@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -1,48 +1,15 @@
 import { mergeAnthropicFamilyWindows, hasAnthropicFamilyEnumeration } from "./anthropic-family-headers";
-import { getCachedProviderAccountQuota } from "./account-cache";
-import { observeAnthropicFamilyQuota, anthropicFamilyQuotaGeneration } from "../../oauth/anthropic-model-quota";
-import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus } from "../../oauth/store";
+import { getCachedProviderAccountQuota, captureProviderAccountQuotaEpoch } from "./account-cache";
+import { anthropicModelQuotaFor } from "../../oauth/anthropic-model-quota";
+import type { AnthropicInstanceId } from "../anthropic-instance-id";
+import type { GenerationContext } from "../../lib/state-store-sweeper";
+import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
 import type { ProviderQuota } from "../quota-types";
 
 export class AnthropicQuotaProbeOwnershipError extends Error {}
 
-/** Check live pause and bearer ownership at the last synchronous step before usage dispatch. */
-export function assertAnthropicQuotaSendAllowed(accountId: string, token: string): void {
-  const row = getAccountCredentialWithStatus("anthropic", accountId);
-  if (!row || row.paused || row.needsReauth || row.credential.access !== token) {
-    throw new AnthropicQuotaProbeOwnershipError("anthropic quota account is no longer eligible");
-  }
-}
-
-const cooldownGenerationByAccount = new Map<string, number>();
-let nextCooldownGeneration = 1;
-let afterSettlementForTests: (() => void) | undefined;
-
-export function setAnthropicQuotaAfterSettlementForTests(hook: (() => void) | undefined): void {
-  afterSettlementForTests = hook;
-}
-
-/** Monotonic per-account fence shared by routing mutations and quota publication. */
-export function anthropicCooldownGeneration(accountId: string): number {
-  return cooldownGenerationByAccount.get(accountId) ?? 0;
-}
-
-/** Keep same-state quota calls joinable while moving post-429 calls to a fresh flight. */
-export function anthropicCooldownFlightKey(baseKey: string, accountId: string): string {
-  return `${baseKey}\0anthropic-cooldown:${anthropicCooldownGeneration(accountId)}`;
-}
-
-export function noteAnthropicCooldownMutation(accountId: string): number {
-  const generation = nextCooldownGeneration++;
-  cooldownGenerationByAccount.set(accountId, generation);
-  return generation;
-}
-
-export function clearAnthropicCooldownGenerations(): void {
-  cooldownGenerationByAccount.clear();
-}
-
 export type AnthropicCooldownRecoveryProbe = Readonly<{
+  instance: AnthropicInstanceId;
   requiresFreshDispatch: boolean;
   isCurrentCredential(): boolean;
   isCurrentFamily(): boolean;
@@ -51,86 +18,230 @@ export type AnthropicCooldownRecoveryProbe = Readonly<{
 }>;
 
 export type AnthropicQuotaRecoveryResult = Readonly<{
+  instance: AnthropicInstanceId;
   quota: ProviderQuota;
   /** Must be checked synchronously at each publication boundary. */
   isCurrent(): boolean;
 }>;
 
-/**
- * Bind a quota probe to both the credential and cooldown generations it observed before
- * dispatch. A successful response may otherwise arrive after either credential replacement
- * or a newer 429 and incorrectly make unrelated state eligible.
- */
-export async function captureAnthropicCooldownRecoveryProbe(
-  accountId: string,
-  accessToken: string,
-): Promise<AnthropicCooldownRecoveryProbe | null> {
-  const credential = getAccountCredential("anthropic", accountId);
-  if (!credential || credential.access !== accessToken) return null;
-  const generation = credentialGeneration(credential);
-  // Lazy because anthropic-routing reads the quota cache on normal request routing.
-  const routing = await import("../../oauth/anthropic-routing");
-  const cooldownGeneration = anthropicCooldownGeneration(accountId);
-  const familyGeneration = anthropicFamilyQuotaGeneration(accountId);
-  const claim = routing.captureAnthropicCooldownRecovery(accountId);
-  const isCurrentCredential = () => {
-    const current = getAccountCredential("anthropic", accountId);
-    return !!current && credentialGeneration(current) === generation;
-  };
-  return {
-    requiresFreshDispatch: claim !== null,
-    isCurrentCredential,
-    isCurrentFamily: () => anthropicFamilyQuotaGeneration(accountId) === familyGeneration,
-    isCurrent: () => isCurrentCredential()
-      && anthropicCooldownGeneration(accountId) === cooldownGeneration,
-    settle: quota => claim === null ? "retained"
-      : routing.settleAnthropicCooldownRecovery(claim, quota),
-  };
-}
+function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
+  const familyGeneration = (accountId: string) => anthropicModelQuotaFor(instance).anthropicFamilyQuotaGeneration(accountId);
 
