cartethyia 2.7.8 → 2.8.0

package/src/console/quota/quota-view.ts

@@ -13,7 +13,14 @@ import {
 /** Shape returned for quota data on dashboard account responses. */
 interface QuotaRefreshView {
   readonly source: string;
-  readonly status: "ready" | "error" | "refreshing";
+  /**
+   * `ready` = a usable quota reading exists (successful fetch, cached or
+   * snapshot). `error` = the collector returned an error with no usable
+   * reading. `refreshing` = a background fill is in flight. `unknown` = no
+   * quota evidence at all (no collector surface, or an empty successful read
+   * with no timestamp) — the canonical wire representation for unknown quota.
+   */
+  readonly status: "ready" | "error" | "refreshing" | "unknown";
   readonly plan: string | null;
   readonly windows: ProviderQuotaResult["windows"];
   readonly fetchedAt: string | null;
@@ -94,7 +101,7 @@ export function toQuotaView(
     lastAttemptAt?: string | null;
     lastSuccessAt?: string | null;
     refreshError?: string | null;
-    status?: "ready" | "error" | "refreshing";
+    status?: "ready" | "error" | "refreshing" | "unknown";
   } = {},
 ): QuotaRefreshView {
   const fetchedAt = timestamps.fetchedAt ?? account.lastSuccessAt?.toISOString() ?? null;
@@ -112,9 +119,18 @@ export function toQuotaView(
   // that the last attempt failed; only `quota.error` — no usable reading at
   // all — makes the card an error.
   const error = quota.error ?? null;
+  // Unknown quota: a successful read that carries no windows AND no timestamp
+  // is not evidence of anything — the canonical "no quota evidence" state.
+  // (A provider with a real zero-balance still reports windows/timestamps.)
+  const derivedStatus =
+    error !== null
+      ? ("error" as const)
+      : quota.windows.length === 0 && fetchedAt === null
+        ? ("unknown" as const)
+        : ("ready" as const);
   return {
     source: quota.source,
-    status: timestamps.status ?? (error !== null ? "error" : "ready"),
+    status: timestamps.status ?? derivedStatus,
     plan: quota.plan ?? null,
     windows: quota.windows,
     fetchedAt,

package/src/console/routing/pools/operations.ts

@@ -45,35 +45,40 @@ function isBlockedEntry(entry: { readonly blocked?: boolean }): boolean {
 }
 
 export function createNetworkPoolOperations(config: NetworkPoolConfig) {
+  /**
+   * The read-only enrichment projection shared by the pool list and the pool
+   * detail page: live inflight (falling back to the stored row counter when no
+   * selector is configured), the derived available/utilization figures, and the
+   * active provider cooldowns (omitted entirely when there are none).
+   */
+  async function enrichPoolResponse(res: NetworkPoolResponse, poolId: string): Promise<NetworkPoolResponse> {
+    const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
+    const inflight = config.poolSelector
+      ? await config.poolSelector.getInflightAuthoritative(poolId)
+      : res.inflight;
+    return {
+      ...res,
+      inflight,
+      available: Math.max(0, res.maxInflight - inflight),
+      utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
+      ...(cooldowns && cooldowns.length > 0
+        ? {
+            providerCooldowns: cooldowns.map((c) => ({
+              providerId: c.providerId,
+              until: new Date(c.until).toISOString(),
+              reason: c.reason,
+              blocked: isBlockedEntry(c),
+            })),
+          }
+        : {}),
+    };
+  }
+
   const operations = {
     async listPools(access: AccessDecision | undefined): Promise<NetworkPoolResponse[]> {
         const a = requireTenantScope(access, "dashboard:read");
         const rawPools = await config.store.list(a.tenantId);
-        return Promise.all(
-          rawPools.map(async (r) => {
-            const res = sanitizePoolResponse(r);
-            const cooldowns = await config.poolSelector?.getPoolCooldowns(r.id);
-            const inflight = config.poolSelector
-              ? await config.poolSelector.getInflightAuthoritative(r.id)
-              : res.inflight;
-            return {
-              ...res,
-              inflight,
-              available: Math.max(0, res.maxInflight - inflight),
-              utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-              ...(cooldowns && cooldowns.length > 0
-                ? {
-                    providerCooldowns: cooldowns.map((c) => ({
-                      providerId: c.providerId,
-                      until: new Date(c.until).toISOString(),
-                      reason: c.reason,
-                      blocked: isBlockedEntry(c),
-                    })),
-                  }
-                : {}),
-            };
-          }),
-        );
+        return Promise.all(rawPools.map(async (r) => enrichPoolResponse(sanitizePoolResponse(r), r.id)));
       },
     async getPoolDetail(
         access: AccessDecision | undefined,
@@ -82,27 +87,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         const a = requireTenantScope(access, "dashboard:read");
         const rec = await config.store.get(a.tenantId, poolId);
         if (!rec) throw new ConsoleDomainError("pool_not_found", 404, `Pool ${poolId} not found`);
-        const res = sanitizePoolResponse(rec);
-        const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
-        const inflight = config.poolSelector
-          ? await config.poolSelector.getInflightAuthoritative(poolId)
-          : res.inflight;
-        return {
-          ...res,
-          inflight,
-          available: Math.max(0, res.maxInflight - inflight),
-          utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-          ...(cooldowns && cooldowns.length > 0
-            ? {
-                providerCooldowns: cooldowns.map((c) => ({
-                  providerId: c.providerId,
-                  until: new Date(c.until).toISOString(),
-                  reason: c.reason,
-                  blocked: isBlockedEntry(c),
-                })),
-              }
-            : {}),
-        };
+        return enrichPoolResponse(sanitizePoolResponse(rec), poolId);
       },
     async clearPoolCooldown(
         access: AccessDecision | undefined,

