claude-code-infinite 1.0.20 → 1.0.22

package/dist/proxy.js

@@ -59,6 +59,8 @@ import { hyperlink } from "./payment-gate.js";
 import { PaymentNoticeThrottle, paymentNoticeText } from "./payment-notice.js";
 import { MEMTREE_LINKS_MAX_SESSIONS } from "./memtree-links.js";
 import { describeClaudeCodeRequest, inspectMonitorTranscript, knownSideRequestKind, transcriptWarning, isClaudeCodeSideRequest, memtreeClientMeta, sessionTag, } from "./cc-request.js";
+import { isResumableSessionId } from "./resume-hint.js";
+import { conservativeBodyTokens } from "./token-estimate.js";
 import { approxTokensFromBytes, mergeUsageFromJsonBody, mergeUsageFromSseEvent, } from "./reqlog.js";
 const DEFAULT_UPSTREAM = "https://api.anthropic.com";
 const HOOK_BODY_LIMIT = 64 * 1024;
@@ -91,10 +93,23 @@ const SKIP_RESPONSE_HEADERS = new Set([
 ]);
 /**
  * Budget fallback until the server reports `model_budget_tokens`: this share
- * of the model's context window (800k of Opus 5.5's 1M, matching the server's
- * large-context threshold).
+ * of the model's context window. 0.8 by default; NEAR_WINDOW_FALLBACK_RATIO
+ * (900k of 1M) for the 1M-window models the server budgets at 900k for ccc
+ * (NEAR_WINDOW_MODEL_RE). Plain Claude Code 2.1.302 auto-compacts a 1M window
+ * at 967k, so MemTree compresses no earlier than ~70k before it would; ccc
+ * lifts Claude Code's own 977k refusal (claude-env.ts) so a tool turn that
+ * jumps past the budget reaches the proxy and is compressed here.
  */
 export const FALLBACK_BUDGET_WINDOW_RATIO = 0.8;
+export const NEAR_WINDOW_FALLBACK_RATIO = 0.9;
+/** Opus 5.5, Opus 5, Opus 4.8 and Fable 5 / 5.1 (polychat LARGE_CONTEXT_MODELS). */
+const NEAR_WINDOW_MODEL_RE = /claude-(?:opus-(?:4-8|5-5|5)|fable-5(?:-1)?)(?![0-9])/i;
+const ONE_MILLION_TOKENS = 1_000_000;
+/** The fallback share of the window for `model` (see FALLBACK_BUDGET_WINDOW_RATIO). */
+export function fallbackBudgetRatio(model, modelContextLimit) {
+    return typeof model === "string" && modelContextLimit >= ONE_MILLION_TOKENS &&
+        NEAR_WINDOW_MODEL_RE.test(model) ? NEAR_WINDOW_FALLBACK_RATIO : FALLBACK_BUDGET_WINDOW_RATIO;
+}
 /**
  * An explicit target is capped at this share of the budget: a compaction to
  * the budget itself would be over budget again on the next turn and
@@ -267,6 +282,8 @@ export function startProxy(opts) {
         paymentNotice: new PaymentNoticeThrottle(opts.paymentNoticeIntervalMs),
         unpaidDetail: () => opts.memtree.paymentRequiredDetail,
         usageUrl: opts.memtree.usageDashboardUrl,
+        sessionStartNotice: opts.sessionStartNotice,
+        diagnostics: opts.diagnostics,
         notices: new NoticeDeliveryQueue(),
         mainNoticePending: false,
         mainPromptGeneration: 0,
@@ -303,6 +320,7 @@ export function startProxy(opts) {
         laneSizes: new Map(),
     };
     installMemtreeLink(state, state.memtreeLinkPlacement);
+    state.notices.setFirstTreeIntro(opts.firstTreeIntro ?? null);
     const server = http.createServer((req, res) => {
         const accepted = { req, res };
         acceptedRequests.add(accepted);
@@ -385,6 +403,7 @@ export function startProxy(opts) {
                     void beginClose();
                 },
                 drain,
+                mainSessionId: () => state.resumableMainSession,
             });
         });
     });
@@ -615,6 +634,30 @@ export function memtreePageId(pageUrl) {
         return undefined;
     }
 }
+const SESSION_START_SOURCES = new Set(["startup", "resume", "clear", "compact"]);
+/** A main-agent SessionStart, for diagnostics; never fails the hook. */
+function recordSessionStart(state, source) {
+    try {
+        const known = source !== undefined && SESSION_START_SOURCES.has(source);
+        state.diagnostics?.record("session_start", { source: known ? source : "other" });
+    }
+    catch {
+        // Diagnostics are best effort.
