@askalf/dario 6.9.3 → 6.10.1

package/dist/ledger.js

@@ -241,6 +241,31 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
     }
     return result;
 }
+/**
+ * What one consumer has used so far TODAY (UTC), priced the same way as the
+ * headline: covered and metered rows both count, because a budget is about the
+ * traffic a key caused, not about who paid for it. Tokens are all four buckets.
+ * The key-budget check (src/keys.ts budgetVerdict) reads this per request.
+ */
+export function consumerDayUsage(file, consumer, now = Date.now()) {
+    const day = dayKey(now);
+    const models = file.consumers?.[day]?.[consumer];
+    const out = { usd: 0, tokens: 0, requests: 0 };
+    if (!models)
+        return out;
+    const at = dayMs(day);
+    for (const [model, row] of Object.entries(models)) {
+        for (const cell of [row.covered, row.metered]) {
+            if (!cell)
+                continue;
+            out.usd += costOfTokens(model, at, cell);
+            out.tokens += cell.inputTokens + cell.outputTokens + cell.cacheReadTokens + cell.cacheCreateTokens;
+            out.requests += cell.requests;
+        }
+    }
+    out.usd = round(out.usd);
+    return out;
+}
 function addTokens(into, cell) {
     into.inputTokens += cell.inputTokens;
     into.outputTokens += cell.outputTokens;
@@ -405,6 +430,10 @@ export class Ledger {
     summary(now = Date.now()) {
         return summarizeLedger(this.file, this.path, now);
     }
+    /** Today's usage for one consumer — the key-budget check's input. */
+    consumerToday(consumer, now = Date.now()) {
+        return consumerDayUsage(this.file, consumer, now);
+    }
     /** The raw per-day table, for /analytics/ledger. */
     snapshot() {
         return JSON.parse(JSON.stringify(this.file));

package/dist/metrics.d.ts

@@ -19,6 +19,13 @@ export interface MetricsInput {
     /** Most recent records, newest last — the latency quantiles come from these. */
     recent: readonly RequestRecord[];
     version: string;
+    /** Per-key daily budgets and today's use (keys with a budget only); absent when keys or the ledger are off. */
+    budgets?: Record<string, {
+        usdPerDay: number | null;
+        tokensPerDay: number | null;
+        usedUsd: number;
+        usedTokens: number;
+    }>;
 }
 /** Nearest-rank quantile over a sorted ascending array. */
 export declare function quantile(sorted: readonly number[], q: number): number;

package/dist/metrics.js

@@ -117,6 +117,14 @@ export function renderPrometheus(input) {
             out.push(`${fam.name}_count ${vals.length}`);
         }
     }
+    // ---- per-key daily budgets (dario#1318 follow-up) ----------------------
+    const budgets = Object.entries(input.budgets ?? {});
+    if (budgets.length > 0) {
+        metric('dario_key_budget_usd_per_day', 'Daily API-equivalent cap per named key, USD (keys with a dollar cap).', budgets.filter(([, b]) => b.usdPerDay !== null).map(([key, b]) => [{ key }, b.usdPerDay]));
+        metric('dario_key_budget_used_usd', 'API-equivalent spend per budgeted key today (UTC), USD.', budgets.map(([key, b]) => [{ key }, b.usedUsd]));
+        metric('dario_key_budget_tokens_per_day', 'Daily token cap per named key (keys with a token cap).', budgets.filter(([, b]) => b.tokensPerDay !== null).map(([key, b]) => [{ key }, b.tokensPerDay]));
+        metric('dario_key_budget_used_tokens', 'Tokens per budgeted key today (UTC), all buckets.', budgets.map(([key, b]) => [{ key }, b.usedTokens]));
+    }
     // ---- predictions -------------------------------------------------------
     const p = summary.predictions;
     if (p.estimatedExhaustionMinutes !== null) {

package/dist/pool.d.ts

@@ -66,6 +66,27 @@ export interface RateLimitSnapshot {
      * static seed and the evidence.
