@askalf/dario 6.10.0 → 6.10.1

package/dist/admin-api.d.ts

@@ -122,6 +122,13 @@ export interface AdminAccountLive {
     rejectedCount: number;
     /** Epoch ms of the most recent 429 on this account, or `null` if never. */
     lastRejectedAt: number | null;
+    /**
+     * Per-model buckets keeping their families off this seat while the seat
+     * itself still serves (`['oi']`: Fable parked on a Pro seat whose included
+     * overage is spent, Opus unaffected). Empty when none. Optional: a peer's
+     * snapshot from before the field behaves as before.
+     */
+    parkedBuckets?: string[];
     /** Organization observed on this seat's responses, or `null` if none yet (dario#1244). */
     organizationId: string | null;
     /**

package/dist/admin-api.js

@@ -569,6 +569,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                         request_count: l.requestCount,
                         rejected_count: l.rejectedCount ?? 0,
                         last_rejected_at: l.lastRejectedAt ?? null,
+                        parked_buckets: l.parkedBuckets ?? [],
                         consecutive_auth_failures: l.consecutiveAuthFailures,
                     } : {}),
                 };

package/dist/pool.d.ts

@@ -66,6 +66,27 @@ export interface RateLimitSnapshot {
      * static seed and the evidence.
      */
     boundBuckets?: Record<string, string[]>;
+    /**
+     * Set by `markRejected` when the 429 named an exhausted PER-MODEL bucket
+     * while the unified 5h/7d windows still had room — `['oi']` for a Pro seat
+     * whose included-overage credit is spent (that is what Fable is metered on)
+     * while Opus keeps serving on the same seat. Only the families those buckets
+     * bind (`bucketsBindingFamily`) are kept off the seat, until
+     * `parkedBucketsUntil` (epoch ms, the bucket's own reset). Carried across
+     * later readings by `withParkedBuckets`: an Opus response carries no `7d_oi`
+     * header, so without that the next Fable request would re-learn the same
+     * 429. Absent (or past its reset) on every other snapshot.
+     */
+    parkedBuckets?: string[];
+    parkedBucketsUntil?: number;
+    /**
+     * The seat's OWN windows' status — the worse of `5h-status` and `7d-status`
+     * on the wire (`allowed` / `allowed_warning` / `rejected`), when the response
+     * carried them. `status` is the request's verdict; on a bucket-scoped 429 the
+     * two differ (`rejected` for Fable, `allowed_warning` for the seat), and the
+     * operator surfaces report this one for such a seat, since it is serving.
+     */
+    seatStatus?: string;
 }
 export declare const EMPTY_SNAPSHOT: RateLimitSnapshot;
 /** Freshness of an account's utilisation reading — see `utilFreshness`. */
@@ -278,9 +299,25 @@ export declare function rateLimitWindowPassed(rl: RateLimitSnapshot, now?: numbe
  * exactly the state this is: no current observation.
  */
 export declare function reportedAccountStatus(account: PoolAccount, now?: number): string;
-export declare function accountIneligibility(account: PoolAccount, now?: number): AccountIneligibility | null;
+export declare function accountIneligibility(account: PoolAccount, now?: number, family?: string | null): AccountIneligibility | null;
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
-export declare function isAccountEligible(account: PoolAccount, now?: number): boolean;
+export declare function isAccountEligible(account: PoolAccount, now?: number, family?: string | null): boolean;
+/**
+ * A rejection whose only exhausted reading was a per-model bucket (see
+ * `RateLimitSnapshot.parkedBuckets`): the seat itself has room, one family
+ * does not.
+ */
+export declare function isBucketScopedRejection(rl: RateLimitSnapshot): boolean;
+/** The buckets still parking families on this snapshot right now. */
+export declare function activeParkedBuckets(rl: RateLimitSnapshot, now?: number): string[];
+/**
+ * Is `family` kept off this seat by a parked per-model bucket? False with no
+ * family: the buckets are per family, and a caller with none to name is asking
+ * about the seat, which those buckets do not park.
