@bitkyc08/opencodex 2.41.0 → 2.43.0-preview.20260906

package/src/lib/redact.ts

@@ -1,3 +1,5 @@
+import { foldForMatching } from "./redact-folding";
+
 export const REDACTED_SECRET = "[REDACTED]";
 
 /**
@@ -43,76 +45,6 @@ const CREDENTIAL_HEADER_LABEL_RAW = "x-api-key|x-goog-api-key|x-amz-security-tok
 const CREDENTIAL_HEADER_LABEL = CREDENTIAL_HEADER_LABEL_RAW
   .replace(/(?<![\[\\])([A-Za-z])(?![\]\-])/g, "[$1\u0001]");
 
-/**
- * Characters that render as a colon separator. Folded to `:` in the matching
- * view so a look-alike cannot hide a header from the label pattern.
- */
-const COLON_CONFUSABLES = new Set([
-  "\uFF1A", "\uFE55", "\uFE13", "\uA789", "\u02D0", "\u2236",
-  "\u205A", "\u0589", "\u1361", "\u16EC", "\u1803", "\u2982", "\u2AF6", "\uFE30",
-]);
-
-/**
- * Characters dropped from the matching view: anything with no visible width
- * that could split a label into pieces the pattern no longer recognizes.
- * `\p{Default_Ignorable_Code_Point}` is the systematic answer — it covers the
- * zero-width set, the bidi isolates and marks, the Mongolian vowel separator,
- * and the variation selectors in one property instead of a list that review
- * keeps finding another member of. `\p{Cf}` and combining marks are folded too.
- */
-const INVISIBLE_FORMAT = /[\p{Default_Ignorable_Code_Point}\p{Cf}\p{Mn}\p{Me}]/u;
-
-/**
- * HTML named character references.
- *
- * A hand-picked list is a coverage promise nobody can keep — review found
- * `&ii;`, `&ee;`, and `&DifferentialD;` decoding to compatibility letters that
- * NFKD already maps onto `i`, `e`, and `d`, and the WHATWG table holds roughly
- * 2200 entries. Neither Bun nor Node exposes that table, and pulling in a
- * dependency to spell a header name is the wrong trade for this path.
- *
- * So names are not resolved at all. A named reference sitting inside a
- * credential label is folded to a single placeholder character of unknown
- * identity, and the label alternation accepts that placeholder wherever a
- * letter may appear. Every named entity is covered, present and future,
- * without claiming to know what any of them mean.
- */
-const NAMED_ENTITY_PLACEHOLDER = "\u0001";
-
-/**
- * The handful of named references that spell a SEPARATOR rather than a letter.
- * These have to resolve exactly, because the placeholder stands in for a letter
- * position and a separator is structure, not a character of the name.
- */
-const SEPARATOR_ENTITIES = new Map<string, string>([
-  ["colon", ":"], ["semi", ";"], ["equals", "="], ["quot", '"'], ["apos", "'"],
-  ["lt", "<"], ["gt", ">"], ["amp", "&"], ["sol", "/"], ["lowbar", "_"],
-  ["hyphen", "-"], ["dash", "-"], ["ndash", "-"], ["mdash", "-"], ["minus", "-"],
-  ["period", "."], ["comma", ","], ["num", "#"], ["nbsp", " "],
-]);
-
-/**
- * Latin look-alikes for the ASCII letters that appear in credential labels.
- * Cyrillic `а`/`е`, Greek `ο`, fullwidth forms and the mathematical alphabets
- * all render as the label to a human, so the matching view folds them back.
- * NFKD handles the width/font variants; this table covers the cross-script
- * homoglyphs NFKD deliberately leaves alone.
- */
-const LETTER_CONFUSABLES = new Map<string, string>([
-  // Cyrillic
-  ["\u0430", "a"], ["\u0435", "e"], ["\u043E", "o"], ["\u0440", "p"], ["\u0441", "c"],
-  ["\u0445", "x"], ["\u0443", "y"], ["\u04BB", "h"], ["\u0455", "s"], ["\u0456", "i"],
-  ["\u0458", "j"], ["\u043A", "k"], ["\u0442", "t"], ["\u0432", "b"], ["\u043C", "m"],
-  ["\u043D", "h"], ["\u0501", "d"], ["\u0503", "g"], ["\u051B", "q"], ["\u051D", "w"],
-  ["\u04CF", "l"], ["\u0261", "g"], ["\u04AB", "c"], ["\u04BD", "e"], ["\u0459", "k"],
-  // Greek
-  ["\u03B1", "a"], ["\u03BF", "o"], ["\u03C1", "p"], ["\u03BD", "v"], ["\u03BA", "k"],
-  ["\u03B5", "e"], ["\u03C4", "t"], ["\u03B9", "i"], ["\u03C5", "u"], ["\u03C7", "x"],
-  ["\u03B7", "n"], ["\u03BC", "u"], ["\u03C3", "o"], ["\u03B2", "b"], ["\u03B3", "y"],
-  // Latin extended / other
-  ["\u0131", "i"], ["\u0269", "i"], ["\u1D0F", "o"], ["\u0280", "r"], ["\u01BF", "p"],
-  ["\u0578", "n"], ["\u057D", "u"], ["\u0585", "o"], ["\u0581", "g"], ["\u2044", "/"],
-]);
 
