@antseed/cli 0.1.193 → 0.1.195

package/dist/proxy/buyer-proxy.js

@@ -8,9 +8,9 @@ import { buildRoutingServices, findPinnedRoutingService } from './routing-servic
 import { readFileSync, watchFile, unwatchFile } from 'node:fs';
 import { readFile, writeFile, rename, mkdir, readdir, stat, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
-import { ANTSEED_BUYER_FAULT_ERROR_CODE, ANTSEED_FAULT_ATTRIBUTION_HEADER, ANTSEED_ATTEST_PATH, adaptPeerFaultErrorResponse, computeTrustScore, decodeSweepRequest, faultAttributionOf, faultCodeOf, isModelRouteCoolingDown, isModelRouteEligible, modelRouteReputationScore, modelRouteTotalPrice, normalizedModelReputationScore, peerSupportsCooperativeClose, isRoutingSelection, DEFAULT_BUYER_IDENTITY, rankModelRoutes, sanitizePeerDisplayName, } from '@antseed/node';
+import { ANTSEED_BUYER_FAULT_ERROR_CODE, ANTSEED_FAULT_ATTRIBUTION_HEADER, ANTSEED_ATTEST_PATH, adaptPeerFaultErrorResponse, computeTrustScore, decodeSweepRequest, faultAttributionOf, faultCodeOf, isModelRouteCoolingDown, isModelRouteEligible, modelRouteReputationScore, modelRouteTotalPrice, normalizedModelReputationScore, peerSupportsCooperativeClose, isRoutingSelection, DEFAULT_BUYER_IDENTITY, rankModelRoutes, SellerHealthBook, orderAdaptiveRoutes, adaptiveFirstTokenTimeoutMs, sanitizePeerDisplayName, } from '@antseed/node';
 import { canonicalModelKey } from '@antseed/node/model-identity';
-import { createStreamingAdapter, detectRequestServiceApiProtocol, transformRequest, transformResponse, } from './service-api-adapter.js';
+import { createStreamingAdapter, detectRequestServiceApiProtocol, extractRequestBodyFields, transformRequest, transformResponse, } from './service-api-adapter.js';
 import { DEBUG, log, extractRequestedService, summarizeRequestShape, summarizeErrorResponse, requestWantsStreaming, parsePeerPinnedService, rewritePeerPinnedServiceInBody, substituteRoutedModelAlias, overrideRoutedModelInBody, ROUTED_MODEL_ALIAS, SYSTEM_PROXY_SOURCE_HEADER, SYSTEM_ROUTED_MODEL_HEADER, BUYER_IDENTITY_HEADER, normalizePeerId, takeRoutingOptions, } from './request-utils.js';
 import { BuyerIdentityLoader } from '../buyer-identities/loader.js';
 import { buildNetworkModels, effectiveModelReputationScore, parseModelTypeFilter, } from './network-models.js';
@@ -26,6 +26,7 @@ import { DEPOSIT_WATCH_ACTIVE_TTL_MS } from './deposit-watcher.js';
 import { DepositLog } from './deposit-log.js';
 import { recordPeerFailureEntry, clearPeerHealthEntry, isCoolingDown, parsePersistedPeerHealth, prunePeerHealth, serializePeerHealth, reasonEscalates, } from './peer-health.js';
 import { PeerAttributionTracker, HEARTBEAT_MS } from './peer-attribution.js';
+import { hasStreamError, isEmptyAnswer, isSellerVerificationFailure } from './response-quality.js';
 import { estimateAnthropicPromptTokens, isCountTokensPath } from './count-tokens.js';
 import { runVerifier, selectVerifier, verifierSupportFingerprint } from '../plugins/verifier.js';
 import { TEE_VERIFIER_ID } from '@antseed/node/tee-status';
@@ -41,6 +42,10 @@ import { buyerConfigReason, buyerHardPolicy, buyerPreferencePolicy, orderByPolic
 // Re-export for backward compatibility (used by tests and other consumers)
 export { selectCandidatePeersForRouting } from './routing.js';
 export { parsePeerPinnedService, rewritePeerPinnedServiceInBody, substituteRoutedModelAlias, ROUTED_MODEL_ALIAS } from './request-utils.js';
+/** On shutdown, requests in flight get this long to finish before their connections are closed. */
+export const BUYER_SHUTDOWN_DRAIN_MS = 60_000;
+/** How long a graceful buyer shutdown may take before the process exits anyway: the proxy's drain, then the node. */
+export const BUYER_SHUTDOWN_DEADLINE_MS = BUYER_SHUTDOWN_DRAIN_MS + 15_000;
 const WATCHER_ABSENCE_ERRORS = {
     'payments-disabled': 'Deposit watcher unavailable — payments are disabled on this buyer.',
     'no-deposit-relay': 'Deposit watcher unavailable — this chain has no deposit relay.',
@@ -58,24 +63,8 @@ const BALANCE_FRESH_FLOOR_MS = 5_000;
 const CONTROL_SECRET_RECHECK_MS = 1_000;
 /** Floor between forced re-reads on a secret mismatch, so a stream of bad secrets can't hammer the disk. */
 const CONTROL_SECRET_FORCED_RECHECK_MS = 100;
-const LATENCY_EMA_ALPHA = 0.3;
-const MAX_LATENCY_ENTRIES = 4096;
-/** Responses with fewer output tokens than this say little about a seller's generation speed. */
-const MIN_THROUGHPUT_TOKENS = 20;
+const SELLER_HEALTH_PERSIST_DELAY_MS = 5_000;
 const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000';
-/** Moves `key`'s EMA toward `sample`; the map stays least recently measured first and bounded. */
-function updateEma(map, key, sample) {
-    if (!Number.isFinite(sample) || sample < 0)
-        return;
-    const previous = map.get(key);
-    map.delete(key);
-    map.set(key, previous === undefined ? sample : previous + LATENCY_EMA_ALPHA * (sample - previous));
-    if (map.size > MAX_LATENCY_ENTRIES) {
-        const oldest = map.keys().next().value;
-        if (oldest !== undefined)
-            map.delete(oldest);
-    }
-}
 /** Exact USDC decimal string from base units, e.g. 1500000n -> "1.500000". */
 function formatUsdcBaseUnits(amount) {
     const sign = amount < 0n ? '-' : '';
@@ -110,10 +99,49 @@ function retryableStatusCodesFor(gatewayAutoRoute) {
  * Whether the routing loop should try the next seller. On automatic routing a
  * seller's model_not_found also moves on: its cached catalog was stale (the
  * seller stopped serving the model), and another seller may still serve it.
