@lawaty/lacode 2.3.0-beta.5 → 2.3.0-beta.6

package/scripts/pool-selection.mjs

@@ -19,6 +19,13 @@ export const STATED_COOLDOWN_MAX_MS = 6 * 60 * 60 * 1000
 // for a gateway hiccup or a short provider outage to clear, short enough that a
 // recovered model is back well before the 6-hour timer.
 export const SYNTHETIC_RETRY_MS = 45 * 60 * 1000
+// A model that fails transiently scan after scan is not having a bad moment; it
+// is a bad slot. Keep it (benched in place) for this many consecutive scans, then
+// let it vacate the pool. A successful scan resets the streak, so a model that
+// genuinely recovers returns on the next run. This is what stops a model that
+// times out on every single request from being retained forever because the
+// failure kind is nominally "transient".
+export const MAX_TRANSIENT_STREAK = 3
 
 // Scan order, not selection order: the pool's core providers are probed first so
 // a wall-clock budget can never starve them behind a slow paid catalogue. This is
@@ -35,7 +42,7 @@ export const providerRank = (provider) => {
 // classifier existed or by a provider that gives only prose.
 const FAILURE_KINDS = [
   ["agreement", /model\s+agreement|terms\s+of\s+(?:service|use)|\btos\b/i],
-  ["credit", /out\s+of\s+credits|insufficient\s+credits|credit\s+balance|requires\s+more\s+credits|payment\s+required|billing|purchase|\b402\b/i],
+  ["credit", /out\s+of\s+credits|insufficient\s+credits|credit\s+balance|requires\s+more\s+credits|payment\s+required|billing|purchase|budget\s+exhausted|api\s+budget|quota\s+exhausted|\b402\b/i],
   ["rate-limited", /rate[\s_-]?limit|usage\s+limit|too\s+many\s+requests|overloaded|limits?[\s_-]?(?:reached|exceeded)|free[-\s]?tier|freelimiterror|quota|\b429\b/i],
   ["credential", /\b401\b|unauthori[sz]ed|not\s+authori[sz]ed|invalid[\s_-]+(?:api[\s_-]?(?:key|token)|token|credential|bearer)|api[\s_-]?key\s+(?:is\s+)?(?:invalid|missing|expired|not\s+valid)|authentication\s+(?:failed|error|required)|incorrect[\s_-]?api[\s_-]?key/i],
   ["not-served", /\b404\b|no\s+such\s+model|model\s+not\s+found|does\s+not\s+exist|is\s+not\s+available|not\s+served|not\s+found/i],
@@ -44,10 +51,12 @@ const FAILURE_KINDS = [
   ["server", /\b5\d\d\b|internal\s+server|bad\s+gateway|service\s+unavailable|gateway\s+timeout/i],
 ]
 
-// A credit exhaustion is transient over hours, not permanent: the balance can be
-// topped up, and the retry schedule is what carries it. Agreement, credential
-// and not-served failures are permanent for this model until a human acts.
-const TRANSIENT_KINDS = new Set(["rate-limited", "credit", "timeout", "network", "server"])
+// An empty balance is not a bad moment: the provider has said it will not serve
+// this account until someone tops it up (or the reset date arrives). Retaining
+// the slot only benches a seat forever, so credit exhaustion vacates it like a
+// missing model. A later scan that answers re-admits it automatically. Rate
+// limits and outages are the kinds that stay retained.
+const TRANSIENT_KINDS = new Set(["rate-limited", "timeout", "network", "server"])
 
 /**
  * Failure kinds that vacate a pool slot for good: the model is gone, the
@@ -134,24 +143,89 @@ const rowsOf = (providers) =>
 
 const providerOf = (model) => String(model ?? "").split("/")[0]
 
