@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/oauth/anthropic-routing.ts

@@ -1,4 +1,4 @@
-import { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhausted, anthropicModelPercents, anthropicModelWeeklyPercent, clearAnthropicFamilyQuota } from "./anthropic-model-quota";
+import { clearAllAnthropicFamilyQuota, anthropicModelQuotaFor, anthropicModelPercents, anthropicModelWeeklyPercent } from "./anthropic-model-quota";
 /**
  * Opt-in Anthropic OAuth account pool (#294).
  *
@@ -17,7 +17,7 @@ import { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhauste
  * backoff. Classified entitlement/billing 403s use a ten-minute default cooldown.
  * Token refresh failures retain the existing store needsReauth policy.
  */
-import { anthropicRatePauseUntil, clearAnthropicRatePauses, classifyAnthropic429, anthropicRetryAfterMs, pauseAnthropicRateAdmission } from "./anthropic-rate-limit-policy";
+import { clearAllAnthropicRatePauses, anthropicRatePolicyFor, classifyAnthropic429, anthropicRetryAfterMs } from "./anthropic-rate-limit-policy";
 import { REFRESH_SKEW_MS } from "./refresh-policy";
 import { createHash } from "node:crypto";
 import { captureOAuthAccountSelection, commitOAuthAccountSelection, credentialGeneration, getAccountSet, getAccountCredential, getAccountCredentialWithStatus } from "./store";
@@ -31,21 +31,22 @@ import {
   notePoolRotationSuccess,
   pickRoundRobinAccount,
   peekRoundRobinAccount,
-  POOL_KEY_ANTHROPIC,
   seedPoolRotationAccount,
 } from "../codex/pool-rotation";
 import type { OcxAccountPoolQuotaWindow, OcxAccountPoolRotationStrategy, OcxConfig } from "../types";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
-import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "./anthropic-model-routes";
+import { resolveAnthropicModelRouteForInstance, routeCandidates, type AnthropicRouteDecision } from "./anthropic-model-routes";
 import type { ProviderQuota } from "../providers/quota-types";
-import {
-  anthropicCooldownGeneration,
-  clearAnthropicCooldownGenerations,
-  noteAnthropicCooldownMutation,
-} from "../providers/quota/anthropic-cooldown-recovery";
+import { clearAllAnthropicCooldownGenerations, anthropicCooldownRecoveryFor } from "../providers/quota/anthropic-cooldown-recovery";
 import { subscribeAccountSelections, subscribeOAuthAccountPauseChanges, subscribeOAuthAccountRoutingPolicyChanges } from "../lib/account-selection-events";
-import { effectiveAnthropicAccountThreshold } from "./anthropic-account-threshold";
+import { effectiveAnthropicAccountThresholdForInstance } from "./anthropic-account-threshold";
+
+import type { AnthropicAccountPoolConfig } from "../types/anthropic-account-pool";
+import { configuredAnthropicInstance, isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance";
+import { resolveAnthropicAccountPoolConfig } from "./anthropic-pool-config";
+import { anthropicPoolKey } from "./pool-kernel";
+import type { GenerationContext } from "../lib/state-store-sweeper";
 
 /**
  * The read side of a `Headers` object, so a caller can pass the live upstream response's
@@ -54,7 +55,6 @@ import { effectiveAnthropicAccountThreshold } from "./anthropic-account-threshol
  */
 export type AnthropicRateLimitHeaders = Pick<Headers, "get">;
 
-const PROVIDER = "anthropic";
 /** Backoff only when upstream supplies no usable deadline. */
 const DEFAULT_COOLDOWN_MS = 60_000;
 const ACCOUNT_REFUSAL_COOLDOWN_MS = 10 * 60_000;
@@ -68,7 +68,7 @@ const VALID_QUOTA_WINDOWS = new Set<OcxAccountPoolQuotaWindow>(["five-hour", "we
 /** Cap same-request 429 rotations so short Retry-After cannot infinite-loop. */
 export const ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST = 3;
 
-export type AnthropicAccountPoolConfig = NonNullable<OcxConfig["anthropicAccountPool"]>;
+export type { AnthropicAccountPoolConfig } from "../types/anthropic-account-pool";
 
 /** Local admission refusal across async dispatch; never treat it as provider reachability evidence. */
 export class AnthropicAccountCooldownError extends Error {
@@ -105,59 +105,11 @@ interface AffinityEntry {
   lastUsedAt: number;
 }
 
-const upstreamHealth = new Map<string, AccountHealth>();
-const sessionAffinity = new Map<string, AffinityEntry>();
-type OAuthAccountSelection = NonNullable<ReturnType<typeof captureOAuthAccountSelection>>;
-// Undefined means this runtime has not admitted a selection yet; null means consumed.
-// The startup baseline comes from the authoritative store, never a second persisted pin.
-let manualPreference: OAuthAccountSelection | null | undefined;
-let manualSelectionGeneration = 0;
-/** Automatic pointer moves preserve affinity; manual selection revokes older bindings. */
-export function captureAnthropicManualSelectionGeneration(): number { return manualSelectionGeneration; }
-
 function normalizeAffinityComponent(value: string | null | undefined): string {
   const normalized = value?.trim() ?? "";
   return normalized && retainedUtf8Bytes(normalized) <= MAX_AFFINITY_COMPONENT_BYTES ? normalized : "";
 }
 
-export function anthropicAccountPoolConfig(config: OcxConfig): AnthropicAccountPoolConfig {
-  const raw = config.anthropicAccountPool;
-  if (!raw || typeof raw !== "object") return {};
-  return raw;
-}
-
-export function isAnthropicAccountPoolEnabled(config: OcxConfig): boolean {
-  return anthropicAccountPoolConfig(config).enabled === true;
-}
-
-export function anthropicAutoSwitchThreshold(config: OcxConfig): number {
-  const value = anthropicAccountPoolConfig(config).autoSwitchThreshold;
-  if (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 100) return value;
-  return DEFAULT_AUTO_SWITCH_THRESHOLD;
-}
-
-/** Read live policy at selection, not a credential snapshot captured before an await. */
-export function anthropicAccountAutoSwitchThreshold(config: OcxConfig, accountId: string): number {
-  return effectiveAnthropicAccountThreshold(config, getAccountSet(PROVIDER)?.accounts.find(row => row.id === accountId));
-}
-
-/** Strict parse for management APIs — returns null instead of defaulting. */
-export function parseAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow | null {
-  if (typeof raw === "string" && VALID_QUOTA_WINDOWS.has(raw as OcxAccountPoolQuotaWindow)) {
-    return raw as OcxAccountPoolQuotaWindow;
-  }
-  return null;
-}
-
-export function normalizeAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow {
-  return parseAccountPoolQuotaWindow(raw) ?? DEFAULT_QUOTA_WINDOW;
-}
-
-export function anthropicQuotaWindow(config: AnthropicAccountPoolConfig): OcxAccountPoolQuotaWindow {
-  return normalizeAccountPoolQuotaWindow(config.quotaWindow);
-}
-
-/** Accept upstream deadlines within the runtime's date range, without a policy ceiling. */
 function delayUntil(timestamp: number, now: number): number | undefined {
   const delay = timestamp - now;
   return Number.isFinite(new Date(timestamp).getTime()) && Number.isFinite(delay) && delay > 0
@@ -175,7 +127,6 @@ function parseRetryAfterMs(value: string | null | undefined, now: number): numbe
   return delayUntil(Date.parse(text), now);
 }
 
-/** Only rejected windows constrain recovery; all must reopen, so take the latest reset. */
 function parseRateLimitReset(
   headers: AnthropicRateLimitHeaders | null | undefined,
   now: number,
@@ -201,297 +152,6 @@ function parseRateLimitReset(
   return { delayMs: latest - now, rejectedQuotaWindows };
 }
 