- * A pinned request keeps the pinned seller's answer.
+ * `extraAttempt` also moves on after any other 4xx except 402: a client error
+ * may be the seller's doing (it refuses a parameter other sellers of the
+ * model accept) or the request's, and only another seller can
+ * tell which. A pinned request keeps the pinned seller's answer.
+ */
+function shouldTryNextPeer(statusCode, modelNotFound, pinned, gatewayAutoRoute, extraAttempt = false) {
+    return retryableStatusCodesFor(gatewayAutoRoute).has(statusCode)
+        || (modelNotFound && !pinned)
+        || (extraAttempt && !pinned && statusCode >= 400 && statusCode < 500 && statusCode !== 402);
+}
+function classifyFailedAttempt(result) {
+    if (result.emptyAnswer)
+        return { description: 'answered with no text or tool call', sellerOnly: false, weight: 1 };
+    if (result.timedOut)
+        return { description: result.errorMessage ?? 'no answer in time', sellerOnly: true, weight: 0.5 };
+    if (result.errorMessage)
+        return { description: `request failed (${result.errorMessage.split('\n')[0].slice(0, 120)})`, sellerOnly: true, weight: 1 };
+    // Busy is not broken: it costs the seller less, and only when another seller served.
+    if (result.statusCode === 429)
+        return { description: 'HTTP 429 (busy)', sellerOnly: false, weight: 0.5 };
+    const sellerOnly = result.statusCode >= 500 || result.statusCode === 401 || result.statusCode === 403 || result.statusCode === 408;
+    return { description: `HTTP ${result.statusCode}`, sellerOnly, weight: 1 };
+}
+/**
+ * The client's own prompt-cache key (OpenAI `prompt_cache_key`), which asks
+ * for requests sharing it to land where their cache is.
  */
-function shouldTryNextPeer(statusCode, modelNotFound, pinned, gatewayAutoRoute) {
-    return retryableStatusCodesFor(gatewayAutoRoute).has(statusCode) || (modelNotFound && !pinned);
+function promptCacheKey(request) {
+    const value = extractRequestBodyFields(request.headers, request.body)?.['prompt_cache_key'];
+    return typeof value === 'string' && value.trim() ? `cache:${value.trim().slice(0, 256)}` : null;
+}
+/**
+ * Size of a request, for weighing a seller's price against its speed: input
+ * from the body size (~4 bytes a token), output from the requested cap.
+ */
+function requestShape(request) {
+    const fields = extractRequestBodyFields(request.headers, request.body);
+    const cap = [fields?.['max_tokens'], fields?.['max_completion_tokens'], fields?.['max_output_tokens']]
+        .find((value) => typeof value === 'number' && Number.isFinite(value) && value > 0);
+    return {
+        inputTokens: Math.round(request.body.length / 4),
+        outputTokens: Math.min(cap ?? 400, 2_000),
+    };
 }
 const MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER = 3;
 const MODEL_RATE_LIMIT_RETRY_DELAYS_MS = [250, 750];
@@ -789,6 +817,15 @@ export class BuyerProxy {
     _peerHealth = new Map();
     /** Decides whether a failure is the peer's fault at all. */
     _attribution = new PeerAttributionTracker();
+    /**
+     * What this buyer has seen of each seller and model: how often requests
+     * succeed and how fast answers come. Automatic routing ranks by it.
+     */
+    _sellerHealth = new SellerHealthBook();
+    /** Requests in flight per seller, to stop sending a seller more than it says it can take at once. */
+    _inFlightBySeller = new Map();
+    _peerHealthPersistTimer = null;
+    _adaptiveRouting;
     _heartbeatHandle = null;
     _now;
     /** Latest relayer receipt per sweep authNonce, for CLI progress polling. */
@@ -820,14 +857,6 @@ export class BuyerProxy {
     _controlSecretCheckedAt = 0;
     _controlSecretForcedAt = 0;
     _loggedUnauthenticatedPolicy = false;
-    /**
-     * Per-seller speed measured by this proxy on streamed requests, as EMAs:
-     * time to the first response frame (ms) and output tokens per second after
-     * it. Kept apart so a long answer doesn't read as a slow seller. Latency
-     * feeds `sort: 'latency'`; sellers without a measurement rank after measured ones.