-/** Run one authoritative usage read and publish its recovery effect only while still owned. */
-export async function probeAnthropicQuotaWithRecovery(
-  accountId: string,
-  accessToken: string,
-  read: (requireFreshDispatch: boolean) => Promise<ProviderQuota | null>,
-  mayPublish: () => boolean,
-): Promise<AnthropicQuotaRecoveryResult | null> {
-  const probe = await captureAnthropicCooldownRecoveryProbe(accountId, accessToken);
-  if (!probe) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost credential ownership");
-  let quota: ProviderQuota | null;
-  try { quota = await read(probe.requiresFreshDispatch); }
-  catch (error) {
-    if (!probe.isCurrent() || !mayPublish()) throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe failure is stale");
-    throw error;
+  /** Check live pause and bearer ownership at the last synchronous step before usage dispatch. */
+  function assertAnthropicQuotaSendAllowed(accountId: string, token: string): void {
+    const row = getAccountCredentialWithStatus(instance, accountId);
+    if (!row || row.paused || row.needsReauth || row.credential.access !== token) {
+      throw new AnthropicQuotaProbeOwnershipError(`${instance} quota account is no longer eligible`);
+    }
+  }
+
+  let cooldownGenerationByAccount: Map<string, number> | undefined;
+  let emptyGeneration = 0;
+  let nextCooldownGeneration = 1;
+  // Account lifetime is distinct from refusal/probe mutations; a valid refusal must not revoke itself.
+  let accountIncarnations: Map<string, number> | undefined;
+  let emptyAccountIncarnation = 0;
+  let nextAccountIncarnation = 1;
+  let afterSettlementForTests: (() => void) | undefined;
+
+  function setAnthropicQuotaAfterSettlementForTests(hook: (() => void) | undefined): void {
+    afterSettlementForTests = hook;
+  }
+
+  /** Monotonic per-account fence shared by routing mutations and quota publication. */
+  function anthropicCooldownGeneration(accountId: string): number {
+    return cooldownGenerationByAccount?.get(accountId) ?? emptyGeneration;
+  }
+
+  /** Keep same-state quota calls joinable while moving post-429 calls to a fresh flight. */
+  function anthropicCooldownFlightKey(baseKey: string, accountId: string): string {
+    // Flight reservation establishes an incarnation even without prior refusal evidence.
+    const generation = reserveCooldownGeneration(accountId);
+    return `${baseKey}\0${instance}-cooldown:${generation}`;
+  }
+
+  /** Active usage readers bind this key after token refresh; renewal keeps the legacy flight valid. */
+  function anthropicCredentialQuotaFlightKey(baseKey: string, accountId: string): string {
+    const row = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+    return `${anthropicCooldownFlightKey(baseKey, accountId)}\0${row ? JSON.stringify([credentialGeneration(row.credential), row.loginId, row.addedAt]) : "missing"}`;
   }
-  if (!probe.isCurrent() || !mayPublish()) {
-    throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe result is stale");
+
+  function reserveCooldownGeneration(accountId: string): number {
+    return cooldownGenerationByAccount?.get(accountId) ?? noteAnthropicCooldownMutation(accountId);
+  }
+
+  function noteAnthropicCooldownMutation(accountId: string): number {
+    const generation = nextCooldownGeneration++;
+    (cooldownGenerationByAccount ??= new Map()).set(accountId, generation);
+    return generation;
+  }
+
+  function anthropicAccountIncarnation(accountId: string): number {
+    return accountIncarnations?.get(accountId) ?? emptyAccountIncarnation;
+  }
+
+  function reserveAnthropicAccountIncarnation(accountId: string): number {
+    const existing = accountIncarnations?.get(accountId);
+    if (existing !== undefined) return existing;
+    const incarnation = nextAccountIncarnation++;
+    (accountIncarnations ??= new Map()).set(accountId, incarnation);
+    return incarnation;
+  }
+
+  function clearAnthropicCooldownGenerations(): void {
+    emptyGeneration = nextCooldownGeneration++;
+    cooldownGenerationByAccount = undefined;
+    emptyAccountIncarnation = nextAccountIncarnation++;
+    accountIncarnations = undefined;
+  }
+
+  /**
+   * Bind a quota probe to both the credential and cooldown generations it observed before
+   * dispatch. A successful response may otherwise arrive after either credential replacement
+   * or a newer 429 and incorrectly make unrelated state eligible.
+   */
+  async function captureAnthropicCooldownRecoveryProbe(
+    accountId: string,
+    accessToken: string,
+  ): Promise<AnthropicCooldownRecoveryProbe | null> {
+    const credential = getAccountCredential(instance, accountId);
+    if (!credential || credential.access !== accessToken) return null;
+    const generation = credentialGeneration(credential);
