cartethyia 2.4.5 → 2.4.6

package/src/console/observability/store.ts

@@ -8,7 +8,7 @@ import {
   type TelemetryEventRecord,
 } from "../../observability/event-log";
 import { isGatewayError } from "../../observability/telemetry-status";
-import { cachedRead } from "../shared/read-through-cache";
+import { cachedReadWithEtag, type CachedResult } from "../shared/read-through-cache";
 import { decodeDatedCursor, encodeCursor } from "../shared/cursor";
 import { CARTETHYIA_VERSION } from "../../version";
 import { CachedPreferencesReader, DrizzlePreferencesReader, type PreferencesReader } from "../../persistence/tenant-preferences";
@@ -298,8 +298,14 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     ),
   ) {}
 
-  async health(tenantId: string): Promise<SystemHealthResponse> {
-    return this.computeHealth(tenantId);
+  async health(tenantId: string): Promise<CachedResult<SystemHealthResponse>> {
+    // The only usage-family read that used to bypass both the 5 s in-process
+    // memo and the Redis read-through, so it re-parsed 24 hourly files every
+    // page load. Same 10 s TTL as `/system/usage`.
+    return this.readThroughWithEtag(
+      this.usageCacheKey(tenantId, "24h", "health"),
+      () => this.computeHealth(tenantId),
+    );
   }
 
   private async computeHealth(tenantId: string): Promise<SystemHealthResponse> {
@@ -401,8 +407,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
       avg_tokens_per_sec: avgTokensPerSec,
     };
   }
-  async usage(tenantId: string, period: string): Promise<UsageResponse> {
-    return this.readThrough(this.usageCacheKey(tenantId, period, "usage"), () =>
+  async usage(tenantId: string, period: string): Promise<CachedResult<UsageResponse>> {
+    return this.readThroughWithEtag(this.usageCacheKey(tenantId, period, "usage"), () =>
       this.computeUsage(tenantId, period),
     );
   }
@@ -415,9 +421,13 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     return `cartethyia:usage:v1:${shape}:${tenantId}:${period}`;
   }
 
-  /** Reads a usage response through Redis; computes when no cache is configured. */
-  private readThrough<T>(key: string, compute: () => Promise<T>): Promise<T> {
-    return cachedRead(this.redis, key, compute);
+  /**
+   * Reads a usage response through Redis — computing when no cache is
+   * configured — and returns the strong validator alongside it, so a repeated
+   * poll can be answered with a `304` instead of the whole payload.
+   */
+  private readThroughWithEtag<T>(key: string, compute: () => Promise<T>): Promise<CachedResult<T>> {
+    return cachedReadWithEtag(this.redis, key, compute);
   }
 
   private async computeUsage(tenantId: string, period: string): Promise<UsageResponse> {
@@ -467,8 +477,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     return promise;
   }
 
-  async usageSummary(tenantId: string, period: string): Promise<UsageSummaryResponse> {
-    return this.readThrough(this.usageCacheKey(tenantId, period, "summary"), () =>
+  async usageSummary(tenantId: string, period: string): Promise<CachedResult<UsageSummaryResponse>> {
+    return this.readThroughWithEtag(this.usageCacheKey(tenantId, period, "summary"), () =>
       this.computeSummary(tenantId, period),
     );
   }
@@ -527,8 +537,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     };
   }
 
-  async usageChart(tenantId: string, period: string): Promise<UsageChartResponse> {
-    return this.readThrough(this.usageCacheKey(tenantId, period, "chart"), () =>
+  async usageChart(tenantId: string, period: string): Promise<CachedResult<UsageChartResponse>> {
+    return this.readThroughWithEtag(this.usageCacheKey(tenantId, period, "chart"), () =>
       this.computeChart(tenantId, period),
     );
   }
@@ -568,8 +578,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     tenantId: string,
     dimension: UsageDimension,
     period: string,
-  ): Promise<UsageByResponse> {
-    return this.readThrough(this.usageCacheKey(tenantId, `${dimension}:${period}`, "by"), () =>
+  ): Promise<CachedResult<UsageByResponse>> {
+    return this.readThroughWithEtag(this.usageCacheKey(tenantId, `${dimension}:${period}`, "by"), () =>
       this.computeBy(tenantId, dimension, period),
     );
   }
@@ -676,8 +686,8 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     return new Map(keyRows.map((keyRow) => [keyRow.id, keyRow.label] as const));
   }
 
