maxpool 1.10.2 → 1.10.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.10.2",
+  "version": "1.10.4",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -3010,7 +3010,11 @@ export class AccountManager {
    *  cycle is no longer a truthful capacity observation — flag it partial (B2/SC6).
    *  It still displays; it is excluded from averages. */
   restoreCapacityState(payload, now = Date.now(), downtimeMs = null) {
+    // Preserve the test seam across the ledger swap (fromSerialized returns a fresh
+    // instance; without this the zero-floor harness override dies on any restore).
+    const floorOverride = this.capacity?._readFloorOverride ?? null;
     this.capacity = CapacityLedger.fromSerialized(payload);
+    this.capacity._readFloorOverride = floorOverride;
     // Partial is keyed on MAXPOOL'S OWN downtime, NEVER on the account's last request:
     // an account parked >10min mid-cycle is normal fleet rotation, and keying on its
     // last request discarded valid observations on every reload (red-team F3). The
@@ -3051,7 +3055,13 @@ export class AccountManager {
   accrueCapacity(accountIndex, { input = 0, output = 0 } = {}) {
     const account = this.accounts[accountIndex];
     if (!account) return;
-    this.capacity.accrue(account.name, { input, output });
+    // A no-weekly plan (z.ai legacy TOKENS_LIMIT, weeklyAbsent) has no weekly window to
+    // measure, so opening a wk cycle only creates a cycle that can NEVER close — dead
+    // weight that grows until the stuck-open invariant false-alarms (~12d). Session
+    // window + day buckets (the 7d volume) are the real signals for such accounts.
+    const windows = account.type === 'provider' && account.quota?.weeklyAbsent
+      ? ['ses'] : ['ses', 'wk'];
+    this.capacity.accrue(account.name, { input, output }, undefined, windows);
   }
 
   /** Close any window cycle whose reset time has passed — CLOCK-AUTHORITATIVE, so a
@@ -3064,6 +3074,18 @@ export class AccountManager {
       const pairs = a.type === 'provider'
         ? [['ses', 'providerSesReset'], ['wk', 'providerWkReset']]
         : [['ses', 'unified5hReset'], ['wk', 'unified7dReset']];
+      // A no-weekly plan's wk cycle can never close (no stamp will ever arrive).
+      // Retire it as an explicitly-labelled partial so it stops occupying the open slot
+      // and never trips the stuck-open invariant. Reachable for cycles opened before
+      // the plan was confirmed no-weekly.
+      if (a.type === 'provider' && q.weeklyAbsent) {
+        const wkOpen = this.capacity.openCycle(a.name, 'wk');
+        if (wkOpen) {
+          wkOpen.complete = false;
+          wkOpen.partialReason = 'no-weekly-plan';
+          this.capacity.closeCycle(a.name, 'wk', now, {});
+        }
+      }
       // Keep the open cycle's windowStartedAt fresh: a NEW reset stamp whose window
       // start precedes the cycle's open means we joined mid-window (the absolute
       // estimate is then only a lower bound — see the delta method).

package/src/capacity-ledger.js

@@ -31,6 +31,10 @@ const SCHEMA_VERSION = 3;
 // Two closes this far apart are the SAME boundary observed twice (a clock-close and a
 // stamp-advance racing across the boundary second), not two windows.
 const SAME_BOUNDARY_MS = 5_000;
+
+// The minimum span of a COMPLETE cycle per window (80% of nominal): a real one is
+// flagged partial by the writer, so a complete cycle below this is corrupt history.
+const READ_FLOOR_MS = { ses: 4 * 3600_000, wk: 5 * 86400_000 };
 const MAX_CYCLES_PER_WINDOW = 50;
 const MAX_DAY_BUCKETS = 10;
 
@@ -54,6 +58,9 @@ export class CapacityLedger {
     // Cleared per account+window once that window's first boundary is behind us.
     this._joinedMidWindow = false;
     this._utilObservedAt = 0;   // last utilization-reading arrival (see estimateFromUtilization)
+    // Test seam ONLY: real-window fixtures are laborious for every close-cycle test,
+    // so tests may zero the read floor. Production never touches this.
+    this._readFloorOverride = null;
   }
 