+    const incarnation = reserveAnthropicAccountIncarnation(accountId);
+    const quotaEpoch = captureProviderAccountQuotaEpoch(instance);
+    const initialRow = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+    if (!initialRow || initialRow.paused || initialRow.needsReauth || credentialGeneration(initialRow.credential) !== generation) return null;
+    // Lazy because anthropic-routing reads the quota cache on normal request routing.
+    const { anthropicRoutingFor } = await import("../../oauth/anthropic-routing");
+    const routing = anthropicRoutingFor(instance);
+    const live = getAccountCredential(instance, accountId);
+    if (!live || credentialGeneration(live) !== generation) return null;
+    const cooldownGeneration = reserveCooldownGeneration(accountId);
+    const capturedFamilyGeneration = anthropicModelQuotaFor(instance).captureAnthropicFamilyQuotaGeneration(accountId);
+    const claim = routing.captureAnthropicCooldownRecovery(accountId);
+    const isCurrentCredential = () => {
+      const currentRow = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+      const current = currentRow?.credential;
+      return quotaEpoch === captureProviderAccountQuotaEpoch(instance)
+        && anthropicAccountIncarnation(accountId) === incarnation
+        && currentRow?.loginId === initialRow?.loginId && currentRow?.addedAt === initialRow?.addedAt
+        && !!current && credentialGeneration(current) === generation;
+    };
+    return {
+      instance,
+      requiresFreshDispatch: claim !== null,
+      isCurrentCredential,
+      isCurrentFamily: () => familyGeneration(accountId) === capturedFamilyGeneration,
+      isCurrent: () => isCurrentCredential()
+        && anthropicCooldownGeneration(accountId) === cooldownGeneration,
+      settle: quota => !isCurrentCredential() || anthropicCooldownGeneration(accountId) !== cooldownGeneration ? "superseded"
+        : claim === null ? "retained" : routing.settleAnthropicCooldownRecovery(claim, quota),
+    };
   }
-  if (!quota) return null;
-  const settlement = probe.settle(quota);
-  if (settlement === "superseded") {
-    throw new AnthropicQuotaProbeOwnershipError("anthropic quota probe lost cooldown ownership");
+
+  /** Run one authoritative usage read and publish its recovery effect only while still owned. */
+  async function probeAnthropicQuotaWithRecovery(
+    accountId: string,
+    accessToken: string,
+    read: (requireFreshDispatch: boolean) => Promise<ProviderQuota | null>,
+    mayPublish: () => boolean,
+  ): Promise<AnthropicQuotaRecoveryResult | null> {
+    const probe = await captureAnthropicCooldownRecoveryProbe(accountId, accessToken);
+    if (!probe) throw new AnthropicQuotaProbeOwnershipError(`${instance} quota probe lost credential ownership`);
+    if (!probe.isCurrent() || !mayPublish()) throw new AnthropicQuotaProbeOwnershipError(`${instance} quota probe lost dispatch ownership`);
+    let quota: ProviderQuota | null;
+    try { quota = await read(probe.requiresFreshDispatch); }
+    catch (error) {
+      if (!probe.isCurrent() || !mayPublish()) throw new AnthropicQuotaProbeOwnershipError(`${instance} quota probe failure is stale`);
+      throw error;
+    }
+    if (!probe.isCurrent() || !mayPublish()) {
+      throw new AnthropicQuotaProbeOwnershipError(`${instance} quota probe result is stale`);
+    }
+    if (!quota) return null;
+    const settlement = probe.settle(quota);
+    if (settlement === "superseded") {
+      throw new AnthropicQuotaProbeOwnershipError(`${instance} quota probe lost cooldown ownership`);
+    }
+    // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
+    // generation; any later observation/429 then invalidates publication before a cache write.
+    const ownsFamily = probe.isCurrentFamily();
+    const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
+    if (ownsFamily) anthropicModelQuotaFor(instance).observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
+    if (!authoritative) {
+      const cached = getCachedProviderAccountQuota(instance, accountId)?.customWindows;
+      const windows = ownsFamily ? mergeAnthropicFamilyWindows(cached, quota.customWindows)
+        : cached ?? [];
+      // A superseded family enumeration has no authority, including over absent families.
+      if (!ownsFamily || windows.length) quota = { ...quota, customWindows: windows };
+    }
+    const publicationGeneration = anthropicCooldownGeneration(accountId);
+    const publicationFamilyGeneration = familyGeneration(accountId);
+    afterSettlementForTests?.();
+    return {
+      instance,
+      quota,
+      isCurrent: () => probe.isCurrentCredential()
+        && anthropicCooldownGeneration(accountId) === publicationGeneration
+        && familyGeneration(accountId) === publicationFamilyGeneration
+        && mayPublish(),