+// Which providers spend ONE shared quota window across their free models.
+// `opencode` (Zen) is the known case: every free model draws from the same free
+// bucket, which is why the primary selector tags it `b:opencode`. `opencode-go`
+// is known to publish a per-model window. For any other provider the scorer
+// cannot claim two models are independent, so fallback disjointness treats the
+// provider as one shared window (the safe direction). The primary selection is
+// unchanged unless a bucket is explicit or the provider is a known shared one.
+export const SHARED_PROVIDER_BUCKETS = { opencode: "opencode" }
+const PER_MODEL_PROVIDERS = new Set(["opencode-go"])
+
+/** The quota group a candidate actually spends: declared, known-shared, or its own model. */
+export function effectiveBucketFor(model, declared) {
+  if (declared) return declared
+  const provider = providerOf(model)
+  if (PER_MODEL_PROVIDERS.has(provider)) return model
+  return SHARED_PROVIDER_BUCKETS[provider] ?? provider
+}
+
+/** The bucket that must be written into pool.txt for a slot, when it is a known shared one. */
+export function bucketToWriteFor(model, declared) {
+  return declared ?? SHARED_PROVIDER_BUCKETS[providerOf(model)]
+}
+
+/** How many disjoint models the secondary pool keeps. */
+export const FALLBACK_POOL_SIZE = 5
+// Fallback seats are real capacity, not a token gesture: give each enough weight
+// to run work, and allow up to two models from one fallback provider so a
+// provider with several distinct models is not reduced to a single w1 seat.
+export const FALLBACK_WEIGHT = 2
+const MAX_FALLBACK_PER_PROVIDER = 2
+
+// The fallback-section marker inside pool.txt, shared with the runtime parser.
+const FALLBACK_MARKER = /^(?:#\s*-*\s*fallback(?:\s+slots)?\s*-*|\[fallback\])$/i
+
 /**
- * Parse pool.txt slot lines into [{ model, weight, bucket?, context? }].
- * Comments and blanks are ignored; weight defaults to 1.
+ * Read `# exclude-provider: name[,name]` directives from a pool.txt header.
+ *
+ * A listed provider is not probed at all and is removed from the primary pool,
+ * the fallback pool, and the retention source. The directive lives in the
+ * header, which refresh preserves, so a provider whose account is out of budget
+ * (or otherwise unwanted) stays out across regenerations without hand-editing
+ * a generated file. Removing the line is all it takes to bring it back.
+ */
+export function parsePoolDirectives(text) {
+  const excluded = new Set()
+  for (const line of String(text ?? "").split(/\r?\n/)) {
+    const match = /^#\s*exclude-provider\s*:\s*(.+)$/i.exec(line.trim())
+    if (!match) continue
+    for (const name of match[1].split(/[,\s]+/)) {
+      const provider = name.trim()
+      if (provider) excluded.add(provider)
+    }
+  }
+  return excluded
+}
+
+/**
+ * Parse pool.txt slot lines into [{ model, weight, bucket?, context?, ceiling?, fallback? }].
+ * Comments and blanks are ignored; weight defaults to 1. A line that is exactly
+ * `# --- fallback ---` (or `[fallback]`) starts the fallback section.
  */
 export function parsePoolSlots(text) {
   const out = []
+  let section = "primary"
   for (const line of String(text ?? "").split(/\r?\n/)) {
+    if (FALLBACK_MARKER.test(line.trim())) {
+      section = "fallback"
+      continue
+    }
     const code = line.split("#")[0].trim()
     if (!code || !code.includes("/")) continue
     const [model, weight] = code.split(/\s+/)
     if (!model || !model.includes("/")) continue
     const bucket = /b:([^\s]+)/.exec(code)?.[1]
     const context = /c:(\d+)/.exec(code)?.[1]
+    const ceiling = /ceil:(\d+)/.exec(code)?.[1]
     out.push({
       model,
       weight: Number(weight) > 0 ? Number(weight) : 1,
+      ...(ceiling ? { ceiling: Number(ceiling) } : {}),
       ...(bucket ? { bucket } : {}),
       context: context ? Number(context) : null,
+      ...(section === "fallback" ? { fallback: true } : {}),
     })
   }
   return out
@@ -166,15 +240,18 @@ export function parsePoolSlots(text) {
  */
 export function poolStructureValid(slots) {
   const problems = []
-  const items = typeof slots === "string" ? String(slots).split(/\r?\n/) : Array.isArray(slots) ? slots : []
-  const lines = items.map((entry) => {
-    if (typeof entry === "string") {
-      const parts = entry.split("#")[0].trim().split(/\s+/)
-      const bucket = /b:([^\s]+)/.exec(entry)?.[1]
-      return { model: parts[0] ?? "", weight: Number(parts[1]) || 0, bucket }
-    }
-    return { model: entry?.model ?? "", weight: Number(entry?.weight) || 0, bucket: entry?.bucket }
-  }).filter((entry) => entry.model.includes("/"))
+  const parsed =
+    typeof slots === "string"
+      ? parsePoolSlots(slots)
+      : Array.isArray(slots)
+        ? slots.flatMap((entry) => (typeof entry === "string" ? parsePoolSlots(entry) : [entry]))