+    }
+}
+/**
+ * A resumed or forked session can be resumed again at once; a fresh or
+ * cleared one has nothing to resume until its first turn. Compaction keeps
+ * the same session.
+ */
+function noteMainSessionStart(state, source, sessionId) {
+    if (source === "resume" || source === "fork") {
+        state.resumableMainSession = isResumableSessionId(sessionId) ? sessionId : undefined;
+    }
+    else if (source === "startup" || source === "clear") {
+        state.resumableMainSession = undefined;
+    }
+}
 /** Serve only validated Claude hook POSTs on the randomized localhost path. */
 async function handleNoticeHook(req, res, state, reqlog, 
 /** A main-lane turn ended: the session may be over (its final index). */
@@ -653,11 +696,15 @@ onMainStop) {
         return;
     }
     if (parsed.hook_event_name === "SessionStart") {
+        if (parsed.agent_id === undefined) {
+            recordSessionStart(state, parsed.source);
+            noteMainSessionStart(state, parsed.source, parsed.session_id);
+        }
         // A resume waits briefly for the newest tree; a fresh session has none to wait for.
         if (parsed.agent_id === undefined && parsed.source === "resume") {
             await state.newestTrees?.settle(parsed.session_id);
         }
-        const line = joinNoticeLines(resumeLinkLine(state, parsed), resumePaymentNotice(state, parsed));
+        const line = joinNoticeLines(resumeLinkLine(state, parsed), resumePaymentNotice(state, parsed), extraSessionStartLine(state.sessionStartNotice, parsed));
         if (!line) {
             res.writeHead(204);
             res.end();
@@ -950,10 +997,11 @@ async function handleMessages(req, res, opts, upstream, state) {
         upstream, headers: forwardableRequestHeaders(req), requestUrl: req.url,
         signal: state.shutdownSignal,
         onAttempt: (result) => {
-            (rec.countTokens ??= []).push({ statusClass: result.outcome, ms: result.ms });
+            (rec.countTokens ??= []).push({ statusClass: result.outcome, ms: result.ms,
+                bytes: result.bytes ?? 0, timeoutMs: result.timeoutMs ?? 0 });
         },
     }, state.countTokensCooldowns);
-    const requestSizing = new RequestSizing(countSession, opts.countTokens === true);
+    const requestSizing = new RequestSizing(countSession, opts.countTokens === true, typeof body.model === "string" ? body.model : undefined);
     if (carriesServerTools(body))
         serverToolRecords.add(rec);
     const sizeSlot = wholeRequestSizeSlot(state, isMainRequest, requestSessionKey, requestSizeKey, body.model);
@@ -1052,6 +1100,8 @@ async function handleMessages(req, res, opts, upstream, state) {
     // reply the session ends with (scheduleFinalIndex, on Stop).
     const mainSessionId = isMainRequest ? requestSessionId(req) : undefined;
     if (mainSessionId !== undefined) {
+        if (isResumableSessionId(mainSessionId))
+            state.resumableMainSession = mainSessionId;
         opts.memtree.noteMainConversation(mainSessionId, {
             messages: msgsForMemtree,
             modelContextLimit,
@@ -1170,7 +1220,7 @@ async function handleMessages(req, res, opts, upstream, state) {
             // prefix, else whole) with no compress call; at it, compress once to
             // the target (planToolCompaction). A "replay" is a client retry of the
             // request that installed the route, forwarded verbatim.
