deepline 0.3.141 → 0.3.142

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -171,6 +171,13 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
   private readonly blocks = new Map<string, LeasedBlock>();
   private readonly refills = new Map<string, Promise<void>>();
   private readonly pendingReleases = new Map<string, PendingRelease>();
+  /**
+   * Last locally synthesized dispatch slot per lane. During a rolling deploy,
+   * a gateway that omits its global schedule can return another block while
+   * the previous block's permits are still sleeping. Carrying this debt across
+   * refills prevents those fallback blocks from overlapping in one runner.
+   */
+  private readonly nextFallbackScheduledAtMs = new Map<string, number>();
   /**
    * Acquirers currently parked on each bucket's refill (empty block, awaiting a
    * grant). Demand-sizing reads this to request a block sized to the live wave
@@ -734,13 +741,41 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     }
     // Rolling deploy compatibility: an older gateway returns no schedule. It
     // has already debited the block under the legacy token-bucket contract, so
-    // keep those permits immediately usable until every gateway serves the new
-    // globally reserved timestamps.
-    const gatewayScheduledAtMs = Array.isArray(response.scheduledAtMs)
-      ? response.scheduledAtMs.map(Number)
-      : Array.from({ length: response.granted }, () => this.now());
-    const serverNowMs = Number(response.serverNowMs);
+    // preserve the grant but synthesize a conservative local schedule. Making
+    // every legacy permit immediately usable would turn a reserved block into
+    // a burst during a rolling deploy and violate the provider rate.
+    const fallbackRequestsPerSecond =
+      effectiveRequestsPerSecond > 0
+        ? effectiveRequestsPerSecond
+        : Math.min(
+            ...ordered
+              .map((rule) => (rule.requestsPerWindow / rule.windowMs) * 1_000)
+              .filter((rate) => Number.isFinite(rate) && rate > 0),
+            DEFAULT_ADVISORY_PROVIDER_MAX_RPS,
+          );
+    const fallbackSpacingMs = Math.max(
+      1,
+      Math.ceil(1_000 / fallbackRequestsPerSecond),
+    );
+    // The gateway deliberately emits burst groups at high rates. A flat
+    // schedule is therefore valid when it contains no more than the gateway's
+    // burst size; only a longer flat run is evidence of the rolling-deploy
+    // response shape that needs local repair.
+    const gatewayBurstSize = Math.max(
+      1,
+      Math.floor(fallbackRequestsPerSecond / 100),
+    );
     const receivedAtMs = this.now();
+    const hasGatewaySchedule = Array.isArray(response.scheduledAtMs);
+    const gatewayScheduledAtMs: number[] = Array.isArray(
+      response.scheduledAtMs,
+    )
+      ? response.scheduledAtMs.map((scheduledAtMs) => Number(scheduledAtMs))
+      : Array.from(
+          { length: response.granted },
+          (_, index) => receivedAtMs + index * fallbackSpacingMs,
+        );
+    const serverNowMs = Number(response.serverNowMs);
     let firstGatewayScheduledAtMs = Number.POSITIVE_INFINITY;
     for (const scheduledAtMs of gatewayScheduledAtMs) {
       firstGatewayScheduledAtMs = Math.min(
@@ -748,15 +783,102 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
         scheduledAtMs,
       );
     }
-    const scheduledAtMs =
+    const translatedScheduledAtMs =
       Number.isFinite(serverNowMs) && serverNowMs >= 0
         ? gatewayScheduledAtMs.map(
             (scheduledAtMs) =>
               receivedAtMs +
               Math.max(0, firstGatewayScheduledAtMs - serverNowMs) +
               (scheduledAtMs - firstGatewayScheduledAtMs),
-          )
+        )
         : gatewayScheduledAtMs;
+    const previousFallbackScheduledAtMs =
+      this.nextFallbackScheduledAtMs.get(laneKey);
+    if (