-     */
-    _peerLatencyMs = new Map();
-    _peerTokensPerSecond = new Map();
     _balanceReader;
     _balanceCache = new ChainReadCache();
     _restartHandler;
@@ -869,6 +898,7 @@ export class BuyerProxy {
             }
             : null;
         this._now = config.now ?? (() => Date.now());
+        this._adaptiveRouting = { ...config.adaptiveRouting };
         this._server = createServer((req, res) => {
             this._handleRequest(req, res).catch((err) => {
                 log('Unhandled error:', err);
@@ -896,6 +926,17 @@ export class BuyerProxy {
                 this._spendAttribution.record(event);
             });
         }
+        const responseAuthNode = this._node;
+        if (typeof responseAuthNode.on === 'function') {
+            responseAuthNode.on('response-auth', (event) => {
+                if (event.verified || !isSellerVerificationFailure(event.verificationError))
+                    return;
+                // A forged or mismatched receipt can only be the seller's doing: it
+                // counts as several failed requests.
+                this._recordSellerFailure(event.sellerPeerId, event.advertisedService, `response failed verification (${event.verificationError})`, 3);
+                log(`Peer ${event.sellerPeerId.slice(0, 12)}... response failed verification (${event.verificationError}); counted against its ${event.advertisedService} health.`);
+            });
+        }
         const eventNode = this._node;
         if (typeof eventNode.on === 'function') {
             eventNode.on('peers:discovered', (peers) => {
@@ -1087,24 +1128,55 @@ export class BuyerProxy {
             teeCapable: parseVerifierCapabilities(peer.capabilities).supported.includes(TEE_VERIFIER_ID),
         };
     }
-    /** Latency is tracked per seller and model: one seller can serve a small model fast and a large one slowly. */
-    _latencyKey(peerId, serviceId) {
-        return `${peerId.toLowerCase()}|${serviceId ? policyModelKey(serviceId) : ''}`;
+    /** Health is tracked per seller and model: one seller can serve a small model fast and a large one slowly. */
+    _healthServiceKey(serviceId) {
+        return serviceId ? policyModelKey(serviceId) : null;
     }
     _peerLatency(peerId, serviceId) {
-        return this._peerLatencyMs.get(this._latencyKey(peerId, serviceId)) ?? null;
+        return this._sellerHealth.stats(peerId, this._healthServiceKey(serviceId), this._now())?.firstTokenMs ?? null;
     }
     _peerThroughput(peerId, serviceId) {
-        return this._peerTokensPerSecond.get(this._latencyKey(peerId, serviceId)) ?? null;
+        return this._sellerHealth.stats(peerId, this._healthServiceKey(serviceId), this._now())?.tokensPerSecond ?? null;
     }
-    /** One streamed request: time to its first frame, then output tokens over the rest of the stream. */
-    _recordPeerSpeed(peerId, serviceId, firstFrameMs, streamMs, outputTokens) {
-        const key = this._latencyKey(peerId, serviceId);
-        updateEma(this._peerLatencyMs, key, firstFrameMs);
-        if (outputTokens >= MIN_THROUGHPUT_TOKENS && streamMs > 0) {
-            updateEma(this._peerTokensPerSecond, key, outputTokens / (streamMs / 1000));
+    /**
+     * Sellers the paying identity already has an open payment channel with, so
+     * routing can spread traffic without reserving funds on new sellers. Null
+     * when the node cannot say.
+     */
+    _openChannelPeers(buyerIdentity) {
+        const node = this._node;
+        if (typeof node.getActiveBuyerChannels !== 'function')
+            return null;
+        try {
+            return new Set(node.getActiveBuyerChannels(buyerIdentity).map((channel) => channel.peerId.toLowerCase()));
+        }
+        catch {
+            return null;
         }
     }
+    _attemptTimeoutMs(timedLike, request) {
+        return adaptiveFirstTokenTimeoutMs(this._sellerHealth.stats(timedLike.peerId, this._healthServiceKey(timedLike.serviceId), this._now()), requestShape(request).outputTokens, requestWantsStreaming(request.headers, request.body));
+    }
+    /** A seller answered: count the success and how fast the answer came. */
+    _recordSellerSuccess(peerId, serviceId, timing) {
+        this._sellerHealth.recordSuccess(peerId, this._healthServiceKey(serviceId), this._now(), timing);
+        this._schedulePeerHealthPersist();
+    }
+    /** A seller failed a request: count it against that seller and model. */
+    _recordSellerFailure(peerId, serviceId, reason, weight = 1) {
+        this._sellerHealth.recordFailure(peerId, this._healthServiceKey(serviceId), this._now(), reason, weight);
+        this._schedulePeerHealthPersist();
+    }
+    /** Seller health changes on every request: write it at most every few seconds, not per request. */
+    _schedulePeerHealthPersist() {
+        if (this._peerHealthPersistTimer)
+            return;
+        this._peerHealthPersistTimer = setTimeout(() => {
+            this._peerHealthPersistTimer = null;
+            void this._persistPeerHealthToState();
+        }, SELLER_HEALTH_PERSIST_DELAY_MS);
+        this._peerHealthPersistTimer.unref?.();
+    }
     /**
      * Candidate selection and ranking for a model-only request. The real
      * routing path and `GET /_antseed/route-preview` both call this, so the
@@ -1208,6 +1280,33 @@ export class BuyerProxy {
             candidates = this._readyFirst(ranked, verdicts, now);
         }
         const isCooling = (candidate) => isModelRouteCoolingDown(candidate, now);
+        const openChannels = this._openChannelPeers(request.headers[BUYER_IDENTITY_HEADER]);
+        // Among the sellers the buyer's limits allow, rank by what this buyer has
+        // seen them do: expected cost of a successful answer, spread across the
+        // sellers close to the best. An explicit gateway sort or route chain
+        // reorders afterwards, but still tries unhealthy sellers late.
