feat: calibrate account capacity weekly

README.md

@@ -32,7 +32,7 @@ Optional tuning:
 - The hosted entrypoint always uses `--max-submits-per-run 0` so stale deployment
   settings cannot restrict a refill cycle to five submissions.
 - `MODELHUB_AGENT_ACTIVE_TASK_CAP` default `100` per account
-- `MODELHUB_CAPACITY_PROBE_INTERVAL_CYCLES` default `3`
+- `MODELHUB_CAPACITY_PROBE_INTERVAL_CYCLES` is a legacy setting ignored by the hosted worker; it uses weekly calibration only
 - `MODELHUB_CAPACITY_STATE_PATH` default `.modelhub_state/account_capacity.json`
 - `MODELHUB_AGENT_ACTIVE_COUNTS_TTL_SECONDS` default `15`
 - `MODELHUB_AGENT_RESERVATION_TTL_SECONDS` default `120`
@@ -228,13 +228,25 @@ or 500, older models stop at positions 95, 195, or 495 respectively. Old-model
 reservations are made under the same account lock as capacity reservations, so
 concurrent submissions cannot enter the reserved suffix. Once every account's
 old-model allowance is exhausted, discovery is capped at the seven-day window.
-Unknown model timestamps are treated as old for new submissions. When capacity
-probing raises an account's known limit, its old-model boundary moves with it.
+Unknown model timestamps are treated as old for new submissions. When weekly
+calibration raises an account's known limit, its old-model boundary moves with it.
 If an account's active-count read fails, old-model admission is fail-closed for
 that account while other accounts remain eligible. Date-deferred candidates are
 recorded as `age_policy_skipped`, release their temporary claim, and do not enter
 failure statistics or permanent exclusions.
 
+Capacity calibration runs only on Monday from 10:00 to 10:59 Asia/Shanghai.
+During this window the worker targets each account in turn and temporarily
+borrows its five reserved positions, using only normally vetted candidates.
+An explicit capacity-full response ends that account's calibration; the
+measured limit and completed week are persisted in `account_capacity.json`.
+Rate limiting is not treated as proof of account capacity. If no safe candidates
+are found, calibration waits ten minutes before retrying within the same window.
+If the window ends or the service was offline throughout it, it does not
+continue or catch up outside the window. Normal capacity-minus-five
+admission resumes without cancelling already accepted tasks; reserved positions
+reappear as tasks finish.
+
 Model age is admission-only. Startup and scheduled queue cleanup never cancel a
 task because it is older than seven days, beyond a capacity-minus-five boundary,
 or above a temporarily reduced platform limit. Existing waiting and running
@@ -464,11 +476,16 @@ Architecture history backfill now
 sends the date format accepted by ModelHub. The full-repository-size OOM rule is
 unchanged because ModelHub's own preflight uses that size.
 
+Version `2026.09.20.2` replaces routine capacity probes with per-account
+calibration each Monday 10:00-10:59 Asia/Shanghai. During that window only,
+the worker may borrow the five recent-model positions to measure a new limit;
+ordinary capacity-minus-five admission resumes afterward.
+
 ## Deploy
 
 Create a tag and submit the repository URL plus tag in "我的适配智能体".
 
 ```bash
-git tag -a agent-v35 -m "ModelHub agent 2026.09.20.1"
-git push origin main agent-v35
+git tag -a agent-v36 -m "ModelHub agent 2026.09.20.2"
+git push origin main agent-v36
 ```