maxpool 1.5.41 → 1.5.43

package/README.md

@@ -270,7 +270,7 @@ TEAMCLAUDE_CONFIG=./my-config.json maxpool server
     "weeklySoftThreshold": 0.65,
     "weeklyReserveThreshold": 0.85,
     "weeklyCriticalThreshold": 0.95,
-    "weeklyExhaustedThreshold": 0.985,
+    "weeklyExhaustedThreshold": 0.999,
     "weeklyBurnDebtWeight": 0.6
   },
   "retry": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.41",
+  "version": "1.5.43",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -91,7 +91,12 @@ const DEFAULT_SCHEDULER = {
   weeklySoftThreshold: 0.65,
   weeklyReserveThreshold: 0.85,
   weeklyCriticalThreshold: 0.95,
-  weeklyExhaustedThreshold: 0.985,
+  // Use-it-or-lose-it (2026-07-24): bench only at 99.9%, not 98.5% — the weekly quota
+  // resets, so reserving the top ~1.5% just wastes it. The thin 0.1% floor is the ONE
+  // remaining guard: don't fire a request at an account whose own header already says
+  // it's essentially full (a near-guaranteed-waste hard-429). A real 429 sets util≈1.0
+  // and still benches here. Critical (0.95-0.999) stays last-resort-only (pass 2).
+  weeklyExhaustedThreshold: 0.999,
   weeklyBurnDebtWeight: 0.6,
   // Routing-cost tuning (lower cost = preferred). The goal is to AVOID
   // short-term (rate/concurrency) throttling by spreading load across healthy
@@ -103,6 +108,18 @@ const DEFAULT_SCHEDULER = {
   capPenaltyWeight: 10,            // steep penalty per unit of in-flight depth past D (throttle safety floor)
   paceCostWeight: 1.5,            // soft de-preference of accounts burning ahead of pace (was the ×6 term)
   scarcityWeight: 6,              // legacy; superseded by paceCostWeight (kept so old configs don't error)
+  // Reserve-account OVERFLOW model. A weekly-RESERVE account (util 0.85-0.95) used to
+  // sit idle behind a healthy-only first pass; now it's eligible in the first pass but
+  // ranked BELOW healthy accounts by _reserveCost (so healthy stays first-pick). Among
+  // reserve accounts the SOONEST-to-reset is cheapest (use-it-or-lose-it); the further
+  // into the band, the costlier (preserve). Critical (≥0.95)/exhausted stay hard-benched
+  // in the second pass, never softened. See _reserveCost + _selectNext's 2-pass ladder.
+  reserveFloorCost: 5,            // base overflow cost — keeps any reserve account behind an idle healthy one (~2)
+  reserveBandWeight: 8,           // ×(util-0.85)/0.10: deeper into the reserve band ⇒ costlier ⇒ consumed later
+  reserveScarcityWeight: 6,       // ×weekly _windowScarcity: reset-timing weight, ON TOP of the global paceCost, so
+                                  // a near-reset reserve account is used freely and a far-from-reset one is used last
+  reserveConcurrencyTarget: 2,    // tighter in-flight cap for reserve (capPenalty bites at inflight>2 ⇒ load fans out
+                                  // across the fleet before any single reserve account is dogpiled toward a 429)
   spreadShareWeight: 3,           // multiplies an account's share of recent fleet load (0..1)
   recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
   recoveryRampMs: 5 * 60_000,     // how long the post-recovery ramp lasts
@@ -121,16 +138,25 @@ const DEFAULT_SCHEDULER = {
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
   //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
   //                     uses GLM only; a Kimi session uses Kimi only.
-  //   'when-exhausted'— (default) home family preferred; a Claude session falls back
-  //                     to GLM/Kimi only once all Claude accounts are unavailable
-  //                     (providers are already lower-priority fallback), and a GLM
-  //                     session may fall to Kimi once GLM is exhausted.
+  //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
+  //                     only once all Claude accounts are unavailable, and a GLM session
+  //                     may fall to Kimi once GLM is exhausted.
   //   'always'        — providers peer with Claude for a Claude/unknown session
   //                     (load-balanced, not last-resort).
+  // DEFAULT is 'never' (2026-07-24): a Claude Code session stays on Anthropic. Routing
+  // Claude→GLM/Kimi proved unreliable (the coding legs 403/429 + ignore the model id),
+  // so cross-routing OUT of Claude is OFF by default; re-enable via the TUI routing
+  // cycle or config. This governs ONLY the Claude→provider direction.
   // INVARIANT (all policies): a GLM/Kimi-origin session NEVER routes to an Anthropic
   // account — Anthropic 400s on a non-`srvtoolu_` server_tool_use id; that direction
   // is unfixable, not policy-tunable.
-  crossProviderFallbackPolicy: 'when-exhausted',
+  crossProviderFallbackPolicy: 'never',
+  // The OTHER cross direction, independent of the policy above: may a provider-origin
+  // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — both legs are
+  // lenient and accept each other's ids, and it's the reliable direction the user wants
+  // kept even while Claude→provider is 'never'. Only has effect under policy:'never' (the
+  // 'when-exhausted'/'always' paths never pinned to home). Set false for a strict home-pin.
+  providerCrossFallback: true,
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -1429,14 +1455,16 @@ export class AccountManager {
     // Else fall through to the candidate score loop, which re-homes the session
     // onto the best healthy account via _bindSession on acquire.
 