package/src/console/settings/contracts.ts

@@ -59,6 +59,15 @@ export interface RuntimeSettingsResponse {
    * used instead.
    */
   readonly visionHandoffModels: readonly string[];
+  /**
+   * Auto-disable provider accounts stuck on upstream rate-limit/quota verdicts.
+   * Default false — the risky direction stays off until an operator flips it.
+   */
+  readonly autoDisableRateLimited: boolean;
+  /** Modelprobe mode; `detail` when unset. */
+  readonly modelProbeMode: ModelProbeMode;
+  /** Fast-probe timeout in seconds; null means the built-in default (10). */
+  readonly modelProbeFastTimeoutSeconds: number | null;
   readonly updatedAt: string;
   /*
    * What each `null` actually resolves to, in the same units the row stores.
@@ -136,6 +145,10 @@ export type PonyTailLevel = (typeof PONYTAIL_LEVELS)[number];
 /** RTK prune strength accepted by the runtime-settings PATCH. */
 export type RtkLevel = (typeof RTK_LEVELS)[number];
 
+export const MODEL_PROBE_MODES = ["fast", "detail"] as const;
+/** Modelprobe mode accepted by the runtime-settings PATCH and the probe route. */
+export type ModelProbeMode = (typeof MODEL_PROBE_MODES)[number];
+
 /** Upper bound on the number of ordered vision-handoff models. */
 export const VISION_HANDOFF_MAX_MODELS = 8;
 
@@ -272,4 +285,9 @@ export const runtimeUpdateBody = t.Object({
     t.Union([t.Null(), t.Number({ minimum: 64 * 1024, maximum: 100 * 1024 * 1024 })]),
   ),
   visionHandoffModels: t.Optional(t.Array(t.String())),
+  autoDisableRateLimited: t.Optional(t.Boolean()),
+  modelProbeMode: t.Optional(literalUnion(MODEL_PROBE_MODES)),
+  modelProbeFastTimeoutSeconds: t.Optional(
+    t.Union([t.Null(), t.Number({ minimum: 1, maximum: 120 })]),
+  ),
 });

package/src/console/settings/store.ts

@@ -10,6 +10,7 @@ import { resolveUpstreamTimeoutMs } from "../../config/timeouts";
 import { payloadRetentionMs } from "../../observability/payload-capture";
 import { IMAGE_CLAMP_MAX_BYTES } from "../../protocol/image-clamp";
 import {
+  MODEL_PROBE_MODES,
   PONYTAIL_LEVELS,
   RESPONSES_REASONING_SUMMARIES,
   RTK_LEVELS,
@@ -23,6 +24,7 @@ import {
   type RuntimeSettingsStore,
   type TelemetryPayloadDepth,
   type TelemetryPayloadMode,
+  type ModelProbeMode,
   type UpdateRuntimeSettingsRequest,
 } from "./contracts";
 
@@ -116,6 +118,23 @@ function normalizeConcurrencyTolerance(value: unknown): number | null {
   return normalizeBoundedNumber(value, 0, 1024);
 }
 
