cartethyia 2.7.9 → 2.8.0

package/src/console/quota/quota-view.ts

@@ -13,7 +13,14 @@ import {
 /** Shape returned for quota data on dashboard account responses. */
 interface QuotaRefreshView {
   readonly source: string;
-  readonly status: "ready" | "error" | "refreshing";
+  /**
+   * `ready` = a usable quota reading exists (successful fetch, cached or
+   * snapshot). `error` = the collector returned an error with no usable
+   * reading. `refreshing` = a background fill is in flight. `unknown` = no
+   * quota evidence at all (no collector surface, or an empty successful read
+   * with no timestamp) — the canonical wire representation for unknown quota.
+   */
+  readonly status: "ready" | "error" | "refreshing" | "unknown";
   readonly plan: string | null;
   readonly windows: ProviderQuotaResult["windows"];
   readonly fetchedAt: string | null;
@@ -94,7 +101,7 @@ export function toQuotaView(
     lastAttemptAt?: string | null;
     lastSuccessAt?: string | null;
     refreshError?: string | null;
-    status?: "ready" | "error" | "refreshing";
+    status?: "ready" | "error" | "refreshing" | "unknown";
   } = {},
 ): QuotaRefreshView {
   const fetchedAt = timestamps.fetchedAt ?? account.lastSuccessAt?.toISOString() ?? null;
@@ -112,9 +119,18 @@ export function toQuotaView(
   // that the last attempt failed; only `quota.error` — no usable reading at
   // all — makes the card an error.
   const error = quota.error ?? null;
+  // Unknown quota: a successful read that carries no windows AND no timestamp
+  // is not evidence of anything — the canonical "no quota evidence" state.
+  // (A provider with a real zero-balance still reports windows/timestamps.)
+  const derivedStatus =
+    error !== null
+      ? ("error" as const)
+      : quota.windows.length === 0 && fetchedAt === null
+        ? ("unknown" as const)
+        : ("ready" as const);
   return {
     source: quota.source,
-    status: timestamps.status ?? (error !== null ? "error" : "ready"),
+    status: timestamps.status ?? derivedStatus,
     plan: quota.plan ?? null,
     windows: quota.windows,
     fetchedAt,

package/src/console/routing/pools/operations.ts

@@ -45,35 +45,40 @@ function isBlockedEntry(entry: { readonly blocked?: boolean }): boolean {
 }
 
 export function createNetworkPoolOperations(config: NetworkPoolConfig) {
+  /**
+   * The read-only enrichment projection shared by the pool list and the pool
+   * detail page: live inflight (falling back to the stored row counter when no
+   * selector is configured), the derived available/utilization figures, and the
+   * active provider cooldowns (omitted entirely when there are none).
+   */
+  async function enrichPoolResponse(res: NetworkPoolResponse, poolId: string): Promise<NetworkPoolResponse> {
+    const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
+    const inflight = config.poolSelector
+      ? await config.poolSelector.getInflightAuthoritative(poolId)
+      : res.inflight;
+    return {
+      ...res,
+      inflight,
+      available: Math.max(0, res.maxInflight - inflight),
+      utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
+      ...(cooldowns && cooldowns.length > 0
+        ? {
+            providerCooldowns: cooldowns.map((c) => ({
+              providerId: c.providerId,
+              until: new Date(c.until).toISOString(),
+              reason: c.reason,
+              blocked: isBlockedEntry(c),
+            })),
+          }
+        : {}),
+    };
+  }
+
   const operations = {
     async listPools(access: AccessDecision | undefined): Promise<NetworkPoolResponse[]> {
         const a = requireTenantScope(access, "dashboard:read");
         const rawPools = await config.store.list(a.tenantId);
-        return Promise.all(
-          rawPools.map(async (r) => {
-            const res = sanitizePoolResponse(r);
-            const cooldowns = await config.poolSelector?.getPoolCooldowns(r.id);
-            const inflight = config.poolSelector
-              ? await config.poolSelector.getInflightAuthoritative(r.id)
-              : res.inflight;
-            return {
-              ...res,
-              inflight,
-              available: Math.max(0, res.maxInflight - inflight),
-              utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-              ...(cooldowns && cooldowns.length > 0
-                ? {
-                    providerCooldowns: cooldowns.map((c) => ({
-                      providerId: c.providerId,
-                      until: new Date(c.until).toISOString(),
-                      reason: c.reason,
-                      blocked: isBlockedEntry(c),
-                    })),
-                  }
-                : {}),
-            };
-          }),
-        );
+        return Promise.all(rawPools.map(async (r) => enrichPoolResponse(sanitizePoolResponse(r), r.id)));
       },
     async getPoolDetail(
         access: AccessDecision | undefined,
@@ -82,27 +87,7 @@ export function createNetworkPoolOperations(config: NetworkPoolConfig) {
         const a = requireTenantScope(access, "dashboard:read");
         const rec = await config.store.get(a.tenantId, poolId);
         if (!rec) throw new ConsoleDomainError("pool_not_found", 404, `Pool ${poolId} not found`);
-        const res = sanitizePoolResponse(rec);
-        const cooldowns = await config.poolSelector?.getPoolCooldowns(poolId);
-        const inflight = config.poolSelector
-          ? await config.poolSelector.getInflightAuthoritative(poolId)
-          : res.inflight;
-        return {
-          ...res,
-          inflight,
-          available: Math.max(0, res.maxInflight - inflight),
-          utilization: res.maxInflight > 0 ? Math.min(1, inflight / res.maxInflight) : 1,
-          ...(cooldowns && cooldowns.length > 0
-            ? {
-                providerCooldowns: cooldowns.map((c) => ({
-                  providerId: c.providerId,
-                  until: new Date(c.until).toISOString(),
-                  reason: c.reason,
-                  blocked: isBlockedEntry(c),
-                })),
-              }
-            : {}),
-        };
+        return enrichPoolResponse(sanitizePoolResponse(rec), poolId);
       },
     async clearPoolCooldown(
         access: AccessDecision | undefined,

