@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/responses/state.ts

@@ -21,6 +21,9 @@ import {
 import { collectReferencedSpillFileNames, snapshotReferencedSpillFileNames } from "./state/spill-inspect";
 import { selectSnapshotEntries, snapshotPayload } from "./state/snapshot-select";
 import { clientCarriedPrefixLength, providerIssuedIdentity } from "./state/replay-fingerprint";
+import { hasPendingClientToolCall, allowsUnforcedStoreFalseReplay } from "./state/unforced-store-false";
+import { computeResponseStateMetrics, type ResponseStateMetrics } from "./state/metrics";
+export type { ResponseStateMetrics } from "./state/metrics";
 export type { ResponseStateTempRecoveryResult, ResponseStateTempRecoveryOptions } from "./state/temp-recovery";
 export type { ResponseSpillDirInspection } from "./spill-store";
 export { recoverStaleResponseStateTemps, reclaimAbandonedResponseStateTemps, inspectAbandonedResponseStateTemps, sweepAbandonedResponseStateTemps } from "./state/temp-recovery";
@@ -118,6 +121,7 @@ export interface ResidentResponseState {
   /** Index in `items` where provider output begins; see clientCarriedPrefixLength. */
   providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
+  unforcedStoreFalse?: boolean;
   sizeBytes: number;
 }
 
@@ -128,6 +132,7 @@ export interface SpilledResponseState {
   /** Mirrors the spilled payload boundary so a spilled entry keeps its anchor. */
   providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
+  unforcedStoreFalse?: boolean;
   spill: ResponseSpillRef;
   sizeBytes: number;
 }
@@ -315,6 +320,7 @@ function measureResidentEntry(id: string, entry: ResidentInput): ResidentRespons
     items: entry.items,
     ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
     ...(entry.providers ? { providers: entry.providers } : {}),
+    ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
   });
   return sizeBytes === null ? null : { kind: "resident", ...entry, sizeBytes };
 }
@@ -417,7 +423,9 @@ function swapResidentForSpill(id: string, expected: ResidentResponseState, ref:
     kind: "spill",
     createdAt: expected.createdAt,
     ...(expected.clientThreadId ? { clientThreadId: expected.clientThreadId } : {}),
+    ...(expected.providerOutputStart !== undefined ? { providerOutputStart: expected.providerOutputStart } : {}),
     ...(expected.providers ? { providers: expected.providers } : {}),
+    ...(expected.unforcedStoreFalse ? { unforcedStoreFalse: expected.unforcedStoreFalse } : {}),
     spill: ref,
   };
   const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -441,6 +449,7 @@ function replaceSpillEntryAtomically(
       items: candidate.items,
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
     });
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
       kind: "spill",
@@ -448,6 +457,7 @@ function replaceSpillEntryAtomically(
       ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
       spill: ref,
     };
     const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -533,6 +543,7 @@ function admitOversizedCandidate(
       items: candidate.items,
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
     });
     // Enforce the ceiling against the REAL envelope: the spill payload adds
     // the {version, responseId, ...} wrapper, so a candidate within the
@@ -547,7 +558,9 @@ function admitOversizedCandidate(
       kind: "spill",
       createdAt: candidate.createdAt,
       ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
+      ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
       spill: ref,
     };
     const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -935,6 +948,7 @@ function pruneResponses(at = now()): void {
