@lawaty/lacode 2.3.0-beta.4 → 2.3.0-beta.5

package/CHANGELOG.md

@@ -9,6 +9,20 @@ commit as the changelog entry it describes.
 
 ## [Unreleased]
 
+## [2.3.0-beta.5] — bench in place, cheap recovery, visible slots
+
+### Added
+
+- Pool: selection retains current pool members unless the run proved them hard-dead (gone, credential, agreement, credit). Head and tail are never vacated by a failed scan; a healthy-but-capped model is still decided by the caps, and a catalogue removal on a clean scan vacates the slot.
+- Pool: the refresh benches kept-but-transiently-failed members in place with a flat `scan-kept` cooling record (never a strike) and clears stale benches for members that answered. The runtime re-admits a benched model on the first answering probe.
+- Pool: degraded retries run a canary over the current members first (`--canary`) and scan fully only when one stops answering. The scorer learned `--probe-models`, `--deprioritize-providers`, `--current-pool`, and `--out` to support it.
+- Pool: the status page is now hint-only. Sick providers probe last; nothing is ever skipped or benched because of the page.
+- Pool: `pool_status` shows each cooling slot's absolute expiry, the structural verdict (head/tail/count vs the 10-slot contract), the last refresh age, and the live status hint.
+
+### Changed
+
+- Pool: per-request probe deadline is 12 seconds (was 45); `--timeout MS` still overrides it.
+
 ## [2.3.0-beta.4] — status never benches, structure is the contract
 
 ### Fixed

package/dist/index.js

@@ -39,6 +39,7 @@ var UNAVAILABLE_COOLDOWN_MS = 60 * 1e3;
 var UNAVAILABLE_REASON = "endpoint-unavailable";
 var PROVIDER_DEGRADED_REASON = "provider-degraded";
 var PROVIDER_DEGRADED_COOLDOWN_MS = 30 * 60 * 1e3;
+var SCAN_KEPT_REASON = "scan-kept";
 var PROVIDER_DEGRADED_WINDOW_MS = 10 * 60 * 1e3;
 var PROVIDER_DEGRADED_MIN_MODELS = 2;
 var TRANSIENT_DEGRADATION_REASONS = /^(?:no answer|no-answer|hang|timeout|timed out|endpoint-unavailable|provider-degraded|empty response|network|server)$/i;
@@ -695,7 +696,7 @@ function readLimits(s) {
     try {
       const strike = JSON.parse(readFileSync2(path4, "utf8"));
       if (typeof strike.until !== "number" || typeof strike.model !== "string") continue;
-      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON;
+      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON && strike.reason !== SCAN_KEPT_REASON;
       if (strike.until > now) {
         cooling.set(strike.model, strike);
         if (countsAsStrike) memory.set(strike.model, strike);
@@ -2527,7 +2528,9 @@ async function maybeSelfUpdate(opts) {
 }
 
 // src/plugins/agent-pool.ts
-import { unwatchFile, watchFile } from "node:fs";
+import { readFileSync as readFileSync5, unwatchFile, watchFile } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
 import { tool } from "@opencode-ai/plugin";
 
 // src/lib/probe.ts
@@ -3179,6 +3182,43 @@ function estimateContextTokens(prompt) {
   if (typeof prompt !== "string" || prompt.length === 0) return void 0;
   return Math.ceil(prompt.length / 4) + CONTEXT_HEADROOM_TOKENS;
 }
+var poolHealthLines = (slots, now) => {
+  const lines = [];
+  const heads = slots.filter((slot) => slot.model.startsWith("opencode-go/"));
+  const headOk = heads.length > 0 && slots.slice(0, heads.length).every((slot) => slot.model.startsWith("opencode-go/"));
+  const tail = slots[slots.length - 1];
+  const tailOk = !!tail && tail.model.startsWith("opencode/") && tail.bucket === "opencode";
+  const verdict = headOk && tailOk ? "intact" : "BROKEN";
+  lines.push(
+    `pool structure: ${verdict} (${slots.length}/10 slots, head=${headOk ? `${heads.length} opencode-go` : "missing"}, tail=${tailOk ? tail.model : "missing"})`
+  );
+  try {
+    const text = readFileSync5(join6(homedir4(), ".config", "lacode", "pool.txt"), "utf8");
+    const stamp = /^#\s*Refreshed\s+(\S+)/m.exec(text)?.[1];
+    if (stamp) {
+      const ageMs = now - Date.parse(stamp);
+      if (Number.isFinite(ageMs) && ageMs >= 0) {
+        const mins = Math.floor(ageMs / 6e4);
+        lines.push(`last refresh: ${mins < 60 ? `${mins}m ago` : `${Math.floor(mins / 60)}h${mins % 60}m ago`} (${stamp})`);
+      }
+    }
+  } catch {
+  }
+  try {
+    const raw = readFileSync5(join6(homedir4(), ".config", "lacode", "provider-status.json"), "utf8");
+    const status = JSON.parse(raw);
+    if (status && typeof status === "object") {
+      const ageS = typeof status.checkedAt === "number" ? Math.max(0, Math.round((now - status.checkedAt) / 1e3)) : -1;
+      const bad = (status.services ?? []).filter((entry) => String(entry?.status ?? "") !== "operational");
+      const detail = bad.length > 0 ? `: ${bad.map((entry) => `${entry.service}=${entry.status}`).join(", ")}` : "";
+      lines.push(
+        `status page: ${status.ok === false ? "unreachable" : status.overall ?? "unknown"}${detail}${ageS >= 0 ? ` (checked ${ageS}s ago)` : ""}`
+      );
+    }
+  } catch {
+  }
+  return lines;
+};
 var agentPoolHooks = (async ({ client, serverUrl, directory }, options) => {
   const opts = options ?? {};
   const notify = opts.notify ?? ((title, message) => void notifyDesktop(title, message));
@@ -4278,8 +4318,9 @@ ${detail}` : detail;
             const users = entry && entry.bases.size > 0 ? [...entry.bases].map(([b, n]) => `${b}x${n}`).join(" ") : "idle";
             const strike = snap.cooling.get(slot.model);
             const status = s.catalog.get(slot.model);
+            const untilClock = strike ? new Date(strike.until).toISOString().slice(11, 19) + "Z" : "";
             const notes = [
-              strike ? `UNAVAILABLE (COOLING ${Math.ceil((strike.until - now) / 1e3)}s, ${strike.reason}, strike ${strike.strikes})` : "",
+              strike ? `UNAVAILABLE (COOLING ${Math.ceil((strike.until - now) / 1e3)}s left, until ${untilClock}, ${strike.reason}, strike ${strike.strikes})` : "",
               !providerReady(s, slot.model) ? `UNAVAILABLE (provider-unconfigured: ${providerOf(slot.model)}; run \`opencode auth login ${providerOf(slot.model)}\`)` : "",
               status && status !== "active" && status !== "unknown" ? `catalog:${status}` : ""
             ].filter(Boolean);
@@ -4313,6 +4354,7 @@ one ordered pass in slot order: each slot fills to its weight, then overflow goe
               ...sharedBuckets.length ? [`buckets: ${sharedBuckets.map(([name, entry]) => `${name} ${entry.seats} seat(s)${entry.cooling ? " COOLING" : ""}`).join("; ")}`] : [],
               ...degradedProviders.length ? [`provider degraded: ${degradedProviders.join(", ")} (flat window; a probe re-admits a model when it answers)`] : [],
               ...slots.map(line),
+              ...poolHealthLines(slots, now),
               "",
               "by process:",
               `  ${s.id} (this process): ${snap.own.size} claim(s)`,
@@ -4380,11 +4422,11 @@ one ordered pass in slot order: each slot fills to its weight, then overflow goe
 
