maxpool 1.10.2 → 1.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -3010,7 +3010,11 @@ export class AccountManager {
    *  cycle is no longer a truthful capacity observation — flag it partial (B2/SC6).
    *  It still displays; it is excluded from averages. */
   restoreCapacityState(payload, now = Date.now(), downtimeMs = null) {
+    // Preserve the test seam across the ledger swap (fromSerialized returns a fresh
+    // instance; without this the zero-floor harness override dies on any restore).
+    const floorOverride = this.capacity?._readFloorOverride ?? null;
     this.capacity = CapacityLedger.fromSerialized(payload);
+    this.capacity._readFloorOverride = floorOverride;
     // Partial is keyed on MAXPOOL'S OWN downtime, NEVER on the account's last request:
     // an account parked >10min mid-cycle is normal fleet rotation, and keying on its
     // last request discarded valid observations on every reload (red-team F3). The

package/src/capacity-ledger.js

@@ -31,6 +31,10 @@ const SCHEMA_VERSION = 3;
 // Two closes this far apart are the SAME boundary observed twice (a clock-close and a
 // stamp-advance racing across the boundary second), not two windows.
 const SAME_BOUNDARY_MS = 5_000;
+
+// The minimum span of a COMPLETE cycle per window (80% of nominal): a real one is
+// flagged partial by the writer, so a complete cycle below this is corrupt history.
+const READ_FLOOR_MS = { ses: 4 * 3600_000, wk: 5 * 86400_000 };
 const MAX_CYCLES_PER_WINDOW = 50;
 const MAX_DAY_BUCKETS = 10;
 
@@ -54,6 +58,9 @@ export class CapacityLedger {
     // Cleared per account+window once that window's first boundary is behind us.
     this._joinedMidWindow = false;
     this._utilObservedAt = 0;   // last utilization-reading arrival (see estimateFromUtilization)
+    // Test seam ONLY: real-window fixtures are laborious for every close-cycle test,
+    // so tests may zero the read floor. Production never touches this.
+    this._readFloorOverride = null;
   }
 
   /** Restore from a serialized payload (state.json). Tolerant: unknown schemaVersion →
@@ -324,7 +331,20 @@ export class CapacityLedger {
    *  are observations, not capacity). */
   windowStats(name, window) {
     const rec = this._accounts.get(name);
-    const closed = (rec?.[window]?.closed || []).filter(c => c.complete && !c.disabledDuring);
+    // READ-TIME FLOOR. A cycle marked complete + never-disabled but spanning far less
+    // than its window is junk from a writer bug — the live ledger held a 0.5-second /
+    // 588-token "cycle" (clock-close and stamp-advance racing at one boundary, the fold
+    // refused on an endedAt mismatch) and it dragged this account's Avg3 down ~188k.
+    // Unlike the WRITE-time floor I tried first (reverted: it punished accounts that
+    // were merely idle early in their window), at read time a genuinely short cycle is
+    // already flagged complete:false by the writer — so a complete sub-floor cycle is
+    // definitionally corrupt, never a real observation.
+    const floor = (this._readFloorOverride ?? READ_FLOOR_MS)[window] ?? 0;
+    // >= floor, with a 1s tolerance for the accrue-vs-close clock race (an accrue can
+    // stamp Date.now() a tick AFTER the close computed its boundary, making a 0-span
+    // cycle read as -1ms — found by debugging a D2 failure that only reproduced in-file).
+    const closed = (rec?.[window]?.closed || []).filter(c =>
+      c.complete && !c.disabledDuring && (c.endedAt - c.startedAt) >= floor - 1_000);
     if (!closed.length) return null;
     const avg = (arr) => arr.length ? Math.round(arr.reduce((a, b) => a + b, 0) / arr.length) : null;
     const tokens = closed.map(c => c.tokens);