         items: entry.items,
         ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
         ...(entry.providers ? { providers: entry.providers } : {}),
+        ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
       });
       if (swapResidentForSpill(oldestId, entry, ref)) noteSpillWriteSuccess();
     } catch (error) {
@@ -994,6 +1008,7 @@ export function evictOldestResponseContinuationForBudget(): number {
       items: entry.items,
       ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
       ...(entry.providers ? { providers: entry.providers } : {}),
+      ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
     });
     if (swapResidentForSpill(id, entry, ref)) noteSpillWriteSuccess();
   } catch (error) {
@@ -1030,6 +1045,15 @@ function materializeEntry(
     schedulePersist();
     return { ok: false, failure };
   }
+  // A restricted snapshot stub must agree with the validated spill's provenance.
+  if (entry.unforcedStoreFalse && (result.payload.unforcedStoreFalse !== true
+    || entry.providerOutputStart === undefined || entry.providerOutputStart > result.payload.items.length
+    || entry.providerOutputStart !== result.payload.providerOutputStart)) {
+    spillCounters.readFailures += 1;
+    replaceWithSpillFailure(id, entry);
+    schedulePersist();
+    return { ok: false, failure: { code: "previous_response_not_found", reason: "spill_corrupt" } };
+  }
   const state = measureResidentEntry(id, {
     createdAt: result.payload.createdAt,
     ...(result.payload.clientThreadId ? { clientThreadId: result.payload.clientThreadId } : {}),
@@ -1038,6 +1062,7 @@ function materializeEntry(
       ? { providerOutputStart: result.payload.providerOutputStart }
       : {}),
     ...(result.payload.providers ? { providers: result.payload.providers } : {}),
+    ...(result.payload.unforcedStoreFalse ? { unforcedStoreFalse: result.payload.unforcedStoreFalse } : {}),
   });
   if (!state) {
     spillCounters.readFailures += 1;
@@ -1075,6 +1100,15 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
     replayScopeMismatchDrops += 1;
     return body;
   }
+  const clientInput = inputItems(request.input);
+  const stored = materialized.state.items;
+  const carried = clientCarriedPrefixLength(stored, clientInput);
+  if (
+    materialized.state.unforcedStoreFalse
+    && !allowsUnforcedStoreFalseReplay(stored, materialized.state.providerOutputStart, clientInput, carried)
+  ) {
+    return body;
+  }
   // The client already replayed this history verbatim. Prepending the stored copy would
   // double it, and the doubled turn is stored again, so the next turn triples (#1412 saw
   // 127k of real context reach 1.3M tokens this way).
@@ -1087,10 +1121,7 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
   // There is no invariant that provider output always carries ids, so an entry whose output
   // has none simply never skips.
   {
-    const clientInput = inputItems(request.input);
-    const stored = materialized.state.items;
     const anchor = materialized.state.providerOutputStart;
-    const carried = clientCarriedPrefixLength(stored, clientInput);
     if (
       carried === stored.length
       && anchor !== undefined
@@ -1110,9 +1141,9 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
   }
   const expanded = {
     ...request,
-    input: [...materialized.state.items, ...inputItems(request.input)],
+    input: [...stored, ...clientInput],
   };
-  replayedInputPrefixLengths.set(expanded, materialized.state.items.length);
+  replayedInputPrefixLengths.set(expanded, stored.length);
   return expanded;
 }
 
