maxpool 1.5.45 → 1.5.47

package/README.md

@@ -194,7 +194,7 @@ Provider fallback credentials can be supplied per Claude Code process with `ANTH
 
 `x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
 
-**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session that used no server tools runs on Claude (its *thinking* blocks are rejected, but Maxpool strips them automatically — see self-heal below) and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` (default) = **Claude sessions never spill onto a provider** (note: this governs the Claude→provider direction only — it is NOT a same-family pin), `when-exhausted` = cross only once the home family is exhausted, `always` = providers peer with Claude.
 
 The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.45",
+  "version": "1.5.47",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -136,8 +136,9 @@ const DEFAULT_SCHEDULER = {
   crossAccountThinkingMigration: true,
   // Cross-PROVIDER fallback policy for 'cc all' (profile=all), i.e. whether a session
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
-  //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
-  //                     uses GLM only; a Kimi session uses Kimi only.
+  //   'never'         — (DEFAULT) a Claude session never spills onto a provider. NOTE:
+  //                     this governs the Claude→provider direction ONLY — it is NOT a
+  //                     same-family pin (a provider-origin session still reaches Claude).
   //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
   //                     only once all Claude accounts are unavailable, and a GLM session
   //                     may fall to Kimi once GLM is exhausted.
@@ -157,6 +158,18 @@ const DEFAULT_SCHEDULER = {
   // kept even while Claude→provider is 'never'. Only has effect under policy:'never' (the
   // 'when-exhausted'/'always' paths never pinned to home). Set false for a strict home-pin.
   providerCrossFallback: true,
+  // PER-PROVIDER Claude→provider control. One knob per provider so GLM and Kimi are
+  // steered independently (their reliability and quota differ). Each takes the same
+  // 'never' | 'when-exhausted' | 'always'. Undefined ⇒ inherit crossProviderFallbackPolicy,
+  // so an existing config upgrades to byte-identical behavior. Default 'never': letting a
+  // Claude session finish on a provider contaminates its transcript (BOTH providers emit
+  // thinking blocks Anthropic rejects — measured 2026-07-25), and while Maxpool now repairs
+  // that automatically, a provider server-tool call is NOT repairable.
+  // Ships EMPTY on purpose: an unset provider INHERITS crossProviderFallbackPolicy (whose
+  // default is already 'never'), so off-by-default holds without a per-provider entry
+  // shadowing the global one. Seeding explicit values here would mean cycling the global
+  // policy silently did nothing — the two-gate trap.
+  providers: {},
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 // Consecutive failed recovery probes before we stop trusting the SHARED breaker and
@@ -1717,7 +1730,7 @@ export class AccountManager {
   _effectivePriority(account, requestInfo = {}) {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     if (account.type === 'provider'
-        && this._crossProviderFallbackPolicy() === 'always'
+        && this._claudeFallbackFor(account.provider) === 'always'
         && !this._effectiveIncompatible(requestInfo).incompatible) {
       return 0;
     }
@@ -1745,6 +1758,23 @@ export class AccountManager {
     };
   }
 
+  /** Claude→provider policy for ONE provider. Falls back to the legacy global policy when
+   *  unset, so an existing config keeps its exact behavior on upgrade. */
+  _claudeFallbackFor(providerKey) {
+    const per = this.scheduler.providers?.[providerKey]?.claudeFallback;
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    return valid.has(per) ? per : this._crossProviderFallbackPolicy();
+  }
+
+  setClaudeFallbackForProvider(providerKey, policy) {
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    if (!providerKey || !valid.has(policy)) return false;
+    const providers = { ...(this.scheduler.providers || {}) };
+    providers[providerKey] = { ...(providers[providerKey] || {}), claudeFallback: policy };
+    this.scheduler.providers = providers;
+    return true;
+  }
+
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
@@ -1789,7 +1819,9 @@ export class AccountManager {
     // lets providers serve as a priority-fallback; 'always' peers them
     // (_effectivePriority). Signed thinking no longer bars providers here — but its
     // live MIGRATION stays Claude-only (see the rebalance guard).
-    if (account.type === 'provider' && policy === 'never') return false;
+    // PER-PROVIDER Claude→provider gate (GLM and Kimi steer independently). Unset ⇒
+    // inherits the legacy global policy, so behavior is unchanged on upgrade.
+    if (account.type === 'provider' && this._claudeFallbackFor(account.provider) === 'never') return false;
     return true;
   }
 
