cartethyia 2.7.0 → 2.7.1

package/src/observability/runtime-metrics.ts

@@ -1,269 +1,269 @@
-/**
- * Periodic runtime gauges: process memory plus bounded-collection sizes.
- *
- * Sampling is driven by `ScheduledTaskRegistry` (unref'd interval) rather than
- * a dedicated timer so it shares the process's existing maintenance lifecycle
- * and stops with it. Map/collection sizes are read through closures supplied at
- * composition time; this module owns no references to the routing or pool
- * layers, keeping the observability boundary one-directional.
- */
-import { readFileSync } from "node:fs";
-import os from "node:os";
-import { metrics } from "./metrics";
-import { trackMemoryUsage } from "./performance-metrics";
-import { log } from "./logger";
-import { resolveMemoryLimitOverrideBytes } from "../config/timeouts";
-import { CONFIG_SPEC, readFlag } from "../config/spec";
-import type { TelemetryBacklogSnapshot } from "./telemetry-buffer";
-/**
- * The memory figures a shed decision needs.
- *
- * Published once per sample instead of re-measured per request:
- * `process.memoryUsage()` is not free, and the headroom guard runs on every
- * request. A snapshot up to one sample interval old is the right trade — the
- * guard is protecting against a spike that arrives over seconds, not one
- * request's worth of allocation.
- */
-export interface RuntimeMemorySnapshot {
-  readonly rssBytes: number;
-  /** The resolved limit; `undefined` when none could be discovered. */
-  readonly limitBytes: number | undefined;
-  readonly sampledAtMs: number;
-}
-
-/** Live collection sizes sampled alongside process memory. */
-export interface RuntimeMetricSources {
-  readonly routingRoundRobinEntries: () => { readonly combo: number; readonly provider: number };
-  /**
-   * Tracked keys in the in-memory IP abuse store, or 0 when the store is
-   * Redis-backed. Unlike the routing maps this one is fed by client-supplied
-   * identities, so its size is the leak signal to watch.
-   */
-  readonly ipAbuseKeys: () => number;
-  /**
-   * The telemetry backlog's current shape, or `undefined` when no buffer is
-   * wired (tests, and the console-only shell).
-   */
-  readonly telemetryBacklog?: () => TelemetryBacklogSnapshot | undefined;
-  /** Tracked keys in the in-process quota cache tier (0 when Redis-only paths are idle). */
-  readonly quotaCacheEntries: () => number;
-
-  /**
-   * Entries in the per-provider model-catalog cache. Bounded, but a count that
-   * sits at the cap means every rebuild is evicting something it needs.
-   */
-  readonly modelCatalogEntries: () => number;
-  /**
-   * Live in-flight request count. Zero means the gateway is idle, so a
-   * synchronous full collection is safe (no request to stall).
-   */
-  readonly inFlight: () => number;
-}
-
-/** Cooldown between memory-pressure warnings so a sustained high-water mark does not flood logs. */
-const PRESSURE_LOG_WINDOW_MS = 60_000;
-/** Cooldown between proactive garbage collections while pressure persists. */
-const PRESSURE_GC_WINDOW_MS = 60_000;
-/** Fraction of the resolved limit at which memory pressure is reported. */
-const PRESSURE_THRESHOLD = 0.8;
-/**
- * Fallback limit when neither an override nor a cgroup limit is discoverable
- * (native development, macOS, Windows).
- *
- * A fixed 512 MiB made every machine without a cgroup look like a 512 MiB
- * container. On a desktop running the gateway natively that is far below what
- * the machine has, so the pressure check fired against a number that described
- * nothing — "RSS 430 MiB exceeds 80% of the 512 MiB limit" on a machine with
- * gigabytes free — and the concurrency cap derived from it admitted a handful
- * of requests while every tenant-level setting sat unreachable above it.
- *
- * The host's real memory is the honest stand-in. It is what the process can
- * actually grow into here, and it is what "no container limit" means.
- */
-function defaultMemoryLimitBytes(): number {
-  try {
-    const total = os.totalmem();
-    if (Number.isFinite(total) && total > 0) return total;
-  } catch {
-    // Platform without totalmem; fall through to the last-resort constant.
-  }
-  return LAST_RESORT_MEMORY_LIMIT_BYTES;
-}
-
-/**
- * Used only when the host's memory cannot be read at all. Deliberately large
- * so an unmeasurable host is not treated as a small container.