      */
     boundBuckets?: Record<string, string[]>;
+    /**
+     * Set by `markRejected` when the 429 named an exhausted PER-MODEL bucket
+     * while the unified 5h/7d windows still had room — `['oi']` for a Pro seat
+     * whose included-overage credit is spent (that is what Fable is metered on)
+     * while Opus keeps serving on the same seat. Only the families those buckets
+     * bind (`bucketsBindingFamily`) are kept off the seat, until
+     * `parkedBucketsUntil` (epoch ms, the bucket's own reset). Carried across
+     * later readings by `withParkedBuckets`: an Opus response carries no `7d_oi`
+     * header, so without that the next Fable request would re-learn the same
+     * 429. Absent (or past its reset) on every other snapshot.
+     */
+    parkedBuckets?: string[];
+    parkedBucketsUntil?: number;
+    /**
+     * The seat's OWN windows' status — the worse of `5h-status` and `7d-status`
+     * on the wire (`allowed` / `allowed_warning` / `rejected`), when the response
+     * carried them. `status` is the request's verdict; on a bucket-scoped 429 the
+     * two differ (`rejected` for Fable, `allowed_warning` for the seat), and the
+     * operator surfaces report this one for such a seat, since it is serving.
+     */
+    seatStatus?: string;
 }
 export declare const EMPTY_SNAPSHOT: RateLimitSnapshot;
 /** Freshness of an account's utilisation reading — see `utilFreshness`. */
@@ -278,9 +299,25 @@ export declare function rateLimitWindowPassed(rl: RateLimitSnapshot, now?: numbe
  * exactly the state this is: no current observation.
  */
 export declare function reportedAccountStatus(account: PoolAccount, now?: number): string;
-export declare function accountIneligibility(account: PoolAccount, now?: number): AccountIneligibility | null;
+export declare function accountIneligibility(account: PoolAccount, now?: number, family?: string | null): AccountIneligibility | null;
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
-export declare function isAccountEligible(account: PoolAccount, now?: number): boolean;
+export declare function isAccountEligible(account: PoolAccount, now?: number, family?: string | null): boolean;
+/**
+ * A rejection whose only exhausted reading was a per-model bucket (see
+ * `RateLimitSnapshot.parkedBuckets`): the seat itself has room, one family
+ * does not.
+ */
+export declare function isBucketScopedRejection(rl: RateLimitSnapshot): boolean;
+/** The buckets still parking families on this snapshot right now. */
+export declare function activeParkedBuckets(rl: RateLimitSnapshot, now?: number): string[];
+/**
+ * Is `family` kept off this seat by a parked per-model bucket? False with no
+ * family: the buckets are per family, and a caller with none to name is asking
+ * about the seat, which those buckets do not park.
+ */
+export declare function familyParkedOnBuckets(rl: RateLimitSnapshot, family: string | null | undefined, now?: number): boolean;
+/** `next` with the parked buckets `prev` still holds carried forward (see `RateLimitSnapshot.parkedBuckets`). */
+export declare function withParkedBuckets(prev: RateLimitSnapshot, next: RateLimitSnapshot, now?: number): RateLimitSnapshot;
 /**
  * A seat parked on a 429 whose stated window has not rolled yet — the one
  * state the router must never re-probe: the 429 named the reset, the clock
@@ -288,7 +325,7 @@ export declare function isAccountEligible(account: PoolAccount, now?: number): b
  * stated reset is NOT this: with nothing to expire, asking is the only way
  * back, so it stays probeable (dario#1244).
  */
-export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+export declare function isParkedInLiveWindow(account: PoolAccount, now?: number, family?: string | null): boolean;
 /**
  * A seat rejected by a 429 that named no exhausted window, still inside the
  * cool-down that rejection earned (see `RateLimitSnapshot.exhausted`). It is
@@ -314,7 +351,7 @@ export declare function isCoolingAfterRejection(account: PoolAccount, now?: numb
  * token, which no amount of waiting fixes and which these paths handle
  * separately.
  */
-export declare function isProbeable(account: PoolAccount, now?: number): boolean;
+export declare function isProbeable(account: PoolAccount, now?: number, family?: string | null): boolean;
 /**
  * The operator's next step for one seat, next to `status` on both listings
  * (dario#1244 — "do I have to re-login?" should not need the docs table).
@@ -399,6 +436,10 @@ export declare function parseRateLimits(headers: Headers, family?: string | null
  * seat's window rolls. 0.99 rather than 1 absorbs float formatting.