-    // Healthy-first ladder for BOTH bound and unbound sessions. A bound session
-    // only reaches this loop once we've decided to LEAVE its account (rebalance
-    // fired / a higher-priority account is available / the bound account is down) —
-    // the sticky "stay put" path returns above without reaching here — so re-homing
-    // must prefer a genuinely-healthy account and fall back to reserve/critical only
-    // if none exists, never re-pick the idle reserve account it's leaving.
+    // Two-pass ladder for BOTH bound and unbound sessions. Pass 1 admits healthy AND
+    // reserve accounts together; the reserve accounts carry _reserveCost so a healthy
+    // account is preferred whenever one is comparably loaded — but a reserve account
+    // CAN outrank a badly-slammed healthy one (its capPenalty is unbounded), which is
+    // intended load-spread, not a regression. Pass 2 adds critical only when pass 1 is
+    // empty (the untouched hard fallback). A bound session reaches this loop only once
+    // we've decided to LEAVE its account (the sticky "stay put" path returns above); it
+    // may now re-home onto a lightly-loaded reserve account rather than a slammed
+    // healthy one — deliberate, since the whole point is to USE reserve accounts.
     const weeklyPasses = [
-      { allowWeeklyReserve: false, allowWeeklyCritical: false },
       { allowWeeklyReserve: true, allowWeeklyCritical: false },
       { allowWeeklyReserve: true, allowWeeklyCritical: true },
     ];
@@ -1715,9 +1743,13 @@ export class AccountManager {
       // The transcript can't replay to Claude (a foreign server_tool_use id, or
       // content Anthropic rejected on replay) — provider accounts ONLY, regardless
       // of policy. Providers are lenient and accept each other's ids (GLM↔Kimi is
-      // fine); 'never' pins to the detected home provider when known.
+      // fine). Under 'never' we keep the session on its home provider ONLY when
+      // providerCrossFallback is explicitly off; by default GLM↔Kimi crossing stays
+      // allowed even under 'never' (that reliable direction is governed separately
+      // from the Claude→provider policy).
       if (account.type !== 'provider') return false;
-      if (policy === 'never' && homeProvider && account.provider !== homeProvider) return false;
+      if (policy === 'never' && homeProvider && account.provider !== homeProvider
+        && this.scheduler.providerCrossFallback === false) return false;
       return true;
     }
 
@@ -1843,9 +1875,16 @@ export class AccountManager {
     const concurrency = inflight * this.scheduler.concurrencyWeight;
 