+/** Modelprobe mode: only the two known modes survive; anything else = `detail`. */
+function normalizeModelProbeMode(value: unknown): ModelProbeMode {
+  return typeof value === "string" && (MODEL_PROBE_MODES as readonly string[]).includes(value)
+    ? (value as ModelProbeMode)
+    : "detail";
+}
+
+/**
+ * Fast-probe timeout in seconds: 1–120, `null` = deployment default, and any
+ * other absent/non-finite value reads as the built-in default of 10 (the UI
+ * select's middle choice, and the value probing uses when unset).
+ */
+function normalizeModelProbeFastTimeoutSeconds(value: unknown): number | null {
+  if (value === null) return null;
+  return normalizeBoundedNumber(value, 1, 120) ?? 10;
+}
+
 /** Ordered vision-handoff models: non-empty strings, trimmed, de-duplicated. */
 function normalizeVisionHandoffModels(value: unknown): readonly string[] {
   if (!Array.isArray(value)) return [];
@@ -166,6 +185,11 @@ function mapRuntimeSettingsRow(
     telemetryWindowMinutes: normalizeTelemetryWindowMinutes(prefs.telemetryWindowMinutes),
     imageClampMaxBytes: normalizeImageClampMaxBytes(prefs.imageClampMaxBytes),
     visionHandoffModels: normalizeVisionHandoffModels(prefs.visionHandoffModels),
+    autoDisableRateLimited: prefs.autoDisableRateLimited === true,
+    modelProbeMode: normalizeModelProbeMode(prefs.modelProbeMode),
+    modelProbeFastTimeoutSeconds: normalizeModelProbeFastTimeoutSeconds(
+      prefs.modelProbeFastTimeoutSeconds,
+    ),
     updatedAt,
     /*
      * Resolved at request time, not at module load: all four come from env the
@@ -231,6 +255,14 @@ export class DrizzleRuntimeSettingsStore implements RuntimeSettingsStore {
       patchPrefs.imageClampMaxBytes = normalizeImageClampMaxBytes(patch.imageClampMaxBytes);
     if (patch.visionHandoffModels !== undefined)
       patchPrefs.visionHandoffModels = normalizeVisionHandoffModels(patch.visionHandoffModels);
+    if (patch.autoDisableRateLimited !== undefined)
+      patchPrefs.autoDisableRateLimited = patch.autoDisableRateLimited === true;
+    if (patch.modelProbeMode !== undefined)
+      patchPrefs.modelProbeMode = normalizeModelProbeMode(patch.modelProbeMode);
+    if (patch.modelProbeFastTimeoutSeconds !== undefined)
+      patchPrefs.modelProbeFastTimeoutSeconds = normalizeModelProbeFastTimeoutSeconds(
+        patch.modelProbeFastTimeoutSeconds,
+      );
 
     const rows = await this.db
       .insert(consoleSettings)

package/src/console/shared/errors.ts

@@ -1,7 +1,7 @@
 import { ValidationError } from "elysia";
 import type { AccessDecision, AccessScope } from "../../security/access-control";
 import { isRecord } from "../../protocol/codecs";
-import { formatPublicErrorMessage } from "../../protocol/gateway-error";
+import { formatPublicErrorMessage, GatewayError } from "../../protocol/gateway-error";
 
 // Single console error/access contract. Every domain throws ConsoleDomainError
 // (or the storage-layer BackupError, same code/status/message shape) and
@@ -24,8 +24,27 @@ export class ConsoleDomainError extends Error {
   }
 }
 