 // src/plugins/context-autoupdate.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync6, readdirSync as readdirSync3, statSync as statSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import * as path3 from "node:path";
 
 // src/lib/map-schema.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6, statSync as statSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import * as path from "node:path";
 var PROVISIONAL_DAYS = 30;
 var MAP_SPECS = [
@@ -4537,7 +4579,7 @@ var resolvePointer = (root, pointer, section) => {
   if (!stat.isFile()) return { exists: false };
   let text;
   try {
-    if (stat.size <= 512 * 1024) text = readFileSync5(absolute, "utf8");
+    if (stat.size <= 512 * 1024) text = readFileSync6(absolute, "utf8");
   } catch {
     text = void 0;
   }
@@ -4786,7 +4828,7 @@ var maintainMap = (root, mapDir, now = Date.now()) => {
     if (!existsSync3(absolute)) continue;
     let before;
     try {
-      before = readFileSync5(absolute, "utf8");
+      before = readFileSync6(absolute, "utf8");
     } catch {
       continue;
     }
@@ -4814,7 +4856,7 @@ var auditMap = (root, mapDir, now = Date.now()) => {
     }
     let text;
     try {
-      text = readFileSync5(absolute, "utf8");
+      text = readFileSync6(absolute, "utf8");
     } catch {
       violations.push({ file: spec.file, kind: "missing-file", detail: "unreadable" });
       continue;
@@ -4893,7 +4935,7 @@ var parseJsonc = (raw) => {
 };
 
 // src/lib/writer-rule.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import * as path2 from "node:path";
 var CONTEXT_DIR = path2.join(".opencode", "context");
 var WRITER = "context";
@@ -4933,7 +4975,7 @@ var agentsForm = (mapDir, projectRoot) => {
 var verifyWriterRule = (configPath, mapDir, projectRoot) => {
   let raw;
   try {
-    raw = readFileSync6(configPath, "utf8");
+    raw = readFileSync7(configPath, "utf8");
   } catch {
     return void 0;
   }
@@ -4978,25 +5020,25 @@ var verifyWriterRule = (configPath, mapDir, projectRoot) => {
 };
 
 // src/lib/timeline.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, join as join8, resolve as resolve3 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync8, renameSync as renameSync4, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname3, join as join9, resolve as resolve3 } from "node:path";
 var TIMELINE_STATE_VERSION = 1;
 function timelineDir() {
   const env = process.env.LACODE_TIMELINE_DIR;
   if (env) return resolve3(env);
-  return join8(homedir4(), ".local/share/opencode/lacode/timeline");
+  return join9(homedir5(), ".local/share/opencode/lacode/timeline");
 }
 function assertValidSessionID(sessionID) {
   if (!/^[A-Za-z0-9_.-]+$/.test(sessionID)) throw new Error("invalid sessionID");
 }
 function timelineFile(sessionID) {
   assertValidSessionID(sessionID);
-  return join8(timelineDir(), sessionID + ".jsonl");
+  return join9(timelineDir(), sessionID + ".jsonl");
 }
 function timelineStateFile(sessionID) {
   assertValidSessionID(sessionID);
-  return join8(timelineDir(), sessionID + ".state.json");
+  return join9(timelineDir(), sessionID + ".state.json");
 }
 function normalizeThrough(through) {
   if (!through || typeof through !== "object") return void 0;
@@ -5043,7 +5085,7 @@ function appendEntriesAt(file, texts, now, through) {
 function readEntriesAt(file, limit) {
   let raw = "";
   try {
-    raw = readFileSync7(file, "utf8");
+    raw = readFileSync8(file, "utf8");
   } catch {
     return [];
   }
@@ -5096,7 +5138,7 @@ function normalizePersistedState(raw) {
 }
 function readTimelineState(sessionID) {
   try {
-    const raw = readFileSync7(timelineStateFile(sessionID), "utf8");
+    const raw = readFileSync8(timelineStateFile(sessionID), "utf8");
     return normalizePersistedState(JSON.parse(raw));
   } catch {
     return void 0;
@@ -5522,7 +5564,7 @@ var changedSince = (before, dir) => {
   return changed;
 };
 var RETAIN_TRANSCRIPTS = 20;
-var transcriptDir = () => process.env.LACODE_TRANSCRIPT_DIR ?? path3.join(homedir5(), ".local", "share", "opencode", "lacode", "cartographer");
+var transcriptDir = () => process.env.LACODE_TRANSCRIPT_DIR ?? path3.join(homedir6(), ".local", "share", "opencode", "lacode", "cartographer");
 var retireSession = async (client, directory, sessionID, mode, log) => {
   try {
     const transcript = await client.session.messages({ path: { id: sessionID }, query: { directory } }).then((r) => r.data).catch(() => void 0);
@@ -5778,15 +5820,15 @@ var contextAutoUpdateHooks = (async ({ client, directory }, options) => {
 });
 
 // src/lib/feedback.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync8, renameSync as renameSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname5, join as join10 } from "node:path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync9, renameSync as renameSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname5, join as join11 } from "node:path";
 var FEEDBACK_HINT_ENV = "LACODE_NO_FEEDBACK_HINT";
 var FEEDBACK_HINT = "Enjoying lacode? Bugs, ideas, or a quick note on how you use it: github.com/lawaty/lacode/issues (a \u2B50 on the repo helps others find it)";
-var feedbackStatePath = () => join10(homedir6(), ".local", "share", "opencode", "lacode", "feedback.json");
+var feedbackStatePath = () => join11(homedir7(), ".local", "share", "opencode", "lacode", "feedback.json");
 function readFeedbackState(path4 = feedbackStatePath()) {
   try {
-    const parsed = JSON.parse(readFileSync8(path4, "utf8"));
+    const parsed = JSON.parse(readFileSync9(path4, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
     return parsed;
   } catch (error) {
@@ -5860,9 +5902,9 @@ async function feedbackHooks(input, options, deps = {}) {
 
 // src/plugins/image-paste.ts
 import { createHash, randomUUID } from "node:crypto";
-import { globSync, mkdirSync as mkdirSync8, readFileSync as readFileSync9, renameSync as renameSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { basename as basename3, join as join11 } from "node:path";
+import { globSync, mkdirSync as mkdirSync8, readFileSync as readFileSync10, renameSync as renameSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { basename as basename3, join as join12 } from "node:path";
 
