maxpool 1.5.42 → 1.5.44

package/README.md

@@ -270,7 +270,7 @@ TEAMCLAUDE_CONFIG=./my-config.json maxpool server
     "weeklySoftThreshold": 0.65,
     "weeklyReserveThreshold": 0.85,
     "weeklyCriticalThreshold": 0.95,
-    "weeklyExhaustedThreshold": 0.985,
+    "weeklyExhaustedThreshold": 0.999,
     "weeklyBurnDebtWeight": 0.6
   },
   "retry": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.42",
+  "version": "1.5.44",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -91,7 +91,12 @@ const DEFAULT_SCHEDULER = {
   weeklySoftThreshold: 0.65,
   weeklyReserveThreshold: 0.85,
   weeklyCriticalThreshold: 0.95,
-  weeklyExhaustedThreshold: 0.985,
+  // Use-it-or-lose-it (2026-07-24): bench only at 99.9%, not 98.5% — the weekly quota
+  // resets, so reserving the top ~1.5% just wastes it. The thin 0.1% floor is the ONE
+  // remaining guard: don't fire a request at an account whose own header already says
+  // it's essentially full (a near-guaranteed-waste hard-429). A real 429 sets util≈1.0
+  // and still benches here. Critical (0.95-0.999) stays last-resort-only (pass 2).
+  weeklyExhaustedThreshold: 0.999,
   weeklyBurnDebtWeight: 0.6,
   // Routing-cost tuning (lower cost = preferred). The goal is to AVOID
   // short-term (rate/concurrency) throttling by spreading load across healthy

package/src/config.js

@@ -90,7 +90,9 @@ export function createDefaultConfig() {
       weeklySoftThreshold: 0.65,
       weeklyReserveThreshold: 0.85,
       weeklyCriticalThreshold: 0.95,
-      weeklyExhaustedThreshold: 0.985,
+      // Use-it-or-lose-it: bench only at 99.9% (the weekly quota resets, so reserving
+      // the top ~1.5% wastes it). A real 429 sets util≈1.0 and still benches.
+      weeklyExhaustedThreshold: 0.999,
       // Cross-PROVIDER fallback policy for 'cc all' (profile=all): whether a session
       // may be served by a provider family other than its home (Claude → GLM/Kimi).
       //   'never'         — (DEFAULT) a Claude Code session stays on Anthropic; no

package/src/index.js

@@ -12,7 +12,7 @@ import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, toke
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
-import { maybeCheckForUpdate, getCurrentVersion, markApplied } from './updater.js';
+import { maybeCheckForUpdate, getCurrentVersion, markApplied, clearQuarantine } from './updater.js';
 import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
@@ -23,10 +23,20 @@ import {
 const args = process.argv.slice(2);
 const command = args[0];
 const SERVER_RESTART_EXIT_CODE = 75;
+// Reload readiness handshake budget. On a loaded machine (Bitdefender, many node procs,
+// a local LLM) a fresh worker can need well over 10s to boot + signal ready; too tight →
+// the seamless reload rolls back and the update/restart silently never lands. Generous +
+// env-tunable; covers BOTH the ready and the takeover waits in runReloadBaton.
+const RELOAD_READY_MS = Math.max(10_000, Number(process.env.MAXPOOL_RELOAD_READY_MS) || 30_000);
 // If a seamless reload doesn't release us (→ take over) within this window, the new
-// worker rolled back — self-heal admission so we don't 503 forever. > the baton
-// readiness timeout (10s) + margin.
-const RELOAD_ROLLBACK_SELFHEAL_MS = Math.max(15_000, Number(process.env.MAXPOOL_RELOAD_SELFHEAL_MS) || 30_000);
+// worker rolled back — self-heal admission so we don't 503 forever. Must sit ABOVE the
+// baton readiness budget + margin so it never fires WHILE the baton is still handshaking.
+// Default (RELOAD_READY_MS + 20s = 50s) sits comfortably above the readiness budget, so
+// the self-heal never fires mid-handshake. An explicit MAXPOOL_RELOAD_SELFHEAL_MS override
+// is honored down to a 15s floor (used by the reload integration test) — a sub-ready
+// override only risks a spurious "rolled back" log + brief admission flap (no corruption:
+// the new worker holds no lease until takeover), never a false double-writer.
+const RELOAD_ROLLBACK_SELFHEAL_MS = Math.max(15_000, Number(process.env.MAXPOOL_RELOAD_SELFHEAL_MS) || RELOAD_READY_MS + 20_000);
 // Seamless-reload drain cap. On a seamless reload the NEW worker already serves
 // ALL new traffic while the OLD worker only finishes its own in-flight requests,
 // so a long old-worker drain has zero request-facing cost — let a long streaming
@@ -326,6 +336,10 @@ async function supervisorCommand() {
         // listener to cover the cutover gap, then hand THAT live handle to the
         // new worker. The new worker's MSG_PRIMARY then closes it again.
         prepareHandle: async () => { await relistenMaster(); return masterServer; },
+        // Generous, env-tunable readiness/takeover budgets — the 10s default rolled back
+        // on this user's loaded Mac (the update never landed). See RELOAD_READY_MS.
+        readyTimeoutMs: RELOAD_READY_MS,
+        takeoverTimeoutMs: RELOAD_READY_MS,
         log: msg => console.log(`[Maxpool] ${msg}`),
       });
 