+ */
+export declare function familyParkedOnBuckets(rl: RateLimitSnapshot, family: string | null | undefined, now?: number): boolean;
+/** `next` with the parked buckets `prev` still holds carried forward (see `RateLimitSnapshot.parkedBuckets`). */
+export declare function withParkedBuckets(prev: RateLimitSnapshot, next: RateLimitSnapshot, now?: number): RateLimitSnapshot;
 /**
  * A seat parked on a 429 whose stated window has not rolled yet — the one
  * state the router must never re-probe: the 429 named the reset, the clock
@@ -288,7 +325,7 @@ export declare function isAccountEligible(account: PoolAccount, now?: number): b
  * stated reset is NOT this: with nothing to expire, asking is the only way
  * back, so it stays probeable (dario#1244).
  */
-export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+export declare function isParkedInLiveWindow(account: PoolAccount, now?: number, family?: string | null): boolean;
 /**
  * A seat rejected by a 429 that named no exhausted window, still inside the
  * cool-down that rejection earned (see `RateLimitSnapshot.exhausted`). It is
@@ -314,7 +351,7 @@ export declare function isCoolingAfterRejection(account: PoolAccount, now?: numb
  * token, which no amount of waiting fixes and which these paths handle
  * separately.
  */
-export declare function isProbeable(account: PoolAccount, now?: number): boolean;
+export declare function isProbeable(account: PoolAccount, now?: number, family?: string | null): boolean;
 /**
  * The operator's next step for one seat, next to `status` on both listings
  * (dario#1244 — "do I have to re-login?" should not need the docs table).
@@ -399,6 +436,10 @@ export declare function parseRateLimits(headers: Headers, family?: string | null
  * seat's window rolls. 0.99 rather than 1 absorbs float formatting.
  */
 export declare function isWindowRejection(rl: RateLimitSnapshot): boolean;
+/** The 429 showed one of the seat's own windows (5h or 7d) at the threshold. */
+export declare function isUnifiedWindowRejection(rl: RateLimitSnapshot): boolean;
+/** The per-model buckets this reading shows at the threshold. */
+export declare function exhaustedBuckets(rl: RateLimitSnapshot): string[];
 /** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
 export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
 /**
@@ -415,6 +456,8 @@ export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
  * bucket is captured automatically the moment Anthropic starts emitting it —
  * this function is what lets routing USE it).
  */
+/** The families `modelFamily` recognises — a per-model bucket named for one (`7d_sonnet`) binds it by name. */
+export declare const KNOWN_FAMILIES: readonly string[];
 export declare function modelFamily(modelId: string | null | undefined): string | null;
 /**
  * Compute headroom for a single account given its rate-limit snapshot.
@@ -473,6 +516,8 @@ export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: st
  */
 export declare function expireElapsedWindow(snapshot: RateLimitSnapshot, now?: number): RateLimitSnapshot;
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+/** The families `buckets` bind on this snapshot — the inverse of `bucketsBindingFamily`, for reporting. */
+export declare function familiesBoundToBuckets(snapshot: RateLimitSnapshot, buckets: readonly string[]): string[];
 export declare function bucketsBindingFamily(snapshot: RateLimitSnapshot, family: string): string[];
 /**
  * Default headroom floor under which an account is treated as "effectively
@@ -570,7 +615,7 @@ export declare class AccountPool {
      * pools stay on the existing unavailable handling (dario#1244, and the
      * review on dario#1254 that caught the mixed case).