+        : []
+  const lines = parsed.map((entry) => ({
+    model: entry?.model ?? "",
+    weight: Number(entry?.weight) || 0,
+    bucket: entry?.bucket,
+    fallback: entry?.fallback === true,
+  })).filter((entry) => entry.model.includes("/") && !entry.fallback)
   const go = lines.filter((entry) => providerOf(entry.model) === "opencode-go")
   const tails = lines.filter((entry) => providerOf(entry.model) === "opencode")
   if (go.length === 0) problems.push("missing opencode-go head")
@@ -223,7 +300,11 @@ export function selectPool({
     typeof row.score === "number" &&
     Number.isFinite(row.score) &&
     row.score >= minScore &&
-    (row.context == null || row.context >= minContext)
+    (row.context == null || row.context >= minContext) &&
+    // A stale success carried beside a current failure is rankable only while the
+    // failure streak is short. Once the model has failed MAX_TRANSIENT_STREAK
+    // scans in a row, the old score stops being evidence about the present.
+    Number(row?.failStreak ?? 0) < MAX_TRANSIENT_STREAK
   const byScore = (a, b) => b.score - a.score || String(a.model).localeCompare(String(b.model))
   const nowMs = typeof now === "function" ? Number(now()) : Number(now)
   const normalize = (row) => {
@@ -236,6 +317,14 @@ export function selectPool({
   const rows = rowsOf(providers).map(normalize)
   const previousRows = rowsOf(previousProviders)
   const currentByModel = new Map(rows.map((row) => [row.model, row]))
+  // A ceiling is the slot's hard concurrency cap (max parallel sessions). It is
+  // carried from the current pool through the report so a refresh never silently
+  // drops it; only a ceiling that still fits the slot's weight is kept.
+  const ceilingByModel = new Map(
+    (Array.isArray(currentSlots) ? currentSlots : [])
+      .filter((slot) => slot && typeof slot.model === "string" && Number.isFinite(Number(slot.ceiling)))
+      .map((slot) => [slot.model, Number(slot.ceiling)]),
+  )
   const scannedProviders = new Set(
     (Array.isArray(providers) ? providers : []).map((entry) => String(entry?.provider ?? "")),
   )
@@ -336,7 +425,10 @@ export function selectPool({
   const shouldRetain = (model) => {
     if (!model.includes("/") || placedModels.has(model)) return false
     const row = rowByModel.get(model)
-    if (row) return row.ok === false && !isHardDeadRow(row)
+    // Retain a failed member only while its consecutive-failure streak is short.
+    // Past the cap the slot has proved it cannot serve; leaving it in the pool
+    // just benches a seat every refresh and hands work to it between refreshes.
+    if (row) return row.ok === false && !isHardDeadRow(row) && Number(row.failStreak ?? 0) < MAX_TRANSIENT_STREAK
     return !cleanlyScanned(model)
   }
   const retainedHead = []
@@ -377,6 +469,34 @@ export function selectPool({
   ]
   const tail = pickedZen.map((row) => ({ model: row.model, weight: 2, bucket: "opencode", context: row.context ?? null }))
   let selection = [...head, ...middle, ...tail]
+  // The report carries each slot's ceiling as a fact: a configured ceiling from
+  // the current pool survives regeneration, and a slot with none stays weight-only.
+  selection = selection.map((entry) => {
+    const ceiling = ceilingByModel.get(entry.model)
+    return ceiling !== undefined && ceiling >= Number(entry.weight) ? { ...entry, ceiling } : entry
+  })
+  // Two provider ids can front the same upstream model (an `openrouter` and a
+  // `console-openrouter` alias, for example). They draw on one quota window, so
+  // giving both a slot burns capacity twice and both fall over together. When
+  // the provider names are aliases (one is a suffix of the other) and the model
+  // id past the provider prefix is identical, keep only the first, score-ranked
+  // occurrence. A plain `provider/model` id is never collapsed, so different
+  // providers serving the same model name keep their independent slots.
+  const upstreamOf = (model) => {
+    const slash = String(model).indexOf("/")
+    const upstream = slash < 0 ? "" : String(model).slice(slash + 1)
+    return upstream.includes("/") ? upstream : ""
+  }
+  const seenUpstream = new Map()
+  selection = selection.filter((entry) => {
+    const upstream = upstreamOf(entry.model)
+    if (!upstream) return true
+    const provider = providerOf(entry.model)
+    const prior = seenUpstream.get(upstream)
+    if (prior && (provider.endsWith(prior) || prior.endsWith(provider))) return false
+    seenUpstream.set(upstream, provider)
+    return true
+  })
   // Fit the contract size without ever vacating head or tail: trim the middle
   // from the back (lowest score first), skipping retained slots. If even that
   // cannot fit, the head wins and a warning says so.
@@ -406,6 +526,28 @@ export function selectPool({
     )
   }
 