@@ -1083,6 +1097,10 @@ async function serverWorkerCommand() {
     if (updateInFlight) { notifyUpdate('Update check already running'); return; }
     if (!hasLease) { notifyUpdate('Updates run on the primary worker only'); return; }
     if (config?.updateCheck === false) { notifyUpdate('Update checks are disabled in config'); return; }
+    // An EXPLICIT manual apply always re-attempts — clear any quarantine a prior auto-reload
+    // left (e.g. a rollback from a too-tight readiness timeout), so 'u'→'c' can't dead-end on
+    // "already attempted — will retry only a newer release".
+    clearQuarantine();
     notifyUpdate('Checking for updates…');
     const r = await runUpdateCheck({ announce: true, apply: applyNow, forceInstall: true });
     if (r && !r.hasUpdate) notifyUpdate('Already on the latest version');

package/src/server.js

@@ -1348,16 +1348,22 @@ function classifyRateLimit(account, headers, body, opts = {}) {
   // genuine account cap with stripped headers must bench the whole account, not one
   // model). Neither bucket may be at/above the exhaustion floor.
   const haveUnifiedEvidence = Number.isFinite(weekly) || Number.isFinite(fiveHour);
+  // Exhaustion floor for 429-SCOPE classification — kept in sync with the scheduler's
+  // weeklyExhaustedThreshold (0.999, use-it-or-lose-it). A 429 whose unified buckets are
+  // still below the floor isn't weekly-exhaustion, so a model-family + long-retry-after
+  // 429 benches only that model, not the whole (still-usable) account — matching routing,
+  // which now treats 0.95-0.999 as usable (critical), not benched.
+  const EXHAUSTION_FLOOR = 0.999;
   const unifiedNotExhausted =
-    (!Number.isFinite(weekly) || weekly < 0.985) && (!Number.isFinite(fiveHour) || fiveHour < 0.985);
+    (!Number.isFinite(weekly) || weekly < EXHAUSTION_FLOOR) && (!Number.isFinite(fiveHour) || fiveHour < EXHAUSTION_FLOOR);
   const modelScope =
     (fam && haveUnifiedEvidence && unifiedNotExhausted && Number.isFinite(retryAfter) && retryAfter >= 30 * 60)
       ? fam : null;
 
   const quotaHeaderExhaustion =
     unifiedStatus === 'rejected'
-    || (Number.isFinite(fiveHour) && fiveHour >= 0.985)
-    || (Number.isFinite(weekly) && weekly >= 0.985)
+    || (Number.isFinite(fiveHour) && fiveHour >= EXHAUSTION_FLOOR)
+    || (Number.isFinite(weekly) && weekly >= EXHAUSTION_FLOOR)
     || (headers['anthropic-ratelimit-tokens-remaining'] != null && tokensRemaining <= 0)
     || (headers['anthropic-ratelimit-requests-remaining'] != null && requestsRemaining <= 0);
   if (quotaHeaderExhaustion) return { scope: 'account', fingerprint: null, modelScope };

package/src/tui.js

@@ -1294,7 +1294,7 @@ export class TUI {
     // still usable, "Fable maxed" (red) ONLY at genuine exhaustion. This is the
     // SAME predicate the router benches on (_scopedExhausted), so "maxed" renders
     // iff the model is actually benched — 90%/critical is no longer mislabelled.
-    const exhaustedFloor = this.am.scheduler?.weeklyExhaustedThreshold ?? 0.985;
+    const exhaustedFloor = this.am.scheduler?.weeklyExhaustedThreshold ?? 0.999;
     const reserveFloor = this.am.scheduler?.weeklyReserveThreshold ?? 0.85;
     const scopedTags = [];
     for (const [fam, e] of Object.entries(q.scopedWeekly || {})) {

package/src/updater.js

@@ -95,6 +95,14 @@ export function markApplied(version) {
   }
 }
 
+/** Clear the applied-version quarantine floor. The AUTO path quarantines a version it
+ *  ATTEMPTED (markApplied, before the reload) so a genuinely boot-broken release can't
+ *  reload-loop — but a reload that rolled back for a NON-version reason (e.g. a slow
+ *  readiness handshake on a loaded machine) then wrongly strands a perfectly-good version
+ *  ("already attempted — will retry only a newer release"). An EXPLICIT manual apply calls
+ *  this first so the user can always re-attempt the current latest. */
+export function clearQuarantine() { _lastAttemptedTarget = null; }
+
 /**
  * Check for an update; with `config.autoUpdate` also self-install; with
  * `config.autoApply` SIGNAL that the caller should seamlessly reload to APPLY it