maxpool 1.5.86 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.86",
+  "version": "1.6.0",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",
@@ -44,4 +44,4 @@
     "eslint": "^9.39.5",
     "git-cliff": "2.13.1"
   }
-}
+}

package/src/account-manager.js

@@ -1,4 +1,5 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
+import { peakWindowState, DEFAULT_PEAK_CAP } from './peak-window.js';
 
 // Bounded re-poll hold for an account blocked ONLY by a transient, self-clearing
 // condition whose exact recovery time is unknown: (a) a weekly-critical account
@@ -194,6 +195,14 @@ const MAX_FAILED_PROBES = 4;
 // day rather than never.
 const PROBE_FAILURE_ALERT_AT = 20;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+// Peak-hour governance (2026-08-18). A peak TIER, added to _effectivePriority after the
+// mode layer: tier 1 = provider inside its peak window (de-prefer), tier 2 = also over
+// its peakCap (last-resort). A STRIDE, not an additive constant, so a peak account ranks
+// below every non-peak account BY CONSTRUCTION even against a hand-set `priority: 500`,
+// while intra-tier ordering (the mode layer) is preserved. Not Infinity — the selector's
+// `priority < bestPriority` is false for Infinity vs Infinity and an all-peaked pool
+// would select nothing.
+const PEAK_TIER_STRIDE = 1_000_000;
 const FIVE_HOUR_MS = 5 * 60 * 60 * 1000;
 
 // Quota fields that survive a restart: utilization levels and their reset
@@ -322,6 +331,7 @@ export class AccountManager {
     this.routingMode = 'automatic';
     this.preferredAccountName = null;
     this.sessionBindings = new Map();
+    this._peakCache = null;   // per-UTC-minute peak-window memo (see _peakStateFor)
     this.sessionPolicies = new Map();
     this.upstreamThrottle = {
       until: null,
@@ -362,10 +372,10 @@ export class AccountManager {
    */
   getActiveAccount(requestInfo = {}, excludedIndexes = new Set()) {
     this.refreshExpiredQuotas();
-    return this._selectNext(requestInfo, excludedIndexes);
+    return this._selectNext(requestInfo, excludedIndexes, requestInfo.now);
   }
 
-  nextRetryForRequest(requestInfo = {}, excludedIndexes = new Set()) {
+  nextRetryForRequest(requestInfo = {}, excludedIndexes = new Set(), now = Date.now()) {
     this.refreshExpiredQuotas();
     const upstreamRetry = this._upstreamThrottleRetry();
     if (upstreamRetry && !this._hasAvailableProvider(requestInfo, excludedIndexes)) {
@@ -434,7 +444,7 @@ export class AccountManager {
       // finite hold. It must NEVER contribute the WEEKLY reset (days) — that is the
       // multi-day-hang the bounded path fences off; see the !fairnessOnlyBlock
       // guards on the weekly branches below.
-      if (!fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true, model: requestInfo.model })) {
+      if (!fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true, model: requestInfo.model, now })) {
         return {
           available: true,
           retryAfterMs: 0,
@@ -443,13 +453,13 @@ export class AccountManager {
           matchingRoutes,
         };
       }
-      if (fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true, model: requestInfo.model })) {
+      if (fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true, model: requestInfo.model, now })) {
         soonestBoundedHold = Math.min(soonestBoundedHold, BOUNDED_REPOLL_HOLD_MS);
         if (!boundedHoldCause) boundedHoldCause = 'queued_behind_fairness';
         continue;
       }
 
-      const retry = this._retryInfo(account, requestInfo.model);
+      const retry = this._retryInfo(account, requestInfo.model, now);
       note(retry.cause);
       if (!fairnessOnlyBlock && retry.weeklyCritical && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true, model: requestInfo.model })) {
         return {
@@ -464,7 +474,7 @@ export class AccountManager {
         // A known, soon short-term reset (5h cap / rate-limit / cooldown) — even on
         // a weekly-critical account, this is the REAL near-term recovery time, so
         // it holds here with the true cause rather than the distant weekly reset.
-        const ms = retry.retryAt - Date.now();
+        const ms = retry.retryAt - now;
         if (ms < soonestTemporary) {
           soonestTemporary = ms;
           temporaryCause = retry.cause;
@@ -488,7 +498,7 @@ export class AccountManager {
         // avoid (a weekly-exhausted gated fleet stays terminal → honest error,
         // matching the no-newcomer-vs-queue distinction). Only its short-term reset
         // (above) or the bounded hold may fire.
-        const ms = retry.retryAt - Date.now();
+        const ms = retry.retryAt - now;
         if (ms < soonestWeekly) soonestWeekly = ms;
       } else if (!fairnessOnlyBlock && retry.cause === 'weekly_exhausted' && !retry.retryAt) {
         // Weekly-capped but we haven't learned the reset time (cold start /
@@ -540,7 +550,7 @@ export class AccountManager {
     };
   }
 
-  hasAvailableRoute(requestInfo = {}, excludedIndexes = new Set()) {
+  hasAvailableRoute(requestInfo = {}, excludedIndexes = new Set(), now = Date.now()) {
     this.refreshExpiredQuotas();
     const profile = requestInfo.profile || 'claude';
     // Route-EXISTENCE check only (order-independent `.some`): unlike the acquire
@@ -562,7 +572,7 @@ export class AccountManager {
     return weeklyPasses.some(options => this.accounts.some(account => {
       if (excludedIndexes.has(account.index)) return false;
       if (!this._matchesRequest(account, profile, requestInfo)) return false;
-      return this._isAvailable(account, { ...options, model: requestInfo.model });
+      return this._isAvailable(account, { ...options, model: requestInfo.model, now });
     }));
   }
 
@@ -580,7 +590,9 @@ export class AccountManager {
     const weight = Math.max(1, Number(requestInfo.weight) || 1);
     const upstreamThrottleProbe = account.type !== 'provider' && this._claimUpstreamThrottleProbe();
     if (requestInfo.sessionKey) {
-      this._bindSession(requestInfo.sessionKey, account, requestInfo.model);
+      // Same clock the selection above used, so the peak-failover guard can never
+      // disagree with the peak tier that caused the move (defaults to real time).
+      this._bindSession(requestInfo.sessionKey, account, requestInfo.model, requestInfo.now);
     }
     account.inFlight++;
     account.activeWeight += weight;
@@ -715,7 +727,7 @@ export class AccountManager {
   _isAvailable(account, options = {}) {
     if (!account) return false;
     if (!account.enabled) return false;
-    const now = Date.now();
+    const now = options.now ?? Date.now();
 