     // Steep soft cap past depth D — the throttle safety floor. No single
-    // account absorbs a deep concurrent burst no matter how "cheap" it looks.
+    // account absorbs a deep concurrent burst no matter how "cheap" it looks. A
+    // RESERVE account gets a tighter D (reserveConcurrencyTarget) so its capPenalty
+    // bites sooner — load fans out across the fleet before a low-quota account is
+    // dogpiled toward a 429.
+    const weeklyState = this._weeklyRawState(account);
+    const concTarget = weeklyState === 'reserve'
+      ? this.scheduler.reserveConcurrencyTarget
+      : this.scheduler.perAccountConcurrencyTarget;
     const capPenalty = this.scheduler.capPenaltyWeight
-      * Math.max(0, inflight - this.scheduler.perAccountConcurrencyTarget);
+      * Math.max(0, inflight - concTarget);
 
     // Burn-pace COST only (demoted from the old dominant scarcity×6 term): a
     // soft de-preference of accounts burning ahead of an even pace. Never a bench.
@@ -1867,6 +1906,7 @@ export class AccountManager {
     const spread = share * this.scheduler.spreadShareWeight;
 
     const ramp = this._recoveryRamp(account, now);
+    const reserveCost = this._reserveCost(account, now, weeklyState);
     const failurePenalty = account.consecutiveFailures * 5;
     // NO unknown-quota bonus. An account whose quota we cannot see must never be
     // MORE attractive than a known-healthy one — the old -0.5 nudge (safe only
@@ -1876,7 +1916,7 @@ export class AccountManager {
     // default) learns the real number within a cycle. `probing`/requalify still
     // flags a never-seen account for learning — that path is unchanged.
 
-    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + failurePenalty;
+    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + reserveCost + failurePenalty;
   }
 
   /**
@@ -1929,6 +1969,31 @@ export class AccountManager {
     return Math.max(0, used - elapsedFrac);
   }
 
+  /**
+   * Overflow cost for a weekly-RESERVE account (util 0.85-0.95). 0 for every other
+   * tier — normal/soft aren't softened, and critical/exhausted are hard-benched by the
+   * pass gate (never made cheaper here). This is what lets a reserve account be eligible
+   * in the FIRST selection pass yet still rank below healthy accounts: floor keeps it
+   * strictly behind an idle healthy pick, the band term makes deeper-into-reserve costlier
+   * (consumed later / preserved), and the reset-timing term makes the soonest-to-reset the
+   * cheapest reserve pick (use-it-or-lose-it). A slammed HEALTHY account can still score
+   * above a lightly-loaded reserve one (its capPenalty is unbounded) — that's intended
+   * load-spread, not a violation of "healthy first".
+   */
+  _reserveCost(account, now = Date.now(), weeklyState = this._weeklyRawState(account)) {
+    if (weeklyState !== 'reserve') return 0;
+    const q = account.quota;
+    const util = clamp01(q.unified7d);
+    const band = clamp01(
+      (util - this.scheduler.weeklyReserveThreshold)
+      / Math.max(1e-6, this.scheduler.weeklyCriticalThreshold - this.scheduler.weeklyReserveThreshold),
+    );
+    const pace = this._windowScarcity(q.unified7d, q.unified7dReset, WEEK_MS, now);
+    return this.scheduler.reserveFloorCost
+      + this.scheduler.reserveBandWeight * band
+      + this.scheduler.reserveScarcityWeight * pace;
+  }
+
   /**
    * Decaying penalty applied for `recoveryRampMs` after an account un-parks,
    * so a freshly-recovered account (which has ~0 recent load and may look most