 // `\b` is the wrong left boundary for a header name: it matches after a `-` or
 // `_`, so `not-authorization:` and `internal_token:` were treated as the
@@ -240,111 +172,6 @@ function maskOtherFramingsOnce(value: string, decodeEscapes: boolean): string {
   return current;
 }
 
-/**
- * Build a folded copy plus an index map back to the original string, so the
- * match runs on normalized text while the output keeps every byte the match did
- * not cover.
- */
-function foldForMatching(value: string, decodeEscapes = true): { folded: string; map: number[] } {
-  let folded = "";
-  const map: number[] = [];
-  // Serialization escapes are ALIASES for the label, not decoration: a JSON
-  // `\u0069`, a percent-encoded `%69`, and an XML `&#105;` all spell the same
-  // field name to whatever parses the body, while spelling something else to a
-  // literal matcher. Decode them into the matching view (one folded character
-  // per escape, with the whole escape mapped back to its start) so
-  // `author\u0069zation`, `author%69zation`, and `author&#105;zation` are the
-  // label they claim to be.
-  const decodeEscape = (at: number): { ch: string; width: number } | null => {
-    // JSON `\uXXXX`, INCLUDING a surrogate pair. Decoding the halves
-    // independently left `\uD835\uDD69` as two lone surrogates, so the
-    // mathematical letter they spell was never normalized as one code point.
-    const json = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at, at + 6));
-    if (json) {
-      const high = parseInt(json[1]!, 16);
-      if (high >= 0xd800 && high <= 0xdbff) {
-        const low = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at + 6, at + 12));
-        const lowCode = low ? parseInt(low[1]!, 16) : NaN;
-        if (lowCode >= 0xdc00 && lowCode <= 0xdfff) {
-          return { ch: String.fromCharCode(high, lowCode), width: 12 };
-        }
-      }
-      return { ch: String.fromCharCode(high), width: 6 };
-    }
-    // Percent encoding is UTF-8: consecutive `%XX` bytes form ONE character.
-    // Decoding each byte on its own turned `%D0%B5` into two unrelated
-    // Latin-1 characters instead of the Cyrillic `е` the fold would have
-    // recognized.
-    const pct = /^(?:%[0-9a-fA-F]{2})+/.exec(value.slice(at, at + 24));
-    if (pct) {
-      try {
-        const decoded = decodeURIComponent(pct[0]);
-        if (decoded.length >= 1) {
-          // Consume only the bytes that produced the FIRST character, so the
-          // rest of the sequence is decoded on the next iteration.
-          const first = String.fromCodePoint(decoded.codePointAt(0)!);
-          const bytes = new TextEncoder().encode(first).length;
-          return { ch: first, width: bytes * 3 };
-        }
-      } catch {
-        const single = parseInt(pct[0].slice(1, 3), 16);
-        return { ch: String.fromCharCode(single), width: 3 };
-      }
-    }
-    const xml = /^&#(x[0-9a-fA-F]{1,6}|[0-9]{1,7});/.exec(value.slice(at, at + 11));
-    if (xml) {
-      const raw = xml[1]!;
-      const code = raw[0] === "x" || raw[0] === "X"
-        ? parseInt(raw.slice(1), 16)