+      previousFallbackScheduledAtMs !== undefined &&
+      previousFallbackScheduledAtMs <= receivedAtMs
+    ) {
+      this.nextFallbackScheduledAtMs.delete(laneKey);
+    }
+    const fallbackScheduleFloor = Math.max(
+      receivedAtMs,
+      this.nextFallbackScheduledAtMs.get(laneKey) ?? receivedAtMs,
+    );
+    let gatewayScheduleValid = hasGatewaySchedule;
+    let equalTimestampRun = 0;
+    for (let index = 0; index < translatedScheduledAtMs.length; index += 1) {
+      const candidate = translatedScheduledAtMs[index];
+      if (!Number.isFinite(candidate) || candidate < 0) {
+        gatewayScheduleValid = false;
+        break;
+      }
+      if (index === 0) {
+        equalTimestampRun = 1;
+        continue;
+      }
+      const previous = translatedScheduledAtMs[index - 1];
+      if (candidate < previous) {
+        gatewayScheduleValid = false;
+        break;
+      }
+      equalTimestampRun = candidate === previous ? equalTimestampRun + 1 : 1;
+      if (equalTimestampRun > gatewayBurstSize) {
+        gatewayScheduleValid = false;
+        break;
+      }
+    }
+
+    let scheduledAtMs: number[];
+    if (gatewayScheduleValid) {
+      // Preserve the gateway's exact cadence, including legitimate burst
+      // groups and provider-imposed gaps. Only shift the whole schedule when
+      // it is already overdue or must clear fallback debt from an older block.
+      const firstScheduledAtMs = translatedScheduledAtMs[0];
+      const shiftMs =
+        firstScheduledAtMs === undefined
+          ? 0
+          : Math.max(0, fallbackScheduleFloor - firstScheduledAtMs);
+      scheduledAtMs = translatedScheduledAtMs.map(
+        (scheduledAtMs) => scheduledAtMs + shiftMs,
+      );
+      this.nextFallbackScheduledAtMs.delete(laneKey);
+    } else {
+      // A rolling gateway may expose the new schedule field before it starts
+      // populating distinct timestamps. Do not let that invalid schedule turn
+      // a reserved block into a burst. Use the conservative local cadence
+      // implied by the effective/declared rate, carrying any prior fallback
+      // debt across refills.
+      const positiveGatewayGaps = translatedScheduledAtMs.flatMap(
+        (scheduledAtMs, index) => {
+          if (index === 0) return [];
+          const gap = scheduledAtMs - translatedScheduledAtMs[index - 1];
+          return Number.isFinite(gap) && gap > 0 ? [gap] : [];
+        },
+      );
+      const repairSpacingMs = Math.min(
+        fallbackSpacingMs,
+        ...(positiveGatewayGaps.length > 0
+          ? [Math.min(...positiveGatewayGaps)]
+          : []),
+      );
+      let previousScheduledAtMs: number | null = null;
+      scheduledAtMs = translatedScheduledAtMs.map((candidate, index) => {
+        const earliest =
+          index === 0
+            ? fallbackScheduleFloor
+            : previousScheduledAtMs! + repairSpacingMs;
+        const normalized = Math.max(candidate, earliest);
+        previousScheduledAtMs = normalized;
+        return normalized;
+      });
+      const lastScheduledAtMs = scheduledAtMs.at(-1);
+      if (lastScheduledAtMs !== undefined) {
+        this.nextFallbackScheduledAtMs.set(
+          laneKey,
+          lastScheduledAtMs + repairSpacingMs,
+        );
+      }
+    }
     if (
       scheduledAtMs.length !== response.granted ||
       scheduledAtMs.some((value) => !Number.isFinite(value) || value < 0)
@@ -986,6 +1108,7 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     if (!block) return null;
     if (block.expiresAt <= this.now()) {
       this.blocks.delete(laneKey);
+      this.nextFallbackScheduledAtMs.delete(laneKey);
       // Unused window permits are forfeited on TTL expiry (the server already
       // decremented the provider window for them, and the rule-scoped TTL is
       // capped so at most one block's worth is stranded per bucket/window).