  */
 export declare function isWindowRejection(rl: RateLimitSnapshot): boolean;
+/** The 429 showed one of the seat's own windows (5h or 7d) at the threshold. */
+export declare function isUnifiedWindowRejection(rl: RateLimitSnapshot): boolean;
+/** The per-model buckets this reading shows at the threshold. */
+export declare function exhaustedBuckets(rl: RateLimitSnapshot): string[];
 /** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
 export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
 /**
@@ -415,6 +456,8 @@ export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
  * bucket is captured automatically the moment Anthropic starts emitting it —
  * this function is what lets routing USE it).
  */
+/** The families `modelFamily` recognises — a per-model bucket named for one (`7d_sonnet`) binds it by name. */
+export declare const KNOWN_FAMILIES: readonly string[];
 export declare function modelFamily(modelId: string | null | undefined): string | null;
 /**
  * Compute headroom for a single account given its rate-limit snapshot.
@@ -473,6 +516,8 @@ export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: st
  */
 export declare function expireElapsedWindow(snapshot: RateLimitSnapshot, now?: number): RateLimitSnapshot;
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+/** The families `buckets` bind on this snapshot — the inverse of `bucketsBindingFamily`, for reporting. */
+export declare function familiesBoundToBuckets(snapshot: RateLimitSnapshot, buckets: readonly string[]): string[];
 export declare function bucketsBindingFamily(snapshot: RateLimitSnapshot, family: string): string[];
 /**
  * Default headroom floor under which an account is treated as "effectively
@@ -570,7 +615,7 @@ export declare class AccountPool {
      * pools stay on the existing unavailable handling (dario#1244, and the
      * review on dario#1254 that caught the mixed case).
      */
-    parkedUntil(now?: number): number | null;
+    parkedUntil(now?: number, family?: string | null): number | null;
     /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now?: number): number;
     /**

package/dist/pool.js

@@ -102,6 +102,12 @@ export function maskEmail(email) {
     return `${(user ?? '').slice(0, 2)}***@${domain ?? ''}`;
 }
 export function describeRejection(rl, now = Date.now()) {
+    if (isBucketScopedRejection(rl)) {
+        const buckets = (rl.parkedBuckets ?? []).map((b) => `7d_${b}`).join(', ');
+        const families = familiesBoundToBuckets(rl, rl.parkedBuckets ?? []);
+        const who = families.length > 0 ? families.join('/') : 'the families it binds';
+        return `${describeRateLimitSnapshot(rl, now)} — ${buckets} exhausted: ${who} parked on this seat until it rolls, other families still served`;
+    }
     if (rl.exhausted !== false)
         return `${describeRateLimitSnapshot(rl, now)} — parked until the window rolls`;
     const { resetInMs } = rateLimitWindow(rl, now);
@@ -249,14 +255,29 @@ export function reportedAccountStatus(account, now = Date.now()) {
         return 'auth-cooldown';
     if (account.rateLimit.status === 'rejected' && rateLimitWindowPassed(account.rateLimit, now))
         return 'unknown';
+    // A bucket-scoped rejection is one family's verdict; the seat is serving the
+    // rest, and its status is its own windows' reading (or unobserved).
+    if (isBucketScopedRejection(account.rateLimit))
+        return account.rateLimit.seatStatus ?? 'unknown';
     return account.rateLimit.status;
 }
-export function accountIneligibility(account, now = Date.now()) {
+export function accountIneligibility(account, now = Date.now(), family) {
     // A rejection outlives its own window unless it is allowed to expire:
     // nothing refreshes a parked account's snapshot, because being parked is
-    // what stops it being sent requests.
-    if (account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now))
+    // what stops it being sent requests. A rejection scoped to per-model
+    // buckets keeps only the families they bind off the seat; with no family
+    // to ask about (the seat-level surfaces) it is not a seat-wide rejection.
+    if (account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now)) {
+        if (!isBucketScopedRejection(account.rateLimit))
+            return 'rate-limited';
+        if (familyParkedOnBuckets(account.rateLimit, family, now))
+            return 'rate-limited';
+    }
+    else if (familyParkedOnBuckets(account.rateLimit, family, now)) {
+        // The seat served something since (an Opus 200 replaced the reading) and
+        // the parked buckets were carried forward: still off for this family.
         return 'rate-limited';
+    }
     if (account.expiresAt <= now + TOKEN_EXPIRY_MARGIN_MS)
         return 'token-expired';
     if (isInAuthCooldown(account, now))
@@ -264,8 +285,44 @@ export function accountIneligibility(account, now = Date.now()) {
     return null;
 }
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
-export function isAccountEligible(account, now = Date.now()) {
-    return accountIneligibility(account, now) === null;
+export function isAccountEligible(account, now = Date.now(), family) {
+    return accountIneligibility(account, now, family) === null;
+}
+/**
+ * A rejection whose only exhausted reading was a per-model bucket (see
+ * `RateLimitSnapshot.parkedBuckets`): the seat itself has room, one family
+ * does not.