      */
-    parkedUntil(now?: number): number | null;
+    parkedUntil(now?: number, family?: string | null): number | null;
     /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now?: number): number;
     /**

package/dist/pool.js

@@ -102,6 +102,12 @@ export function maskEmail(email) {
     return `${(user ?? '').slice(0, 2)}***@${domain ?? ''}`;
 }
 export function describeRejection(rl, now = Date.now()) {
+    if (isBucketScopedRejection(rl)) {
+        const buckets = (rl.parkedBuckets ?? []).map((b) => `7d_${b}`).join(', ');
+        const families = familiesBoundToBuckets(rl, rl.parkedBuckets ?? []);
+        const who = families.length > 0 ? families.join('/') : 'the families it binds';
+        return `${describeRateLimitSnapshot(rl, now)} — ${buckets} exhausted: ${who} parked on this seat until it rolls, other families still served`;
+    }
     if (rl.exhausted !== false)
         return `${describeRateLimitSnapshot(rl, now)} — parked until the window rolls`;
     const { resetInMs } = rateLimitWindow(rl, now);
@@ -249,14 +255,29 @@ export function reportedAccountStatus(account, now = Date.now()) {
         return 'auth-cooldown';
     if (account.rateLimit.status === 'rejected' && rateLimitWindowPassed(account.rateLimit, now))
         return 'unknown';
+    // A bucket-scoped rejection is one family's verdict; the seat is serving the
+    // rest, and its status is its own windows' reading (or unobserved).
+    if (isBucketScopedRejection(account.rateLimit))
+        return account.rateLimit.seatStatus ?? 'unknown';
     return account.rateLimit.status;
 }
-export function accountIneligibility(account, now = Date.now()) {
+export function accountIneligibility(account, now = Date.now(), family) {
     // A rejection outlives its own window unless it is allowed to expire:
     // nothing refreshes a parked account's snapshot, because being parked is
-    // what stops it being sent requests.
-    if (account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now))
+    // what stops it being sent requests. A rejection scoped to per-model
+    // buckets keeps only the families they bind off the seat; with no family
+    // to ask about (the seat-level surfaces) it is not a seat-wide rejection.
+    if (account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now)) {
+        if (!isBucketScopedRejection(account.rateLimit))
+            return 'rate-limited';
+        if (familyParkedOnBuckets(account.rateLimit, family, now))
+            return 'rate-limited';
+    }
+    else if (familyParkedOnBuckets(account.rateLimit, family, now)) {
+        // The seat served something since (an Opus 200 replaced the reading) and
+        // the parked buckets were carried forward: still off for this family.
         return 'rate-limited';
+    }
     if (account.expiresAt <= now + TOKEN_EXPIRY_MARGIN_MS)
         return 'token-expired';
     if (isInAuthCooldown(account, now))
@@ -264,8 +285,44 @@ export function accountIneligibility(account, now = Date.now()) {
     return null;
 }
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
-export function isAccountEligible(account, now = Date.now()) {
-    return accountIneligibility(account, now) === null;
+export function isAccountEligible(account, now = Date.now(), family) {
+    return accountIneligibility(account, now, family) === null;
+}
+/**
+ * A rejection whose only exhausted reading was a per-model bucket (see
+ * `RateLimitSnapshot.parkedBuckets`): the seat itself has room, one family
+ * does not.
+ */
+export function isBucketScopedRejection(rl) {
+    return rl.status === 'rejected' && rl.exhausted !== false && (rl.parkedBuckets?.length ?? 0) > 0;
+}
+/** The buckets still parking families on this snapshot right now. */
+export function activeParkedBuckets(rl, now = Date.now()) {
+    if (!rl.parkedBuckets || rl.parkedBuckets.length === 0)
+        return [];
+    if (rl.parkedBucketsUntil === undefined || rl.parkedBucketsUntil <= now)
+        return [];
+    return rl.parkedBuckets;
+}
+/**
+ * Is `family` kept off this seat by a parked per-model bucket? False with no
+ * family: the buckets are per family, and a caller with none to name is asking
+ * about the seat, which those buckets do not park.