     // Check rate limit expiry
     if (account.status === 'throttled' && account.rateLimitedUntil) {
@@ -765,6 +777,12 @@ export class AccountManager {
     // by request-path callers; model-agnostic call sites skip this gate.
     if (options.model && this._scopedExhausted(account, options.model)) return false;
 
+    // PEAK HARD BAR (peakCap: 0.0 — "never during peak"). The ONLY peak gate on
+    // ELIGIBILITY; the soft cap is a priority tier and can never strand a request.
+    // No allow* opt-out exists on purpose: zero means zero. The request parks on the
+    // finite hold the _retryInfo peak branch hands the oracle — it must never die.
+    if (this._peakHardBarred(account, now)) return false;
+
     return true;
   }
 
@@ -1251,7 +1269,7 @@ export class AccountManager {
    *  near-reset session (whose pace stays normal) never triggers → no churn. Does
    *  NOT flip the instant a request migrates (unlike live in-flight, left to the
    *  score loop), so a healthy bound account never ping-pongs. */
-  _isBoundAccountHot(account) {
+  _isBoundAccountHot(account, now = Date.now()) {
     return this._isSessionQuotaUnavailable(account)
       || ['reserve', 'critical', 'exhausted'].includes(this._weeklyPaceState(account))
       // SESSION-window pressure counts too. _isSessionQuotaUnavailable only fires at
@@ -1263,7 +1281,11 @@ export class AccountManager {
       // there is still headroom, not at the cliff edge. _shouldRebalanceBoundSession
       // still requires a clearly-cheaper, strictly-healthier target, so a hot account
       // with no better alternative keeps its sessions — this only opens the question.
-      || this._sessionWindowUsage(account) >= this.scheduler.weeklySoftThreshold;
+      || this._sessionWindowUsage(account) >= this.scheduler.weeklySoftThreshold
+      // PEAK (2026-08-18): a provider inside its peak window is "hot" in the COST
+      // sense — staying bound burns at 2x for hours. Peak-only ⇒ inert off-peak
+      // (SC2). This only OPENS the question; the rebalance gates still decide.
+      || this._peakTier(account, now) > 0;
   }
 
   /** Fraction of the SESSION (5h) window consumed, across both quota shapes.
@@ -1320,7 +1342,7 @@ export class AccountManager {
       if (!this._isWarming(account, now)) continue;
       if (!this._matchesRequest(account, profile, requestInfo)) continue;
       // Genuinely-healthy target only (same bar as the hot-rebalance candidate scan).
-      if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model })) continue;
+      if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model, now })) continue;
       const score = this._scoreAccount(account, requestInfo, ctx);
       if (score < bestScore) {
         bestScore = score;
@@ -1330,10 +1352,10 @@ export class AccountManager {
     return best;
   }
 
-  _shouldRebalanceBoundSession(bound, profile, excludedIndexes, requestInfo, scoringCtx) {
+  _shouldRebalanceBoundSession(bound, profile, excludedIndexes, requestInfo, scoringCtx, now = Date.now()) {
     if (!this._migrationSafeForRequest(requestInfo)) return false;
     if (requestInfo.queueTicket || requestInfo.queueAdmitted) return false;
-    if (!this._isBoundAccountHot(bound)) return false;
+    if (!this._isBoundAccountHot(bound, now)) return false;
 
     const boundScore = this._scoreAccount(bound, requestInfo, scoringCtx);
     // Tier guard on the SAME axis as the trigger (pace, not raw). If the trigger is
@@ -1357,8 +1379,11 @@ export class AccountManager {
       // remove assuming the fall-through protects signed thinking — it does not.
       if (requestInfo.requiresAnthropicThinkingIntegrity === true && account.type === 'provider') continue;
       if (!this._matchesRequest(account, profile, requestInfo)) continue;
+      // PEAK (2026-08-18): never migrate ONTO a peak-suppressed account — the move
+      // would immediately be a 2x-burn destination. Peak-only ⇒ inert off-peak.
+      if (this._peakTier(account, now) > 0) continue;
       // Genuinely-healthy alternatives only (normal/soft/unknown weekly + model headroom).
-      if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model })) continue;
+      if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model, now })) continue;
       const score = this._scoreAccount(account, requestInfo, scoringCtx);
       if (score < bestScore) {
         bestScore = score;
@@ -1391,6 +1416,14 @@ export class AccountManager {
     // and preserving the last of a 5h window beats concurrency spread.
     if (this._sessionWindowUsage(bound) >= this.scheduler.weeklyReserveThreshold) return true;
 
+    // PEAK (2026-08-18) — absolute escape. The score margins below are calibrated for
+    // LOAD relief and are UNSATISFIABLE for a healthy peak account: peak tier 1/2 with
+    // weekly pace `normal` means bestTier < boundTier can never hold, so without this
+    // escape the exact sessions causing the 2x spend would never move. Flap-stable:
+    // clause (b) guarantees every candidate is non-peak, and within the window nothing
+    // pulls the session back. Peak-only ⇒ inert off-peak (SC2).
+    if (this._peakTier(bound, now) > 0) return true;
+
     // Otherwise the trigger was PACE-only on a RAW-healthy account — a fast-burner
     // that still has real absolute headroom (RAW soft but pace reserve/critical,
     // e.g. 79% used resetting in ~3.5d). Keep the conservative gate so it isn't
@@ -1402,8 +1435,7 @@ export class AccountManager {
       && bestTier < boundTier;
   }
 
-  _retryInfo(account, model = null) {
-    const now = Date.now();
+  _retryInfo(account, model = null, now = Date.now()) {
     const q = account.quota || {};
 
     // TERMINAL (non-recoverable) states FIRST — before any weekly/short-term
@@ -1435,10 +1467,54 @@ export class AccountManager {
     // account reports its REAL near-term recovery, not the distant weekly reset.
     const shortTerm = this._shortTermRetry(account, now, q);
 