package/src/config.js

@@ -90,18 +90,26 @@ export function createDefaultConfig() {
       weeklySoftThreshold: 0.65,
       weeklyReserveThreshold: 0.85,
       weeklyCriticalThreshold: 0.95,
-      weeklyExhaustedThreshold: 0.985,
+      // Use-it-or-lose-it: bench only at 99.9% (the weekly quota resets, so reserving
+      // the top ~1.5% wastes it). A real 429 sets util≈1.0 and still benches.
+      weeklyExhaustedThreshold: 0.999,
       // Cross-PROVIDER fallback policy for 'cc all' (profile=all): whether a session
-      // may be served by a provider family other than its home (Claude ↔ GLM ↔ Kimi).
-      //   'never'         — strict pin (Claude→Claude, GLM→GLM, Kimi→Kimi).
-      //   'when-exhausted'— (default) home family preferred; cross only once it's
-      //                     exhausted (a Claude session falls to GLM/Kimi when all
-      //                     Claude accounts are unavailable).
+      // may be served by a provider family other than its home (Claude → GLM/Kimi).
+      //   'never'         — (DEFAULT) a Claude Code session stays on Anthropic; no
+      //                     GLM/Kimi fallback. Routing Claude→providers proved unreliable
+      //                     (the coding legs 403/429 + ignore the model id), so it's OFF
+      //                     by default — re-enable here or via the TUI 'f' key.
+      //   'when-exhausted'— home family preferred; a Claude session falls to GLM/Kimi
+      //                     only once all Claude accounts are unavailable.
       //   'always'        — providers peer with Claude for a Claude/unknown session.
       // A GLM/Kimi-origin session NEVER routes to Anthropic under ANY policy — that
       // direction 400s on the non-`srvtoolu_` tool-use id and is unfixable. Toggle
       // live in the TUI (Routing sub-mode, 'f' key).
-      crossProviderFallbackPolicy: 'when-exhausted',
+      crossProviderFallbackPolicy: 'never',
+      // The OTHER cross direction (independent of the policy above): may a provider-origin
+      // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — reliable,
+      // both legs accept each other's ids. Only has effect under policy:'never'.
+      providerCrossFallback: true,
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -966,6 +966,13 @@ async function serverWorkerCommand() {
             crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
           };
         }
+        // Persist live-toggled automatic-update flags (the TUI 'u' Updates menu). Same
+        // reason as the policy above: without this the toggle takes effect in memory but
+        // silently reverts on the next config write / restart. Only write keys defined
+        // in-memory so a disk value is never clobbered with undefined.
+        for (const key of ['updateCheck', 'autoUpdate', 'autoApply']) {
+          if (config[key] !== undefined) diskConfig[key] = config[key];
+        }
         // Write in-memory accounts as the authoritative state, preserving
         // extra disk-only fields (e.g. importFrom) where the account still exists.
         // Use live tokens from AccountManager (not the stale config.accounts copy).
@@ -1038,18 +1045,55 @@ async function serverWorkerCommand() {
       restartController.requestRestart();
     }
   };
+  // Manual apply (the TUI 'u' → check & apply now): reload into a freshly-installed
+  // newer version REGARDLESS of autoApply — the user asked for it explicitly, so it must
+  // NOT no-op just because the AUTOMATIC path is off (that no-op is exactly the "relaunch
+  // still shows the old version" pain this menu exists to kill).
+  const applyNow = r => {
+    if (r?.applicable && restartController) {
+      markApplied(r.installedVersion);
+      notifyUpdate('Applying update — seamless reload…');
+      restartController.requestRestart();
+    }
+  };
+  // ONE in-flight latch shared by the periodic timer, the cold-start probe, AND the
+  // manual action, so two `npm i -g` can never race (global-package corruption). hasLease
+  // already blocks CROSS-worker races; this blocks same-worker timer-vs-manual overlap.
+  let updateInFlight = false;
+  const runUpdateCheck = async ({ announce, apply, forceInstall = false }) => {
+    if (updateInFlight || !hasLease || config?.updateCheck === false) return undefined;
+    updateInFlight = true;
+    try {
+      // The MANUAL action forces the install (autoUpdate:true) so pressing 'u' → 'c'
+      // actually downloads + reloads even when AUTOMATIC updates are off. Without this,
+      // maybeCheckForUpdate short-circuits before installing when config.autoUpdate is
+      // false (the default) and just tells the user to run `npm i -g` by hand — the exact
+      // quit/relaunch dance this menu exists to kill. The periodic + cold-start paths
+      // pass the real config so they still respect the user's autoUpdate choice.
+      const cfg = forceInstall ? { ...config, autoUpdate: true } : config;
+      const r = await maybeCheckForUpdate(cfg, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce });
+      apply(r);
+      return r;
+    } catch { return undefined; /* update path is best-effort; never break the proxy */ }
+    finally { updateInFlight = false; }
+  };
+  // 'u' → check & apply now: force an immediate check + install + seamless reload so the
+  // user never has to quit/relaunch to pick up a release. Reports the up-to-date case too.
+  const checkForUpdatesNow = async () => {
+    if (updateInFlight) { notifyUpdate('Update check already running'); return; }
+    if (!hasLease) { notifyUpdate('Updates run on the primary worker only'); return; }
+    if (config?.updateCheck === false) { notifyUpdate('Update checks are disabled in config'); return; }
+    notifyUpdate('Checking for updates…');
+    const r = await runUpdateCheck({ announce: true, apply: applyNow, forceInstall: true });
+    if (r && !r.hasUpdate) notifyUpdate('Already on the latest version');
+  };
+  if (tui) tui.checkNow = checkForUpdatesNow;
   const updateIntervalMs = Math.max(60_000, Number(process.env.MAXPOOL_UPDATE_CHECK_INTERVAL_MS) || 6 * 60 * 60 * 1000);
   updateTimer = setInterval(() => {
-    // ONLY the lease-holding primary self-installs — the timer is unconditional across
-    // EVERY worker (incl. a headless reload worker), so gate on hasLease here to avoid
-    // two `npm i -g` racing during a reload overlap (global-package corruption). A
-    // headless reload worker never holds the lease, so it never installs/auto-applies.
-    if (config?.updateCheck === false || !hasLease) return;
     // announce:false — the persistent TUI banner is the passive reminder; only real
-    // actions (installing / applying) log here, so a pending update never churns the log.
-    maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce: false })
-      .then(applyUpdateIfReady)
-      .catch(() => {});
+    // actions (installing / applying) log. runUpdateCheck's latch + hasLease gate prevent
+    // racing installs (a headless reload worker never holds the lease, so never installs).
+    runUpdateCheck({ announce: false, apply: applyUpdateIfReady });
   }, updateIntervalMs);
   updateTimer.unref();
 
