maxpool 1.8.0 → 1.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,5 +1,9 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
 import { CapacityLedger } from './capacity-ledger.js';
+
+// A capacity window boundary must move by at least this much to count as a real
+// window ADVANCE rather than reset-stamp jitter (see noteCapacityWindowAdvance).
+const WINDOW_ADVANCE_EPSILON_MS = 60_000;
 import { peakWindowState, DEFAULT_PEAK_CAP } from './peak-window.js';
 
 // Bounded re-poll hold for an account blocked ONLY by a transient, self-clearing
@@ -3050,7 +3054,19 @@ export class AccountManager {
   /** Close a cycle because a probe observed the window ADVANCE (a new reset stamp) —
    *  covers the case where the old stamp was never learned. */
   noteCapacityWindowAdvance(accountName, window, prevResetAt, nextResetAt) {
-    if (!prevResetAt || !nextResetAt || nextResetAt <= prevResetAt) return;
+    if (!prevResetAt || !nextResetAt) return;
+    // EPSILON, not `>`. An OAuth reset stamp is derived per-response as
+    // `Date.now() + delay_seconds * 1000` (parseResetHeader), so the SAME window
+    // boundary reads a little later on every response — sub-second to ~2s of jitter.
+    // A bare `nextResetAt > prevResetAt` fired the advance-close on each of those,
+    // shredding one real 5h window into 9-10 fake cycles and closing a "weekly"
+    // cycle whose endedAt was a week in the FUTURE. Measured on live state.json
+    // 2026-08-23, 12h after v1.8.0 shipped: mk@dubner.io had 9 ses cycles between
+    // 01:00 and 06:00, the shortest 0.2 minutes. A REAL advance is a whole window
+    // (>=5h); 60s separates the two by three orders of magnitude.
+    // Provider stamps (z.ai/Kimi probe) are absolute and did NOT jitter — which is
+    // how the defect localized to the OAuth path.
+    if (nextResetAt - prevResetAt < WINDOW_ADVANCE_EPSILON_MS) return;
     this.capacity.closeCycle(accountName, window, prevResetAt, { resetAt: prevResetAt });
   }
 

package/src/capacity-ledger.js

@@ -15,7 +15,15 @@
  * Pre-mortem (2026-08-22) blockers B1/B2 + majors M3-M7 are the load-bearing comments.
  */
 
-const SCHEMA_VERSION = 1;
+// v2 (2026-08-23): v1 histories are POISONED and are deliberately dropped on load.
+// The OAuth reset-stamp jitter (see AccountManager.noteCapacityWindowAdvance) shredded
+// real windows into slivers and recorded future-dated weekly cycles, so a v1 payload's
+// averages are wrong for weeks. Starting empty costs one window; keeping it costs trust.
+const SCHEMA_VERSION = 2;
+
+// Two closes this far apart are the SAME boundary observed twice (a clock-close and a
+// stamp-advance racing across the boundary second), not two windows.
+const SAME_BOUNDARY_MS = 5_000;
 const MAX_CYCLES_PER_WINDOW = 50;
 const MAX_DAY_BUCKETS = 10;
 
@@ -134,8 +142,13 @@ export class CapacityLedger {
     // one that drags every average down. A LATER window reporting the same numeric stamp
     // value (clock coincidence) is distinguished by endedAt. Pinned by I3.
     const prev = rec[window].closed[rec[window].closed.length - 1];
-    if (resetAt != null && prev && prev.resetAt === resetAt && prev.endedAt === endedAt
-        && open.complete && !open.disabledDuring) {
+    // Same boundary within a few seconds, not just byte-identical stamps: the two
+    // closers can observe one rollover through slightly different stamps (jitter), and
+    // an exact-match-only fold then admitted a 0.2-minute sliver as its own cycle.
+    const sameBoundary = resetAt != null && prev
+      && Math.abs((prev.resetAt ?? prev.endedAt) - resetAt) <= SAME_BOUNDARY_MS
+      && Math.abs(prev.endedAt - endedAt) <= SAME_BOUNDARY_MS;
+    if (sameBoundary && open.complete && !open.disabledDuring) {
       // Fold ONLY a complete tail: folding a partial/disabled tail would flip the
       // flags on the prior legitimate observation and ERASE it from the averages
       // (round 3, RT3-2) — strictly worse than leaving a tiny excluded cycle.