A probe the provider would not let run never demotes a model; a limit on one model holds that model only; capabilities left Could Not Check re-check themselves (SIQ3)

Shipped

November 13, 2026 at 2:35 AM UTC

Author

Kamo

Commit

3e5cfeb

- ProbeOutcome.inconclusive: rate limited, out of credit, key rejected (401), timeout or outage = COULD_NOT_CHECK. ProbePersister writes last_probe_detail only; verification, verified_at, measured attributes and the tool flag stay. ProbeResultView.outcome = PASSED | FAILED | COULD_NOT_CHECK. - ProviderBreaker: a 429 naming a model ("Rate limit reached for <model> in organization ...") cools that model only, for the provider's own wait (max 1 h); the provider and its other models stay in the walk. Plain 429s, out of credit and rejected keys still hold the provider. - BreakerProbeJob self-recovery (every 5 min, singleton): re-probes Could Not Check capabilities when the provider healed since the attempt, else hourly; at most 6 probes per provider per hour, text then tool calling first; stops when the account still refuses.