+ */
+export function familyParkedOnBuckets(rl, family, now = Date.now()) {
+    if (!family)
+        return false;
+    const parked = activeParkedBuckets(rl, now);
+    if (parked.length === 0)
+        return false;
+    return bucketsBindingFamily(rl, family).some((b) => parked.includes(b));
+}
+/** `next` with the parked buckets `prev` still holds carried forward (see `RateLimitSnapshot.parkedBuckets`). */
+export function withParkedBuckets(prev, next, now = Date.now()) {
+    const parked = activeParkedBuckets(prev, now);
+    if (parked.length === 0)
+        return next;
+    return { ...next, parkedBuckets: parked, parkedBucketsUntil: prev.parkedBucketsUntil };
 }
 /**
  * A seat parked on a 429 whose stated window has not rolled yet — the one
@@ -274,12 +331,18 @@ export function isAccountEligible(account, now = Date.now()) {
  * stated reset is NOT this: with nothing to expire, asking is the only way
  * back, so it stays probeable (dario#1244).
  */
-export function isParkedInLiveWindow(account, now = Date.now()) {
+export function isParkedInLiveWindow(account, now = Date.now(), family) {
     const rl = account.rateLimit;
     // A non-exhausted rejection is never "parked in a live window": its reset
     // was not this seat's window, and once its cool-down passes asking is the
     // way back (the all-exhausted branch may probe it even sooner).
-    return rl.status === 'rejected' && rl.exhausted !== false && rl.reset > 0 && rl.reset * 1000 > now;
+    if (!(rl.status === 'rejected' && rl.exhausted !== false && rl.reset > 0 && rl.reset * 1000 > now))
+        return false;
+    // A bucket-scoped rejection parks its families, not the seat: for any
+    // other family, or for no family at all, the window is not this seat's.
+    if (isBucketScopedRejection(rl))
+        return familyParkedOnBuckets(rl, family, now);
+    return true;
 }
 /**
  * A seat rejected by a 429 that named no exhausted window, still inside the
@@ -310,9 +373,9 @@ export function isCoolingAfterRejection(account, now = Date.now()) {
  * token, which no amount of waiting fixes and which these paths handle
  * separately.
  */
-export function isProbeable(account, now = Date.now()) {
+export function isProbeable(account, now = Date.now(), family) {
     return !isInAuthCooldown(account, now)
-        && !isParkedInLiveWindow(account, now)
+        && !isParkedInLiveWindow(account, now, family)
         && !isCoolingAfterRejection(account, now);
 }
 /**
@@ -437,6 +500,12 @@ export function parseRateLimits(headers, family) {
             rejectedBuckets.push(st[1].toLowerCase());
     }
     const claim = get('representative-claim') || 'unknown';
+    // The seat's own windows, when the response names them (see `seatStatus`).
+    const windowStatuses = ['5h-status', '7d-status'].map((k) => get(k).trim().toLowerCase()).filter(Boolean);
+    const seatStatus = windowStatuses.length === 0 ? undefined
+        : windowStatuses.includes('rejected') ? 'rejected'
+            : windowStatuses.includes('allowed_warning') ? 'allowed_warning'
+                : windowStatuses[0];
     // What THIS response proved about which bucket binds the request's family
     // (see WIRE_BUCKET_BINDINGS). Only with a family to attribute to, and only
     // on the wire's own say-so: an overage-included claim means the request was
@@ -465,6 +534,7 @@ export function parseRateLimits(headers, family) {
         updatedAt: Date.now(),
         retryAfterMs: parseRetryAfterMs(headers.get('retry-after')),
         ...(boundBuckets ? { boundBuckets } : {}),
+        ...(seatStatus ? { seatStatus } : {}),
     };
 }
 /**
@@ -482,8 +552,15 @@ export function isWindowRejection(rl) {
     // and a real rejection carries one, but its absence must not turn a 104%
     // reading into a mere cool-down — under-parking a genuinely exhausted seat
     // re-probes it every minute, which is the loop #1254 removed.