@@ -1156,29 +1187,6 @@ export function previousResponseProviderState(responseId: string | undefined): O
   return providers ? structuredClone(providers) : undefined;
 }
 
-export interface ResponseStateMetrics {
-  count: number;
-  residentCount: number;
-  spillStubCount: number;
-  tombstoneCount: number;
-  totalBytes: number;
-  spillPayloadBytes: number;
-  largestBytes: number;
-  oldestAgeMs: number;
-  spillWrites: number;
-  spillWriteFailures: number;
-  spillWriteStatus: ResponseSpillWriteStatus;
-  spillWriteConsecutiveFailures: number;
-  spillLastWriteFailureCode: ResponseSpillWriteFailureCode | null;
-  spillLastWriteFailureOrigin: ResponseSpillWriteFailureOrigin | null;
-  spillAclRetryReturnedTimeouts: number;
-  spillAclTimeoutMemoRefusals: number;
-  spillLastWriteFailureAt: number | null;
-  spillLastWriteSuccessAt: number | null;
-  spillReadFailures: number;
-  replayScopeMismatchDrops: number;
-}
-
 /**
  * Observe-only snapshot of the in-RAM continuation store, surfaced via GET /api/system/memory.
  * Additive and side-effect free — it does NOT lazy-load the disk snapshot, prune, or evict — so a
@@ -1189,50 +1197,23 @@ export interface ResponseStateMetrics {
  * store (JS heap) or in the runtime allocator (native).
  */
 export function responseStateMetrics(): ResponseStateMetrics {
-  const at = now();
-  let largestBytes = 0;
-  let oldestCreatedAt = at;
-  let residentCount = 0;
-  let spillStubCount = 0;
-  let tombstoneCount = 0;
-  let spillPayloadBytes = 0;
-  for (const state of states.values()) {
-    const bytes = state.sizeBytes;
-    if (bytes > largestBytes) largestBytes = bytes;
-    if (state.createdAt < oldestCreatedAt) oldestCreatedAt = state.createdAt;
-    if (state.kind === "resident") {
-      residentCount += 1;
-    } else if (state.kind === "spill") {
-      spillStubCount += 1;
-      spillPayloadBytes += state.spill.payloadBytes;
-    } else tombstoneCount += 1;
-  }
-  return {
-    count: states.size,
-    residentCount,
-    spillStubCount,
-    tombstoneCount,
+  return computeResponseStateMetrics({
+    states: states.values(),
+    stateCount: states.size,
+    now: now(),
     totalBytes: responseContinuationRetainedStoreSnapshot().bytes,
-    spillPayloadBytes,
-    largestBytes,
-    oldestAgeMs: states.size > 0 ? at - oldestCreatedAt : 0,
     spillWrites: spillCounters.writes,
     spillWriteFailures: spillCounters.writeFailures,
-    spillWriteStatus: spillWriteHealth.consecutiveFailures > 0
-      ? "degraded"
-      : spillWriteHealth.lastSuccessAt !== null
-        ? "healthy"
-        : "initial",
     spillWriteConsecutiveFailures: spillWriteHealth.consecutiveFailures,
-    spillLastWriteFailureCode: spillWriteHealth.lastFailureCode,
-    spillLastWriteFailureOrigin: spillWriteHealth.lastFailureOrigin,
+    spillLastFailureCode: spillWriteHealth.lastFailureCode,
+    spillLastFailureOrigin: spillWriteHealth.lastFailureOrigin,
+    spillLastSuccessAt: spillWriteHealth.lastSuccessAt,
     spillAclRetryReturnedTimeouts: spillCounters.aclRetryReturnedTimeouts,
     spillAclTimeoutMemoRefusals: spillCounters.aclTimeoutMemoRefusals,
-    spillLastWriteFailureAt: spillWriteHealth.lastFailureAt,
-    spillLastWriteSuccessAt: spillWriteHealth.lastSuccessAt,
+    spillLastFailureAt: spillWriteHealth.lastFailureAt,
     spillReadFailures: spillCounters.readFailures,
     replayScopeMismatchDrops,
-  };
+  });
 }
 
 /**
@@ -1256,7 +1237,7 @@ export function rememberResponseState(
   requestBody: unknown,
   response: { id?: unknown; output?: unknown; status?: unknown; incomplete_details?: unknown },
   providerState?: OcxProviderContinuationState | string,
-  opts?: { force?: boolean; clientThreadId?: string },
+  opts?: { force?: boolean; clientThreadId?: string; retainForToolContinuation?: boolean },
 ): void {
   if (!requestBody || typeof requestBody !== "object" || Array.isArray(requestBody)) return;
   const request = requestBody as Record<string, unknown>;
@@ -1266,8 +1247,10 @@ export function rememberResponseState(
   // The passthrough branch records with force so those chains can be expanded locally; the
   // store stays in-memory under RESPONSE_TTL_MS, so this is a proxy-internal continuation cache, not
   // real server-side response storage.
-  if (request.store === false && !opts?.force) return;
   if (typeof response.id !== "string" || !Array.isArray(response.output)) return;
+  // Only an explicitly opted-in adapter may retain pending client calls despite store:false.
+  const unforcedStoreFalse = request.store === false && !opts?.force;
+  if (unforcedStoreFalse && !(opts?.retainForToolContinuation === true && hasPendingClientToolCall(response.output))) return;
   if (response.status === "incomplete") {
     const details = response.incomplete_details;
     if (!details || typeof details !== "object" || Array.isArray(details)
@@ -1300,6 +1283,7 @@ export function rememberResponseState(
     // incomplete agent turn on the Cursor side (we suspended without a real mcpResult), so its
     // checkpoint must not be reused — but the conversation id string itself is still valid.
     ...(Object.keys(normalizedProviderState).length > 0 ? { providers: normalizedProviderState } : {}),
+    ...(unforcedStoreFalse ? { unforcedStoreFalse: true } : {}),
   });
   enforceAppOwnedMemoryBudget();
   schedulePersist();

