maxpool 1.8.0 → 1.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,5 +1,9 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
 import { CapacityLedger } from './capacity-ledger.js';
+
+// A capacity window boundary must move by at least this much to count as a real
+// window ADVANCE rather than reset-stamp jitter (see noteCapacityWindowAdvance).
+const WINDOW_ADVANCE_EPSILON_MS = 60_000;
 import { peakWindowState, DEFAULT_PEAK_CAP } from './peak-window.js';
 
 // Bounded re-poll hold for an account blocked ONLY by a transient, self-clearing
@@ -3050,8 +3054,21 @@ export class AccountManager {
   /** Close a cycle because a probe observed the window ADVANCE (a new reset stamp) —
    *  covers the case where the old stamp was never learned. */
   noteCapacityWindowAdvance(accountName, window, prevResetAt, nextResetAt) {
-    if (!prevResetAt || !nextResetAt || nextResetAt <= prevResetAt) return;
-    this.capacity.closeCycle(accountName, window, prevResetAt, { resetAt: prevResetAt });
+    if (!prevResetAt || !nextResetAt) return;
+    // TWO guards, both learned from live data (2026-08-23):
+    // 1. PAST stamp = a probe that answered late (its window rolled mid-request) or
+    //    vendor clock skew — honoring it closed a minutes-long "cycle" sliver. Close
+    //    at NOW instead: the window genuinely rolled, just later than the stale stamp.
+    // 2. JITTER: OAuth stamps derive per-response as Date.now()+delay*1000
+    //    (parseResetHeader), so one boundary reads ~2s later on every response; a
+    //    bare `>` comparison shredded one real 5h window into 9-10 fake cycles and
+    //    dated a "weekly" cycle a week into the future. A real advance moves a whole
+    //    window (>=5h) — the 60s epsilon separates it by three orders of magnitude.
+    //    Provider stamps (z.ai/Kimi probe) are absolute and never jitter.
+    const nowMs = Date.now();
+    const boundary = nextResetAt <= nowMs ? nowMs : nextResetAt;
+    if (boundary - prevResetAt < WINDOW_ADVANCE_EPSILON_MS) return;
+    this.capacity.closeCycle(accountName, window, boundary, { resetAt: prevResetAt });
   }
 
   /**

package/src/capacity-ledger.js

@@ -15,7 +15,15 @@
  * Pre-mortem (2026-08-22) blockers B1/B2 + majors M3-M7 are the load-bearing comments.
  */
 
-const SCHEMA_VERSION = 1;
+// v2 (2026-08-23): v1 histories are POISONED and are deliberately dropped on load.
+// The OAuth reset-stamp jitter (see AccountManager.noteCapacityWindowAdvance) shredded
+// real windows into slivers and recorded future-dated weekly cycles, so a v1 payload's
+// averages are wrong for weeks. Starting empty costs one window; keeping it costs trust.
+const SCHEMA_VERSION = 2;
+
+// Two closes this far apart are the SAME boundary observed twice (a clock-close and a
+// stamp-advance racing across the boundary second), not two windows.
+const SAME_BOUNDARY_MS = 5_000;
 const MAX_CYCLES_PER_WINDOW = 50;
 const MAX_DAY_BUCKETS = 10;
 
@@ -134,8 +142,13 @@ export class CapacityLedger {
     // one that drags every average down. A LATER window reporting the same numeric stamp
     // value (clock coincidence) is distinguished by endedAt. Pinned by I3.
     const prev = rec[window].closed[rec[window].closed.length - 1];
-    if (resetAt != null && prev && prev.resetAt === resetAt && prev.endedAt === endedAt
-        && open.complete && !open.disabledDuring) {
+    // Same boundary within a few seconds, not just byte-identical stamps: the two
+    // closers can observe one rollover through slightly different stamps (jitter), and
+    // an exact-match-only fold then admitted a 0.2-minute sliver as its own cycle.
+    const sameBoundary = resetAt != null && prev
+      && Math.abs((prev.resetAt ?? prev.endedAt) - resetAt) <= SAME_BOUNDARY_MS
+      && Math.abs(prev.endedAt - endedAt) <= SAME_BOUNDARY_MS;
+    if (sameBoundary && open.complete && !open.disabledDuring) {
       // Fold ONLY a complete tail: folding a partial/disabled tail would flip the
       // flags on the prior legitimate observation and ERASE it from the averages
       // (round 3, RT3-2) — strictly worse than leaving a tiny excluded cycle.