-    const utils = [rl.util5h, rl.util7d, ...Object.values(rl.perModel7d)];
-    return utils.some((u) => u >= 0.99);
+    return isUnifiedWindowRejection(rl) || exhaustedBuckets(rl).length > 0;
+}
+/** The 429 showed one of the seat's own windows (5h or 7d) at the threshold. */
+export function isUnifiedWindowRejection(rl) {
+    return rl.util5h >= 0.99 || rl.util7d >= 0.99;
+}
+/** The per-model buckets this reading shows at the threshold. */
+export function exhaustedBuckets(rl) {
+    return Object.entries(rl.perModel7d).filter(([, u]) => u >= 0.99).map(([b]) => b);
 }
 /** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
 export const NON_WINDOW_REJECTION_COOLDOWN_MS = 60_000;
@@ -501,6 +578,8 @@ export const NON_WINDOW_REJECTION_COOLDOWN_MS = 60_000;
  * bucket is captured automatically the moment Anthropic starts emitting it —
  * this function is what lets routing USE it).
  */
+/** The families `modelFamily` recognises — a per-model bucket named for one (`7d_sonnet`) binds it by name. */
+export const KNOWN_FAMILIES = ['opus', 'sonnet', 'haiku', 'fable'];
 export function modelFamily(modelId) {
     if (!modelId)
         return null;
@@ -599,6 +678,22 @@ export function expireElapsedWindow(snapshot, now = Date.now()) {
     return snapshot;
 }
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+/** The families `buckets` bind on this snapshot — the inverse of `bucketsBindingFamily`, for reporting. */
+export function familiesBoundToBuckets(snapshot, buckets) {
+    const out = [];
+    const add = (f) => { if (!out.includes(f))
+        out.push(f); };
+    for (const b of buckets) {
+        if (KNOWN_FAMILIES.includes(b))
+            add(b);
+        for (const f of WIRE_BUCKET_BINDINGS[b] ?? [])
+            add(f);
+        for (const [f, bound] of Object.entries(snapshot.boundBuckets ?? {}))
+            if (bound.includes(b))
+                add(f);
+    }
+    return out;
+}
 export function bucketsBindingFamily(snapshot, family) {
     const out = [family];
     for (const [bucket, families] of Object.entries(WIRE_BUCKET_BINDINGS)) {
@@ -827,7 +922,7 @@ export class AccountPool {
             return null;
         const now = Date.now();
         const all = [...this.accounts.values()];
-        const eligible = all.filter(a => isAccountEligible(a, now));
+        const eligible = all.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
             if (this.strategy === 'fill-first') {
                 const first = pickFillFirst(eligible, family, this.headroomFloor);
@@ -853,7 +948,7 @@ export class AccountPool {
         // What is left — a rejection with no stated reset (nothing to expire, so
         // asking is the only way back) or an expiring token — is tried least-used
         // first, as before.
-        const probeable = all.filter(a => isProbeable(a, now));
+        const probeable = all.filter(a => isProbeable(a, now, family));
         if (probeable.length === 0)
             return null;
         return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
@@ -867,7 +962,7 @@ export class AccountPool {
      * pools stay on the existing unavailable handling (dario#1244, and the
      * review on dario#1254 that caught the mixed case).
      */
-    parkedUntil(now = Date.now()) {
+    parkedUntil(now = Date.now(), family) {
         if (this.accounts.size === 0)
             return null;
         const all = [...this.accounts.values()];
@@ -878,10 +973,10 @@ export class AccountPool {
         // 429 again (dario#1264 review). An auth cool-down or an expired token
         // still does NOT count — those are not rate limits and must not be
         // reported, or cooled, as if they were.