package/src/router.ts

@@ -1,3 +1,4 @@
+import { CODEX_INTERNAL_OPENAI_MODELS } from "./codex/control-plane-models";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "./types";
 import { createHash } from "node:crypto";
 import { peekAuthStore } from "./oauth/store";
@@ -12,6 +13,7 @@ import {
 } from "./combos";
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
+import { anthropicInstanceRowShapeMatches } from "./providers/anthropic-instance-id";
 import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./providers/key-store";
 import { captureProviderApiKeySelection } from "./providers/api-key-selection-capture";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
@@ -53,6 +55,14 @@ import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/eva
 import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
 import { resolveModelPolicy, type ResolvedModelPolicy } from "./providers/resolved-model-policy";
 
+/** Explicit Pool 2 admission refusal; ingress must not recover it through default routing. */
+export class AnthropicSecondaryInstanceUnavailableError extends Error {
+  constructor() {
+    super("Anthropic Pool 2 requires an enabled configured provider with valid OAuth ownership");
+    this.name = "AnthropicSecondaryInstanceUnavailableError";
+  }
+}
+
 export class UnknownRoutingPolicyError extends Error {
   constructor(readonly profileId: string) {
     super(`Unknown routing policy: ${profileId}`);
@@ -521,9 +531,18 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   return resolved;
 }
 
+/**
+ * Rows eligible for bare-model inference (configured default model, model list, model alias).
+ *
+ * The marked builtin Pool 2 row is excluded: it seeds the same catalog as `anthropic`, so letting it
+ * compete would move a bare `claude-*` request onto Pool 2 by insertion order, or make a shared alias
+ * ambiguous. Pool 2 is reached only through `anthropic2/<model>`, its provider alias, or an explicit
+ * `defaultProvider`. An unmarked custom row named `anthropic2` keeps its ordinary custom meaning.
+ */
 function activeProviderEntries(config: OcxConfig): [string, OcxProviderConfig][] {
   return Object.entries(config.providers)
-    .filter(([name, provider]) => name !== LEGACY_CHATGPT_PROVIDER_ID && provider.disabled !== true);
+    .filter(([name, provider]) => name !== LEGACY_CHATGPT_PROVIDER_ID && provider.disabled !== true
+      && !(name === "anthropic2" && anthropicInstanceRowShapeMatches(name, provider)));
 }
 
 export class NoEnabledOpenAiProviderError extends Error {
@@ -564,9 +583,6 @@ export function comboRouteDecisionTrace(
   });
 }
 
-// Codex uses a small number of control-plane model ids that are not part of the public GPT/o
-// naming families. Keep this exact: a broad `codex-*` rule could capture a third-party model.
-const CODEX_INTERNAL_OPENAI_MODELS = new Set(["codex-auto-review"]);
 const MAX_BLOCKED_MODEL_REDIRECT_EDGES = 5;
 
 interface BlockedModelRedirectState {
@@ -620,6 +636,9 @@ function routeResult(
   routeReason: string,
   redirectState: BlockedModelRedirectState,
 ): RouteResult {
+  if (providerName === "anthropic2" && provider.authMode === "oauth" && !anthropicInstanceRowShapeMatches(providerName, provider)) {
+    throw new AnthropicSecondaryInstanceUnavailableError();
+  }
   const qualified = resolveBlockedModelRedirect(config, `${providerName}/${modelId}`);
   const bare = resolveBlockedModelRedirect(config, modelId);
   const crossTarget = config && (
@@ -813,6 +832,11 @@ function routeModelInternal(
   if (slash > 0) {
     const requestedProvider = modelId.slice(0, slash);
     const requestedLower = requestedProvider.toLowerCase();
+    // Literal B is a reserved instance selector even before its row exists. Keep other
+    // qualifiers, including exact uppercase custom keys, on the ordinary routing path.
+    if (requestedProvider === "anthropic2" && !hasOwnProvider(config.providers, requestedProvider)) {
+      throw new AnthropicSecondaryInstanceUnavailableError();
+    }
     let provName: string | undefined;
 