-        : parseInt(raw, 10);
-      if (Number.isFinite(code) && code > 0 && code <= 0x10ffff) {
-        return { ch: String.fromCodePoint(code), width: xml[0].length };
-      }
-    }
-    // HTML named references. `&colon;` and the other separator names are
-    // resolved exactly; anything else folds to the opaque placeholder so the
-    // label still matches without pretending to know the character.
-    const named = /^&([A-Za-z][A-Za-z0-9]{1,31});/.exec(value.slice(at, at + 34));
-    if (named) {
-      const separator = SEPARATOR_ENTITIES.get(named[1]!.toLowerCase());
-      return { ch: separator ?? NAMED_ENTITY_PLACEHOLDER, width: named[0].length };
-    }
-    return null;
-  };
-  // Iterate by CODE POINT, not UTF-16 code unit: a supplementary character
-  // (mathematical letters, variation selectors above the BMP) is two units, so
-  // a per-unit loop hands each half to the property tests separately and
-  // neither half matches anything. `𝕩-api-key` and a U+E0100 inside a label
-  // both walked straight past the fold that way.
-  let i = 0;
-  while (i < value.length) {
-    const escaped = decodeEscapes ? decodeEscape(i) : null;
-    const ch = escaped ? escaped.ch : String.fromCodePoint(value.codePointAt(i)!);
-    const width = escaped ? escaped.width : ch.length;
-    if (INVISIBLE_FORMAT.test(ch)) {
-      i += width;
-      continue;
-    }
-    const mapped = COLON_CONFUSABLES.has(ch)
-      ? ":"
-      : LETTER_CONFUSABLES.get(ch.toLowerCase())
-        // NFKD collapses fullwidth, circled, and mathematical letter variants
-        // onto their ASCII base.
-        ?? (ch.normalize("NFKD").length === 1 ? ch.normalize("NFKD") : ch);
-    // One folded unit per source code point keeps the offset map aligned; a
-    // multi-unit fold would desynchronize it, so those keep the original.
-    folded += mapped.length === 1 ? mapped : ch;
-    // One map entry per EMITTED UTF-16 unit. An escaped supplementary
-    // character emits two units, and giving it one entry desynchronized every
-    // later offset — the mask then landed mid-token and left part of the
-    // credential behind.
-    const emittedText = mapped.length === 1 ? mapped : ch;
-    for (let k = 0; k < emittedText.length; k += 1) map.push(i);
-    i += width;
-  }
-  map.push(value.length);
-  return { folded, map };
-}
 
 /**
  * Run the header rule over BOTH matching views and take the union.

package/src/lib/state-store-sweeper.ts

@@ -35,7 +35,13 @@ export interface StateStoreSweeperOptions {
 }
 
 const registrations = new Map<string, StateStoreRegistration>();
-const afterTickRegistrations = new Map<string, StateSweepAfterTickRegistration>();
+interface AfterTickRegistrationNode {
+  registration: StateSweepAfterTickRegistration;
+  previous: AfterTickRegistrationNode | null;
+  active: boolean;
+}
+
+const afterTickRegistrations = new Map<string, AfterTickRegistrationNode>();
 let configGeneration = 0;
 let attemptSequence = 0;
 let generationContextBuilder: (() => GenerationContext) | null = null;
@@ -56,11 +62,19 @@ export function registerStateStore(registration: StateStoreRegistration): () =>
 }
 