-            const plan = planToolCompaction({
+            const plan = await planToolCompaction({
                 opts,
                 state,
                 body,
@@ -1207,11 +1257,15 @@ async function handleMessages(req, res, opts, upstream, state) {
                     // A concurrent request of this lane is already compressing.
                     rec.routeRecovery = { outcome: "in-flight" };
                 }
-                else if (prior?.awaitingIndex && !plan.overWindow) {
+                else if (prior?.awaitingIndex && (!plan.overWindow || plan.uncountedOverWindowOnly)) {
                     // The last attempt found no tree for this conversation, so a
                     // compress call could only pass everything through again. Forward
                     // now; the page check lets the next tool turn try once it exists.
+                    // Over the window only by its uncounted bound, delivery may still
+                    // count it; if it refuses, that is an index wait, not a strike.
                     rec.routeRecovery = { outcome: "awaiting-index" };
+                    if (plan.uncountedOverWindowOnly)
+                        rec.indexBehind = true;
                     checkAwaitedIndex(opts, prior, state.shutdownSignal);
                 }
                 else if (prior?.retryAtTokens !== undefined &&
@@ -1350,7 +1404,7 @@ async function handleMessages(req, res, opts, upstream, state) {
     // Stable-prefix (edge) compaction: the main thread's human turns only. The
     // recap rides the main route above; subagents keep per-turn compression.
     const edge = isMainRequest && sessionId !== undefined
-        ? planEdgeCompaction({
+        ? await planEdgeCompaction({
             sizing: requestSizing,
             opts,
             state,
@@ -1641,7 +1695,10 @@ async function handleMessages(req, res, opts, upstream, state) {
         const paymentDetail = opts.memtree.paymentRequiredDetail;
         const mayQueueNotice = displayForThisTurn && state.mainPromptGeneration === noticePromptGeneration;
         if (mayQueueNotice && paymentDetail !== null && state.paymentNotice.due()) {
-            state.notices.queueSuffix(paymentNoticeText(paymentDetail, recapLink(state, sessionId)?.link), () => state.paymentNotice.markShown(), noticePromptId);
+            state.notices.queueSuffix(paymentNoticeText(paymentDetail, recapLink(state, sessionId)?.link), () => {
+                state.paymentNotice.markShown();
+                state.diagnostics?.record("paused_notice", { trigger: "turn" });
+            }, noticePromptId);
         }
         else if (mayQueueNotice && paymentDetail === null) {
             state.notices.queueSuffix(DEGRADED_NOTICE, undefined, noticePromptId);
@@ -1875,8 +1932,20 @@ function resumePaymentNotice(state, input) {
     if (detail === null)
         return undefined;
     state.paymentNotice.markShown();
+    state.diagnostics?.record("paused_notice", { trigger: "resume" });
     return state.notices.warningText(paymentNoticeText(detail));
 }
+/** The caller's extra SessionStart line; a throwing provider shows nothing. */
+function extraSessionStartLine(provider, input) {
+    if (!provider || input.agent_id !== undefined || input.source === "compact")
+        return undefined;
+    try {
+        return provider();
+    }
+    catch {
+        return undefined;
+    }
+}
 function joinNoticeLines(...parts) {
     const present = parts.filter((part) => !!part);
     return present.length ? present.join("\n") : undefined;
@@ -2381,7 +2450,7 @@ function serverBudgetKey(model, modelContextLimit) {
 /**
  * The session's whole-request budget: CCC_BUDGET_TOKENS when set (tests),
  * else the model budget the server last reported for this model and window,
- * else the window times FALLBACK_BUDGET_WINDOW_RATIO (servers that predate
+ * else the window times fallbackBudgetRatio (servers that predate
  * `model_budget_tokens`, and the first request before any response).
  */
 function resolveBudget(opts, state, model, modelContextLimit) {
@@ -2392,7 +2461,7 @@ function resolveBudget(opts, state, model, modelContextLimit) {
     if (reported !== undefined)
         return { tokens: reported, source: "server" };
     return {
-        tokens: Math.floor(modelContextLimit * FALLBACK_BUDGET_WINDOW_RATIO),
+        tokens: Math.floor(modelContextLimit * fallbackBudgetRatio(model, modelContextLimit)),
         source: "window-ratio",
     };
 }
@@ -2442,10 +2511,11 @@ function laneCompaction(opts, state, sessionId, model, modelContextLimit) {
 }
 /** Calibrated input must leave room for the requested output as well. */
 function calibratedSizeExceedsWindow(record, body, modelContextLimit) {
-    // A planning estimate, so the full max_tokens (the floor needs an exact count).