+    // PEAK HARD BAR (peakCap 0.0) — barred until a KNOWN wall-clock time, so the oracle
+    // must hold FINITE. Placement is pinned: AFTER the terminal checks above, BEFORE
+    // the weekly branches. A LATE placement falls through to the terminal
+    // `{cause:'unavailable'}` return, contributes to NO recovery bucket, collapses
+    // nextRetryForRequest to Infinity, and server.js error-fasts — a session KILL at
+    // 06:00 UTC. Precedence: weekly_exhausted (below) outranks peak when the weekly
+    // reset dominates; here the max() merge with shortTerm means BOTH must clear.
+    if (this._peakHardBarred(account, now)) {
+      const { endsAt } = this._peakStateFor(account.provider, now);
+      // Only a weekly reset that is ACTUALLY BLOCKING may dominate. providerWkReset is
+      // set on every successfully-PROBED provider account — i.e. the steady state, not
+      // an exceptional one — so reading it unconditionally made a HEALTHY account at 5%
+      // weekly report a 72h "weekly_exhausted" hold instead of the real 3h peak hold.
+      // That is the multi-day-hang class this branch exists to prevent, inverted.
+      // (Caught by red-team probe 2026-08-18; the D5b control passed only because its
+      // fixture left quota={}, a state a probed account is never in.)
+      const weeklyBlocked = weeklyState === 'exhausted';
+      const weeklyReset = weeklyBlocked ? (q.providerWkReset || q.unified7dReset || 0) : 0;
+      // CAUSE follows the DOMINANT blocker, not merely the branch we are in. A
+      // peak-barred account that is ALSO weekly-exhausted clears in DAYS, not at the
+      // window end — labelling that `peak_window` would tell the user "peak ends in
+      // 3h" while the real wait is 3 days (the misleading-message class this codebase
+      // has been bitten by before). The TIME was always right via the max-merge; this
+      // makes the LABEL agree with it.
+      const retryAt = Math.max(endsAt || 0, shortTerm?.retryAt || 0, weeklyReset);
+      const weeklyDominates = weeklyReset > 0 && weeklyReset >= (endsAt || 0);
+      return {
+        cause: weeklyDominates ? 'weekly_exhausted' : 'peak_window',
+        retryAt,
+        queueable: true,
+      };
+    }
     if (weeklyState === 'exhausted') {
       // Hard block: only a weekly reset unblocks it — a sooner short-term clear
       // does not help — so key the hold on the weekly reset.
-      return { cause: 'weekly_exhausted', retryAt: q.unified7dReset || null, queueable: false };
+      //
+      // Read the PROVIDER reset too. `unified7dReset` is an Anthropic-only field;
+      // a GLM/Kimi account stores its weekly reset in `providerWkReset`
+      // (applyProviderUsage). Reading only the Anthropic field returned retryAt:null
+      // for every weekly-exhausted PROVIDER, which lands on `weeklyUnknownReset` in
+      // nextRetryForRequest → retryAfterMs: Infinity → server.js error-fasts → the
+      // live session is KILLED, despite the real reset time being known all along.
+      // Reproduced 2026-08-18 with providerWk=0.9995 + a known providerWkReset.
+      return {
+        cause: 'weekly_exhausted',
+        retryAt: q.unified7dReset || q.providerWkReset || null,
+        queueable: false,
+      };
     }
 
     if (weeklyState === 'critical') {
@@ -1556,7 +1632,9 @@ export class AccountManager {
     return null;
   }
 
-  _selectNext(requestInfo = {}, excludedIndexes = new Set()) {
+  // `now` is the injected clock for every time-varying predicate on the selection
+  // path (peak tier, sticky escape). Defaults to the real clock; tests pass it.
+  _selectNext(requestInfo = {}, excludedIndexes = new Set(), now = Date.now()) {
     // Adaptive least-loaded balancing: spread requests across every healthy
     // account immediately, and let live load, quota pressure, and recent errors
     // push traffic away from weaker accounts.
@@ -1576,7 +1654,7 @@ export class AccountManager {
       const pinned = this.accounts.find(a => a.name === requestInfo.pinnedAccountName);
       if (pinned && !excludedIndexes.has(pinned.index)
         && this._matchesRequest(pinned, profile, requestInfo)
-        && this._isAvailable(pinned, { allowWeeklyReserve: true, allowWeeklyCritical: true, model: requestInfo.model })) {
+        && this._isAvailable(pinned, { allowWeeklyReserve: true, allowWeeklyCritical: true, model: requestInfo.model, now })) {
         this.currentIndex = pinned.index;
         return pinned;
       }
@@ -1588,7 +1666,7 @@ export class AccountManager {
         { allowWeeklyReserve: true, allowWeeklyCritical: false },
         { allowWeeklyReserve: true, allowWeeklyCritical: true },
       ];
-      if (preferredPasses.some(options => this._isAvailable(preferred, { ...options, model: requestInfo.model }))) {
+      if (preferredPasses.some(options => this._isAvailable(preferred, { ...options, model: requestInfo.model, now }))) {
         this.currentIndex = preferred.index;
         return preferred;
       }
@@ -1600,7 +1678,7 @@ export class AccountManager {
     // `_isWarming`, not on a binding.
     const isStickyMode = this.scheduler.routingMode === 'sticky';
     const bound = isStickyMode
-      ? this._boundAccount(requestInfo.sessionKey, profile, excludedIndexes, requestInfo)
+      ? this._boundAccount(requestInfo.sessionKey, profile, excludedIndexes, requestInfo, now)
       : null;
     if (bound) {
       // Warmup-pull: onboard a freshly-ADDED account (added mid-session, no reload)
@@ -1617,7 +1695,7 @@ export class AccountManager {
         return warmupTarget;   // _bindSession re-homes the session on acquire
       }
       if (!this._hasHigherPriorityAvailable(bound, profile, excludedIndexes, requestInfo)
-        && !this._shouldRebalanceBoundSession(bound, profile, excludedIndexes, requestInfo, scoringCtx)) {
+        && !this._shouldRebalanceBoundSession(bound, profile, excludedIndexes, requestInfo, scoringCtx, now)) {
         return bound;
       }
     }
@@ -1648,9 +1726,9 @@ export class AccountManager {
         const account = this.accounts[idx];
         if (excludedIndexes.has(account.index)) continue;
         if (!this._matchesRequest(account, profile, requestInfo)) continue;
-        if (!this._isAvailable(account, { ...weeklyOptions, model: requestInfo.model })) continue;
+        if (!this._isAvailable(account, { ...weeklyOptions, model: requestInfo.model, now })) continue;
 