+  // A fallback pool for the case where every primary slot is cooling at once.
+  // Candidates are score-ranked and must spend a different quota window from
+  // every primary slot: a same-bucket model would be benched by the same limit,
+  // so it cannot serve as a fallback. A provider may contribute up to
+  // MAX_FALLBACK_PER_PROVIDER distinct models; a shared bucket is written only
+  // when it is a known fact (Zen).
+  const selectedModels = new Set(selection.map((entry) => entry.model))
+  const primaryBuckets = new Set(selection.map((entry) => effectiveBucketFor(entry.model, entry.bucket)))
+  const fallbackSelection = []
+  const fallbackCounts = new Map()
+  for (const row of merge(() => true)) {
+    if (fallbackSelection.length >= FALLBACK_POOL_SIZE) break
+    if (!rankable(row) || selectedModels.has(row.model)) continue
+    if (primaryBuckets.has(effectiveBucketFor(row.model, undefined))) continue
+    const provider = providerOf(row.model)
+    const count = fallbackCounts.get(provider) ?? 0
+    if (count >= MAX_FALLBACK_PER_PROVIDER) continue
+    fallbackCounts.set(provider, count + 1)
+    const bucket = bucketToWriteFor(row.model, undefined)
+    fallbackSelection.push({ model: row.model, weight: FALLBACK_WEIGHT, ...(bucket ? { bucket } : {}), context: row.context ?? null })
+  }
+
   for (const entry of Array.isArray(providers) ? providers : []) {
     if (entry?.error) {
       warnings.push(`${entry.provider}: ${entry.error}`)
@@ -441,5 +583,5 @@ export function selectPool({
         }
       : undefined
 