 export function registerStateSweepAfterTick(registration: StateSweepAfterTickRegistration): () => void {
-  afterTickRegistrations.set(registration.name, registration);
+  const node: AfterTickRegistrationNode = {
+    registration,
+    previous: afterTickRegistrations.get(registration.name) ?? null,
+    active: true,
+  };
+  afterTickRegistrations.set(registration.name, node);
   return () => {
-    if (afterTickRegistrations.get(registration.name) === registration) {
-      afterTickRegistrations.delete(registration.name);
-    }
+    node.active = false;
+    if (afterTickRegistrations.get(registration.name) !== node) return;
+    let previous = node.previous;
+    while (previous && !previous.active) previous = previous.previous;
+    if (previous) afterTickRegistrations.set(registration.name, previous);
+    else afterTickRegistrations.delete(registration.name);
   };
 }
 
@@ -106,7 +120,7 @@ export function sweepLiveness(): StateSweepResult {
 }
 
 function runAfterTickCallbacks(): void {
-  for (const registration of afterTickRegistrations.values()) {
+  for (const { registration } of afterTickRegistrations.values()) {
     try {
       registration.afterTick();
     } catch {

package/src/lib/token-estimate.ts

@@ -9,50 +9,112 @@
  * ~GPT 3.6, ~Gemini 3.8 chars/token (within ~10%). Code / JSON / tool-args (the dominant Codex
  * traffic) pack MORE tokens per char, so a lower chars-per-token ratio is used for those models.
  * Over-counting fails safe (auto-compact fires earlier); under-counting risks context overflow.
+ *
+ * ## Why the estimate is segmented by script rather than a single divisor
+ *
+ * A single chars-per-token divisor cannot describe mixed text. Latin prose and code run near
+ * 3.2 chars/token; Hangul and Han run near 1.2-1.5, because a Latin-trained BPE spends a token
+ * on roughly every CJK character. That is a ~2.5x spread inside one blob, and essentially all
+ * real agent traffic is mixed: English code and JSON framing with Korean prose threaded through
+ * it.
+ *
+ * The earlier model divided the whole blob by one ratio and then clamped to a denser ratio only
+ * when a SAMPLED CJK share crossed 30%. Two failures followed from that shape. The clamp was a
+ * cliff: 29% CJK counted at the sparse ratio, 31% at the dense one, and the band where real
+ * traffic actually sits (roughly 1-30% CJK) never triggered it at all. And the sampler read
+ * every stride-th character on long blobs, so the share it measured was noisy — a payload of
+ * fixed-width records could sample as 100% CJK while being 1.6% CJK, a case still documented in
+ * `server/responses/input-admission.ts`.
+ *
+ * Counting the two scripts separately and adding them removes both problems at once. There is no
+ * threshold to sit beside, no sampling error, and the result is continuous in the CJK share, so a
+ * blob that gains one Korean character gains a fraction of a token instead of jumping a ratio.
  */
 
 /** Generic English-prose fallback ratio (chars per token). */
 const DEFAULT_CHARS_PER_TOKEN = 4;
 