+        const adaptive = orderAdaptiveRoutes(candidates, (candidate) => ({
+            peerId: candidate.peerId,
+            serviceId: this._healthServiceKey(candidate.serviceId),
+            inputUsdPerMillion: candidate.inputUsdPerMillion,
+            outputUsdPerMillion: candidate.outputUsdPerMillion,
+            requestUsd: candidate.minImageUsdPerImage,
+            coolingDown: isCooling(candidate),
+            ...(openChannels ? { channelOpen: modelRouteTotalPrice(candidate) === 0 || openChannels.has(candidate.peerId.toLowerCase()) } : {}),
+            saturated: typeof candidate.peer.maxConcurrency === 'number' && candidate.peer.maxConcurrency > 0
+                && (this._inFlightBySeller.get(candidate.peerId.toLowerCase()) ?? 0) >= candidate.peer.maxConcurrency,
+        }), this._sellerHealth, requestShape(request), {
+            now,
+            affinityKey: input.affinityKey ?? null,
+            ...this._adaptiveRouting,
+            ...(input.deterministic ? { spreadTolerance: 0, explorationRate: 0 } : {}),
+        });
+        // Without routing preferences the buyer ranks by reputation, as before;
+        // health only moves sellers that fail often behind the others.
+        candidates = routingPreferences
+            ? adaptive.ordered
+            : [...candidates].sort((a, b) => Number(adaptive.scores.get(a).unhealthy) - Number(adaptive.scores.get(b).unhealthy));
+        const healthOf = (candidate) => adaptive.scores.get(candidate);
         let chainPosition = null;
         if (effectivePolicy) {
             const ordering = orderByPolicy(candidates, effectivePolicy, requestedService, {
@@ -1216,6 +1315,7 @@ export class BuyerProxy {
                 trustScore: (candidate) => (candidate.reputation >= 0 ? candidate.reputation : null),
                 latencyMs: (candidate) => this._peerLatency(candidate.peerId, candidate.serviceId),
                 coolingDown: isCooling,
+                unhealthy: (candidate) => healthOf(candidate).unhealthy,
             });
             for (const candidate of candidates) {
                 const reason = ordering.excluded.get(normalizePolicyPeerId(candidate.peerId));
@@ -1230,7 +1330,8 @@ export class BuyerProxy {
         const preferredPeerId = input.preferredPeerId;
         if (preferredPeerId && !findModelRoute(effectivePolicy, requestedService)) {
             const preferredIndex = candidates.findIndex((candidate) => (candidate.peer.peerId.toLowerCase() === preferredPeerId
-                && !isCoolingDown(this._peerHealth.get(candidate.peer.peerId), now)));
+                && !isCoolingDown(this._peerHealth.get(candidate.peer.peerId), now)
+                && !healthOf(candidate).unhealthy));
             if (preferredIndex > 0) {
                 const [preferred] = candidates.splice(preferredIndex, 1);
                 if (preferred)
@@ -1246,18 +1347,24 @@ export class BuyerProxy {
             const position = chainPosition?.get(normalizePolicyPeerId(candidate.peerId));
             if (position !== undefined)
                 verdict.reasons.push(`route chain #${position + 1}`);
+            const health = healthOf(candidate);
             if (isCooling(candidate))
                 verdict.reasons.push('cooling down (tried last)');
+            else if (health.unhealthy)
+                verdict.reasons.push(`failing lately: ${health.stats?.lastFailureReason ?? 'failed requests'} (tried after healthy sellers)`);
+            if (adaptive.pool.length > 1 && adaptive.pool.includes(candidate))
+                verdict.reasons.push(`shares traffic with ${adaptive.pool.length - 1} other seller(s)`);
             if (modelRouteTotalPrice(candidate) === 0)
                 verdict.reasons.push('free');
+            verdict.reasons.push(`success ~${Math.round(health.successProbability * 100)}%${health.stats ? '' : ' (no data yet)'}`);
             const latency = this._peerLatency(candidate.peerId, candidate.serviceId);
             if (latency !== null)
-                verdict.reasons.push(`latency ~${Math.round(latency)}ms`);
+                verdict.reasons.push(`first token ~${Math.round(latency)}ms`);
             const throughput = this._peerThroughput(candidate.peerId, candidate.serviceId);
             if (throughput !== null)
                 verdict.reasons.push(`~${Math.round(throughput)} tok/s`);
         });
-        return { candidates, verdicts: [...verdicts.values()], effectivePolicy };
+        return { candidates, verdicts: [...verdicts.values()], effectivePolicy, explored: adaptive.explored };
     }
     /**
      * Without routing preferences: best effective reputation first, and only
@@ -1301,6 +1408,7 @@ export class BuyerProxy {
             requiredParameters: [],
             requestPolicy,
             preferredPeerId: null,
+            deterministic: true,
         });
         const effective = plan.effectivePolicy;
         const modelAllowed = policyAllowsModel(effective, model);
@@ -1569,6 +1677,7 @@ export class BuyerProxy {
             // impossibly distant, so a restart can never extend one. Nothing new can
             // escalate until a success re-establishes that the buyer is healthy.