- */
-const LAST_RESORT_MEMORY_LIMIT_BYTES = 4 * 1024 * 1024 * 1024;
-/** Cooldown between idle full collections. */
-const IDLE_GC_WINDOW_MS = 5 * 60_000;
-/** RSS retained above the post-collection baseline before another idle collection runs. */
-const IDLE_GC_MIN_GROWTH_BYTES = 32 * 1024 * 1024;
-
-/**
- * Resolves the effective memory limit for the process.
- *
- * Precedence: an explicit `CARTETHYIA_MEMORY_LIMIT_BYTES` override, then the
- * cgroup v2/v1 limit when running in a container. Falls back to
- * {@link DEFAULT_MEMORY_LIMIT_BYTES} when no limit is discoverable (native
- * development, macOS, Windows) so pressure-based reclaim still runs.
- */
-export function resolveMemoryLimitBytes(): number | undefined {
-  const override = resolveMemoryLimitOverrideBytes();
-  if (override !== undefined) return override;
-  if (process.platform !== "linux") return defaultMemoryLimitBytes();
-  for (const path of [
-    "/sys/fs/cgroup/memory.max",
-    "/sys/fs/cgroup/memory/memory.limit_in_bytes",
-  ]) {
-    try {
-      const content = readFileSync(path, "utf8").trim();
-      if (content === "max") continue;
-      const value = Number(content);
-      // The v1 unlimited sentinel is a huge finite number; treat it as unknown.
-      if (Number.isInteger(value) && value > 0 && value < 2 ** 53) return value;
-    } catch {
-      // File absent (cgroup v1 vs v2) or unreadable — try the next source.
-    }
-  }
-  return defaultMemoryLimitBytes();
-}
-
-/** Samples process memory and bounded-collection sizes into the metric registry. */
-export class RuntimeMetricsSampler {
-  private readonly limitBytes: number | undefined;
-  private readonly gcOnPressure: boolean;
-  private lastPressureLogAt = 0;
-  private lastGcAt = 0;
-  private lastIdleGcAt = 0;
-  private rssAtLastGc = 0;
-  private inFlightSource: () => number = () => 0;
-  /**
-   * The latest snapshot, published once per sample. Stays undefined until the
-   * first sample runs; consumers must treat that as "unknown", not as zero.
-   */
-  private snapshot: RuntimeMemorySnapshot | undefined;
-
-  /**
-   * Binds the live in-flight count after the request state store exists. The
-   * sampler is constructed before that store, so the source is late-bound.
-   */
-  bindInFlight(source: () => number): void {
-    this.inFlightSource = source;
-  }
-
-  /**
-   * The last sampled memory state, for consumers on a hot path.
-   *
-   * Undefined before the first sample: a guard that read zero as "plenty of
-   * room" would disable itself exactly when it matters, so callers must fall
-   * back to their own judgement when this is absent.
-   */
-  memorySnapshot(): RuntimeMemorySnapshot | undefined {
-    return this.snapshot;
-  }
-
-  /**
-   * Publishes the effective concurrency ceiling.
-   *
-   * Late-bound like `bindInFlight`: the ceiling is derived from the memory
-   * limit, which is known here, but the guard that owns it is constructed in
-   * the transport layer.
-   */
-
-  constructor(
-    private readonly sources: RuntimeMetricSources,
-    limitBytes: number | undefined = resolveMemoryLimitBytes(),
-    // Off by default: a forced collection is not how memory is meant to come
-    // back. The synchronous form (`Bun.gc(true)`) stops the shared event loop
-    // outright, so every concurrent request stalls inside it — which reads as
-    // a latency spike with no upstream cause. And it hides the actual defect:
-    // a process that only returns memory when something forces it to is a
-    // process that is still holding it. Bounded caches, released streams, and
-    // batched writers reclaim naturally; this is opt-in for an operator who
-    // has measured that they need it.