-        const priority = this._effectivePriority(account, requestInfo);
+        const priority = this._effectivePriority(account, requestInfo, now);
         const score = this._scoreAccount(account, requestInfo, scoringCtx);
         if (priority < bestPriority || (priority === bestPriority && score < bestScore)) {
           bestPriority = priority;
@@ -1702,15 +1780,15 @@ export class AccountManager {
     return null;
   }
 
-  _boundAccount(sessionKey, profile, excludedIndexes = new Set(), requestInfo = {}) {
+  _boundAccount(sessionKey, profile, excludedIndexes = new Set(), requestInfo = {}, now = Date.now()) {
     if (!sessionKey) return null;
     const binding = this._sessionBinding(sessionKey);
     if (!binding) return null;
 
-    const home = this._eligibleBoundAccount(binding.homeName, profile, excludedIndexes, { allowWeeklyReserve: true }, requestInfo);
+    const home = this._eligibleBoundAccount(binding.homeName, profile, excludedIndexes, { allowWeeklyReserve: true, now }, requestInfo);
     if (home) return home;
 
-    const current = this._eligibleBoundAccount(binding.currentName, profile, excludedIndexes, { allowWeeklyReserve: true }, requestInfo);
+    const current = this._eligibleBoundAccount(binding.currentName, profile, excludedIndexes, { allowWeeklyReserve: true, now }, requestInfo);
     if (current) return current;
 
     const homeExists = binding.homeName && this.accounts.some(a => a.name === binding.homeName);
@@ -1731,7 +1809,7 @@ export class AccountManager {
     return account;
   }
 
-  _bindSession(sessionKey, account, model = null) {
+  _bindSession(sessionKey, account, model = null, now = Date.now()) {
     const priority = this._priority(account);
     const binding = this._sessionBinding(sessionKey) || {
       homeName: account.name,
@@ -1739,7 +1817,19 @@ export class AccountManager {
       currentName: account.name,
     };
 
-    if (!binding.homeName || priority < binding.homePriority) {
+    // PEAK FAILOVER GUARD (2026-08-18): a move forced by peak suppression is a
+    // FAILOVER, not a by-choice rebalance — keep homeName so the session returns to
+    // its home once the window closes. Without this, `priority < homePriority`
+    // (oauth 0 < provider 10) permanently re-homes every sticky GLM session live at
+    // 06:00 UTC, and it never returns after 10:00 — an SC2 violation. Mirrors the
+    // CHOICE-vs-FAILOVER distinction the equal-priority branch below already encodes.
+    // Both legs need the previous home, so it is resolved once here.
+    const oldHome = binding.homeName ? this.accounts.find(a => a.name === binding.homeName) : null;
+    const oldHomeInPeak = oldHome != null && this._peakTier(oldHome, now) > 0;
+    // Lower-priority leg: only a move ONTO a non-peak account is peak-driven.
+    const peakFailover = oldHomeInPeak && this._peakTier(account, now) === 0;
+
+    if (!binding.homeName || (priority < binding.homePriority && !peakFailover)) {
       binding.homeName = account.name;
       binding.homePriority = priority;
     } else if (priority === binding.homePriority && account.name !== binding.homeName) {
@@ -1751,8 +1841,12 @@ export class AccountManager {
       // Model-aware: a move off a home that's capped for THIS model (but healthy
       // for others) is a FAILOVER, not a by-choice rebalance — keep homeName so the
       // session snaps back once the model's scoped cap resets.
-      const oldHome = this.accounts.find(a => a.name === binding.homeName);
-      if (oldHome && this._isAvailable(oldHome, { allowWeeklyReserve: true, model })) {
+      //
+      // PEAK FAILOVER GUARD (equal-priority leg): an in-peak old home reads AVAILABLE
+      // (tier 1/2 is a ranking, not an eligibility bar) — so without this check the
+      // CHOICE branch would treat a peak-driven move as by-choice and permanently
+      // re-home the session. A peak home is a FAILOVER cause: keep homeName.
+      if (oldHome && !oldHomeInPeak && this._isAvailable(oldHome, { allowWeeklyReserve: true, model })) {
         binding.homeName = account.name;
       }
     }
@@ -1855,7 +1949,17 @@ export class AccountManager {
   // Claude session load-balances across Claude+GLM+Kimi rather than using providers
   // only as last-resort. 'never'/'when-exhausted' keep the provider's own priority
   // (10/20) → fallback-only. A foreign session is provider-only regardless.
-  _effectivePriority(account, requestInfo = {}) {
+  _effectivePriority(account, requestInfo = {}, now = Date.now()) {
+    // PEAK TIER (2026-08-18): a stride added AFTER the mode layer, so a peak provider
+    // ranks strictly below every non-peak account in EVERY routing mode with no
+    // per-mode branch. Tier 0 returns base IDENTICALLY — off-peak behaviour is
+    // byte-identical to the pre-peak implementation (SC2 by construction).
+    const base = this._basePriority(account, requestInfo);
+    const tier = this._peakTier(account, now);
+    return tier === 0 ? base : base + tier * PEAK_TIER_STRIDE;
+  }
+
+  _basePriority(account, requestInfo = {}) {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     const mode = this.scheduler.routingMode;
     const incompatible = this._effectiveIncompatible(requestInfo).incompatible;
@@ -1934,9 +2038,147 @@ export class AccountManager {
     const providers = { ...(this.scheduler.providers || {}) };
     providers[providerKey] = { ...(providers[providerKey] || {}), claudeFallback: policy };
     this.scheduler.providers = providers;
+    this._peakCache = null;   // provider settings changed → peak memo is stale (MINOR 10)
     return true;
   }
 
