Refuse re-probing failures too fast: 500/429 failures get a 2h backoff, other errors 30m (flapping relays/quota stops hammering ipinfo every pass, passes every 30 min instead of 15). One-line summary per pass (geo N/M · fail: rate×a server×b) replaces the per-pool error wall. New env POOL_GEO_PROBE_DISABLED=1 turns the feature off.