-  async usageCache(tenantId: string, period: string): Promise<UsageCacheResponse> {
-    return this.readThrough(this.usageCacheKey(tenantId, period, "cache"), () =>
+  async usageCache(tenantId: string, period: string): Promise<CachedResult<UsageCacheResponse>> {
+    return this.readThroughWithEtag(this.usageCacheKey(tenantId, period, "cache"), () =>
       this.computeCache(tenantId, period),
     );
   }
@@ -709,7 +719,7 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     period: string,
     limit: number,
     httpStatus?: number,
-  ): Promise<UsageRequestsResponse> {
+  ): Promise<CachedResult<UsageRequestsResponse>> {
     // Ask the reader for `limit` rows instead of folding the whole window and
     // slicing it. It stops at the newest file that fills the page, so the
     // console's most-polled endpoint no longer parses the retention window just
@@ -723,15 +733,29 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     });
     const rows = events.slice(0, limit);
     const hideClientIp = await shouldMaskClientIp(this.preferences, tenantId);
-    const keyIds = [...new Set(rows.map((row) => row.apiKeyId).filter((id): id is string => id !== null))];
-    const labels = await this.apiKeyLabels(tenantId, keyIds);
-    return {
-      items: rows.map((row) => {
-        const item = mapUsageRequestItem(row, hideClientIp);
-        const label = row.apiKeyId ? labels.get(row.apiKeyId) : undefined;
-        return label === undefined ? item : { ...item, apiKeyLabel: label };
-      }),
-    };
+    // Cached like its siblings, so a repeated poll costs a `304` instead of
+    // another read. The mask flag is part of the key: it is a privacy setting,
+    // so a page must never be served from an entry computed under the other
+    // value. The rows were already read above — this bounds the label lookup
+    // and the mapping, not the telemetry read.
+    return this.readThroughWithEtag(
+      this.usageCacheKey(
+        tenantId,
+        `${period}:${limit}:${httpStatus ?? "*"}:${hideClientIp}`,
+        "requests",
+      ),
+      async () => {
+        const keyIds = [...new Set(rows.map((row) => row.apiKeyId).filter((id): id is string => id !== null))];
+        const labels = await this.apiKeyLabels(tenantId, keyIds);
+        return {
+          items: rows.map((row) => {
+            const item = mapUsageRequestItem(row, hideClientIp);
+            const label = row.apiKeyId ? labels.get(row.apiKeyId) : undefined;
+            return label === undefined ? item : { ...item, apiKeyLabel: label };
+          }),
+        };
+      },
+    );
   }
   async usageRequestDetail(
     tenantId: string,
@@ -795,7 +819,19 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     cursor?: string,
   ): Promise<TelemetryEventListPage> {
     const before = decodeDatedCursor(cursor);
-    const events = await queryTelemetryEvents({ tenantId, ...(before ? {} : { limit: limit + 1 }) });
+    // The cursor becomes an `until` bound inside the query, so `limit` applies
+    // to every page and not only the first. Filtering after the read forced the
+    // previous shape: a cursor page had to fetch the whole window to know where
+    // it ended, so `limit` was dropped the moment a cursor appeared.
+    //
+    // `until` is inclusive while the cursor is exclusive, so rows at the exact
+    // cursor timestamp are still compared by id here — the cheap part of the
+    // predicate, now over one timestamp's worth of rows instead of the window.
+    const events = await queryTelemetryEvents({
+      tenantId,
+      limit: limit + 1,
+      ...(before === undefined ? {} : { until: new Date(before.createdAt) }),
+    });
     const rows = (before
       ? events.filter((event) => event.createdAt < before.createdAt || (event.createdAt === before.createdAt && event.id < before.id))
       : events
@@ -817,7 +853,11 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     includePayload = false,
     createdAt?: string,
   ): Promise<TelemetryEventDetail | undefined> {
-    const events = await queryTelemetryEvents({ tenantId });
+    // Matched by `id`, which is the field the list cursor encodes — not by
+    // `requestId`, which is a different column that merely defaults to the
+    // same value. Predicating on it lets the reader stop at the first hit
+    // instead of parsing the retention window to find one row.
+    const events = await queryTelemetryEvents({ tenantId, id: eventId });
     const event = events.find(
       (candidate) =>
         candidate.id === eventId && (createdAt === undefined || candidate.createdAt === createdAt),