 /**
- * Kiro routes code/JSON-heavy agent traffic whose true ratio is ~3.0-3.3 chars/token. 3.5 keeps a
- * small safety margin (slight over-count) without wildly inflating; tune toward 3.3 if overflow is
- * ever observed. All kiro models are text LLMs, so a single ratio applies to the whole family.
+ * Kiro routes code/JSON-heavy agent traffic: diffs, file paths, tool arguments, identifiers.
+ * That material tokenizes markedly denser than the "4 chars per token" English-prose rule.
+ *
+ * Measured two independent ways, which agree. Recorded conversations pair exact text with the
+ * provider's authoritative input-token count; over 5,799 pure-Latin samples that aggregates to
+ * 2.80 chars/token. Separately, recorded Kiro request bodies charge ~2.43 bytes per token, and
+ * those bodies run ~1.12 bytes per counted character of JSON escaping and framing, which implies
+ * ~2.17 chars/token at the wire.
+ *
+ * 2.8 takes the conservative end of that pair. All kiro models are text LLMs, so one Latin ratio
+ * applies to the whole family.
+ *
+ * Applied ONLY to `kiro/`-prefixed ids. The measurement is Kiro's charge for Kiro's payload
+ * shape, and the id families below (`claude`, `deepseek`, `qwen`, ...) are also routed by
+ * Cursor, Anthropic direct and Antigravity, whose consumers read this same helper to size
+ * admission ceilings, `count_tokens` answers, and overflow-vs-429 classification. Widening a
+ * Kiro-derived constant to those callers would retune three unrelated subsystems from evidence
+ * that says nothing about them.
+ */
+const KIRO_CHARS_PER_TOKEN = 2.8;
+
+/**
+ * Ratio for the model families Kiro shares with other providers, when NOT routed through Kiro.
+ *
+ * These are code-heavy agent models, so 3.5 remains right for them; it is the value every
+ * non-Kiro consumer of this helper was calibrated against.
  */
-const KIRO_CHARS_PER_TOKEN = 3.5;
+const AGENT_MODEL_CHARS_PER_TOKEN = 3.5;
 
-const KIRO_MODEL_PREFIXES = ["kiro", "claude", "deepseek", "minimax", "glm", "qwen"];
+const AGENT_MODEL_PREFIXES = ["kiro", "claude", "deepseek", "minimax", "glm", "qwen"];
 
-/** Model-aware chars-per-token ratio. Unknown models fall back to the generic English ratio. */
+/**
+ * Model-aware chars-per-token ratio for LATIN text. Unknown models fall back to the generic
+ * English ratio.
+ *
+ * This is the sparse-script ratio only. It stays exported, and keeps returning a single number,
+ * because callers and tests use it to compare model families; the CJK component is applied by
+ * `estimateTokens` per character rather than by rewriting this ratio.
+ */
 export function charsPerToken(modelId?: string): number {
   if (!modelId) return DEFAULT_CHARS_PER_TOKEN;
   const id = modelId.toLowerCase();
-  if (KIRO_MODEL_PREFIXES.some(p => id.startsWith(p))) return KIRO_CHARS_PER_TOKEN;
+  // `estimateKiroTokens` always prefixes `kiro/`, so the Kiro-measured ratio reaches Kiro traffic
+  // and only Kiro traffic.
+  if (id.startsWith("kiro")) return KIRO_CHARS_PER_TOKEN;
+  if (AGENT_MODEL_PREFIXES.some(p => id.startsWith(p))) return AGENT_MODEL_CHARS_PER_TOKEN;
   return DEFAULT_CHARS_PER_TOKEN;
 }
 
 /**
- * CJK-aware ratio (devlog 260712 B3, audit R2#7): Korean/Chinese/Japanese text packs
- * roughly one token per 1.5-3 chars, so a CJK-heavy blob estimated at English ratios
- * badly undercounts. When >30% of chars are CJK, clamp DOWN to 2.5 chars/token —
- * `min(model ratio, 2.5)` so per-model ratios (Claude 3.5, Kiro family) never rise.
+ * Chars per token for CJK text, applied to the CJK characters alone.
+ *
+ * Solved from the same recorded ground truth: holding the Latin ratio fixed and attributing the
+ * remainder of CJK-heavy samples to their Hangul/Han characters gives ~1.50 chars/token. A Korean
+ * character therefore costs roughly TWICE what a Latin character does, which is precisely what a
+ * single blended divisor cannot express.
  */
-const CJK_CHARS_PER_TOKEN = 2.5;
-const CJK_RATIO_THRESHOLD = 0.3;
-// Hangul syllables/jamo, CJK unified ideographs (+ext A), hiragana/katakana.
-const CJK_RE = /[\uAC00-\uD7A3\u1100-\u11FF\u3130-\u318F\u4E00-\u9FFF\u3400-\u4DBF\u3040-\u30FF]/;
+const CJK_CHARS_PER_TOKEN = 1.5;
 
