QA: Fix L1 cache regression & perform lifecycle maintenance

- fixed `heavyComputation` returning false cache hits when called with `undefined`
- bumped version to 1.1.26
- updated CHANGELOG.md and .jules/warden.md

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: shenald-dev <245350826+shenald-dev@users.noreply.github.com>

Author: shenald-dev

.jules/warden.md

@@ -138,3 +138,9 @@ Observation / Pruned:
 Assessed BOLT's optimization moving the `/health` endpoint above `helmet()` and `cors()` middlewares, while manually setting `Content-Type`. This effectively prevents parsing and middleware overhead for frequent health check pings without compromising the expected response headers. Also bumped minor/patch versions via `npm update`. No dead code or unused files found, as previous optimizations have pruned effectively.
 Alignment / Deferred:
 Appended release notes for performance patch. Version bumped to 1.1.25.
+
+2026-04-28 — Assessment & Lifecycle
+Observation / Pruned:
+Assessed JULES/BOLT's optimization adding an L1 cache to `heavyComputation`. Discovered a silent regression where initializing the cache variables with `undefined` caused false cache hits when the function was legitimately called with `undefined`. Fixed the regression by initializing the cache with a unique `Symbol('UNINITIALIZED')`. Ran tests to ensure no further issues. Checked for dead code and found none.
+Alignment / Deferred:
+Updated `CHANGELOG.md` with the fix details. Version bumped to 1.1.26.

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [1.1.26] - 2026-04-28
+### Changed
+* **[Reliability]:** Fixed an issue in `heavyComputation` where the L1 cache was incorrectly returning false cache hits when `undefined` was passed as a parameter. The cache is now properly initialized with a unique `Symbol`. Zero dead code pruned.
+
 ## v1.1.25 - 2026-04-27
 ### Changed
 - **Performance:** Moved the `/health` endpoint above `helmet()` and `cors()` middlewares, saving significant CPU cycle overhead on load balancer pings by skipping unnecessary security header injections and CORS processing for this specific endpoint. No dead code pruned.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "one-api",
-  "version": "1.1.25",
+  "version": "1.1.26",
   "description": "One API to rule them all. Unified gateway for 20+ LLM providers. OpenAI-compatible, single binary, zero config.",
   "main": "src/index.js",
   "scripts": {

package.json

@@ -154,7 +154,7 @@ app.use((err, req, res, next) => {
 });
 
 const computationCache = new Map();
-let lastIterations = undefined;
+let lastIterations = Symbol('UNINITIALIZED');
 let lastResult = undefined;
 
 /**