 // src/lib/clipboard.ts
 import { spawnSync } from "node:child_process";
@@ -6012,8 +6054,8 @@ function splitArguments(input) {
   return out;
 }
 function expandTilde(p) {
-  if (p === "~") return homedir7();
-  if (p.startsWith("~/")) return join11(homedir7(), p.slice(2));
+  if (p === "~") return homedir8();
+  if (p.startsWith("~/")) return join12(homedir8(), p.slice(2));
   return p;
 }
 function expandGlob(p) {
@@ -6029,7 +6071,7 @@ function storeImage(bytes, dir, sessionID, label) {
   if (kind === null) return null;
   const hash = createHash("sha256").update(bytes).digest("hex");
   mkdirSync8(dir, { recursive: true });
-  const target = join11(dir, `${hash}.${kind.ext}`);
+  const target = join12(dir, `${hash}.${kind.ext}`);
   const tmp = `${target}.tmp`;
   writeFileSync9(tmp, bytes, { mode: 384 });
   renameSync6(tmp, target);
@@ -6060,7 +6102,7 @@ async function imagePasteHooks(input, options, deps) {
     if (opts.enabled === false) return {};
     const maxBytes = resolveMaxBytes(opts);
     const maxImages = resolveMaxImages(opts);
-    const dir = opts.dir ?? process.env.LACODE_IMAGE_DIR ?? join11(homedir7(), ".local/share/opencode/lacode/images");
+    const dir = opts.dir ?? process.env.LACODE_IMAGE_DIR ?? join12(homedir8(), ".local/share/opencode/lacode/images");
     const readClipboard = (deps ?? {}).readClipboard ?? readClipboardImage;
     return {
       "command.execute.before": async (cmd, output) => {
@@ -6117,7 +6159,7 @@ async function imagePasteHooks(input, options, deps) {
               }
               let bytes;
               try {
-                bytes = readFileSync9(filePath);
+                bytes = readFileSync10(filePath);
               } catch {
                 skipped.push(name);
                 continue;
@@ -6168,14 +6210,14 @@ async function imagePasteHooks(input, options, deps) {
 }
 
 // src/lib/opencode-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync10, renameSync as renameSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname6, join as join12 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync11, renameSync as renameSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname6, join as join13 } from "node:path";
 import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
 function globalOpencodeConfigPath() {
-  const base = process.env.XDG_CONFIG_HOME ?? join12(homedir8(), ".config");
-  const jsonc = join12(base, "opencode", "opencode.jsonc");
-  return existsSync5(jsonc) ? jsonc : join12(base, "opencode", "opencode.json");
+  const base = process.env.XDG_CONFIG_HOME ?? join13(homedir9(), ".config");
+  const jsonc = join13(base, "opencode", "opencode.jsonc");
+  return existsSync5(jsonc) ? jsonc : join13(base, "opencode", "opencode.json");
 }
 var OpenCodeConfigError = class extends Error {
   constructor(message) {
@@ -6188,7 +6230,7 @@ function isPlainObject(value) {
 }
 function readOpencodeConfig(path4 = globalOpencodeConfigPath()) {
   if (!existsSync5(path4)) return {};
-  const text = readFileSync10(path4, "utf8");
+  const text = readFileSync11(path4, "utf8");
   const errors = [];
   const parsed = parse(text, errors, { allowTrailingComma: true, disallowComments: false });
   if (errors.length > 0) {
@@ -7424,7 +7466,7 @@ async function selfUpdateHooks(input, options) {
 
 // src/plugins/timeline.ts
 import { existsSync as existsSync6, writeFileSync as writeFileSync11, renameSync as renameSync8, rmSync as rmSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { tool as tool2 } from "@opencode-ai/plugin";
 var DEFAULT_INTERVAL_MS = 3e5;
 var MIN_INTERVAL_MS = 1e4;
@@ -7500,7 +7542,7 @@ function errorText(value) {
 }
 var MAX_TASK_CHILDREN_EXPANDED = 40;
 async function expandTaskSessions(client, messages, directory, owned, onError, cursor) {
-  const projectOwnsTooling = existsSync6(join13(directory, "src/plugins/timeline.ts"));
+  const projectOwnsTooling = existsSync6(join14(directory, "src/plugins/timeline.ts"));
   let attempts = 0;
   const expandedMessages = [];
   let startIndex = 0;
@@ -8066,9 +8108,9 @@ function timelineHooks(input, options) {
 
 // src/lib/timer-migration.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync11, renameSync as renameSync9, writeFileSync as writeFileSync12 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { basename as basename4, dirname as dirname7, join as join14 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync12, renameSync as renameSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename4, dirname as dirname7, join as join15 } from "node:path";
 var TIMER_MIGRATION_ENV = "LACODE_NO_TIMER_MIGRATION";
 var TIMER_MIGRATION_STATE_VERSION = 1;
 var defaultRun2 = (file, args, options) => new Promise((resolve5, reject) => {
@@ -8082,15 +8124,15 @@ function resolveNodeBinary(execPath = process.execPath) {
   if (existsSync7("/usr/bin/node")) return "/usr/bin/node";
   return "node";
 }
-function timerMigrationStatePath(home = homedir9()) {
-  return join14(home, ".local", "share", "opencode", "lacode", "migrations.json");
+function timerMigrationStatePath(home = homedir10()) {
+  return join15(home, ".local", "share", "opencode", "lacode", "migrations.json");
 }
-function timerMigrationUnitPath(home = homedir9()) {
-  return join14(home, ".config", "systemd", "user", "lacode-refresh-pool.timer");
+function timerMigrationUnitPath(home = homedir10()) {
+  return join15(home, ".config", "systemd", "user", "lacode-refresh-pool.timer");
 }
 function readState2(path4) {
   try {
-    return JSON.parse(readFileSync11(path4, "utf8"));
+    return JSON.parse(readFileSync12(path4, "utf8"));
   } catch {
     return {};
   }
@@ -8109,7 +8151,7 @@ async function runTimerMigration(options = {}) {
   const packageRoot = options.packageRoot ?? PACKAGE_ROOT;
   const version = options.version ?? readInstalledVersion(packageRoot);
   if (!version) return { action: "skipped", reason: "no-version" };
-  const home = options.home ?? homedir9();
+  const home = options.home ?? homedir10();
   const statePath = options.statePath ?? timerMigrationStatePath(home);
   const state2 = readState2(statePath);
   if (state2.timersVersion === version && existsSync7(timerMigrationUnitPath(home))) {
@@ -8121,7 +8163,7 @@ async function runTimerMigration(options = {}) {
   } catch {
     return { action: "skipped", reason: "no-systemd" };
   }
-  const script = join14(packageRoot, "scripts", "refresh-pool.mjs");
+  const script = join15(packageRoot, "scripts", "refresh-pool.mjs");
   if (!existsSync7(script)) return { action: "failed", version, error: `timer script not found: ${script}` };
   try {
     await run(resolveNodeBinary(), [script, "--install-timer", "--stable"], { stdio: "ignore" });

package/dist/pool.js

@@ -39,6 +39,7 @@ var UNAVAILABLE_COOLDOWN_MS = 60 * 1e3;
 var UNAVAILABLE_REASON = "endpoint-unavailable";
 var PROVIDER_DEGRADED_REASON = "provider-degraded";
 var PROVIDER_DEGRADED_COOLDOWN_MS = 30 * 60 * 1e3;
+var SCAN_KEPT_REASON = "scan-kept";
 var PROVIDER_DEGRADED_WINDOW_MS = 10 * 60 * 1e3;
 var PROVIDER_DEGRADED_MIN_MODELS = 2;
 var TRANSIENT_DEGRADATION_REASONS = /^(?:no answer|no-answer|hang|timeout|timed out|endpoint-unavailable|provider-degraded|empty response|network|server)$/i;
@@ -695,7 +696,7 @@ function readLimits(s) {
     try {
       const strike = JSON.parse(readFileSync2(path, "utf8"));
       if (typeof strike.until !== "number" || typeof strike.model !== "string") continue;
-      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON;
+      const countsAsStrike = strike.reason !== UNAVAILABLE_REASON && strike.reason !== SCAN_KEPT_REASON;
       if (strike.until > now) {
         cooling.set(strike.model, strike);
         if (countsAsStrike) memory.set(strike.model, strike);
@@ -1098,6 +1099,7 @@ export {
   PROVIDER_LIST_TTL_MS,
   QUOTA_COOLDOWN_BASE_MS,
   QUOTA_COOLDOWN_MAX_MS,
+  SCAN_KEPT_REASON,
   SLOTS_WARN_AT,
   STATED_COOLDOWN_MAX_MS,
   STATE_SWEEP_INTERVAL_MS,

package/docs/USER-STORIES.md

@@ -202,6 +202,22 @@ A refresh once replaced a healthy ten-slot pool with a two-slot scan because not
 - [ ] Given a thin or missing pool, When a fuller scan completes, Then it is always written — the guard only ever blocks shrinking, never recovery.
 - [ ] Given the status endpoint is unreachable, When the refresh runs, Then the scan proceeds as before, because an unknown signal must never block a refresh and the write guard still protects the pool.
 