-        if (!all.every(a => isParkedInLiveWindow(a, now) || isCoolingAfterRejection(a, now)))
+        if (!all.every(a => isParkedInLiveWindow(a, now, family) || isCoolingAfterRejection(a, now)))
             return null;
-        return Math.min(...all.map(a => isParkedInLiveWindow(a, now)
-            ? a.rateLimit.reset * 1000
+        return Math.min(...all.map(a => isParkedInLiveWindow(a, now, family)
+            ? (isBucketScopedRejection(a.rateLimit) ? (a.rateLimit.parkedBucketsUntil ?? a.rateLimit.reset * 1000) : a.rateLimit.reset * 1000)
             : a.rateLimit.cooldownUntil ?? now));
     }
     /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
@@ -912,7 +1007,7 @@ export class AccountPool {
         if (binding) {
             const bound = this.accounts.get(binding.alias);
             if (bound
-                && isAccountEligible(bound, now)
+                && isAccountEligible(bound, now, family)
                 && computeHeadroom(bound.rateLimit, family) > this.headroomFloor) {
                 // Refresh the idle timer. A session that keeps taking turns must never
                 // be reaped or rebound while active — that would strand its warm prompt
@@ -990,7 +1085,7 @@ export class AccountPool {
             return null;
         const now = Date.now();
         const candidates = [...this.accounts.values()].filter(a => !excluded.has(a.alias));
-        const eligible = candidates.filter(a => isAccountEligible(a, now));
+        const eligible = candidates.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
             // Fill-first failover keeps the fill order: the next account tried
             // after a 429 is the next alias in line, not the max-headroom seat —
@@ -1007,7 +1102,7 @@ export class AccountPool {
         // parked inside a live window is not one of them — on the dario#1244
         // gateway every request walked all six parked seats, six guaranteed 429s
         // a request. Cool-downs are skipped for the same reason.
-        const probeable = candidates.filter(a => isProbeable(a, now));
+        const probeable = candidates.filter(a => isProbeable(a, now, family));
         if (probeable.length > 0) {
             return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
         }
@@ -1017,7 +1112,7 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.rateLimit = withBoundBuckets(account.rateLimit, snapshot);
+        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, snapshot), snapshot.updatedAt || Date.now());
         account.adoptedFrom = undefined;
         account.requestCount++;
     }
@@ -1042,14 +1137,30 @@ export class AccountPool {
         // the upstream's own `retry-after`, or a minute, and stays probeable.
         const exhausted = isWindowRejection(snapshot);
         const merged = withBoundBuckets(account.rateLimit, snapshot);
-        account.rateLimit = exhausted
-            ? { ...merged, status: 'rejected', exhausted: true }
-            : {
+        // A 429 whose only exhausted reading is a per-model bucket, with the
+        // seat's own windows under the threshold, parks that bucket's families
+        // and nothing else (dario#1262 follow-up, 2026-09-21): a Pro seat at
+        // `5h 3%, 7d 83%, 7d_oi 1.02 rejected` had refused Fable — metered on the
+        // included-overage credit — while answering Opus 200 on the very next
+        // request, and the old seat-wide park took it out of rotation for every
+        // model until the 7-day reset, three days out.
+        const buckets = exhausted && !isUnifiedWindowRejection(snapshot) ? exhaustedBuckets(snapshot) : [];
+        account.rateLimit = buckets.length > 0
+            ? {
                 ...merged,
                 status: 'rejected',
-                exhausted: false,
-                cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),
-            };
+                exhausted: true,
+                parkedBuckets: buckets,
+                parkedBucketsUntil: snapshot.reset > 0 ? snapshot.reset * 1000 : now + NON_WINDOW_REJECTION_COOLDOWN_MS,
+            }
+            : exhausted
+                ? { ...merged, status: 'rejected', exhausted: true, parkedBuckets: undefined, parkedBucketsUntil: undefined }
+                : {
+                    ...merged,
+                    status: 'rejected',
+                    exhausted: false,
+                    cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),
+                };
         account.adoptedFrom = undefined;
         account.rejectedCount++;
         account.lastRejectedAt = now;

package/dist/proxy.js

@@ -13,7 +13,7 @@ import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMa
 import { stampCch, hasCchSeed } from './cch.js';
 import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { Analytics, billingBucketFromClaim, costOfTokens, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
@@ -2550,6 +2550,7 @@ export async function startProxy(opts = {}) {
                             requestCount: a.requestCount,
                             rejectedCount: a.rejectedCount,
                             lastRejectedAt: a.lastRejectedAt ?? null,
+                            parkedBuckets: activeParkedBuckets(a.rateLimit, snapNow),
                             organizationId: a.organizationId ?? null,
                             sharesWindowWith: peers.get(a.alias) ?? [],
                             sameAccountAs: peers.get(a.alias) ?? [],
@@ -2685,6 +2686,10 @@ export async function startProxy(opts = {}) {
                     // parked seat no longer reads as one that was never called.