-    const outputTokens = bodyOutputReservation(body, false);
-    return record.sizeSource === "reported" &&
-        (record.estimatedTokens ?? 0) + outputTokens > modelContextLimit;
+    // An exact count reserves the model's output floor, as delivery does; an
+    // estimate reserves the full max_tokens.
+    const outputTokens = bodyOutputReservation(body, exactSizedRecords.has(record));
+    return record.uncountedOverWindow === true || (record.sizeSource === "reported" &&
+        (record.estimatedTokens ?? 0) + outputTokens > modelContextLimit);
 }
 function calibratedSizeExceedsLimits(record, body, modelContextLimit) {
     return (record.sizeSource === "reported" &&
@@ -2515,16 +2585,24 @@ function usedServerTools(rec) {
  * is dropped and the previous sample kept.
  */
 function reportedSample(rec, bytes) {
-    if (changedDeliveryRecords.has(rec))
-        return undefined;
-    if (serverToolRecords.has(rec) || usedServerTools(rec))
-        return undefined;
-    const tokens = reportedInputTokens(rec);
+    const tokens = reportedBodyTokens(rec);
     if (tokens === undefined)
         return undefined;
     const sample = { tokens, forwardedBytes: bytes };
     return plausibleSample(sample) ? sample : undefined;
 }
+/**
+ * Anthropic's input tokens for the body this request forwarded, when its usage
+ * describes that body (not a changed delivery, no server tools). Not filtered
+ * by plausibility: a body that is mostly images is truly cheap per byte.
+ */
+function reportedBodyTokens(rec) {
+    if (changedDeliveryRecords.has(rec))
+        return undefined;
+    if (serverToolRecords.has(rec) || usedServerTools(rec))
+        return undefined;
+    return reportedInputTokens(rec);
+}
 /**
  * Key of a non-main request's size sample (ProxyState.laneSizes): its lane,
  * its own agent id (helpers that carry only a parent id stay apart from the
@@ -2592,7 +2670,7 @@ function boundedSet(map, key, value, limit = STABLE_PREFIX_MAX_SESSIONS) {
  *
  * Fills rec.compaction with the budget, estimate and reason.
  */
-function planEdgeCompaction(args) {
+async function planEdgeCompaction(args) {
     const { opts, state, body, messages, sessionId, modelContextLimit, forwardBody, rec } = args;
     const mode = compactionMode(opts, state, sessionId);
     const budget = resolveBudget(opts, state, body.model, modelContextLimit);
@@ -2644,12 +2722,16 @@ function planEdgeCompaction(args) {
         }
         const prefixCandidate = args.sizing.register(routed.raw, "ride", prefix.lastSize);
         candidateSizeOwners.set(prefixCandidate, prefix);
+        await countIfOverBound(args.sizing, prefixCandidate, body, modelContextLimit);
         const size = args.sizing.plan(prefixCandidate);
         compaction.estimatedTokens = size.tokens;
         compaction.estimatedBytes = routed.raw.length;
         compaction.sizeSource = size.source;
-        const overWindow = routedBodyExceedsContext(body, routed.raw, modelContextLimit) ||
-            calibratedSizeExceedsWindow(compaction, body, modelContextLimit);
+        noteUncountedBound(compaction, args.sizing, prefixCandidate, body, modelContextLimit);
+        // Request-local sizing (an exact count, a calibrated sample, or the
+        // image-aware bound), not bytes: a flatten that kept images is mostly
+        // base64 that costs a fixed amount per image.