package/src/console/providers/catalog/public-model-store.ts

@@ -104,16 +104,6 @@ function commonCost(entries: readonly unknown[]): unknown {
   return present.every((entry) => costSignature(entry) === signature) ? present[0] : undefined;
 }
 
-function matchesModelPrefix(
-  modelPrefix: string | undefined,
-  bareModelId: string,
-  qualifiedModelId?: string,
-): boolean {
-  const prefix = modelPrefix?.trim();
-  if (!prefix) return true;
-  return bareModelId.startsWith(prefix) || qualifiedModelId?.startsWith(prefix) === true;
-}
-
 /** Catalog metadata mirrored onto an alias or combo entry. */
 export interface ModelMetadata {
   readonly contextLimit: number | null;
@@ -153,15 +143,42 @@ export function resolveTargetIds(
   name: string,
   aliasTargets: ReadonlyMap<string, string>,
   comboMembers: ReadonlyMap<string, readonly string[]>,
-  seen: ReadonlySet<string> = new Set(),
+  seen: Set<string> = new Set(),
+): string[] {
+  return collectTargetIds(name, aliasTargets, comboMembers, seen);
+}
+
+/**
+ * Walks alias → combo → member with one mutable visited set.
+ *
+ * The previous form copied the whole set per edge (`new Set(seen).add(name)`),
+ * which is called per alias and per combo row over the whole catalog. Adding
+ * and removing on one set keeps the same cycle protection — each branch still
+ * sees its own ancestors — without an allocation per step.
+ */
+function collectTargetIds(
+  name: string,
+  aliasTargets: ReadonlyMap<string, string>,
+  comboMembers: ReadonlyMap<string, readonly string[]>,
+  seen: Set<string>,
 ): string[] {
   if (seen.has(name) || seen.size >= MAX_TARGET_DEPTH) return [];
-  const next = new Set(seen).add(name);
-  const members = comboMembers.get(name);
-  if (members) return members.flatMap((m) => resolveTargetIds(m, aliasTargets, comboMembers, next));
-  const target = aliasTargets.get(name);
-  if (target !== undefined) return resolveTargetIds(target, aliasTargets, comboMembers, next);
-  return [name];
+  seen.add(name);
+  try {
+    const members = comboMembers.get(name);
+    if (members) {
+      return members.flatMap((m) => collectTargetIds(m, aliasTargets, comboMembers, seen));
+    }
+    const target = aliasTargets.get(name);
+    if (target !== undefined) {
+      return collectTargetIds(target, aliasTargets, comboMembers, seen);
+    }
+    return [name];
+  } finally {
+    // Removing on the way out keeps `seen` meaning "ancestors on this path",
+    // so a name reachable by two sibling branches still resolves in both.
+    seen.delete(name);
+  }
 }
 
 /**
@@ -339,10 +356,21 @@ export class PublicModelCatalogStore {
     return result;
   }
 
+  /**
+   * Lists the models this key may see.
+   *
+   * `modelPrefix` is accepted and currently has NO effect on the result. It
+   * used to feed a `matchesModelPrefix(...) || isModelAllowed(...)` disjunct
+   * that was immediately followed by `isModelAllowed(...)` on its own — so the
+   * prefix could never add a row, and dropping it changes nothing. The
+   * parameter is kept so the call sites and the auth shape stay stable; if a
+   * real prefix filter is wanted later it needs to be an AND, not the OR it
+   * was written as.
+   */
   async listPublicModels(
     tenantId: string | null,
     snapshot: ApiKeyAuthorizationSnapshot,
-    modelPrefix?: string,
+    _modelPrefix?: string,
   ): Promise<AllowedModelEntry[]> {
     const providerScope =
       tenantId === null
@@ -407,40 +435,46 @@ export class PublicModelCatalogStore {
       if (typeof combo.name === "string") comboNames.add(combo.name);
     }
 