@@ -1022,6 +1145,7 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     for (const [laneKey, block] of this.blocks) {
       if (!laneKey.startsWith(prefix)) continue;
       this.blocks.delete(laneKey);
+      this.nextFallbackScheduledAtMs.delete(laneKey);
       this.releaseReserved(
         bucketId,
         block.rateScopeToken,

package/dist/bundling-sources/shared_libs/play-runtime/play-runtime-batching-registry.ts

@@ -26,5 +26,7 @@ export function getPlayRuntimeBatchStrategy(
   if (!operation) {
     return null;
   }
-  return PLAY_RUNTIME_BATCH_OPERATION_REGISTRY[operation] ?? null;
+  const canonicalOperation =
+    operation === 'fullenrich_enrich' ? 'fullenrich_bulk_enrich' : operation;
+  return PLAY_RUNTIME_BATCH_OPERATION_REGISTRY[canonicalOperation] ?? null;
 }

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts

@@ -109,14 +109,13 @@ import {
   readRuntimeSheetDatasetRowKeys,
   readRuntimeSheetDatasetRows,
   releaseRuntimeWorkReceipts,
-  RuntimeSheetAttemptSupersededError,
   startRuntimeSheetDataset,
   supersededRuntimeMapRows,
+  type RuntimeMapRowsStaleRow,
   type RuntimeMapRowsWriteResult,
 } from '../runtime-api';
 import { installPgRuntimePoolDriver } from '../runtime-pg-driver-pg';
 import { createRuntimeToolAuthScopeDigestResolver } from '../auth-scope-resolver';
-import { resolveMapRowOutcomeKey } from '../map-row-outcome';
 import { createRunScopedChildPlayResolver } from './child-play-resolver';
 import { normalizePlayContractCompatibility } from '../../plays/contracts';
 import {
@@ -365,8 +364,7 @@ export function assertRuntimeSheetAttemptPersistedTerminalRows(input: {
 }): void {
   // Kept as a temporary source-compatible seam for callers compiled against
   // the lease model. A partial update is classified from the terminal-write
-  // result (`assertRuntimeSheetTerminalWriteNotSuperseded`), never from this
-  // count.
+  // result, never from this count.
   void input;
 }
 
@@ -453,33 +451,39 @@ export function runtimeSheetStartWriteVersion(
     : {};
 }
 
-/**
- * Terminal writes rejected as stale for any reason other than a verified
- * same-run settlement or an unversioned already-terminal row mean the sheet
- * rows belong to a different write version than this attempt's: a newer
- * admission (rerun, resumed attempt, concurrent run) owns them. Throw so the
- * map fails and the persistence latch trips, instead of logging a perf line
- * and spending provider calls on rows that can never be persisted.