+        const overWindow = calibratedSizeExceedsWindow(compaction, body, modelContextLimit);
         const fallback = overWindow ? undefined : { prefix, routed };
         if (state.compactNow.has(sessionId))
             return forced("manual", fallback);
@@ -2663,10 +2745,13 @@ function planEdgeCompaction(args) {
     }
     if (state.compactNow.has(sessionId))
         return forced("manual");
-    const size = args.sizing.plan(args.sizing.register(forwardBody, "original"));
+    const originalCandidate = args.sizing.register(forwardBody, "original");
+    await countIfOverBound(args.sizing, originalCandidate, body, modelContextLimit);
+    const size = args.sizing.plan(originalCandidate);
     compaction.estimatedTokens = size.tokens;
     compaction.estimatedBytes = forwardBody.length;
     compaction.sizeSource = size.source;
+    noteUncountedBound(compaction, args.sizing, originalCandidate, body, modelContextLimit);
     if (calibratedSizeExceedsLimits(compaction, body, modelContextLimit)) {
         return forced(compaction.prefixMiss ? "prefix-mismatch" : "budget");
     }
@@ -2697,7 +2782,7 @@ function planEdgeCompaction(args) {
  *
  * Fills rec.compaction.
  */
-function planToolCompaction(args) {
+async function planToolCompaction(args) {
     const { opts, state, body, messages, sessionId, modelContextLimit, forwardBody, rec } = args;
     const mode = compactionMode(opts, state, sessionId);
     const budget = resolveBudget(opts, state, body.model, modelContextLimit);
@@ -2714,23 +2799,16 @@ function planToolCompaction(args) {
     const stableLane = args.isMainRequest && sessionId !== undefined;
     const current = stableLane ? state.stablePrefixes.get(sessionId) : undefined;
     let ride = args.ride;
-    let overWindow = false;
     if (!ride && current && !prefixMismatch(body, messages, current, sessionId, stablePrefixMessageHash)) {
         const routed = prefixRoutedBody(body, messages, current);
         if (routed) {
             const prefixCandidate = args.sizing.register(routed.raw, "ride", current.lastSize);
             candidateSizeOwners.set(prefixCandidate, current);
-            if (routedBodyExceedsContext(body, routed.raw, modelContextLimit))
-                overWindow = true;
-            else
-                ride = { raw: routed.raw, turnType: "tool-prefix", sizeHolder: current };
+            // Sized below with the request-local sizing; an over-window ride is not
+            // kept as a fallback.
+            ride = { raw: routed.raw, turnType: "tool-prefix", sizeHolder: current };
         }
     }
-    if (!ride) {
-        const original = args.sizing.register(forwardBody, "original");
-        overWindow ||= args.sizing.plan(original).tokens +
-            bodyOutputReservation(body, args.sizing.isExact(original)) > modelContextLimit;
-    }
     const sample = ride
         ? ride.sizeHolder.lastSize
         : stableLane
@@ -2739,12 +2817,18 @@ function planToolCompaction(args) {
     const candidate = args.sizing.register(ride?.raw ?? forwardBody, ride ? "ride" : "original", sample);
     if (ride)
         candidateSizeOwners.set(candidate, ride.sizeHolder);
+    await countIfOverBound(args.sizing, candidate, body, modelContextLimit);
     const size = args.sizing.plan(candidate);
     compaction.estimatedTokens = size.tokens;
     compaction.estimatedBytes = (ride?.raw ?? forwardBody).length;
     compaction.sizeSource = size.source;
-    overWindow ||= !fitsNative(size.tokens, { budget: budget.tokens, context: modelContextLimit,
+    noteUncountedBound(compaction, args.sizing, candidate, body, modelContextLimit);
+    // Judged after any planning count, so a fitting exact count is not
+    // overridden by the estimate it replaced.
+    let overWindow = !fitsNative(size.tokens, { budget: budget.tokens, context: modelContextLimit,
         output: bodyOutputReservation(body, args.sizing.isExact(candidate)) });
+    const uncountedOnly = !overWindow && compaction.uncountedOverWindow === true;
+    overWindow ||= uncountedOnly;
     if (!args.canCompress) {
         if (overWindow)
             return { kind: "pass", original: true };
@@ -2762,6 +2846,7 @@ function planToolCompaction(args) {
         estimateTokens: size.tokens,
         budgetTokens: budget.tokens,
         overWindow,
+        ...(uncountedOnly ? { uncountedOverWindowOnly: true } : {}),
         ...(ride && !overWindow ? { fallback: ride } : {}),
         ...(stableLane ? { replaces: current ?? null } : {}),
     };
@@ -2806,12 +2891,46 @@ function memoryRoutedToolBody(body, messages, route, routeEpoch, sessionId) {
         return null;
     return Buffer.from(JSON.stringify(routed), "utf-8");
 }
-/** Size the assembled input (including system/tools) and reserve output room. */
-function routedBodyExceedsContext(body, routedBody, modelContextLimit) {
-    const outputTokens = bodyOutputReservation(body, false);
-    // This is the existing local byte estimate, not a tokenizer or a hard cap.