-    gcOnPressure = readFlag("CARTETHYIA_FORCED_GC", CONFIG_SPEC.CARTETHYIA_FORCED_GC),
-  ) {
-    this.limitBytes = limitBytes;
-    this.gcOnPressure = gcOnPressure;
-  }
-
-  sample(): void {
-    const memory = process.memoryUsage();
-    metrics.cartethyia_memory_rss_bytes.set(memory.rss);
-    metrics.cartethyia_memory_heap_used_bytes.set(memory.heapUsed);
-    metrics.cartethyia_memory_heap_total_bytes.set(memory.heapTotal);
-    metrics.cartethyia_memory_limit_bytes.set(this.limitBytes ?? 0);
-    this.snapshot = {
-      rssBytes: memory.rss,
-      limitBytes: this.limitBytes,
-      sampledAtMs: Date.now(),
-    };
-    trackMemoryUsage("rss", memory.rss);
-    trackMemoryUsage("heap_used", memory.heapUsed);
-    trackMemoryUsage("heap_total", memory.heapTotal);
-    trackMemoryUsage("external", memory.external);
-
-    const roundRobin = this.sources.routingRoundRobinEntries();
-    metrics.cartethyia_routing_roundrobin_entries.set(roundRobin.combo, { scope: "combo" });
-    metrics.cartethyia_routing_roundrobin_entries.set(roundRobin.provider, { scope: "provider" });
-    metrics.cartethyia_ip_abuse_keys.set(this.sources.ipAbuseKeys());
-    metrics.cartethyia_quota_cache_entries.set(this.sources.quotaCacheEntries());
-    metrics.cartethyia_model_catalog_entries.set(this.sources.modelCatalogEntries());
-    metrics.cartethyia_process_in_flight.set(this.inFlightSource());
-    const backlog = this.sources.telemetryBacklog?.();
-    if (backlog !== undefined) {
-      metrics.cartethyia_telemetry_backlog_items.set(backlog.items);
-      metrics.cartethyia_telemetry_backlog_bytes.set(backlog.bytes);
-    }
-
-    this.checkPressure(memory.rss);
-    this.checkIdleReclaim(memory.rss);
-  }
-
-  private checkPressure(rss: number): void {
-    if (this.limitBytes === undefined || rss <= this.limitBytes * PRESSURE_THRESHOLD) return;
-    const now = Date.now();
-    if (this.gcOnPressure && now - this.lastGcAt >= PRESSURE_GC_WINDOW_MS) {
-      this.lastGcAt = now;
-      // Asynchronous GC: reclaims before the limit is reached without stalling
-      // in-flight requests on the shared event loop. A synchronous full
-      // collection here would add a latency spike to every concurrent request.
-      Bun.gc(false);
-    }
-    if (now - this.lastPressureLogAt < PRESSURE_LOG_WINDOW_MS) return;
-    this.lastPressureLogAt = now;
-    log.warn(
-      `[memory] RSS ${(rss / 1024 / 1024).toFixed(1)}MiB exceeds 80% of the ` +
-        `${(this.limitBytes / 1024 / 1024).toFixed(1)}MiB limit`,
-    );
-  }
-
-  /**
-   * Reclaims memory while the gateway is idle.
-   *
-   * Triggered on RSS growth rather than heap growth: this process holds most of
-   * its footprint off-heap (adapters, TLS contexts, buffers), and `heapUsed`
-   * barely moves when those are allocated — a heap-based gate never opens, which
-   * is why an idle gateway held its startup peak indefinitely.
-   *
-   * A synchronous full collection is safe here because no request is in flight to
-   * stall, and it is the only form that actually returns pages to the OS; the
-   * async form used under pressure does not.
-   *
-   * Not gated on `gcOnPressure` the way `checkPressure` is. The opt-in exists
-   * because a synchronous collection stalls concurrent requests, and this path
-   * only runs when there is nothing in flight to stall — so the reason the flag
-   * is off does not apply to it. Gating it meant a gateway with no traffic at
-   * all never reclaimed anything and held its startup peak for hours.
-   */
-  private checkIdleReclaim(rss: number): void {
-    if (this.inFlightSource() > 0) return;
-    const now = Date.now();
-    if (now - this.lastIdleGcAt < IDLE_GC_WINDOW_MS) return;
-    if (this.rssAtLastGc !== 0 && rss - this.rssAtLastGc < IDLE_GC_MIN_GROWTH_BYTES) return;
-    this.lastIdleGcAt = now;
-    Bun.gc(true);
-    this.rssAtLastGc = process.memoryUsage().rss;
-  }
-}
+/**
+ * Periodic runtime gauges: process memory plus bounded-collection sizes.