-export type AnthropicCooldownRecoveryClaim = Readonly<{
-  accountId: string;
-  cooldownGeneration: number;
-  claimedAt: number;
-}>;
-
-export type AnthropicCooldownRecoverySettlement = "cleared" | "retained" | "superseded";
-
-/**
- * Capture the exact reset-derived refusal a fresh usage probe is allowed to recover.
- *
- * The generation fence matters because the usage request is asynchronous: a newer 429 may
- * arrive while it is in flight, and an older answer must never erase that newer refusal.
- */
-export function captureAnthropicCooldownRecovery(
-  accountId: string,
-  now = Date.now(),
-): AnthropicCooldownRecoveryClaim | null {
-  const entry = upstreamHealth.get(accountId);
-  if (!entry || entry.cooldownUntil <= now || entry.cooldownSource !== "reset-derived") return null;
-  return { accountId, cooldownGeneration: entry.cooldownGeneration, claimedAt: now };
-}
-
-/**
- * Clear only the claimed reset-derived cooldown when a fresh, complete usage result proves
- * headroom in every window that upstream previously reported as rejected.
- */
-export function settleAnthropicCooldownRecovery(
-  claim: AnthropicCooldownRecoveryClaim,
-  quota: ProviderQuota,
-): AnthropicCooldownRecoverySettlement {
-  const entry = upstreamHealth.get(claim.accountId);
-  if (!entry || entry.cooldownSource !== "reset-derived"
-    || entry.cooldownGeneration !== claim.cooldownGeneration
-    || anthropicCooldownGeneration(claim.accountId) !== claim.cooldownGeneration
-    || !Number.isFinite(quota.updatedAt) || quota.updatedAt < claim.claimedAt) return "superseded";
-  const windows = entry.rejectedQuotaWindows;
-  if (!windows?.length) return "retained";
-  const recovered = windows.every(window => {
-    const percent = window === "five-hour" ? quota.fiveHourPercent : quota.weeklyPercent;
-    return typeof percent === "number" && Number.isFinite(percent) && percent >= 0 && percent < 100;
-  });
-  if (!recovered) return "retained";
-  upstreamHealth.delete(claim.accountId);
-  noteAnthropicCooldownMutation(claim.accountId);
-  return "cleared";
-}
-
-export function getAnthropicAccountHealthSnapshot(
-  accountId: string,
-  now = Date.now(),
-): { cooldownUntil?: number; cooldownSource?: AccountHealth["cooldownSource"] } | null {
-  const entry = upstreamHealth.get(accountId);
-  if (!entry) return null;
-  if (entry.cooldownUntil <= now) {
-    upstreamHealth.delete(accountId);
-    noteAnthropicCooldownMutation(accountId);
-    return null;
-  }
-  return { cooldownUntil: entry.cooldownUntil, cooldownSource: entry.cooldownSource };
-}
-
-export function clearAnthropicAccountCooldown(accountId: string): boolean {
-  const cleared = upstreamHealth.delete(accountId);
-  if (cleared) noteAnthropicCooldownMutation(accountId);
-  return cleared;
-}
-
-export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
-  let removed = 0;
-  for (const [accountId, health] of upstreamHealth) {
-    if (health.cooldownUntil > now) continue;
-    upstreamHealth.delete(accountId);
-    noteAnthropicCooldownMutation(accountId);
-    removed += 1;
-  }
-  return removed;
-}
-
-/** Test / logout helper. */
-export function clearAnthropicAccountPoolState(): void {
-  upstreamHealth.clear();
-  clearAnthropicRatePauses();
-  clearAnthropicFamilyQuota();
-  clearAnthropicCooldownGenerations();
-  sessionAffinity.clear();
-  manualPreference = undefined;
-  manualSelectionGeneration++;
-  quorumCache = null;
-}
-
-export function anthropicSessionAffinitySizeForTests(): number {
-  return sessionAffinity.size;
-}
-
-function isCooled(accountId: string, now: number): boolean {
-  return getAnthropicAccountHealthSnapshot(accountId, now) !== null;
-}
-
-function fiveHourKnown(accountId: string): boolean {
-  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
-  return typeof percent === "number" && Number.isFinite(percent);
-}
-
-function weeklyKnown(accountId: string): boolean {
-  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
-  return typeof percent === "number" && Number.isFinite(percent);
-}
-
-function fiveHourScore(accountId: string): number {
-  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
-  return typeof percent === "number" && Number.isFinite(percent)
-    ? Math.max(0, Math.min(100, percent))
-    : UNKNOWN_USAGE_SCORE;
-}
-
-function weeklyScore(accountId: string): number {
-  const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
-  return typeof percent === "number" && Number.isFinite(percent)
-    ? Math.max(0, Math.min(100, percent))
-    : UNKNOWN_USAGE_SCORE;
-}
-
-function exhausted5h(accountId: string): boolean {
-  return fiveHourKnown(accountId) && fiveHourScore(accountId) >= 100;
-}
-
-function hasKnownUsage(config: OcxConfig, accountId: string, model?: string): boolean {
-  if (model) return hasKnownUsage(config, accountId) || anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model) !== undefined;
-  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  switch (window) {
-    case "five-hour": return fiveHourKnown(accountId);
-    case "weekly": return weeklyKnown(accountId);
-    case "max-utilization": return fiveHourKnown(accountId) || weeklyKnown(accountId);
-  }
-}
-
-function usageScore(config: OcxConfig, accountId: string, model?: string): number {
-  if (model) {
-    const family = anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model);
-    if (family === undefined) return usageScore(config, accountId);
-    return hasKnownUsage(config, accountId) ? Math.max(family, usageScore(config, accountId)) : family;
-  }
-  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  switch (window) {
-    case "five-hour": return fiveHourScore(accountId);
-    case "weekly": return weeklyScore(accountId);
-    case "max-utilization": {
-      const scores = [
-        ...(fiveHourKnown(accountId) ? [fiveHourScore(accountId)] : []),
-        ...(weeklyKnown(accountId) ? [weeklyScore(accountId)] : []),
-      ];
-      return scores.length > 0 ? Math.max(...scores) : UNKNOWN_USAGE_SCORE;
-    }
-  }
-}
-
-
-/** Background `local-cli` slots with expired access are not pool-eligible (identity adoption risk). */
-function isPoolCredentialUsable(accountId: string, now: number): boolean {
-  const cred = getAccountCredential(PROVIDER, accountId);
-  if (!cred) return false;
-  if (cred.source !== "local-cli") return true;
-  if (canRefreshAnthropicPoolAccount(accountId)) return true;
-  return cred.expires > now + REFRESH_SKEW_MS;
-}
-
-export function getEligibleAnthropicAccounts(now = Date.now(), model?: string): string[] {
-  const set = getAccountSet(PROVIDER);
-  if (!set) return [];
-  return set.accounts
-    .filter(account =>
-      account.paused !== true && account.needsReauth !== true
-      && !isCooled(account.id, now) && !anthropicRatePauseUntil(account.id, now) && !anthropicFamilyRejected(account.id, model, now)
-      && isPoolCredentialUsable(account.id, now))
-    .map(account => account.id);
-}
-
-/**
- * How long a quorum answer may be reused before the store is consulted again.
- *
- * This predicate now runs on the INITIAL resolution of every Anthropic request, not just after a
- * 429, so an uncached implementation puts a synchronous file read in front of ordinary traffic:
- * `getAccountSet` goes through `loadAuthStore`, which has no cache of its own and chmods the
- * config dir, chmods the secret, reads the whole file and normalizes it on every call.
- *
- * Two seconds matches the generic module's `PRESENCE_CACHE_TTL_MS` for the same reason: short
- * enough that a login in another window is visible before the operator can switch back and send a
- * prompt, long enough that a burst of requests shares one read. The cache holds a BOOLEAN derived
- * from a count — never a credential, never an account id.
- *
- * Staleness is bounded by consequence, not only by the TTL. Explicit invalidation covers the
- * roster mutations this module can see (rotation, pool-state reset, affinity clear on account
- * removal, manual selection), but not one it cannot: a 401 elsewhere flagging an account
- * `needsReauth` drops the real quorum to one while a cached `true` survives for up to 2s.
- *
- * That window is harmless in both directions, which is why it is left rather than plumbed
- * through the store. A stale `true` only lets the caller ASK for an alternate;
- * `pickAlternateAnthropicAccount` re-reads the roster through `getEligibleAnthropicAccounts`,
- * skips the reauth-flagged account and returns `null`, so the 429 surfaces exactly as it would
- * have. A stale `false` costs one un-rotated 429 and self-corrects on the next read. Neither
- * can dispatch on an unusable credential, which is the only outcome worth adding a store hook
- * to prevent.
- */
-const QUORUM_CACHE_TTL_MS = 2_000;
-
-let quorumCache: { value: boolean; readAt: number } | null = null;
-// Pause changes eligibility, not health. Do not reset cooldowns or cancel sent turns.
-subscribeOAuthAccountPauseChanges(provider => { if (provider === PROVIDER) quorumCache = null; });
-// A threshold write must fence in-flight automatic proposals, but it does not
-// revoke an operator's one-dispatch choice. Rebase only that still-owned choice;
-// an intervening account change clears it, so an ABA selection is not resurrected.
-subscribeOAuthAccountRoutingPolicyChanges(event => {
-  if (event.provider !== PROVIDER || !manualPreference) return;
-  if (manualPreference.accountId !== event.before.accountId
-    || manualPreference.revision !== event.before.revision) return;
-  manualPreference = event.after.accountId === manualPreference.accountId ? { ...event.after } : null;
-});
-// Any non-policy selection generation supersedes the pending one-shot choice.
-// Threshold mutations rebase it first, before this generic notification runs.
-subscribeAccountSelections(event => {
-  if (event.provider !== PROVIDER || event.kind !== "oauth" || !manualPreference) return;
-  const current = captureOAuthAccountSelection(PROVIDER);
-  if (current?.accountId !== manualPreference.accountId
-    || current.revision !== manualPreference.revision) manualPreference = null;
-});
-
-/**
- * Whether a 429 has somewhere to go: two or more accounts that could serve traffic if asked.
- *
- * Reactive failover is a safety net, not a routing policy. It runs only AFTER upstream refused,
- * it cannot spread load across a healthy session, and it cannot fire at all unless the operator
- * deliberately logged in twice. So it activates on presence, exactly like an `apiKeyPool` of two
- * keys does in `providers/key-failover.ts` -- and unlike the PROACTIVE pool (affinity,
- * quota-ranked new-session picks, `autoSwitchThreshold`, `strategy`), which changes which
- * account serves a healthy request and therefore stays behind `anthropicAccountPool.enabled`.
- *
- * Cooldowns are deliberately ignored here. They are transient and per-request, while this
- * answers the durable question "did the operator store a second account". Counting a cooled
- * account as absent would switch the feature off for the length of the cooldown -- precisely
- * when it is needed.
- *
- * `isPoolCredentialUsable` is still applied, so the fail-closed background `local-cli` rule
- * holds: an expired background slot is not a quorum and cannot be adopted.
- */
-export function hasAnthropicFailoverQuorum(now = Date.now()): boolean {
-  // Monotonic guard: a caller-supplied `now` that predates the cached read (tests pass explicit
-  // clocks) must not be served from a future entry.
-  if (quorumCache && now >= quorumCache.readAt && now - quorumCache.readAt < QUORUM_CACHE_TTL_MS) {
-    return quorumCache.value;
-  }
-  const set = getAccountSet(PROVIDER);
-  let value = false;
-  if (set) {
-    let usable = 0;
-    for (const account of set.accounts) {
-      if (account.paused === true || account.needsReauth === true) continue;
-      if (!isPoolCredentialUsable(account.id, now)) continue;
-      if (++usable >= 2) { value = true; break; }
-    }
-  }
-  quorumCache = { value, readAt: now };
-  return value;
-}
-
-/** Test seam and manual-recovery hook: force the next quorum question to re-read the store. */
-export function forgetAnthropicFailoverQuorum(): void {
-  quorumCache = null;
-}
-
-/** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
-export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): number | null {
-  const set = getAccountSet(PROVIDER);
-  if (!set) return null;
-  // Once an explicit fallback route has no eligible declared account, selection may use
-  // the ordinary pool. Its earliest usable cooldown must determine the advertised wait.
-  const fallbackExpanded = decision?.fallback === true
-    && !getEligibleAnthropicAccounts(now, model).some(id => decision.accounts.includes(id));
-  let earliest: number | null = null;
-  for (const account of set.accounts) {
-    if (account.paused === true || account.needsReauth === true || !isPoolCredentialUsable(account.id, now)) continue;
-    if (decision && !fallbackExpanded && !decision.accounts.includes(account.id)) continue;
-    const snap = getAnthropicAccountHealthSnapshot(account.id, now);
-    const until = Math.max(snap?.cooldownUntil ?? 0, anthropicRatePauseUntil(account.id, now) ?? 0, anthropicFamilyRetryAt(account.id, model, now) ?? 0);
-    if (until <= now) continue;
-    if (earliest === null || until < earliest) earliest = until;
-  }
-  if (earliest === null || earliest <= now) return null;
-  return Math.max(1, Math.ceil((earliest - now) / 1000));
-}
-
 interface ScoredAccount {
   accountId: string;
   hasKnownUsage: boolean;
@@ -512,110 +172,71 @@ function compareScoredAccounts(a: ScoredAccount, b: ScoredAccount): number {
   return a.score - b.score || a.fiveHourTieBreak - b.fiveHourTieBreak;
 }
 
-function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string, excludedAccountIds?: ReadonlySet<string>): string | null {
-  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
-  const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)
-    || isAnthropicAccountPoolEnabled(config) && anthropicAccountAutoSwitchThreshold(config, id) === 0) : unfiltered;
-  const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
-  const availableOrFallback = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : unfiltered;
-  // Thresholds are preferences, never eligibility. Keep the old lowest-usage fallback
-  // when every candidate is drained, and keep pool-off reactive recovery policy inert.
-  const hasKnownUnderThreshold = isAnthropicAccountPoolEnabled(config)
-    && availableOrFallback.some(id => hasKnownUsage(config, id, model) && isActiveUnderFillFirstThreshold(config, id, model));
-  const eligible = hasKnownUnderThreshold
-    ? availableOrFallback.filter(id => isActiveUnderFillFirstThreshold(config, id, model)) : availableOrFallback;
-  if (eligible.length === 0) return null;
-  const scored: ScoredAccount[] = eligible.map(accountId => ({
-    accountId,
-    hasKnownUsage: hasKnownUsage(config, accountId, model),
-    score: usageScore(config, accountId, model),
-    fiveHourTieBreak: window === "five-hour" ? 0 : fiveHourScore(accountId),
-    // Every window EXCEPT the legacy five-hour default is an explicit opt-in, so
-    // known-before-unknown applies to all of them and to none of the default path.
-    knownFirst: window !== "five-hour",
-  }));
-  let best = scored[0]!;
-  for (let i = 1; i < scored.length; i++) {
-    const candidate = scored[i]!;
-    // Strict `< 0` keeps the earliest eligible account on an exact tie.
-    if (compareScoredAccounts(candidate, best) < 0) best = candidate;
-  }
-  return best.accountId;
-}
-
-/** A fallback route uses ordinary ordering only after it widens beyond its declared accounts. */
 function usesDeclaredRouteOrder(eligible: readonly string[], decision: AnthropicRouteDecision | null): boolean {
   return decision !== null && (!decision.fallback || eligible.some(id => decision.accounts.includes(id)));
 }
 
-/** Next eligible Anthropic account in stable order after `afterId` (wrapping). */
-function pickNextFillFirstAnthropicAccount(
-  config: OcxConfig,
-  afterId: string,
-  eligible: string[],
-  decision: AnthropicRouteDecision | null,
-  model?: string,
-): string | null {
-  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  const available = window === "weekly" ? eligible.filter(id => !exhausted5h(id)
-    || anthropicAccountAutoSwitchThreshold(config, id) === 0) : eligible;
-  const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
-  const candidates = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : eligible;
-  if (candidates.length === 0) return null;
-  const routeOrder = usesDeclaredRouteOrder(eligible, decision);
-  const ordered = routeOrder ? candidates : [...candidates].sort((a, b) => a.localeCompare(b));
-  const set = getAccountSet(PROVIDER);
-  const stableAll = routeOrder ? [...decision!.accounts] : set
-    ? [...set.accounts.map(a => a.id)].sort((a, b) => a.localeCompare(b))
-    : ordered;
-  const startIdx = stableAll.indexOf(afterId);
-  if (startIdx < 0) {
-    for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
-    }
-    return ordered[0] ?? null;
-  }
-  // Skip successors that are also at/above threshold (known drained usage).
-  let fallback: string | null = null;
-  for (let step = 1; step <= stableAll.length; step++) {
-    const candidate = stableAll[(startIdx + step) % stableAll.length]!;
-    if (!candidates.includes(candidate)) continue;
-    if (!fallback) fallback = candidate;
-    if (isActiveUnderFillFirstThreshold(config, candidate, model)) return candidate;
+type OAuthAccountSelection = NonNullable<ReturnType<typeof captureOAuthAccountSelection>>;
+
+export function parseAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow | null {
+  if (typeof raw === "string" && VALID_QUOTA_WINDOWS.has(raw as OcxAccountPoolQuotaWindow)) {
+    return raw as OcxAccountPoolQuotaWindow;
   }
-  return fallback ?? ordered[0] ?? null;
+  return null;
 }
 
-export function pickAlternateAnthropicAccount(
-  config: OcxConfig,
-  excludeId: string,
-  now: number,
-  decision: AnthropicRouteDecision | null,
-  model?: string,
-  excludedAccountIds?: ReadonlySet<string>,
-): string | null {
-  const strategy = anthropicPoolStrategy(config);
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
-  if (strategy === "round-robin") {
-    return peekRoundRobinAccount(POOL_KEY_ANTHROPIC, eligible, stickyLimitForPool(config));
-  }
-  if (strategy === "fill-first") {
-    return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision, model);
-  }
-  return pickLowestUsage(config, excludeId, now, decision, model, excludedAccountIds);
+export function normalizeAccountPoolQuotaWindow(raw: unknown): OcxAccountPoolQuotaWindow {
+  return parseAccountPoolQuotaWindow(raw) ?? DEFAULT_QUOTA_WINDOW;
+}
+
+export function anthropicQuotaWindow(config: AnthropicAccountPoolConfig): OcxAccountPoolQuotaWindow {
+  return normalizeAccountPoolQuotaWindow(config.quotaWindow);
+}
+
+export function formatAnthropicAccountOrdinal(accountId: string): string {
+  return fallbackCodexAccountLogLabel(accountId);
+}
+
+export function formatAnthropicProviderForLog(
+  providerName: string,
+  accountId: string | null | undefined,
+  _config?: OcxConfig,
+): string {
+  if (!accountId) return providerName;
+  return `${providerName}-${formatAnthropicAccountOrdinal(accountId)}`;
 }
 
-function pruneExpiredAffinity(now: number): void {
-  for (const [key, entry] of sessionAffinity) {
-    if (now - entry.lastUsedAt > AFFINITY_IDLE_TTL_MS) sessionAffinity.delete(key);
+export function anthropicSessionKeyFromParts(input: {
+  sessionIdHeader?: string | null;
+  threadIdHeader?: string | null;
+  promptCacheKey?: string | null;
+  clientThreadId?: string | null;
+  /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
+  promptCacheKeyIsSharedCohort?: boolean;
+}): string | null {
+  const preferred = input.clientThreadId?.trim()
+    || input.sessionIdHeader?.trim()
+    || input.threadIdHeader?.trim()
+    || "";
+  if (preferred) {
+    return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
   }
-  if (sessionAffinity.size <= MAX_AFFINITY_ENTRIES) return;
-  const sorted = [...sessionAffinity.entries()].sort((a, b) => a[1].lastUsedAt - b[1].lastUsedAt);
-  const drop = sessionAffinity.size - MAX_AFFINITY_ENTRIES;
-  for (let i = 0; i < drop; i++) sessionAffinity.delete(sorted[i]![0]);
+  if (input.promptCacheKeyIsSharedCohort) return null;
+  const cacheKey = input.promptCacheKey?.trim() ?? "";
+  if (!cacheKey) return null;
+  return cacheKey.length <= 128 ? cacheKey : createHash("sha256").update(cacheKey).digest("hex");
 }
 
+
+export type AnthropicCooldownRecoveryClaim = Readonly<{
+  instance: AnthropicInstanceId;
+  accountId: string;
+  cooldownGeneration: number;
+  claimedAt: number;
+}>;
+
+export type AnthropicCooldownRecoverySettlement = "cleared" | "retained" | "superseded";
+
 export type AnthropicAccountSelectionReason =
   | "pool-disabled"
   | "affinity"
@@ -635,242 +256,1158 @@ export interface AnthropicAccountSelection {
   routePosition?: number;
 }
 