   /** Restore from a serialized payload (state.json). Tolerant: unknown schemaVersion →
@@ -140,10 +147,10 @@ export class CapacityLedger {
    *  M3 in the pre-mortem — Anthropic interim deltas are CUMULATIVE, so the SSE seam
    *  passes the running max, and this adds it exactly once per request).
    *  count_tokens requests are the CALLER's job to skip (M4) — they never reach here. */
-  accrue(name, { input, output }, at = this._now()) {
+  accrue(name, { input, output }, at = this._now(), windows = ['ses', 'wk']) {
     if (!(input > 0) && !(output > 0)) return;
     const rec = this._rec(name);
-    for (const w of ['ses', 'wk']) {
+    for (const w of windows) {
       // Open the window lazily if nothing is open (a mid-cycle boot or a window whose
       // reset stamp was never learned). startedAt is the accrual time then — the cycle
       // will be flagged partial by the caller if the boot gap warrants it (B1/B2).
@@ -324,7 +331,20 @@ export class CapacityLedger {
    *  are observations, not capacity). */
   windowStats(name, window) {
     const rec = this._accounts.get(name);
-    const closed = (rec?.[window]?.closed || []).filter(c => c.complete && !c.disabledDuring);
+    // READ-TIME FLOOR. A cycle marked complete + never-disabled but spanning far less
+    // than its window is junk from a writer bug — the live ledger held a 0.5-second /
+    // 588-token "cycle" (clock-close and stamp-advance racing at one boundary, the fold
+    // refused on an endedAt mismatch) and it dragged this account's Avg3 down ~188k.
+    // Unlike the WRITE-time floor I tried first (reverted: it punished accounts that
+    // were merely idle early in their window), at read time a genuinely short cycle is
+    // already flagged complete:false by the writer — so a complete sub-floor cycle is
+    // definitionally corrupt, never a real observation.
+    const floor = (this._readFloorOverride ?? READ_FLOOR_MS)[window] ?? 0;
+    // >= floor, with a 1s tolerance for the accrue-vs-close clock race (an accrue can
+    // stamp Date.now() a tick AFTER the close computed its boundary, making a 0-span
+    // cycle read as -1ms — found by debugging a D2 failure that only reproduced in-file).
+    const closed = (rec?.[window]?.closed || []).filter(c =>
+      c.complete && !c.disabledDuring && (c.endedAt - c.startedAt) >= floor - 1_000);
     if (!closed.length) return null;
     const avg = (arr) => arr.length ? Math.round(arr.reduce((a, b) => a + b, 0) / arr.length) : null;
     const tokens = closed.map(c => c.tokens);

package/src/tui.js

@@ -2040,18 +2040,27 @@ export class TUI {
       const name = truncate(a.name, nameW).padEnd(nameW);
       const prov = gray(providerLabel(a).padEnd(PROVIDER_W));
       if (noWeekly) {
-        // No weekly limit — the favourite legacy plan. There is no cycle to complete,
-        // so a capacity number would be a fiction. Show what it actually DID move.
+        // No weekly limit — the favourite legacy plan. There is no weekly CAP, so a
+        // measured weekly capacity is a fiction; but there IS a real ceiling: the 5h
+        // session limit gates throughput, capping the week at (windows/wk × session
+        // capacity). 33.6 five-hour windows fit in 7 days — the user's own
+        // approximation ("from the session limits"), shipped as a ceiling, never a cap.
         const t = ledger.rollingThroughput(a.name, 7);
+        const ses = ledger.windowStats(a.name, 'ses');
+        const windowsPerWk = (7 * 24) / 5;
         anyData = anyData || t.tokens > 0;
         const vol = t.tokens > 0 ? formatTokens(t.tokens) : '--';
+        // The ceiling needs a measured session capacity; without one it would multiply
+        // a guess — show the volume alone rather than fabricate the headline.
+        const ceiling = ses ? ` · ≈${formatTokens(Math.round(windowsPerWk * ses.avg10))}/wk ceiling`
+                          + dim(` (${windowsPerWk.toFixed(0)} sessions × ${formatTokens(ses.avg10)})`) : '';
         // Always disclose the window's age boundary: today is unfinished, so the 7d
         // figure grows through the day; a genuinely partial day adds the ≤-observed floor.
         const note = t.partial
           ? ' (≤ observed — maxpool was down part of the window; includes today, in progress)'
           : ' (includes today, in progress)';
         out.push('  ' + name + ' ' + prov + ' '
-          + cyan(`no weekly limit · 7d volume ${vol}`) + dim(note));
+          + cyan(`no weekly limit · 7d volume ${vol}`) + yellow(ceiling) + dim(note));
         continue;
       }
       const st = ledger.windowStats(a.name, win);
@@ -2093,7 +2102,7 @@ export class TUI {
           : ' A session figure appears after an account\'s 5h window resets once.'));
     }
     out.push(' ' + dim('A cycle counts only if maxpool ran for all of it and the account stayed enabled.'));
-    out.push(' ' + dim('~ = estimated from utilization; ≥ = at least this (window joined late); Δ = exact-by-difference; measured replaces both.'));
+    out.push(' ' + dim('~ = estimated from utilization; ≥ = at least this (window joined late); Δ = exact-by-difference; ≈/wk ceiling = session rate, not a cap.'));
     return out;
   }