-    const modelEntries: AllowedModelEntry[] = rows
-      .filter((row) => {
-        // A provider is listed only when the tenant has an active account for
-        // it — the same rule the console model picker applies. A no-auth
-        // provider with nothing configured is not "set", so it stays hidden
-        // until the operator adds an account.
-        if (tenantId === null) return row.providerRequiresAccount === false;
-        return activeProviderIds.has(row.providerId);
-      })
-      .filter((row) =>
-        matchesModelPrefix(modelPrefix, row.modelId, `${row.providerId}/${row.modelId}`) ||
-        isModelAllowed(snapshot, row.modelId, row.providerId),
-      )
-      .filter((m) => isModelAllowed(snapshot, m.modelId, m.providerId))
-      .filter((m) => !shadowsAliasOrCombo(m, aliasTargets, comboNames, snapshot))
-      .map((m) => {
-        const capabilities = normalizeModalities(m.modalities);
-        return {
-          id: `${m.providerId}/${m.modelId}`,
-          object: "model" as const,
-          created: Math.floor(Date.now() / 1000),
-          owned_by: m.providerId,
-          ...(m.contextLimit != null ? { context_length: m.contextLimit } : {}),
-          ...(m.outputLimit != null ? { max_completion_tokens: m.outputLimit } : {}),
-          ...(capabilities ? { capabilities } : {}),
-          ...(m.reasoning ? { reasoning: true } : {}),
-          ...(m.toolCall ? { tool_call: true } : {}),
-          ...(m.cost != null ? { cost: m.cost } : {}),
-          // Only a non-`llm` row is labelled: absence already means "chat wire".
-          ...(m.serviceKind && m.serviceKind !== "llm"
-            ? { service_kind: m.serviceKind }
-            : {}),
-        };
+    // One clock reading for the whole response: `created` is the same
+    // timestamp for every entry, and reading it per row made the field vary
+    // across a single listing.
+    const now = Math.floor(Date.now() / 1000);
+    const modelEntries: AllowedModelEntry[] = [];
+    for (const row of rows) {
+      // A provider is listed only when the tenant has an active account for
+      // it — the same rule the console model picker applies. A no-auth
+      // provider with nothing configured is not "set", so it stays hidden
+      // until the operator adds an account.
+      const listed =
+        tenantId === null ? row.providerRequiresAccount === false : activeProviderIds.has(row.providerId);
+      if (!listed) continue;
+      const qualified = `${row.providerId}/${row.modelId}`;
+      // The prefix test is deliberately gone from this path: the chain used to
+      // be `(prefixMatch || isAllowed)` followed by `isAllowed`, which reduces
+      // to `isAllowed` alone — the prefix disjunct could never change the
+      // outcome, only cost a second full pass over the catalog. Collapsing the
+      // four chained filters into one loop also drops the three intermediate
+      // arrays they materialized.
+      if (!isModelAllowed(snapshot, row.modelId, row.providerId)) continue;
+      if (shadowsAliasOrCombo(row, aliasTargets, comboNames, snapshot)) continue;
+      const capabilities = normalizeModalities(row.modalities);
+      modelEntries.push({
+        id: qualified,
+        object: "model" as const,
+        created: now,
+        owned_by: row.providerId,
+        ...(row.contextLimit != null ? { context_length: row.contextLimit } : {}),
+        ...(row.outputLimit != null ? { max_completion_tokens: row.outputLimit } : {}),
+        ...(capabilities ? { capabilities } : {}),
+        ...(row.reasoning ? { reasoning: true } : {}),
+        ...(row.toolCall ? { tool_call: true } : {}),
+        ...(row.cost != null ? { cost: row.cost } : {}),
+        // Only a non-`llm` row is labelled: absence already means "chat wire".
+        ...(row.serviceKind && row.serviceKind !== "llm"
+          ? { service_kind: row.serviceKind }
+          : {}),
       });
+    }
 