@@ -1835,6 +1867,25 @@ export class AccountManager {
     this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
   }
 
+  // Latch a session whose transcript carries provider-authored thinking blocks Anthropic
+  // rejects. Without this the repair is per-REQUEST: the client resends the whole poisoned
+  // history every turn, so each turn pays another rejected round-trip before the strip
+  // (measured: ~9 rejections per contaminated session). Sticky → later turns are stripped
+  // BEFORE the first attempt. In-memory only, like the other session policies.
+  markSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.thinkingContaminated) {
+      console.log(`[Maxpool] Session "${sessionKey}" carries provider-authored thinking — stripping it up front from now on`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, thinkingContaminated: true });
+  }
+
+  isSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(sessionKey)?.thinkingContaminated);
+  }
+
   _isSessionLargeContext(requestInfo = {}) {
     if (requestInfo.largeContext) return true;
     if (!requestInfo.sessionKey) return false;

package/src/config.js

@@ -110,6 +110,14 @@ export function createDefaultConfig() {
       // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — reliable,
       // both legs accept each other's ids. Only has effect under policy:'never'.
       providerCrossFallback: true,
+      // Per-provider Claude→provider control (TUI routing: g = GLM, k = Kimi). Same values
+      // as the policy above; unset inherits it. Default 'never' — a Claude session that
+      // finishes on a provider comes back with thinking blocks Anthropic rejects (Maxpool
+      // repairs that automatically, but a provider server-tool call is unrepairable).
+      // Left EMPTY: an unset provider inherits the policy above, so off-by-default holds
+      // without shadowing it. The TUI writes an entry here only when you steer one
+      // provider differently from the other.
+      providers: {},
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -974,10 +974,14 @@ async function serverWorkerCommand() {
         // policy cycled with the TUI 'f' key). Without this, the toggle takes effect
         // in memory but silently reverts on the next config write / restart. Merge
         // onto the existing disk scheduler block so other scheduler keys survive.
-        if (config.scheduler?.crossProviderFallbackPolicy) {
+        if (config.scheduler?.crossProviderFallbackPolicy || config.scheduler?.providers) {
           diskConfig.scheduler = {
             ...diskConfig.scheduler,
-            crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
+            ...(config.scheduler.crossProviderFallbackPolicy
+              ? { crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy } : {}),
+            // Per-provider Claude→provider settings (TUI routing g / k). Must be listed
+            // here explicitly or the toggle takes effect in memory and silently reverts.
+            ...(config.scheduler.providers ? { providers: config.scheduler.providers } : {}),
           };
         }
         // Persist live-toggled automatic-update flags (the TUI 'u' Updates menu). Same

package/src/server.js

@@ -354,6 +354,18 @@ async function forwardRequest(
   const configuredAttempts = Number(retryConfig.maxAttemptsPerRequest) || accountManager.accounts.length;
   const maxAttempts = Math.max(1, configuredAttempts);
 
