maxpool 1.9.0 → 1.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.9.0",
+  "version": "1.10.1",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,6 +1,10 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
 import { CapacityLedger } from './capacity-ledger.js';
 
+// Nominal window length per kind — mirrors capacity-ledger's WINDOW_MS (kept here as a
+// local table so account-manager does not import a private constant).
+const WINDOW_MS_BY_KIND = { ses: 5 * 3600_000, wk: 7 * 86400_000 };
+
 // A capacity window boundary must move by at least this much to count as a real
 // window ADVANCE rather than reset-stamp jitter (see noteCapacityWindowAdvance).
 const WINDOW_ADVANCE_EPSILON_MS = 60_000;
@@ -2701,9 +2705,12 @@ export class AccountManager {
     }
     this.noteCapacityWindowAdvance(account.name, 'ses', prevSesReset, usage.fiveHour?.resetAt);
     this.noteCapacityWindowAdvance(account.name, 'wk', prevWkReset, usage.sevenDay?.resetAt);
-    // Utilization readings feed the capacity ESTIMATE (tokens ÷ fullness). Noted even
-    // when null — a probe that carries no utilization is not evidence of anything.
-    this.capacity.noteUtilizationObserved();
+    // Utilization readings feed the capacity ESTIMATE. The probe path passes per-window
+    // marks so the DELTA method can difference consecutive readings.
+    this.capacity.noteUtilizationObserved(Date.now(), [
+      { name: account.name, window: 'ses', utilization: usage.fiveHour?.utilization },
+      { name: account.name, window: 'wk', utilization: usage.sevenDay?.utilization },
+    ]);
     // Only a SUCCESSFUL probe carrying the flag speaks to this. A header-driven update
     // can't see the limits[] array, and a FAILED read knows nothing about the account's
     // caps — either one claiming "uncapped" would mislabel a capped account as having no
@@ -2846,12 +2853,12 @@ export class AccountManager {
       q.weeklyAbsent = true;
     }
     q.lastProbeOkAt = Date.now();
-    // Stamp-advance close: a FRESHER reset stamp means the old window rolled over —
-    // the tokens accrued since the last close belong to the cycle that just ended.
-    // noteCapacityWindowAdvance already no-ops on a missing/unchanged/older stamp
-    // (same-window re-report, clock-skew backward re-report) — pass values through.
     this.noteCapacityWindowAdvance(account.name, 'ses', prevSesReset, usage.ses?.resetAt);
     this.noteCapacityWindowAdvance(account.name, 'wk', prevWkReset, usage.wk?.resetAt);
+    this.capacity.noteUtilizationObserved(Date.now(), [
+      { name: account.name, window: 'ses', utilization: usage.ses?.utilization },
+      { name: account.name, window: 'wk', utilization: usage.wk?.utilization },
+    ]);
   }
 
   /**
@@ -2878,6 +2885,17 @@ export class AccountManager {
     const account = this.accounts[accountIndex];
     if (!account) return;
 
+    // Utilization from RESPONSE HEADERS (every request) feeds the capacity estimate's
+    // delta marks too — header-driven moves arrive far more often than probe cycles.
+    const hdrU5 = parseFloat(headers['anthropic-ratelimit-unified-5h-utilization']);
+    const hdrU7 = parseFloat(headers['anthropic-ratelimit-unified-7d-utilization']);
+    if (!isNaN(hdrU5) || !isNaN(hdrU7)) {
+      this.capacity.noteUtilizationObserved(Date.now(), [
+        { name: account.name, window: 'ses', utilization: isNaN(hdrU5) ? undefined : clamp01(hdrU5) },
+        { name: account.name, window: 'wk', utilization: isNaN(hdrU7) ? undefined : clamp01(hdrU7) },
+      ]);
+    }
+
     // Unified rate limits (Claude Max)
     const u5h = parseFloat(headers['anthropic-ratelimit-unified-5h-utilization']);
     const u7d = parseFloat(headers['anthropic-ratelimit-unified-7d-utilization']);
@@ -3046,6 +3064,16 @@ export class AccountManager {
       const pairs = a.type === 'provider'
         ? [['ses', 'providerSesReset'], ['wk', 'providerWkReset']]
         : [['ses', 'unified5hReset'], ['wk', 'unified7dReset']];
+      // Keep the open cycle's windowStartedAt fresh: a NEW reset stamp whose window
+      // start precedes the cycle's open means we joined mid-window (the absolute
+      // estimate is then only a lower bound — see the delta method).
+      for (const [win, stampKey] of pairs) {
+        const resetAt = q[stampKey];
+        const open = this.capacity.openCycle(a.name, win);
+        if (resetAt && open && open.startedAt > resetAt - WINDOW_MS_BY_KIND[win]) {
+          open.windowStartedAt = resetAt - WINDOW_MS_BY_KIND[win];
+        }
+      }
       for (const [win, stampKey] of pairs) {
         const resetAt = q[stampKey];
         // Close ONLY. This path deliberately does NOT null the stamp: the rollover