+    };
   }
-  // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
-  // generation; any later observation/429 then invalidates publication before a cache write.
-  const ownsFamily = probe.isCurrentFamily();
-  const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
-  if (ownsFamily) observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
-  if (!authoritative) {
-    const cached = getCachedProviderAccountQuota("anthropic", accountId)?.customWindows;
-    const windows = ownsFamily ? mergeAnthropicFamilyWindows(cached, quota.customWindows)
-      : cached ?? [];
-    // A superseded family enumeration has no authority, including over absent families.
-    if (!ownsFamily || windows.length) quota = { ...quota, customWindows: windows };
+
+  function reconcileAnthropicCooldownGenerations(context: GenerationContext): number {
+    // Probe reservations include accounts with no cooldown, so every claim retires here.
+    for (const id of cooldownGenerationByAccount?.keys() ?? []) {
+      if (!context.oauthAccountKeys.has(`${instance}\0${id}`)) noteAnthropicCooldownMutation(id);
+    }
+    for (const id of accountIncarnations?.keys() ?? []) {
+      if (!context.oauthAccountKeys.has(`${instance}\0${id}`)) accountIncarnations!.set(id, nextAccountIncarnation++);
+    }
+    return 0; // Tombstones are retained, never reclaimed into an older generation.
   }
-  const publicationGeneration = anthropicCooldownGeneration(accountId);
-  const publicationFamilyGeneration = anthropicFamilyQuotaGeneration(accountId);
-  afterSettlementForTests?.();
-  return {
-    quota,
-    isCurrent: () => probe.isCurrentCredential()
-      && anthropicCooldownGeneration(accountId) === publicationGeneration
-      && anthropicFamilyQuotaGeneration(accountId) === publicationFamilyGeneration
-      && mayPublish(),
-  };
+  return Object.freeze({ instance, assertAnthropicQuotaSendAllowed, setAnthropicQuotaAfterSettlementForTests,
+    anthropicCooldownGeneration, anthropicCooldownFlightKey, anthropicCredentialQuotaFlightKey, noteAnthropicCooldownMutation,
+    anthropicAccountIncarnation, reserveAnthropicAccountIncarnation,
+    clearAnthropicCooldownGenerations, captureAnthropicCooldownRecoveryProbe,
+    probeAnthropicQuotaWithRecovery, reconcileAnthropicCooldownGenerations });
+}
+export type AnthropicCooldownRecovery = ReturnType<typeof createAnthropicCooldownRecovery>;
+const instances = new Map<AnthropicInstanceId, AnthropicCooldownRecovery>();
+export function anthropicCooldownRecoveryFor(instance: AnthropicInstanceId): AnthropicCooldownRecovery {
+  let facade = instances.get(instance);
+  if (!facade) { facade = createAnthropicCooldownRecovery(instance); instances.set(instance, facade); }
+  return facade;
+}
+export function reconcileAllAnthropicCooldownGenerations(context: GenerationContext): number {
+  for (const facade of instances.values()) facade.reconcileAnthropicCooldownGenerations(context);
+  return 0;
+}
+export function clearAllAnthropicCooldownGenerations(): void {
+  for (const facade of instances.values()) facade.clearAnthropicCooldownGenerations();
+}
+export function assertAnthropicQuotaSendAllowed(accountId: string, token: string): void {
+  anthropicCooldownRecoveryFor("anthropic").assertAnthropicQuotaSendAllowed(accountId, token);
+}
+export function setAnthropicQuotaAfterSettlementForTests(hook: (() => void) | undefined): void {
+  anthropicCooldownRecoveryFor("anthropic").setAnthropicQuotaAfterSettlementForTests(hook);
+}
+export function anthropicCooldownGeneration(accountId: string): number {
+  return anthropicCooldownRecoveryFor("anthropic").anthropicCooldownGeneration(accountId);
+}
+export function anthropicCooldownFlightKey(baseKey: string, accountId: string): string {
+  return anthropicCooldownRecoveryFor("anthropic").anthropicCooldownFlightKey(baseKey, accountId);
+}
+export function noteAnthropicCooldownMutation(accountId: string): number {
+  return anthropicCooldownRecoveryFor("anthropic").noteAnthropicCooldownMutation(accountId);
+}
+export function clearAnthropicCooldownGenerations(): void {
+  anthropicCooldownRecoveryFor("anthropic").clearAnthropicCooldownGenerations();
+}
+export function captureAnthropicCooldownRecoveryProbe(accountId: string, accessToken: string): Promise<AnthropicCooldownRecoveryProbe | null> {
+  return anthropicCooldownRecoveryFor("anthropic").captureAnthropicCooldownRecoveryProbe(accountId, accessToken);
+}
+export function probeAnthropicQuotaWithRecovery(
+  accountId: string, accessToken: string,
+  read: (requireFreshDispatch: boolean) => Promise<ProviderQuota | null>, mayPublish: () => boolean,
+): Promise<AnthropicQuotaRecoveryResult | null> {
+  return anthropicCooldownRecoveryFor("anthropic").probeAnthropicQuotaWithRecovery(accountId, accessToken, read, mayPublish);
 }