-function stickyLimitForPool(config: OcxConfig): number {
-  return normalizeAccountPoolStickyLimit(anthropicAccountPoolConfig(config).stickyLimit);
+export interface AnthropicSelectionRoutingOptions {
+  config: OcxConfig;
+  sessionKey?: string | null;
+  reason?: AnthropicAccountSelectionReason;
+  expectedCredentialGeneration?: string;
+  routeDecision?: AnthropicRouteDecision | null;
+  model?: string;
 }
 
-function anthropicPoolStrategy(config: OcxConfig): OcxAccountPoolRotationStrategy {
-  return normalizeAccountPoolStrategy(anthropicAccountPoolConfig(config).strategy);
-}
+/** No health/affinity bucket is allocated by a read or an event for a dormant instance. */
+class RoutingMap<K, V> implements Iterable<[K, V]> {
+  private rows?: Map<K, V>;
+  get size(): number { return this.rows?.size ?? 0; }
+  get(key: K): V | undefined { return this.rows?.get(key); }
+  set(key: K, value: V): void { (this.rows ??= new Map()).set(key, value); }
+  delete(key: K): boolean { return this.rows?.delete(key) ?? false; }
+  clear(): void { this.rows = undefined; }
+  *entries(): IterableIterator<[K, V]> { if (this.rows) yield* this.rows; }
+  [Symbol.iterator](): IterableIterator<[K, V]> { return this.entries(); }
+}
+type RoutingFacadeSymbol =
+  | "captureAnthropicManualSelectionGeneration"
+  | "anthropicAccountPoolConfig"
+  | "isAnthropicAccountPoolEnabled"
+  | "anthropicAutoSwitchThreshold"
+  | "anthropicAccountAutoSwitchThreshold"
+  | "captureAnthropicCooldownRecovery"
+  | "settleAnthropicCooldownRecovery"
+  | "getAnthropicAccountHealthSnapshot"
+  | "clearAnthropicAccountCooldown"
+  | "sweepExpiredAnthropicRoutingHealth"
+  | "clearAnthropicAccountPoolState"
+  | "anthropicSessionAffinitySizeForTests"
+  | "getEligibleAnthropicAccounts"
+  | "hasAnthropicFailoverQuorum"
+  | "forgetAnthropicFailoverQuorum"
+  | "getAnthropicPoolRetryAfterSeconds"
+  | "pickAlternateAnthropicAccount"
+  | "resolveAnthropicAccountForSession"
+  | "resolveAnthropicDispatchAccountId"
+  | "bindAnthropicSessionAffinity"
+  | "clearAnthropicSessionAffinityForAccount"
+  | "rotateAnthropicAccountOn429"
+  | "rotateAnthropicAccountOnRefusal"
+  | "recordAnthropicAccount429"
+  | "recordAnthropicAccountRefusal"
+  | "promoteAnthropicActiveAccount"
+  | "commitAnthropicSelectionRouting"
+  | "resetAnthropicRoutingForManualSelection"
+  | "getAnthropicPoolAccessToken"
+  | "getAnthropicPoolAccessSnapshot"
+  | "canRefreshAnthropicPoolAccount";
+export type AnthropicRouting = Readonly<{ instance: AnthropicInstanceId } & Pick<typeof import("./anthropic-routing"), RoutingFacadeSymbol>>;
+type RoutingHandlers = { onPause(): void; onPolicy: Parameters<typeof subscribeOAuthAccountRoutingPolicyChanges>[0]; onSelection: Parameters<typeof subscribeAccountSelections>[0]; reconcile(context: GenerationContext, config?: OcxConfig): number };
+const instances = new Map<AnthropicInstanceId, AnthropicRouting>();
+const handlers = new Map<AnthropicInstanceId, RoutingHandlers>();
+function createAnthropicRouting(instance: AnthropicInstanceId): AnthropicRouting {
+  const PROVIDER = instance;
+  const poolKey = anthropicPoolKey(instance);
+  const { anthropicFamilyRejected, anthropicFamilyRetryAt, anthropicModelExhausted, clearAnthropicFamilyQuota } = anthropicModelQuotaFor(instance);
+  const { anthropicRatePauseUntil, clearAnthropicRatePauses, pauseAnthropicRateAdmission } = anthropicRatePolicyFor(instance);
+  const { anthropicCooldownGeneration, clearAnthropicCooldownGenerations, noteAnthropicCooldownMutation } = anthropicCooldownRecoveryFor(instance);
+  // Request-owned config authorizes selection/commit. Namespace-only credential and roster
+  // methods carry no ambient disk authority; physical consumers recheck their captured config/target.
+  function admitted(config: OcxConfig): boolean { return configuredAnthropicInstance(config, instance) === instance; }
+  const upstreamHealth = new RoutingMap<string, AccountHealth>();
+  const sessionAffinity = new RoutingMap<string, AffinityEntry>();
+  // Undefined means this runtime has not admitted a selection yet; null means consumed.
+  // The startup baseline comes from the authoritative store, never a second persisted pin.
+  let manualPreference: OAuthAccountSelection | null | undefined;
+  let manualSelectionGeneration = 0;
+  /** Automatic pointer moves preserve affinity; manual selection revokes older bindings. */
+  function captureAnthropicManualSelectionGeneration(): number { return manualSelectionGeneration; }
+
+  function anthropicAccountPoolConfig(config: OcxConfig): AnthropicAccountPoolConfig {
+    return resolveAnthropicAccountPoolConfig(config, instance);
+  }
 
-function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string, model?: string): boolean {
-  const threshold = anthropicAccountAutoSwitchThreshold(config, accountId);
-  if (threshold <= 0) return true;
-  const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-  if (window === "weekly" && exhausted5h(accountId)) return false;
-  // Unknown usage must not force fill-first to abandon the active account.
-  if (!hasKnownUsage(config, accountId, model)) return true;
-  return usageScore(config, accountId, model) < threshold;
-}
+  function isAnthropicAccountPoolEnabled(config: OcxConfig): boolean {
+    return anthropicAccountPoolConfig(config).enabled === true;
+  }
 
-/**
- * Fill-first: keep eligible active under threshold; otherwise advance to the next
- * eligible id in stable sorted order after the current active (wrapping).
- */
-function pickFillFirstAnthropicAccount(config: OcxConfig, now: number, decision: AnthropicRouteDecision | null, model?: string): string | null {
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
-  if (eligible.length === 0) return null;
-
-  const set = getAccountSet(PROVIDER);
-  const active = set?.activeAccountId;
-  if (active && eligible.includes(active) && (!model || !anthropicModelExhausted(active, model)) && isActiveUnderFillFirstThreshold(config, active, model)) {
-    return active;
+  function anthropicAutoSwitchThreshold(config: OcxConfig): number {
+    const value = anthropicAccountPoolConfig(config).autoSwitchThreshold;
+    if (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 100) return value;
+    return DEFAULT_AUTO_SWITCH_THRESHOLD;
   }
 
-  if (!active || !set) {
-    const ordered = usesDeclaredRouteOrder(eligible, decision) ? eligible : [...eligible].sort((a, b) => a.localeCompare(b));
-    for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
-    }
-    return ordered[0] ?? null;
+  /** Read live policy at selection, not a credential snapshot captured before an await. */
+  function anthropicAccountAutoSwitchThreshold(config: OcxConfig, accountId: string): number {
+    return effectiveAnthropicAccountThresholdForInstance(instance, config, getAccountSet(PROVIDER)?.accounts.find(row => row.id === accountId));
   }
 
-  return pickNextFillFirstAnthropicAccount(config, active, eligible, decision, model);
-}
 
-/**
- * Unbound new-session pick for round-robin / fill-first. Returns null to fall through
- * to the legacy quota path (or when the strategy is quota).
- */
-function pickUnboundStrategyAccount(
-  config: OcxConfig,
-  now: number,
-  decision: AnthropicRouteDecision | null,
-  model?: string,
-): { accountId: string; reason: "round-robin" | "fill-first" } | null {
-  const strategy = anthropicPoolStrategy(config);
-  if (strategy === "quota") return null;
+  /** Accept upstream deadlines within the runtime's date range, without a policy ceiling. */
 
-  if (strategy === "round-robin") {
-    const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
-    const limit = stickyLimitForPool(config);
-    const headroom = model ? eligible.filter(id => !anthropicModelExhausted(id, model)) : eligible;
-    const picked = peekRoundRobinAccount(POOL_KEY_ANTHROPIC, headroom.length ? headroom : eligible, limit);
-    if (!picked) return null;
-    return { accountId: picked, reason: "round-robin" };
+  /** Only rejected windows constrain recovery; all must reopen, so take the latest reset. */
+
+
+  /**
+   * Capture the exact reset-derived refusal a fresh usage probe is allowed to recover.
+   *
+   * The generation fence matters because the usage request is asynchronous: a newer 429 may
+   * arrive while it is in flight, and an older answer must never erase that newer refusal.
+   */
+  function captureAnthropicCooldownRecovery(
+    accountId: string,
+    now = Date.now(),
+  ): AnthropicCooldownRecoveryClaim | null {
+    const entry = upstreamHealth.get(accountId);
+    if (!entry || entry.cooldownUntil <= now || entry.cooldownSource !== "reset-derived") return null;
+    return { instance, accountId, cooldownGeneration: entry.cooldownGeneration, claimedAt: now };
   }
 
-  if (strategy === "fill-first") {
-    const picked = pickFillFirstAnthropicAccount(config, now, decision, model);
-    if (!picked) return null;
-    return { accountId: picked, reason: "fill-first" };
+  /**
+   * Clear only the claimed reset-derived cooldown when a fresh, complete usage result proves
+   * headroom in every window that upstream previously reported as rejected.
+   */
+  function settleAnthropicCooldownRecovery(
+    claim: AnthropicCooldownRecoveryClaim,
+    quota: ProviderQuota,
+  ): AnthropicCooldownRecoverySettlement {
+    if (claim.instance !== instance) return "superseded";
+    const entry = upstreamHealth.get(claim.accountId);
+    if (!entry || entry.cooldownSource !== "reset-derived"
+      || entry.cooldownGeneration !== claim.cooldownGeneration
+      || anthropicCooldownGeneration(claim.accountId) !== claim.cooldownGeneration
+      || !Number.isFinite(quota.updatedAt) || quota.updatedAt < claim.claimedAt) return "superseded";
+    const windows = entry.rejectedQuotaWindows;
+    if (!windows?.length) return "retained";
+    const recovered = windows.every(window => {
+      const percent = window === "five-hour" ? quota.fiveHourPercent : quota.weeklyPercent;
+      return typeof percent === "number" && Number.isFinite(percent) && percent >= 0 && percent < 100;
+    });
+    if (!recovered) return "retained";
+    upstreamHealth.delete(claim.accountId);
+    noteAnthropicCooldownMutation(claim.accountId);
+    return "cleared";
   }
 
-  return null;
-}
+  function getAnthropicAccountHealthSnapshot(
+    accountId: string,
+    now = Date.now(),
+  ): { cooldownUntil?: number; cooldownSource?: AccountHealth["cooldownSource"] } | null {
+    const entry = upstreamHealth.get(accountId);
+    if (!entry) return null;
+    if (entry.cooldownUntil <= now) {
+      upstreamHealth.delete(accountId);
+      noteAnthropicCooldownMutation(accountId);
+      return null;
+    }
+    return { cooldownUntil: entry.cooldownUntil, cooldownSource: entry.cooldownSource };
+  }
 
-/**
- * Resolve which Anthropic OAuth account should serve this session.
- * When the pool is disabled, retain the active account unless the operator paused it.
- */
-export function resolveAnthropicAccountForSession(
-  sessionKey: string | null | undefined,
-  config: OcxConfig,
-  now = Date.now(),
-  decision: AnthropicRouteDecision | null = null,
-  model?: string,
-): AnthropicAccountSelection {
-  pruneExpiredAffinity(now);
-  const set = getAccountSet(PROVIDER);
-  if (!set || set.accounts.length === 0) return { accountId: null, reason: "none", ...(decision ? { routePosition: decision.position } : {}) };
-  const scoped = decision && !decision.fallback
-    ? set.accounts.filter(account => decision.accounts.includes(account.id)) : set.accounts;
-  if (scoped.length > 0 && scoped.every(account => account.paused === true)) {
-    return { accountId: null, reason: "paused", routePosition: decision?.position };
+  function clearAnthropicAccountCooldown(accountId: string): boolean {
+    const cleared = upstreamHealth.delete(accountId);
+    if (cleared) noteAnthropicCooldownMutation(accountId);
+    return cleared;
   }
 
-  if (manualPreference === undefined) {
-    manualPreference = set.selectionRevision !== undefined
-      ? { accountId: set.activeAccountId, revision: set.selectionRevision }
-      : null;
+  function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
+    let removed = 0;
+    for (const [accountId, health] of upstreamHealth) {
+      if (health.cooldownUntil > now) continue;
+      upstreamHealth.delete(accountId);
+      noteAnthropicCooldownMutation(accountId);
+      removed += 1;
+    }
+    return removed;
   }
 
-  const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
-  if (eligible.length === 0) {
-    // Pause, removal and reauthentication are not cooldown evidence. Classify only
-    // usable members of this strict route (or the ordinary pool after fallback widens).
-    const recoverable = set.accounts.filter(account =>
-      (!decision || decision.fallback || decision.accounts.includes(account.id))
-      && account.paused !== true && account.needsReauth !== true && isPoolCredentialUsable(account.id, now));
-    const cooled = recoverable.length > 0 && recoverable.every(account => isCooled(account.id, now) || anthropicRatePauseUntil(account.id, now) || anthropicFamilyRejected(account.id, model, now));
-    if (cooled || decision) return { accountId: null, reason: cooled ? "all-cooled" : "none", routePosition: decision?.position };
+  /** Test / logout helper. */
+  function clearAnthropicAccountPoolState(): void {
+    for (const [id] of upstreamHealth) noteAnthropicCooldownMutation(id);
+    upstreamHealth.clear();
+    clearAnthropicRatePauses();
+    clearAnthropicFamilyQuota();
+    clearAnthropicCooldownGenerations();
+    sessionAffinity.clear();
+    manualPreference = undefined;
+    manualSelectionGeneration++;
+    quorumCache = null;
   }
 