package/src/capacity-ledger.js

@@ -250,18 +250,71 @@ export class CapacityLedger {
     if (!(utilization > 0) || !(utilization < 1)) return null;
     const open = this.openCycle(name, window);
     if (!open || !(open.tokensSoFar > 0)) return null;
+
+    // DELTA METHOD (preferred). The absolute form (tokens ÷ utilization) silently
+    // assumes we watched the WHOLE window — false whenever the ledger joined late (a
+    // restart, a migration, a new account). Measured 2026-08-24: all four weekly
+    // estimates joined 8.9-95h into their window, so every one understated the tank,
+    // max@dubner.io by ~2x.
+    //
+    // Between two readings the tank is invariant, so pre-join usage cancels:
+    //     tank = (tokens observed between them) / (u2 - u1)
+    // No assumption about what happened before we started counting. Requires a rising
+    // utilization AND tokens accrued across the same span; falls back to absolute when
+    // we genuinely did watch from the start.
+    const mark = this._utilMarks?.get(`${name}:${window}`);
+    if (mark && utilization > mark.utilization) {
+      const deltaTokens = open.tokensSoFar - mark.tokensSoFar;
+      const deltaUtil = utilization - mark.utilization;
+      // A meaningful denominator only: a 0.5pp move on a coarse-rounded percentage
+      // (vendors report whole percents) turns rounding noise into a 200x multiplier.
+      if (deltaTokens > 0 && deltaUtil >= 0.02) {
+        return {
+          tokens: Math.round(deltaTokens / deltaUtil),
+          utilization, fresh: true, method: 'delta',
+          basis: { deltaTokens, deltaUtil },
+        };
+      }
+    }
     // Fresh = we can prove the reading and the accrual describe the SAME window: the
     // reading arrived after the open cycle began. A reading that predates the cycle (or
     // was never noted at all) describes the previous window — mark it and let the UI
     // caveat it, never silently trust it.
     const fresh = this._utilObservedAt > 0 && open.startedAt != null && this._utilObservedAt >= open.startedAt;
-    return { tokens: Math.round(open.tokensSoFar / utilization), utilization, fresh };
+    // ABSOLUTE fallback. Only a LOWER BOUND unless we observed the window from its very
+    // start — flagged so the UI can say "≥" rather than present a floor as the answer.
+    const wholeWindow = open.startedAt != null && open.windowStartedAt != null
+      && open.startedAt <= open.windowStartedAt + 60_000;
+    return {
+      tokens: Math.round(open.tokensSoFar / utilization),
+      utilization, fresh, method: 'absolute', lowerBound: !wholeWindow,
+    };
   }
 
   /** Record when a utilization reading arrived, so estimateFromUtilization can tell
    *  same-window freshness from a stale previous-window reading. */
-  noteUtilizationObserved(at = this._now()) {
+  noteUtilizationObserved(at = this._now(), marks = null) {
     this._utilObservedAt = at;
+    // Snapshot (utilization, tokensSoFar) per account+window so the NEXT reading can be
+    // differenced against it. `marks` is [{name, window, utilization}] from the caller,
+    // which owns the per-account-type quota fields.
+    if (!marks) return;
+    this._utilMarks = this._utilMarks || new Map();
+    for (const m of marks) {
+      if (!(m.utilization >= 0) || !(m.utilization < 1)) continue;
+      const open = this.openCycle(m.name, m.window);
+      if (!open) continue;
+      const key = `${m.name}:${m.window}`;
+      const prev = this._utilMarks.get(key);
+      // Keep the OLDEST usable mark within this cycle: a wider span means a larger
+      // denominator and less rounding sensitivity. Reset when the cycle rolls.
+      if (!prev || prev.cycleStartedAt !== open.startedAt || m.utilization < prev.utilization) {
+        this._utilMarks.set(key, {
+          utilization: m.utilization, tokensSoFar: open.tokensSoFar,
+          cycleStartedAt: open.startedAt, at,
+        });
+      }
+    }
   }
 
   // ── Queries ─────────────────────────────────────────────────────────────────

package/src/server.js

@@ -1657,7 +1657,7 @@ function isContextLengthError(errorBody) {
   return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
+export const __serverTest = { reanchorOrphanedSystemMessages, unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1905,6 +1905,52 @@ function describeRejectedBlock(body, errorBody) {
   }
 }
 