package/src/console/shared/errors.ts

@@ -1,7 +1,7 @@
 import { ValidationError } from "elysia";
 import type { AccessDecision, AccessScope } from "../../security/access-control";
 import { isRecord } from "../../protocol/codecs";
-import { formatPublicErrorMessage } from "../../protocol/gateway-error";
+import { formatPublicErrorMessage, GatewayError } from "../../protocol/gateway-error";
 
 // Single console error/access contract. Every domain throws ConsoleDomainError
 // (or the storage-layer BackupError, same code/status/message shape) and
@@ -24,8 +24,27 @@ export class ConsoleDomainError extends Error {
   }
 }
 
-function asDomainError(error: unknown): { code: string; status: number; message: string; details?: unknown } | undefined {
+interface ShapedDomainError {
+  readonly code: string;
+  readonly status: number;
+  readonly message: string;
+  readonly details?: unknown;
+  /** Upstream/network origin, preserved so the dashboard can tell a provider
+   * rejection from a console-session expiry (see `maybeSignalSessionTransition`). */
+  readonly origin?: string;
+}
+
+function asDomainError(error: unknown): ShapedDomainError | undefined {
   if (error instanceof ConsoleDomainError) return error;
+  if (error instanceof GatewayError) {
+    return {
+      code: error.code,
+      status: error.status,
+      message: error.message,
+      details: error.details,
+      ...(error.origin === "cartethyia" ? {} : { origin: error.origin }),
+    };
+  }
   if (
     typeof error === "object" &&
     error !== null &&
@@ -33,8 +52,14 @@ function asDomainError(error: unknown): { code: string; status: number; message:
     typeof (error as { status?: unknown }).status === "number" &&
     typeof (error as { message?: unknown }).message === "string"
   ) {
-    const shaped = error as { code: string; status: number; message: string; details?: unknown };
-    return { code: shaped.code, status: shaped.status, message: shaped.message, details: shaped.details };
+    const shaped = error as { code: string; status: number; message: string; details?: unknown; origin?: unknown };
+    return {
+      code: shaped.code,
+      status: shaped.status,
+      message: shaped.message,
+      details: shaped.details,
+      ...(typeof shaped.origin === "string" && shaped.origin !== "cartethyia" ? { origin: shaped.origin } : {}),
+    };
   }
   return undefined;
 }
@@ -47,6 +72,7 @@ export function errorResponse(
 ): {
   error: string;
   code: string;
+  origin?: string;
   details?: Record<string, unknown>;
 } {
   const shaped = asDomainError(error);
@@ -63,16 +89,17 @@ export function errorResponse(
     const body: Record<string, unknown> = {
       error: message,
       code: shaped.code,
+      ...(shaped.origin === undefined ? {} : { origin: shaped.origin }),
     };
     if (includeDetails) body.details = details;
-    return body as { error: string; code: string; details?: Record<string, unknown> };
+    return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
   }
   set.status = 500;
   const body: Record<string, unknown> = {
     error: formatPublicErrorMessage("internal_error", fallbackMessage),
     code: "internal_error",
   };
-  return body as { error: string; code: string; details?: Record<string, unknown> };
+  return body as { error: string; code: string; origin?: string; details?: Record<string, unknown> };
 }
 