-  if (!isAnthropicAccountPoolEnabled(config)) {
-    const active = set.accounts.find(account => account.id === set.activeAccountId);
-    // Disabled proactive rotation does not authorize a paused slot or an entirely cooled pool.
-    if (active?.paused || isCooled(set.activeAccountId, now) || anthropicRatePauseUntil(set.activeAccountId, now) || anthropicFamilyRejected(set.activeAccountId, model, now)) {
-      return { accountId: eligible[0] ?? null, reason: eligible.length > 0 ? "only-eligible" : "none" };
-    }
-    return { accountId: set.activeAccountId, reason: "pool-disabled" };
+  function anthropicSessionAffinitySizeForTests(): number {
+    return sessionAffinity.size;
   }
 
-  // A manual choice is a one-dispatch preference, not a lower-priority quota hint.
-  // Consume it only after admission commits, so a failed token lookup cannot spend it.
-  if (manualPreference) {
-    if (manualPreference.accountId !== set.activeAccountId || manualPreference.revision !== set.selectionRevision) {
-      manualPreference = null;
-    } else {
-      const chosen = manualPreference.accountId;
-      const quota = getCachedProviderAccountQuota(PROVIDER, chosen);
-      const exhausted = anthropicModelPercents(quota, model).some(percent => percent >= 100);
-      if (!exhausted && eligible.includes(chosen)) {
-        return { accountId: chosen, reason: "manual", routePosition: decision?.position };
-      }
-    }
+  function isCooled(accountId: string, now: number): boolean {
+    return getAnthropicAccountHealthSnapshot(accountId, now) !== null;
   }
 
-  const key = normalizeAffinityComponent(sessionKey);
-  if (key) {
-    const affined = sessionAffinity.get(key);
-    if (affined && now - affined.lastUsedAt <= AFFINITY_IDLE_TTL_MS) {
-      const stillThere = set.accounts.some(a => a.id === affined.accountId && a.paused !== true && a.needsReauth !== true);
-      const stillUsable = stillThere && !isCooled(affined.accountId, now)
-        && isPoolCredentialUsable(affined.accountId, now);
-      if (stillUsable && eligible.includes(affined.accountId) && (!model || !anthropicModelExhausted(affined.accountId, model))) {
-        return { accountId: affined.accountId, reason: "affinity", routePosition: decision?.position };
-      }
-      // A model route may exclude a healthy binding only for this request. Keep it for
-      // another model; remove bindings only when the account itself became unusable.
-      if (!stillUsable) sessionAffinity.delete(key);
-    }
+  function fiveHourKnown(accountId: string): boolean {
+    const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
+    return typeof percent === "number" && Number.isFinite(percent);
   }
 
-  const strategy = anthropicPoolStrategy(config);
-  // No session identity (Desktop turns without a sticky key): hold the current
-  // active under RR/fill-first instead of treating every turn as a new session.
-  // Round-robin only when there is a real new-session key (or active is unusable).
-  if (!key && (strategy === "round-robin" || strategy === "fill-first")) {
-    const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
-      && !isCooled(set.activeAccountId, now)
-      && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
-    if (activeOk) {
-      return { accountId: set.activeAccountId, reason: "active", routePosition: decision?.position };
-    }
+  function weeklyKnown(accountId: string): boolean {
+    const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
+    return typeof percent === "number" && Number.isFinite(percent);
   }
 
-  const strategyPick = pickUnboundStrategyAccount(config, now, decision, model);
-  if (strategyPick) {
-    return { accountId: strategyPick.accountId, reason: strategyPick.reason, routePosition: decision?.position };
+  function fiveHourScore(accountId: string): number {
+    const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.fiveHourPercent;
+    return typeof percent === "number" && Number.isFinite(percent)
+      ? Math.max(0, Math.min(100, percent))
+      : UNKNOWN_USAGE_SCORE;
   }
 
-  const threshold = anthropicAccountAutoSwitchThreshold(config, set.activeAccountId);
-  const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
-    && !isCooled(set.activeAccountId, now)
-    && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
+  function weeklyScore(accountId: string): number {
+    const percent = getCachedProviderAccountQuota(PROVIDER, accountId)?.weeklyPercent;
+    return typeof percent === "number" && Number.isFinite(percent)
+      ? Math.max(0, Math.min(100, percent))
+      : UNKNOWN_USAGE_SCORE;
+  }
 
-  let accountId: string | null = null;
-  let reason: AnthropicAccountSelectionReason = "none";
+  function exhausted5h(accountId: string): boolean {
+    return fiveHourKnown(accountId) && fiveHourScore(accountId) >= 100;
+  }
 