- */
-export function assertRuntimeSheetTerminalWriteNotSuperseded(input: {
-  tableNamespace: string;
-  runId: string;
-  writeVersion: SheetWriteVersionValue | null;
-  submittedRows: number;
+/** Stale latest-view rows are reported, not escalated to a run failure. */
+export function runtimeSheetTerminalWriteStaleRows(input: {
   result: Pick<RuntimeMapRowsWriteResult, 'staleKeys' | 'staleRows'>;
   recoveredStaleKeys: Iterable<string>;
-}): void {
-  const supersededRows = supersededRuntimeMapRows(input.result, {
+}): RuntimeMapRowsStaleRow[] {
+  return supersededRuntimeMapRows(input.result, {
     exceptKeys: input.recoveredStaleKeys,
   });
-  if (supersededRows.length === 0) return;
-  throw new RuntimeSheetAttemptSupersededError({
-    tableNamespace: input.tableNamespace,
-    runId: input.runId,
-    writeVersionValue: input.writeVersion,
-    submittedRows: input.submittedRows,
-    supersededRows,
-  });
+}
+
+/** Only accepted current-sheet rows contribute to persisted lifecycle counts. */
+export function runtimeSheetTerminalWriteCounts(input: {
+  rows: ReadonlyArray<{ key: string; status?: string }>;
+  committedKeys: Iterable<string>;
+  recoveredStaleKeys: Iterable<string>;
+}): { persistedRows: number; succeededRows: number; failedRows: number } {
+  const acceptedKeys = new Set([
+    ...input.committedKeys,
+    ...input.recoveredStaleKeys,
+  ]);
+  const acceptedRows = new Map(
+    input.rows
+      .filter((row) => acceptedKeys.has(row.key))
+      .map((row) => [row.key, row]),
+  );
+  const failedRows = [...acceptedRows.values()].filter(
+    (row) => row.status === 'failed',
+  ).length;
+  return {
+    persistedRows: acceptedRows.size,
+    succeededRows: acceptedRows.size - failedRows,
+    failedRows,
+  };
 }
 
 async function vercelBypassHeaders(
@@ -2686,34 +2690,27 @@ async function run(
           `[info] dropped ${staleKeys.size} stale runtime sheet write(s) for table=${input.tableNamespace}; ${recoveredStaleKeys.length} same-run terminal write(s) were accepted idempotently`,
           options,
         );
-        try {
-          assertRuntimeSheetTerminalWriteNotSuperseded({
-            tableNamespace: input.tableNamespace,
-            runId,
-            writeVersion: attempt?.writeVersion ?? null,
-            submittedRows: input.rows.length,
-            result,
-            recoveredStaleKeys,
-          });
-        } catch (error) {
+        const supersededRows = runtimeSheetTerminalWriteStaleRows({
+          result,
+          recoveredStaleKeys,
+        });
+        if (supersededRows.length > 0) {
           emitWorkerLog(
-            `[error] ${error instanceof Error ? error.message : String(error)}`,
+            `[info] ${supersededRows.length} Runtime Sheet row write(s) did not own the latest view; ` +
+              `the existing latest-view values were preserved and this run will continue`,
             options,
           );
-          throw error;
         }
       }
-      const failedRows = input.rows.filter(
-        (row) =>
-          row.status === 'failed' &&
-          !staleKeys.has(resolveMapRowOutcomeKey(row) ?? String(row.key ?? '')),
-      ).length;
-      // The fenced commit response is the persistence barrier. An exact-version
-      // replay may report zero physical updates while still being an accepted,
-      // durable settlement, so derive accepted rows from submitted minus stale
-      // keys instead of issuing a read-after-write visibility audit.
-      const committedTerminalRows = result.committedKeys.length;
-      const succeededRows = Math.max(0, committedTerminalRows - failedRows);
+      const {
+        persistedRows: committedTerminalRows,
+        succeededRows,
+        failedRows,
+      } = runtimeSheetTerminalWriteCounts({
+        rows: input.rows,
+        committedKeys: result.committedKeys,
+        recoveredStaleKeys,
+      });
       const datasetPath = `datasets.${input.tableNamespace}`;
       const datasetId = createRuntimeDatasetId(playName, input.tableNamespace);
       const settlement = runtimeMapDatasetSettlements.get(datasetId) ?? {
@@ -2725,10 +2722,8 @@ async function run(
         succeededRows: 0,
         failedRows: 0,
       };
-      // Only exact-version accepted rows belong to this run's lifecycle
-      // settlement. The stale keys that reach this point were all recovered as
-      // same-run terminal settlements, counted when they first committed, so
-      // they stay excluded here.