 export function requireScope(

package/src/main.ts

@@ -3,6 +3,7 @@
 import "./boot/elysia-typebox-bridge";
 import { createGatewayApp, createGatewayShell } from "./boot/app";
 import { bootstrap } from "./boot/lifecycle";
+import { flushAllBuffers } from "./boot/flush";
 import type { CartethyiaBoot } from "./boot/lifecycle";
 import {
   resolveDrainToken,
@@ -90,9 +91,7 @@ const app = boot
         // for the queues, minus the stop.
         flushBuffers: {
           flush: async () => {
-            await boot.deps.telemetryBuffer.flush();
-            await boot.deps.usageFlush.flush();
-            await boot.deps.healthEventFlush.flush();
+            await flushAllBuffers(boot.deps);
           },
         },
       },

package/src/network/pool/byte-accounting.ts

@@ -13,6 +13,8 @@
  * byte, and nothing is allocated.
  */
 
+import { evictOldestEntry } from "../../transport/routing/bounded-lru";
+
 /** Running totals for one pool. */
 interface PoolByteTotals {
   /** Bytes sent to the proxy (uploads, TLS handshake, CONNECT). */
@@ -33,8 +35,7 @@ function entry(poolId: string): { sent: number; received: number } {
   let current = totals.get(poolId);
   if (!current) {
     if (totals.size >= MAX_BYTE_ENTRY_COUNT) {
-      const oldest = totals.keys().next().value;
-      if (oldest !== undefined) totals.delete(oldest);
+      evictOldestEntry(totals, MAX_BYTE_ENTRY_COUNT - 1);
     }
     current = { sent: 0, received: 0 };
     totals.set(poolId, current);

package/src/network/pool/selector.ts

@@ -108,6 +108,13 @@ type PoolSelectionFailureReason =
   | "coordination_unavailable"
   | "no_active_pool";
 