+ *
+ * Sampling is driven by `ScheduledTaskRegistry` (unref'd interval) rather than
+ * a dedicated timer so it shares the process's existing maintenance lifecycle
+ * and stops with it. Map/collection sizes are read through closures supplied at
+ * composition time; this module owns no references to the routing or pool
+ * layers, keeping the observability boundary one-directional.
+ */
+import { readFileSync } from "node:fs";
+import os from "node:os";
+import { metrics } from "./metrics";
+import { trackMemoryUsage } from "./performance-metrics";
+import { log } from "./logger";
+import { resolveMemoryLimitOverrideBytes } from "../config/timeouts";
+import { CONFIG_SPEC, readFlag } from "../config/spec";
+import type { TelemetryBacklogSnapshot } from "./telemetry-buffer";
+/**
+ * The memory figures a shed decision needs.
+ *
+ * Published once per sample instead of re-measured per request:
+ * `process.memoryUsage()` is not free, and the headroom guard runs on every
+ * request. A snapshot up to one sample interval old is the right trade — the
+ * guard is protecting against a spike that arrives over seconds, not one
+ * request's worth of allocation.
+ */
+export interface RuntimeMemorySnapshot {
+  readonly rssBytes: number;
+  /** The resolved limit; `undefined` when none could be discovered. */
+  readonly limitBytes: number | undefined;
+  readonly sampledAtMs: number;
+}
+
+/** Live collection sizes sampled alongside process memory. */
+export interface RuntimeMetricSources {
+  readonly routingRoundRobinEntries: () => { readonly combo: number; readonly provider: number };
+  /**
+   * Tracked keys in the in-memory IP abuse store, or 0 when the store is
+   * Redis-backed. Unlike the routing maps this one is fed by client-supplied
+   * identities, so its size is the leak signal to watch.
+   */
+  readonly ipAbuseKeys: () => number;
+  /**
+   * The telemetry backlog's current shape, or `undefined` when no buffer is
+   * wired (tests, and the console-only shell).
+   */
+  readonly telemetryBacklog?: () => TelemetryBacklogSnapshot | undefined;
+  /** Tracked keys in the in-process quota cache tier (0 when Redis-only paths are idle). */
+  readonly quotaCacheEntries: () => number;
+
+  /**
+   * Entries in the per-provider model-catalog cache. Bounded, but a count that
+   * sits at the cap means every rebuild is evicting something it needs.
+   */
+  readonly modelCatalogEntries: () => number;
+  /**
+   * Live in-flight request count. Zero means the gateway is idle, so a
+   * synchronous full collection is safe (no request to stall).
+   */
+  readonly inFlight: () => number;
+}
+
+/** Cooldown between memory-pressure warnings so a sustained high-water mark does not flood logs. */
+const PRESSURE_LOG_WINDOW_MS = 60_000;
+/** Cooldown between proactive garbage collections while pressure persists. */
+const PRESSURE_GC_WINDOW_MS = 60_000;
+/** Fraction of the resolved limit at which memory pressure is reported. */
+const PRESSURE_THRESHOLD = 0.8;
+/**
+ * Fallback limit when neither an override nor a cgroup limit is discoverable
+ * (native development, macOS, Windows).
+ *
+ * A fixed 512 MiB made every machine without a cgroup look like a 512 MiB
+ * container. On a desktop running the gateway natively that is far below what
+ * the machine has, so the pressure check fired against a number that described
+ * nothing — "RSS 430 MiB exceeds 80% of the 512 MiB limit" on a machine with
+ * gigabytes free — and the concurrency cap derived from it admitted a handful
+ * of requests while every tenant-level setting sat unreachable above it.
+ *
+ * The host's real memory is the honest stand-in. It is what the process can
+ * actually grow into here, and it is what "no container limit" means.
+ */
+function defaultMemoryLimitBytes(): number {
+  try {
+    const total = os.totalmem();
+    if (Number.isFinite(total) && total > 0) return total;
+  } catch {
+    // Platform without totalmem; fall through to the last-resort constant.
+  }
+  return LAST_RESORT_MEMORY_LIMIT_BYTES;
+}
+
+/**
+ * Used only when the host's memory cannot be read at all. Deliberately large
+ * so an unmeasurable host is not treated as a small container.