-  if (threshold > 0) {
+  function hasKnownUsage(config: OcxConfig, accountId: string, model?: string): boolean {
+    if (model) return hasKnownUsage(config, accountId) || anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model) !== undefined;
     const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
-    // Unknown usage must NOT force a switch away from the healthy active account.
-    if (activeOk
-      && !(window === "weekly" && exhausted5h(set.activeAccountId))
-      && (!hasKnownUsage(config, set.activeAccountId, model) || usageScore(config, set.activeAccountId, model) < threshold)) {
-      accountId = set.activeAccountId;
-      reason = "active";
-    } else {
-      const picked = pickLowestUsage(config, undefined, now, decision, model);
-      if (picked) {
-        accountId = picked;
-        reason = activeOk && picked === set.activeAccountId ? "active" : "lowest-usage";
-      } else if (activeOk) {
+    switch (window) {
+      case "five-hour": return fiveHourKnown(accountId);
+      case "weekly": return weeklyKnown(accountId);
+      case "max-utilization": return fiveHourKnown(accountId) || weeklyKnown(accountId);
+    }
+  }
+
+  function usageScore(config: OcxConfig, accountId: string, model?: string): number {
+    if (model) {
+      const family = anthropicModelWeeklyPercent(getCachedProviderAccountQuota(PROVIDER, accountId), model);
+      if (family === undefined) return usageScore(config, accountId);
+      return hasKnownUsage(config, accountId) ? Math.max(family, usageScore(config, accountId)) : family;
+    }
+    const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+    switch (window) {
+      case "five-hour": return fiveHourScore(accountId);
+      case "weekly": return weeklyScore(accountId);
+      case "max-utilization": {
+        const scores = [
+          ...(fiveHourKnown(accountId) ? [fiveHourScore(accountId)] : []),
+          ...(weeklyKnown(accountId) ? [weeklyScore(accountId)] : []),
+        ];
+        return scores.length > 0 ? Math.max(...scores) : UNKNOWN_USAGE_SCORE;
+      }
+    }
+  }
+
+
+  /** Background `local-cli` slots with expired access are not pool-eligible (identity adoption risk). */
+  function isPoolCredentialUsable(accountId: string, now: number): boolean {
+    const cred = getAccountCredential(PROVIDER, accountId);
+    if (!cred) return false;
+    if (instance === "anthropic2" && cred.source === "local-cli") return false;
+    if (cred.source !== "local-cli") return true;
+    if (canRefreshAnthropicPoolAccount(accountId)) return true;
+    return cred.expires > now + REFRESH_SKEW_MS;
+  }
+
+  function getEligibleAnthropicAccounts(now = Date.now(), model?: string): string[] {
+    const set = getAccountSet(PROVIDER);
+    if (!set) return [];
+    return set.accounts
+      .filter(account =>
+        account.paused !== true && account.needsReauth !== true
+        && !isCooled(account.id, now) && !anthropicRatePauseUntil(account.id, now) && !anthropicFamilyRejected(account.id, model, now)
+        && isPoolCredentialUsable(account.id, now))
+      .map(account => account.id);
+  }
+
+  /**
+   * How long a quorum answer may be reused before the store is consulted again.
+   *
+   * This predicate now runs on the INITIAL resolution of every Anthropic request, not just after a
+   * 429, so an uncached implementation puts a synchronous file read in front of ordinary traffic:
+   * `getAccountSet` goes through `loadAuthStore`, which has no cache of its own and chmods the
+   * config dir, chmods the secret, reads the whole file and normalizes it on every call.
+   *
+   * Two seconds matches the generic module's `PRESENCE_CACHE_TTL_MS` for the same reason: short
+   * enough that a login in another window is visible before the operator can switch back and send a
+   * prompt, long enough that a burst of requests shares one read. The cache holds a BOOLEAN derived
+   * from a count — never a credential, never an account id.
+   *
+   * Staleness is bounded by consequence, not only by the TTL. Explicit invalidation covers the
+   * roster mutations this module can see (rotation, pool-state reset, affinity clear on account
+   * removal, manual selection), but not one it cannot: a 401 elsewhere flagging an account
+   * `needsReauth` drops the real quorum to one while a cached `true` survives for up to 2s.
+   *
+   * That window is harmless in both directions, which is why it is left rather than plumbed
+   * through the store. A stale `true` only lets the caller ASK for an alternate;
+   * `pickAlternateAnthropicAccount` re-reads the roster through `getEligibleAnthropicAccounts`,
+   * skips the reauth-flagged account and returns `null`, so the 429 surfaces exactly as it would
+   * have. A stale `false` costs one un-rotated 429 and self-corrects on the next read. Neither
+   * can dispatch on an unusable credential, which is the only outcome worth adding a store hook
+   * to prevent.
+   */
+  const QUORUM_CACHE_TTL_MS = 2_000;
+
+  let quorumCache: { value: boolean; readAt: number } | null = null;
+
+  /**
+   * Whether a 429 has somewhere to go: two or more accounts that could serve traffic if asked.
+   *
+   * Reactive failover is a safety net, not a routing policy. It runs only AFTER upstream refused,
+   * it cannot spread load across a healthy session, and it cannot fire at all unless the operator
+   * deliberately logged in twice. So it activates on presence, exactly like an `apiKeyPool` of two
+   * keys does in `providers/key-failover.ts` -- and unlike the PROACTIVE pool (affinity,
+   * quota-ranked new-session picks, `autoSwitchThreshold`, `strategy`), which changes which
+   * account serves a healthy request and therefore stays behind `anthropicAccountPool.enabled`.
+   *
+   * Cooldowns are deliberately ignored here. They are transient and per-request, while this
+   * answers the durable question "did the operator store a second account". Counting a cooled
+   * account as absent would switch the feature off for the length of the cooldown -- precisely
+   * when it is needed.
+   *
+   * `isPoolCredentialUsable` is still applied, so the fail-closed background `local-cli` rule
+   * holds: an expired background slot is not a quorum and cannot be adopted.
+   */
+  function hasAnthropicFailoverQuorum(now = Date.now()): boolean {
+    // Monotonic guard: a caller-supplied `now` that predates the cached read (tests pass explicit
+    // clocks) must not be served from a future entry.
+    if (quorumCache && now >= quorumCache.readAt && now - quorumCache.readAt < QUORUM_CACHE_TTL_MS) {
+      return quorumCache.value;
+    }
+    const set = getAccountSet(PROVIDER);
+    let value = false;
+    if (set) {
+      let usable = 0;
+      for (const account of set.accounts) {
+        if (account.paused === true || account.needsReauth === true) continue;
+        if (!isPoolCredentialUsable(account.id, now)) continue;
+        if (++usable >= 2) { value = true; break; }
+      }
+    }
+    quorumCache = { value, readAt: now };
+    return value;
+  }
+
+  /** Test seam and manual-recovery hook: force the next quorum question to re-read the store. */
+  function forgetAnthropicFailoverQuorum(): void {
+    quorumCache = null;
+  }
+
+  /** Earliest remaining cooldown among cooled Anthropic accounts, for client Retry-After. */
+  function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): number | null {
+    const set = getAccountSet(PROVIDER);
+    if (!set) return null;
+    // Once an explicit fallback route has no eligible declared account, selection may use
+    // the ordinary pool. Its earliest usable cooldown must determine the advertised wait.
+    const fallbackExpanded = decision?.fallback === true
+      && !getEligibleAnthropicAccounts(now, model).some(id => decision.accounts.includes(id));
+    let earliest: number | null = null;
+    for (const account of set.accounts) {
+      if (account.paused === true || account.needsReauth === true || !isPoolCredentialUsable(account.id, now)) continue;
+      if (decision && !fallbackExpanded && !decision.accounts.includes(account.id)) continue;
+      const snap = getAnthropicAccountHealthSnapshot(account.id, now);
+      const until = Math.max(snap?.cooldownUntil ?? 0, anthropicRatePauseUntil(account.id, now) ?? 0, anthropicFamilyRetryAt(account.id, model, now) ?? 0);
+      if (until <= now) continue;
+      if (earliest === null || until < earliest) earliest = until;
+    }
+    if (earliest === null || earliest <= now) return null;
+    return Math.max(1, Math.ceil((earliest - now) / 1000));
+  }
+
+  function pickLowestUsage(config: OcxConfig, excludeId: string | undefined, now: number, decision: AnthropicRouteDecision | null = null, model?: string, excludedAccountIds?: ReadonlySet<string>): string | null {
+    const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+    const unfiltered = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
+    const available = window === "weekly" ? unfiltered.filter(id => !exhausted5h(id)
+      || isAnthropicAccountPoolEnabled(config) && anthropicAccountAutoSwitchThreshold(config, id) === 0) : unfiltered;
+    const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
+    const availableOrFallback = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : unfiltered;
+    // Thresholds are preferences, never eligibility. Keep the old lowest-usage fallback
+    // when every candidate is drained, and keep pool-off reactive recovery policy inert.
+    const hasKnownUnderThreshold = isAnthropicAccountPoolEnabled(config)
+      && availableOrFallback.some(id => hasKnownUsage(config, id, model) && isActiveUnderFillFirstThreshold(config, id, model));
+    const eligible = hasKnownUnderThreshold
+      ? availableOrFallback.filter(id => isActiveUnderFillFirstThreshold(config, id, model)) : availableOrFallback;
+    if (eligible.length === 0) return null;
+    const scored: ScoredAccount[] = eligible.map(accountId => ({
+      accountId,
+      hasKnownUsage: hasKnownUsage(config, accountId, model),
+      score: usageScore(config, accountId, model),
+      fiveHourTieBreak: window === "five-hour" ? 0 : fiveHourScore(accountId),
+      // Every window EXCEPT the legacy five-hour default is an explicit opt-in, so
+      // known-before-unknown applies to all of them and to none of the default path.
+      knownFirst: window !== "five-hour",
+    }));
+    let best = scored[0]!;
+    for (let i = 1; i < scored.length; i++) {
+      const candidate = scored[i]!;
+      // Strict `< 0` keeps the earliest eligible account on an exact tie.
+      if (compareScoredAccounts(candidate, best) < 0) best = candidate;
+    }
+    return best.accountId;
+  }
+
+  /** A fallback route uses ordinary ordering only after it widens beyond its declared accounts. */
+
+
+  /** Next eligible Anthropic account in stable order after `afterId` (wrapping). */
+  function pickNextFillFirstAnthropicAccount(
+    config: OcxConfig,
+    afterId: string,
+    eligible: string[],
+    decision: AnthropicRouteDecision | null,
+    model?: string,
+  ): string | null {
+    const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+    const available = window === "weekly" ? eligible.filter(id => !exhausted5h(id)
+      || anthropicAccountAutoSwitchThreshold(config, id) === 0) : eligible;
+    const modelAvailable = model ? available.filter(id => !anthropicModelExhausted(id, model)) : available;
+    const candidates = modelAvailable.length > 0 ? modelAvailable : available.length > 0 ? available : eligible;
+    if (candidates.length === 0) return null;
+    const routeOrder = usesDeclaredRouteOrder(eligible, decision);
+    const ordered = routeOrder ? candidates : [...candidates].sort((a, b) => a.localeCompare(b));
+    const set = getAccountSet(PROVIDER);
+    const stableAll = routeOrder ? [...decision!.accounts] : set
+      ? [...set.accounts.map(a => a.id)].sort((a, b) => a.localeCompare(b))
+      : ordered;
+    const startIdx = stableAll.indexOf(afterId);
+    if (startIdx < 0) {
+      for (const id of ordered) {
+        if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
+      }
+      return ordered[0] ?? null;
+    }
+    // Skip successors that are also at/above threshold (known drained usage).
+    let fallback: string | null = null;
+    for (let step = 1; step <= stableAll.length; step++) {
+      const candidate = stableAll[(startIdx + step) % stableAll.length]!;
+      if (!candidates.includes(candidate)) continue;
+      if (!fallback) fallback = candidate;
+      if (isActiveUnderFillFirstThreshold(config, candidate, model)) return candidate;
+    }
+    return fallback ?? ordered[0] ?? null;
+  }
+
+  function pickAlternateAnthropicAccount(
+    config: OcxConfig,
+    excludeId: string,
+    now: number,
+    decision: AnthropicRouteDecision | null,
+    model?: string,
+    excludedAccountIds?: ReadonlySet<string>,
+  ): string | null {
+    if (!admitted(config)) return null;
+    const strategy = anthropicPoolStrategy(config);
+    const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision).filter(id => id !== excludeId && !excludedAccountIds?.has(id));
+    if (strategy === "round-robin") {
+      return peekRoundRobinAccount(poolKey, eligible, stickyLimitForPool(config));
+    }
+    if (strategy === "fill-first") {
+      return pickNextFillFirstAnthropicAccount(config, excludeId, eligible, decision, model);
+    }
+    return pickLowestUsage(config, excludeId, now, decision, model, excludedAccountIds);
+  }
+
+  function pruneExpiredAffinity(now: number): void {
+    for (const [key, entry] of sessionAffinity) {
+      if (now - entry.lastUsedAt > AFFINITY_IDLE_TTL_MS) sessionAffinity.delete(key);
+    }
+    if (sessionAffinity.size <= MAX_AFFINITY_ENTRIES) return;
+    const sorted = [...sessionAffinity.entries()].sort((a, b) => a[1].lastUsedAt - b[1].lastUsedAt);
+    const drop = sessionAffinity.size - MAX_AFFINITY_ENTRIES;
+    for (let i = 0; i < drop; i++) sessionAffinity.delete(sorted[i]![0]);
+  }
+
+  function stickyLimitForPool(config: OcxConfig): number {
+    return normalizeAccountPoolStickyLimit(anthropicAccountPoolConfig(config).stickyLimit);
+  }
+
+  function anthropicPoolStrategy(config: OcxConfig): OcxAccountPoolRotationStrategy {
+    return normalizeAccountPoolStrategy(anthropicAccountPoolConfig(config).strategy);
+  }
+
+  function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string, model?: string): boolean {
+    const threshold = anthropicAccountAutoSwitchThreshold(config, accountId);
+    if (threshold <= 0) return true;
+    const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+    if (window === "weekly" && exhausted5h(accountId)) return false;
+    // Unknown usage must not force fill-first to abandon the active account.
+    if (!hasKnownUsage(config, accountId, model)) return true;
+    return usageScore(config, accountId, model) < threshold;
+  }
+
+  /**
+   * Fill-first: keep eligible active under threshold; otherwise advance to the next
+   * eligible id in stable sorted order after the current active (wrapping).
+   */
+  function pickFillFirstAnthropicAccount(config: OcxConfig, now: number, decision: AnthropicRouteDecision | null, model?: string): string | null {
+    const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
+    if (eligible.length === 0) return null;
+
+    const set = getAccountSet(PROVIDER);
+    const active = set?.activeAccountId;
+    if (active && eligible.includes(active) && (!model || !anthropicModelExhausted(active, model)) && isActiveUnderFillFirstThreshold(config, active, model)) {
+      return active;
+    }
+
+    if (!active || !set) {
+      const ordered = usesDeclaredRouteOrder(eligible, decision) ? eligible : [...eligible].sort((a, b) => a.localeCompare(b));
+      for (const id of ordered) {
+        if (isActiveUnderFillFirstThreshold(config, id, model)) return id;
+      }
+      return ordered[0] ?? null;
+    }
+
+    return pickNextFillFirstAnthropicAccount(config, active, eligible, decision, model);
+  }
+
+  /**
+   * Unbound new-session pick for round-robin / fill-first. Returns null to fall through
+   * to the legacy quota path (or when the strategy is quota).
+   */
+  function pickUnboundStrategyAccount(
+    config: OcxConfig,
+    now: number,
+    decision: AnthropicRouteDecision | null,
+    model?: string,
+  ): { accountId: string; reason: "round-robin" | "fill-first" } | null {
+    const strategy = anthropicPoolStrategy(config);
+    if (strategy === "quota") return null;
+
+    if (strategy === "round-robin") {
+      const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
+      const limit = stickyLimitForPool(config);
+      const headroom = model ? eligible.filter(id => !anthropicModelExhausted(id, model)) : eligible;
+      const picked = peekRoundRobinAccount(poolKey, headroom.length ? headroom : eligible, limit);
+      if (!picked) return null;
+      return { accountId: picked, reason: "round-robin" };
+    }
+
+    if (strategy === "fill-first") {
+      const picked = pickFillFirstAnthropicAccount(config, now, decision, model);
+      if (!picked) return null;
+      return { accountId: picked, reason: "fill-first" };
+    }
+
+    return null;
+  }
+
+  /**
+   * Resolve which Anthropic OAuth account should serve this session.
+   * When the pool is disabled, retain the active account unless the operator paused it.
+   */
+  function resolveAnthropicAccountForSession(
+    sessionKey: string | null | undefined,
+    config: OcxConfig,
+    now = Date.now(),
+    decision: AnthropicRouteDecision | null = null,
+    model?: string,
+  ): AnthropicAccountSelection {
+    if (!admitted(config)) return { accountId: null, reason: "none", routePosition: decision?.position };
+    pruneExpiredAffinity(now);
+    const set = getAccountSet(PROVIDER);
+    if (!set || set.accounts.length === 0) return { accountId: null, reason: "none", ...(decision ? { routePosition: decision.position } : {}) };
+    const scoped = decision && !decision.fallback
+      ? set.accounts.filter(account => decision.accounts.includes(account.id)) : set.accounts;
+    if (scoped.length > 0 && scoped.every(account => account.paused === true)) {
+      return { accountId: null, reason: "paused", routePosition: decision?.position };
+    }
+
+    if (manualPreference === undefined) {
+      manualPreference = set.selectionRevision !== undefined
+        ? { accountId: set.activeAccountId, revision: set.selectionRevision }
+        : null;
+    }
+
+    const eligible = routeCandidates(getEligibleAnthropicAccounts(now, model), decision);
+    if (eligible.length === 0) {
+      // Pause, removal and reauthentication are not cooldown evidence. Classify only
+      // usable members of this strict route (or the ordinary pool after fallback widens).
+      const recoverable = set.accounts.filter(account =>
+        (!decision || decision.fallback || decision.accounts.includes(account.id))
+        && account.paused !== true && account.needsReauth !== true && isPoolCredentialUsable(account.id, now));
+      const cooled = recoverable.length > 0 && recoverable.every(account => isCooled(account.id, now) || anthropicRatePauseUntil(account.id, now) || anthropicFamilyRejected(account.id, model, now));
+      if (cooled || decision) return { accountId: null, reason: cooled ? "all-cooled" : "none", routePosition: decision?.position };
+    }
+
+    if (!isAnthropicAccountPoolEnabled(config)) {
+      const active = set.accounts.find(account => account.id === set.activeAccountId);
+      // Disabled proactive rotation does not authorize a paused slot or an entirely cooled pool.
+      if (active?.paused || isCooled(set.activeAccountId, now) || anthropicRatePauseUntil(set.activeAccountId, now) || anthropicFamilyRejected(set.activeAccountId, model, now)) {
+        return { accountId: eligible[0] ?? null, reason: eligible.length > 0 ? "only-eligible" : "none" };
+      }
+      return { accountId: set.activeAccountId, reason: "pool-disabled" };
+    }
+
+    // A manual choice is a one-dispatch preference, not a lower-priority quota hint.
+    // Consume it only after admission commits, so a failed token lookup cannot spend it.
+    if (manualPreference) {
+      if (manualPreference.accountId !== set.activeAccountId || manualPreference.revision !== set.selectionRevision) {
+        manualPreference = null;
+      } else {
+        const chosen = manualPreference.accountId;
+        const quota = getCachedProviderAccountQuota(PROVIDER, chosen);
+        const exhausted = anthropicModelPercents(quota, model).some(percent => percent >= 100);
+        if (!exhausted && eligible.includes(chosen)) {
+          return { accountId: chosen, reason: "manual", routePosition: decision?.position };
+        }
+      }
+    }
+
+    const key = normalizeAffinityComponent(sessionKey);
+    if (key) {
+      const affined = sessionAffinity.get(key);
+      if (affined && now - affined.lastUsedAt <= AFFINITY_IDLE_TTL_MS) {
+        const stillThere = set.accounts.some(a => a.id === affined.accountId && a.paused !== true && a.needsReauth !== true);
+        const stillUsable = stillThere && !isCooled(affined.accountId, now)
+          && isPoolCredentialUsable(affined.accountId, now);
+        if (stillUsable && eligible.includes(affined.accountId) && (!model || !anthropicModelExhausted(affined.accountId, model))) {
+          return { accountId: affined.accountId, reason: "affinity", routePosition: decision?.position };
+        }
+        // A model route may exclude a healthy binding only for this request. Keep it for
+        // another model; remove bindings only when the account itself became unusable.
+        if (!stillUsable) sessionAffinity.delete(key);
+      }
+    }
+
+    const strategy = anthropicPoolStrategy(config);
+    // No session identity (Desktop turns without a sticky key): hold the current
+    // active under RR/fill-first instead of treating every turn as a new session.
+    // Round-robin only when there is a real new-session key (or active is unusable).
+    if (!key && (strategy === "round-robin" || strategy === "fill-first")) {
+      const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
+        && !isCooled(set.activeAccountId, now)
+        && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
+      if (activeOk) {
+        return { accountId: set.activeAccountId, reason: "active", routePosition: decision?.position };
+      }
+    }
+
+    const strategyPick = pickUnboundStrategyAccount(config, now, decision, model);
+    if (strategyPick) {
+      return { accountId: strategyPick.accountId, reason: strategyPick.reason, routePosition: decision?.position };
+    }
+
+    const threshold = anthropicAccountAutoSwitchThreshold(config, set.activeAccountId);
+    const activeOk = set.accounts.some(a => a.id === set.activeAccountId && a.needsReauth !== true)
+      && !isCooled(set.activeAccountId, now)
+      && eligible.includes(set.activeAccountId) && (!model || !anthropicModelExhausted(set.activeAccountId, model));
+
+    let accountId: string | null = null;
+    let reason: AnthropicAccountSelectionReason = "none";
+
+    if (threshold > 0) {
+      const window = anthropicQuotaWindow(anthropicAccountPoolConfig(config));
+      // Unknown usage must NOT force a switch away from the healthy active account.
+      if (activeOk
+        && !(window === "weekly" && exhausted5h(set.activeAccountId))
+        && (!hasKnownUsage(config, set.activeAccountId, model) || usageScore(config, set.activeAccountId, model) < threshold)) {
         accountId = set.activeAccountId;
         reason = "active";
+      } else {
+        const picked = pickLowestUsage(config, undefined, now, decision, model);
+        if (picked) {
+          accountId = picked;
+          reason = activeOk && picked === set.activeAccountId ? "active" : "lowest-usage";
+        } else if (activeOk) {
+          accountId = set.activeAccountId;
+          reason = "active";
+        }
+      }
+    } else if (activeOk) {
+      accountId = set.activeAccountId;
+      reason = "active";
+    } else {
+      const picked = pickLowestUsage(config, set.activeAccountId, now, decision, model);
+      if (picked) {
+        accountId = picked;
+        reason = "only-eligible";
+      }
+    }
+
+    if (!accountId) {
+      const anyCooled = set.accounts.some(a => !a.paused && (!decision || decision.accounts.includes(a.id)) && isCooled(a.id, now));
+      return { accountId: null, reason: anyCooled ? "all-cooled" : "none", routePosition: decision?.position };
+    }
+
+    return { accountId, reason, routePosition: decision?.position };
+  }
+
+  /** Shared local refusal policy for Responses and native Messages after asynchronous waits. */
+  async function resolveAnthropicDispatchAccountId(
+    config: OcxConfig,
+    sessionKey: string | null = null,
+    decision: AnthropicRouteDecision | null = null,
+    model?: string,
+  ): Promise<string> {
+    const now = Date.now();
+    const selection = resolveAnthropicAccountForSession(sessionKey, config, now, decision, model);
+    if (selection.reason === "all-cooled") {
+      throw new AnthropicAccountCooldownError(getAnthropicPoolRetryAfterSeconds(now, decision, model), decision?.position);
+    }
+    if (selection.reason === "paused" || !selection.accountId || !getEligibleAnthropicAccounts(now, model).includes(selection.accountId)) {
+      const { OAuthAccountPausedError, OAuthLoginRequiredError } = await import("./index");
+      const active = getAccountSet(PROVIDER)?.activeAccountId;
+      // Pool-off fresh admission resolves the active credential first. Preserve that
+      // paused-active refusal when no usable survivor could take over from it.
+      if (selection.reason === "paused" || (!isAnthropicAccountPoolEnabled(config) && active
+        && getAccountCredentialWithStatus(PROVIDER, active)?.paused)) throw new OAuthAccountPausedError();
+      throw new OAuthLoginRequiredError(PROVIDER);
+    }
+    return selection.accountId;
+  }
+
+  function bindAnthropicSessionAffinity(
+    sessionKey: string | null | undefined,
+    accountId: string,
+    now = Date.now(),
+  ): void {
+    const key = normalizeAffinityComponent(sessionKey);
+    if (!key || !normalizeAffinityComponent(accountId)) return;
+    sessionAffinity.set(key, { accountId, lastUsedAt: now });
+    pruneExpiredAffinity(now);
+  }
+
+  function clearAnthropicSessionAffinityForAccount(accountId: string): void {
+    for (const [key, entry] of sessionAffinity) {
+      if (entry.accountId === accountId) sessionAffinity.delete(key);
+    }
+    // The roster just lost or changed a member. This is the account-removal path, so the next
+    // activation question must re-read rather than answer from a count taken while the account
+    // was still present -- otherwise a delete leaves a stale quorum for the length of the TTL.
+    quorumCache = null;
+  }
+
+  /**
+   * Record a 429 for `failedAccountId`, cool it, clear its affinity, and pick a failover
+   * account. Does NOT promote the store active account — caller should promote only after a
+   * successful retry (or token resolve).
+   */
+  function rotateAnthropicAccountOn429(
+    config: OcxConfig,
+    failedAccountId: string,
+    retryAfterHeader: string | null | undefined,
+    sessionKey?: string | null,
+    now = Date.now(),
+    rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+    decision: AnthropicRouteDecision | null = null,
+    model?: string,
+  ): string | null {
+    return rotateAnthropicAccountOnRefusal(config, failedAccountId, 429, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision, model);
+  }
+
+  /** The caller proves that a 403 is an account refusal before entering this pool policy. */
+  function rotateAnthropicAccountOnRefusal(
+    config: OcxConfig,
+    failedAccountId: string,
+    status: 429 | 403,
+    retryAfterHeader: string | null | undefined,
+    sessionKey?: string | null,
+    now = Date.now(),
+    rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+    decision: AnthropicRouteDecision | null = null,
+    model?: string,
+    excludedAccountIds?: ReadonlySet<string>,
+  ): string | null {
+    if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
+
+    // The pool's strategy is a PROACTIVE policy. When the pool is disabled, reactive
+    // presence-only recovery must not silently reactivate round-robin/fill-first merely
+    // because those dormant values remain in config. The quota picker is the neutral
+    // recovery policy already used by the default strategy.
+    const next = isAnthropicAccountPoolEnabled(config)
+      ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model, excludedAccountIds)
+      : pickLowestUsage(config, failedAccountId, now, null, model, excludedAccountIds);
+    if (!next) {
+      console.warn(`[${instance}-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
+      return null;
+    }
+
+    console.warn(status === 403
+      ? `[${instance}-pool] ${decision ? `route:#${decision.position} ` : ""}account unavailable (403); failing over`
+      : `[${instance}-pool] ${decision ? `route:#${decision.position} ` : ""}429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`);
+
+    return next;
+  }
+
+  /** Record the account refusal even when this request has no remaining retry sends. */
+  function recordAnthropicAccount429(
+    config: OcxConfig,
+    failedAccountId: string,
+    retryAfterHeader: string | null | undefined,
+    now = Date.now(),
+    rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+  ): boolean {
+    return recordAnthropicAccountRefusal(config, failedAccountId, 429, retryAfterHeader, now, rateLimitHeaders);
+  }
+
+  /** Account entitlement refusals use a finite backoff; renewing a plan does not require login. */
+  function recordAnthropicAccountRefusal(
+    config: OcxConfig,
+    failedAccountId: string,
+    status: 429 | 403,
+    retryAfterHeader: string | null | undefined,
+    now = Date.now(),
+    rateLimitHeaders?: AnthropicRateLimitHeaders | null,
+  ): boolean {
+    if (!admitted(config)) return false;
+    // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
+    // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
+    // of which move a HEALTHY request and stay opt-in. Rotating away from an account upstream has
+    // just rate-limited is a different thing: it only ever runs after a refusal, and stranding a
+    // 429 while a second logged-in account sits idle is a defect, not a configuration choice.
+    // Presence is the activation rule, the same one an apiKeyPool of two keys already uses.
+    // A sent turn may finish after its account is paused; its one remaining successor is
+    // still a valid reactive recovery even though the current unpaused quorum is now one.
+    if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)
+      && !getAccountCredentialWithStatus(PROVIDER, failedAccountId)?.paused) return false;
+
+    if (status === 429) {
+      const headers = rateLimitHeaders ?? new Headers();
+      const kind = classifyAnthropic429({ get: name => name === "retry-after" ? retryAfterHeader ?? null : headers.get(name) }, now);
+      if (kind !== "shared-quota") {
+        if (kind === "transient-rate") pauseAnthropicRateAdmission(failedAccountId, now + (anthropicRetryAfterMs(retryAfterHeader, now) ?? 100));
+        return false;
+      }
+    }
+
+    // Retry-After first: it is the header written FOR this decision. The rejected window's
+    // reset is the fallback, because a 429 that omits Retry-After still carries it -- and
+    // without that fallback such a refusal cools for the 60s default and the exhausted
+    // account is back in the rotation a minute later.
+    const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
+    const resetDerived = status === 429 && parsedRetry === undefined ? parseRateLimitReset(rateLimitHeaders, now) : undefined;
+    const cooldownMs = parsedRetry ?? resetDerived?.delayMs ?? (status === 403 ? ACCOUNT_REFUSAL_COOLDOWN_MS : DEFAULT_COOLDOWN_MS);
+    const cooldownGeneration = noteAnthropicCooldownMutation(failedAccountId);
+    upstreamHealth.set(failedAccountId, {
+      cooldownUntil: now + cooldownMs,
+      cooldownSource: parsedRetry !== undefined
+        ? "retry-after"
+        : resetDerived !== undefined ? "reset-derived" : "default",
+      ...(resetDerived ? { rejectedQuotaWindows: resetDerived.rejectedQuotaWindows } : {}),
+      cooldownGeneration,
+    });
+    sweepExpiredOnWrite(now);
+    clearAnthropicSessionAffinityForAccount(failedAccountId);
+    notePoolRotationFailure(poolKey, failedAccountId);
+    // The refused account changed the eligible roster even when no retry send remains.
+    quorumCache = null;
+
+    return true;
+  }
+
+  /** Commit the selected account before dispatch; rejected proposals have no routing side effects. */
+  async function promoteAnthropicActiveAccount(
+    accountId: string,
+    expectedSelection: OAuthAccountSelection | null,
+    options: AnthropicSelectionRoutingOptions,
+  ): Promise<OAuthAccountSelection | null> {
+    if (!admitted(options.config)) return null;
+    if (!expectedSelection || !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null).includes(accountId)) return null;
+    const committed = await commitOAuthAccountSelection(PROVIDER, accountId, {
+      expectedSelection,
+      expectedCredentialGeneration: options.expectedCredentialGeneration,
+      requireUsableAccount: true,
+    });
+    if (!committed) return null;
+    return commitAnthropicSelectionRouting(accountId, expectedSelection, committed, options) ? committed : null;
+  }
+
+  /** Main's shared selection owner calls this only after its authoritative commit succeeds. */
+  function commitAnthropicSelectionRouting(
+    accountId: string,
+    expectedSelection: OAuthAccountSelection,
+    committed: OAuthAccountSelection,
+    options: AnthropicSelectionRoutingOptions,
+  ): boolean {
+    if (!admitted(options.config)) return false;
+    if (getAccountCredentialWithStatus(PROVIDER, accountId)?.paused || committed.accountId !== accountId || (options.routeDecision
+      && !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision).includes(accountId))) return false;
+    const current = captureOAuthAccountSelection(PROVIDER);
+    if (current?.accountId !== committed.accountId || current.revision !== committed.revision) return false;
+    if (isAnthropicAccountPoolEnabled(options.config)) {
+      if (anthropicPoolStrategy(options.config) === "round-robin" && options.reason !== "affinity") {
+        const limit = stickyLimitForPool(options.config);
+        const picked = pickRoundRobinAccount(poolKey, routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null), limit);
+        if (picked !== accountId) seedPoolRotationAccount(poolKey, accountId);
+        notePoolRotationSuccess(poolKey, accountId, limit);
       }
+      const key = normalizeAffinityComponent(options.sessionKey);
+      const bound = key ? sessionAffinity.get(key) : undefined;
+      const eligibleAtCommit = options.routeDecision && bound ? getEligibleAnthropicAccounts() : [];
+      const preserveExcludedAffinity = options.routeDecision && bound && bound.accountId !== accountId
+        && Date.now() - bound.lastUsedAt <= AFFINITY_IDLE_TTL_MS
+        && eligibleAtCommit.includes(bound.accountId)
+        && !routeCandidates(eligibleAtCommit, options.routeDecision).includes(bound.accountId);
+      const preservePausedAffinity = bound && (anthropicRatePauseUntil(bound.accountId) !== undefined
+        || anthropicFamilyRejected(bound.accountId, options.model));
+      if (!preserveExcludedAffinity && !preservePausedAffinity) bindAnthropicSessionAffinity(options.sessionKey, accountId);
+    }
+    if (manualPreference === undefined || (manualPreference?.accountId === expectedSelection.accountId
+      && manualPreference.revision === expectedSelection.revision)) manualPreference = null;
+    return true;
+  }
+
+  /**
+   * Manual selection resets session affinity and seeds the RR ring so the next
+   * unbound new session honors the operator-chosen account (Codex parity).
+   */
+  function resetAnthropicRoutingForManualSelection(accountId: string): void {
+    sessionAffinity.clear();
+    manualSelectionGeneration++;
+    manualPreference = captureOAuthAccountSelection(PROVIDER);
+    seedPoolRotationAccount(poolKey, accountId);
+    // A manual account selection is an operator statement about the roster; do not answer the
+    // next activation question from a count read before it.
+    quorumCache = null;
+  }
+
+  /**
+   * Resolve a bearer for pool traffic without adopting a newer global Claude CLI
+   * credential into a background multiauth `local-cli` slot (same fail-closed rule
+   * as quota probes).
+   */
+  async function getAnthropicPoolAccessToken(accountId: string): Promise<string> {
+    const row = getAccountCredentialWithStatus(PROVIDER, accountId);
+    if (row?.paused) {
+      const { OAuthAccountPausedError } = await import("./index");
+      throw new OAuthAccountPausedError();
+    }
+    const stored = row?.credential;
+    if (!stored) {
+      const { OAuthLoginRequiredError } = await import("./index");
+      throw new OAuthLoginRequiredError(PROVIDER);
+    }
+    if (instance === "anthropic2" && stored.source === "local-cli") {
+      const { OAuthLoginRequiredError } = await import("./index");
+      throw new OAuthLoginRequiredError(instance);
+    }
+    if (stored.expires > Date.now() + REFRESH_SKEW_MS) return stored.access;
+    if (!canRefreshAnthropicPoolAccount(accountId)) {
+      throw new Error("background local-cli token expired; refuse CLI-adopting refresh for pool");
     }
-  } else if (activeOk) {
-    accountId = set.activeAccountId;
-    reason = "active";
-  } else {
-    const picked = pickLowestUsage(config, set.activeAccountId, now, decision, model);
-    if (picked) {
-      accountId = picked;
-      reason = "only-eligible";
+    const { getValidAccessTokenForAccount } = await import("./index");
+    return getValidAccessTokenForAccount(PROVIDER, accountId);
+  }
+
+  /** Resolve through the pool's local-CLI restrictions, then bind the exact returned generation. */
+  async function getAnthropicPoolAccessSnapshot(accountId: string): Promise<OAuthAccessSnapshot> {
+    const accessToken = await getAnthropicPoolAccessToken(accountId);
+    const row = getAccountCredentialWithStatus(PROVIDER, accountId);
+    if (row?.paused) {
+      const { OAuthAccountPausedError } = await import("./index");
+      throw new OAuthAccountPausedError();
+    }
+    if (!row || row.needsReauth || row.credential.access !== accessToken
+      || row.credential.expires <= Date.now()) {
+      throw new Error("Anthropic pool credential changed during account selection");
     }
+    return { provider: PROVIDER, accountId, accessToken, generation: credentialGeneration(row.credential) };
+  }
+
+  /**
+   * Whether the pool may refresh this account's token. Background `local-cli` slots must not
+   * adopt the global Claude CLI credential (same fail-closed rule as quota probes).
+   */
+  function canRefreshAnthropicPoolAccount(accountId: string): boolean {
+    const set = getAccountSet(PROVIDER);
+    if (set?.accounts.find(account => account.id === accountId)?.paused) return false;
+    const cred = getAccountCredential(PROVIDER, accountId);
+    if (!cred) return false;
+    if (instance === "anthropic2" && cred.source === "local-cli") return false;
+    if (cred.source !== "local-cli") return true;
+    return set?.activeAccountId === accountId;
   }
 
