The model

maxx counts.
Anthropic limits.

Everything below follows from that one sentence — and every bug in it came from breaking it.

A counter that can deny is a limit nobody agreed to.
maxx tracks what you spent across every surface and account, tells you the pace that keeps your week alive, and moves you to the account with room. It never decides whether you may work. The only things that stop work are Anthropic's 5-hour and weekly windows — and those enforce themselves, by rejecting the call.

Three marks, one denominator

A session shows where you are, where we suggest stopping, and where Anthropic stops you.

used    48%  of this 5-hour window
advise  2.4%  your weekly share, in this window's terms
wall    100%  Anthropic's hard limit — a lockout, mid-task

Past the advised wall is fine. It borrows from later blocks and breaks nothing.

Why not "% of my 5-hour limit"

That number reads 100%-is-fine every window, because the window refills. Spend to it six windows running and the week is gone by Wednesday — with every individual session inside its limits the whole way.

So the advice is what remains of your week, divided by the 5-hour blocks left in it, then converted into this window's terms so the three numbers can be compared at a glance.

And it never advises the whole window: 5-hour windows aren't spent evenly — you sleep through some and burst through others — so planning every one to the wall assumes the flattest possible week, which is the one week nobody has.

Four bugs, one mistake

A fleet spawned zero builders for 26 hours. Four bugs stacked into silence, each survivable alone — all four the same error in different costumes: treating “I could not measure” as “you may not spend.”

01  An HTTP status is not a network failure.  A Cloudflare 403 (error 1010, banned client fingerprint) was caught in the same branch as “no route to host” and reported as unreachable. maxx has no 403 path at all — its auth failure is 401.
02  The coin tank could deny.  Two accounts read “over” against maxx's own configured cap while Anthropic had them at 100% and 82% of the real week. The second held 242M tokens it was not permitted to spend.
03  The store was re-read from the beginning of time.  82,150 events / 37MB parsed on every request: 22–27s at the origin, served as intermittent 502s, read by every client as “unreachable”.
04  Reads waited at all.  A budget read now returns the last number instantly and recomputes behind it. Being one pass stale costs at most one overspend, which the wall stops. Being slow cost 26 hours.

Rules that follow

1. An unreadable meter never stops work — it reports full, tagged with the error.

2. An HTTP status is never a network failure. A 403 is fixable in minutes; unreachable isn't.

3. An unknown account is not an empty one. It sorts last in every ranking.

4. Only Anthropic's windows deny. Everything maxx computes is advice.

5. A read never waits. Stale-and-instant beats fresh-and-slow, for a counter.

For agents

The rules are in the API, not just on this page — an agent mid-run can't open a website.

GET https://api.meetmaxx.co/api/model

Plain markdown, no auth. The same brief the MCP tool descriptions point to, so an agent that has only ever seen the payload can still find the rule.

block_share_pct · block_used_pct · blocks_left_week · on_pace
session_used_pct · session_advised_pct · session_wall_pct

Computed server-side, so every client gets the same answer. Three clients had already written three versions of this arithmetic; two were wrong the same way.