+ */
+const LAST_RESORT_MEMORY_LIMIT_BYTES = 4 * 1024 * 1024 * 1024;
+/** Cooldown between idle full collections. */
+const IDLE_GC_WINDOW_MS = 5 * 60_000;
+/** RSS retained above the post-collection baseline before another idle collection runs. */
+const IDLE_GC_MIN_GROWTH_BYTES = 32 * 1024 * 1024;
+
+/**
+ * Resolves the effective memory limit for the process.
+ *
+ * Precedence: an explicit `CARTETHYIA_MEMORY_LIMIT_BYTES` override, then the
+ * cgroup v2/v1 limit when running in a container. Falls back to
+ * {@link DEFAULT_MEMORY_LIMIT_BYTES} when no limit is discoverable (native
+ * development, macOS, Windows) so pressure-based reclaim still runs.
+ */
+export function resolveMemoryLimitBytes(): number | undefined {
+  const override = resolveMemoryLimitOverrideBytes();
+  if (override !== undefined) return override;
+  if (process.platform !== "linux") return defaultMemoryLimitBytes();
+  for (const path of [
+    "/sys/fs/cgroup/memory.max",
+    "/sys/fs/cgroup/memory/memory.limit_in_bytes",
+  ]) {
+    try {
+      const content = readFileSync(path, "utf8").trim();
+      if (content === "max") continue;
+      const value = Number(content);
+      // The v1 unlimited sentinel is a huge finite number; treat it as unknown.
+      if (Number.isInteger(value) && value > 0 && value < 2 ** 53) return value;
+    } catch {
+      // File absent (cgroup v1 vs v2) or unreadable — try the next source.
+    }
+  }
+  return defaultMemoryLimitBytes();
+}
+
+/** Samples process memory and bounded-collection sizes into the metric registry. */
+export class RuntimeMetricsSampler {
+  private readonly limitBytes: number | undefined;
+  private readonly gcOnPressure: boolean;
+  private lastPressureLogAt = 0;
+  private lastGcAt = 0;
+  private lastIdleGcAt = 0;
+  private rssAtLastGc = 0;
+  private inFlightSource: () => number = () => 0;
+  /**
+   * The latest snapshot, published once per sample. Stays undefined until the
+   * first sample runs; consumers must treat that as "unknown", not as zero.
+   */
+  private snapshot: RuntimeMemorySnapshot | undefined;
+
+  /**
+   * Binds the live in-flight count after the request state store exists. The
+   * sampler is constructed before that store, so the source is late-bound.
+   */
+  bindInFlight(source: () => number): void {
+    this.inFlightSource = source;
+  }
+
+  /**
+   * The last sampled memory state, for consumers on a hot path.
+   *
+   * Undefined before the first sample: a guard that read zero as "plenty of
+   * room" would disable itself exactly when it matters, so callers must fall
+   * back to their own judgement when this is absent.
+   */
+  memorySnapshot(): RuntimeMemorySnapshot | undefined {
+    return this.snapshot;
+  }
+
+  /**
+   * Publishes the effective concurrency ceiling.
+   *
+   * Late-bound like `bindInFlight`: the ceiling is derived from the memory
+   * limit, which is known here, but the guard that owns it is constructed in
+   * the transport layer.
+   */
+
+  constructor(
+    private readonly sources: RuntimeMetricSources,
+    limitBytes: number | undefined = resolveMemoryLimitBytes(),
+    // Off by default: a forced collection is not how memory is meant to come
+    // back. The synchronous form (`Bun.gc(true)`) stops the shared event loop
+    // outright, so every concurrent request stalls inside it — which reads as
+    // a latency spike with no upstream cause. And it hides the actual defect:
+    // a process that only returns memory when something forces it to is a
+    // process that is still holding it. Bounded caches, released streams, and
+    // batched writers reclaim naturally; this is opt-in for an operator who
+    // has measured that they need it.