-    // Final forwarding checks can replace this estimate with Count Tokens.
-    return approxTokensFromBytes(routedBody.length) + outputTokens > modelContextLimit;
+/**
+ * Count the candidate a planner is about to judge (ride or original, sampled
+ * or not) when only a count could admit it: no exact count, and its per-model
+ * conservative bound plus max_tokens exceeds the window. Delivery reuses the
+ * result.
+ */
+async function countIfOverBound(sizing, candidate, body, modelContextLimit) {
+    await sizing.countIfOverBound(candidate, { budget: modelContextLimit, context: modelContextLimit, output: bodyOutputReservation(body, false) });
+}
+/** Compaction records whose estimatedTokens is an exact count (noteUncountedBound). */
+const exactSizedRecords = new WeakSet();
+/**
+ * Note an exactly counted candidate (exactSizedRecords), or mark a planned
+ * candidate still without an exact count (counting off, or its
+ * planning count failed: countIfOverBound ran first) whose conservative bound
+ * plus max_tokens exceeds the window: delivery would refuse it uncounted, so
+ * it is over the window for planning and takes the normal gated compression.
+ */
+function noteUncountedBound(record, sizing, candidate, body, modelContextLimit) {
+    if (sizing.isExact(candidate)) {
+        exactSizedRecords.add(record);
+        return;
+    }
+    if (sizing.exceedsRequestLimit(candidate) ||
+        candidate.conservativeTokens + bodyOutputReservation(body, false) > modelContextLimit) {
+        record.uncountedOverWindow = true;
+    }
+}
+/**
+ * Whether a forwarded compressed body still overflows the window: its exact
+ * count (`exactTokens`, made for delivery), else its reported input tokens,
+ * both Anthropic's own count, so the output floor applies; else its
+ * conservative image-aware bound (token-estimate.ts) with full max_tokens,
+ * never bytes/4, which reads base64 images as text.
+ */
+function compressedResultExceedsWindow(body, rec, compressedRaw, modelContextLimit, exactTokens) {
+    const counted = exactTokens ?? reportedBodyTokens(rec);
+    const tokens = counted ??
+        conservativeBodyTokens(compressedRaw, typeof body.model === "string" ? body.model : undefined);
+    return tokens + bodyOutputReservation(body, counted !== undefined) > modelContextLimit;
 }
 /** Output room a native-fit check reserves: the model's floor for an exact
  * count, else (an estimate) the full max_tokens. */
@@ -2998,12 +3117,18 @@ function withFlattenCacheBreakpoint(body, ttl) {
     if (messages.length !== 1)
         return messages;
     const only = messages[0];
-    const text = typeof only.content === "string" ? only.content : undefined;
-    if (text === undefined)
-        return messages;
     const cacheControl = { type: "ephemeral" };
     if (ttl !== undefined)
         cacheControl.ttl = ttl;
+    if (Array.isArray(only.content) && only.content.length > 0) {
+        // A flatten that kept images: the breakpoint goes on its last block.
+        const blocks = only.content.map((block) => ({ ...block }));
+        blocks[blocks.length - 1].cache_control = cacheControl;
+        return [{ ...only, content: blocks }];
+    }
+    const text = typeof only.content === "string" ? only.content : undefined;
+    if (text === undefined)
+        return messages;
     return [{ ...only, content: [{ type: "text", text, cache_control: cacheControl }] }];
 }
 /**
@@ -3147,7 +3272,9 @@ async function runBlockingCompression(args) {
         // whatever the fallback gate would refuse to send uncompressed; a bytes/4
         // guess is not sent, as it would force needless compression.