@@ -1099,11 +1143,10 @@ async function serverWorkerCommand() {
     // A reload-spawned/takeover worker must NEVER re-probe (1x not 2x traffic).
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
-      // Cold-start-behind: download AND (autoApply) self-apply via the SAME helper as the
-      // periodic path — so the version is applied, not marked-attempted-then-stranded.
-      maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; })
-        .then(applyUpdateIfReady)
-        .catch(() => {});
+      // Cold-start-behind: download AND (autoApply) self-apply via the SAME latched helper
+      // as the periodic path — so the version is applied, not marked-attempted-then-stranded,
+      // and it can't race the periodic timer's install.
+      runUpdateCheck({ announce: true, apply: applyUpdateIfReady });
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }

package/src/server.js

@@ -1348,16 +1348,22 @@ function classifyRateLimit(account, headers, body, opts = {}) {
   // genuine account cap with stripped headers must bench the whole account, not one
   // model). Neither bucket may be at/above the exhaustion floor.
   const haveUnifiedEvidence = Number.isFinite(weekly) || Number.isFinite(fiveHour);
+  // Exhaustion floor for 429-SCOPE classification — kept in sync with the scheduler's
+  // weeklyExhaustedThreshold (0.999, use-it-or-lose-it). A 429 whose unified buckets are
+  // still below the floor isn't weekly-exhaustion, so a model-family + long-retry-after
+  // 429 benches only that model, not the whole (still-usable) account — matching routing,
+  // which now treats 0.95-0.999 as usable (critical), not benched.
+  const EXHAUSTION_FLOOR = 0.999;
   const unifiedNotExhausted =
-    (!Number.isFinite(weekly) || weekly < 0.985) && (!Number.isFinite(fiveHour) || fiveHour < 0.985);
+    (!Number.isFinite(weekly) || weekly < EXHAUSTION_FLOOR) && (!Number.isFinite(fiveHour) || fiveHour < EXHAUSTION_FLOOR);
   const modelScope =
     (fam && haveUnifiedEvidence && unifiedNotExhausted && Number.isFinite(retryAfter) && retryAfter >= 30 * 60)
       ? fam : null;
 