-  if (!accountId) {
-    const anyCooled = set.accounts.some(a => !a.paused && (!decision || decision.accounts.includes(a.id)) && isCooled(a.id, now));
-    return { accountId: null, reason: anyCooled ? "all-cooled" : "none", routePosition: decision?.position };
+  // Pause changes eligibility, not health. Do not reset cooldowns or cancel sent turns.
+  function onPause(): void { quorumCache = null; }
+  // A threshold write must fence in-flight automatic proposals, but it does not
+  // revoke an operator's one-dispatch choice. Rebase only that still-owned choice;
+  // an intervening account change clears it, so an ABA selection is not resurrected.
+  function onPolicy(event: Parameters<Parameters<typeof subscribeOAuthAccountRoutingPolicyChanges>[0]>[0]): void {
+    if (event.provider !== PROVIDER || !manualPreference) return;
+    if (manualPreference.accountId !== event.before.accountId
+      || manualPreference.revision !== event.before.revision) return;
+    manualPreference = event.after.accountId === manualPreference.accountId ? { ...event.after } : null;
   }
+  // Any non-policy selection generation supersedes the pending one-shot choice.
+  // Threshold mutations rebase it first, before this generic notification runs.
+  function onSelection(event: Parameters<Parameters<typeof subscribeAccountSelections>[0]>[0]): void {
+    if (event.provider !== PROVIDER || event.kind !== "oauth" || !manualPreference) return;
+    const current = captureOAuthAccountSelection(PROVIDER);
+    if (current?.accountId !== manualPreference.accountId
+      || current.revision !== manualPreference.revision) manualPreference = null;
+  }
+
 