+interface PoolCooldownState {
+  readonly inCooldown: boolean;
+  readonly resetsAt: Date | null;
+  readonly reason: string | null;
+  readonly blocked: boolean;
+}
+
 interface PoolCapacitySnapshot {
   readonly poolId: string;
   readonly maxInflight: number;
@@ -399,12 +406,7 @@ export class NetworkPoolSelector {
   async isProviderCooldown(
     poolId: string,
     providerId: string,
-  ): Promise<{
-    inCooldown: boolean;
-    resetsAt: Date | null;
-    reason: string | null;
-    blocked: boolean;
-  }> {
+  ): Promise<PoolCooldownState> {
     const k = this.cooldownKey(poolId, providerId);
     const local = this.state.cooldowns.get(k);
     if (local) {
@@ -880,6 +882,171 @@ export class NetworkPoolSelector {
     }
     return undefined;
   }
+
+  /**
+   * Infight counter from a Redis `MGET` row. `null` (unset counter) is zero;
+   * a malformed counter is the same hard error the per-key read raises, so a
+   * corrupt key is never silently treated as 0.
+   */
+  private parseInflightCounter(raw: string | null, what: string): number {
+    if (raw === null) return 0;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 0) {
+      throw new Error(`invalid pool inflight counter: ${what}`);
+    }
+    return value;
+  }
+
+  /**
+   * Per-pool cooldown resolution with the same semantics as
+   * `isProviderCooldown`: the local cooldown map wins when it has a live
+   * entry; otherwise a non-expired Redis row is admitted (bounded) and an
+   * expired Redis row is cleared. Used by the batched failure path, which
+   * reads all cooldown keys in one `MGET` and resolves each row here.
+   */
+  private cooldownFromBatchState(
+    poolId: string,
+    providerId: string,
+    raw: string | null,
+  ): PoolCooldownState {
+    const k = this.cooldownKey(poolId, providerId);
+    const local = this.state.cooldowns.get(k);
+    if (local) {
+      if (Date.now() < local.until) {
+        return {
+          inCooldown: true,
+          resetsAt: new Date(local.until),
+          reason: local.reason,
+          blocked: local.blocked === true,
+        };
+      }
+      this.state.cooldowns.delete(k);
+    }
+    const parsed = raw ? parseCooldownEntry(raw) : undefined;
+    if (parsed && Date.now() < parsed.until) {
+      enforceCooldownLimit(this.state.cooldowns);
+      this.state.cooldowns.set(k, parsed);
+      return {
+        inCooldown: true,
+        resetsAt: new Date(parsed.until),
+        reason: parsed.reason,
+        blocked: parsed.blocked === true,
+      };
+    }
+    if (raw) {
+      void this.clearRedisCooldown(poolId, providerId);
+    }
+    return { inCooldown: false, resetsAt: null, reason: null, blocked: false };
+  }
+
+  /**
+   * The original per-pool failure check: one Redis read per pool for each of
+   * cooldown, pool inflight, and provider inflight. Retained as the fallback
+   * for the non-Redis path and for a Redis outage during the batched read.
+   */
+  private async perPoolSelectionChecks(
+    eligiblePoolIds: readonly string[],
+    providerId: string,
+    limitsByPool?: Record<string, number>,
+    weightsByPool?: Record<string, number>,
+    providerCapacity?: number,
+  ): Promise<Array<{ cooldown: PoolCooldownState; pool: PoolCapacitySnapshot }>> {
+    return Promise.all(
+      eligiblePoolIds.map(async (poolId) => {
+        const cooldown = await this.isProviderCooldown(poolId, providerId);
+        const maxInflight = effectiveConcurrency(
+          limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
+        );
+        const weight = normalizedWeight(weightsByPool?.[poolId]);
+        const currentInflight = await this.getInflightAuthoritative(poolId);
+        const providerInflight =
+          providerCapacity === undefined
+            ? undefined
+            : await this.getProviderInflightAuthoritative(poolId, providerId);
+        return {
+          cooldown,
+          pool: {
+            poolId,
+            maxInflight,
+            currentInflight,
+            available: Math.max(0, maxInflight - currentInflight),
+            weight,
+            ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
+            ...(cooldown.blocked ? { blocked: true } : {}),
+            ...(providerCapacity === undefined
+              ? {}
+              : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
+          } satisfies PoolCapacitySnapshot,
+        };
+      }),
+    );
+  }
+
+  /**
+   * Batched failure check: one `MGET` per key family (cooldowns, pool
+   * inflight, provider inflight) instead of three serial GETs per pool. On a
+   * Redis error the whole read falls back to per-pool reads so the failure
+   * report keeps the "cooldown store unavailable" per-pool detail.
+   */
+  private async batchSelectionChecks(
+    eligiblePoolIds: readonly string[],
+    providerId: string,
+    limitsByPool?: Record<string, number>,
+    weightsByPool?: Record<string, number>,
+    providerCapacity?: number,