     if (hasOwnProvider(config.providers, requestedProvider)) {

package/src/routing/compatibility/assemble.ts

@@ -76,7 +76,7 @@ export function assemblePolicyCandidateEvidence(
       quota: quotaEvidenceForCandidate({
         provider: candidate.provider,
         model: candidate.model,
-      }),
+      }, config),
       cost: costEvidenceForCandidate({
         provider: candidate.provider,
         model: candidate.model,

package/src/routing/quota.ts

@@ -1,3 +1,5 @@
+import type { OcxConfig } from "../types";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 /**
  * Quota-aware policy scoring (RI-07).
  *
@@ -98,7 +100,7 @@ export function codexPoolQuotaEvidence(accounts: readonly CodexPoolQuotaAccount[
   };
 }
 
-export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuotaEvidence {
+export function quotaEvidenceForCandidate(input: QuotaEvidenceInput, config?: Pick<OcxConfig, "providers">): RouteQuotaEvidence {
   if (input.provider === "openai" && input.codexAccountId) {
     // listAccountQuotas() is the reconciled quota snapshot: config-generation
     // reconciliation prunes removed accounts. Other eligibility dimensions
@@ -113,8 +115,10 @@ export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuota
     return codexAccountQuotaEvidence(input.codexAccountId, input.codexAccountPlan);
   }
 
-  if (input.provider === "anthropic" && input.accountRef) {
-    const quota = getCachedProviderAccountQuota("anthropic", input.accountRef);
+  const instance = config ? configuredAnthropicInstance(config, input.provider)
+    : input.provider === "anthropic" ? "anthropic" : undefined;
+  if (instance && input.accountRef) {
+    const quota = getCachedProviderAccountQuota(instance, input.accountRef);
     if (quota) {
       const family = anthropicFamilyWindow(input.model, quota.customWindows ?? []);
       const percents = [quota.fiveHourPercent, quota.weeklyPercent, quota.monthlyPercent, family?.percent]

package/src/server/auth-cors.ts

@@ -38,6 +38,7 @@ import { redactSecretString } from "../lib/redact";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
+import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -785,6 +786,8 @@ export function providerManagementConfigError(
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  const markerError = anthropicOAuthInstanceConfigError({ providers: { [name]: provider } });
+  if (markerError) return markerError;
   // Every write path (POST, PUT, reload, both PATCH passes) funnels through here, so a PATCH
   // that changes authMode/baseUrl/adapter under a retained tlsProfile is refused before it
   // persists a row the config schema would later reject as document-fatal.
@@ -1057,6 +1060,8 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   modelVercelGatewayRouting: "editor",
   authMode: "editor",
   oauthAccountFailover: "editor",
+  anthropicAccountPool: "editor",
+  anthropicOAuthInstance: "editor",
   keyOptional: "editor",
   freeTier: "editor",
   note: "editor",

package/src/server/chat-completions.ts

@@ -32,7 +32,7 @@ import {
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
 import { estimateTokens } from "../lib/token-estimate";
-import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { AnthropicSecondaryInstanceUnavailableError, captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
@@ -242,6 +242,11 @@ async function handleChatCompletionsWithBudget(
       }
     }
   } catch (err) {
+    if (err instanceof AnthropicSecondaryInstanceUnavailableError) {
+      logCtx.requestedModel = requestedModel;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+      return chatCompletionsErrorResponse(401, err.message, "authentication_error");
+    }
     if (err instanceof AdmissionModelDeniedError) {
       logCtx.requestedModel = requestedModel;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });

package/src/server/chat-native.ts

@@ -1,3 +1,5 @@
+import { createPhysicalSendReporter } from "../lib/request-execution-budget";
+import { createInferenceSendBudget } from "./inference/context";
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
 import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
 import { isNativeChatRouteEligible } from "./chat-native-eligibility";
@@ -17,7 +19,7 @@ import {
   isCyberPolicyMessage,
   SEND_BUDGET_EXHAUSTED_CODE,
 } from "../lib/errors";
-import type { RequestExecutionBudget } from "../lib/request-execution-budget";
+import { reportDispatchSends, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../lib/request-execution-budget";
 import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
@@ -198,6 +200,7 @@ export interface NativeChatExecution extends HandleNativeChatOptions {
    * the parent row, replace the one the final log settles.
    */
   sendBudget?: RequestExecutionBudget;
+  comboDispatchPermit?: SingleUseDispatchPermit;
   /** Replaces the request-relative first-output mark; a combo child records its own. */
   onFirstOutput?: () => void;
   /** The lease a streamed body holds; defaults to `logIds.turnAdmissionLease`. */
@@ -254,6 +257,7 @@ export function createNativeChatComboSource(input: {
       translatorBudget: input.translatorBudget,
       finishLog: child.finishLog,
       sendBudget: child.sendBudget,
+      comboDispatchPermit: child.comboDispatchPermit,
       onFirstOutput: child.onFirstOutput,
       ...(child.turnAdmissionLease ? { turnAdmissionLease: child.turnAdmissionLease } : {}),
     }, child.attemptHandle),
@@ -314,6 +318,7 @@ export async function runNativeChatAttempt(
   let activeProvider: OcxProviderConfig = route.provider;
   stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
   const spendTracker = sendBudget ? undefined : attachRequestSpendTracker(req, logCtx);
+  const physicalBudget = sendBudget ?? createInferenceSendBudget(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
   let retainedRequestBytes = 0;
@@ -450,30 +455,45 @@ export async function runNativeChatAttempt(
               const encoding = new Headers(init.headers).get("accept-encoding");
               if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
               if (init.signal?.aborted) throw init.signal.reason;
-              if (sendBudget) {
-                // Backstop for sends the helper cannot see coming (a reset replay). The first
-                // report settles the combo's booking; each later one is charged and booked.
-                if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
-                  throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+              const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
+                poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
+              }), execution.comboDispatchPermit);
+              let dispatched: Response;
+              try {
+                // Capture this request's spend policy at its first physical boundary, including
+                // observe-only starts; later configuration changes belong to later requests.
+                if (spendReport.beforeSend && !spendReport.beforeSend()) {
+                  if ((logCtx.spendTracker as { refusals?: number } | undefined)?.refusals) throw new NativeChatSpendRefusal();
+                  throw new SendBudgetExhaustedError();
                 }
-                physicalSends += 1;
-                sendBudget.used += 1;
-              } else if (!spendTracker?.charge()) throw new NativeChatSpendRefusal();
-              noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-              // A reselected provider transport is still a physical send: the connection policy
-              // and manual-redirect ownership wrap the selected implementation (#4992).
-              const dispatched = await sendWithConnectionPolicy(
-                (activeProvider as OcxProviderTransport).fetch ?? execute,
-                request.url,
-                applyUpstreamRecoveryInit({
-                  ...init, method: request.method, headers, body: request.body,
-                }, transportRecovery),
-                // Reselection can replace the provider transport and the wire shape, so the
-                // egress route is bound to the provider this send actually uses. Omitting it
-                // here would let a provider transport bypass its configured route entirely,
-                // because that transport wins over the executor that carries the binding.
-                { providerName: route.providerName, provider: activeProvider },
-              );
+                if (!physicalBudget.spendEnforced && sendBudget) {
+                  // Backstop for sends the helper cannot see coming (a reset replay). The first
+                  // report settles the combo's booking; each later one is charged and booked.
+                  if (physicalSends > 0 && sendBudget.remainingBaseSends(sharedSendCap) <= 0) {
+                    throw new SendBudgetExhaustedError(safeHostLabel(request.url));
+                  }
+                  physicalSends += 1;
+                  reportDispatchSends(sendBudget, 1, execution.comboDispatchPermit);
+                } else if (!physicalBudget.spendEnforced && !spendTracker?.charge()) throw new NativeChatSpendRefusal();
+                noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+                // A reselected provider transport is still a physical send: the connection policy
+                // and manual-redirect ownership wrap the selected implementation (#4992).
+                dispatched = await sendWithConnectionPolicy(
+                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  request.url,
+                  applyUpstreamRecoveryInit({
+                    ...init, method: request.method, headers, body: request.body,
+                  }, transportRecovery),
+                  // Reselection can replace the provider transport and the wire shape, so the
+                  // egress route is bound to the provider this send actually uses. Omitting it
+                  // here would let a provider transport bypass its configured route entirely,
+                  // because that transport wins over the executor that carries the binding.
+                  { providerName: route.providerName, provider: activeProvider },
+                );
+              } finally {
+                try { if (physicalBudget.spendEnforced) spendReport(1); }
+                finally { spendReport.close?.(); }
+              }
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
               return dispatched;
             },
@@ -558,7 +578,7 @@ export async function runNativeChatAttempt(
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
-    if (sendBudget && sendError instanceof SendBudgetExhaustedError) {
+    if (sendError instanceof SendBudgetExhaustedError) {
       // A decision this process made, answered as the Responses path answers it: 429, not 502.
       return fail(429, sendError.message, SEND_BUDGET_EXHAUSTED_CODE, SEND_BUDGET_EXHAUSTED_CODE);
     }