-function asDomainError(error: unknown): { code: string; status: number; message: string; details?: unknown } | undefined {
+interface ShapedDomainError {
+  readonly code: string;
+  readonly status: number;
+  readonly message: string;
+  readonly details?: unknown;
+  /** Upstream/network origin, preserved so the dashboard can tell a provider
+   * rejection from a console-session expiry (see `maybeSignalSessionTransition`). */
+  readonly origin?: string;
+}
+
+function asDomainError(error: unknown): ShapedDomainError | undefined {
   if (error instanceof ConsoleDomainError) return error;
+  if (error instanceof GatewayError) {
+    return {
+      code: error.code,
+      status: error.status,
+      message: error.message,
+      details: error.details,
+      ...(error.origin === "cartethyia" ? {} : { origin: error.origin }),
+    };
+  }
   if (
     typeof error === "object" &&
     error !== null &&
@@ -33,8 +52,14 @@ function asDomainError(error: unknown): { code: string; status: number; message:
     typeof (error as { status?: unknown }).status === "number" &&
     typeof (error as { message?: unknown }).message === "string"
   ) {
-    const shaped = error as { code: string; status: number; message: string; details?: unknown };
-    return { code: shaped.code, status: shaped.status, message: shaped.message, details: shaped.details };
+    const shaped = error as { code: string; status: number; message: string; details?: unknown; origin?: unknown };
+    return {
+      code: shaped.code,
+      status: shaped.status,
+      message: shaped.message,
+      details: shaped.details,
+      ...(typeof shaped.origin === "string" && shaped.origin !== "cartethyia" ? { origin: shaped.origin } : {}),
+    };
   }
   return undefined;
 }
@@ -47,6 +72,7 @@ export function errorResponse(
 ): {
   error: string;
   code: string;
+  origin?: string;
   details?: Record<string, unknown>;
 } {
   const shaped = asDomainError(error);
@@ -63,16 +89,17 @@ export function errorResponse(
     const body: Record<string, unknown> = {
       error: message,
       code: shaped.code,
+      ...(shaped.origin === undefined ? {} : { origin: shaped.origin }),
     };
     if (includeDetails) body.details = details;
-    return body as { error: string; code: string; details?: Record<string, unknown> };
+    return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
   }
   set.status = 500;
   const body: Record<string, unknown> = {
     error: formatPublicErrorMessage("internal_error", fallbackMessage),
     code: "internal_error",
   };
-  return body as { error: string; code: string; details?: Record<string, unknown> };
+  return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
 }
 
 export function requireScope(

package/src/console/system-prompt/contracts.ts

@@ -115,7 +115,6 @@ export const SYSTEM_PROMPT_ALIAS_LIMIT = 512;
 const WRAPPED_INJECTION_PROVIDERS: ReadonlySet<string> = new Set([
   "cb", // CodeBuddy International
   "cbcn", // CodeBuddy CN
-  "workbuddy",
 ]);
 
 /** Whether a provider's tenant text rides wrapped after the fixed identity prompt. */

package/src/main.ts

@@ -3,6 +3,7 @@
 import "./boot/elysia-typebox-bridge";
 import { createGatewayApp, createGatewayShell } from "./boot/app";
 import { bootstrap } from "./boot/lifecycle";
+import { flushAllBuffers } from "./boot/flush";
 import type { CartethyiaBoot } from "./boot/lifecycle";
 import {
   resolveDrainToken,
@@ -84,14 +85,13 @@ const app = boot
         oauthRefreshService: boot.deps.oauthRefreshService,
         admissionService: boot.deps.admissionService,
         readRoutingAccountInflight: boot.deps.readRoutingAccountInflight,
+        ipAbuseStore: boot.deps.ipAbuseStore,
         // The same three writers the shutdown coordinator drains, so a manual
         // flush from the console does exactly what a graceful stop would do
         // for the queues, minus the stop.
         flushBuffers: {
           flush: async () => {
-            await boot.deps.telemetryBuffer.flush();
-            await boot.deps.usageFlush.flush();
-            await boot.deps.healthEventFlush.flush();
+            await flushAllBuffers(boot.deps);
           },
         },
       },

package/src/network/pool/byte-accounting.ts

@@ -13,6 +13,8 @@
  * byte, and nothing is allocated.
  */
 
+import { evictOldestEntry } from "../../transport/routing/bounded-lru";
+
 /** Running totals for one pool. */
 interface PoolByteTotals {
   /** Bytes sent to the proxy (uploads, TLS handshake, CONNECT). */
@@ -33,8 +35,7 @@ function entry(poolId: string): { sent: number; received: number } {
   let current = totals.get(poolId);
   if (!current) {
     if (totals.size >= MAX_BYTE_ENTRY_COUNT) {
-      const oldest = totals.keys().next().value;
-      if (oldest !== undefined) totals.delete(oldest);
+      evictOldestEntry(totals, MAX_BYTE_ENTRY_COUNT - 1);
     }
     current = { sent: 0, received: 0 };
     totals.set(poolId, current);

package/src/network/pool/selector.ts

@@ -108,6 +108,13 @@ type PoolSelectionFailureReason =
   | "coordination_unavailable"
   | "no_active_pool";
 