-  return { selection, warnings, retry }
+  return { selection, fallback: fallbackSelection, warnings, retry }
 }

package/scripts/refresh-pool.mjs

@@ -60,6 +60,11 @@ const REFRESH_LOCK_STALE_MS = 60 * 60 * 1000
  */
 function acquireRefreshLock() {
   const take = () => {
+    // Ensure the parent exists (a fresh HOME, or the stable systemd copy before
+    // the plugin has ever started) but keep the lock directory's own creation
+    // non-recursive: mkdir with `recursive` succeeds on an existing directory,
+    // which would let two refreshes run at once.
+    mkdirSync(dirname(REFRESH_LOCK_DIR), { recursive: true })
     mkdirSync(REFRESH_LOCK_DIR)
     writeFileSync(join(REFRESH_LOCK_DIR, "pid"), String(process.pid))
     return true
@@ -99,6 +104,9 @@ const isSlotLine = (line) => {
   return stripped.length > 0 && stripped.includes("/")
 }
 
+/** The marker that starts the fallback section; shared with src/lib/pool.ts. */
+export const FALLBACK_MARKER = "# --- fallback ---"
+
 function splitHeaderAndSlots(text) {
   const lines = String(text ?? "").split(/\r?\n/)
   // Drop a single trailing empty element produced by a final newline so we can
@@ -120,11 +128,17 @@ function refreshComment(now, scoresGeneratedAt) {
 
 function withRefreshComment(headerLines, comment) {
   const kept = headerLines.filter((line) => !/^#\s*Refreshed\b/.test(String(line)))
+  // The header includes the blank separator before the slots, so trim trailing
+  // blanks or every run would prepend one more and the file would grow an
+  // unbounded run of empty lines.
+  while (kept.length > 0 && String(kept[kept.length - 1]).trim() === "") kept.pop()
   return [...kept, comment]
 }
 
-function formatGeneratedLine(model, weight, bucket, context) {
+function formatGeneratedLine(model, weight, bucket, context, ceiling) {
   const parts = [String(model), String(weight)]
+  // A ceiling equal to the weight is the default (one pass), so it is not printed.
+  if (Number.isFinite(Number(ceiling)) && Number(ceiling) > Number(weight)) parts.push(`ceil:${Math.round(Number(ceiling))}`)
   if (context != null && Number.isFinite(Number(context))) parts.push(`c:${Math.round(Number(context))}`)
   if (bucket) parts.push(`b:${bucket}`)
   return parts.join("  ")
@@ -141,29 +155,38 @@ export function buildPool(input) {
   if (!scores || typeof scores !== "object" || !Array.isArray(scores.providers) || !Array.isArray(scores.selection)) {
     throw new Error("score file is missing or invalid (expected { providers: [...], selection: [...] })")
   }
-  const selection = scores.selection.filter(
-    (entry) =>
-      entry &&
-      typeof entry.model === "string" &&
-      entry.model.includes("/") &&
-      typeof entry.weight === "number" &&
-      Number.isFinite(entry.weight) &&
-      entry.weight > 0,
-  )
+  const validSelection = (entry) =>
+    entry &&
+    typeof entry.model === "string" &&
+    entry.model.includes("/") &&
+    typeof entry.weight === "number" &&
+    Number.isFinite(entry.weight) &&
+    entry.weight > 0
+  const selection = scores.selection.filter(validSelection)
   if (selection.length === 0) {
     throw new Error("score file has no selected models; refusing to write pool.txt")
   }
+  // A score file written before fallback/ceiling support has no such fields.
+  // Treat "absent" as "no opinion" and carry the configured facts forward, so a
+  // refresh cannot silently delete a hand-written fallback or ceiling.
+  const currentSlots = parsePoolSlots(input?.currentPoolText ?? "")
+  const currentByModel = new Map(currentSlots.map((slot) => [slot.model, slot]))
+  const fallbackProvided = Array.isArray(scores.fallback)
+  const fallback = (fallbackProvided ? scores.fallback : currentSlots.filter((slot) => slot.fallback)).filter(validSelection)
+  const ceilingOf = (entry) => entry.ceiling ?? currentByModel.get(entry.model)?.ceiling
   const warnings = Array.isArray(scores.warnings) ? scores.warnings : []
   const { header } = splitHeaderAndSlots(input?.currentPoolText ?? "")
-  const outSlots = selection.map((entry) => formatGeneratedLine(entry.model, entry.weight, entry.bucket, entry.context))
+  const outSlots = selection.map((entry) => formatGeneratedLine(entry.model, entry.weight, entry.bucket, entry.context, ceilingOf(entry)))
+  const outFallback = fallback.map((entry) => formatGeneratedLine(entry.model, entry.weight, entry.bucket, entry.context, ceilingOf(entry)))
   const comment = refreshComment(input?.now ?? new Date(), scores.generatedAt)
   const outHeader = withRefreshComment(header, comment)
-  const text = [...outHeader, "", ...outSlots, ""].join("\n")
+  const text = [...outHeader, "", ...outSlots, ...(outFallback.length > 0 ? ["", FALLBACK_MARKER, ...outFallback] : []), ""].join("\n")
   return {
     text,
     slots: outSlots,
+    fallback: outFallback,
     warnings,
-    chosen: { selected: selection.map((entry) => entry.model) },
+    chosen: { selected: selection.map((entry) => entry.model), fallback: fallback.map((entry) => entry.model) },
   }
 }
 