+    gcOnPressure = readFlag("CARTETHYIA_FORCED_GC", CONFIG_SPEC.CARTETHYIA_FORCED_GC),
+  ) {
+    this.limitBytes = limitBytes;
+    this.gcOnPressure = gcOnPressure;
+  }
+
+  sample(): void {
+    const memory = process.memoryUsage();
+    metrics.cartethyia_memory_rss_bytes.set(memory.rss);
+    metrics.cartethyia_memory_heap_used_bytes.set(memory.heapUsed);
+    metrics.cartethyia_memory_heap_total_bytes.set(memory.heapTotal);
+    metrics.cartethyia_memory_limit_bytes.set(this.limitBytes ?? 0);
+    this.snapshot = {
+      rssBytes: memory.rss,
+      limitBytes: this.limitBytes,
+      sampledAtMs: Date.now(),
+    };
+    trackMemoryUsage("rss", memory.rss);
+    trackMemoryUsage("heap_used", memory.heapUsed);
+    trackMemoryUsage("heap_total", memory.heapTotal);
+    trackMemoryUsage("external", memory.external);
+
+    const roundRobin = this.sources.routingRoundRobinEntries();
+    metrics.cartethyia_routing_roundrobin_entries.set(roundRobin.combo, { scope: "combo" });
+    metrics.cartethyia_routing_roundrobin_entries.set(roundRobin.provider, { scope: "provider" });
+    metrics.cartethyia_ip_abuse_keys.set(this.sources.ipAbuseKeys());
+    metrics.cartethyia_quota_cache_entries.set(this.sources.quotaCacheEntries());
+    metrics.cartethyia_model_catalog_entries.set(this.sources.modelCatalogEntries());
+    metrics.cartethyia_process_in_flight.set(this.inFlightSource());
+    const backlog = this.sources.telemetryBacklog?.();
+    if (backlog !== undefined) {
+      metrics.cartethyia_telemetry_backlog_items.set(backlog.items);
+      metrics.cartethyia_telemetry_backlog_bytes.set(backlog.bytes);
+    }
+
+    this.checkPressure(memory.rss);
+    this.checkIdleReclaim(memory.rss);
+  }
+
+  private checkPressure(rss: number): void {
+    if (this.limitBytes === undefined || rss <= this.limitBytes * PRESSURE_THRESHOLD) return;
+    const now = Date.now();
+    if (this.gcOnPressure && now - this.lastGcAt >= PRESSURE_GC_WINDOW_MS) {
+      this.lastGcAt = now;
+      // Asynchronous GC: reclaims before the limit is reached without stalling
+      // in-flight requests on the shared event loop. A synchronous full
+      // collection here would add a latency spike to every concurrent request.
+      Bun.gc(false);
+    }
+    if (now - this.lastPressureLogAt < PRESSURE_LOG_WINDOW_MS) return;
+    this.lastPressureLogAt = now;
+    log.warn(
+      `[memory] RSS ${(rss / 1024 / 1024).toFixed(1)}MiB exceeds 80% of the ` +
+        `${(this.limitBytes / 1024 / 1024).toFixed(1)}MiB limit`,
+    );
+  }
+
+  /**
+   * Reclaims memory while the gateway is idle.
+   *
+   * Triggered on RSS growth rather than heap growth: this process holds most of
+   * its footprint off-heap (adapters, TLS contexts, buffers), and `heapUsed`
+   * barely moves when those are allocated — a heap-based gate never opens, which
+   * is why an idle gateway held its startup peak indefinitely.
+   *
+   * A synchronous full collection is safe here because no request is in flight to
+   * stall, and it is the only form that actually returns pages to the OS; the
+   * async form used under pressure does not.
+   *
+   * Not gated on `gcOnPressure` the way `checkPressure` is. The opt-in exists
+   * because a synchronous collection stalls concurrent requests, and this path
+   * only runs when there is nothing in flight to stall — so the reason the flag
+   * is off does not apply to it. Gating it meant a gateway with no traffic at
+   * all never reclaimed anything and held its startup peak for hours.
+   */
+  private checkIdleReclaim(rss: number): void {
+    if (this.inFlightSource() > 0) return;
+    const now = Date.now();
+    if (now - this.lastIdleGcAt < IDLE_GC_WINDOW_MS) return;
+    if (this.rssAtLastGc !== 0 && rss - this.rssAtLastGc < IDLE_GC_MIN_GROWTH_BYTES) return;
+    this.lastIdleGcAt = now;
+    Bun.gc(true);
+    this.rssAtLastGc = process.memoryUsage().rss;
+  }
+}

package/src/persistence/health-event-flush.ts

@@ -15,6 +15,7 @@
 // Same shape as `persistence/usage-flush.ts`: enqueue and return, a timer
 // flushes, shutdown flushes what remains. A crash loses the unflushed rows and
 // nothing else — the durable state routing depends on was never in here.