+      // Rejected stale rows have no retained copy. Verified same-run terminal
+      // replays count as accepted even when they performed no physical update.
       settlement.persistedRows += committedTerminalRows;
       settlement.succeededRows += succeededRows;
       settlement.failedRows += failedRows;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -7168,12 +7168,11 @@ export function supersededRuntimeMapRows(
 }
 
 /**
- * A terminal write batch was rejected because the Runtime Sheet rows belong to
- * a different write version than this attempt carries. The attempt has been
- * superseded: nothing it executes from here on can be persisted, so it must
- * stop instead of spending provider calls on rows that will be dropped. Thrown
- * by the runner's terminal-write handler and by the Context when a handler
- * reports `supersededKeys`; both trip the persistence latch.
+ * A terminal write batch was explicitly marked as an attempt-wide
+ * supersession. Retained for compatibility with older terminal-write handlers
+ * and the Context's explicit `supersededKeys` stop signal. The current
+ * runner-app writer reports ordinary stale latest-view rows without throwing
+ * this error.
  */
 export class RuntimeSheetAttemptSupersededError extends Error {
   readonly tableNamespace: string;
@@ -8995,7 +8994,13 @@ export async function countRuntimeSheetRowOutcomes(
       params?: unknown[],
     ): Promise<{ rows: Row[] }>;
   },
-  input: { schema: string; table: string; runId: string },
+  input: {
+    schema: string;
+    table: string;
+    runId: string;
+    playName?: string;
+    tableNamespace?: string;
+  },
 ): Promise<RuntimeSheetRowOutcomeCounts> {
   const { rows } = await client.query<{
     completed: number | string;
@@ -9052,6 +9057,8 @@ export async function readRuntimeSheetRowOutcomeCounts(
       schema: session.postgres.schema,
       table: session.postgres.sheetTable,
       runId: context.runId,
+      playName: context.playName,
+      tableNamespace: input.tableNamespace,
     }),
   );
 }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-state.ts

@@ -89,10 +89,12 @@ const BLOCK_WAIT_HORIZON_MS = 1_000;
 const ADAPTIVE_BURST_HORIZON_MS = 1_000;
 
 /**
- * Effective (spendable) bucket capacity for rate rows aliased `b`. Derived per
+ * Effective (spendable) bucket capacity for a rate-row alias. Derived per
  * statement from the learned rate; see {@link ADAPTIVE_BURST_HORIZON_MS}.
  */
-const EFFECTIVE_CAPACITY_SQL = `GREATEST(b.capacity, b.refill_per_sec * ${ADAPTIVE_BURST_HORIZON_MS} / 1000.0)`;
+function effectiveCapacitySql(alias: string): string {
+  return `GREATEST(${alias}.capacity, ${alias}.refill_per_sec * ${ADAPTIVE_BURST_HORIZON_MS} / 1000.0)`;
+}
 
 /**
  * Internal cooldown cap. A 429 report (penalize) can carry an arbitrarily large
@@ -1047,26 +1049,66 @@ async function acquirePureRate(
         SELECT
           b.bucket_id,
           b.rule_id,
-          b.capacity,
-          b.min_rps,
-          b.max_rps,
+          sc.capacity,
+          sc.min_rps,
+          CASE
+            WHEN sc.adaptive_max_configured THEN sc.max_rps
+            ELSE b.max_rps
+          END AS max_rps,
           b.seen_backpressure,
-          b.base_refill_per_sec,
-          b.refill_per_sec,
+          sc.base_refill_per_sec,
+          LEAST(
+            CASE
+              WHEN sc.adaptive_max_configured THEN sc.max_rps
+              ELSE b.max_rps
+            END,
+            GREATEST(sc.min_rps, b.refill_per_sec)
+          ) AS refill_per_sec,
           b.cool_until_ms,
           b.last_ramp_at_ms,
           b.next_dispatch_at_ms,
           nv.now_ms AS now_ms,
+          -- A warm row can have been widened by an older adaptive ceiling or
+          -- edited out of band. Normalize it to the current seed before this
+          -- statement computes tokens, schedules, or grants. The original
+          -- values remain beside the normalized ones so config_drift still
+          -- reports that the repair happened.