+  // PRE-STRIP a session already known to carry provider-authored thinking. The client
+  // resends the whole poisoned history every turn, so without this each turn pays another
+  // rejected round-trip before the reactive repair kicks in. Latched by the first repair.
+  if (retryCount === 0 && !requestInfo.thinkingStripped
+    && accountManager.isSessionThinkingContaminated?.(requestInfo.sessionKey)) {
+    const pre = stripForeignThinkingBlocks(body);
+    if (pre.body) {
+      body = pre.body;
+      requestInfo = { ...requestInfo, thinkingStripped: true };
+    }
+  }
+
   // Select account
   const lease = accountManager.acquireAccount(requestInfo, excludedIndexes);
   const account = lease?.account;
@@ -896,8 +908,14 @@ async function forwardRequest(
       // for the strip-and-recover retry below. Deliberately NOT the fuzzy
       // isAnthropicIncompatBody heuristic, so a merely malformed request can never cause
       // us to rewrite a user's transcript.
+      // Two deterministic shapes, both repairable by stripping: a signature Anthropic
+      // can't validate, AND a provider block that carries NO signature field at all
+      // ("messages.4.content.0.thinking.signature: Field required"). The second variant
+      // used to fall straight through to a PERMANENT provider pin even though stripping
+      // fixes it. Still deterministic — never the fuzzy isAnthropicIncompatBody heuristic.
       const isSignatureRejection = account.type !== 'provider'
-        && /invalid `signature` in `thinking`/i.test(errorBody);
+        && (/invalid `signature` in `thinking`/i.test(errorBody)
+          || /content\.\d+\.thinking\.signature/i.test(errorBody));
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
@@ -943,6 +961,9 @@ async function forwardRequest(
         && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
         const { body: cleanBody, removed } = stripForeignThinkingBlocks(body);
         if (cleanBody) {
+          // Latch it so EVERY later turn is stripped up front instead of re-paying this
+          // rejected round-trip (the client resends the full poisoned history each turn).
+          accountManager.markSessionThinkingContaminated?.(requestInfo.sessionKey);
           console.log(`[Maxpool] Recovering session on Claude: stripped ${removed} provider-authored thinking block(s) Anthropic rejected`);
           return forwardRequest(
             req, res, cleanBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
@@ -1334,7 +1355,7 @@ function isContextLengthError(errorBody) {
   return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, isCapacitySignalStatus, isForeignThinkingSignature, stripForeignThinkingBlocks, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1510,17 +1531,16 @@ function secondsUntilParsedTime(value) {
   return null;
 }
 
-// An Anthropic thinking `signature` is a long base64 protobuf blob (200+ chars, e.g.
-// "Eo8DCpQBCBAYAipAqutr+oAB…"). GLM's Anthropic-compatible endpoint emits a SHORT hex
-// digest instead (verified 2026-07-25: "8f8840affff743118e1f569d", 24 hex chars) — which
-// Anthropic rejects with `Invalid \`signature\` in \`thinking\` block`, permanently
-// bricking any session that took even ONE provider turn. Detect the foreign shape
-// conservatively: only a missing / short / pure-hex signature counts, so a genuine
-// Anthropic block is never stripped.
-function isForeignThinkingSignature(sig) {
-  if (typeof sig !== 'string' || sig.length === 0) return true;
-  if (sig.length < 60) return true;
-  return /^[0-9a-f]+$/i.test(sig);
+// Provider thinking signatures CANNOT be told apart from Anthropic's by shape — measured
+// against the live APIs 2026-07-25: Anthropic ~200-400 char base64, GLM a 24-char hex
+// digest, Kimi(K3) a 12,946-char base64 blob. A shape heuristic tuned to GLM silently
+// missed Kimi entirely. So the repair below does NOT guess: it strips EVERY `thinking`
+// block. That is safe precisely because it only ever runs in response to Anthropic's own
+// signature-rejection 400 — a healthy Claude-only session never reaches it — and a history
+// with thinking removed is accepted (200 OK, verified, incl. tool_use → tool_result).
+// `redacted_thinking` is never touched: it legitimately carries `data` and no signature.
+function isStrippableThinkingBlock(block) {
+  return block?.type === 'thinking';
 }
 