   const quotaHeaderExhaustion =
     unifiedStatus === 'rejected'
-    || (Number.isFinite(fiveHour) && fiveHour >= 0.985)
-    || (Number.isFinite(weekly) && weekly >= 0.985)
+    || (Number.isFinite(fiveHour) && fiveHour >= EXHAUSTION_FLOOR)
+    || (Number.isFinite(weekly) && weekly >= EXHAUSTION_FLOOR)
     || (headers['anthropic-ratelimit-tokens-remaining'] != null && tokensRemaining <= 0)
     || (headers['anthropic-ratelimit-requests-remaining'] != null && requestsRemaining <= 0);
   if (quotaHeaderExhaustion) return { scope: 'account', fingerprint: null, modelScope };

package/src/tui.js

@@ -27,9 +27,9 @@ const vw = s => strip(s).length;
 // ── Accounts-table columns ───────────────────────────────────
 // Fixed column widths shared by the header row (acctHeader) AND every data row, so
 // the header labels stay aligned with the columns they name. The Account/Provider/
-// Status/Quota start offsets (4/21/31/45) are pure functions of these widths + the
+// Status/Quota start offsets (4/25/35/49) are pure functions of these widths + the
 // 4-col row prefix, independent of the quota-bar width.
-const NAME_W = 16;         // a.name.slice(0, NAME_W).padEnd(NAME_W) — wide enough for a full email
+const NAME_W = 20;         // a.name.slice(0, NAME_W).padEnd(NAME_W) — fits a full email like 2solarmax@gmail.com (19)
 const PROVIDER_W = 9;      // providerLabel(a).padEnd(PROVIDER_W) — fits "Anthropic"
 const STATUS_W = 13;       // rpad(status, STATUS_W) — fits "throttled 59s"
 const ROW_PREFIX = '    '; // ' ' + sel(1) + cur(1) + ' ' — 4 cols before the name
@@ -250,6 +250,9 @@ export class TUI {
     this.syncAccounts = syncAccounts;
     this.onQuit = onQuit;
     this.onRestart = onRestart;
+    // Set by index.js after construction (a deferred closure, not a constructor literal —
+    // avoids the const TDZ on applyUpdateIfReady, which is defined after `new TUI`).
+    this.checkNow = null;
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -400,6 +403,7 @@ export class TUI {
       case 'normal': this._keyNormal(k); break;
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
+      case 'updates': this._keyUpdates(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
       case 'confirm': this._keyConfirm(k); break;
@@ -435,11 +439,52 @@ export class TUI {
         'Reload account credentials and newly added accounts from the config file.',
         () => this._doSync(),
       );
+    } else if (k === 'u') {
+      this.mode = 'updates';
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
   }
 