package/src/providers/quota/report-cache.ts

@@ -8,7 +8,7 @@ import { apiKeyPoolEntryId } from "../api-keys";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "../registry";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../openai-tiers";
 import { CODEX_CAPACITY_MAX_QUOTA_AGE_MS, type CodexCapacityAggregation, type CodexCapacityQuota } from "../codex-capacity";
-import { clearCachedProviderQuotas, providerQuotaRoutingBinding, type ProviderQuotaRoutingEvidence } from "../quota-routing-cache";
+import { clearCachedProviderQuotas, providerQuotaRoutingBinding, replaceCachedProviderQuotas, type ProviderQuotaRoutingEvidence } from "../quota-routing-cache";
 import { clearProviderApiKeyQuotaCache } from "../quota-key-accounts";
 import { QUOTA_JSON_READ_FAILURE, readQuotaJson } from "../quota-wire";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
@@ -101,6 +101,29 @@ export function clearProviderQuotaCache(): void {
   invalidationEpoch += 1;
 }
 
+const providerReportEpochs = new Map<string, number>();
+
+export function captureProviderReportEpochs(): ReadonlyMap<string, number> {
+  return new Map(providerReportEpochs);
+}
+
+export function providerReportEpochChanged(captured: ReadonlyMap<string, number>, provider: string): boolean {
+  return (providerReportEpochs.get(provider) ?? 0) !== (captured.get(provider) ?? 0);
+}
+
+/**
+ * Provider-scoped invalidation: drop one provider's report and routing row. The global epoch
+ * is untouched, so another provider's cached row and in-flight commit authority survive; an
+ * aggregate already in flight drops only this provider's row when it publishes.
+ */
+export function clearProviderQuotaCacheFor(provider: string): void {
+  providerReportEpochs.set(provider, (providerReportEpochs.get(provider) ?? 0) + 1);
+  if (!cache) return;
+  const reports = cache.response.reports.filter(report => report.provider !== provider);
+  cache = { ...cache, response: { ...cache.response, reports } };
+  replaceCachedProviderQuotas(reports, routingEvidence);
+}
+
 function cacheKey(config: OcxConfig): string {
   const providers = Object.entries(config.providers)
     .map(([name, provider]) => {