@@ -240,7 +263,7 @@ function runCanary({ currentPoolText, scorerArgs, max }) {
  * Count the usable model slots in a pool.txt text (comments and blanks ignored).
  */
 export function poolSlotCount(text) {
-  return splitHeaderAndSlots(text).slots.filter(isSlotLine).length
+  return parsePoolSlots(text).filter((slot) => !slot.fallback).length
 }
 
 /**
@@ -249,15 +272,21 @@ export function poolSlotCount(text) {
  * the moment a probe watches it answer.
  */
 export const SCAN_BENCH_REASON = "scan-kept"
-export const SCAN_BENCH_WINDOW_MS = 45 * 60 * 1000
+// Bench a kept-but-failing member until the next scheduled refresh. The timer
+// runs every six hours; a 45-minute bench left the slot routable for most of the
+// cycle, so it kept failing spawns between refreshes. The cooldown probe still
+// re-admits the model as soon as it watches it answer, so a real recovery is not
+// made to wait for the timer.
+export const SCAN_BENCH_WINDOW_MS = 6 * 60 * 60 * 1000
 export const scanBenchDir = (home = HOME) => join(home, ".local", "share", "opencode", "agent-pool")
 export const scanBenchFile = (model) => `limit.${String(model).replace(/[^a-zA-Z0-9._-]/g, "__")}.json`
 
 /**
  * Pure bench plan for the current pool members. A member whose current row
- * failed transiently is benched until its stated reset (else 45 minutes); a
- * member that answered has any stale bench cleared; an unscanned member is
- * left alone for lack of evidence. Only pool members are ever touched.
+ * failed transiently is benched until its stated reset (else until the next
+ * scheduled refresh); a member that answered has any stale bench cleared; an
+ * unscanned member is left alone for lack of evidence. Only pool members are
+ * ever touched.
  */
 export function computeScanBench({ selectionModels, providers, now = Date.now() }) {
   const currentByModel = new Map()
@@ -302,8 +331,21 @@ export function applyScanBench({ dir, bench, clear }) {
     } catch {}
   }
   for (const model of clear ?? []) {
+    const path = join(dir, scanBenchFile(model))
     try {
-      rmSync(join(dir, scanBenchFile(model)), { force: true })
+      // Clear only the bench THIS scan wrote. A runtime strike
+      // (`rate-limited`, `no answer`, `provider error`, ...) is evidence from a
+      // real spawn and carries the escalation count; deleting it because a
+      // probe happened to answer would let a model that fails every real
+      // request be re-admitted every refresh. The runtime owns that record.
+      let reason
+      try {
+        reason = JSON.parse(readFileSync(path, "utf8"))?.reason
+      } catch {
+        continue // nothing on disk to clear
+      }
+      if (reason !== SCAN_BENCH_REASON) continue
+      rmSync(path, { force: true })
       applied.cleared.push(model)
     } catch {}
   }
@@ -335,7 +377,7 @@ export function shouldKeepPool({ currentPoolText, newSlots }) {
       reason: `new selection breaks the pool structure (${newCheck.problems.join("; ")}); keeping the previous pool`,
     }
   }
-  if (slots.filter(isSlotLine).length >= threshold) return { keep: false, prev, threshold, reason: "" }
+  if (parsePoolSlots(slots.join("\n")).filter((slot) => !slot.fallback).length >= threshold) return { keep: false, prev, threshold, reason: "" }
   return {
     keep: true,
     prev,