+ */
+export function isBucketScopedRejection(rl) {
+    return rl.status === 'rejected' && rl.exhausted !== false && (rl.parkedBuckets?.length ?? 0) > 0;
+}
+/** The buckets still parking families on this snapshot right now. */
+export function activeParkedBuckets(rl, now = Date.now()) {
+    if (!rl.parkedBuckets || rl.parkedBuckets.length === 0)
+        return [];
+    if (rl.parkedBucketsUntil === undefined || rl.parkedBucketsUntil <= now)
+        return [];
+    return rl.parkedBuckets;
+}
+/**
+ * Is `family` kept off this seat by a parked per-model bucket? False with no
+ * family: the buckets are per family, and a caller with none to name is asking
+ * about the seat, which those buckets do not park.
+ */
+export function familyParkedOnBuckets(rl, family, now = Date.now()) {
+    if (!family)
+        return false;
+    const parked = activeParkedBuckets(rl, now);
+    if (parked.length === 0)
+        return false;
+    return bucketsBindingFamily(rl, family).some((b) => parked.includes(b));
+}
+/** `next` with the parked buckets `prev` still holds carried forward (see `RateLimitSnapshot.parkedBuckets`). */
+export function withParkedBuckets(prev, next, now = Date.now()) {
+    const parked = activeParkedBuckets(prev, now);
+    if (parked.length === 0)
+        return next;
+    return { ...next, parkedBuckets: parked, parkedBucketsUntil: prev.parkedBucketsUntil };
 }
 /**
  * A seat parked on a 429 whose stated window has not rolled yet — the one
@@ -274,12 +331,18 @@ export function isAccountEligible(account, now = Date.now()) {
  * stated reset is NOT this: with nothing to expire, asking is the only way
  * back, so it stays probeable (dario#1244).
  */
-export function isParkedInLiveWindow(account, now = Date.now()) {
+export function isParkedInLiveWindow(account, now = Date.now(), family) {
     const rl = account.rateLimit;
     // A non-exhausted rejection is never "parked in a live window": its reset
     // was not this seat's window, and once its cool-down passes asking is the
     // way back (the all-exhausted branch may probe it even sooner).
-    return rl.status === 'rejected' && rl.exhausted !== false && rl.reset > 0 && rl.reset * 1000 > now;
+    if (!(rl.status === 'rejected' && rl.exhausted !== false && rl.reset > 0 && rl.reset * 1000 > now))
+        return false;
+    // A bucket-scoped rejection parks its families, not the seat: for any
+    // other family, or for no family at all, the window is not this seat's.
+    if (isBucketScopedRejection(rl))
+        return familyParkedOnBuckets(rl, family, now);
+    return true;
 }
 /**
  * A seat rejected by a 429 that named no exhausted window, still inside the
@@ -310,9 +373,9 @@ export function isCoolingAfterRejection(account, now = Date.now()) {
  * token, which no amount of waiting fixes and which these paths handle
  * separately.
  */
-export function isProbeable(account, now = Date.now()) {
+export function isProbeable(account, now = Date.now(), family) {
     return !isInAuthCooldown(account, now)
-        && !isParkedInLiveWindow(account, now)
+        && !isParkedInLiveWindow(account, now, family)
         && !isCoolingAfterRejection(account, now);
 }
 /**
@@ -437,6 +500,12 @@ export function parseRateLimits(headers, family) {
             rejectedBuckets.push(st[1].toLowerCase());
     }
     const claim = get('representative-claim') || 'unknown';
+    // The seat's own windows, when the response names them (see `seatStatus`).