-  return { accountId, reason, routePosition: decision?.position };
+  function reconcile(context: GenerationContext, config?: OcxConfig): number {
+    let removed = 0;
+    const valid = (id: string) => context.oauthAccountKeys.has(`${instance}\0${id}`)
+      && (!config || admitted(config));
+    for (const [id] of upstreamHealth) {
+      if (valid(id)) continue;
+      noteAnthropicCooldownMutation(id);
+      upstreamHealth.delete(id);
+      removed++;
+    }
+    for (const [key, entry] of sessionAffinity) {
+      if (valid(entry.accountId)) continue;
+      sessionAffinity.delete(key);
+      removed++;
+    }
+    if (manualPreference && !valid(manualPreference.accountId)) { manualPreference = null; removed++; }
+    if (removed > 0) manualSelectionGeneration++;
+    quorumCache = null;
+    return removed;
+  }
+  handlers.set(instance, { onPause, onPolicy, onSelection, reconcile });
+  return Object.freeze({
+    instance, captureAnthropicManualSelectionGeneration, anthropicAccountPoolConfig,
+    isAnthropicAccountPoolEnabled, anthropicAutoSwitchThreshold, anthropicAccountAutoSwitchThreshold,
+    captureAnthropicCooldownRecovery, settleAnthropicCooldownRecovery, getAnthropicAccountHealthSnapshot,
+    clearAnthropicAccountCooldown, sweepExpiredAnthropicRoutingHealth, clearAnthropicAccountPoolState,
+    anthropicSessionAffinitySizeForTests, getEligibleAnthropicAccounts, hasAnthropicFailoverQuorum,
+    forgetAnthropicFailoverQuorum, getAnthropicPoolRetryAfterSeconds, pickAlternateAnthropicAccount,
+    resolveAnthropicAccountForSession, resolveAnthropicDispatchAccountId, bindAnthropicSessionAffinity,
+    clearAnthropicSessionAffinityForAccount, rotateAnthropicAccountOn429, rotateAnthropicAccountOnRefusal,
+    recordAnthropicAccount429, recordAnthropicAccountRefusal, promoteAnthropicActiveAccount,
+    commitAnthropicSelectionRouting, resetAnthropicRoutingForManualSelection, getAnthropicPoolAccessToken,
+    getAnthropicPoolAccessSnapshot, canRefreshAnthropicPoolAccount,
+  });
+}
+export function anthropicRoutingFor(instance: AnthropicInstanceId): AnthropicRouting {
+  let routing = instances.get(instance);
+  if (!routing) { routing = createAnthropicRouting(instance); instances.set(instance, routing); }
+  return routing;
+}
+export function sweepAllAnthropicRoutingHealth(now = Date.now()): number {
+  let removed = 0;
+  for (const routing of instances.values()) removed += routing.sweepExpiredAnthropicRoutingHealth(now);
+  return removed;
 }
+export function reconcileAnthropicRoutingState(context: GenerationContext, config?: OcxConfig): number {
+  let removed = 0;
+  for (const handler of handlers.values()) removed += handler.reconcile(context, config);
+  return removed;
+}
+export function clearAllAnthropicAccountPoolState(): void {
+  for (const routing of instances.values()) routing.clearAnthropicAccountPoolState();
+  clearAllAnthropicFamilyQuota();
+  clearAllAnthropicRatePauses();
+  clearAllAnthropicCooldownGenerations();
+}
+subscribeOAuthAccountPauseChanges(provider => { if (isAnthropicInstanceId(provider)) handlers.get(provider)?.onPause(); });
+subscribeOAuthAccountRoutingPolicyChanges(event => { if (isAnthropicInstanceId(event.provider)) handlers.get(event.provider)?.onPolicy(event); });
+subscribeAccountSelections(event => { if (isAnthropicInstanceId(event.provider)) handlers.get(event.provider)?.onSelection(event); });
 
-/** Shared local refusal policy for Responses and native Messages after asynchronous waits. */
-export async function resolveAnthropicDispatchAccountId(
+export function captureAnthropicManualSelectionGeneration(): number {
+  return anthropicRoutingFor("anthropic").captureAnthropicManualSelectionGeneration();
+}
+
+export function anthropicAccountPoolConfig(config: OcxConfig): AnthropicAccountPoolConfig {
+  return anthropicRoutingFor("anthropic").anthropicAccountPoolConfig(config);
+}
+
+export function isAnthropicAccountPoolEnabled(config: OcxConfig): boolean {
+  return anthropicRoutingFor("anthropic").isAnthropicAccountPoolEnabled(config);
+}
+
+export function anthropicAutoSwitchThreshold(config: OcxConfig): number {
+  return anthropicRoutingFor("anthropic").anthropicAutoSwitchThreshold(config);
+}
+
+export function anthropicAccountAutoSwitchThreshold(config: OcxConfig, accountId: string): number {
+  return anthropicRoutingFor("anthropic").anthropicAccountAutoSwitchThreshold(config, accountId);
+}
+
+export function captureAnthropicCooldownRecovery(
+  accountId: string,
+  now = Date.now(),
+): AnthropicCooldownRecoveryClaim | null {
+  return anthropicRoutingFor("anthropic").captureAnthropicCooldownRecovery(accountId, now);
+}
+
+export function settleAnthropicCooldownRecovery(
+  claim: AnthropicCooldownRecoveryClaim,
+  quota: ProviderQuota,
+): AnthropicCooldownRecoverySettlement {
+  return anthropicRoutingFor("anthropic").settleAnthropicCooldownRecovery(claim, quota);
+}
+
+export function getAnthropicAccountHealthSnapshot(
+  accountId: string,
+  now = Date.now(),
+): { cooldownUntil?: number; cooldownSource?: AccountHealth["cooldownSource"] } | null {
+  return anthropicRoutingFor("anthropic").getAnthropicAccountHealthSnapshot(accountId, now);
+}
+
+export function clearAnthropicAccountCooldown(accountId: string): boolean {
+  return anthropicRoutingFor("anthropic").clearAnthropicAccountCooldown(accountId);
+}
+
+export function sweepExpiredAnthropicRoutingHealth(now = Date.now()): number {
+  return anthropicRoutingFor("anthropic").sweepExpiredAnthropicRoutingHealth(now);
+}
+
+export function clearAnthropicAccountPoolState(): void {
+  return anthropicRoutingFor("anthropic").clearAnthropicAccountPoolState();
+}
+
+export function anthropicSessionAffinitySizeForTests(): number {
+  return anthropicRoutingFor("anthropic").anthropicSessionAffinitySizeForTests();
+}
+
+export function getEligibleAnthropicAccounts(now = Date.now(), model?: string): string[] {
+  return anthropicRoutingFor("anthropic").getEligibleAnthropicAccounts(now, model);
+}
+
+export function hasAnthropicFailoverQuorum(now = Date.now()): boolean {
+  return anthropicRoutingFor("anthropic").hasAnthropicFailoverQuorum(now);
+}
+
+export function forgetAnthropicFailoverQuorum(): void {
+  return anthropicRoutingFor("anthropic").forgetAnthropicFailoverQuorum();
+}
+
+export function getAnthropicPoolRetryAfterSeconds(now = Date.now(), decision: AnthropicRouteDecision | null = null, model?: string): number | null {
+  return anthropicRoutingFor("anthropic").getAnthropicPoolRetryAfterSeconds(now, decision, model);
+}
+
+export function pickAlternateAnthropicAccount(
+  config: OcxConfig,
+  excludeId: string,
+  now: number,
+  decision: AnthropicRouteDecision | null,
+  model?: string,
+  excludedAccountIds?: ReadonlySet<string>,
+): string | null {
+  return anthropicRoutingFor("anthropic").pickAlternateAnthropicAccount(config, excludeId, now, decision, model, excludedAccountIds);
+}
+
+export function resolveAnthropicAccountForSession(
+  sessionKey: string | null | undefined,
+  config: OcxConfig,
+  now = Date.now(),
+  decision: AnthropicRouteDecision | null = null,
+  model?: string,
+): AnthropicAccountSelection {
+  return anthropicRoutingFor("anthropic").resolveAnthropicAccountForSession(sessionKey, config, now, decision, model);
+}
+
+export function resolveAnthropicDispatchAccountId(
   config: OcxConfig,
   sessionKey: string | null = null,
   decision: AnthropicRouteDecision | null = null,
   model?: string,
 ): Promise<string> {
-  const now = Date.now();
-  const selection = resolveAnthropicAccountForSession(sessionKey, config, now, decision, model);
-  if (selection.reason === "all-cooled") {
-    throw new AnthropicAccountCooldownError(getAnthropicPoolRetryAfterSeconds(now, decision, model), decision?.position);
-  }
-  if (selection.reason === "paused" || !selection.accountId || !getEligibleAnthropicAccounts(now, model).includes(selection.accountId)) {
-    const { OAuthAccountPausedError, OAuthLoginRequiredError } = await import("./index");
-    const active = getAccountSet(PROVIDER)?.activeAccountId;
-    // Pool-off fresh admission resolves the active credential first. Preserve that
-    // paused-active refusal when no usable survivor could take over from it.
-    if (selection.reason === "paused" || (!isAnthropicAccountPoolEnabled(config) && active
-      && getAccountCredentialWithStatus(PROVIDER, active)?.paused)) throw new OAuthAccountPausedError();
-    throw new OAuthLoginRequiredError(PROVIDER);
-  }
-  return selection.accountId;
+  return anthropicRoutingFor("anthropic").resolveAnthropicDispatchAccountId(config, sessionKey, decision, model);
 }
 
 export function bindAnthropicSessionAffinity(
@@ -878,27 +1415,13 @@ export function bindAnthropicSessionAffinity(
   accountId: string,
   now = Date.now(),
 ): void {
-  const key = normalizeAffinityComponent(sessionKey);
-  if (!key || !normalizeAffinityComponent(accountId)) return;
-  sessionAffinity.set(key, { accountId, lastUsedAt: now });
-  pruneExpiredAffinity(now);
+  return anthropicRoutingFor("anthropic").bindAnthropicSessionAffinity(sessionKey, accountId, now);
 }
 
 export function clearAnthropicSessionAffinityForAccount(accountId: string): void {
-  for (const [key, entry] of sessionAffinity) {
-    if (entry.accountId === accountId) sessionAffinity.delete(key);
-  }
-  // The roster just lost or changed a member. This is the account-removal path, so the next
-  // activation question must re-read rather than answer from a count taken while the account
-  // was still present -- otherwise a delete leaves a stale quorum for the length of the TTL.
-  quorumCache = null;
+  return anthropicRoutingFor("anthropic").clearAnthropicSessionAffinityForAccount(accountId);
 }
 
-/**
- * Record a 429 for `failedAccountId`, cool it, clear its affinity, and pick a failover
- * account. Does NOT promote the store active account — caller should promote only after a
- * successful retry (or token resolve).
- */
 export function rotateAnthropicAccountOn429(
   config: OcxConfig,
   failedAccountId: string,
@@ -909,10 +1432,9 @@ export function rotateAnthropicAccountOn429(
   decision: AnthropicRouteDecision | null = null,
   model?: string,
 ): string | null {
-  return rotateAnthropicAccountOnRefusal(config, failedAccountId, 429, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision, model);
+  return anthropicRoutingFor("anthropic").rotateAnthropicAccountOn429(config, failedAccountId, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision, model);
 }
 
-/** The caller proves that a 403 is an account refusal before entering this pool policy. */
 export function rotateAnthropicAccountOnRefusal(
   config: OcxConfig,
   failedAccountId: string,
@@ -925,28 +1447,9 @@ export function rotateAnthropicAccountOnRefusal(
   model?: string,
   excludedAccountIds?: ReadonlySet<string>,
 ): string | null {
-  if (!recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders)) return null;
-
-  // The pool's strategy is a PROACTIVE policy. When the pool is disabled, reactive
-  // presence-only recovery must not silently reactivate round-robin/fill-first merely
-  // because those dormant values remain in config. The quota picker is the neutral
-  // recovery policy already used by the default strategy.
-  const next = isAnthropicAccountPoolEnabled(config)
-    ? pickAlternateAnthropicAccount(config, failedAccountId, now, decision, model, excludedAccountIds)
-    : pickLowestUsage(config, failedAccountId, now, null, model, excludedAccountIds);
-  if (!next) {
-    console.warn(`[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}no eligible replacement; returning ${status}`);
-    return null;
-  }
-
-  console.warn(status === 403
-    ? `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}account unavailable (403); failing over`
-    : `[anthropic-pool] ${decision ? `route:#${decision.position} ` : ""}429 on ${formatAnthropicAccountOrdinal(failedAccountId)}; failing over to ${formatAnthropicAccountOrdinal(next)}`);
-
-  return next;
+  return anthropicRoutingFor("anthropic").rotateAnthropicAccountOnRefusal(config, failedAccountId, status, retryAfterHeader, sessionKey, now, rateLimitHeaders, decision, model, excludedAccountIds);
 }
 
-/** Record the account refusal even when this request has no remaining retry sends. */
 export function recordAnthropicAccount429(
   config: OcxConfig,
   failedAccountId: string,
@@ -954,10 +1457,9 @@ export function recordAnthropicAccount429(
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
 ): boolean {
-  return recordAnthropicAccountRefusal(config, failedAccountId, 429, retryAfterHeader, now, rateLimitHeaders);
+  return anthropicRoutingFor("anthropic").recordAnthropicAccount429(config, failedAccountId, retryAfterHeader, now, rateLimitHeaders);
 }
 