+### US-41: The pool keeps its structure through any outage and shows its state
+**As a** user relying on the pool, **I want** members to be benched in place instead of deleted, recovery to be cheap, and the slot states visible, **so that** no outage can shrink the pool, no recovery takes longer than minutes, and I can see what each slot is doing.
+
+Selection retains current members unless the run proved them hard-dead (gone, credential, agreement, credit); a healthy-but-capped model is still decided by the caps. The refresh writes a flat `scan-kept` cooling record for every kept-but-transiently-failed member — the runtime already honours it and re-admits the model on the first answering probe — and clears stale benches for members that answered. The status page is a hint only: sick providers probe last, nothing is ever skipped or benched because of it. Degraded retries run a canary over the current members first and scan fully only when one stops answering. `pool_status` shows each cooling slot's absolute expiry, the structural verdict, the last refresh age, and the status hint.
+
+**Story ID(s) for tests:** US-41
+**Acceptance criteria:**
+- [ ] Given a current member whose probe failed transiently, When selection runs, Then the member is retained in place (marked retained) with its pool weight, and head/tail positions are never vacated.
+- [ ] Given a current member that is healthy but capped out, When selection runs, Then it is not retained — the caps decide.
+- [ ] Given a model absent from a cleanly scanned catalogue, When selection runs, Then it is dropped as hard-dead, not retained.
+- [ ] Given a retained member, When the refresh finishes, Then a flat `scan-kept` cooling record benches it without entering the strike memory, and a member that answered has any stale bench cleared.
+- [ ] Given a scan-kept bench, When any probe watches the model answer, Then it is re-admitted without waiting out the window.
+- [ ] Given a degraded page, When the refresh runs, Then sick providers only probe last; nothing is skipped or benched because of the page.
+- [ ] Given a degraded retry, When it runs, Then it probes only the current members first and scans fully only when one stops answering.
+- [ ] Given cooling slots, When `pool_status` renders, Then each shows its absolute expiry, plus the structural verdict, last refresh age, and status hint.
+
 ---
 
 ## Epic C — Hang detection and auto-recovery
@@ -623,6 +639,7 @@ table was filled in.
 | US-31 | B | `tests/stories/b-provider-resilience.test.mjs`, `tests/stories/c-hang-recovery.test.mjs` |
 | US-39 | B | `tests/stories/l-pool-refresh.test.mjs` |
 | US-40 | B | `tests/stories/l-pool-refresh.test.mjs`, `tests/refresh-pool-test.mjs`, `tests/provider-status-test.mjs` |
+| US-41 | B | `tests/stories/l-pool-refresh.test.mjs`, `tests/pool-selection-test.mjs`, `tests/refresh-pool-test.mjs`, `tests/pool-shared-test.mjs`, `tests/provider-status-test.mjs` |
 | US-8 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs` |
 | US-9 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs`, `tests/pool-shared-test.mjs` |
 | US-10 | C | `tests/stories/c-hang-recovery.test.mjs`, `tests/pool-hang-test.mjs`, `tests/pool-timer-test.mjs` |
@@ -656,6 +673,6 @@ The root-level suites under `tests/` are unit-style; the `tests/stories/` suites
 the behavioural layer, written one epic per file with every test name carrying
 its story id. Run everything with `npm test`.
 
-40/40 stories covered by 377 test case(s); thinnest story has 1.
+41/41 stories covered by 380 test case(s); thinnest story has 1.
 No story is untested. The scan covers the `tests/stories/` suites and the root-level
 `tests/*-test.mjs` suites.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lawaty/lacode",
-  "version": "2.3.0-beta.4",
+  "version": "2.3.0-beta.5",
   "description": "Ultimate opencode setup for Go users — cost-controlled pooled subagents, hang recovery, and notifications for opencode.",
   "license": "MIT",
   "type": "module",

package/scripts/pool-selection.mjs

@@ -49,6 +49,13 @@ const FAILURE_KINDS = [
 // and not-served failures are permanent for this model until a human acts.
 const TRANSIENT_KINDS = new Set(["rate-limited", "credit", "timeout", "network", "server"])
 
+/**
+ * Failure kinds that vacate a pool slot for good: the model is gone, the
+ * credential is wrong, the terms are unsigned, or the balance is empty. Every
+ * other failure mode keeps the slot — benched, not deleted.
+ */
+export const HARD_DEAD_KINDS = new Set(["not-served", "credential", "agreement", "credit"])
+
 export const isTransientKind = (kind) => TRANSIENT_KINDS.has(String(kind ?? "").toLowerCase())
 
 export function classifyFailure({ status, reason, kind } = {}) {
@@ -127,9 +134,84 @@ const rowsOf = (providers) =>
 
 const providerOf = (model) => String(model ?? "").split("/")[0]
 
+/**
+ * Parse pool.txt slot lines into [{ model, weight, bucket?, context? }].
+ * Comments and blanks are ignored; weight defaults to 1.
+ */
+export function parsePoolSlots(text) {
+  const out = []
+  for (const line of String(text ?? "").split(/\r?\n/)) {
+    const code = line.split("#")[0].trim()
+    if (!code || !code.includes("/")) continue
+    const [model, weight] = code.split(/\s+/)
+    if (!model || !model.includes("/")) continue
+    const bucket = /b:([^\s]+)/.exec(code)?.[1]
+    const context = /c:(\d+)/.exec(code)?.[1]
+    out.push({
+      model,
+      weight: Number(weight) > 0 ? Number(weight) : 1,
+      ...(bucket ? { bucket } : {}),
+      context: context ? Number(context) : null,
+    })
+  }
+  return out
+}
+
+/**
+ * Pure structural verdict for a pool slot list (formatted lines or selection
+ * entries). The contract: an opencode-go head (every go slot first, weight 4),
+ * exactly one opencode tail (last, weight 2, b:opencode), POOL_SIZE slots.
+ * Returns { valid, problems[] } — valid covers head+tail; count is reported
+ * separately so a short-but-structured pool reads as short, not broken.
+ */
+export function poolStructureValid(slots) {
+  const problems = []
+  const items = typeof slots === "string" ? String(slots).split(/\r?\n/) : Array.isArray(slots) ? slots : []
+  const lines = items.map((entry) => {
+    if (typeof entry === "string") {
+      const parts = entry.split("#")[0].trim().split(/\s+/)
+      const bucket = /b:([^\s]+)/.exec(entry)?.[1]
+      return { model: parts[0] ?? "", weight: Number(parts[1]) || 0, bucket }
+    }
+    return { model: entry?.model ?? "", weight: Number(entry?.weight) || 0, bucket: entry?.bucket }
+  }).filter((entry) => entry.model.includes("/"))
+  const go = lines.filter((entry) => providerOf(entry.model) === "opencode-go")
+  const tails = lines.filter((entry) => providerOf(entry.model) === "opencode")
+  if (go.length === 0) problems.push("missing opencode-go head")
+  for (let i = 0; i < go.length; i++) {
+    if (lines[i] !== go[i]) {
+      problems.push("opencode-go slots must all come first")
+      break
+    }
+    if (go[i].weight !== 4) {
+      problems.push("opencode-go head slots must have weight 4")
+      break
+    }
+  }
+  if (tails.length !== 1) problems.push(`expected exactly one opencode tail, found ${tails.length}`)
+  else {
+    const tail = tails[0]
+    if (lines[lines.length - 1] !== tail) problems.push("opencode tail slot must be last")
+    if (tail.weight !== 2 || tail.bucket !== "opencode") problems.push("opencode tail must be weight 2 with b:opencode")
+  }
+  if (lines.length !== POOL_SIZE) problems.push(`expected ${POOL_SIZE} slots, found ${lines.length}`)
+  const structural = problems.filter((p) => !p.startsWith(`expected ${POOL_SIZE}`))
+  return { valid: structural.length === 0, problems, count: lines.length }
+}
+
+/**
+ * Hard-dead check for retention: only these failure kinds vacate a slot.
+ */
+export const isHardDeadRow = (row) => {
+  if (!row || row.ok !== false) return false
+  const kind = String(row.kind ?? classifyFailure({ status: row.status, reason: row.reason }) ?? "").toLowerCase()
+  return HARD_DEAD_KINDS.has(kind)
+}
+
 export function selectPool({
   providers,
   previousProviders,
+  currentSlots = [],
   minContext = MIN_CONTEXT,
   minScore = MIN_SCORE,
   poolSize = POOL_SIZE,
@@ -237,14 +319,93 @@ export function selectPool({
 