package/scripts/score-models.mjs

@@ -46,6 +46,7 @@ import {
   classifyFailure,
   isTransientFailure,
   isTransientKind,
+  parsePoolDirectives,
   parsePoolSlots,
   providerRank,
   retryAfterMs,
@@ -589,7 +590,20 @@ const pad = (s, n) => String(s).padEnd(n)
 const padL = (s, n) => String(s).padStart(n)
 
 async function main() {
+  const currentPoolText = (() => {
+    if (!currentPoolPath) return ""
+    try {
+      return readFileSync(currentPoolPath, "utf8")
+    } catch {
+      return ""
+    }
+  })()
+  const excludedProviders = parsePoolDirectives(currentPoolText)
   let scanned = providers ? providers.map((provider) => freeModels(provider)) : freeModelsAll()
+  if (excludedProviders.size > 0) {
+    scanned = scanned.filter((entry) => !excludedProviders.has(entry.provider))
+    if (scanned.length === 0) console.log(`every provider was excluded by pool.txt directives; nothing to probe`)
+  }
   // Core providers first, then the free-only middle tier, then the slow paid
   // catalogues — and explicitly deprioritized providers last. Ordering only;
   // every provider is still probed if time allows.
@@ -599,14 +613,9 @@ async function main() {
       providerRank(a.provider) - providerRank(b.provider) ||
       String(a.provider).localeCompare(String(b.provider)),
   )
-  const currentSlots = (() => {
-    if (!currentPoolPath) return []
-    try {
-      return parsePoolSlots(readFileSync(currentPoolPath, "utf8"))
-    } catch {
-      return []
-    }
-  })()
+  const currentSlots = parsePoolSlots(currentPoolText).filter(
+    (slot) => !excludedProviders.has(String(slot.model).split("/")[0]),
+  )
   if (probeModels && probeModels.size > 0) {
     const seen = new Set()
     scanned = scanned.flatMap((entry) => {
@@ -662,6 +671,12 @@ async function main() {
         outcome = await probe(candidate, entry.provider)
       }
       const kind = outcome.kind ?? classifyFailure({ status: outcome.status, reason: outcome.reason })
+      // Only cheap-failure kinds that also stall the scan count toward the
+      // breaker. A rate limit is deliberately NOT included: a 429 answers in
+      // milliseconds, so truncating on it saves little, and it would leave the
+      // provider's pool members unscanned -- which means no current failure row,
+      // so their consecutive-failure streak could never advance and they could
+      // never retire. Probe every model and record the evidence instead.
       const providerFault = !outcome.ok && ["timeout", "network", "server"].includes(kind)
       consecutiveTransient = providerFault ? consecutiveTransient + 1 : 0
       const row = { provider: entry.provider, ...candidate, ...outcome, score: null }
@@ -764,15 +779,19 @@ async function main() {
       return null
     }
   })()
-  const { selection, warnings, retry } = selectPool({
-    providers: results.map((entry) => ({
-      provider: entry.provider,
-      error: entry.error,
-      truncated: entry.truncated,
-      rows: entry.rows.map((row) => ({ ...row, score: row.score?.value ?? null })),
-      excluded: entry.excluded,
-    })),
-    previousProviders: previousScores?.providers,
+  const { selection, fallback, warnings, retry } = selectPool({
+    providers: results
+      .filter((entry) => !excludedProviders.has(entry.provider))
+      .map((entry) => ({
+        provider: entry.provider,
+        error: entry.error,
+        truncated: entry.truncated,
+        rows: entry.rows.map((row) => ({ ...row, score: row.score?.value ?? null })),
+        excluded: entry.excluded,