+/** Anthropic (2026-08) accepts a mid-array `system` message under one positional rule,
+ *  stated verbatim in its own 400:
+ *    "role 'system' must precede an 'assistant' message or end the array; the
+ *     directive-only form (content: [] with output_config) is accepted at any position"
+ *
+ *  Both transcript repairs DROP a turn whose content strips empty. When that turn is the
+ *  assistant anchoring a preceding system, the system is orphaned and the NEXT request
+ *  400s — and because the repair LATCHES the session (markSessionThinkingContaminated →
+ *  the pre-strip at retryCount===0), the orphaning recurs on every later turn. The
+ *  ordering 400 is not an isSignatureRejection, so it never reaches the recovery branches
+ *  or the friendly give-up message: it surfaces raw and the session is bricked. Measured
+ *  2026-08-24: "stripped 21 provider thinking block(s)" at 06:12:13.278Z → that exact 400
+ *  at 06:12:13.835Z, 4 occurrences in one day.
+ *
+ *  RE-ANCHOR, never drop the system. A system message carries load-bearing directives;
+ *  deleting one silently changes the user's session with no signal — a worse defect than
+ *  the loud 400. The placeholder reuses the `(content removed)` string this file already
+ *  emits for the messages[0] guard, so it is an established shape here, not a new one.
+ *
+ *  Runs as a POST-PASS over the rebuilt array so it fires only on real violations:
+ *   - a system that ENDS the array is legal ("or end the array") — untouched
+ *   - a system already followed by an assistant is legal — untouched
+ *   - the directive-only form (content: [] + output_config) is legal ANYWHERE — untouched
+ *  Idempotent: a second run finds no violation, so the latched re-strip cannot grow the
+ *  transcript turn after turn.
+ */
+function reanchorOrphanedSystemMessages(messages) {
+  let inserted = 0;
+  const out = [];
+  for (let i = 0; i < messages.length; i++) {
+    const msg = messages[i];
+    out.push(msg);
+    if (msg?.role !== 'system') continue;
+    const next = messages[i + 1];
+    if (next === undefined) continue;                       // ends the array — legal
+    if (next?.role === 'assistant') continue;               // already anchored — legal
+    // The directive-only form is accepted at any position; re-anchoring it would mutate
+    // a transcript the API already accepts.
+    if (Array.isArray(msg.content) && msg.content.length === 0) continue;
+    out.push({ role: 'assistant', content: [{ type: 'text', text: '(content removed)' }] });
+    inserted++;
+  }
+  return { messages: out, inserted };
+}
+
+
 /**
  * Last-resort repair driven by the upstream's own coordinate, for a rejected block no
  * shape heuristic here recognised. Removes every block sharing the rejected block's
@@ -1951,7 +1997,7 @@ function stripRejectedBlockClass(body, errorBody) {
       messages.push({ ...msg, content: kept });
     }
     if (!removed) return { body: null, removed: 0, type };
-    json.messages = messages;
+    json.messages = reanchorOrphanedSystemMessages(messages).messages;
     return { body: Buffer.from(JSON.stringify(json)), removed, type };
   } catch {
     return { body: null, removed: 0, type: null };
@@ -2129,7 +2175,7 @@ function stripForeignThinkingBlocks(body) {
       messages.push({ ...msg, content: kept });
     }
     if (!removed && !converted) return { body: null, removed: 0, converted: 0 };
-    json.messages = messages;
+    json.messages = reanchorOrphanedSystemMessages(messages).messages;
     return { body: Buffer.from(JSON.stringify(json)), removed, converted };
   } catch {
     return { body: null, removed: 0, converted: 0 };   // non-JSON / unparseable → no rewrite

package/src/tui.js

@@ -2064,8 +2064,14 @@ export class TUI {
         if (est) {
           anyData = true;
           const caveat = est.fresh ? '' : ' (utilization reading may be from the previous window)';
-          out.push('  ' + name + ' ' + prov + ' ' + cyan('~' + formatTokens(est.tokens).padStart(CW - 1))
-            + dim(` ≈ est from ${(est.utilization * 100).toFixed(0)}% full${caveat} — measured after this window completes`));
+          // ≥ = absolute method on a window we joined late: the true tank is at least
+          // this. No ≥ when the delta method fired — it is join-independent, or the
+          // window was observed from its start.
+          const op = est.lowerBound ? '≥' : '~';
+          const via = est.method === 'delta'
+            ? `Δ ${(est.utilization * 100).toFixed(0)}% full` : `${(est.utilization * 100).toFixed(0)}% full`;
+          out.push('  ' + name + ' ' + prov + ' ' + cyan(op + formatTokens(est.tokens).padStart(CW - 1))
+            + dim(` est from ${via}${caveat} — measured after this window completes`));
         } else {
           out.push('  ' + name + ' ' + prov + ' ' + dim('no completed cycle yet'));
         }
@@ -2087,7 +2093,7 @@ export class TUI {
           : ' A session figure appears after an account\'s 5h window resets once.'));
     }
     out.push(' ' + dim('A cycle counts only if maxpool ran for all of it and the account stayed enabled.'));
-    out.push(' ' + dim('~ = estimated now from utilization (tokens ÷ % full); a measured column replaces it later.'));
+    out.push(' ' + dim('~ = estimated from utilization; ≥ = at least this (window joined late); Δ = exact-by-difference; measured replaces both.'));
     return out;
   }