+  ): Promise<Array<{ cooldown: PoolCooldownState; pool: PoolCapacitySnapshot }>> {
+    const cooldownKeys = eligiblePoolIds.map((poolId) => proxyCooldownKey(poolId, providerId));
+    const inflightKeys = eligiblePoolIds.map((poolId) => proxyInflightKey(poolId));
+    const providerInflightKeys =
+      providerCapacity === undefined
+        ? []
+        : eligiblePoolIds.map((poolId) => proxyProviderInflightKey(poolId, providerId));
+    try {
+      const [cooldownRaws, inflightRaws, providerRaws] = await Promise.all([
+        this.redis!.mget(...cooldownKeys),
+        this.redis!.mget(...inflightKeys),
+        providerInflightKeys.length === 0
+          ? Promise.resolve([] as Array<string | null>)
+          : this.redis!.mget(...providerInflightKeys),
+      ]);
+      return eligiblePoolIds.map((poolId, index) => {
+        const cooldown = this.cooldownFromBatchState(poolId, providerId, cooldownRaws[index] ?? null);
+        const maxInflight = effectiveConcurrency(
+          limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
+        );
+        const weight = normalizedWeight(weightsByPool?.[poolId]);
+        const currentInflight = this.parseInflightCounter(inflightRaws[index] ?? null, poolId);
+        const providerInflight =
+          providerCapacity === undefined
+            ? undefined
+            : this.parseInflightCounter(providerRaws[index] ?? null, `${poolId}/${providerId}`);
+        return {
+          cooldown,
+          pool: {
+            poolId,
+            maxInflight,
+            currentInflight,
+            available: Math.max(0, maxInflight - currentInflight),
+            weight,
+            ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
+            ...(cooldown.blocked ? { blocked: true } : {}),
+            ...(providerCapacity === undefined
+              ? {}
+              : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
+          } satisfies PoolCapacitySnapshot,
+        };
+      });
+    } catch {
+      return this.perPoolSelectionChecks(
+        eligiblePoolIds,
+        providerId,
+        limitsByPool,
+        weightsByPool,
+        providerCapacity,
+      );
+    }
+  }
+
   async getSelectionFailure(
     eligiblePoolIds: readonly string[],
     providerId: string,
@@ -891,39 +1058,15 @@ export class NetworkPoolSelector {
     const providerCapacity =
       providerMaxInflight === undefined ? undefined : effectiveConcurrency(providerMaxInflight);
     try {
-      // One pass, not two: the cooldown lookup is a Redis read per pool, and
-      // the first version read it once for the capacity snapshot and again for
-      // the rejection decision, doubling the round trips on exactly the path
-      // that runs when selection fails.
-      const checks = await Promise.all(
-        eligiblePoolIds.map(async (poolId) => {
-          const cooldown = await this.isProviderCooldown(poolId, providerId);
-          const maxInflight = effectiveConcurrency(
-            limitsByPool?.[poolId] ?? DEFAULT_PROXY_CONCURRENCY,
-          );
-          const weight = normalizedWeight(weightsByPool?.[poolId]);
-          const currentInflight = await this.getInflightAuthoritative(poolId);
-          const providerInflight =
-            providerCapacity === undefined
-              ? undefined
-              : await this.getProviderInflightAuthoritative(poolId, providerId);
-          return {
-            cooldown,
-            pool: {
-              poolId,
-              maxInflight,
-              currentInflight,
-              available: Math.max(0, maxInflight - currentInflight),
-              weight,
-              ...(cooldown.resetsAt ? { retryAt: cooldown.resetsAt.getTime() } : {}),
-              ...(cooldown.blocked ? { blocked: true } : {}),
-              ...(providerCapacity === undefined
-                ? {}
-                : { providerMaxInflight: providerCapacity, providerInflight: providerInflight ?? 0 }),
-            } satisfies PoolCapacitySnapshot,
-          };
-        }),
-      );
+      // One batch pass instead of per-pool Redis reads: cooldowns and inflight
+      // counters are read in one `MGET` per key family (three total), not
+      // three serial GETs per pool. The per-pool resolution below consumes the
+      // raw rows with the same semantics `isProviderCooldown` /
+      // `getInflightAuthoritative` / `getProviderInflightAuthoritative` apply.
+      const checks =
+        this.redis === undefined
+          ? await this.perPoolSelectionChecks(eligiblePoolIds, providerId, limitsByPool, weightsByPool, providerCapacity)
+          : await this.batchSelectionChecks(eligiblePoolIds, providerId, limitsByPool, weightsByPool, providerCapacity);
       const pools = checks.map((check) => check.pool);
       const cooldowns = checks.map((check) => check.cooldown);
       if (cooldowns.some((entry) => entry.reason === "cooldown store unavailable")) {