-function cjkRatio(text: string): number {
-  if (text.length === 0) return 0;
-  // Sample long blobs for O(1) cost: every char up to 2k, then a stride.
-  const stride = text.length > 2048 ? Math.ceil(text.length / 2048) : 1;
+/**
+ * Count CJK characters exactly, in one pass, with no allocation and no regex object per char.
+ *
+ * Ranges: Hangul syllables and jamo, CJK unified ideographs and extension A, hiragana/katakana.
+ * Surrogate pairs (rare CJK extensions beyond the BMP) are counted as their two code units,
+ * which slightly over-counts them — again the safe direction.
+ */
+function countCjk(text: string): number {
   let cjk = 0;
-  let sampled = 0;
-  for (let i = 0; i < text.length; i += stride) {
-    sampled++;
-    if (CJK_RE.test(text[i]!)) cjk++;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (
+      (c >= 0xac00 && c <= 0xd7a3)
+      || (c >= 0x1100 && c <= 0x11ff)
+      || (c >= 0x3130 && c <= 0x318f)
+      || (c >= 0x4e00 && c <= 0x9fff)
+      || (c >= 0x3400 && c <= 0x4dbf)
+      || (c >= 0x3040 && c <= 0x30ff)
+    ) cjk++;
   }
-  return sampled === 0 ? 0 : cjk / sampled;
+  return cjk;
 }
 
 /**
@@ -80,7 +142,12 @@ export function estimateTokens(text: string, modelId?: string, contextWindow?: n
   if (!text) return 0;
   const len = text.length;
   if (len === 0) return 0;
-  let ratio = charsPerToken(modelId);
-  if (cjkRatio(text) > CJK_RATIO_THRESHOLD) ratio = Math.min(ratio, CJK_CHARS_PER_TOKEN);
-  return capEstimateAtContextWindow(Math.max(1, Math.ceil(len / ratio)), contextWindow);
+  const latinRatio = charsPerToken(modelId);
+  const cjk = countCjk(text);
+  // Continuous in the CJK share: no threshold, so one added Korean character moves the estimate
+  // by a fraction of a token instead of switching the whole blob to a different divisor.
+  const estimate = cjk === 0
+    ? Math.ceil(len / latinRatio)
+    : Math.ceil((len - cjk) / latinRatio + cjk / CJK_CHARS_PER_TOKEN);
+  return capEstimateAtContextWindow(Math.max(1, estimate), contextWindow);
 }

package/src/lib/windows-user-principal.ts

@@ -23,6 +23,7 @@
 import { existsSync } from "node:fs";
 import { win32 as windowsPath } from "node:path";
 import { waitForSubprocessExit } from "./bounded-subprocess";
+import { decodeWindowsTextBytes } from "./windows-text";
 
 import {
   resolveTrustedWindowsPowerShellExe,
@@ -98,7 +99,12 @@ export interface WindowsPrincipalLookupResult {
   success: boolean;
   exitCode: number | null;
   timedOut: boolean;
-  stdout: string;
+  /**
+   * Raw child stdout. Bytes are allowed because `powershell.exe` writes the console
+   * output code page, not UTF-8, and the decode below is the thing under test: a seam
+   * that only carried a decoded string could never exercise it.
+   */
+  stdout: string | Uint8Array;
 }
 
 export type WindowsPrincipalRunner = (
@@ -138,7 +144,10 @@ function defaultWindowsPrincipalRunner(timeoutMs: number): WindowsPrincipalLooku
     success: result.success,
     exitCode: result.exitCode,
     timedOut: result.exitedDueToTimeout ?? false,
-    stdout: result.stdout ? result.stdout.toString() : "",
+    // Bytes, NOT .toString(): that is UTF-8, and Windows PowerShell 5.1 emits the
+    // console output code page. A non-ASCII account name decoded as UTF-8 becomes
+    // U+FFFD and is then frozen into the identity cache.
+    stdout: result.stdout ?? new Uint8Array(),
   };
 }
 