             this._peerHealth = parsePersistedPeerHealth(parsed, this._now());
+            this._sellerHealth = SellerHealthBook.parse(parsed.sellerHealth, this._now());
             const peers = parsePersistedPeers(parsed);
             if (peers.length === 0) {
                 return;
@@ -1592,6 +1701,11 @@ export class BuyerProxy {
     async stop() {
         this._teeVerification.close();
         await this._teeControl.close();
+        if (this._peerHealthPersistTimer) {
+            clearTimeout(this._peerHealthPersistTimer);
+            this._peerHealthPersistTimer = null;
+            await this._persistPeerHealthToState().catch(() => { });
+        }
         if (this._stateWatchDebounce) {
             clearTimeout(this._stateWatchDebounce);
             this._stateWatchDebounce = null;
@@ -1618,8 +1732,13 @@ export class BuyerProxy {
         }
         await this._writeStateFile('stopped');
         await this._conversations.flush();
+        // Requests in flight finish (a supervisor restarting the buyer holds new
+        // ones meanwhile), up to the drain limit.
         return new Promise((resolve) => {
+            const drain = setTimeout(() => this._server.closeAllConnections(), BUYER_SHUTDOWN_DRAIN_MS);
+            drain.unref?.();
             this._server.close(() => {
+                clearTimeout(drain);
                 this._spendAttribution.close();
                 resolve();
             });
@@ -2098,6 +2217,7 @@ export class BuyerProxy {
         this._peerHealth = prunePeerHealth(this._peerHealth, now);
         await this._mergeStateFile({
             peerHealth: serializePeerHealth(this._peerHealth),
+            sellerHealth: this._sellerHealth.serialize(now),
             peerHealthUpdatedAt: now,
         });
     }
@@ -2296,6 +2416,18 @@ export class BuyerProxy {
                 suppressedUntil: attribution.suppressedUntil,
                 lastSuppressedBy: attribution.lastSuppressedBy,
                 peers,
+                // What automatic routing has learned of each seller and model.
+                sellerHealth: this._sellerHealth.entries(now).map(({ peerId, serviceId, stats }) => ({
+                    peerId,
+                    serviceId,
+                    successes: Math.round(stats.successes * 100) / 100,
+                    failures: Math.round(stats.failures * 100) / 100,
+                    firstTokenMs: stats.firstTokenMs === null ? null : Math.round(stats.firstTokenMs),
+                    tokensPerSecond: stats.tokensPerSecond === null ? null : Math.round(stats.tokensPerSecond),
+                    lastSuccessAt: stats.lastSuccessAt,
+                    lastFailureAt: stats.lastFailureAt,
+                    lastFailureReason: stats.lastFailureReason,
+                })),
             }));
             return;
         }
@@ -2330,6 +2462,8 @@ export class BuyerProxy {
             // Deliberately does not stamp a success: the user is asking us to give
             // the peer another chance, not asserting that it answered.
             this._rollbackPeerHealth([normalized], 'cleared by request');
+            this._sellerHealth.forget(normalized);
+            void this._persistPeerHealthToState();
             res.writeHead(200, { 'content-type': 'application/json' });
             res.end(JSON.stringify({ ok: true, peerId: normalized }));
             return;
@@ -3550,7 +3684,7 @@ export class BuyerProxy {
                 ({ candidatePeers: modelPeers, routePlanByPeerId: modelPlans } = selectModelPeers(discoveredPeers));
             }
             const router = this._node.router;
-            const { candidates, effectivePolicy } = this._planModelRoutes({
+            const { candidates, effectivePolicy, explored } = this._planModelRoutes({
                 modelPeers,
                 modelPlans,
                 request: serializedReq,
@@ -3560,6 +3694,9 @@ export class BuyerProxy {
                 requiredParameters,
                 requestPolicy,
                 preferredPeerId: preferredConversationPeerId,
+                // Conversations the client identifies (session id, prompt-cache key)
+                // stay on one seller so its prompt cache keeps paying off.
+                affinityKey: routingConversationKey ?? promptCacheKey(serializedReq),
             });
             const requireVerified = effectivePolicy?.requireVerified === true;
             if (candidates.length === 0) {
@@ -3604,6 +3741,31 @@ export class BuyerProxy {
             // Set once a seller refused for lack of deposits: every other paid
             // seller would too, so only free ones are still worth trying.
             let unfunded = false;
+            // Sellers that failed this request, whatever the failure: an error
+            // status, a dropped request, an empty answer. If a later seller serves
+            // the same request, they could have too, and each failure counts
+            // against its seller's health. If none does, the request itself may be
+            // at fault: only failures that can only be the seller's count, and only
+            // while the buyer itself is known to be healthy.
+            const failedSellers = new Map();
+            const countFailures = (servedBy) => {
+                const buyerHealthy = this._attribution.isBuyerHealthy(this._now());
+                for (const [peerId, { serviceId, failure }] of failedSellers) {
+                    // A seller that recovered on its own retry (a 429, then an answer)
+                    // proved nothing against itself.
+                    if (peerId === servedBy)
+                        continue;
+                    if (servedBy === null && (!failure.sellerOnly || !buyerHealthy))
+                        continue;
+                    const detail = servedBy ? `${failure.description} (peer ${servedBy.slice(0, 12)}... served it)` : failure.description;
+                    this._recordSellerFailure(peerId, serviceId, detail, failure.weight);
+                    log(`Peer ${peerId.slice(0, 12)}... ${detail}; counted against its ${serviceId} health.`);
+                }
+            };
+            // Failures that only maybe are the seller's (a client error, an empty
+            // answer) get one extra seller to compare against, not the whole list:
+            // when every seller fails, the client gets that answer quickly.