   const pickedZen = zen.slice(0, zenReserve)
 
-  const selection = [
-    ...go.map((row) => ({ model: row.model, weight: 4, context: row.context ?? null })),
-    ...pickedSmall.map((row) => ({ model: row.model, weight: 2, context: row.context ?? null })),
-    ...pickedLarge.map((row) => ({ model: row.model, weight: 1, context: row.context ?? null })),
-    ...pickedZen.map((row) => ({ model: row.model, weight: 2, bucket: "opencode", context: row.context ?? null })),
+  const warnings = []
+
+  // Pool-level retention: a current member stays unless this run proved it
+  // hard-dead. A healthy-but-unselected model (caps, score floors) is NOT
+  // retained — the caps decided that. A transiently failed, unscanned, or
+  // budget-cut model is retained and benched in place by the writer; only a
+  // catalogue removal on a cleanly scanned provider vacates the slot. Head
+  // and tail are never vacated by a failed or partial scan.
+  const rowByModel = new Map(rows.map((row) => [row.model, row]))
+  const cleanlyScanned = (model) => {
+    const provider = providerOf(model)
+    return scannedProviders.has(provider) && !truncatedProviders.has(provider) && !erroredProviders.has(provider)
+  }
+  const placedModels = new Set([...go, ...cappedSmall, ...cappedLarge, ...pickedZen].map((row) => row.model))
+  const shouldRetain = (model) => {
+    if (!model.includes("/") || placedModels.has(model)) return false
+    const row = rowByModel.get(model)
+    if (row) return row.ok === false && !isHardDeadRow(row)
+    return !cleanlyScanned(model)
+  }
+  const retainedHead = []
+  const retainedMiddle = []
+  let retainedTail = null
+  for (const slot of Array.isArray(currentSlots) ? currentSlots : []) {
+    const model = String(slot?.model ?? "")
+    if (!shouldRetain(model)) continue
+    const weight = Number(slot?.weight)
+    if (providerOf(model) === "opencode-go") {
+      retainedHead.push({ model, weight: 4, context: slot?.context ?? null, retained: true })
+    } else if (providerOf(model) === "opencode") {
+      if (!retainedTail) retainedTail = { model, weight: 2, bucket: "opencode", context: slot?.context ?? null, retained: true }
+    } else {
+      retainedMiddle.push({
+        model,
+        weight: Number.isFinite(weight) && weight > 0 ? weight : 2,
+        ...(slot?.bucket ? { bucket: slot.bucket } : {}),
+        context: slot?.context ?? null,
+        retained: true,
+      })
+    }
+  }
+
+  const toSmall = (row) => ({ model: row.model, weight: 2, context: row.context ?? null })
+  const toLarge = (row) => ({ model: row.model, weight: 1, context: row.context ?? null })
+  const middle = [...pickedSmall.map(toSmall), ...pickedLarge.map(toLarge)]
+  for (const entry of retainedMiddle) {
+    if (!middle.some((existing) => existing.model === entry.model)) middle.push(entry)
+  }
+  if (retainedTail && !pickedZen.some((row) => providerOf(row.model) === "opencode")) {
+    middle.push({ ...retainedTail })
+    retainedTail = { ...retainedTail, placed: true }
+  }
+  const head = [
+    ...retainedHead,
+    ...go.filter((row) => !retainedHead.some((entry) => entry.model === row.model)).map((row) => ({ model: row.model, weight: 4, context: row.context ?? null })),
   ]
+  const tail = pickedZen.map((row) => ({ model: row.model, weight: 2, bucket: "opencode", context: row.context ?? null }))
+  let selection = [...head, ...middle, ...tail]
+  // Fit the contract size without ever vacating head or tail: trim the middle
+  // from the back (lowest score first), skipping retained slots. If even that
+  // cannot fit, the head wins and a warning says so.
+  while (selection.length > poolSize) {
+    let index = -1
+    for (let i = selection.length - 1; i >= 0; i--) {
+      const entry = selection[i]
+      if (!entry.retained && providerOf(entry.model) !== "opencode-go" && providerOf(entry.model) !== "opencode") {
+        index = i
+        break
+      }
+    }
+    if (index === -1) {
+      warnings.push(`pool head exceeds the contract size ${poolSize}; keeping every head slot`)
+      break
+    }
+    selection.splice(index, 1)
+  }
+
+  const retainedCount = selection.filter((entry) => entry.retained).length
+  if (retainedCount > 0) {
+    warnings.push(
+      `retained ${retainedCount} current slot(s) benched in place: ${selection
+        .filter((entry) => entry.retained)
+        .map((entry) => entry.model)
+        .join(", ")}`,
+    )
+  }
 
-  const warnings = []
   for (const entry of Array.isArray(providers) ? providers : []) {
     if (entry?.error) {
       warnings.push(`${entry.provider}: ${entry.error}`)

package/scripts/refresh-pool.mjs

@@ -20,11 +20,11 @@
 
 import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"
 import { execFileSync } from "node:child_process"
-import { homedir, userInfo } from "node:os"
+import { homedir, tmpdir, userInfo } from "node:os"
 import { dirname, join, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
-import { fetchProviderStatus } from "./provider-status.mjs"
-import { POOL_SIZE } from "./pool-selection.mjs"
+import { fetchProviderStatus, statusDeprioritizedProviders } from "./provider-status.mjs"
+import { POOL_SIZE, isTransientFailure, parsePoolSlots, poolStructureValid } from "./pool-selection.mjs"
 
 const HOME = homedir()
 export const DEFAULT_SCORES_PATH = join(HOME, ".config", "lacode", "model-scores.json")
@@ -195,14 +195,47 @@ function writeFileAtomic(path, text) {
   renameSync(tmp, path)
 }
 