@@ -152,8 +161,9 @@ async function defaultAsyncWindowsPrincipalRunner(
     windowsHide: true,
   });
   const { exitCode, timedOut } = await waitForSubprocessExit(proc, timeoutMs);
-  const stdout = !timedOut && proc.stdout
-    ? await new Response(proc.stdout).text().catch(() => "")
+  // `.bytes()` rather than `.text()`, for the same reason as the sync runner above.
+  const stdout: string | Uint8Array = !timedOut && proc.stdout
+    ? await new Response(proc.stdout).bytes().catch(() => new Uint8Array())
     : "";
   return {
     success: !timedOut && exitCode === 0,
@@ -165,6 +175,24 @@ async function defaultAsyncWindowsPrincipalRunner(
 
 let principalRunner: WindowsPrincipalRunner = defaultWindowsPrincipalRunner;
 let asyncPrincipalRunner: AsyncWindowsPrincipalRunner = defaultAsyncWindowsPrincipalRunner;
+let principalLocaleForTests: string | undefined;
+
+/**
+ * Decode child stdout the way the rest of this repository already decodes Windows
+ * console output: UTF-16 with or without a BOM, then STRICT UTF-8, then the locale's
+ * legacy code page. Strict-UTF-8-first is what keeps an ordinary UTF-8 host unaffected.
+ *
+ * The SID on the first line is ASCII by construction and survives either way, which is
+ * why this corruption stayed silent: only the account name on the second line breaks.
+ */
+function decodePrincipalStdout(stdout: string | Uint8Array): string {
+  if (typeof stdout === "string") return stdout;
+  return decodeWindowsTextBytes(
+    stdout,
+    principalLocaleForTests ? { locale: principalLocaleForTests } : {},
+  );
+}
+
 export interface WindowsPrincipalIdentity {
   readonly sid: string;
   readonly name: string;
@@ -220,7 +248,7 @@ function identityFromResult(result: WindowsPrincipalLookupResult): WindowsPrinci
       ? "timed out"
       : `exited ${result.exitCode ?? "null"}`);
   }
-  const lines = result.stdout.trim().split(/\r?\n/);
+  const lines = decodePrincipalStdout(result.stdout).trim().split(/\r?\n/);
   const sid = lines[0]?.trim() ?? "";
   const name = lines[1]?.trim() ?? "";
   if (!SID_PATTERN.test(sid)) {
@@ -341,6 +369,26 @@ export function setAsyncWindowsPrincipalRunnerForTests(
   cachedIdentity = null;
 }
 
+/**
+ * Test seam: pin the locale that selects the legacy code page.
+ *
+ * Required rather than convenient. `decodeWindowsTextBytes` picks ONE legacy encoding
+ * from the ambient locale, so CP949, CP932 and CP936 fixtures cannot all decode
+ * correctly in a single process without being told which to expect. Production passes
+ * nothing and keeps the ambient locale.
+ *
+ * Clears the cache and refuses mid-flight for the same reasons the runner setters do:
+ * a successful identity is returned from cache BEFORE any decode, and the async path
+ * decodes after its runner resolves.
+ */
+export function setWindowsPrincipalLocaleForTests(locale: string | null): void {
+  if (asyncLookupInFlight) {
+    throw new Error("Cannot change the Windows principal locale while a lookup is in flight.");
+  }
+  principalLocaleForTests = locale ?? undefined;
+  cachedIdentity = null;
+}
+
 /** Test seam: clear only process-local principal state. */
 export function resetWindowsPrincipalForTests(): void {
   if (asyncLookupInFlight) {

package/src/oauth/account-quota-rank.ts

@@ -10,7 +10,7 @@
  * categories answer the only question rotation asks — "which of these is most likely to
  * serve the retry" — and within the healthy group a simple headroom sort is enough.
  */
-import { getCachedProviderAccountQuota } from "../providers/quota";
+import { getCachedProviderAccountQuota, hasPassiveAccountQuota } from "../providers/quota";
 import { getKiroAccountExhaustion } from "../providers/kiro-usage";
 