+interface PoolCooldownState {
+  readonly inCooldown: boolean;
+  readonly resetsAt: Date | null;
+  readonly reason: string | null;
+  readonly blocked: boolean;
+}
+
 interface PoolCapacitySnapshot {
   readonly poolId: string;
   readonly maxInflight: number;
@@ -399,12 +406,7 @@ export class NetworkPoolSelector {
   async isProviderCooldown(
     poolId: string,
     providerId: string,
-  ): Promise<{
-    inCooldown: boolean;
-    resetsAt: Date | null;
-    reason: string | null;
-    blocked: boolean;
-  }> {
+  ): Promise<PoolCooldownState> {
     const k = this.cooldownKey(poolId, providerId);
     const local = this.state.cooldowns.get(k);
     if (local) {
@@ -880,6 +882,171 @@ export class NetworkPoolSelector {
     }
     return undefined;
   }
+
+  /**
+   * Infight counter from a Redis `MGET` row. `null` (unset counter) is zero;
+   * a malformed counter is the same hard error the per-key read raises, so a
+   * corrupt key is never silently treated as 0.
+   */
+  private parseInflightCounter(raw: string | null, what: string): number {
+    if (raw === null) return 0;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 0) {
+      throw new Error(`invalid pool inflight counter: ${what}`);
+    }
+    return value;
+  }
+
+  /**
+   * Per-pool cooldown resolution with the same semantics as
+   * `isProviderCooldown`: the local cooldown map wins when it has a live
+   * entry; otherwise a non-expired Redis row is admitted (bounded) and an
+   * expired Redis row is cleared. Used by the batched failure path, which
+   * reads all cooldown keys in one `MGET` and resolves each row here.
+   */
+  private cooldownFromBatchState(
+    poolId: string,
+    providerId: string,
+    raw: string | null,
+  ): PoolCooldownState {
+    const k = this.cooldownKey(poolId, providerId);
+    const local = this.state.cooldowns.get(k);
+    if (local) {
+      if (Date.now() < local.until) {
+        return {
+          inCooldown: true,
+          resetsAt: new Date(local.until),
+          reason: local.reason,
+          blocked: local.blocked === true,
+        };
+      }
+      this.state.cooldowns.delete(k);
+    }
+    const parsed = raw ? parseCooldownEntry(raw) : undefined;
+    if (parsed && Date.now() < parsed.until) {
+      enforceCooldownLimit(this.state.cooldowns);
+      this.state.cooldowns.set(k, parsed);
+      return {
+        inCooldown: true,
+        resetsAt: new Date(parsed.until),
+        reason: parsed.reason,
+        blocked: parsed.blocked === true,
+      };
+    }
+    if (raw) {
+      void this.clearRedisCooldown(poolId, providerId);
+    }
+    return { inCooldown: false, resetsAt: null, reason: null, blocked: false };
+  }
+
+  /**
+   * The original per-pool failure check: one Redis read per pool for each of
+   * cooldown, pool inflight, and provider inflight. Retained as the fallback
+   * for the non-Redis path and for a Redis outage during the batched read.
+   */
+  private async perPoolSelectionChecks(
+    eligiblePoolIds: readonly string[],
+    providerId: string,
+    limitsByPool?: Record<string, number>,
+    weightsByPool?: Record<string, number>,
+    providerCapacity?: number,
+  ): Promise<Array<{ cooldown: PoolCooldownState; pool: PoolCapacitySnapshot }>> {
+    return Promise.all(
+      eligiblePoolIds.map(async (poolId) => {
+        const cooldown = await this.isProviderCooldown(poolId, providerId);
+        const maxInflight = effectiveConcurrency(
+          limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
+        );
+        const weight = normalizedWeight(weightsByPool?.[poolId]);
+        const currentInflight = await this.getInflightAuthoritative(poolId);
+        const providerInflight =
+          providerCapacity === undefined
+            ? undefined
+            : await this.getProviderInflightAuthoritative(poolId, providerId);
+        return {
+          cooldown,
+          pool: {
+            poolId,
+            maxInflight,
+            currentInflight,
+            available: Math.max(0, maxInflight - currentInflight),
+            weight,
+            ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
+            ...(cooldown.blocked ? { blocked: true } : {}),
+            ...(providerCapacity === undefined
+              ? {}
+              : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
+          } satisfies PoolCapacitySnapshot,
+        };
+      }),
+    );
+  }
+
+  /**
+   * Batched failure check: one `MGET` per key family (cooldowns, pool
+   * inflight, provider inflight) instead of three serial GETs per pool. On a
+   * Redis error the whole read falls back to per-pool reads so the failure
+   * report keeps the "cooldown store unavailable" per-pool detail.
+   */
+  private async batchSelectionChecks(
+    eligiblePoolIds: readonly string[],
+    providerId: string,
+    limitsByPool?: Record<string, number>,
+    weightsByPool?: Record<string, number>,