+  /** Peak settings setter (TUI + config writes). Validates, spread-preserves sibling
+   *  keys, clears the per-minute memo. Returns false on invalid input (no change). */
+  setPeakSettingsForProvider(providerKey, { peakWindows, peakCap, peakDepreference, peakTimezone } = {}) {
+    if (!providerKey) return false;
+    const existing = this.scheduler.providers?.[providerKey] || {};
+    const next = { ...existing };
+    if (peakWindows !== undefined) {
+      if (!Array.isArray(peakWindows)) return false;
+      next.peakWindows = peakWindows;
+    }
+    if (peakCap !== undefined) {
+      const c = Number(peakCap);
+      if (!Number.isFinite(c) || c < 0 || c > 1) return false;
+      next.peakCap = c;
+    }
+    if (peakDepreference !== undefined) next.peakDepreference = Boolean(peakDepreference);
+    if (peakTimezone !== undefined) {
+      // null = follow the machine's zone. A string must be a zone Intl accepts —
+      // validate by construction so a typo is rejected here rather than silently
+      // falling back at every routing decision.
+      if (peakTimezone !== null) {
+        if (typeof peakTimezone !== 'string') return false;
+        try { new Intl.DateTimeFormat('en-US', { timeZone: peakTimezone }); } catch { return false; }
+      }
+      next.peakTimezone = peakTimezone;
+    }
+    const providers = { ...(this.scheduler.providers || {}) };
+    providers[providerKey] = next;
+    this.scheduler.providers = providers;
+    this._peakCache = null;
+    return true;
+  }
+
+  /** Machine-readable peak state for the status endpoint (SC9). Per provider:
+   *  inPeak/endsAt/cap/depreference; plus which accounts are tier-1/2/barred. */
+  peakSummary(now = Date.now()) {
+    const providers = {};
+    for (const a of this.accounts) {
+      if (a.type !== 'provider' || providers[a.provider]) continue;
+      const { inPeak, endsAt, settings } = this._peakStateFor(a.provider, now);
+      providers[a.provider] = { inPeak, endsAt, cap: settings.cap, depreference: settings.depreference };
+    }
+    return { providers };
+  }
+
+  // ── Peak-hour governance (2026-08-18) ─────────────────────────────────────────
+  // Peak is a DERIVED, STATELESS overlay: a pure function of now + config. Never
+  // persisted, never latched, never timer-driven — so sleep/wake, restart and the
+  // zero-downtime reload need no recovery code. All peak predicates route through
+  // these four helpers so the selector, the oracle and the TUI can never disagree.
+
+  /** Merged peak settings for one provider family. A malformed cap falls back to the
+   *  shipped default rather than throwing — but a malformed WINDOW yields `[]`, i.e.
+   *  never peak, so a config typo degrades to today's behaviour instead of benching an
+   *  account. Defaults resolve ONLY from scheduler.providers (seeded by the loadConfig
+   *  migration / createDefaultConfig — see peak-window.js for why they must not live
+   *  in DEFAULT_SCHEDULER). Resolved once per provider per minute via _peakStateFor. */
+  _peakSettingsFor(providerKey) {
+    const p = this.scheduler.providers?.[providerKey] || {};
+    // Accept ONLY a real number. `Number(null)`/`Number('')`/`Number(false)`/`Number([])`
+    // are all 0 — which is the HARD BAR — so a config carrying `peakCap: null` (the
+    // natural JSON spelling of "no cap", and the very convention `peakTimezone: null`
+    // uses in this same object) would silently bench every GLM account for 4h every
+    // weekday. The window path already documents "a typo degrades to today's
+    // behaviour"; the cap path must match it.
+    const cap = typeof p.peakCap === 'number' && Number.isFinite(p.peakCap) ? p.peakCap : undefined;
+    return {
+      windows: Array.isArray(p.peakWindows) ? p.peakWindows : [],
+      // null/absent ⇒ follow the MACHINE's local zone (wallClockIn's own default).
+      // A string pins an IANA zone. Both are user-settable (2026-08-18).
+      timezone: typeof p.peakTimezone === 'string' && p.peakTimezone ? p.peakTimezone : null,
+      cap: cap === undefined ? DEFAULT_PEAK_CAP : Math.max(0, Math.min(1, cap)),
+      depreference: p.peakDepreference !== false,
+    };
+  }
+
+  /** {inPeak, endsAt, settings} for a provider family, memoized per UTC MINUTE (the
+   *  evaluation is minute-stable by construction, so the memo is exact). Carrying the
+   *  resolved settings in the same entry is what lets _peakTier / _peakHardBarred /
+   *  peakSummary read them without re-resolving. Invalidated by the peak/provider
+   *  setters, which are the only things that can change settings mid-minute. */
+  _peakStateFor(providerKey, now = Date.now()) {
+    const minute = Math.floor(now / 60_000);
+    if (!this._peakCache || this._peakCache.minute !== minute) {
+      this._peakCache = { minute, byProvider: new Map() };
+    }
+    let st = this._peakCache.byProvider.get(providerKey);
+    if (!st) {
+      const settings = this._peakSettingsFor(providerKey);
+      st = { ...peakWindowState(settings.windows, now, settings.timezone), settings };
+      this._peakCache.byProvider.set(providerKey, st);
+    }
+    return st;
+  }
+
+  /** WEEKLY utilization 0..1, or null when unreadable. The cap's basis (D2): TOTAL
+   *  WEEKLY — deliberately NOT _weeklyRawState's max(providerSes, providerWk), which
+   *  conflates the 5h session window with the weekly one. null (legacy TOKENS_LIMIT
+   *  plan / weeklyAbsent) FAILS OPEN: unknown must never mean over-cap. Provider-only,
+   *  like every peak predicate — OAuth accounts have no peak concept. */
+  _peakWeeklyUtilization(account) {
+    const wk = account?.quota?.providerWk;
+    return wk != null ? clamp01(wk) : null;
+  }
+
+  /** SOFT cap: weekly utilization at/over the cap during peak ⇒ tier 2 (last-resort).
+   *  cap >= 1 is "feature off" (SC4) — the strict < 1 guard also stops cap 1.0 firing
+   *  at exactly util 1.0. cap === 0 is NOT handled here; it is the hard bar, a
+   *  different mechanism entirely (utilization-independent). */
+  _peakCapExceeded(account, settings) {
+    if (!(settings.cap > 0 && settings.cap < 1)) return false;
+    const util = this._peakWeeklyUtilization(account);
+    if (util == null) return false;          // fail open
+    return util >= settings.cap;
+  }
+
+  /** HARD bar: peakCap === 0.0 means "never use this provider during peak" (D4).
+   *  Utilization is irrelevant — zero means zero. The ONLY peak predicate that gates
+   *  ELIGIBILITY (_isAvailable); everything else is ranking. */
+  _peakHardBarred(account, now = Date.now()) {
+    if (account?.type !== 'provider') return false;
+    const { inPeak, settings } = this._peakStateFor(account.provider, now);
+    return inPeak && settings.cap === 0;
+  }
+
+  /** 0 = unaffected · 1 = peak, de-preferred · 2 = peak + over the soft cap.
+   *  OAuth accounts are 0 always (no peak concept). A provider with no window is 0
+   *  always (Kimi by default — SC5). The cap is independent of depreference: turning
+   *  depreference off must not disable the cap (both knobs exist, D7). */
+  _peakTier(account, now = Date.now()) {
+    if (account?.type !== 'provider') return 0;
+    const { inPeak, settings } = this._peakStateFor(account.provider, now);
+    if (!inPeak) return 0;
+    if (this._peakCapExceeded(account, settings)) return 2;
+    return settings.depreference ? 1 : 0;
+  }
+
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
@@ -3373,6 +3615,7 @@ export class AccountManager {
         admissionPaused: this.admissionPaused,
         safetyMaxActivePerAccount: this.scheduler.safetyMaxActivePerAccount,
         safetyMaxGlobalActive: this.scheduler.safetyMaxGlobalActive,
+        peak: this.peakSummary(),
       },
       upstreamThrottle: {
         active: this._isUpstreamThrottleBlocking(),