 /** Lower sorts earlier. Unknown sits between measured-healthy and measured-empty. */
@@ -27,6 +27,24 @@ interface Ranked {
   index: number;
 }
 
+/**
+ * How old a PASSIVELY observed quota may be and still steer routing.
+ *
+ * A probed row is fresh by construction: it exists only because a probe wrote it, and
+ * `fetchAccountQuota` re-probes once `ACCOUNT_QUOTA_TTL_MS` has passed. So no caller has
+ * ever needed an explicit age check, and `getCachedProviderAccountQuota` does not apply
+ * one.
+ *
+ * A passive row breaks that invariant — nothing re-probes it, so it can be hours or days
+ * old. Routing on such a reading is worse than routing on none: the unranked ring at
+ * least rotates, while a stale ranking sends every first attempt to an account that may
+ * have been spent since. The bound is longer than the probe TTL (an hour-old reading of
+ * a five-hour window is still informative) and far shorter than the six-hour disk
+ * horizon, which exists to preserve a value for DISPLAY — where the age is shown to the
+ * user and no automatic decision rides on it.
+ */
+const PASSIVE_HEADROOM_MAX_AGE_MS = 60 * 60_000;
+
 /**
  * Remaining headroom across every window the provider reports.
  *
@@ -36,6 +54,9 @@ interface Ranked {
 function headroomOf(provider: string, accountId: string): number | null {
   const quota = getCachedProviderAccountQuota(provider, accountId);
   if (!quota) return null;
+  // Null, not a low rank: this must reproduce "no evidence" so a stale roster degrades to
+  // the unranked ring rather than to a differently wrong answer.
+  if (hasPassiveAccountQuota(provider) && Date.now() - quota.updatedAt > PASSIVE_HEADROOM_MAX_AGE_MS) return null;
   const percents = [
     quota.fiveHourPercent,
     quota.weeklyPercent,
@@ -56,6 +77,12 @@ export function rankAccountsByHeadroom(provider: string, ring: readonly string[]
   if (ring.length < 2) return [...ring];
 
   let sawEvidence = false;
+  // Same rule as hasHeadroomEvidence: a passive provider's partial roster must not rank
+  // at all. The failover path calls this directly (selectFailoverAccount), so the guard
+  // cannot live only in the pre-dispatch predicate.
+  if (hasPassiveAccountQuota(provider) && !ring.every(id => headroomOf(provider, id) !== null)) {
+    return [...ring];
+  }
   const ranked: Ranked[] = ring.map((id, index) => {
     // A provider-declared exhaustion verdict outranks the percentage: an account may sit at
     // 100% and still be servable when overage is enabled, and the verdict knows that.
@@ -84,6 +111,18 @@ export function rankAccountsByHeadroom(provider: string, ring: readonly string[]
  * can decline to act on a roster it knows nothing about.
  */
 export function hasHeadroomEvidence(provider: string, ids: readonly string[]): boolean {
+  // A PASSIVE provider needs evidence for EVERY candidate, not any one of them.
+  //
+  // A probe fills the whole roster in one pass (fetchProviderAccountQuotas), so "any"
+  // and "every" coincide there. An observation arrives one account at a time, so the
+  // normal passive state is "one measured, N unknown" -- and RANK_UNKNOWN (1) sorts
+  // AFTER RANK_HEALTHY (0), including behind a measured row sitting at 100% with zero
+  // headroom. Accepting partial evidence would therefore redirect the first attempt
+  // AWAY from an unmeasured account and TOWARD the one account known to be spent, which
+  // is the exact inversion of what ranking is for.
+  if (hasPassiveAccountQuota(provider)) {
+    return ids.length > 0 && ids.every(id => headroomOf(provider, id) !== null);
+  }
   return ids.some(id =>
     headroomOf(provider, id) !== null
     || (provider === "kiro" && getKiroAccountExhaustion(`${provider}\u0000${id}`) !== null));