+          b.capacity AS stored_capacity,
+          b.base_refill_per_sec AS stored_base_refill_per_sec,
+          b.min_rps AS stored_min_rps,
+          b.max_rps AS stored_max_rps,
+          b.adaptive_max_configured OR sc.adaptive_max_configured
+            AS adaptive_max_configured,
           -- Spendable burst: one second of the rate in force, floored at the
-          -- declared window burst. b.capacity stays the seeded declared value
-          -- so config-drift detection keeps comparing like with like.
-          ${EFFECTIVE_CAPACITY_SQL} AS effective_capacity,
+          -- declared window burst. The normalized row is what this acquire
+          -- spends; the stored row remains available for drift reporting.
+          ${effectiveCapacitySql('normalized')} AS effective_capacity,
           LEAST(
-            ${EFFECTIVE_CAPACITY_SQL},
-            b.tokens + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0 * b.refill_per_sec
+            ${effectiveCapacitySql('normalized')},
+            LEAST(b.tokens, sc.capacity)
+              + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                * LEAST(
+                    CASE
+                      WHEN sc.adaptive_max_configured THEN sc.max_rps
+                      ELSE b.max_rps
+                    END,
+                    GREATEST(sc.min_rps, b.refill_per_sec)
+                  )
           ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
+        JOIN seed_config sc ON sc.rule_id = b.rule_id
         CROSS JOIN now_value nv
+        CROSS JOIN LATERAL (
+          SELECT
+            sc.capacity AS capacity,
+            LEAST(
+              CASE
+                WHEN sc.adaptive_max_configured THEN sc.max_rps
+                ELSE b.max_rps
+              END,
+              GREATEST(sc.min_rps, b.refill_per_sec)
+            ) AS refill_per_sec
+        ) normalized
         WHERE b.bucket_id = $1
           AND b.rule_id = ANY($2::text[])
         ORDER BY b.rule_id
@@ -1119,6 +1161,11 @@ async function acquirePureRate(
       updated AS (
         UPDATE ${bucketTableName(input)} b
         SET
+          capacity = r.capacity,
+          base_refill_per_sec = r.base_refill_per_sec,
+          min_rps = r.min_rps,
+          max_rps = r.max_rps,
+          adaptive_max_configured = r.adaptive_max_configured,
           tokens = r.tokens_after_refill - (SELECT granted FROM grant_calc),
           refilled_at_ms = r.now_ms,
           next_dispatch_at_ms = CASE
@@ -1200,12 +1247,12 @@ async function acquirePureRate(
         (
           SELECT COALESCE(
             bool_or(
-              r.capacity IS DISTINCT FROM sc.capacity
-              OR r.base_refill_per_sec IS DISTINCT FROM sc.base_refill_per_sec
-              OR r.min_rps IS DISTINCT FROM sc.min_rps
+              r.stored_capacity IS DISTINCT FROM sc.capacity
+              OR r.stored_base_refill_per_sec IS DISTINCT FROM sc.base_refill_per_sec
+              OR r.stored_min_rps IS DISTINCT FROM sc.min_rps
               OR (
                 sc.adaptive_max_configured
-                AND r.max_rps IS DISTINCT FROM sc.max_rps
+                AND r.stored_max_rps IS DISTINCT FROM sc.max_rps
               )
             ),
             false
@@ -1432,27 +1479,64 @@ async function acquireWithConcurrency(
       refreshed AS (
         SELECT
           b.rule_id,
-          b.capacity,
-          b.min_rps,
-          b.max_rps,
+          sc.capacity,
+          sc.min_rps,
+          CASE
+            WHEN sc.adaptive_max_configured THEN sc.max_rps
+            ELSE b.max_rps
+          END AS max_rps,
           b.seen_backpressure,
-          b.base_refill_per_sec,
+          sc.base_refill_per_sec,
+          LEAST(
+            CASE
+              WHEN sc.adaptive_max_configured THEN sc.max_rps
+              ELSE b.max_rps
+            END,
+            GREATEST(sc.min_rps, b.refill_per_sec)
+          ) AS refill_per_sec,
           b.learned_concurrency_limit,
           b.concurrency_minimum_rtt_ms,
           b.cool_until_ms,
           b.last_ramp_at_ms,
           b.next_dispatch_at_ms,
           nv.now_ms AS now_ms,
+          -- Normalize a warm row before deriving its grant. The stored values
+          -- are retained for the config_drift diagnostic below.