         ...(args.inputCandidate && args.sizing.clientInputTokens(args.inputCandidate) !== undefined
-            ? { clientInputTokens: args.sizing.clientInputTokens(args.inputCandidate) }
+            ? { clientInputTokens: args.sizing.clientInputTokens(args.inputCandidate),
+                // Only an exact count of these bytes may loosen the server's sizing.
+                clientInputTokensExact: args.sizing.isExact(args.inputCandidate) }
             : {}),
         ...(messageUsage && Object.keys(messageUsage).length ? { messageUsage } : {}),
         ...(messageTimes && Object.keys(messageTimes).length ? { messageTimes } : {}),
@@ -3592,8 +3719,11 @@ async function recoverToolRouteMiss(args) {
     // Nothing to ride next turn, or a result that still does not fit the
     // window (the next turn would reject it and compress again): wait for
     // growth before the lane tries again.
-    if (!sizeHolder || routedBodyExceedsContext(body, compressedRaw, modelContextLimit))
+    const exactTokens = args.sizing.exactTokensFor(compressedRaw);
+    if (!sizeHolder ||
+        compressedResultExceedsWindow(body, rec, compressedRaw, modelContextLimit, exactTokens)) {
         backOff();
+    }
     // A reservation that lost its race (stale) or never reached
     // protocol-complete (upstream 5xx, truncated stream) installed nothing, so
     // it must stop suppressing whoever is still trying to install.
@@ -3766,13 +3896,16 @@ async function selectForwardCandidate(args) {
     return changed ? candidate.body : intended;
 }
 /**
- * Whether delivery would refuse `candidate` sent whole: it is planned over the
- * window, and the measurement selection would use (an exact count, else the
- * same estimate or bytes/4 fallback) does not fit either. Only then is there
- * no fallback, and only then may a compress take the long budget.
+ * Whether delivery would refuse `candidate` sent whole, by delivery's own
+ * admission: it is sendable only when its plan fits and either an exact count
+ * or its conservative per-model bound (with the full max_tokens) fits too;
+ * otherwise the measurement delivery would use (a count, else that bound)
+ * decides. Only when it is refused is there no fallback, and only then may a
+ * compress take the long budget.
  */
 async function wholeRequestRefused(sizing, candidate, limits) {
-    if (fitsNative(sizing.plan(candidate).tokens, limits))
+    if (fitsNative(sizing.plan(candidate).tokens, limits) &&
+        (sizing.isExact(candidate) || sizing.boundFits(candidate, limits)))
         return false;
     return !fitsMeasured(await sizing.measure(candidate, limits), limits);
 }
@@ -3781,12 +3914,17 @@ function refuseWholeRequest(args, inputTokens, budgetTokens) {
     const failure = args.state.fallbackFailures.fail(args.routeKey, { awaitingIndex: args.rec.indexBehind === true });
     args.rec.forwardedBytes = 0;
     args.rec.approxInputTokens = 0;
-    console.error("[ccc proxy] request exceeds native context window; recovery failed", {
+    args.state.diagnostics?.record("refusal", {
+        status: failure.status, attempt: failure.attempt,
+        input_ktokens: Math.round(inputTokens / 1000), budget_ktokens: Math.round(budgetTokens / 1000),
+    });
+    // To requests.jsonl, never the console: Claude Code's TUI shows stderr inline.
+    args.rec.refusal = {
         lane: args.routeKey, attempt: failure.attempt, status: failure.status,
         inputTokens, outputTokens: args.body.max_tokens ?? 0,
         outputReservation: bodyOutputReservation(args.body), indexBehind: args.rec.indexBehind === true,
         budgetTokens, modelContextLimit: args.modelContextLimit,
-    });
+    };
     if (args.res.headersSent || args.res.destroyed)
         return false;
     args.res.writeHead(failure.status, { "content-type": "application/json", ...failure.headers });
@@ -4529,6 +4667,7 @@ function readAll(stream) {
 /** Test seam. */
 export const __testCapCacheBreakpoints = capCacheBreakpoints;
 export const __testEstimateRequestTokens = estimateRequestTokens;
+export const __testCompressedResultExceedsWindow = compressedResultExceedsWindow;
 /** Reads message times from the session's transcript, when there is one. */
 function transcriptTimesFor(opts, sessionId, agentId) {
     const source = opts.transcriptUsage;