     // Expose tenant model aliases and combos as first-class public models.
     // `aliasRows`/`comboRows` were loaded above for the shadow filter.
@@ -465,9 +499,10 @@ export class PublicModelCatalogStore {
       ].flat();
       const targetMeta = await this.modelMetadataById(tenantId, targetIds);
 
-      const now = Math.floor(Date.now() / 1000);
+
       for (const a of aliasRows) {
-        if (!matchesModelPrefix(modelPrefix, a.alias) && !isModelAllowed(snapshot, a.alias)) continue;
+        // `!A && !B` followed by `!B` — the second subsumes the first, so the
+        // prefix test never changed the outcome. Collapsed to the real gate.
         if (!isModelAllowed(snapshot, a.alias)) continue;
         const target = advertisedMetadata(resolveTargetIds(a.targetModel, aliasTargets, comboMembers), targetMeta);
         const capabilities = normalizeModalities(target.modalities);
@@ -486,7 +521,6 @@ export class PublicModelCatalogStore {
       }
 
       for (const c of comboRows) {
-        if (!matchesModelPrefix(modelPrefix, c.name) && !isModelAllowed(snapshot, c.name)) continue;
         if (!isModelAllowed(snapshot, c.name)) continue;
         const target = advertisedMetadata(resolveTargetIds(c.name, aliasTargets, comboMembers), targetMeta);
         const capabilities = normalizeModalities(target.modalities);
@@ -648,12 +682,9 @@ export class PublicModelCatalogStore {
         )
         .limit(1);
       const row = rows[0];
-      if (
-        row &&
-        (matchesModelPrefix(modelPrefix, row.modelId, `${row.providerId}/${row.modelId}`) ||
-          isModelAllowed(snapshot, row.modelId, row.providerId)) &&
-        isModelAllowed(snapshot, row.modelId, row.providerId)
-      ) {
+      // Same reduction as the listing path: `(prefix || allowed) && allowed`
+      // is just `allowed`, and the prefix disjunct cost a redundant call.
+      if (row && isModelAllowed(snapshot, row.modelId, row.providerId)) {
         const capabilities = normalizeModalities(row.modalities);
         return {
           id: `${row.providerId}/${row.modelId}`,

package/src/console/providers/catalog/store.ts

@@ -17,7 +17,7 @@ import { listAccountHealthEvents, recoverAccount, type AccountHealthEventRecord
 import { invalidateCredentialCache } from "../../../providers/operations/provider-credential-service";
 import { encryptCredential, hashSecret } from "../../../security/crypto";
 import type { TelemetryBatchBuffer } from "../../../observability/telemetry-buffer";
-import type { BundledProviderCatalog } from "../../../providers/operations/provider-catalog-service";
+import { bumpCatalogRevision, type BundledProviderCatalog } from "../../../providers/operations/provider-catalog-service";
 import type { AccountInflightReading, BuddyGrowthTaskLedgerEntry, ByokConnectionTestRequest, ByokConnectionTestResult, CreateProviderAccountBatchItemResult, CreateProviderAccountBatchResult, CreateProviderAccountRequest, CredentialMode, ModelCatalogEntry, ProbeAllAccountsResult, ProbeAllModelsResult, ProbeModelRequest, ProbeModelResult, ProviderAccountResponse, ProviderAccountTokenUsage, ProviderCatalogStore, ProviderRecord, SetModelEnabledRequest, UpdateModelMetadataRequest, UpdateProviderAccountRequest, ModelMetadataOverride } from "./contracts";
 import { isServiceKind, validateCompatibilityProfile } from "./contracts";
 import { ProviderProbingService, type ProbeOutboundResolver } from "../../../providers/discovery/probing-service";
@@ -487,6 +487,10 @@ export class DrizzleProviderCatalogStore implements ProviderCatalogStore {
       .returning({ id: providers.id });
     if (deleted.length === 0) return false;
     this.providerRegistry.unregister(providerId);
+    // The provider left the registry, so the compiled catalog no longer
+    // contains it — the snapshot's re-seed is gated on that revision, and a
+    // delete that did not bump it would leave the provider's model rows behind.
+    bumpCatalogRevision();
     return true;
   }
   async updateGlobal(