package/src/config.js

@@ -1,4 +1,5 @@
 import { readFile, writeFile, mkdir, rename, chmod, unlink } from 'node:fs/promises';
+import { DEFAULT_PEAK_PROVIDERS, mergePeakDefaults } from './peak-window.js';
 import { existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
@@ -117,7 +118,14 @@ export function createDefaultConfig() {
       // Left EMPTY: an unset provider inherits the policy above, so off-by-default holds
       // without shadowing it. The TUI writes an entry here only when you steer one
       // provider differently from the other.
-      providers: {},
+      // Peak-hour governance defaults (2026-08-18). Fresh installs get the block ON
+      // DISK; existing installs inherit it at load (see the migration in loadConfig).
+      // NEVER in account-manager's DEFAULT_SCHEDULER.providers: the shallow spread
+      // there wipes it for any config that already has `providers`, and a default in
+      // that object reaches every directly-constructed AccountManager in the test
+      // suite, making it time-dependent. Both proven by probe 2026-08-18.
+      providers: structuredClone(DEFAULT_PEAK_PROVIDERS),
+      peakDefaultsVersion: 1,
     },
     retry: {
       maxAttemptsPerRequest: 0,
@@ -191,6 +199,18 @@ export async function loadConfig() {
     for (const key of Object.keys(defaults)) {
       if (!(key in parsed)) parsed[key] = defaults[key];
     }
+    // ── Peak-hours migration (2026-08-18) ──
+    // The top-level backfill fills ABSENT top-level keys only, and every real config
+    // already HAS `scheduler` — the nested provider defaults never reach an existing
+    // install without this pass. Merges by key-PRESENCE (an explicit user value wins;
+    // `peakWindows: []` = never-peak and survives), gated on peakDefaultsVersion so
+    // deliberately-emptied windows are not re-seeded. CLONES — config.scheduler is
+    // reference-shared with the TUI persist path, and mutating it would write the
+    // defaults to disk on the next toggle (pre-mortem MINOR 8).
+    if (parsed.scheduler && typeof parsed.scheduler === 'object') {
+      parsed.scheduler.providers = mergePeakDefaults(parsed.scheduler.providers, parsed.scheduler.peakDefaultsVersion);
+      parsed.scheduler.peakDefaultsVersion = 1;
+    }
   }
   return parsed;
 }