-function runScorer(max) {
+function runScorer(max, extraArgs = []) {
   const here = dirname(fileURLToPath(import.meta.url))
   const scorer = resolve(here, "score-models.mjs")
   if (!existsSync(scorer)) throw new Error(`scorer not found: ${scorer}`)
-  const args = [scorer, "--max", String(max)]
+  const args = [scorer, "--max", String(max), ...extraArgs]
   execFileSync(process.execPath, args, { stdio: "inherit" })
 }
 
+/**
+ * Cheap health check: probe exactly the current pool members (no catalogue
+ * sweep). Every member answers → the pool stands as-is: no full scan, no
+ * retry, back to the 6-hour cadence. Anything else → false, and the caller
+ * runs a full scan to verify. Returns true when the pool stands.
+ */
+function runCanary({ currentPoolText, scorerArgs, max }) {
+  const members = parsePoolSlots(currentPoolText).map((slot) => slot.model)
+  if (members.length === 0) return false
+  const tmp = join(tmpdir(), `lacode-canary-${process.pid}.json`)
+  try {
+    runScorer(Math.max(max, members.length), [...scorerArgs, "--probe-models", members.join(","), "--out", tmp])
+    const payload = JSON.parse(readFileSync(tmp, "utf8"))
+    const answered = new Set()
+    for (const entry of payload?.providers ?? []) {
+      for (const row of entry?.rows ?? []) {
+        if (row?.model && row?.ok === true) answered.add(row.model)
+      }
+    }
+    const missing = members.filter((model) => !answered.has(model))
+    if (missing.length === 0) {
+      console.log(`canary healthy: all ${members.length} pool member(s) answered; pool stands, no full scan`)
+      return true
+    }
+    console.log(`canary: ${missing.length} member(s) not answering (${missing.join(", ")}); running a full scan`)
+    return false
+  } finally {
+    try {
+      rmSync(tmp, { force: true })
+    } catch {}
+  }
+}
+
 /**
  * Count the usable model slots in a pool.txt text (comments and blanks ignored).
  */
@@ -210,40 +243,71 @@ export function poolSlotCount(text) {
   return splitHeaderAndSlots(text).slots.filter(isSlotLine).length
 }
 
-/** The pool's structural contract: an opencode-go head and an opencode tail. */
-export function poolHasHead(text) {
-  const slots = splitHeaderAndSlots(text).slots.filter(isSlotLine)
-  return slots.length > 0 && slots[0].split("#")[0].trim().startsWith("opencode-go/")
-}
-
-export function poolHasTail(text) {
-  const slots = splitHeaderAndSlots(text).slots.filter(isSlotLine)
-  if (slots.length === 0) return false
-  const last = slots[slots.length - 1].split("#")[0].trim()
-  return last.startsWith("opencode/") && /(^|\s)b:opencode(\s|$)/.test(last)
-}
+/**
+ * Bench-in-place file layout. Must match src/lib/pool.ts: the runtime treats
+ * these files as flat cooling records (never strikes) and re-admits a model
+ * the moment a probe watches it answer.
+ */
+export const SCAN_BENCH_REASON = "scan-kept"
+export const SCAN_BENCH_WINDOW_MS = 45 * 60 * 1000
+export const scanBenchDir = (home = HOME) => join(home, ".local", "share", "opencode", "agent-pool")
+export const scanBenchFile = (model) => `limit.${String(model).replace(/[^a-zA-Z0-9._-]/g, "__")}.json`
 
 /**
- * Pure scan-skip decision. Only a hard `down` on a gating opencode service may
- * skip a scan — `degraded` never does, because models routinely answer while
- * the page says degraded. A structurally broken pool is never skipped either:
- * the scan is its repair path.
+ * Pure bench plan for the current pool members. A member whose current row
+ * failed transiently is benched until its stated reset (else 45 minutes); a
+ * member that answered has any stale bench cleared; an unscanned member is
+ * left alone for lack of evidence. Only pool members are ever touched.
  */
-export function shouldSkipScan({ providerStatus, currentPoolText }) {
-  if (!providerStatus?.ok || providerStatus.stale) {
-    return { skip: false, reason: "no trustworthy live signal; scanning" }
+export function computeScanBench({ selectionModels, providers, now = Date.now() }) {
+  const currentByModel = new Map()
+  for (const entry of Array.isArray(providers) ? providers : []) {
+    for (const row of Array.isArray(entry?.rows) ? entry.rows : []) {
+      if (row?.model && !currentByModel.has(row.model)) currentByModel.set(row.model, row)
+    }
   }
-  const down = Array.isArray(providerStatus.down) ? providerStatus.down : []
-  if (down.length === 0) {
-    return { skip: false, reason: "no hard outage on the live status; scanning" }
+  const bench = []
+  const clear = []
+  for (const model of selectionModels ?? []) {
+    const row = currentByModel.get(model)
+    if (!row) continue
+    if (row.ok !== false) {
+      clear.push(model)
+      continue
+    }
+    if (!isTransientFailure(row)) continue
+    const at = Number(row.retryAfter)
+    bench.push({
+      model,
+      until: Number.isFinite(at) && at > now ? at : now + SCAN_BENCH_WINDOW_MS,
+      kind: String(row.kind ?? "unknown"),
+    })
   }
-  if (!poolHasHead(currentPoolText) || !poolHasTail(currentPoolText)) {
-    return { skip: false, reason: "pool structure already broken; scanning to repair it" }
+  return { bench, clear }
+}
+
+/** Apply a bench plan with atomic writes; every failure is best-effort. */
+export function applyScanBench({ dir, bench, clear }) {
+  const applied = { benched: [], cleared: [] }
+  try {
+    mkdirSync(dir, { recursive: true })
+  } catch {}
+  for (const { model, until } of bench ?? []) {
+    try {
+      const record = { model, until, strikes: 1, reason: SCAN_BENCH_REASON, last: Date.now() }
+      const tmp = join(dir, `${scanBenchFile(model)}.tmp-${process.pid}`)
+      writeFileSync(tmp, JSON.stringify(record))
+      renameSync(tmp, join(dir, scanBenchFile(model)))
+      applied.benched.push(model)
+    } catch {}
   }
-  return {
-    skip: true,
-    reason: `opencode status reports down: ${down.join(", ")}; keeping the current pool and rechecking in ${DEGRADED_RETRY_S / 60} minutes`,
+  for (const model of clear ?? []) {
+    try {
+      rmSync(join(dir, scanBenchFile(model)), { force: true })
+      applied.cleared.push(model)
+    } catch {}
   }
+  return applied
 }
 