+    providerCapacity?: number,
+  ): Promise<Array<{ cooldown: PoolCooldownState; pool: PoolCapacitySnapshot }>> {
+    const cooldownKeys = eligiblePoolIds.map((poolId) => proxyCooldownKey(poolId, providerId));
+    const inflightKeys = eligiblePoolIds.map((poolId) => proxyInflightKey(poolId));
+    const providerInflightKeys =
+      providerCapacity === undefined
+        ? []
+        : eligiblePoolIds.map((poolId) => proxyProviderInflightKey(poolId, providerId));
+    try {
+      const [cooldownRaws, inflightRaws, providerRaws] = await Promise.all([
+        this.redis!.mget(...cooldownKeys),
+        this.redis!.mget(...inflightKeys),
+        providerInflightKeys.length === 0
+          ? Promise.resolve([] as Array<string | null>)
+          : this.redis!.mget(...providerInflightKeys),
+      ]);
+      return eligiblePoolIds.map((poolId, index) => {
+        const cooldown = this.cooldownFromBatchState(poolId, providerId, cooldownRaws[index] ?? null);
+        const maxInflight = effectiveConcurrency(
+          limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
+        );
+        const weight = normalizedWeight(weightsByPool?.[poolId]);
+        const currentInflight = this.parseInflightCounter(inflightRaws[index] ?? null, poolId);
+        const providerInflight =
+          providerCapacity === undefined
+            ? undefined
+            : this.parseInflightCounter(providerRaws[index] ?? null, `${poolId}/${providerId}`);
+        return {
+          cooldown,
+          pool: {
+            poolId,
+            maxInflight,
+            currentInflight,
+            available: Math.max(0, maxInflight - currentInflight),
+            weight,
+            ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
+            ...(cooldown.blocked ? { blocked: true } : {}),
+            ...(providerCapacity === undefined
+              ? {}
+              : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
+          } satisfies PoolCapacitySnapshot,
+        };
+      });
+    } catch {
+      return this.perPoolSelectionChecks(
+        eligiblePoolIds,
+        providerId,
+        limitsByPool,
+        weightsByPool,
+        providerCapacity,
+      );
+    }
+  }
+
   async getSelectionFailure(
     eligiblePoolIds: readonly string[],
     providerId: string,
@@ -891,39 +1058,15 @@ export class NetworkPoolSelector {
     const providerCapacity =
       providerMaxInflight === undefined ? undefined : effectiveConcurrency(providerMaxInflight);
     try {
-      // One pass, not two: the cooldown lookup is a Redis read per pool, and
-      // the first version read it once for the capacity snapshot and again for
-      // the rejection decision, doubling the round trips on exactly the path
-      // that runs when selection fails.
-      const checks = await Promise.all(
-        eligiblePoolIds.map(async (poolId) => {
-          const cooldown = await this.isProviderCooldown(poolId, providerId);
-          const maxInflight = effectiveConcurrency(
-            limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
-          );
-          const weight = normalizedWeight(weightsByPool?.[poolId]);
-          const currentInflight = await this.getInflightAuthoritative(poolId);
-          const providerInflight =
-            providerCapacity === undefined
-              ? undefined
-              : await this.getProviderInflightAuthoritative(poolId, providerId);
-          return {
-            cooldown,
-            pool: {
-              poolId,
-              maxInflight,
-              currentInflight,
-              available: Math.max(0, maxInflight - currentInflight),
-              weight,
-              ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
-              ...(cooldown.blocked ? { blocked: true } : {}),
-              ...(providerCapacity === undefined
-                ? {}
-                : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
-            } satisfies PoolCapacitySnapshot,
-          };
-        }),
-      );
+      // One batch pass instead of per-pool Redis reads: cooldowns and inflight
+      // counters are read in one `MGET` per key family (three total), not
+      // three serial GETs per pool. The per-pool resolution below consumes the
+      // raw rows with the same semantics `isProviderCooldown` /
+      // `getInflightAuthoritative` / `getProviderInflightAuthoritative` apply.
+      const checks =
+        this.redis === undefined
+          ? await this.perPoolSelectionChecks(eligiblePoolIds, providerId, limitsByPool, weightsByPool, providerCapacity)
+          : await this.batchSelectionChecks(eligiblePoolIds, providerId, limitsByPool, weightsByPool, providerCapacity);
       const pools = checks.map((check) => check.pool);
       const cooldowns = checks.map((check) => check.cooldown);
       if (cooldowns.some((entry) => entry.reason === "cooldown store unavailable")) {