+    const windowStatuses = ['5h-status', '7d-status'].map((k) => get(k).trim().toLowerCase()).filter(Boolean);
+    const seatStatus = windowStatuses.length === 0 ? undefined
+        : windowStatuses.includes('rejected') ? 'rejected'
+            : windowStatuses.includes('allowed_warning') ? 'allowed_warning'
+                : windowStatuses[0];
     // What THIS response proved about which bucket binds the request's family
     // (see WIRE_BUCKET_BINDINGS). Only with a family to attribute to, and only
     // on the wire's own say-so: an overage-included claim means the request was
@@ -465,6 +534,7 @@ export function parseRateLimits(headers, family) {
         updatedAt: Date.now(),
         retryAfterMs: parseRetryAfterMs(headers.get('retry-after')),
         ...(boundBuckets ? { boundBuckets } : {}),
+        ...(seatStatus ? { seatStatus } : {}),
     };
 }
 /**
@@ -482,8 +552,15 @@ export function isWindowRejection(rl) {
     // and a real rejection carries one, but its absence must not turn a 104%
     // reading into a mere cool-down — under-parking a genuinely exhausted seat
     // re-probes it every minute, which is the loop #1254 removed.
-    const utils = [rl.util5h, rl.util7d, ...Object.values(rl.perModel7d)];
-    return utils.some((u) => u >= 0.99);
+    return isUnifiedWindowRejection(rl) || exhaustedBuckets(rl).length > 0;
+}
+/** The 429 showed one of the seat's own windows (5h or 7d) at the threshold. */
+export function isUnifiedWindowRejection(rl) {
+    return rl.util5h >= 0.99 || rl.util7d >= 0.99;
+}
+/** The per-model buckets this reading shows at the threshold. */
+export function exhaustedBuckets(rl) {
+    return Object.entries(rl.perModel7d).filter(([, u]) => u >= 0.99).map(([b]) => b);
 }
 /** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
 export const NON_WINDOW_REJECTION_COOLDOWN_MS = 60_000;
@@ -501,6 +578,8 @@ export const NON_WINDOW_REJECTION_COOLDOWN_MS = 60_000;
  * bucket is captured automatically the moment Anthropic starts emitting it —
  * this function is what lets routing USE it).
  */
+/** The families `modelFamily` recognises — a per-model bucket named for one (`7d_sonnet`) binds it by name. */
+export const KNOWN_FAMILIES = ['opus', 'sonnet', 'haiku', 'fable'];
 export function modelFamily(modelId) {
     if (!modelId)
         return null;
@@ -599,6 +678,22 @@ export function expireElapsedWindow(snapshot, now = Date.now()) {
     return snapshot;
 }
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+/** The families `buckets` bind on this snapshot — the inverse of `bucketsBindingFamily`, for reporting. */
+export function familiesBoundToBuckets(snapshot, buckets) {
+    const out = [];
+    const add = (f) => { if (!out.includes(f))
+        out.push(f); };
+    for (const b of buckets) {
+        if (KNOWN_FAMILIES.includes(b))
+            add(b);
+        for (const f of WIRE_BUCKET_BINDINGS[b] ?? [])
+            add(f);
+        for (const [f, bound] of Object.entries(snapshot.boundBuckets ?? {}))
+            if (bound.includes(b))
+                add(f);
+    }
+    return out;
+}
 export function bucketsBindingFamily(snapshot, family) {
     const out = [family];
     for (const [bucket, families] of Object.entries(WIRE_BUCKET_BINDINGS)) {
@@ -827,7 +922,7 @@ export class AccountPool {
             return null;
         const now = Date.now();
         const all = [...this.accounts.values()];
-        const eligible = all.filter(a => isAccountEligible(a, now));
+        const eligible = all.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
             if (this.strategy === 'fill-first') {
                 const first = pickFillFirst(eligible, family, this.headroomFloor);
@@ -853,7 +948,7 @@ export class AccountPool {
         // What is left — a rejection with no stated reset (nothing to expire, so
         // asking is the only way back) or an expiring token — is tried least-used
         // first, as before.
-        const probeable = all.filter(a => isProbeable(a, now));
+        const probeable = all.filter(a => isProbeable(a, now, family));
         if (probeable.length === 0)
             return null;
         return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
@@ -867,7 +962,7 @@ export class AccountPool {
      * pools stay on the existing unavailable handling (dario#1244, and the
      * review on dario#1254 that caught the mixed case).
