fix(llm): HostPool.check merges in-flight counts; guard release (refs #568)

src/llm/pool.py

@@ -53,7 +53,7 @@ class HostPool:
                 except httpx.HTTPError:
                     continue
         with self._lock:
-            self._in_flight = {h: 0 for h in alive}
+            self._in_flight = {h: self._in_flight.get(h, 0) for h in alive}
         if not alive:
             raise RuntimeError(
                 f"no Ollama host in pool serves {model!r} — "
@@ -70,7 +70,8 @@ class HostPool:
             yield host
         finally:
             with self._lock:
-                self._in_flight[host] -= 1
+                if host in self._in_flight:
+                    self._in_flight[host] -= 1
 
 
 def embed_texts(

tests/llm/test_pool.py

@@ -85,6 +85,27 @@ class TestEmbedTexts:
             embed_texts(HostPool([H1]), "m", ["a"])
 
 
+class TestCheckAcquireInterleave:
+    @patch("llm.pool.httpx.Client")
+    def test_check_drops_held_host_without_corruption(self, MockClient):
+        client = MockClient.return_value.__enter__.return_value
+        pool = HostPool([H1, H2])
+        with pool.acquire() as held:
+            survivor = H2 if held == H1 else H1
+
+            def fake_get(url, **kw):
+                if url.startswith(held):
+                    return _resp({"models": []})
+                return _resp({"models": [{"name": "m:latest"}]})
+
+            client.get.side_effect = fake_get
+            assert pool.check("m") == [survivor]
+        # exiting acquire() above must not raise despite the dropped host
+        with pool.acquire() as again:
+            assert again == survivor
+        assert pool._in_flight[survivor] == 0
+
+
 class TestPoolEmbeddings:
     @patch("llm.pool.embed_texts")
     def test_adapter_delegates(self, mock_embed):