package/src/console/quota/account-quota-tenant.ts

@@ -29,6 +29,7 @@ import type { ProviderId } from "../../providers/provider-contracts";
 import {
   DAILY_CHECKIN_PROVIDER_IDS,
   checkinAttemptedToday,
+  checkinAttemptedTodayBatch,
   dailyCheckinEgressForPass,
   markCheckinAttempted,
 } from "../../workers/daily-checkin";
@@ -334,12 +335,14 @@ export function registerAccountQuotaTenantRoutes(
       // request; only check-in-capable accounts can carry one, so only they
       // are read.
       const checkinCandidates = rows.filter((row) => supportsAccountCheckin(row.providerId));
-      const checkinAttempted = new Map<string, boolean>();
-      await Promise.all(
-        checkinCandidates.map(async (row) => {
-          checkinAttempted.set(row.id, await todayCheckinAttempted(db, redis, row.id));
-        }),
-      );
+      // One batched read for the whole page. Per-account reads made opening
+      // this route scale with the account count — a round trip each, on the
+      // route the dashboard polls — for a marker that is one key per account.
+      const checkinAttempted = await checkinAttemptedTodayBatch({
+        db,
+        redis,
+        accountIds: checkinCandidates.map((row) => row.id),
+      });
       // Real credit deductions, read from the stored snapshots rather than from
       // the upstream: the page renders every account at once, and re-hitting the
       // billing endpoint per account would make opening it scale with the

package/src/console/response-compression.ts

@@ -9,6 +9,18 @@
  * what the browser spends its time receiving, and shaving microseconds off a
  * handler cannot compete with removing 94% of the bytes.
  *
+ * ## Why the gate is a path allowlist inside the function
+ *
+ * The wrap is mounted on the console Elysia instance (`console-router.ts`),
+ * but Elysia's `use()` merges the child's `hoc` into the **root** app's ext
+ * (`node_modules/elysia/dist/base.js:886-887`). Measured: the wrap therefore
+ * runs for `/v1/*` too, so instance-level scoping cannot express "console
+ * only". A path test can, and it lives inside `gzipResponse` — the one place
+ * that runs on every request.
+ *
+ * Consequence: `/v1/models` was previously compressed as a side effect of
+ * that `hoc` propagation. It deliberately is not now.
+ *
  * ## Why this is scoped to the console, not the proxy
  *
  * `/v1/*` is deliberately excluded, for two independent reasons:
@@ -26,9 +38,26 @@
  * Below `MIN_COMPRESSIBLE_BYTES` the envelope, the header, and the CPU are all
  * pure loss: a 200-byte reply is not worth a gzip stream plus a browser
  * decompression step. The threshold sits where the saving stops being noise.
+ *
+ * ## Opting a route out
+ *
+ * A route that knows its body is already compressed — or is an encoded
+ * envelope that would gain nothing — sets {@link NO_COMPRESS_HEADER}. The
+ * honest-sounding alternative, declaring `content-encoding: gzip`, is a lie
+ * when the bytes on the wire are not gzip, and the client that believes it
+ * fails trying to inflate them.
  */
 import { gzipSync } from "node:zlib";
 
+/**
+ * Header a route sets to say "do not compress this", popped before the
+ * response leaves.
+ *
+ * Deleted rather than left on the response, so it stays an internal signal
+ * between two layers in this process and never reaches a client or a cache.
+ */
+export const NO_COMPRESS_HEADER = "x-cartethyia-no-compress";
+
 /**
  * Smallest body worth compressing.
  *
@@ -37,6 +66,19 @@ import { gzipSync } from "node:zlib";
  */
 export const MIN_COMPRESSIBLE_BYTES = 1024;
 