+            let comparisonUsed = false;
             const isFree = (candidate) => modelRouteTotalPrice(candidate) === 0;
             for (const [index, selected] of candidates.entries()) {
                 if (unfunded && !isFree(selected))
@@ -3622,11 +3784,29 @@ export class BuyerProxy {
                         + `service="${selected.serviceId}" reputation=${selected.reputation} `
                         + `effective=${selected.effectiveReputationScore ?? 'unknown'} peer=${index + 1}/${candidates.length} `
                         + `attempt=${peerAttempt + 1}/${MODEL_RATE_LIMIT_MAX_ATTEMPTS_PER_PEER}`);
-                    const result = await this._dispatchToPeer(res, selected.request, selected.peer, modelPlans, requestProtocol, selected.serviceId, explicitProvider, router, false, signal, requestPolicy !== null, routingConversationKey);
+                    const result = await this._dispatchToPeer(res, selected.request, selected.peer, modelPlans, requestProtocol, selected.serviceId, explicitProvider, router, false, signal, requestPolicy !== null, routingConversationKey, !comparisonUsed && index + 1 < candidates.length, 
+                    // With another seller to fall back on, don't wait far longer than
+                    // this one usually takes; the last seller gets the full timeout. A
+                    // probe of a seller with no recent data waits no longer than the
+                    // seller it stands in for would.
+                    index + 1 < candidates.length && !nativeVideo
+                        ? this._attemptTimeoutMs(selected === explored ? candidates[index + 1] : selected, selected.request)
+                        : null);
                     if (result.done) {
+                        // A stream that broke after its headers proves nothing for the
+                        // sellers before it, and counts against this one like any other
+                        // transport failure.
+                        if (result.interrupted === 'seller') {
+                            failedSellers.set(selected.peer.peerId, {
+                                serviceId: selected.serviceId,
+                                failure: { description: 'stream interrupted', sellerOnly: true, weight: 1 },
+                            });
+                        }
+                        const answered = res.statusCode < 400 && !result.emptyAnswer && !result.interrupted;
+                        countFailures(answered ? selected.peer.peerId : null);
                         // Only a seller that answered becomes the chat's route: an error
                         // must not pin later turns to it.
-                        if (trackedConversationId && res.statusCode < 400) {
+                        if (trackedConversationId && answered) {
                             this._conversations.recordRoutedModel(trackedConversationId, `${selected.peer.peerId}@${selected.serviceId}`, conversationPinAtRouting);
                         }
                         return result;
@@ -3636,6 +3816,15 @@ export class BuyerProxy {
                     if (nativeVideo)
                         return result;
                     lastRetry = result;
+                    if (!isBuyerFault(result) && !result.modelNotFound && result.statusCode !== 402) {
+                        const failure = classifyFailedAttempt(result);
+                        failedSellers.set(selected.peer.peerId, { serviceId: selected.serviceId, failure });
+                        if (!failure.sellerOnly && result.statusCode !== 429) {
+                            comparisonUsed = true;
+                            log(`Peer ${selected.peer.peerId.slice(0, 12)}... ${failure.description}; asking one more seller.`);
+                            break;
+                        }
+                    }
                     if (isBuyerFault(result)) {
                         const freeLeft = candidates.slice(index + 1).some(isFree);
                         if (result.statusCode === 402 && freeLeft) {
@@ -3658,6 +3847,7 @@ export class BuyerProxy {
                     log(`Peer ${selected.peer.peerId.slice(0, 12)}... failed retryably; trying next model peer.`);
                 }
             }
+            countFailures(null);
             return lastRetry ?? dispatchFailure(502, { 'content-type': 'application/json' }, JSON.stringify({
                 error: {
                     type: 'peer_verification_failed',
@@ -3820,7 +4010,13 @@ export class BuyerProxy {
         if (result.done && trackedConversationId && pinnedServiceId) {
             this._conversations.recordRoutedModel(trackedConversationId, `${selectedPeer.peerId}@${pinnedServiceId}`, conversationPinAtRouting);
         }
-        // A pinned peer is never retried against another peer; the caller reports any failure.
+        // A pinned peer is never retried against another peer; the caller reports
+        // any failure. Failures only the seller can cause still count against it.
+        if (!result.done && !isBuyerFault(result) && this._attribution.isBuyerHealthy(this._now())) {
+            const failure = classifyFailedAttempt(result);
+            if (failure.sellerOnly)
+                this._recordSellerFailure(selectedPeer.peerId, pinnedServiceId ?? requestedService, failure.description, failure.weight);
+        }
         return result;
     }
     async _verifyPeer(peer, makeReach, signal, requireVerified = false) {
@@ -3906,7 +4102,9 @@ export class BuyerProxy {
      * was sent to the client (success or non-retryable error), or retry info if the
      * caller should try another peer.