 /**
@@ -1546,12 +1566,7 @@ function stripForeignThinkingBlocks(body) {
       if (msg?.role !== 'assistant' || !Array.isArray(msg.content)) { messages.push(msg); continue; }
       let localRemoved = 0;
       const kept = msg.content.filter(block => {
-        // ONLY `thinking`. NEVER `redacted_thinking`: a genuine one carries `data` and
-        // legitimately has NO signature, so signature-based judging would strip 100% of
-        // them (verified against the live API). GLM's contamination is always a
-        // `thinking` block with a hex signature.
-        if (block?.type !== 'thinking') return true;
-        if (!isForeignThinkingSignature(block.signature)) return true;
+        if (!isStrippableThinkingBlock(block)) return true;
         localRemoved++;
         return false;
       });

package/src/tui.js

@@ -253,6 +253,7 @@ export class TUI {
     // Set by index.js after construction (a deferred closure, not a constructor literal —
     // avoids the const TDZ on applyUpdateIfReady, which is defined after `new TUI`).
     this.checkNow = null;
+    this.updateBusy = null;   // live progress text while an update check/apply runs
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -456,10 +457,20 @@ export class TUI {
   _keyUpdates(k) {
     if (k === 'c') {
       // Check & apply now — the dance-killer: pull the latest + seamless-reload in place,
-      // no quit/relaunch. index.js wires this.checkNow (applies regardless of autoApply).
-      this.mode = 'normal';
-      if (this.checkNow) this.checkNow();
-      else this._addLog('Update check unavailable on this worker');
+      // no quit/relaunch. STAY on this screen and show live progress: bouncing straight
+      // back to the dashboard was indistinguishable from "nothing happened".
+      if (!this.checkNow) { this._addLog('Update check unavailable on this worker'); return; }
+      if (this.updateBusy) return;                       // already running
+      this.updateBusy = 'Checking npm…';
+      this.render();
+      Promise.resolve(this.checkNow())
+        .catch(() => {})
+        .finally(() => {
+          // If an update was found+applied, the seamless reload replaces this worker and
+          // this never renders. Otherwise report the outcome in place.
+          this.updateBusy = null;
+          if (this.mode === 'updates') this.render();
+        });
     } else if (k === 't') {
       this._toggleAutoUpdate();
     } else if (k === 'esc' || k === 'q') {
@@ -467,6 +478,29 @@ export class TUI {
     }
   }
 
+  /** The visible Updates panel. Answers, at a glance: what am I running, is anything
+   *  newer, is it automatic, and what is happening right now. */
+  _renderUpdatesDetail() {
+    const v = this.am.versionInfo;
+    const running = v?.current ? `v${v.current}` : 'unknown';
+    const auto = this._autoUpdateOn();
+    const out = [];
+    out.push(` ${bold('Updates')}`);
+    if (!v) {
+      out.push(` ${dim('Running')} ${running}   ${dim('· checking npm for a newer version…')}`);
+    } else if (v.hasUpdate && v.latest) {
+      out.push(` ${dim('Running')} ${running}   ${yellow(`v${v.latest} is available`)}`);
+      out.push(auto
+        ? ` ${dim('It installs itself automatically. Press')} ${bold('c')} ${dim('to get it right now.')}`
+        : ` ${dim('Automatic updates are off. Press')} ${bold('c')} ${dim('to install it now, or')} ${bold('t')} ${dim('to turn automatic on.')}`);
+    } else {
+      out.push(` ${dim('Running')} ${running}   ${green('up to date')}`);
+      out.push(` ${dim(auto ? 'New versions install themselves.' : 'Automatic updates are off — press t to turn them on.')}`);
+    }
+    if (this.updateBusy) out.push(` ${cyan(SPINNER[this.frame])} ${dim(this.updateBusy)}`);
+    return out;
+  }
+
   async _toggleAutoUpdate() {
     const turnOn = !this._autoUpdateOn();
     // ON = the full hands-free chain; OFF = keep checking (banner still shows) but never
@@ -525,6 +559,8 @@ export class TUI {
       );
     } else if (k === 'p' && this.am.accounts.some(account => account.type !== 'provider')) {
       this._startSelection('prefer');
+    } else if (k === 'g' || k === 'k') {
+      this._cycleProviderClaudeFallback(k === 'g' ? 'zai' : 'kimi');
     } else if (k === 'f' || k === 'F') {
       // Cycle the cross-provider fallback policy in place — reversible + non-destructive,
       // so no confirm dialog (unlike restart/delete). Accept F too (Shift-f muscle memory).
@@ -534,6 +570,34 @@ export class TUI {
     }
   }
 
+  /** Cycle ONE provider's Claude→provider setting. Turning it ON is the risky direction
+   *  (a Claude session can finish on that provider), so it asks first; turning it back off
+   *  is always safe and never prompts. */
+  _cycleProviderClaudeFallback(providerKey) {
+    const order = ['never', 'when-exhausted', 'always'];
+    const label = providerKey === 'zai' ? 'GLM' : 'Kimi';
+    const cur = this.am._claudeFallbackFor?.(providerKey) || 'never';
+    const next = order[(order.indexOf(cur) + 1) % order.length];
+    const apply = async () => {
+      this.am.setClaudeFallbackForProvider?.(providerKey, next);
+      const sched = { ...(this.config.scheduler || {}) };
+      sched.providers = { ...(sched.providers || {}) };
+      sched.providers[providerKey] = { ...(sched.providers[providerKey] || {}), claudeFallback: next };
+      this.config.scheduler = sched;
+      try { await this.saveConfig(this.config); } catch (e) { this._addLog(`Could not save: ${e.message}`); }
+      this._addLog(`${label} takes over when Claude is out: ${next}`);
+    };
+    if (cur === 'never') {
+      this._confirm(
+        `Let ${label} take over when Claude is out?`,
+        `A session that starts on Claude can finish on ${label}. Most move back to Claude fine. If ${label} runs a web search, that session stays on ${label} until you start a new one.`,
+        apply,
+      );
+      return;
+    }
+    apply();
+  }
+
   async _cycleCrossProviderPolicy() {
     const order = ['never', 'when-exhausted', 'always'];
     const cur = this.am._crossProviderFallbackPolicy();
@@ -1158,7 +1222,10 @@ export class TUI {
     }
 
     // Completed log
-    const footerH = this.mode === 'confirm' ? 3 : 2;
+    // 2 = separator + footer; confirm adds its detail line; updates adds its detail block.
+    const footerH = this.mode === 'confirm' ? 3
+      : this.mode === 'updates' ? 2 + this._renderUpdatesDetail().length
+      : 2;
     const space = Math.max(0, H - lines.length - footerH);
     for (let i = 0; i < space && i < this.log.length; i++) {
       lines.push(`   ${gray(this.log[i].t)}  ${this.log[i].msg}`);
@@ -1170,6 +1237,10 @@ export class TUI {
     // ── Footer
     lines.push(' ' + dim('─'.repeat(W - 2)));
     if (this.mode === 'confirm') lines.push(` ${this.confirmDetail}`);
+    // Updates DETAIL — without this, pressing 'u' changed only the one-line footer at the
+    // very bottom of a busy screen, which reads as "nothing happened" (reported twice).
+    // Every other mode draws something visible; this one must too.
+    if (this.mode === 'updates') lines.push(...this._renderUpdatesDetail());
     lines.push(this._renderFooter());
 
     // Write buffer
@@ -1418,8 +1489,9 @@ export class TUI {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the
         // keypress — the "f does nothing" report).
-        const xp = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
-        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider: ${cyan(xp)} ↻  ${bold('Esc')} Back`;
+        const g = this.am._claudeFallbackFor?.('zai') || 'never';
+        const k = this.am._claudeFallbackFor?.('kimi') || 'never';
+        return ` ${bold('a')} Automatic  ${bold('p')} Preference  ${bold('g')} GLM: ${cyan(g)} ↻  ${bold('k')} Kimi: ${cyan(k)} ↻  ${bold('Esc')} Back`;
       }
       case 'select': {
         const act = this.selAction === 'prefer'