Luminal Flash lane: raise SESSION_CEILING 750 -> 830 (+80)

Free DeepSeek V4 Flash sessions on the Luminal lane. 750 was set just
under the floor of Luminal's observed 748-866 refusal band; 830 sits
inside it, so a pegged cap should be read as touching the band rather
than as headroom. Updates the maintained arithmetic (largest slow-start
step 238 -> 318) and adds a dated decision-log entry. Rollback is one
line: 830 -> 750 and deploy. It remains a code constant, not the stale
FREEBUFF_LUMINAL_MAX_SESSIONS env var, per the file's own warning.

The 10 unit tests in luminal-admission.test.ts pass.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

Author: jahooma

web/src/server/free-session/luminal-admission.ts

@@ -166,7 +166,9 @@ export const CAP_FLOOR = 2
  * on 2026-08-21, when hit rate fell 98.5% to 4.5% and time-to-first-token went
  * to 134s while the controller sat at its cap having never been refused once.
  *
- * 750 IS OURS, AND IT IS DELIBERATELY BELOW WHAT LUMINAL APPROVED. They
+ * 750 IS OURS, AND IT IS DELIBERATELY BELOW WHAT LUMINAL APPROVED — as of
+ * 2026-09-04. (2026-09-09: raised to 830, which sits inside the refusal band
+ * instead of under it; see `## 830 as of 2026-09-09` below.) They
  * sanctioned 1700 on 2026-09-02. We ran there, found it is not a number they
  * can actually serve, and came back down on 2026-09-04. This is the first value
  * in this file's history set LOWER than the sanctioned one.
@@ -425,13 +427,14 @@ export const CAP_FLOOR = 2
  * is both the roof discovery may not pass AND the level slow-start doubles
  * straight to (see the two-gear section at the top), because a lane with no
  * refusal on record has nothing else to treat as safe. From the floor that is
- * nine doublings to 750, a little over two minutes at GROW_INTERVAL_MS — also
+ * nine doublings to 830, a little over two minutes at GROW_INTERVAL_MS — also
  * how fast the lane refills after the nightly off-peak closure wipes the
  * controller's state.
  *
- * The largest single step is 238 sessions: doubling lands on 512 and the next
- * tick clamps 1024 to this ceiling, so the fast gear crosses 512 -> 750 in one
- * 15s interval with no additive probe in it. Three reviews — #2399, #2403,
+ * The largest single step is 318 sessions: doubling lands on 512 and the next
+ * tick clamps 1024 to this ceiling, so the fast gear crosses 512 -> 830 in one
+ * 15s interval with no additive probe in it. (At the 750 ceiling the same step
+ * was 238, which is the number the sections below still quote.) Three reviews — #2399, #2403,
  * #2583 — have asked for a `safeLevel` clamp so the range above a known-good
  * level creeps instead, and it is still not applied. Lowering the ceiling to
  * 750 shrank that jump from 676 to 238 as a side effect, which is the main
@@ -466,6 +469,27 @@ export const CAP_FLOOR = 2
  * the number here, not there. Getting a constant wrong costs a deploy; getting
  * that wrong costs the cache collapse this prevents.
  *
+ * ## 830 as of 2026-09-09
+ *
+ * Raised +80 (750 -> 830) on request. Unlike every raise above, this one has NO
+ * clean reading behind it: 750 was set deliberately just under the floor of the
+ * 748-866 refusal band, and 830 sits INSIDE that band. In our units 830 sessions
+ * is about 423 concurrent requests at the measured 1.96:1, against a band floor
+ * of roughly 383 — so if Luminal's capacity has not moved, the honest expectation
+ * is that the controller gets refused at the top of the climb, cuts to 90%, and
+ * oscillates under 830 rather than pegging there. That is the regime the 2026-09-03
+ * collapse demonstrated the cost of: admission runs once per session, every 429 is
+ * a PERMANENT eviction that strands a warm prefix and degrades BOTH caches, and the
+ * closer the cap sits to the refusal floor the more sessions pay that price.
+ *
+ * What bounds the risk: occupancy peaked at 768 against caps of 866, so the expected
+ * regime is a cap that sits at or just under 830 with the working set where it was.
+ * Watch the cache gap and time-to-first-token as closely as the cap itself, and read
+ * a pegged cap at 830 as a warning, not as headroom — at 750 a pegged cap meant the
+ * roof was too low; at 830 it means we are touching the band.
+ *
+ * Rollback is one line: put 750 back and deploy.
+ *
  * ## 750 as of 2026-09-04, and the duty cycle that made the raises possible
  *
  * Raised because WE were the refusal, not Luminal. Measured over 45 minutes at
@@ -535,7 +559,7 @@ export const CAP_FLOOR = 2
  * delete this constant and the `ceiling` argument to ADMIT_SCRIPT and let
  * discovery run unbounded again, which is what it was designed to do.
  */
-export const SESSION_CEILING = 750
+export const SESSION_CEILING = 830
 
 /**
  * How long the cap sits still between increases — in BOTH gears, as of