --deprioritize-providers a,b probe these providers last (a live status hint;
+                    never excludes anything, ordering only)
+  --current-pool PATH feed pool.txt as the current pool so selection retains
+                    members this run could not reach (default: no retention)
   --max N           probe at most N candidate models per provider (default: 50)
   --min-context N   exclude models whose context limit is below N (default: ${MIN_CONTEXT})
   --min-score N     do not rank models scoring below N (default: ${MIN_SCORE})
   --free-only        only probe catalogue cost 0/0 models on every provider
-  --timeout MS      per-request deadline in ms (default: 45000)
+  --timeout MS      per-request deadline in ms (default: 12000)
   --delay MS        pause between requests in ms (default: 300)
   --budget-min N    stop starting new probes after N minutes and write what was
                     measured; providers not scanned keep their previous rows
@@ -126,13 +134,24 @@ Providers with no direct HTTP endpoint (or an unexpanded \${...} URL) are probed
 
 const providerArg = value("--providers", null)
 const providers = providerArg ? String(providerArg).split(",").map((s) => s.trim()).filter(Boolean) : null
+const probeModelsArg = value("--probe-models", null)
+const probeModels = probeModelsArg ? new Set(String(probeModelsArg).split(",").map((s) => s.trim()).filter(Boolean)) : null
+const deprioritizeArg = value("--deprioritize-providers", null)
+  const deprioritizedProviders = new Set(
+    deprioritizeArg ? String(deprioritizeArg).split(",").map((s) => s.trim()).filter(Boolean) : [],
+  )
+  // probe --probe-models ids absent from every catalogue. Filled during the
+  // catalogue filter above; emitted as synthetic not-served rows after probing.
+  const missingProbeModels = []
+const currentPoolPath = value("--current-pool", null)
 const maxPerProvider = Math.max(1, Number(value("--max", "50")) || 50)
 const minContext = Math.max(0, Number(value("--min-context", String(MIN_CONTEXT))) || MIN_CONTEXT)
 const minScore = Math.max(0, Number(value("--min-score", String(MIN_SCORE))) || MIN_SCORE)
-const timeoutMs = Math.max(1_000, Number(value("--timeout", "45000")) || 45_000)
+const timeoutMs = Math.max(1_000, Number(value("--timeout", "12000")) || 12_000)
 const delayMs = Math.max(0, Number(value("--delay", "300")) || 300)
 const budgetMin = Math.max(1, Number(value("--budget-min", "30")) || 30)
 const budgetMs = budgetMin * 60_000
+const OUT = value("--out", DEFAULT_OUT)
 const writeResults = !has("--no-write")
 const freeOnlyFlag = has("--free-only")
 
@@ -570,12 +589,35 @@ const pad = (s, n) => String(s).padEnd(n)
 const padL = (s, n) => String(s).padStart(n)
 
 async function main() {
-  const scanned = providers ? providers.map((provider) => freeModels(provider)) : freeModelsAll()
+  let scanned = providers ? providers.map((provider) => freeModels(provider)) : freeModelsAll()
   // Core providers first, then the free-only middle tier, then the slow paid
-  // catalogues. Ordering only; every provider is still probed if time allows.
+  // catalogues — and explicitly deprioritized providers last. Ordering only;
+  // every provider is still probed if time allows.
   scanned.sort(
-    (a, b) => providerRank(a.provider) - providerRank(b.provider) || String(a.provider).localeCompare(String(b.provider)),
+    (a, b) =>
+      Number(deprioritizedProviders.has(a.provider)) - Number(deprioritizedProviders.has(b.provider)) ||
+      providerRank(a.provider) - providerRank(b.provider) ||
+      String(a.provider).localeCompare(String(b.provider)),
   )
+  const currentSlots = (() => {
+    if (!currentPoolPath) return []
+    try {
+      return parsePoolSlots(readFileSync(currentPoolPath, "utf8"))
+    } catch {
+      return []
+    }
+  })()
+  if (probeModels && probeModels.size > 0) {
+    const seen = new Set()
+    scanned = scanned.flatMap((entry) => {
+      if (entry.error) return []
+      const models = (entry.models ?? []).filter((candidate) => probeModels.has(candidate.model))
+      models.forEach((candidate) => seen.add(candidate.model))
+      if (models.length === 0) return []
+      return [{ ...entry, models }]
+    })
+    missingProbeModels.push(...[...probeModels].filter((model) => !seen.has(model)))
+  }
   const results = []
   const deadline = Date.now() + budgetMs
   const skippedProviders = []
@@ -655,6 +697,32 @@ async function main() {
   }
   stopSessionServer()
 
+  // A canary model absent from every catalogue is not "unscanned" — it is
+  // gone. A synthetic not-served row makes the selector drop it (hard-dead)
+  // instead of retaining it blindly.
+  for (const model of missingProbeModels) {
+    const slash = model.indexOf("/")
+    const provider = slash === -1 ? "unknown" : model.slice(0, slash)
+    const row = {
+      provider,
+      model,
+      url: "",
+      apiId: slash === -1 ? model : model.slice(slash + 1),
+      context: null,
+      output: null,
+      ok: false,
+      ms: null,
+      reason: "not in provider catalogue (model-missing)",
+      status: 404,
+      kind: "not-served",
+      score: null,
+      retryAfter: null,
+    }
+    const entry = results.find((candidate) => candidate.provider === provider)
+    if (entry) entry.rows.push(row)
+    else results.push({ provider, error: null, rows: [row], excluded: [], truncated: false, degraded: false })
+  }
+
   // Per-provider ranked tables.
   for (const entry of results) {
     if (entry.error || entry.rows.length === 0) continue
@@ -705,6 +773,7 @@ async function main() {
       excluded: entry.excluded,
     })),
     previousProviders: previousScores?.providers,
+    currentSlots,
     minContext,
     minScore,
   })