package/src/network/pool-cooldown-store.ts

@@ -17,6 +17,7 @@ import { eq } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../persistence/db-handle";
 import { networkPools, healthEvents } from "../persistence/schema";
 import { log } from "../observability/logger";
+import { metrics } from "../observability/metrics";
 import { providerRateLimitIsIpScoped } from "../providers/provider-metadata";
 import { resolvePoolProviderRateLimitCooldownMs } from "../config/cooldowns";
 import { PROVIDER_BLOCK_MS, type ProxyCooldownEntry } from "./pool/selector";
@@ -152,6 +153,88 @@ export async function pruneExpiredProviderCooldownMarkers(
   }
 }
 
+/** Max simultaneously tracked (pool, provider) coalescing keys. */
+const MAX_TRACKED_PAIRS = 5_000;
+
+/** Last coalesced row timestamp per (pool, provider), for the cooldown window only. */
+const lastRecordedByPoolProvider = new Map<string, number>();
+
+/**
+ * Appends one provider-scoped egress verdict row to `health_events` — the
+ * durable audit log the console's pool page reads.
+ *
+ * Shared by the three writers of this row shape: the dispatch-side 429
+ * recorder (`recordPoolCooldownEvent`), the egress-block recorder
+ * (`recordPoolBlockEvent`), and the probe verdict recorder
+ * (`recordProbeVerdict`). The row is always `entityKind: "pool"`,
+ * `fromStatus: null`, `toStatus: "cooldown"`, and the category is chosen by
+ * `blocked`; the only divergences are the optional code suffix (block path)
+ * and the optional coalescing window (cooldown path).
+ *
+ * Coalescing: `coalesceWindowMs` suppresses a duplicate row for the same
+ * (pool, provider) pair within the window — used by the cooldown path, where
+ * dispatch flags the same pair on every throttled request and the audit log
+ * needs one row per episode, not one per request. The default `undefined`
+ * means no coalescing, so block and probe rows are never deduped; it also
+ * means the pair never enters the tracking map, so the eviction sweep below
+ * only ever sees coalesced pairs. A failed insert does not stamp the pair, so
+ * the next attempt within the window is still tried.
+ *
+ * Swallow contract: this never throws to dispatch (observability writes are
+ * non-fatal); failures bump `pool_cooldown_record_failed` and are logged.
+ */
+export async function appendPoolProviderEgressAuditRow(
+  db: CartethyiaDatabase,
+  opts: {
+    poolId: string;
+    providerId: string;
+    reason: string;
+    blocked: boolean;
+    codeSuffix?: string;
+    coalesceWindowMs?: number;
+  },
+): Promise<void> {
+  const { poolId, providerId, reason, blocked, codeSuffix, coalesceWindowMs } = opts;
+  let key: string | undefined;
+  let now = 0;
+  if (coalesceWindowMs !== undefined) {
+    key = `${poolId}::${providerId.toLowerCase()}`;
+    now = Date.now();
+    const last = lastRecordedByPoolProvider.get(key);
+    if (last !== undefined && now - last < coalesceWindowMs) return;
+  }
+  try {
+    await db.insert(healthEvents).values({
+      id: randomUUID(),
+      entityKind: "pool",
+      networkPoolId: poolId,
+      fromStatus: null,
+      toStatus: "cooldown",
+      reason: `provider ${providerId}: ${reason}${codeSuffix ?? ""}`,
+      errorCategory: blocked ? "egress_blocked" : "rate_limit_transient",
+      createdAt: new Date(),
+    });
+  } catch (error) {
+    metrics.pool_cooldown_record_failed.inc(1);
+    log.warn("pool provider egress audit row failed", {
+      networkPoolId: poolId,
+      providerId,
+      error: String(error),
+    });
+    return;
+  }
+  if (key !== undefined && coalesceWindowMs !== undefined) {
+    lastRecordedByPoolProvider.set(key, now);
+    if (lastRecordedByPoolProvider.size > MAX_TRACKED_PAIRS) {
+      for (const [trackedKey, recordedAt] of lastRecordedByPoolProvider) {
+        if (now - recordedAt >= coalesceWindowMs) {
+          lastRecordedByPoolProvider.delete(trackedKey);
+        }
+      }
+    }
+  }
+}
+
 /**
  * Writes a probe-measured verdict the same way a dispatch-side event would be
  * recorded: one mirror marker and one audit row.
@@ -174,20 +257,12 @@ export async function recordProbeVerdict(
   marker: { until: number; reason: string; blocked?: boolean },
 ): Promise<void> {
   await upsertProviderCooldownMarker(db, poolId, providerId, marker);
-  try {
-    await db.insert(healthEvents).values({
-      id: randomUUID(),
-      entityKind: "pool",
-      networkPoolId: poolId,
-      fromStatus: null,
-      toStatus: "cooldown",
-      reason: `provider ${providerId}: ${marker.reason}`,
-      errorCategory: marker.blocked === true ? "egress_blocked" : "rate_limit_transient",
-      createdAt: new Date(),
-    });
-  } catch (error) {
-    log.warn("pool probe event failed", { networkPoolId: poolId, providerId, error: String(error) });
-  }
+  await appendPoolProviderEgressAuditRow(db, {
+    poolId,
+    providerId,
+    reason: marker.reason,
+    blocked: marker.blocked === true,
+  });
 }
 
 /**