      */
-    async _dispatchToPeer(res, serializedReq, selectedPeer, routePlanByPeerId, requestProtocol, requestedService, explicitProvider, router, pinned, requestSignal, gatewayRouted = false, routingConversationKey = null) {
+    async _dispatchToPeer(res, serializedReq, selectedPeer, routePlanByPeerId, requestProtocol, requestedService, explicitProvider, router, pinned, requestSignal, gatewayRouted = false, routingConversationKey = null, extraAttempt = false, 
+    /** Give up on this seller if it has not started answering by then, so the next one can be tried. */
+    attemptTimeoutMs = null) {
         const gatewayAutoRoute = gatewayRouted && !pinned;
         const selectedRoutePlan = routePlanByPeerId.get(selectedPeer.peerId)
             ?? resolvePeerRoutePlan(selectedPeer, requestProtocol, requestedService, explicitProvider, 'lenient');
@@ -4004,16 +4202,29 @@ export class BuyerProxy {
         const peerResponseProtocol = selectedRoutePlan.selection?.targetProtocol ?? requestProtocol;
         const adaptPeerResponse = (response) => adaptPeerFaultErrorResponse(response, peerResponseProtocol, { pinned });
         const startTime = Date.now();
+        const attemptAbort = new AbortController();
+        const attemptSignal = attemptTimeoutMs ? AbortSignal.any([requestSignal, attemptAbort.signal]) : requestSignal;
+        const attemptTimer = attemptTimeoutMs
+            ? setTimeout(() => attemptAbort.abort(new Error(`no answer within ${Math.round(attemptTimeoutMs / 1000)}s, about 4x this seller's usual time`)), attemptTimeoutMs)
+            : null;
+        attemptTimer?.unref?.();
+        const sellerKey = selectedPeer.peerId.toLowerCase();
+        this._inFlightBySeller.set(sellerKey, (this._inFlightBySeller.get(sellerKey) ?? 0) + 1);
         try {
             if (wantsStreaming) {
                 let streamed = false;
                 let firstFrameAt = 0;
+                let streamStartBody = new Uint8Array();
                 const response = await this._node.sendRequestStream(selectedPeer, requestForPeer, {
                     onResponseStart: (startResponse, metadata) => {
                         if (!metadata.streaming)
                             return;
+                        // The seller is answering: from here a slow answer is still an answer.
+                        if (attemptTimer)
+                            clearTimeout(attemptTimer);
                         streamed = true;
                         firstFrameAt = Date.now();
+                        streamStartBody = startResponse.body;
                         const adaptedStartResponse = streamResponseAdapter
                             ? streamResponseAdapter.adaptStart(startResponse)
                             : startResponse;
@@ -4042,7 +4253,7 @@ export class BuyerProxy {
                             }
                         }
                     },
-                }, { signal: requestSignal, pinned, ...(buyerIdentity ? { buyerIdentity } : {}) });
+                }, { signal: attemptSignal, pinned, ...(buyerIdentity ? { buyerIdentity } : {}) });
                 recordRouterUsage(this._modelRoutingClient, routingConversationKey, requestForPeer, response, selectedPeer, requestSignal);
                 let responseForClient = adaptBuyerFaultErrorResponse(response, requestProtocol);
                 responseForClient = adaptPeerResponse(responseForClient);
@@ -4064,8 +4275,9 @@ export class BuyerProxy {
                     log(`${prefix}: ${summarizeErrorResponse(responseForClient)}`);
                 }
                 const telemetry = computeResponseTelemetry(requestForPeer, responseForClient.headers, responseForClient.body, selectedPeer);
+                let streamTiming = null;
                 if (streamed && responseForClient.statusCode < 400) {
-                    this._recordPeerSpeed(selectedPeer.peerId, latencyServiceId, firstFrameAt - startTime, finishedAt - firstFrameAt, telemetry.usage.outputTokens);
+                    streamTiming = { firstTokenMs: firstFrameAt - startTime, streamMs: finishedAt - firstFrameAt, outputTokens: telemetry.usage.outputTokens, streamed: true };
                 }
                 const responseFault = responseFaultAttribution(responseForClient);
                 const modelNotFound = !streamed
@@ -4089,30 +4301,58 @@ export class BuyerProxy {
                     this._recordPeerResponseHealth(selectedPeer.peerId, responseForClient.statusCode, requestForPeer.path);
                 }
                 if (streamed) {
+                    const streamedBody = Buffer.concat([streamStartBody, response.body]);
+                    // The seller's provider failed after the stream started: the wire
+                    // ends normally, but the answer never completed.
+                    const streamFailed = responseForClient.statusCode < 300
+                        && hasStreamError(response.headers['content-type'], streamedBody);
+                    const streamedEmpty = !pinned && !streamFailed && responseForClient.statusCode < 300
+                        && isEmptyAnswer(response.headers['content-type'], streamedBody);
+                    // Already sent, so there is nothing to compare against: an empty
+                    // answer counts against the seller by itself.
+                    if (streamedEmpty)
+                        this._recordSellerFailure(selectedPeer.peerId, latencyServiceId, 'streamed an answer with no text or tool call');
+                    else if (streamFailed) {
+                        // Auto-routing attributes it with the other attempts; a pinned
+                        // request has no other attempts, so count it here.