package/src/server/claude-messages.ts

@@ -80,7 +80,9 @@ import { upstreamWireForAdapter } from "../protocols/contract";
 import { createProtocolEnvelope, type ProtocolEnvelope } from "../protocols/envelope";
 import { featuresFromMessagesBody, type ProtocolFeature } from "../protocols/features";
 import { credentialDomainFor, messagesBodyHasOpaqueState } from "../protocols/opaque-state";
-import { hasAnthropicFailoverQuorum, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
+import { anthropicRoutingFor, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
+import { messagesSelectorTargetsSecondaryInstance, messagesSecondaryInstanceUnavailable } from "./messages-native-selector";
 import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
 import { requestPathForLane } from "../protocols/path";
 import { resolveApiSurfaceSettings, resolveProtocolSettings } from "../protocols/settings";
@@ -244,6 +246,7 @@ function wantsNativePassthrough(
 ): model is string {
   if (cc?.nativePassthrough === false) return false;
   if (typeof model !== "string" || !/^(claude|anthropic)/i.test(model)) return false;
+  if (messagesSelectorTargetsSecondaryInstance(config, model, cc)) return false;
   // Authorization and x-api-key both belong to the upstream on this branch. An exposed listener
   // therefore requires the dedicated admission header even though the routed Messages surface
   // keeps accepting all three legacy admission forms.
@@ -961,6 +964,11 @@ async function handleClaudeMessagesWithBudget(
       recordProtocolShadowPlan(logCtx, config, { inbound: "messages", model: requestedModel });
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
+    if (isRec(anthropicBody) && typeof anthropicBody.model === "string"
+      && messagesSecondaryInstanceUnavailable(config, anthropicBody.model, cc)) {
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+      return anthropicErrorResponse(401, "Configured Anthropic OAuth instance is unavailable", "authentication_error");
+    }
     // Only Anthropic holds message-thread state; the error makes Claude Code resend the full turn.
     if (carriesMessageThread(anthropicBody)) {
       logCtx.errorCode = "claude_thread_unsupported";
@@ -1148,10 +1156,16 @@ async function handleClaudeMessagesWithBudget(
 
   // PF-08: a managed-key Anthropic route sends its Messages body natively. The caller-forward
   // passthrough above was decided on the caller's own credential and never reaches this point.
+  const settledInstance = configuredAnthropicInstance(config, settledRoute?.providerName);
+  if (settledRoute?.providerName === "anthropic2" && settledRoute.provider.authMode === "oauth" && !settledInstance) {
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+    return anthropicErrorResponse(401, "Configured Anthropic OAuth instance is unavailable", "authentication_error");
+  }
   const nativeSelector: NativeMessagesSelector = {
     effortRow: !!effortRow, fastRow: !!fastRow, routeSelector: String(internalBody.model ?? ""), claudeCode: cc,
     // PF-10: a stored second OAuth account turns on the bridge's rotation, so it stays there.
-    ...(settledRoute?.provider.authMode === "oauth" ? { oauthFailoverQuorum: hasAnthropicFailoverQuorum() } : {}),
+    ...(settledRoute?.provider.authMode === "oauth" && settledInstance
+      ? { oauthFailoverQuorum: anthropicRoutingFor(settledInstance).hasAnthropicFailoverQuorum() } : {}),
   };
   const nativeDecline = settledRoute && isRec(anthropicBody)
     ? nativeMessagesDeclineReason(settledRoute, anthropicBody, config, nativeSelector)