 /**
@@ -261,32 +325,22 @@ export function shouldKeepPool({ currentPoolText, newSlots }) {
   if (prev <= 0) return { keep: false, prev, threshold: 0, reason: "no previous pool to protect" }
   const slots = Array.isArray(newSlots) ? newSlots : []
   const threshold = Math.max(MIN_POOL_SLOTS, Math.floor(POOL_SIZE / 2))
-  if (poolHasHead(currentPoolText) && !slots.some((line) => String(line).split("#")[0].trim().startsWith("opencode-go/"))) {
+  const currentCheck = poolStructureValid(currentPoolText)
+  const newCheck = poolStructureValid(slots)
+  if (currentCheck.valid && !newCheck.valid) {
     return {
       keep: true,
       prev,
       threshold,
-      reason: `new selection has no opencode-go head slot while the previous pool has one; refusing to behead the pool`,
+      reason: `new selection breaks the pool structure (${newCheck.problems.join("; ")}); keeping the previous pool`,
     }
   }
-  const tailKept = slots.some((line) => {
-    const stripped = String(line).split("#")[0].trim()
-    return stripped.startsWith("opencode/") && /(^|\s)b:opencode(\s|$)/.test(stripped)
-  })
-  if (poolHasTail(currentPoolText) && !tailKept) {
-    return {
-      keep: true,
-      prev,
-      threshold,
-      reason: `new selection has no opencode tail slot while the previous pool has one; refusing to dock the tail`,
-    }
-  }
-  if (slots.length >= threshold) return { keep: false, prev, threshold, reason: "" }
+  if (slots.filter(isSlotLine).length >= threshold) return { keep: false, prev, threshold, reason: "" }
   return {
     keep: true,
     prev,
     threshold,
-    reason: `new selection has ${slots.length} usable slot(s), below the keep threshold of ${threshold} (contract pool size ${POOL_SIZE}); refusing to shrink the pool`,
+    reason: `new selection has ${slots.filter(isSlotLine).length} usable slot(s), below the keep threshold of ${threshold} (contract pool size ${POOL_SIZE}); refusing to shrink the pool`,
   }
 }
 
@@ -312,6 +366,7 @@ export function scheduleRetryIn(seconds, options = {}) {
   const scriptPath = options.scriptPath ?? fileURLToPath(import.meta.url)
   const nodePath = options.nodePath ?? process.execPath
   const home = options.home ?? HOME
+  const extraArgs = Array.isArray(options.args) ? options.args : []
   const nowMs = (options.now ?? Date.now)()
   const path = `${home}/.opencode/bin:/usr/local/bin:/usr/bin:/bin`
   const unit = `lacode-refresh-pool-retry-${Math.floor(nowMs / 1000).toString(36)}`
@@ -327,6 +382,7 @@ export function scheduleRetryIn(seconds, options = {}) {
         `--setenv=PATH=${path}`,
         nodePath,
         scriptPath,
+        ...extraArgs,
       ],
       { stdio: "ignore" },
     )
@@ -348,9 +404,11 @@ export function scheduleRetry(retry, options = {}) {
   return scheduled
 }
 
-/** Schedule a recheck on the degraded cadence (default 5 minutes). */
+/** Schedule a recheck on the degraded cadence (default 5 minutes). Retries run
+ * a cheap canary first and only fall back to a full scan when a pool member
+ * stops answering. */
 export function scheduleRetrySoon(seconds = DEGRADED_RETRY_S, options = {}) {
-  return scheduleRetryIn(seconds, options)
+  return scheduleRetryIn(seconds, { ...options, args: [...(options.args ?? []), "--canary"] })
 }
 
 export function renderTimerUnits(input = {}) {
@@ -441,6 +499,8 @@ function usage() {
                     systemctl --user start lacode-refresh-pool.service
   --print           print the proposed pool.txt and make no changes (alias: --dry-run)
   --dry-run         same as --print
+  --canary          probe only the current pool members; run a full scan only
+                    when one stops answering (used by degraded rechecks)
   --max N           models per provider passed to the scorer (default: 50)
   --scores PATH     scores file (default: ${DEFAULT_SCORES_PATH})
   --pool PATH       pool file to read/compare/write (default: ${DEFAULT_POOL_PATH})
@@ -448,15 +508,16 @@ function usage() {
                     keep the previous pool (human override for a changed catalogue)
   -h, --help        this message
 
-Degradation behaviour: before scanning, the refresh checks
-https://status.opencode.ai/api/status. Only a hard outage (a gating service
-reporting down) with a structurally intact pool skips the scan; a mere degraded
-never does, because models routinely answer while the page says degraded. After
-a scan, a selection that beheads the pool (no opencode-go head), docks the tail
-(no opencode slot), or falls below half the contract pool size (minimum ${MIN_POOL_SLOTS}
-slots) is never written; the previous pool is kept and a 5-minute recheck is
-scheduled. A retry is always rechecked within 5 minutes while anything failed,
-even when the stated reset is hours out.`)
+Degradation behaviour: before scanning, the refresh reads
+https://status.opencode.ai/api/status. The page is a hint, never a verdict:
+sick providers are only probed last, and nothing is ever skipped or benched
+because of it. A canary (--canary, used by every degraded recheck) probes only
+the current pool members and runs a full scan solely when one stops answering.
+After a scan, a selection that breaks the pool structure or falls below half
+the contract pool size (minimum ${MIN_POOL_SLOTS} slots) is never written; the
+previous pool is kept, transiently failed members are still benched in place,
+and a 5-minute canary recheck is scheduled. A retry is always rechecked
+within 5 minutes while anything failed, even when the stated reset is hours out.`)
 }
 
 async function main() {
@@ -488,37 +549,36 @@ async function main() {
   }
 
   const currentPoolText = readTextFile(poolPath)
+  const canary = argv.includes("--canary")
 
-  // Live degradation signal. Only a hard `down` on opencode's serving path may
-  // skip the scan — and only when the current pool is structurally intact, so
-  // a broken pool always gets its repair scan. `degraded` never skips: models
-  // routinely answer while the page says degraded, and the write guard below
+  // Live status is a hint, never a verdict. Gating services that report down
+  // or degraded only reorder probes (sick providers last) so they cannot eat
+  // the scan budget. Nothing is ever skipped or benched because of the page —
+  // only real probe evidence benches a model, and the write guard below
   // protects the pool if the scan comes back degenerate.
-  let providerStatus = { ok: false, providers: [], services: [], down: [] }
-  if (!printOnly) {
+  let deprioritized = []
+  if (!printOnly && !fromScores) {
     try {
-      providerStatus = await fetchProviderStatus()
+      deprioritized = statusDeprioritizedProviders(await fetchProviderStatus())
     } catch (error) {
-      providerStatus = { ok: false, providers: [], services: [], down: [], reason: String(error?.message ?? error) }
+      console.log(`live status unreadable (${String(error?.message ?? error)}); scanning in default order`)
     }
-    const skip = shouldSkipScan({ providerStatus, currentPoolText })
-    if (skip.skip) {
-      console.log(`${skip.reason}; keeping the current pool of ${poolSlotCount(currentPoolText)} slots`)
-      if (!noRetry) {
-        const scheduled = scheduleRetrySoon()
-        console.log(
-          scheduled.scheduled
-            ? `scheduled degraded recheck in ${scheduled.seconds}s`
-            : `degraded recheck not scheduled: ${scheduled.reason}`,
-        )
-      }
-      return
+    if (deprioritized.length > 0) {
+      console.log(`status hint: probing ${deprioritized.join(", ")} last`)
     }
   }
+  const scorerArgs = [`--current-pool`, poolPath]
+  if (deprioritized.length > 0) scorerArgs.push(`--deprioritize-providers`, deprioritized.join(","))
+
+  const runFullScan = () => runScorer(max, scorerArgs)
 
   if (!fromScores) {
     try {
-      runScorer(max)
+      if (canary) {
+        runCanary({ poolPath, currentPoolText, scorerArgs, max })
+      } else {
+        runFullScan()
+      }
     } catch (error) {
       console.error(`scorer failed; pool.txt not written: ${String(error?.message ?? error)}`)
       if (!printOnly && !noRetry) {
@@ -562,6 +622,21 @@ async function main() {
 