                     rejectedCount: a.rejectedCount,
                     lastRejectedAt: a.lastRejectedAt ?? null,
+                    // Per-model buckets keeping their families off this seat while the
+                    // seat itself still serves (`7d_oi` → fable on a Pro seat whose
+                    // included overage is spent). Empty when nothing is parked that way.
+                    parkedBuckets: activeParkedBuckets(a.rateLimit, now),
                     // Which organization the token belongs to, who the token IS (OAuth
                     // account uuid, masked email), and which other seats are the same
                     // account — one subscription under several aliases (dario#1244,
@@ -3096,6 +3101,11 @@ export async function startProxy(opts = {}) {
         // before that point they remain at their initial values, which is
         // also exactly what we want to log on early-failure paths.
         let requestModel = '';
+        // The Claude family the pool is asked to serve, known once the body's
+        // model is read (before `selectPoolAccount()` runs): a seat parked on a
+        // per-model bucket is off for that family only, so selection, the key's
+        // preferred seat and the all-parked answer all ask with it.
+        let requestFamily = null;
         let detectedClientForLog;
         let preserveToolsEffective = Boolean(opts.preserveTools);
         // Per-request: did isGenuineCCClient recognise the caller as real Claude
@@ -3285,15 +3295,15 @@ export async function startProxy(opts = {}) {
                 // eligible right now, else the pool picks as usual. Failover
                 // mid-request is unchanged either way — a preference, not a pin.
                 const preferredSeat = requestAuth.key?.seat ? (pool.get(requestAuth.key.seat) ?? null) : null;
-                keySeatTaken = preferredSeat !== null && isAccountEligible(preferredSeat, Date.now());
-                poolAccount = keySeatTaken ? preferredSeat : pool.select();
+                keySeatTaken = preferredSeat !== null && isAccountEligible(preferredSeat, Date.now(), requestFamily);
+                poolAccount = keySeatTaken ? preferredSeat : pool.select(requestFamily);
                 if (poolAccount)
                     poolParkedAnnounced = false;
                 // Every seat parked inside a live window (dario#1244): cool the
                 // provider to the earliest reset so a fallback chain sees the Claude
                 // half as what it is, say so once, and — unless a fallback is armed —
                 // answer the client here instead of spending a probe that can only 429.
-                const parkedUntil = poolAccount ? null : pool.parkedUntil();
+                const parkedUntil = poolAccount ? null : pool.parkedUntil(Date.now(), requestFamily);
                 if (parkedUntil !== null) {
                     providerCooldowns.note('claude', parkedUntil - Date.now());
                     if (!poolParkedAnnounced) {
@@ -3771,6 +3781,7 @@ export async function startProxy(opts = {}) {
                     // Reassignable: the codex effort-suffix strip below rewrites it, and
                     // every routing decision after that point must see the stripped name.
                     let rawModel = (peek.model || '').toString();
+                    requestFamily = modelFamily(rawModel);
                     // Credentials are re-read per request (not cached at startup) because
                     // a refresh rotates them on disk; getFreshCodexAccount refreshes when
                     // inside the expiry buffer, collapsing concurrent refreshes per alias.
@@ -4217,7 +4228,7 @@ export async function startProxy(opts = {}) {
             if (!upstreamApiKey && !poolAccount) {
                 // A fallback was armed but nothing could serve, and the pool itself is
                 // parked: the exact reset beats a cool-down estimate (dario#1244).
-                const parkedNow = pool.parkedUntil();
+                const parkedNow = pool.parkedUntil(Date.now(), requestFamily);
                 if (parkedNow !== null) {
                     writePoolParked(parkedNow);
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.10.0",
+  "version": "6.10.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {