maxpool 1.7.1 → 1.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",
@@ -44,4 +44,4 @@
     "eslint": "^9.39.5",
     "git-cliff": "2.13.1"
   }
-}
+}

package/src/account-manager.js

@@ -1,4 +1,9 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
+import { CapacityLedger } from './capacity-ledger.js';
+
+// A capacity window boundary must move by at least this much to count as a real
+// window ADVANCE rather than reset-stamp jitter (see noteCapacityWindowAdvance).
+const WINDOW_ADVANCE_EPSILON_MS = 60_000;
 import { peakWindowState, DEFAULT_PEAK_CAP } from './peak-window.js';
 
 // Bounded re-poll hold for an account blocked ONLY by a transient, self-clearing
@@ -332,6 +337,9 @@ export class AccountManager {
     this.preferredAccountName = null;
     this.sessionBindings = new Map();
     this._peakCache = null;   // per-UTC-minute peak-window memo (see _peakStateFor)
+    // CAPACITY LEDGER (2026-08-22): observed tokens per completed window cycle, so
+    // "true capacity" is comparable across providers. Restored from state on boot.
+    this.capacity = new CapacityLedger();
     this.sessionPolicies = new Map();
     this.upstreamThrottle = {
       until: null,
@@ -1058,9 +1066,14 @@ export class AccountManager {
     let changed = false;
     let session = false;
 
-    // Clear expired unified quotas
+    // Clear expired unified quotas. The capacity cycle closes HERE, before the stamp
+    // is nulled: this is the authoritative rollover moment, and it fires wherever the
+    // rollover is noticed (TUI render tick, every routed request) — not only on a
+    // prober sweep that happens to land inside the sub-second window before the stamp
+    // disappears (without this, OAuth cycles essentially never close: red-team 2026-08-22).
     if (q.unified5h != null && q.unified5hReset && now >= q.unified5hReset) {
       console.log(`[Maxpool] Account "${account.name}" session quota reset`);
+      this.capacity?.closeCycle?.(account.name, 'ses', q.unified5hReset, { resetAt: q.unified5hReset });
       q.unified5h = null;
       q.unified5hReset = null;
       changed = true;
@@ -1068,6 +1081,7 @@ export class AccountManager {
     }
     if (q.unified7d != null && q.unified7dReset && now >= q.unified7dReset) {
       console.log(`[Maxpool] Account "${account.name}" weekly quota reset`);
+      this.capacity?.closeCycle?.(account.name, 'wk', q.unified7dReset, { resetAt: q.unified7dReset });
       q.unified7d = null;
       q.unified7dReset = null;
       q.unifiedStatus = null;
@@ -1914,6 +1928,10 @@ export class AccountManager {
   setAccountEnabled(index, enabled) {
     const account = this.accounts[index];
     if (!account) return false;
+    // CAPACITY LEDGER: a cycle that spent part of its life DISABLED did not get the
+    // chance to deliver its true capacity, so it is not a capacity observation —
+    // flag it partial (shown, excluded from the averages).
+    if (!enabled && account.enabled) this.capacity.markPartial(account.name, { disabled: true });
     account.enabled = Boolean(enabled);
     if (!enabled && account.name === this.preferredAccountName) {
       this.setRoutingMode('automatic');
@@ -2668,6 +2686,10 @@ export class AccountManager {
     const account = this.accounts[accountIndex];
     if (!account || !usage) return;
     const q = account.quota;
+    // CAPACITY LEDGER: prev stamps, so a probe observing the window ADVANCE closes
+    // the old cycle (the OAuth twin of the applyProviderUsage hook).
+    const prevSesReset = q.unified5hReset;
+    const prevWkReset = q.unified7dReset;
 
     if (usage.fiveHour) {
       if (usage.fiveHour.utilization != null) q.unified5h = clamp01(usage.fiveHour.utilization);
@@ -2677,6 +2699,12 @@ export class AccountManager {
       if (usage.sevenDay.utilization != null) q.unified7d = clamp01(usage.sevenDay.utilization);
       if (usage.sevenDay.resetAt != null) q.unified7dReset = usage.sevenDay.resetAt;
     }
+    // Stamp-advance close (same guard as the provider path): a FRESHER stamp means
+    // the old window rolled over — close its cycle at the old boundary.
+    // noteCapacityWindowAdvance already no-ops on a missing/unchanged/older stamp, so
+    // there is nothing to gate here — pass the raw (possibly undefined) value through.
+    this.noteCapacityWindowAdvance(account.name, 'ses', prevSesReset, usage.fiveHour?.resetAt);
+    this.noteCapacityWindowAdvance(account.name, 'wk', prevWkReset, usage.sevenDay?.resetAt);
     // Only a SUCCESSFUL probe carrying the flag speaks to this. A header-driven update
     // can't see the limits[] array, and a FAILED read knows nothing about the account's
     // caps — either one claiming "uncapped" would mislabel a capped account as having no
@@ -2787,6 +2815,11 @@ export class AccountManager {
     const account = this.accounts[accountIndex];
     if (!account || !usage) return;
     const q = account.quota;
+    // CAPACITY LEDGER: snapshot the previous reset stamps so a probe observing the
+    // window ADVANCE (new stamp) closes the capacity cycle at the old boundary —
+    // covers windows whose old stamp was never learned (clock-close can't fire).
+    const prevSesReset = q.providerSesReset;
+    const prevWkReset = q.providerWkReset;
     if (usage.error) {
       // Distinguish "no pollable quota" (Kimi) from a transient probe failure.
       // Never clear existing values on a transient error — let them age into the
@@ -2814,6 +2847,12 @@ export class AccountManager {
       q.weeklyAbsent = true;
     }
     q.lastProbeOkAt = Date.now();
+    // Stamp-advance close: a FRESHER reset stamp means the old window rolled over —
+    // the tokens accrued since the last close belong to the cycle that just ended.
+    // noteCapacityWindowAdvance already no-ops on a missing/unchanged/older stamp
+    // (same-window re-report, clock-skew backward re-report) — pass values through.
+    this.noteCapacityWindowAdvance(account.name, 'ses', prevSesReset, usage.ses?.resetAt);
+    this.noteCapacityWindowAdvance(account.name, 'wk', prevWkReset, usage.wk?.resetAt);
   }
 
   /**
@@ -2949,6 +2988,88 @@ export class AccountManager {
     }
   }
 
+  /** Restore the ledger from persisted state. A BOOT GAP (the open cycle's last
+   *  accrual is far behind now) means maxpool was down for part of that cycle, so the
+   *  cycle is no longer a truthful capacity observation — flag it partial (B2/SC6).
+   *  It still displays; it is excluded from averages. */
+  restoreCapacityState(payload, now = Date.now(), downtimeMs = null) {
+    this.capacity = CapacityLedger.fromSerialized(payload);
+    // Partial is keyed on MAXPOOL'S OWN downtime, NEVER on the account's last request:
+    // an account parked >10min mid-cycle is normal fleet rotation, and keying on its
+    // last request discarded valid observations on every reload (red-team F3). The
+    // caller passes measured downtime (state mtime at save → boot now); when it
+    // cannot (a seamless reload handoff — the old worker was provably serving
+    // throughout), null skips the check entirely.
+    // 60s absorbs a restart's own turnaround; anything longer is real downtime, and
+    // it disqualifies EVERY open cycle (maxpool was not serving, so no account could
+    // deliver its true capacity) — the downtime is a property of the process, not of
+    // any one account's traffic.
+    if (!(downtimeMs > 60_000)) return;
+    const spannedDays = new Set();
+    for (let t = now - downtimeMs; t <= now; t += 3600_000) spannedDays.add(new Date(t).toISOString().slice(0, 10));
+    spannedDays.add(new Date(now).toISOString().slice(0, 10));
+    for (const name of this.capacity.accounts()) {
+      if (this.capacity.openCycle(name, 'ses') || this.capacity.openCycle(name, 'wk')) {
+        this.capacity.markPartial(name);
+      }
+      for (const day of spannedDays) this.capacity.markDayPartial(name, day);
+    }
+  }
+
+  /** Accrue ONE request's tokens into the capacity ledger (per-request values; the
+   *  server seam has already applied max-semantics for streamed output). */
+  accrueCapacity(accountIndex, { input = 0, output = 0 } = {}) {
+    const account = this.accounts[accountIndex];
+    if (!account) return;
+    this.capacity.accrue(account.name, { input, output });
+  }
+
+  /** Close any window cycle whose reset time has passed — CLOCK-AUTHORITATIVE, so a
+   *  stale or dead probe can never leave a cycle open and mis-attribute the next
+   *  window's tokens to it (pre-mortem M5; worst case is the no-weekly account whose
+   *  probe latches refreshDead). Safe to call on every render tick and prober tick. */
+  closeExpiredCapacityCycles(now = Date.now()) {
+    for (const a of this.accounts) {
+      const q = a.quota || {};
+      const pairs = a.type === 'provider'
+        ? [['ses', 'providerSesReset'], ['wk', 'providerWkReset']]
+        : [['ses', 'unified5hReset'], ['wk', 'unified7dReset']];
+      for (const [win, stampKey] of pairs) {
+        const resetAt = q[stampKey];
+        // Close ONLY. This path deliberately does NOT null the stamp: the rollover
+        // stays single-shot because closeCycle FOLDS a same-boundary repeat into the
+        // already-closed cycle (one boundary, one cycle), and the very next
+        // refreshExpiredQuotas / request-path _clearExpiredQuotas nulls the stamp with
+        // its full original side effects — the reset log, the `session` signal that
+        // drives _switchOnSessionReset, and the weekly `unifiedStatus` clear. Nulling
+        // here as well (round-2) made a prober-first notice silently swallow all of
+        // those whenever the sweep won the race (red-team round 3, RT3-1).
+        if (resetAt && now >= resetAt) {
+          this.capacity.closeCycle(a.name, win, resetAt, { resetAt });
+        }
+      }
+    }
+  }
+
+  /** Close a cycle because a probe observed the window ADVANCE (a new reset stamp) —
+   *  covers the case where the old stamp was never learned. */
+  noteCapacityWindowAdvance(accountName, window, prevResetAt, nextResetAt) {
+    if (!prevResetAt || !nextResetAt) return;
+    // EPSILON, not `>`. An OAuth reset stamp is derived per-response as
+    // `Date.now() + delay_seconds * 1000` (parseResetHeader), so the SAME window
+    // boundary reads a little later on every response — sub-second to ~2s of jitter.
+    // A bare `nextResetAt > prevResetAt` fired the advance-close on each of those,
+    // shredding one real 5h window into 9-10 fake cycles and closing a "weekly"
+    // cycle whose endedAt was a week in the FUTURE. Measured on live state.json
+    // 2026-08-23, 12h after v1.8.0 shipped: mk@dubner.io had 9 ses cycles between
+    // 01:00 and 06:00, the shortest 0.2 minutes. A REAL advance is a whole window
+    // (>=5h); 60s separates the two by three orders of magnitude.
+    // Provider stamps (z.ai/Kimi probe) are absolute and did NOT jitter — which is
+    // how the defect localized to the OAuth path.
+    if (nextResetAt - prevResetAt < WINDOW_ADVANCE_EPSILON_MS) return;
+    this.capacity.closeCycle(accountName, window, prevResetAt, { resetAt: prevResetAt });
+  }
+
   /**
    * Update cumulative token usage from response body data.
    */

package/src/capacity-ledger.js

@@ -0,0 +1,286 @@
+/**
+ * True-capacity ledger — observed tokens per completed window cycle.
+ *
+ * The measurement model (user spec 2026-08-22): when a 5h or weekly window completes,
+ * the tokens delivered during that cycle ARE the account's measured capacity for the
+ * window. History per account per window: last / prev / prev-1 / avg3 / avg10 /
+ * all-time — in tokens, so a GLM row and a Claude row compare apples to apples.
+ *
+ * The no-weekly account (legacy z.ai TOKENS_LIMIT, weeklyAbsent) has no weekly TANK:
+ * it gets full 5h cycle history plus a rolling-7d THROUGHPUT from UTC day buckets —
+ * a volume, never a limit, rendered distinctly.
+ *
+ * PURE: no I/O, injected clock. Persistence + accrual seams live in account-manager /
+ * index; this module owns the data model and its invariants.
+ * Pre-mortem (2026-08-22) blockers B1/B2 + majors M3-M7 are the load-bearing comments.
+ */
+
+// v2 (2026-08-23): v1 histories are POISONED and are deliberately dropped on load.
+// The OAuth reset-stamp jitter (see AccountManager.noteCapacityWindowAdvance) shredded
+// real windows into slivers and recorded future-dated weekly cycles, so a v1 payload's
+// averages are wrong for weeks. Starting empty costs one window; keeping it costs trust.
+const SCHEMA_VERSION = 2;
+
+// Two closes this far apart are the SAME boundary observed twice (a clock-close and a
+// stamp-advance racing across the boundary second), not two windows.
+const SAME_BOUNDARY_MS = 5_000;
+const MAX_CYCLES_PER_WINDOW = 50;
+const MAX_DAY_BUCKETS = 10;
+
+export class CapacityLedger {
+  constructor({ now = () => Date.now() } = {}) {
+    this._now = now;
+    // accountName → { ses: {open?, closed: []}, wk: {open?, closed: []}, days: {utcDay: {tokens, partial}} }
+    this._accounts = new Map();
+  }
+
+  /** Restore from a serialized payload (state.json). Tolerant: unknown schemaVersion →
+   *  start empty and KEEP the file (the caller preserves it); a corrupt shape → empty. */
+  static fromSerialized(payload, { now = () => Date.now() } = {}) {
+    const l = new CapacityLedger({ now });
+    if (!payload || payload.schemaVersion !== SCHEMA_VERSION) return l;
+    try {
+      for (const [name, rec] of Object.entries(payload.accounts || {})) {
+        const a = { ses: { open: null, closed: [] }, wk: { open: null, closed: [] }, days: {} };
+        for (const w of ['ses', 'wk']) {
+          if (rec[w]?.open) a[w].open = { ...rec[w].open };
+          if (Array.isArray(rec[w]?.closed)) a[w].closed = rec[w].closed.slice(-MAX_CYCLES_PER_WINDOW);
+        }
+        if (rec.days && typeof rec.days === 'object') {
+          for (const [d, v] of Object.entries(rec.days)) a.days[d] = { ...v };
+        }
+        l._accounts.set(name, a);
+      }
+    } catch { return new CapacityLedger({ now }); }
+    return l;
+  }
+
+  serialize() {
+    const accounts = {};
+    for (const [name, rec] of this._accounts) {
+      accounts[name] = {
+        ses: { open: rec.ses.open ? { ...rec.ses.open } : null, closed: rec.ses.closed.slice() },
+        wk: { open: rec.wk.open ? { ...rec.wk.open } : null, closed: rec.wk.closed.slice() },
+        days: Object.fromEntries(Object.entries(rec.days).map(([d, v]) => [d, { ...v }])),
+      };
+    }
+    return { schemaVersion: SCHEMA_VERSION, accounts };
+  }
+
+  _rec(name) {
+    let r = this._accounts.get(name);
+    if (!r) {
+      r = { ses: { open: null, closed: [] }, wk: { open: null, closed: [] }, days: {} };
+      this._accounts.set(name, r);
+    }
+    return r;
+  }
+
+  // ── Accrual ──────────────────────────────────────────────────────────────────
+
+  /** Accrue one served request's tokens. `tokens` = {input, output} for THIS request,
+   *  already per-request-max semantics for output (the caller derives them; see
+   *  M3 in the pre-mortem — Anthropic interim deltas are CUMULATIVE, so the SSE seam
+   *  passes the running max, and this adds it exactly once per request).
+   *  count_tokens requests are the CALLER's job to skip (M4) — they never reach here. */
+  accrue(name, { input, output }, at = this._now()) {
+    if (!(input > 0) && !(output > 0)) return;
+    const rec = this._rec(name);
+    for (const w of ['ses', 'wk']) {
+      // Open the window lazily if nothing is open (a mid-cycle boot or a window whose
+      // reset stamp was never learned). startedAt is the accrual time then — the cycle
+      // will be flagged partial by the caller if the boot gap warrants it (B1/B2).
+      if (!rec[w].open) {
+        rec[w].open = { startedAt: at, tokensSoFar: 0, lastAccrualAt: at, complete: true, disabledDuring: false };
+      }
+      rec[w].open.tokensSoFar += input + output;
+      rec[w].open.lastAccrualAt = at;
+    }
+    const day = new Date(at).toISOString().slice(0, 10);
+    rec.days[day] = rec.days[day] || { tokens: 0, partial: false };
+    rec.days[day].tokens += input + output;
+    this._evictDays(rec);
+  }
+
+  _evictDays(rec) {
+    const keys = Object.keys(rec.days).sort();
+    while (keys.length > MAX_DAY_BUCKETS) {
+      delete rec.days[keys.shift()];
+    }
+  }
+
+  // ── Cycle lifecycle ─────────────────────────────────────────────────────────
+
+  /** Mark the open cycles as partial (maxpool was down / an account was disabled).
+   *  Called by the boot path when a gap is detected (B2), and by the disable hook. */
+  markPartial(name, { disabled = false } = {}) {
+    const rec = this._accounts.get(name);
+    if (!rec) return;
+    for (const w of ['ses', 'wk']) {
+      if (!rec[w].open) continue;
+      // TWO INDEPENDENT axes, deliberately not collapsed: `complete:false` = maxpool
+      // was down for part of the cycle; `disabledDuring` = the operator took the
+      // account out of rotation. Setting both for a disable made the disabled flag
+      // query-redundant and therefore untested (red-team F6-1) — each now excludes on
+      // its own, and each is pinned by its own test.
+      if (disabled) rec[w].open.disabledDuring = true;
+      else rec[w].open.complete = false;
+    }
+  }
+
+  /** Close the open cycle for a window (M5: clock-authoritative — the close is keyed
+   *  on `endedAt`, which the caller derives from the reset stamp or the clock, and the
+   *  cycle keeps its own book regardless of probe health). No-op if none open. */
+  closeCycle(name, window, endedAt = this._now(), { resetAt = null } = {}) {
+    const rec = this._accounts.get(name);
+    if (!rec || !rec[window]?.open) return null;
+    const open = rec[window].open;
+    // ONE CYCLE PER BOUNDARY CLOSURE — the structural backstop for the two-closer race
+    // (round-2 F1). If both closers observe the SAME reset stamp within the same
+    // rollover moment, the second close's tokens are a straddling tail of that same
+    // window, so they FOLD INTO that cycle instead of becoming a tiny fabricated second
+    // one that drags every average down. A LATER window reporting the same numeric stamp
+    // value (clock coincidence) is distinguished by endedAt. Pinned by I3.
+    const prev = rec[window].closed[rec[window].closed.length - 1];
+    // Same boundary within a few seconds, not just byte-identical stamps: the two
+    // closers can observe one rollover through slightly different stamps (jitter), and
+    // an exact-match-only fold then admitted a 0.2-minute sliver as its own cycle.
+    const sameBoundary = resetAt != null && prev
+      && Math.abs((prev.resetAt ?? prev.endedAt) - resetAt) <= SAME_BOUNDARY_MS
+      && Math.abs(prev.endedAt - endedAt) <= SAME_BOUNDARY_MS;
+    if (sameBoundary && open.complete && !open.disabledDuring) {
+      // Fold ONLY a complete tail: folding a partial/disabled tail would flip the
+      // flags on the prior legitimate observation and ERASE it from the averages
+      // (round 3, RT3-2) — strictly worse than leaving a tiny excluded cycle.
+      prev.tokens += open.tokensSoFar;
+      rec[window].open = null;
+      return prev;
+    }
+    rec[window].closed.push({
+      startedAt: open.startedAt,
+      endedAt,
+      tokens: open.tokensSoFar,
+      complete: open.complete,
+      disabledDuring: open.disabledDuring,
+      resetAt,
+    });
+    if (rec[window].closed.length > MAX_CYCLES_PER_WINDOW) rec[window].closed.shift();
+    rec[window].open = null;
+    return rec[window].closed[rec[window].closed.length - 1];
+  }
+
+  // ── Queries ─────────────────────────────────────────────────────────────────
+
+  /** The columns the TUI renders: last, prev, prev1, avg3, avg10, allTime — over
+   *  COMPLETE, not-disabled cycles only (D4/D5: partial and operator-disabled cycles
+   *  are observations, not capacity). */
+  windowStats(name, window) {
+    const rec = this._accounts.get(name);
+    const closed = (rec?.[window]?.closed || []).filter(c => c.complete && !c.disabledDuring);
+    if (!closed.length) return null;
+    const avg = (arr) => arr.length ? Math.round(arr.reduce((a, b) => a + b, 0) / arr.length) : null;
+    const tokens = closed.map(c => c.tokens);
+    return {
+      last: closed[closed.length - 1].tokens,
+      prev: closed.length >= 2 ? closed[closed.length - 2].tokens : null,
+      prev1: closed.length >= 3 ? closed[closed.length - 3].tokens : null,
+      avg3: avg(tokens.slice(-3)),
+      avg10: avg(tokens.slice(-10)),
+      allTime: avg(tokens),
+      cycles: closed.length,
+    };
+  }
+
+  /** Rolling-7d throughput (the no-weekly account's weekly figure). The window is
+   *  keyed on CALENDAR days — [today-6 .. today] UTC — NOT "the last 7 buckets":
+   *  buckets exist only where accrual happened, so a bucket-slice silently stretches
+   *  across idle gaps and over-reports (red-team F4). A missing day contributes 0 by
+   *  ABSENCE (present in dayKeys, absent from days) — and with MAX_DAY_BUCKETS=10 an
+   *  idle day no longer even evicts; only real activity ages out. `partial` is true
+   *  when any bucket in the window is flagged partial — the figure is ≤ observed. */
+  rollingThroughput(name, days = 7) {
+    const rec = this._accounts.get(name);
+    if (!rec) return { tokens: 0, partial: false };
+    // The window is anchored on the ledger's OWN clock — the last `days` CALENDAR days
+    // ending today. An earlier "latest recorded day" anchor reported a weeks-old window
+    // as if it were current (idle GLM fallback showed a stale 25M "7d volume" with no
+    // disclosure — red-team round 2, F2). Now: idle → 0, honestly.
+    const today = new Date(this._now()).toISOString().slice(0, 10);
+    const cutoff = this._utcDayMinus(today, Math.min(days - 1, MAX_DAY_BUCKETS - 1));
+    let tokens = 0, partial = false;
+    for (const [d, v] of Object.entries(rec.days)) {
+      if (d >= cutoff && d <= today) { tokens += v.tokens; if (v.partial) partial = true; }
+    }
+    return { tokens, partial };
+  }
+
+  _utcDayMinus(day, n) {
+    const d = new Date(`${day}T00:00:00Z`);
+    d.setUTCDate(d.getUTCDate() - n);
+    return d.toISOString().slice(0, 10);
+  }
+
+  /**
+   * Merge a DELTA of accrual into a base payload (B2 drain-exit merge-flush).
+   *
+   * The released worker keeps serving in-flight requests for up to RELOAD_DRAIN_MS
+   * AFTER its final flush, and then exits bare — so every token delivered during the
+   * drain was measured and thrown away. It cannot simply re-write its own ledger:
+   * the NEW worker owns the file by then and has its own accrual. So at exit it
+   * computes what it accrued SINCE its final flush (after − before) and adds only
+   * that delta onto whatever the new worker has on disk.
+   *
+   * Adds to the OPEN cycles and the day buckets — the only places drain-time tokens
+   * can land. A cycle the new worker already closed is not re-opened (the tokens
+   * belonged to a window that has since rolled; dropping them is correct, and the
+   * cycle is a completed observation we must not mutate after the fact).
+   */
+  static mergeDelta(basePayload, beforePayload, afterPayload) {
+    const base = (basePayload && basePayload.schemaVersion === SCHEMA_VERSION)
+      ? JSON.parse(JSON.stringify(basePayload))
+      : { schemaVersion: SCHEMA_VERSION, accounts: {} };
+    const before = beforePayload?.accounts || {};
+    const after = afterPayload?.accounts || {};
+    for (const [name, aRec] of Object.entries(after)) {
+      const bRec = before[name] || {};
+      for (const w of ['ses', 'wk']) {
+        const aOpen = aRec[w]?.open, bOpen = bRec[w]?.open;
+        if (!aOpen) continue;
+        const target = base.accounts[name]?.[w];
+        // The BASE's open cycle is the one being amended, so the same-cycle check is
+        // against IT — not against our own before-snapshot (which trivially matches
+        // our own after-snapshot and so never fired). A different startedAt means the
+        // window rolled during the drain: the delta belongs to a window the new worker
+        // has already closed, and crediting it to the fresh cycle would inflate the
+        // very next capacity reading by a whole window of traffic (red-team F6-3).
+        if (!target?.open) continue;
+        if (target.open.startedAt !== aOpen.startedAt) continue;
+        const delta = (bOpen && bOpen.startedAt === aOpen.startedAt)
+          ? aOpen.tokensSoFar - bOpen.tokensSoFar
+          : aOpen.tokensSoFar;
+        if (!(delta > 0)) continue;
+        target.open.tokensSoFar += delta;
+        target.open.lastAccrualAt = Math.max(target.open.lastAccrualAt || 0, aOpen.lastAccrualAt || 0);
+      }
+      for (const [day, v] of Object.entries(aRec.days || {})) {
+        const bTok = bRec.days?.[day]?.tokens || 0;
+        const delta = (v.tokens || 0) - bTok;
+        if (!(delta > 0)) continue;
+        base.accounts[name] = base.accounts[name]
+          || { ses: { open: null, closed: [] }, wk: { open: null, closed: [] }, days: {} };
+        const days = base.accounts[name].days;
+        days[day] = days[day] || { tokens: 0, partial: false };
+        days[day].tokens += delta;
+      }
+    }
+    return base;
+  }
+
+  dayKeys(name) { return Object.keys(this._accounts.get(name)?.days || {}).sort(); }
+  openCycle(name, window) { return this._accounts.get(name)?.[window]?.open || null; }
+  accounts() { return [...this._accounts.keys()]; }
+  markDayPartial(name, utcDay) {
+    const rec = this._accounts.get(name);
+    if (rec?.days[utcDay]) rec.days[utcDay].partial = true;
+  }
+}

package/src/config.js

@@ -289,6 +289,22 @@ export async function readGeneration(path) {
  */
 let _stateWriteChain = Promise.resolve();
 
+/**
+ * Amended state write at an UNCHANGED generation (drain-exit capacity merge-flush).
+ * saveState always bumps `_generation`; a released worker amending the file the NEW
+ * lease-holder owns must NOT bump it, or the holder's `stateGeneration` is stale from
+ * that instant and every guarded periodic write is refused for its entire tenure.
+ * Serialized onto the same write chain; NEVER used for ordinary state updates.
+ */
+export function saveStateUnbumped(state, generation) {
+  const run = async () => {
+    await atomicWrite(getStatePath(), JSON.stringify({ ...state, _generation: generation }, null, 2) + '\n');
+  };
+  const result = _stateWriteChain.then(run, run);
+  _stateWriteChain = result.then(() => {}, () => {});
+  return result;
+}
+
 export function saveState(state, { expectedGeneration = null } = {}) {
   // Serialize state writes (a 60s interval flush can otherwise race the final
   // baton flush, read the same on-disk generation, and double-write).

package/src/index.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 
 import net from 'node:net';
+import { stat } from 'node:fs/promises';
 import { spawn, spawnSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
-import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, loadState, saveState, getStatePath, getLogPath, readGeneration, flushConfigWrites, flushStateWrites } from './config.js';
+import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, loadState, saveState, getStatePath, getLogPath, readGeneration, flushConfigWrites, flushStateWrites, saveStateUnbumped } from './config.js';
 import { setEventLogPath, installConsoleMirror, setConsoleStdoutSuppressed } from './event-log.js';
 import { SleepGuard } from './sleep-guard.js';
 import { AccountManager } from './account-manager.js';
@@ -27,6 +28,7 @@ net.setDefaultAutoSelectFamilyAttemptTimeout(
   Math.max(1000, Number(process.env.MAXPOOL_FAMILY_ATTEMPT_TIMEOUT_MS) || 5000),
 );
 import { Prober } from './prober.js';
+import { CapacityLedger } from './capacity-ledger.js';
 import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, tokenFingerprint } from './oauth.js';
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
@@ -606,6 +608,18 @@ async function serverWorkerCommand() {
   // lease holder); a cold/direct worker reads the on-disk state file.
   const savedState = await loadState();
   if (savedState?.quota) accountManager.restoreQuotaState(savedState.quota);
+  if (savedState?.capacity) {
+    // Measured maxpool downtime = state-file last write → boot. A seamless reload
+    // worker's state was handed over live (no gap) → null skips the partial check.
+    let downtimeMs = null;
+    try {
+      if (!isReloadWorker) {
+        const st = await stat(getStatePath());
+        downtimeMs = Date.now() - st.mtimeMs;
+      }
+    } catch { downtimeMs = null; }
+    accountManager.restoreCapacityState(savedState.capacity, Date.now(), downtimeMs);
+  }
   // Runtime fallback providers (glm-fallback/kimi-fallback) are created lazily from
   // `cc all` request headers, not config — so without restoring them here a restart
   // shows only the config OAuth accounts until the next `cc all` request re-sends the
@@ -675,12 +689,47 @@ async function serverWorkerCommand() {
         // Runtime providers so glm-fallback/kimi-fallback survive a restart (they're
         // header-derived, not in config). Empty [] when none — harmless.
         runtimeProviders: accountManager.exportRuntimeProviders(),
+        // CAPACITY LEDGER (2026-08-22) rides the SAME payload on purpose: it inherits
+        // the writer lease, the generation guard and the serialized write chain. A
+        // separate file would need its own copy of all three (pre-mortem B2), and the
+        // OPEN cycle must persist or a mid-cycle restart records a near-empty cycle as
+        // a real capacity observation and poisons the averages forever (B1).
+        capacity: accountManager.capacity?.serialize?.() || null,
       },
       { expectedGeneration },
     )
       .then(written => { if (written != null) stateGeneration = written; })
       .catch(() => {});
   };
+  // CAPACITY LEDGER drain-exit merge-flush (B2). `capacityFlushSnapshot` is taken at
+  // the released worker's FINAL flush; everything accrued after it is drain-time work
+  // whose tokens would otherwise be discarded when this worker exits bare.
+  let capacityFlushSnapshot = null;
+  const mergeFlushCapacityDelta = async () => {
+    if (!capacityFlushSnapshot) return;
+    const after = accountManager.capacity?.serialize?.();
+    if (!after) return;
+    const disk = await loadState();
+    if (!disk) { // a failed read must not be "merged" into a quota-less state file (RT2-4)
+      console.error('[Maxpool] Capacity drain-flush skipped: state file unreadable — drain-time token delta not persisted.');
+      return;
+    }
+    const capacity = CapacityLedger.mergeDelta(disk.capacity, capacityFlushSnapshot, after);
+    // Re-write the FULL on-disk state with only `capacity` replaced: quota and
+    // runtimeProviders belong to the NEW worker now and must not be reverted to ours.
+    // No generation guard — we are deliberately amending a file another writer owns,
+    // and a same-instant race costs at most this drain's delta.
+    const { _generation, ...rest } = disk;
+    // NO generation bump: re-write the file at the SAME generation so the new
+    // worker's stateGeneration stays valid. saveState refuses a lower generation
+    // only — writing the observed one back is accepted and bumps nothing. Bumping
+    // here (the naive first version) wedged the new worker's periodic flush for its
+    // entire tenure: onDisk advanced past its stateGeneration and every guarded
+    // write was refused forever (red-team 2026-08-22).
+    await saveStateUnbumped({ ...rest, capacity }, _generation ?? 0);
+    await flushStateWrites();
+  };
+
   // Persist quota every minute; unref so it never keeps the process alive.
   let quotaSaveInterval = null;
 
@@ -1339,6 +1388,11 @@ async function serverWorkerCommand() {
       //    flipped hasLease=false, and persistQuotaState no-ops without the lease —
       //    so an unforced call here silently drops the reload's final quota flush.
       await persistQuotaState(true);
+      // 3b) CAPACITY LEDGER: snapshot what we had flushed. We keep serving in-flight
+      //     requests for up to RELOAD_DRAIN_MS after this, and those tokens are real
+      //     measured capacity — but the NEW worker owns the state file by then. At
+      //     exit we merge (now − this snapshot) onto whatever it has written (B2).
+      capacityFlushSnapshot = accountManager.capacity?.serialize?.() || null;
       // 4) Barrier: ensure every queued config write (a rotated-token persist is
       //    fire-and-forget) AND state write has actually hit disk before we hand
       //    off (M3 — otherwise the new worker boots from the invalidated token).
@@ -1368,14 +1422,22 @@ async function serverWorkerCommand() {
       // exit(0). Cap = RELOAD_DRAIN_MS (above the idle reaper) so a long streaming
       // response finishes instead of being cut; the supervisor SIGKILLs us only if
       // we outlive its (slightly longer) cap.
+      // Exit only AFTER folding the drain-time capacity delta into the new worker's
+      // state file. Bounded (1s) and best-effort: losing the delta is a measurement
+      // gap, hanging the released worker is an operational fault, so the timeout wins.
+      const exitAfterMergeFlush = () => {
+        Promise.race([mergeFlushCapacityDelta(), delay(1000)])
+          .catch(() => {})
+          .finally(() => process.exit(0));
+      };
       const waitForDrain = () => {
-        if (restartController.activeRequests.size === 0) { process.exit(0); return; }
+        if (restartController.activeRequests.size === 0) { exitAfterMergeFlush(); return; }
       };
       const drainPoll = setInterval(waitForDrain, 200);
       drainPoll.unref?.();
       const hardCap = setTimeout(() => {
         console.error(`[Maxpool] Released worker reload-drain cap reached with ${restartController.activeRequests.size} active; exiting.`);
-        process.exit(0);
+        exitAfterMergeFlush();
       }, RELOAD_DRAIN_MS);
       hardCap.unref?.();
       waitForDrain();

package/src/prober.js

@@ -70,6 +70,12 @@ export class Prober {
     this._stopping = false;
     this._inflight = (async () => {
       try {
+        // CAPACITY LEDGER: close any open cycle whose window's reset stamp has
+        // passed. Runs at the top of every sweep (lease-holder only — probeAll
+        // fires from the prober, which start/stop with the lease) so a window that
+        // rolled over between requests still closes promptly, not only on the next
+        // accrual or stamp-advance.
+        try { this.am.closeExpiredCapacityCycles?.(); } catch { /* never block probing */ }
         // DISABLED accounts are INTENTIONALLY still probed (no `a.enabled` filter):
         // a user often disables an account precisely BECAUSE it's exhausted, and still
         // wants to see its quota recover — so keep refreshing its usage for visibility

package/src/server.js

@@ -1285,7 +1285,19 @@ async function forwardRequest(
 
     if (isStreaming) {
       const streamLog = logDir ? [] : null;
-      await streamResponse(upstreamRes.body, res, upstreamRes.status, responseHeaders, account.index, accountManager, streamLog, requestInfo);
+      // CAPACITY LEDGER: accrue in a FINALLY — a stream that dies mid-flight throws
+      // from streamResponse, and the tokens genuinely delivered before the failure
+      // are real capacity; skipping them under-counts exactly the longest
+      // generations (red-team F5). One accrual per request, per-stream running max
+      // (M3 — cumulative interim deltas must not be summed).
+      try {
+        await streamResponse(upstreamRes.body, res, upstreamRes.status, responseHeaders, account.index, accountManager, streamLog, requestInfo);
+      } finally {
+        accountManager.accrueCapacity?.(account.index, {
+          input: requestInfo._capacityInput || 0,
+          output: requestInfo._capacityOutput || 0,
+        });
+      }
       accountManager.releaseAccount(lease, { success: true, status: upstreamRes.status });
       if (logDir) {
         logSections.push(`=== RESPONSE BODY (streamed) ===\n${streamLog.join('')}`);
@@ -1312,7 +1324,7 @@ async function forwardRequest(
         clearTimeout(bodyTimer);
       }
       const buf = Buffer.from(arr);
-      extractUsageFromBody(buf, account.index, accountManager);
+      extractUsageFromBody(buf, account.index, accountManager, requestInfo);
       markThinkingFromResponse(buf, accountManager, requestInfo);
       accountManager.releaseAccount(lease, { success: upstreamRes.status < 500, status: upstreamRes.status });
       if (logDir) {
@@ -2914,10 +2926,18 @@ function parseSSEEvent(event, accountIndex, accountManager, requestInfo = {}) {
 
   try {
     const data = JSON.parse(dataLine.slice(6));
-    if (data.type === 'message_start' && data.message?.usage) {
-      accountManager.updateUsage(accountIndex, data.message.usage.input_tokens, 0);
-    } else if (data.type === 'message_delta' && data.usage) {
-      accountManager.updateUsage(accountIndex, 0, data.usage.output_tokens);
+    // CAPACITY LEDGER (2026-08-22): stream-level usage feeds the per-cycle ledger.
+    // M3: Anthropic interim message_delta usage is CUMULATIVE — add-semantics inflates
+    // output on long generations. Track a per-stream RUNNING MAX, accrue once at end.
+    // M4: count_tokens responses are prompt-size echoes, not delivered work — skip.
+    if (!requestInfo.isCountTokens) {
+      if (data.type === 'message_start' && data.message?.usage) {
+        accountManager.updateUsage(accountIndex, data.message.usage.input_tokens, 0);
+        requestInfo._capacityInput = Math.max(requestInfo._capacityInput || 0, data.message.usage.input_tokens || 0);
+      } else if (data.type === 'message_delta' && data.usage) {
+        accountManager.updateUsage(accountIndex, 0, data.usage.output_tokens);
+        requestInfo._capacityOutput = Math.max(requestInfo._capacityOutput || 0, data.usage.output_tokens || 0);
+      }
     }
     if (sseEventContainsThinking(data)) {
       accountManager.markSessionThinkingProtected?.(requestInfo.sessionKey, requestInfo.model);
@@ -2933,11 +2953,20 @@ function sseEventContainsThinking(data) {
     || data?.delta?.type === 'signature_delta';
 }
 
-function extractUsageFromBody(buffer, accountIndex, accountManager) {
+function extractUsageFromBody(buffer, accountIndex, accountManager, requestInfo = {}) {
   try {
     const json = JSON.parse(buffer.toString());
     if (json.usage) {
       accountManager.updateUsage(accountIndex, json.usage.input_tokens, json.usage.output_tokens);
+      // CAPACITY LEDGER — M4: a /count_tokens response is a prompt-size echo with ZERO
+      // work delivered. Claude Code calls it constantly; counting it would inflate every
+      // cycle by whole prompt sizes.
+      if (!requestInfo.isCountTokens) {
+        accountManager.accrueCapacity?.(accountIndex, {
+          input: json.usage.input_tokens || 0,
+          output: json.usage.output_tokens || 0,
+        });
+      }
     }
   } catch {
     // not JSON or no usage

package/src/tui.js

@@ -68,7 +68,10 @@ function rpad(s, w) {
   return gap > 0 ? s + ' '.repeat(gap) : s;
 }
 
-/** Truncate a string with ANSI codes to exactly w visible characters, then reset. */
+/** Truncate a string with ANSI codes to exactly w visible characters, then reset.
+ *  The trailing RESET is appended only when something was actually cut — a no-op
+ *  truncate that unconditionally appended it shifted `.padEnd()` (raw-length) fields
+ *  4 columns narrow for every string shorter than the width (red-team round 3, RT3-4). */
 function truncate(s, w) {
   let visible = 0;
   let out = '';
@@ -82,7 +85,7 @@ function truncate(s, w) {
     visible++;
     i++;
   }
-  return out + RESET;
+  return visible < w ? out + ' '.repeat(w - visible) + RESET : out + RESET;
 }
 
 /** Fit a line to exactly w columns: truncate if too long, pad if too short. */
@@ -116,6 +119,16 @@ function quotaLabel(ratio, resetTs, width) {
   return (rst || pct).slice(0, width);
 }
 
+/** Compact token count for the capacity page. Tokens are the apples-to-apples unit
+ *  across Claude / GLM / Kimi, so the column must stay narrow and scannable. */
+function formatTokens(n) {
+  if (n == null) return '--';
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(1)}B`;
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(n >= 10_000_000 ? 0 : 1)}M`;
+  if (n >= 1_000) return `${Math.round(n / 1_000)}k`;
+  return String(n);
+}
+
 function formatMs(ms) {
   if (ms == null || isNaN(ms)) return '-';
   if (ms < 1000) return `${Math.round(ms)}ms`;
@@ -257,7 +270,8 @@ export class TUI {
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
-    this.mode = 'normal';    // normal | accounts | routing | select | input | confirm | providers | addtype
+    this.mode = 'normal';    // normal | accounts | routing | capacity | select | input | confirm | providers | addtype
+    this.capacityWindow = 'ses'; // capacity page window: 'ses' (5h) | 'wk' (weekly)
     // Hide disabled accounts from the table. With 8 dead/disabled accounts the live
     // ones scroll off the top; `h` collapses them to a one-line summary.
     this.hideDisabled = false;
@@ -408,6 +422,7 @@ export class TUI {
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
       case 'updates': this._keyUpdates(k); break;
+      case 'capacity': this._keyCapacity(k); break;
       case 'addtype': this._keyAddType(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
@@ -451,6 +466,8 @@ export class TUI {
       );
     } else if (k === 'u') {
       this.mode = 'updates';
+    } else if (k === 'y') {
+      this.mode = 'capacity';
     } else if (k === 'h') {
       this.hideDisabled = !this.hideDisabled;
       this._addLog(this.hideDisabled ? 'Hiding disabled accounts' : 'Showing all accounts');
@@ -1598,6 +1615,19 @@ export class TUI {
       lines.push(` ${cyan(' Parked')} ${dim(`${queuedCount} request${queuedCount === 1 ? '' : 's'} held  oldest ${formatMs(oldest)}  ·  ${why}`)}`);
     }
 
+    // ── Capacity page — a DEDICATED screen, not a footer panel. It replaces the
+    // account/activity body wholesale so the six columns get the full width; the
+    // header above (version, routing, throttle) stays so the operator never loses
+    // where they are. Reads the in-memory ledger only — no fs per frame.
+    if (this.mode === 'capacity') {
+      lines.push(...this._renderCapacityPage(W));
+      while (lines.length < H - 2) lines.push('');
+      lines.push(' ' + dim('─'.repeat(W - 2)));
+      lines.push(this._renderFooter());
+      this._writeScreen(lines, W, H);
+      return;
+    }
+
     // ── Accounts
     if (this.am.accounts.length === 0) {
       lines.push('');
@@ -1696,7 +1726,12 @@ export class TUI {
     if (this.mode === 'updates') lines.push(...this._renderUpdatesDetail());
     lines.push(this._renderFooter());
 
-    // Write buffer
+    this._writeScreen(lines, W, H);
+  }
+
+  /** Full-screen buffer write: cursor home, H rows fitted to W, then hide the cursor
+   *  (shown only in input mode). */
+  _writeScreen(lines, W, H) {
     let buf = `${ESC}H`;
     for (let i = 0; i < H; i++) {
       buf += fitLine(lines[i] || '', W);
@@ -1955,10 +1990,102 @@ export class TUI {
     };
   }
 
+  _keyCapacity(k) {
+    if (k === 'w') { this.capacityWindow = this.capacityWindow === 'wk' ? 'ses' : 'wk'; }
+    else if (k === 'esc' || k === 'q') { this.mode = 'normal'; }
+  }
+
+  /**
+   * Capacity page — how much an account ACTUALLY delivers before it runs out.
+   *
+   * Each completed 5h/weekly cycle's token total IS that account's measured capacity
+   * for the window, so the columns compare a Claude account and a GLM account on the
+   * same axis. Only COMPLETE, never-disabled cycles count (a cycle maxpool sat out
+   * part of is an observation, not a capacity).
+   *
+   * The no-weekly account (legacy z.ai plan) has no weekly TANK to fill, so its weekly
+   * row is a rolling-7d THROUGHPUT — a volume, labelled as such, never a limit.
+   */
+  _renderCapacityPage(W) {
+    const out = [];
+    const win = this.capacityWindow === 'wk' ? 'wk' : 'ses';
+    const ledger = this.am.capacity;
+    const title = win === 'wk' ? 'Weekly (7d) capacity' : 'Session (5h) capacity';
+    out.push('');
+    out.push(` ${bold(title)}  ${dim('— tokens delivered per completed cycle, per account')}`);
+    out.push('');
+
+    if (!ledger) { out.push(yellow('  Capacity ledger unavailable on this worker.')); return out; }
+
+    // Narrow terminals: drop trailing columns rather than let fitLine chop a number
+    // mid-digit (at W=80 the full 6-column row is 82+ chars — every row silently lost
+    // its last two cells). The dropped ones are the aggregates, not the observations.
+    const ALL_COLS = ['Last', 'Prev', 'Prev-1', 'Avg 3', 'Avg 10', 'All time'];
+    const CW = 9;
+    const nameW = 12;
+    let COLS = ALL_COLS;
+    while (COLS.length > 1 && (nameW + PROVIDER_W + 2 + COLS.length * CW + 14) > W) {
+      COLS = COLS.slice(0, -1);
+    }
+    const header = '  ' + 'Account'.padEnd(nameW) + ' ' + 'Provider'.padEnd(PROVIDER_W) + ' '
+      + COLS.map(c => c.padStart(CW)).join('') + '  Cycles';
+    out.push(dimUnderline(fitLine(header, W)));
+
+    let anyData = false;
+    for (const i of this._displayOrder()) {
+      const a = this.am.accounts[i];
+      if (!a) continue;
+      if (this.hideDisabled && a.enabled === false) continue;
+      const noWeekly = win === 'wk' && a.type === 'provider' && a.quota?.weeklyAbsent;
+      const name = truncate(a.name, nameW).padEnd(nameW);
+      const prov = gray(providerLabel(a).padEnd(PROVIDER_W));
+      if (noWeekly) {
+        // No weekly limit — the favourite legacy plan. There is no cycle to complete,
+        // so a capacity number would be a fiction. Show what it actually DID move.
+        const t = ledger.rollingThroughput(a.name, 7);
+        anyData = anyData || t.tokens > 0;
+        const vol = t.tokens > 0 ? formatTokens(t.tokens) : '--';
+        // Always disclose the window's age boundary: today is unfinished, so the 7d
+        // figure grows through the day; a genuinely partial day adds the ≤-observed floor.
+        const note = t.partial
+          ? ' (≤ observed — maxpool was down part of the window; includes today, in progress)'
+          : ' (includes today, in progress)';
+        out.push('  ' + name + ' ' + prov + ' '
+          + cyan(`no weekly limit · 7d volume ${vol}`) + dim(note));
+        continue;
+      }
+      const st = ledger.windowStats(a.name, win);
+      if (!st) {
+        out.push('  ' + name + ' ' + prov + ' ' + dim('no completed cycle yet'));
+        continue;
+      }
+      anyData = true;
+      const all = { Last: st.last, Prev: st.prev, 'Prev-1': st.prev1, 'Avg 3': st.avg3, 'Avg 10': st.avg10, 'All time': st.allTime };
+      const cells = COLS.map(c => formatTokens(all[c]).padStart(CW)).join('');
+      out.push('  ' + name + ' ' + prov + ' ' + cells + '  ' + dim(String(st.cycles)));
+    }
+
+    out.push('');
+    if (!anyData) {
+      // Fresh install: the page is honest about WHY it is empty and WHEN it fills,
+      // instead of showing zeros that read like an account delivering nothing.
+      out.push(' ' + yellow('No completed cycles yet.') + dim(
+        win === 'wk'
+          ? ' A weekly figure appears after an account\'s 7d window resets once.'
+          : ' A session figure appears after an account\'s 5h window resets once.'));
+    }
+    out.push(' ' + dim('A cycle counts only if maxpool ran for all of it and the account stayed enabled.'));
+    return out;
+  }
+
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('h')} Hide disabled  ${dim('│')}  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop server`;
+        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('y')} Capacity  ${bold('h')} Hide disabled  ${dim('│')}  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop server`;
+      case 'capacity': {
+        const other = this.capacityWindow === 'wk' ? '5h session' : 'weekly (7d)';
+        return ` ${bold('w')} Show ${cyan(other)}  ${bold('Esc')} Back`;
+      }
       case 'updates': {
         const state = this._autoUpdateOn() ? green('on') : dim('off');
         return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;