   const oldSlotCount = poolSlotCount(currentPoolText)
   const newSlotCount = built.slots.filter(isSlotLine).length
+
+  // Bench-in-place: a pool member this run failed transiently keeps its slot
+  // and gets a flat cooling record the runtime already honours; a member that
+  // answered has any stale bench cleared. Unscanned members are left alone.
+  // Runs on the write path and the refusal path alike — a kept pool still
+  // learns what the scan found.
+  if (!printOnly) {
+    const plan = computeScanBench({ selectionModels: built.chosen.selected, providers: scores.providers })
+    const applied = applyScanBench({ dir: scanBenchDir(), bench: plan.bench, clear: plan.clear })
+    if (applied.benched.length > 0) {
+      const detail = plan.bench.map((entry) => `${entry.model} (${entry.kind})`).join(", ")
+      console.log(`scan benched in place: ${detail}`)
+    }
+    if (applied.cleared.length > 0) console.log(`scan cleared stale benches: ${applied.cleared.join(", ")}`)
+  }
   const dropped = scores.providers.flatMap((entry) => (Array.isArray(entry?.excluded) ? entry.excluded : []))
   const summary = [
     `selected [${built.chosen.selected.join(", ")}]`,

package/scripts/score-models.mjs

@@ -46,13 +46,14 @@ import {
   classifyFailure,
   isTransientFailure,
   isTransientKind,
+  parsePoolSlots,
   providerRank,
   retryAfterMs,
   selectPool,
 } from "./pool-selection.mjs"
 
 const AUTH = join(homedir(), ".local", "share", "opencode", "auth.json")
-const OUT = join(homedir(), ".config", "lacode", "model-scores.json")
+const DEFAULT_OUT = join(homedir(), ".config", "lacode", "model-scores.json")
 // No default provider list: `opencode models --verbose` with no argument returns
 // every provider opencode knows about, and that is what we scan by default.
 const SESSION_PROVIDERS = new Set(["opencode", "opencode-go"])
@@ -100,6 +101,13 @@ const value = (flag, fallback) => {
     console.log(`Usage: npm run score -- [options]
 
   --providers a,b   restrict the scan to these providers (default: all configured)
+  --probe-models a,b probe exactly these provider/model ids (canary: skips the
+                    catalogue scan for everything else; unscanned providers keep
+                    their previous rows)
+  --deprioritize-providers a,b probe these providers last (a live status hint;
+                    never excludes anything, ordering only)
+  --current-pool PATH feed pool.txt as the current pool so selection retains
+                    members this run could not reach (default: no retention)
   --max N           probe at most N candidate models per provider (default: 50)
   --min-context N   exclude models whose context limit is below N (default: ${MIN_CONTEXT})
   --min-score N     do not rank models scoring below N (default: ${MIN_SCORE})
@@ -126,6 +134,16 @@ Providers with no direct HTTP endpoint (or an unexpanded \${...} URL) are probed
 
 const providerArg = value("--providers", null)
 const providers = providerArg ? String(providerArg).split(",").map((s) => s.trim()).filter(Boolean) : null
+const probeModelsArg = value("--probe-models", null)
+const probeModels = probeModelsArg ? new Set(String(probeModelsArg).split(",").map((s) => s.trim()).filter(Boolean)) : null
+const deprioritizeArg = value("--deprioritize-providers", null)
+  const deprioritizedProviders = new Set(
+    deprioritizeArg ? String(deprioritizeArg).split(",").map((s) => s.trim()).filter(Boolean) : [],
+  )
+  // probe --probe-models ids absent from every catalogue. Filled during the
+  // catalogue filter above; emitted as synthetic not-served rows after probing.
+  const missingProbeModels = []
+const currentPoolPath = value("--current-pool", null)
 const maxPerProvider = Math.max(1, Number(value("--max", "50")) || 50)
 const minContext = Math.max(0, Number(value("--min-context", String(MIN_CONTEXT))) || MIN_CONTEXT)
 const minScore = Math.max(0, Number(value("--min-score", String(MIN_SCORE))) || MIN_SCORE)
@@ -133,6 +151,7 @@ const timeoutMs = Math.max(1_000, Number(value("--timeout", "12000")) || 12_000)
 const delayMs = Math.max(0, Number(value("--delay", "300")) || 300)
 const budgetMin = Math.max(1, Number(value("--budget-min", "30")) || 30)
 const budgetMs = budgetMin * 60_000
+const OUT = value("--out", DEFAULT_OUT)
 const writeResults = !has("--no-write")
 const freeOnlyFlag = has("--free-only")
 
@@ -570,12 +589,35 @@ const pad = (s, n) => String(s).padEnd(n)
 const padL = (s, n) => String(s).padStart(n)
 
 async function main() {
-  const scanned = providers ? providers.map((provider) => freeModels(provider)) : freeModelsAll()
+  let scanned = providers ? providers.map((provider) => freeModels(provider)) : freeModelsAll()
   // Core providers first, then the free-only middle tier, then the slow paid
-  // catalogues. Ordering only; every provider is still probed if time allows.
+  // catalogues — and explicitly deprioritized providers last. Ordering only;
+  // every provider is still probed if time allows.
   scanned.sort(
-    (a, b) => providerRank(a.provider) - providerRank(b.provider) || String(a.provider).localeCompare(String(b.provider)),
+    (a, b) =>
+      Number(deprioritizedProviders.has(a.provider)) - Number(deprioritizedProviders.has(b.provider)) ||
+      providerRank(a.provider) - providerRank(b.provider) ||
+      String(a.provider).localeCompare(String(b.provider)),
   )
+  const currentSlots = (() => {
+    if (!currentPoolPath) return []
+    try {
+      return parsePoolSlots(readFileSync(currentPoolPath, "utf8"))
+    } catch {
+      return []
+    }
+  })()
+  if (probeModels && probeModels.size > 0) {
+    const seen = new Set()
+    scanned = scanned.flatMap((entry) => {
+      if (entry.error) return []
+      const models = (entry.models ?? []).filter((candidate) => probeModels.has(candidate.model))
+      models.forEach((candidate) => seen.add(candidate.model))
+      if (models.length === 0) return []
+      return [{ ...entry, models }]
+    })
+    missingProbeModels.push(...[...probeModels].filter((model) => !seen.has(model)))
+  }
   const results = []
   const deadline = Date.now() + budgetMs
   const skippedProviders = []
@@ -655,6 +697,32 @@ async function main() {
   }
   stopSessionServer()
 
+  // A canary model absent from every catalogue is not "unscanned" — it is
+  // gone. A synthetic not-served row makes the selector drop it (hard-dead)
+  // instead of retaining it blindly.
+  for (const model of missingProbeModels) {
+    const slash = model.indexOf("/")
+    const provider = slash === -1 ? "unknown" : model.slice(0, slash)
+    const row = {
+      provider,
+      model,
+      url: "",
+      apiId: slash === -1 ? model : model.slice(slash + 1),
+      context: null,
+      output: null,
+      ok: false,
+      ms: null,
+      reason: "not in provider catalogue (model-missing)",
+      status: 404,
+      kind: "not-served",
+      score: null,
+      retryAfter: null,
+    }
+    const entry = results.find((candidate) => candidate.provider === provider)
+    if (entry) entry.rows.push(row)
+    else results.push({ provider, error: null, rows: [row], excluded: [], truncated: false, degraded: false })
+  }
+
   // Per-provider ranked tables.
   for (const entry of results) {
     if (entry.error || entry.rows.length === 0) continue
@@ -705,6 +773,7 @@ async function main() {
       excluded: entry.excluded,
     })),
     previousProviders: previousScores?.providers,
+    currentSlots,
     minContext,
     minScore,
   })