+/**
+ * Largest body this module will compress, as a ceiling on the event-loop
+ * stall.
+ *
+ * `gzipSync` is synchronous, so its cost is paid out of the request's own
+ * turn and is not interruptible. `/console/api/backup/export` answers with a
+ * multi-MB JSON document; at that size level 6 costs tens of milliseconds,
+ * which is longer than an entire dashboard poll. Those bytes go to disk
+ * rather than being polled, so the compression ratio is the wrong thing to
+ * optimise — above this size the response is returned as-is.
+ */
+export const MAX_COMPRESSIBLE_BYTES = 1024 * 1024;
+
 /** Content types worth compressing, matched by prefix. */
 const COMPRESSIBLE_TYPES: readonly string[] = [
   "application/json",
@@ -99,20 +141,42 @@ export function isCompressible(contentType: string | null, bodyLength: number):
  * type: `text/event-stream` is not in {@link COMPRESSIBLE_TYPES}, so a stream
  * can never reach the buffering path.
  *
- * The size gate runs on the **actual** byte length, not a declared
+ * The size gate runs on the **actual** byte length, not only a declared
  * `content-length`: Elysia does not set that header for a serialized object
- * (measured), so gating on it rejected every route worth compressing. The
+ * (measured), so gating on it alone rejected every route worth compressing. A
+ * declared length is still used as a fast path — it can skip the read for a
+ * small reply — but silence from the header must never mean "too small". The
  * content-type gate is what keeps a stream from being read here, and it is
  * checked before the body is touched.
  */
 export async function gzipResponse(request: Request, response: Response): Promise<Response> {
+  // Scoped to the paths this module documents. Instance-level scoping is not
+  // available here: the wrap's `hoc` propagates to the root app, so every
+  // route in the process — `/v1/*` included — reaches this function.
+  const pathname = new URL(request.url).pathname;
+  if (!pathname.startsWith("/console/api/") && pathname !== "/metrics") return response;
   if (request.method === "HEAD") return response;
   if (response.status === 204 || response.status === 304) return response;
   // Already encoded — by a route or by an upstream. Never encode twice.
   if (response.headers.has("content-encoding")) return response;
+  // A route that knows better: the body is an encoded envelope, or already
+  // compressed in a form this wire layer cannot describe. Deleted here so the
+  // signal stays internal and never reaches a client or a cache.
+  if (response.headers.has(NO_COMPRESS_HEADER)) {
+    response.headers.delete(NO_COMPRESS_HEADER);
+    return response;
+  }
   if (!acceptsGzip(request.headers.get("accept-encoding"))) return response;
   // Type first, before any read: this is what keeps an event stream out.
   if (!isCompressibleType(response.headers.get("content-type"))) return response;
+  // A bodiless reply has nothing to compress, and `arrayBuffer()` on a null
+  // body yields a 0-byte buffer that would rebuild into a non-null body.
+  if (response.body === null) return response;
+  // A declared length below the threshold skips the read entirely. It cannot
+  // be the only gate — Elysia sets no `content-length` for a serialized
+  // object (measured) — so the byte-length read below still has to exist.
+  const declared = response.headers.get("content-length");
+  if (declared !== null && Number(declared) < MIN_COMPRESSIBLE_BYTES) return response;
 
   const body = await response.arrayBuffer();
   // Below the threshold the envelope, the header, and the CPU are all pure
@@ -120,6 +184,9 @@ export async function gzipResponse(request: Request, response: Response): Promis
   // than compressed. A response that was read must always be rebuilt, or the
   // client would receive an empty body.
   if (body.byteLength < MIN_COMPRESSIBLE_BYTES) return rebuild(response, body);
+  // Above the ceiling the synchronous `gzipSync` stall costs more than the
+  // bytes it would save. Same rebuild obligation as the threshold path.
+  if (body.byteLength > MAX_COMPRESSIBLE_BYTES) return rebuild(response, body);
 
   const compressed = gzipSync(new Uint8Array(body), { level: GZIP_LEVEL });
   const headers = new Headers(response.headers);