+      })),
+    previousProviders: (previousScores?.providers ?? []).filter(
+      (entry) => !excludedProviders.has(String(entry?.provider ?? "")),
+    ),
     currentSlots,
     minContext,
     minScore,
@@ -785,6 +804,14 @@ async function main() {
     console.log(`\nsuggested pool.txt (paste if it matches your judgement — nothing was changed)`)
     console.log(`# scored ${new Date().toISOString()} — opencode-go first (weight 4), small-context providers (weight 2), large-context providers (weight 1), opencode last (max 1)`)
     for (const entry of selection) {
+      const ceiling = Number.isFinite(entry.ceiling) && entry.ceiling > entry.weight ? `  ceil:${entry.ceiling}` : ""
+      const bucket = entry.bucket ? `  b:${entry.bucket}` : ""
+      console.log(`${pad(entry.model, 60)}${entry.weight}${ceiling}${bucket}`)
+    }
+  }
+  if (fallback.length) {
+    console.log(`\nfallback section (used only when every primary slot is unavailable)`)
+    for (const entry of fallback) {
       const bucket = entry.bucket ? `  b:${entry.bucket}` : ""
       console.log(`${pad(entry.model, 60)}${entry.weight}${bucket}`)
     }
@@ -798,7 +825,9 @@ async function main() {
       // entry forward verbatim so the next run still sees it and selectPool can
       // keep its rankable models.
       const scannedNames = new Set(results.map((e) => e.provider))
-      const carried = (previousScores?.providers ?? []).filter((p) => !scannedNames.has(String(p?.provider ?? "")))
+      const carried = (previousScores?.providers ?? []).filter(
+        (p) => !scannedNames.has(String(p?.provider ?? "")) && !excludedProviders.has(String(p?.provider ?? "")),
+      )
       const previousByModel = new Map()
       for (const provider of previousScores?.providers ?? []) {
         for (const row of provider?.rows ?? []) {
@@ -811,6 +840,7 @@ async function main() {
         minContext,
         minScore,
         selection,
+        fallback,
         warnings,
         retry,
         providers: [
@@ -832,14 +862,21 @@ async function main() {
                 kind: r.kind ?? null,
                 score: r.score?.value ?? null,
                 retryAfter: r.retryAfter ?? null,
+                failStreak: 0,
               }
               // A transient failure must not erase the last measured ranking:
               // the next run needs it to keep a previously-good model while a
-              // gateway is down. Keep both rows; the selector prefers the
-              // rankable one and still schedules the failed one for retry.
+              // gateway is down. But a model that keeps failing scan after scan
+              // is not having a bad moment, and the selector must be able to see
+              // that: carry a consecutive-failure count forward on both rows so
+              // it can retire the slot after MAX_TRANSIENT_STREAK scans. A
+              // successful scan emits a fresh row with a zero streak.
               if (r.ok === false && isTransientFailure(r)) {
                 const prior = previousByModel.get(r.model)
-                if (prior?.ok === true && typeof prior.score === "number") return [current, prior]
+                const failStreak = Number(prior?.failStreak ?? 0) + 1
+                const failed = { ...current, failStreak }
+                if (prior?.ok === true && typeof prior.score === "number") return [failed, { ...prior, failStreak }]
+                return [failed]
               }
               return [current]
             }),