+                        if (pinned && this._attribution.isBuyerHealthy(this._now())) {
+                            this._recordSellerFailure(selectedPeer.peerId, latencyServiceId, 'stream interrupted');
+                        }
+                    }
+                    else if (streamTiming)
+                        this._recordSellerSuccess(selectedPeer.peerId, latencyServiceId, streamTiming);
                     // Headers already sent to client, can't retry
                     if (!res.writableEnded) {
                         res.end();
                     }
-                    return { done: true };
+                    return streamFailed ? { done: true, interrupted: 'seller' } : { done: true, emptyAnswer: streamedEmpty };
                 }
                 // Non-streamed response — check if retryable
                 const responseHeaders = attachAntseedTelemetryHeaders(responseForClient.headers, selectedPeer, telemetry, requestForPeer.requestId, latencyMs);
-                if (shouldTryNextPeer(responseForClient.statusCode, modelNotFound, pinned, gatewayAutoRoute)) {
+                const answeredEmpty = !pinned && responseForClient.statusCode < 300
+                    && isEmptyAnswer(responseForClient.headers['content-type'], responseForClient.body);
+                const emptyAnswer = extraAttempt && answeredEmpty;
+                if (emptyAnswer || shouldTryNextPeer(responseForClient.statusCode, modelNotFound, pinned, gatewayAutoRoute, extraAttempt && responseFault !== 'buyer')) {
                     return {
                         done: false,
                         statusCode: responseForClient.statusCode,
                         responseBody: Buffer.from(responseForClient.body),
                         responseHeaders,
                         errorMessage: null,
+                        modelNotFound,
+                        emptyAnswer,
                     };
                 }
+                if (responseForClient.statusCode < 300 && !answeredEmpty && !isControlPlaneServicesPath(requestForPeer.path)) {
+                    this._recordSellerSuccess(selectedPeer.peerId, latencyServiceId, { firstTokenMs: latencyMs, outputTokens: telemetry.usage.outputTokens, streamed: false });
+                }
                 res.writeHead(responseForClient.statusCode, responseHeaders);
                 res.end(Buffer.from(responseForClient.body));
-                return { done: true };
+                return { done: true, emptyAnswer: answeredEmpty };
             }
             else {
                 const upstreamResponse = await this._node.sendRequest(selectedPeer, requestForPeer, {
-                    signal: requestSignal,
+                    signal: attemptSignal,
                     pinned,
                     ...(buyerIdentity ? { buyerIdentity } : {}),
                 });
@@ -4168,18 +4408,27 @@ export class BuyerProxy {
                     this._recordPeerResponseHealth(selectedPeer.peerId, response.statusCode, requestForPeer.path);
                 }
                 // Check if retryable
-                if (shouldTryNextPeer(response.statusCode, modelNotFound, pinned, gatewayAutoRoute)) {
-                    return { done: false, statusCode: response.statusCode, responseBody: Buffer.from(response.body), responseHeaders, errorMessage: null };
+                const answeredEmpty = !pinned && response.statusCode < 300 && !videoRoute
+                    && isEmptyAnswer(response.headers['content-type'], response.body);
+                const emptyAnswer = extraAttempt && answeredEmpty;
+                if (emptyAnswer || shouldTryNextPeer(response.statusCode, modelNotFound, pinned, gatewayAutoRoute, extraAttempt && responseFault !== 'buyer')) {
+                    return { done: false, statusCode: response.statusCode, responseBody: Buffer.from(response.body), responseHeaders, errorMessage: null, modelNotFound, emptyAnswer };
+                }
+                if (response.statusCode < 300 && !answeredEmpty && !videoRoute && !isControlPlaneServicesPath(requestForPeer.path)) {
+                    this._recordSellerSuccess(selectedPeer.peerId, latencyServiceId, { firstTokenMs: latencyMs, outputTokens: telemetry.usage.outputTokens, streamed: false });
                 }
                 // Forward response headers and body to the HTTP client
                 res.writeHead(response.statusCode, responseHeaders);
                 res.end(Buffer.from(response.body));
-                return { done: true };
+                return { done: true, emptyAnswer: answeredEmpty };
             }
         }
         catch (err) {
             const latencyMs = Date.now() - startTime;
-            const message = err instanceof Error ? err.message : String(err);
+            const timedOut = attemptAbort.signal.aborted && !requestSignal.aborted;
+            const message = timedOut
+                ? attemptAbort.signal.reason.message
+                : err instanceof Error ? err.message : String(err);
             const abortedLocally = requestSignal.aborted;
             log(`Request failed after ${latencyMs}ms: ${message}`);
             if (abortedLocally) {
@@ -4213,7 +4462,7 @@ export class BuyerProxy {
                         // ignore
                     }
                 }
-                return { done: true };
+                return { done: true, interrupted: 'cancelled' };
             }
             // Whose fault was this? Errors raised by our own wallet, deposits,
             // transport or state machine say nothing about the peer, and telling the
@@ -4228,7 +4477,7 @@ export class BuyerProxy {
                 if (!res.writableEnded) {
                     res.end();
                 }
-                return { done: true };
+                return { done: true, interrupted: fault === 'buyer' ? 'buyer' : 'seller' };
             }
             if (fault === 'buyer') {
                 const buyerResponse = adaptBuyerFaultErrorResponse({
@@ -4266,8 +4515,18 @@ export class BuyerProxy {
                 responseBody: Buffer.from(peerResponse.body),
                 responseHeaders: peerResponse.headers,
                 errorMessage: message,
+                timedOut,
             };
         }
+        finally {
+            if (attemptTimer)
+                clearTimeout(attemptTimer);
+            const remaining = (this._inFlightBySeller.get(sellerKey) ?? 1) - 1;
+            if (remaining > 0)
+                this._inFlightBySeller.set(sellerKey, remaining);
+            else
+                this._inFlightBySeller.delete(sellerKey);
+        }
     }
 }
 //# sourceMappingURL=buyer-proxy.js.map