+import { randomUUID } from "node:crypto";
 import type { CartethyiaDatabase } from "./db-handle";
 import { healthEvents } from "./schema";
 
@@ -141,6 +142,7 @@ export class HealthEventFlushBuffer {
     try {
       await this.db.insert(healthEvents).values(
         batch.map((row) => ({
+          id: randomUUID(),
           entityKind: row.entityKind,
           accountId: row.accountId ?? null,
           networkPoolId: row.networkPoolId ?? null,

package/src/persistence/schema.ts

@@ -490,6 +490,24 @@ export const networkPools = pgTable("network_pools", {
   /** The endpoint the verdict was measured against. Compared on read, so an
    * edited endpoint reports "never probed" instead of a stale verdict. */
   providerProbeEndpoint: text("provider_probe_endpoint"),
+  /**
+   * The database mirror of the pool selector's provider cooldown state, one
+   * entry per cooling provider keyed by its lowercased id:
+   * `{ "opencode": { "until": <epoch ms>, "reason": "...", "blocked": false } }`.
+   *
+   * The selector's own map is process-local (mirrored to Redis when present),
+   * so a restart dropped every flag while the upstream kept refusing the
+   * egress — dispatch re-picked a spent pool and the console showed nothing.
+   * The dispatch-side flaggers write each marker here, and boot reads this
+   * column back into the selector, so the state survives a restart the way the
+   * upstream's memory of the address does.
+   *
+   * `null` means no provider was ever flagged. Expired entries are left inert
+   * until the next write for the pool rather than swept eagerly: a marker with
+   * `until` in the past is skipped by every reader.
+   */
+  providerCooldowns: jsonb("provider_cooldowns")
+    .$type<Record<string, { until: number; reason: string; blocked?: boolean }>>(),
   /** Metered egress totals, flushed from the in-memory socket counters on
    * every pool-touching write so the quota bar survives a restart. */
   bytesSentTotal: bigint("bytes_sent_total", { mode: "number" }).notNull().default(0),
@@ -676,6 +694,7 @@ export const providerRoutingSettings = pgTable(
 export const poolRoutingStrategy = pgEnum("pool_routing_strategy", [
   "least_loaded",
   "round_robin",
+  "random",
 ]);
 export type PoolRoutingStrategy = (typeof poolRoutingStrategy.enumValues)[number];
 

package/src/persistence/usage-flush.ts

@@ -145,13 +145,18 @@ export class UsageFlushBuffer {
    * cost the others their delta. A key whose write fails goes back into the
    * pending map, added to anything enqueued while the flush ran, so a
    * transient failure retries instead of dropping.
+   *
+   * `force` bypasses the outage backoff. The scheduled timer never passes it —
+   * a failing database should not be probed on every tick — but `stop({flush:
+   * true})` must, or a shutdown during a backoff window would return without
+   * even attempting to persist the pending deltas.
    */
-  async flush(): Promise<void> {
+  async flush(options?: { force?: boolean }): Promise<void> {
     if (this.flushing || this.pending.size === 0) return;
     // Backing off during a sustained outage: without this the writer probed a
     // failing database on every tick, adding write load to the very overload
     // that caused the failure.
-    if (Date.now() < this.backoffUntil) return;
+    if (Date.now() < this.backoffUntil && options?.force !== true) return;
     this.flushing = true;
     const batch = new Map(this.pending);
     this.pending.clear();
@@ -210,7 +215,7 @@ export class UsageFlushBuffer {
       clearTimeout(this.timer);
       this.timer = undefined;
     }
-    if (options?.flush) await this.flush();
+    if (options?.flush) await this.flush({ force: true });
   }
 
   private arm(): void {

package/src/protocol/canonical-model.ts

@@ -52,7 +52,7 @@ export type ServiceKind = (typeof SERVICE_KINDS)[number];
  * their membership set from it, and the probe route's accepted subset is
  * declared separately because it is deliberately narrower.
  */
-export const REASONING_EFFORTS = ["none", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
+export const REASONING_EFFORTS = ["none", "instant", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
 /** One canonical reasoning effort. */
 export type ReasoningEffort = (typeof REASONING_EFFORTS)[number];