      */
-    parkedUntil(now = Date.now()) {
+    parkedUntil(now = Date.now(), family) {
         if (this.accounts.size === 0)
             return null;
         const all = [...this.accounts.values()];
@@ -878,10 +973,10 @@ export class AccountPool {
         // 429 again (dario#1264 review). An auth cool-down or an expired token
         // still does NOT count — those are not rate limits and must not be
         // reported, or cooled, as if they were.
-        if (!all.every(a => isParkedInLiveWindow(a, now) || isCoolingAfterRejection(a, now)))
+        if (!all.every(a => isParkedInLiveWindow(a, now, family) || isCoolingAfterRejection(a, now)))
             return null;
-        return Math.min(...all.map(a => isParkedInLiveWindow(a, now)
-            ? a.rateLimit.reset * 1000
+        return Math.min(...all.map(a => isParkedInLiveWindow(a, now, family)
+            ? (isBucketScopedRejection(a.rateLimit) ? (a.rateLimit.parkedBucketsUntil ?? a.rateLimit.reset * 1000) : a.rateLimit.reset * 1000)
             : a.rateLimit.cooldownUntil ?? now));
     }
     /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
@@ -912,7 +1007,7 @@ export class AccountPool {
         if (binding) {
             const bound = this.accounts.get(binding.alias);
             if (bound
-                && isAccountEligible(bound, now)
+                && isAccountEligible(bound, now, family)
                 && computeHeadroom(bound.rateLimit, family) > this.headroomFloor) {
                 // Refresh the idle timer. A session that keeps taking turns must never
                 // be reaped or rebound while active — that would strand its warm prompt
@@ -990,7 +1085,7 @@ export class AccountPool {
             return null;
         const now = Date.now();
         const candidates = [...this.accounts.values()].filter(a => !excluded.has(a.alias));
-        const eligible = candidates.filter(a => isAccountEligible(a, now));
+        const eligible = candidates.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
             // Fill-first failover keeps the fill order: the next account tried
             // after a 429 is the next alias in line, not the max-headroom seat —
@@ -1007,7 +1102,7 @@ export class AccountPool {
         // parked inside a live window is not one of them — on the dario#1244
         // gateway every request walked all six parked seats, six guaranteed 429s
         // a request. Cool-downs are skipped for the same reason.
-        const probeable = candidates.filter(a => isProbeable(a, now));
+        const probeable = candidates.filter(a => isProbeable(a, now, family));
         if (probeable.length > 0) {
             return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
         }
@@ -1017,7 +1112,7 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.rateLimit = withBoundBuckets(account.rateLimit, snapshot);
+        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, snapshot), snapshot.updatedAt || Date.now());
         account.adoptedFrom = undefined;
         account.requestCount++;
     }
@@ -1042,14 +1137,30 @@ export class AccountPool {
         // the upstream's own `retry-after`, or a minute, and stays probeable.
         const exhausted = isWindowRejection(snapshot);
         const merged = withBoundBuckets(account.rateLimit, snapshot);
-        account.rateLimit = exhausted
-            ? { ...merged, status: 'rejected', exhausted: true }
-            : {
+        // A 429 whose only exhausted reading is a per-model bucket, with the
+        // seat's own windows under the threshold, parks that bucket's families
+        // and nothing else (dario#1262 follow-up, 2026-09-21): a Pro seat at
+        // `5h 3%, 7d 83%, 7d_oi 1.02 rejected` had refused Fable — metered on the
+        // included-overage credit — while answering Opus 200 on the very next
+        // request, and the old seat-wide park took it out of rotation for every
+        // model until the 7-day reset, three days out.
+        const buckets = exhausted && !isUnifiedWindowRejection(snapshot) ? exhaustedBuckets(snapshot) : [];
+        account.rateLimit = buckets.length > 0
+            ? {
                 ...merged,
                 status: 'rejected',
-                exhausted: false,
-                cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),
-            };
+                exhausted: true,
+                parkedBuckets: buckets,
+                parkedBucketsUntil: snapshot.reset > 0 ? snapshot.reset * 1000 : now + NON_WINDOW_REJECTION_COOLDOWN_MS,
+            }
+            : exhausted
+                ? { ...merged, status: 'rejected', exhausted: true, parkedBuckets: undefined, parkedBucketsUntil: undefined }
+                : {
+                    ...merged,
+                    status: 'rejected',
+                    exhausted: false,
+                    cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),
+                };
         account.adoptedFrom = undefined;
         account.rejectedCount++;
         account.lastRejectedAt = now;