package/src/peak-window.js

@@ -0,0 +1,177 @@
+/**
+ * Peak-hour window evaluation — PURE, zero imports, zero deps.
+ *
+ * z.ai charges 50% of the standard credit rate OFF-peak; peak is full rate, so peak
+ * spend costs 2x. Peak = Mon-Fri 14:00-18:00 SGT (UTC+8, no DST) = 06:00-10:00 UTC,
+ * 20h of 168h. Kimi (Moonshot) publishes no peak multiplier — it ships with NO
+ * window = never peak = unaffected.
+ *
+ * Design invariants (task-2026-08-18-maxpool-peak-hours-glm-governance):
+ *   - UTC ONLY. days use Date#getUTCDay() numbering (0=Sun .. 6=Sat). No timezone
+ *     math, no tz library — SGT has no DST so the fixed UTC window is exact year-round.
+ *   - Start INCLUSIVE, end EXCLUSIVE: m >= start && m < end.
+ *   - A day names the day the window STARTS. A wrapping window (end <= start) spans
+ *     the UTC day boundary: segment A on each listed day, segment B on the NEXT day.
+ *   - A MALFORMED window NEVER matches. The feature is on by default; a config typo
+ *     must degrade to today's behaviour (never bench GLM), never to 24/7 de-preference.
+ *   - Overlapping windows merge: endsAt is the LATEST matching end, so a hold never
+ *     wakes into a second contiguous window.
+ */
+
+export const MINUTES_PER_DAY = 1440;
+export const DEFAULT_PEAK_CAP = 0.5;
+
+/** The shipped defaults. ONE literal, imported by config.js (fresh installs get it on
+ *  disk) AND the loadConfig migration (existing installs inherit it at load). Never
+ *  DEFAULT_SCHEDULER — see the task research for the probe that proved that placement
+ *  makes the test suite time-dependent and is wiped by the shallow provider spread. */
+export const DEFAULT_PEAK_PROVIDERS = {
+  zai: {
+    // The VENDOR's window, expressed in the vendor's own zone. z.ai states
+    // Mon-Fri 14:00-18:00 SGT; pinning peakTimezone to Asia/Singapore means the
+    // window tracks what z.ai actually bills no matter where the laptop thinks it
+    // is, AND survives a DST change if the vendor ever restates it in a DST zone.
+    //
+    // USER-ADJUSTABLE (2026-08-18): both the hours and the zone are config. Set
+    // `peakTimezone` to any IANA zone, or to null to follow the MACHINE's local
+    // zone — the right choice if you'd rather reason in your own wall clock.
+    // startMin/endMin are minutes-from-midnight IN THAT ZONE.
+    peakTimezone: 'Asia/Singapore',
+    peakWindows: [{ days: [1, 2, 3, 4, 5], startMin: 14 * 60, endMin: 18 * 60 }],
+    peakCap: DEFAULT_PEAK_CAP,
+    peakDepreference: true,
+  },
+  kimi: { peakWindows: [], peakCap: DEFAULT_PEAK_CAP, peakDepreference: true },
+};
+
+/** Validate + normalize one window row. Returns {days:Set, start, end} or null.
+ *  null ⇒ this row never matches (see invariants). */
+export function normalizePeakWindow(w) {
+  if (!w || typeof w !== 'object') return null;
+  // `startMin`/`endMin` are the current names (minutes-from-midnight in the window's
+  // timezone). `startUtcMin`/`endUtcMin` are accepted as legacy aliases so a config
+  // written before the timezone knob keeps working unchanged.
+  const start = Number(w.startMin ?? w.startUtcMin);
+  const end = Number(w.endMin ?? w.endUtcMin);
+  if (!Number.isFinite(start) || !Number.isFinite(end)) return null;
+  if (start < 0 || start >= MINUTES_PER_DAY) return null;   // start is a minute-of-day
+  if (end <= 0 || end > MINUTES_PER_DAY) return null;        // end EXCLUSIVE; 1440 == midnight
+  if (end === start) return null;                            // zero-length ⇒ never
+  const days = Array.isArray(w.days)
+    ? [...new Set(w.days.map(Number).filter(n => Number.isInteger(n) && n >= 0 && n <= 6))]
+    : [];
+  if (!days.length) return null;                             // no days ⇒ never, not "every day"
+  return { days: new Set(days), start, end };
+}
+
+/** Wall-clock parts (weekday + minute-of-day) for `now` in an IANA timezone, using
+ *  Node's built-in Intl — zero dependencies, and DST-correct by construction (the
+ *  offset is resolved for THAT instant, not a fixed number).
+ *
+ *  `tz` resolution order, per the user requirement (2026-08-18):
+ *    1. an explicit IANA zone in config (`peakTimezone`) — for a laptop whose clock
+ *       is set to somewhere the user is not,
+ *    2. else the MACHINE's local zone (the default: maxpool follows the laptop),
+ *    3. else UTC.
+ *  An invalid/unknown zone falls back to the machine zone rather than throwing —
+ *  a typo must never take routing down.
+ */
+const DAY_INDEX = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
+const _dtfCache = new Map();
+
+export function wallClockIn(now, tz) {
+  const zone = tz || Intl.DateTimeFormat().resolvedOptions().timeZone || 'UTC';
+  let dtf = _dtfCache.get(zone);
+  if (!dtf) {
+    try {
+      dtf = new Intl.DateTimeFormat('en-US', {
+        timeZone: zone, hour12: false, weekday: 'short', hour: '2-digit', minute: '2-digit',
+      });
+    } catch {
+      // Unknown zone → machine local. Never throw from the routing hot path.
+      dtf = new Intl.DateTimeFormat('en-US', { hour12: false, weekday: 'short', hour: '2-digit', minute: '2-digit' });
+    }
+    _dtfCache.set(zone, dtf);
+  }
+  const parts = Object.fromEntries(dtf.formatToParts(new Date(now)).map(p => [p.type, p.value]));
+  const day = DAY_INDEX[parts.weekday] ?? 0;
+  // hour '24' appears at midnight in some locales' hour12:false output — normalize.
+  const hour = Number(parts.hour) % 24;
+  return { day, min: hour * 60 + Number(parts.minute) };
+}
+
+/** Is `now` inside any window, and when does the peak end?
+ *  @returns {{inPeak: boolean, endsAt: number|null}} endsAt is an ms epoch; null when
+ *  not in peak. Pure in `now` — the caller injects it; no ambient clock reads here. */
+export function peakWindowState(windows, now, tz = null) {
+  if (!Array.isArray(windows) || !Number.isFinite(now)) return { inPeak: false, endsAt: null };
+  // Normalize ONCE — both the match scan and the contiguity chain below read this.
+  const norm = [];
+  for (const raw of windows) {
+    const w = normalizePeakWindow(raw);
+    if (w) norm.push(w);
+  }
+  if (!norm.length) return { inPeak: false, endsAt: null };
+
+  // Window times are WALL-CLOCK in `tz` — the config's `peakTimezone` when set, else the
+  // MACHINE's own zone (2026-08-18 user requirement: follow the laptop by default, but
+  // let the user pin a zone, because a laptop clock is often set to somewhere they aren't).
+  // `endsAt` stays an absolute epoch, derived by projecting the remaining wall-clock
+  // minutes from local midnight.
+  const { day, min } = wallClockIn(now, tz);
+  const midnightUtc = now - min * 60_000 - (now % 60_000);   // local midnight as an epoch
+  const yesterday = (day + 6) % 7;
+  let endsAt = null;
+  const note = (mins) => {
+    const t = midnightUtc + mins * 60_000;
+    if (endsAt == null || t > endsAt) endsAt = t;
+  };
+
+  for (const w of norm) {
+    const wraps = w.end < w.start;
+    // Segment A — the window's own UTC day (its full length, or to midnight when wrapping).
+    if (w.days.has(day)) {
+      const segEnd = wraps ? MINUTES_PER_DAY : w.end;
+      if (min >= w.start && min < segEnd) note(segEnd);
+    }
+    // Segment B — the spill onto the NEXT UTC day, for a wrapping window only.
+    // Keyed on the START day (yesterday from now), so a Fri 22:00-02:00 window is
+    // peak early Saturday but never early Sunday.
+    if (wraps && w.days.has(yesterday) && min < w.end) note(w.end);
+  }
+  if (endsAt == null) return { inPeak: false, endsAt: null };
+  // CONTIGUITY EXTENSION: a hold that wakes exactly at endsAt must not land inside a
+  // FOLLOW-ON window. Extend endsAt across any window that starts at/before the
+  // current end on the same day (chain until no extension). Simple O(n·k); n is tiny.
+  let extended = true;
+  while (extended) {
+    extended = false;
+    for (const w of norm) {
+      if (!w.days.has(day) || w.end <= w.start) continue;   // wrapping windows never extend
+      const curMin = (endsAt - midnightUtc) / 60_000;
+      if (w.start <= curMin && w.end > curMin) {
+        const t = midnightUtc + w.end * 60_000;
+        if (t > endsAt) { endsAt = t; extended = true; }
+      }
+    }
+  }
+  return { inPeak: true, endsAt };
+}
+
+/** Merge shipped defaults into a provider's settings by key-PRESENCE (an explicit
+ *  user value always survives; only an absent key inherits). CLONES — never mutates
+ *  the input (the config object is reference-shared with the TUI persist path). */
+export function mergePeakDefaults(providers, version) {
+  if (Number(version) >= 1) return providers;   // already seeded — respect user edits
+  const out = {};
+  for (const key of Object.keys(providers || {})) out[key] = { ...(providers[key] || {}) };
+  for (const [key, seed] of Object.entries(DEFAULT_PEAK_PROVIDERS)) {
+    const existing = out[key] ||= {};
+    // Fields come from the seed itself, so a new peak setting added to
+    // DEFAULT_PEAK_PROVIDERS is migrated without editing a parallel list here.
+    for (const field of Object.keys(seed)) {
+      if (!(field in existing)) existing[field] = seed[field];
+    }
+  }
+  return out;
+}

package/src/server.js

@@ -1555,6 +1555,30 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     return `This session is too large for the GLM/Kimi fallbacks (their ~256K limit) — it needs a 1M-context Claude account, and they're all busy right now.${eta} It sends as soon as one frees; /compact shortens the session if you'd rather not wait.`;
   }
 