+          b.capacity AS stored_capacity,
+          b.base_refill_per_sec AS stored_base_refill_per_sec,
+          b.min_rps AS stored_min_rps,
+          b.max_rps AS stored_max_rps,
+          b.adaptive_max_configured OR sc.adaptive_max_configured
+            AS adaptive_max_configured,
           -- Same derived burst as the pure-rate path. The declared
           -- maxConcurrency is untouched: free_slots still bounds the grant.
-          ${EFFECTIVE_CAPACITY_SQL} AS effective_capacity,
+          ${effectiveCapacitySql('normalized')} AS effective_capacity,
           LEAST(
-            ${EFFECTIVE_CAPACITY_SQL},
-            b.tokens + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0 * b.refill_per_sec
-          ) AS tokens_after_refill,
-          b.refill_per_sec
+            ${effectiveCapacitySql('normalized')},
+            LEAST(b.tokens, sc.capacity)
+              + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                * LEAST(
+                    CASE
+                      WHEN sc.adaptive_max_configured THEN sc.max_rps
+                      ELSE b.max_rps
+                    END,
+                    GREATEST(sc.min_rps, b.refill_per_sec)
+                  )
+          ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
+        JOIN seed_config sc ON sc.rule_id = b.rule_id
         CROSS JOIN now_value nv
+        CROSS JOIN LATERAL (
+          SELECT
+            sc.capacity AS capacity,
+            LEAST(
+              CASE
+                WHEN sc.adaptive_max_configured THEN sc.max_rps
+                ELSE b.max_rps
+              END,
+              GREATEST(sc.min_rps, b.refill_per_sec)
+            ) AS refill_per_sec
+        ) normalized
         WHERE b.bucket_id = $1
           AND b.rule_id = ANY($2::text[])
         ORDER BY b.rule_id
@@ -1560,6 +1644,11 @@ async function acquireWithConcurrency(
       updated AS (
         UPDATE ${bucketTableName(input)} b
         SET
+          capacity = r.capacity,
+          base_refill_per_sec = r.base_refill_per_sec,
+          min_rps = r.min_rps,
+          max_rps = r.max_rps,
+          adaptive_max_configured = r.adaptive_max_configured,
           tokens = r.tokens_after_refill - (SELECT granted FROM grant_calc),
           refilled_at_ms = r.now_ms,
           next_dispatch_at_ms = CASE
@@ -1667,12 +1756,12 @@ async function acquireWithConcurrency(
         (
           SELECT COALESCE(
             bool_or(
-              r.capacity IS DISTINCT FROM sc.capacity
-              OR r.base_refill_per_sec IS DISTINCT FROM sc.base_refill_per_sec
-              OR r.min_rps IS DISTINCT FROM sc.min_rps
+              r.stored_capacity IS DISTINCT FROM sc.capacity
+              OR r.stored_base_refill_per_sec IS DISTINCT FROM sc.base_refill_per_sec
+              OR r.stored_min_rps IS DISTINCT FROM sc.min_rps
               OR (
                 sc.adaptive_max_configured
-                AND r.max_rps IS DISTINCT FROM sc.max_rps
+                AND r.stored_max_rps IS DISTINCT FROM sc.max_rps
               )
             ),
             false