package/src/console/routing/pools/probe-verdict.ts

@@ -58,3 +58,75 @@ export function classifyProviderProbeAnswer(httpStatus: number, body: string): P
     reason: `Reachable; upstream answered ${httpStatus} for the probe body`,
   };
 }
+
+/**
+ * Error codes that mean "this attempt never reached the upstream", not "the
+ * upstream refused this address".
+ *
+ * Every one of them is worth a second attempt, and the reason is the same in
+ * each case: the failure is a property of one socket, not of the egress. A
+ * proxy that has just been dialled for the first time has to resolve, open a
+ * tunnel, and complete a TLS handshake, and any of those steps can be refused
+ * or reset by a middlebox that accepts the very next attempt — which is exactly
+ * the "fails once, works on retry" report. Retiring the pool on the first one
+ * blames the address for a cold-start race.
+ */
+const RETRYABLE_TRANSPORT_CODES = new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ENETRESET",
+  "EPIPE",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+  "UND_ERR_SOCKET",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "ECONNECT_TIMEOUT",
+]);
+/** How many `cause` links to follow; wraps are shallow in practice. */
+const PROBE_ERROR_CAUSE_DEPTH = 5;
+
+/**
+ * Whether one probe error should be retried before it becomes a verdict.
+ *
+ * Deliberately narrow: an abort is *our* deadline firing, so retrying it would
+ * spend the whole probe budget on a slow egress, and an unknown error is left
+ * alone rather than guessed at. Only transport codes that describe a single
+ * dead connection qualify.
+ */
+export function isRetryableProbeError(error: unknown): boolean {
+
+  // Walk the `cause` chain: a transport failure is routinely wrapped — the
+  // proxy layer raises `ProxyConnectHandshakeError` whose *message* carries the
+  // real code, with nothing on `code`. Checking only the top error would miss
+  // exactly the failure this exists for.
+  let current: unknown = error;
+  for (let depth = 0; depth < PROBE_ERROR_CAUSE_DEPTH && current !== undefined && current !== null; depth += 1) {
+    if (!(current instanceof Error)) break;
+    if (current.name === "AbortError" || current.name === "TimeoutError") return false;
+    // `code` is not on the base `Error`; narrow before reading it rather than
+    // asserting a shape the runtime may not have.
+    const code: string | undefined =
+      "code" in current && typeof current.code === "string" ? current.code : undefined;
+    if (code !== undefined && RETRYABLE_TRANSPORT_CODES.has(code.toUpperCase())) return true;
+    const message = String(current.message ?? "");
+    // The wrapped code is often only in the message, so match it there too.
+    for (const candidate of RETRYABLE_TRANSPORT_CODES) {
+      if (message.includes(candidate)) return true;
+    }
+    if (
+      message.includes("fetch failed") ||
+      message.includes("socket connection was closed unexpectedly") ||
+      message.includes("other side closed") ||
+      message.startsWith("terminated") ||
+      /connection (?:was|is) closed/i.test(message)
+    ) {
+      return true;
+    }
+    current = current.cause;
+  }
+  return false;
+}
+

package/src/console/share/share-router.ts

@@ -33,11 +33,14 @@ import {
 const MIN_TOKEN_LENGTH = 20;
 
 /**
- * Cadence of the share stats SSE snapshot. Short enough to read as live;
- * the rollup itself is a handful of indexed aggregates, so re-reading on this
- * interval is cheap next to the per-request telemetry insert it summarizes.
+ * Cadence of the share stats SSE snapshot.
+ *
+ * Raised with `SHARE_STATS_CACHE_TTL_SECONDS` (10 s). At 2 s the tick was
+ * shorter than the rollup's own cache TTL, so every push re-parsed the whole
+ * retained telemetry window — the interval was the thing making this read
+ * expensive, not the number of viewers. Short enough to still read as live.
  */
-const SHARE_STATS_STREAM_INTERVAL_MS = 2_000;
+const SHARE_STATS_STREAM_INTERVAL_MS = 10_000;
 
 /**
  * Context and capabilities for one allowed model, sourced from the public