+  // PEAK (2026-08-18): a provider family hard-barred by peakCap:0 inside its window.
+  // Placed AFTER the incompat + large-context branches on purpose — both have strictly
+  // better explanations for THEIR requests, and this preempting them told a >256K
+  // session to raise peakCap (which cannot help it). ENABLED accounts only, and the ETA
+  // comes from the peak window end — never the caller's retryAfter, which may reflect
+  // an entirely different blocker (red-team 2026-08-18).
+  {
+    const peakBarred = [];
+    const seenPeakProviders = new Set();
+    for (const a of accountManager.accounts || []) {
+      if (a.type !== 'provider' || a.enabled === false || seenPeakProviders.has(a.provider)) continue;
+      seenPeakProviders.add(a.provider);
+      if (accountManager._peakHardBarred?.(a)) peakBarred.push(a);
+    }
+    if (peakBarred.length) {
+      const names = [...new Set(peakBarred.map(a => (a.provider === 'zai' ? 'GLM' : a.provider === 'kimi' ? 'Kimi' : a.provider)))];
+      const endsAt = Math.max(...peakBarred.map(a => accountManager._peakStateFor?.(a.provider)?.endsAt || 0));
+      const leftMs = endsAt - Date.now();
+      const eta = leftMs > 0 ? ` Peak ends in ~${formatRetryDuration(Math.round(leftMs / 1000))}.` : '';
+      return `${names.join(' and ')} ${names.length === 1 ? 'is' : 'are'} switched off during peak hours (a setting: peakCap 0), and no other account can take this request.${eta} Set scheduler.providers.<provider>.peakCap above 0 to let it cover peak hours.`;
+    }
+  }
+
+
   // ENABLED only — a disabled account is not "at its limit", it is off; counting it
   // made a 1-enabled-account pool report "all 9 accounts at their limit".
   const claudeCount = accountManager.accounts.filter(a => a.type !== 'provider' && a.enabled !== false).length;

package/src/tui.js

@@ -520,6 +520,25 @@ export class TUI {
     }
   }
 
+  /** The peak fragment for the routing header: `GLM peak · ends in 2h05m` while any
+   *  provider is inside its window, '' otherwise. Names the window end so the 4h
+   *  shape is legible; per-account detail lives in the row tags. `now` is injectable
+   *  so a test can assert the rendered string without waiting for 06:00 UTC. */
+  _peakHeaderNote(now = Date.now()) {
+    const parts = [];
+    const seen = new Set();
+    for (const a of this.am.accounts) {
+      if (a.type !== 'provider' || seen.has(a.provider)) continue;
+      seen.add(a.provider);
+      const st = this.am._peakStateFor?.(a.provider, now);
+      if (!st?.inPeak || !st.endsAt) continue;
+      const label = a.provider === 'zai' ? 'GLM' : a.provider === 'kimi' ? 'Kimi' : a.provider;
+      const mins = Math.max(0, Math.ceil((st.endsAt - now) / 60_000));
+      parts.push(`${yellow(label + ' peak')} ${dim(`ends in ${Math.floor(mins / 60)}h${String(mins % 60).padStart(2, '0')}m`)}`);
+    }
+    return parts.join('  ');
+  }
+
   _routingLine(routing, xpText) {
     return ` Routing  ${cyan(routing)}${xpText}`;
   }
@@ -1485,9 +1504,18 @@ export class TUI {
     // header read "Balance all · Cross-provider: always" which looked like two
     // conflicting settings when only the first one does anything.
     if (hasProviders) {
+      // PEAK (SC9): name an active window — the feature must be visible, not silent.
+      // Only while a provider is genuinely in-window, so an off-peak screen is
+      // byte-identical to today (render parity, TEST PLAN H1).
       // Cross-provider fragment is sticky-only — under other modes it is inert and
       // reading "always" next to "Balance all" looked like two conflicting controls.
       if (mode === 'sticky') xpText = this._crossProviderText();
+      // PEAK note is APPENDED after, never before: the sticky assignment above
+      // overwrites xpText wholesale, so prepending silently discarded the peak note
+      // in sticky — which is DEFAULT_SCHEDULER.routingMode, the TUI's own fallback,
+      // AND the legacy-policy migration target (red-team 2026-08-18).
+      const peakNote = this._peakHeaderNote();
+      if (peakNote) xpText += (xpText ? '  ' : '') + peakNote;
       // Overflow visibility: when GLM/Kimi actually served requests recently, surface the
       // volume so provider traffic isn't a mystery. This is DATA, not a control — shown
       // in every mode. Reuses the SAME 15m load window as the per-row "15m Nr" column.
@@ -1832,6 +1860,17 @@ export class TUI {
       wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset)
         : emptyBar(q.weeklyAbsent ? 'none' : '—', bw);
       note = this._probeHealthNote(a);
+      // PEAK row tag (SC9): mirrors the router's own predicates — hard-barred = off,
+      // tier 2 = over cap, tier 1 = peak (or "cap n/a" when the weekly is unreadable,
+      // so the soft cap is inert). The label can never disagree with routing because
+      // it reads the same predicates.
+      if (this.am._peakHardBarred?.(a)) note += `  ${red('peak·off')}`;
+      else {
+        const tier = this.am._peakTier?.(a) || 0;
+        const wu = this.am._peakWeeklyUtilization?.(a);
+        if (tier === 2) note += `  ${yellow(`peak·capped ${Math.round((wu ?? 0) * 100)}%`)}`;
+        else if (tier === 1) note += wu == null ? `  ${dim('peak·cap n/a')}` : `  ${yellow('peak')}`;
+      }
     } else if (q.providerQuotaSource === 'console-only') {
       sesCell = emptyBar('n/a', bw);
       wkCell = emptyBar('n/a', bw);