-/** Account entitlement refusals use a finite backoff; renewing a plan does not require login. */
 export function recordAnthropicAccountRefusal(
   config: OcxConfig,
   failedAccountId: string,
@@ -966,228 +1468,62 @@ export function recordAnthropicAccountRefusal(
   now = Date.now(),
   rateLimitHeaders?: AnthropicRateLimitHeaders | null,
 ): boolean {
-  // Reactive 429 failover is NOT gated on the pool flag. That flag buys PROACTIVE routing --
-  // session affinity, quota-ranked new-session selection, autoSwitchThreshold, strategy -- all
-  // of which move a HEALTHY request and stay opt-in. Rotating away from an account upstream has
-  // just rate-limited is a different thing: it only ever runs after a refusal, and stranding a
-  // 429 while a second logged-in account sits idle is a defect, not a configuration choice.
-  // Presence is the activation rule, the same one an apiKeyPool of two keys already uses.
-  // A sent turn may finish after its account is paused; its one remaining successor is
-  // still a valid reactive recovery even though the current unpaused quorum is now one.
-  if (!isAnthropicAccountPoolEnabled(config) && !hasAnthropicFailoverQuorum(now)
-    && !getAccountCredentialWithStatus(PROVIDER, failedAccountId)?.paused) return false;
-
-  if (status === 429) {
-    const headers = rateLimitHeaders ?? new Headers();
-    const kind = classifyAnthropic429({ get: name => name === "retry-after" ? retryAfterHeader ?? null : headers.get(name) }, now);
-    if (kind !== "shared-quota") {
-      if (kind === "transient-rate") pauseAnthropicRateAdmission(failedAccountId, now + (anthropicRetryAfterMs(retryAfterHeader, now) ?? 100));
-      return false;
-    }
-  }
-
-  // Retry-After first: it is the header written FOR this decision. The rejected window's
-  // reset is the fallback, because a 429 that omits Retry-After still carries it -- and
-  // without that fallback such a refusal cools for the 60s default and the exhausted
-  // account is back in the rotation a minute later.
-  const parsedRetry = parseRetryAfterMs(retryAfterHeader, now);
-  const resetDerived = status === 429 && parsedRetry === undefined ? parseRateLimitReset(rateLimitHeaders, now) : undefined;
-  const cooldownMs = parsedRetry ?? resetDerived?.delayMs ?? (status === 403 ? ACCOUNT_REFUSAL_COOLDOWN_MS : DEFAULT_COOLDOWN_MS);
-  const cooldownGeneration = noteAnthropicCooldownMutation(failedAccountId);
-  upstreamHealth.set(failedAccountId, {
-    cooldownUntil: now + cooldownMs,
-    cooldownSource: parsedRetry !== undefined
-      ? "retry-after"
-      : resetDerived !== undefined ? "reset-derived" : "default",
-    ...(resetDerived ? { rejectedQuotaWindows: resetDerived.rejectedQuotaWindows } : {}),
-    cooldownGeneration,
-  });
-  sweepExpiredOnWrite(now);
-  clearAnthropicSessionAffinityForAccount(failedAccountId);
-  notePoolRotationFailure(POOL_KEY_ANTHROPIC, failedAccountId);
-  // The refused account changed the eligible roster even when no retry send remains.
-  quorumCache = null;
-
-  return true;
-}
-
-export interface AnthropicSelectionRoutingOptions {
-  config: OcxConfig;
-  sessionKey?: string | null;
-  reason?: AnthropicAccountSelectionReason;
-  expectedCredentialGeneration?: string;
-  routeDecision?: AnthropicRouteDecision | null;
-  model?: string;
+  return anthropicRoutingFor("anthropic").recordAnthropicAccountRefusal(config, failedAccountId, status, retryAfterHeader, now, rateLimitHeaders);
 }
 
-/** Commit the selected account before dispatch; rejected proposals have no routing side effects. */
-export async function promoteAnthropicActiveAccount(
+export function promoteAnthropicActiveAccount(
   accountId: string,
   expectedSelection: OAuthAccountSelection | null,
   options: AnthropicSelectionRoutingOptions,
 ): Promise<OAuthAccountSelection | null> {
-  if (!expectedSelection || !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null).includes(accountId)) return null;
-  const committed = await commitOAuthAccountSelection(PROVIDER, accountId, {
-    expectedSelection,
-    expectedCredentialGeneration: options.expectedCredentialGeneration,
-    requireUsableAccount: true,
-  });
-  if (!committed) return null;
-  return commitAnthropicSelectionRouting(accountId, expectedSelection, committed, options) ? committed : null;
+  return anthropicRoutingFor("anthropic").promoteAnthropicActiveAccount(accountId, expectedSelection, options);
 }
 
-/** Main's shared selection owner calls this only after its authoritative commit succeeds. */
 export function commitAnthropicSelectionRouting(
   accountId: string,
   expectedSelection: OAuthAccountSelection,
   committed: OAuthAccountSelection,
   options: AnthropicSelectionRoutingOptions,
 ): boolean {
-  if (getAccountCredentialWithStatus(PROVIDER, accountId)?.paused || committed.accountId !== accountId || (options.routeDecision
-    && !routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision).includes(accountId))) return false;
-  const current = captureOAuthAccountSelection(PROVIDER);
-  if (current?.accountId !== committed.accountId || current.revision !== committed.revision) return false;
-  if (isAnthropicAccountPoolEnabled(options.config)) {
-    if (anthropicPoolStrategy(options.config) === "round-robin" && options.reason !== "affinity") {
-      const limit = stickyLimitForPool(options.config);
-      const picked = pickRoundRobinAccount(POOL_KEY_ANTHROPIC, routeCandidates(getEligibleAnthropicAccounts(Date.now(), options.model), options.routeDecision ?? null), limit);
-      if (picked !== accountId) seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
-      notePoolRotationSuccess(POOL_KEY_ANTHROPIC, accountId, limit);
-    }
-    const key = normalizeAffinityComponent(options.sessionKey);
-    const bound = key ? sessionAffinity.get(key) : undefined;
-    const eligibleAtCommit = options.routeDecision && bound ? getEligibleAnthropicAccounts() : [];
-    const preserveExcludedAffinity = options.routeDecision && bound && bound.accountId !== accountId
-      && Date.now() - bound.lastUsedAt <= AFFINITY_IDLE_TTL_MS
-      && eligibleAtCommit.includes(bound.accountId)
-      && !routeCandidates(eligibleAtCommit, options.routeDecision).includes(bound.accountId);
-    const preservePausedAffinity = bound && (anthropicRatePauseUntil(bound.accountId) !== undefined
-      || anthropicFamilyRejected(bound.accountId, options.model));
-    if (!preserveExcludedAffinity && !preservePausedAffinity) bindAnthropicSessionAffinity(options.sessionKey, accountId);
-  }
-  if (manualPreference === undefined || (manualPreference?.accountId === expectedSelection.accountId
-    && manualPreference.revision === expectedSelection.revision)) manualPreference = null;
-  return true;
+  return anthropicRoutingFor("anthropic").commitAnthropicSelectionRouting(accountId, expectedSelection, committed, options);
 }
 
-/**
- * Manual selection resets session affinity and seeds the RR ring so the next
- * unbound new session honors the operator-chosen account (Codex parity).
- */
 export function resetAnthropicRoutingForManualSelection(accountId: string): void {
-  sessionAffinity.clear();
-  manualSelectionGeneration++;
-  manualPreference = captureOAuthAccountSelection(PROVIDER);
-  seedPoolRotationAccount(POOL_KEY_ANTHROPIC, accountId);
-  // A manual account selection is an operator statement about the roster; do not answer the
-  // next activation question from a count read before it.
-  quorumCache = null;
-}
-
-/**
- * Resolve a bearer for pool traffic without adopting a newer global Claude CLI
- * credential into a background multiauth `local-cli` slot (same fail-closed rule
- * as quota probes).
- */
-export async function getAnthropicPoolAccessToken(accountId: string): Promise<string> {
-  const row = getAccountCredentialWithStatus(PROVIDER, accountId);
-  if (row?.paused) {
-    const { OAuthAccountPausedError } = await import("./index");
-    throw new OAuthAccountPausedError();
-  }
-  const stored = row?.credential;
-  if (!stored) {
-    const { OAuthLoginRequiredError } = await import("./index");
-    throw new OAuthLoginRequiredError(PROVIDER);
-  }
-  if (stored.expires > Date.now() + REFRESH_SKEW_MS) return stored.access;
-  if (!canRefreshAnthropicPoolAccount(accountId)) {
-    throw new Error("background local-cli token expired; refuse CLI-adopting refresh for pool");
-  }
-  const { getValidAccessTokenForAccount } = await import("./index");
-  return getValidAccessTokenForAccount(PROVIDER, accountId);
+  return anthropicRoutingFor("anthropic").resetAnthropicRoutingForManualSelection(accountId);
 }
 
-/** Resolve through the pool's local-CLI restrictions, then bind the exact returned generation. */
-export async function getAnthropicPoolAccessSnapshot(accountId: string): Promise<OAuthAccessSnapshot> {
-  const accessToken = await getAnthropicPoolAccessToken(accountId);
-  const row = getAccountCredentialWithStatus(PROVIDER, accountId);
-  if (row?.paused) {
-    const { OAuthAccountPausedError } = await import("./index");
-    throw new OAuthAccountPausedError();
-  }
-  if (!row || row.needsReauth || row.credential.access !== accessToken
-    || row.credential.expires <= Date.now()) {
-    throw new Error("Anthropic pool credential changed during account selection");
-  }
-  return { provider: PROVIDER, accountId, accessToken, generation: credentialGeneration(row.credential) };
+export function getAnthropicPoolAccessToken(accountId: string): Promise<string> {
+  return anthropicRoutingFor("anthropic").getAnthropicPoolAccessToken(accountId);
 }
 
-/** Resolve a direct Anthropic helper send through the same model route as primary traffic. */
-export async function getAnthropicSidecarAccessToken(
-  providerName: string,
-  model: string,
-  config?: OcxConfig,
-): Promise<string> {
-  if (providerName !== PROVIDER || !config || !isAnthropicAccountPoolEnabled(config)) {
-    const { getValidAccessToken } = await import("./index");
-    return getValidAccessToken(providerName);
-  }
-  const route = resolveAnthropicModelRoute(config, model);
-  if (route.error) throw new Error("Invalid Anthropic model route configuration");
-  const selection = resolveAnthropicAccountForSession(null, config, Date.now(), route.decision, model);
-  if (!selection.accountId) throw new Error("No permitted Anthropic account is available for this model");
-  return (await getAnthropicPoolAccessSnapshot(selection.accountId)).accessToken;
+export function getAnthropicPoolAccessSnapshot(accountId: string): Promise<OAuthAccessSnapshot> {
+  return anthropicRoutingFor("anthropic").getAnthropicPoolAccessSnapshot(accountId);
 }
 
-/**
- * Whether the pool may refresh this account's token. Background `local-cli` slots must not
- * adopt the global Claude CLI credential (same fail-closed rule as quota probes).
- */
 export function canRefreshAnthropicPoolAccount(accountId: string): boolean {
-  const set = getAccountSet(PROVIDER);
-  if (set?.accounts.find(account => account.id === accountId)?.paused) return false;
-  const cred = getAccountCredential(PROVIDER, accountId);
-  if (!cred) return false;
-  if (cred.source !== "local-cli") return true;
-  return set?.activeAccountId === accountId;
-}
-
-export function formatAnthropicAccountOrdinal(accountId: string): string {
-  return fallbackCodexAccountLogLabel(accountId);
+  return anthropicRoutingFor("anthropic").canRefreshAnthropicPoolAccount(accountId);
 }
 
-export function formatAnthropicProviderForLog(
-  providerName: string,
-  accountId: string | null | undefined,
-  _config?: OcxConfig,
-): string {
-  if (!accountId) return providerName;
-  return `${providerName}-${formatAnthropicAccountOrdinal(accountId)}`;
+export async function getAnthropicSidecarAccessTokenForInstance(instance: AnthropicInstanceId, model: string, config: OcxConfig): Promise<string> {
+  if (configuredAnthropicInstance(config, instance) !== instance) {
+    const { OAuthLoginRequiredError } = await import("./index");
+    throw new OAuthLoginRequiredError(instance);
+  }
+  const routing = anthropicRoutingFor(instance);
+  const route = resolveAnthropicModelRouteForInstance(instance, config, model);
+  if (route.error) throw new Error("Invalid Anthropic model route configuration");
+  const selection = routing.resolveAnthropicAccountForSession(null, config, Date.now(), route.decision, model);
+  if (!selection.accountId) throw new Error("No permitted Anthropic account is available for this model");
+  return (await routing.getAnthropicPoolAccessSnapshot(selection.accountId)).accessToken;
 }
-
-/**
- * Build a sticky session key from Claude/Responses headers.
- * Prefer true session/thread ids; do not use Desktop shared cache-cohort prompt_cache_key
- * alone (those collide across conversations).
- */
-export function anthropicSessionKeyFromParts(input: {
-  sessionIdHeader?: string | null;
-  threadIdHeader?: string | null;
-  promptCacheKey?: string | null;
-  clientThreadId?: string | null;
-  /** When true, prompt_cache_key is a shared Desktop cohort — ignore it for affinity. */
-  promptCacheKeyIsSharedCohort?: boolean;
-}): string | null {
-  const preferred = input.clientThreadId?.trim()
-    || input.sessionIdHeader?.trim()
-    || input.threadIdHeader?.trim()
-    || "";
-  if (preferred) {
-    return preferred.length <= 128 ? preferred : createHash("sha256").update(preferred).digest("hex");
+export async function getAnthropicSidecarAccessToken(providerName: string, model: string, config?: OcxConfig): Promise<string> {
+  if (providerName === "anthropic2") {
+    if (!config) { const { OAuthLoginRequiredError } = await import("./index"); throw new OAuthLoginRequiredError(providerName); }
+    return getAnthropicSidecarAccessTokenForInstance("anthropic2", model, config);
   }
-  if (input.promptCacheKeyIsSharedCohort) return null;
-  const cacheKey = input.promptCacheKey?.trim() ?? "";
-  if (!cacheKey) return null;
-  return cacheKey.length <= 128 ? cacheKey : createHash("sha256").update(cacheKey).digest("hex");
+  if (providerName !== "anthropic" || !config || !isAnthropicAccountPoolEnabled(config)) {
+    const { getValidAccessToken } = await import("./index");
+    return getValidAccessToken(providerName);
+  }
+  return getAnthropicSidecarAccessTokenForInstance("anthropic", model, config);
 }