+  // Automatic updates are "on" only when the whole chain is enabled: check npm →
+  // install to disk → seamlessly reload. Any one off means a release won't land hands-free.
+  _autoUpdateOn() {
+    const c = this.config || {};
+    return c.updateCheck !== false && c.autoUpdate === true && c.autoApply === true;
+  }
+
+  _keyUpdates(k) {
+    if (k === 'c') {
+      // Check & apply now — the dance-killer: pull the latest + seamless-reload in place,
+      // no quit/relaunch. index.js wires this.checkNow (applies regardless of autoApply).
+      this.mode = 'normal';
+      if (this.checkNow) this.checkNow();
+      else this._addLog('Update check unavailable on this worker');
+    } else if (k === 't') {
+      this._toggleAutoUpdate();
+    } else if (k === 'esc' || k === 'q') {
+      this.mode = 'normal';
+    }
+  }
+
+  async _toggleAutoUpdate() {
+    const turnOn = !this._autoUpdateOn();
+    // ON = the full hands-free chain; OFF = keep checking (banner still shows) but never
+    // install/reload without the user. Mutating this.config (=== the object index.js's
+    // update timer reads) takes effect live; saveConfig persists it (index.js writes these
+    // three keys) so it survives a restart.
+    this.config.updateCheck = true;
+    this.config.autoUpdate = turnOn;
+    this.config.autoApply = turnOn;
+    try {
+      await this.saveConfig(this.config);
+      this._addLog(`Automatic updates ${turnOn ? 'on' : 'off'}`);
+    } catch (error) {
+      this._addLog(`Could not save update setting: ${error.message}`);
+    }
+    this.mode = 'normal';
+  }
+
   _keyAccounts(k) {
     if (k === 'k') {
       this.mode = 'input';
@@ -984,7 +1029,12 @@ export class TUI {
     // ── Header
     const v = this.am.versionInfo;
     const verStr = v?.current ? ` ${dim('v' + v.current)}` : '';
-    const left = bold(' Maxpool') + verStr;
+    // Auto-update state next to the version, so it's obvious whether a published release
+    // lands hands-free (green "auto-update on") or needs a manual 'u' (dim "off").
+    const auto = this._autoUpdateOn()
+      ? green('· auto-update on')
+      : dim('· auto-update off');
+    const left = bold(' Maxpool') + verStr + ' ' + auto;
     const port = this.config.proxy?.port || 3456;
     const right = `Port ${port} ${green('▲')} `;
     lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
@@ -1009,8 +1059,10 @@ export class TUI {
     // blank line). The persistent banner IS the reminder; a long-lived session's
     // periodic re-check keeps it current (index.js updateTimer refreshes versionInfo).
     if (v?.hasUpdate && v?.latest) {
-      lines.push('  ' + yellow(`↑ Update available: v${v.current} → v${v.latest}`)
-        + dim("  ·  run 'npm i -g maxpool', then press r"));
+      // No more "run npm i -g, then press r" — that manual dance is what the Updates menu
+      // kills. Auto-update ON: it applies itself; either way 'u' pulls + reloads in place.
+      const how = this._autoUpdateOn() ? 'applying automatically · or press u now' : 'press u to update now';
+      lines.push('  ' + yellow(`↑ Update available: v${v.current} → v${v.latest}`) + dim(`  ·  ${how}`));
     }
     const routing = this.am.routingMode === 'preferred'
       ? `Manual preference: ${this.am.preferredAccountName} (automatic failover)`
@@ -1062,11 +1114,11 @@ export class TUI {
       // misaligned second header).
       lines.push(dimUnderline(acctHeader(W)));
       const showBoth = W >= 70;
-      // 61/50 = the fixed pre-bar column span (prefix + Account + Provider + Status +
-      // gaps); grew by +4 with the wider 16-col Account column (was 57/46 at NAME_W 12).
+      // 65/54 = the fixed pre-bar column span (prefix + Account + Provider + Status +
+      // gaps); grew by +4 with the wider 20-col Account column (was 61/50 at NAME_W 16).
       const bw = showBoth
-        ? Math.max(5, Math.min(20, Math.floor((W - 61) / 2)))
-        : Math.max(5, Math.min(20, W - 50));
+        ? Math.max(5, Math.min(20, Math.floor((W - 65) / 2)))
+        : Math.max(5, Math.min(20, W - 54));
 
       // Claude/OAuth accounts first, providers (GLM/Kimi fallback) last — a stable
       // display order over the canonical am.accounts array (which stays untouched so
@@ -1242,7 +1294,7 @@ export class TUI {
     // still usable, "Fable maxed" (red) ONLY at genuine exhaustion. This is the
     // SAME predicate the router benches on (_scopedExhausted), so "maxed" renders
     // iff the model is actually benched — 90%/critical is no longer mislabelled.
-    const exhaustedFloor = this.am.scheduler?.weeklyExhaustedThreshold ?? 0.985;
+    const exhaustedFloor = this.am.scheduler?.weeklyExhaustedThreshold ?? 0.999;
     const reserveFloor = this.am.scheduler?.weeklyReserveThreshold ?? 0.85;
     const scopedTags = [];
     for (const [fam, e] of Object.entries(q.scopedWeekly || {})) {
@@ -1355,7 +1407,11 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
+      case 'updates': {
+        const state = this._autoUpdateOn() ? green('on') : dim('off');
+        return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;
+      }
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing': {