package/src/providers/quota/vendor-probes-oauth.ts

@@ -2,7 +2,9 @@ import { markAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { effectiveCodexAuthAccountId, fetchMainAccountInfoSnapshot, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { getValidAccessToken } from "../../oauth";
-import { captureOAuthAccountSelection, getAccountCredential, getAccountSet } from "../../oauth/store";
+import { loadConfig } from "../../config";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
+import { captureOAuthAccountSelection, credentialGeneration, getAccountCredential, getAccountSet } from "../../oauth/store";
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
@@ -33,6 +35,7 @@ import {
 } from "./report-cache";
 import {
   accountCacheKey,
+  captureProviderAccountQuotaEpoch,
   accountQuotaCache,
   hydrateAccountQuotaCache,
   mayCommitAccountQuotaKey,
@@ -40,7 +43,7 @@ import {
 } from "./account-cache";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import type { ProviderQuota, ProviderQuotaWindow } from "../quota-types";
-import { AnthropicQuotaProbeOwnershipError, assertAnthropicQuotaSendAllowed, probeAnthropicQuotaWithRecovery } from "./anthropic-cooldown-recovery";
+import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor } from "./anthropic-cooldown-recovery";
 
 const XAI_BILLING_URL = "https://cli-chat-proxy.grok.com/v1/billing";
 const XAI_CREDITS_URL = `${XAI_BILLING_URL}?format=credits`;
@@ -336,39 +339,68 @@ async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuo
 export async function fetchAnthropicUsageQuota(
   accessToken: string,
   requireFreshDispatch = false,
+): Promise<ProviderQuota | null> {
+  return fetchAnthropicUsageQuotaForInstance("anthropic", accessToken, requireFreshDispatch);
+}
+
+export async function fetchAnthropicUsageQuotaForInstance(
+  instance: AnthropicInstanceId,
+  accessToken: string,
+  requireFreshDispatch = false,
 ): Promise<ProviderQuota | null> {
   // Recovery evidence must be requested after the claimed cooldown. Joining an older request
   // can return after the 429 while still describing provider state from before that refusal.
-  const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(accessToken);
+  const credentialIdentity = getAccountSet(instance)?.accounts.filter(row => row.credential.access === accessToken)
+    .map(row => [row.id, row.loginId, row.addedAt, credentialGeneration(row.credential)]);
+  const key = `${instance}\0${captureProviderAccountQuotaEpoch(instance)}\0${JSON.stringify(credentialIdentity)}\0${accessToken}`;
+  const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(key);
   if (joinable) return joinable;
 
   const probe = readAnthropicUsageQuota(accessToken).finally(() => {
-    if (anthropicUsageInflight.get(accessToken) === probe) anthropicUsageInflight.delete(accessToken);
+    if (anthropicUsageInflight.get(key) === probe) anthropicUsageInflight.delete(key);
   });
-  anthropicUsageInflight.set(accessToken, probe);
+  anthropicUsageInflight.set(key, probe);
   return probe;
 }
 
-export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
+/** `config` is the caller's live object; currency re-reads it instead of reloading the file. */
+export async function fetchAnthropicQuota(provider: string, config: OcxConfig = loadConfig()): Promise<ProviderQuotaReport | null> {
+  const instance = configuredAnthropicInstance(config, provider);
+  const target = config.providers[provider];
+  if (!instance || target?.disabled || target && target.authMode !== "oauth") return null;
+  const targetIdentity = JSON.stringify(target);
+  const targetCurrent = () => configuredAnthropicInstance(config, provider) === instance
+    && JSON.stringify(config.providers[provider]) === targetIdentity;
+  const recovery = anthropicCooldownRecoveryFor(instance);
   // Capture the account we intend to probe before awaiting — a mid-flight active
   // switch must not seed the wrong account's cache with this response.
-  const selection = captureOAuthAccountSelection("anthropic");
+  const selection = captureOAuthAccountSelection(instance);
   const probedAccountId = selection?.accountId;
-  const probedAccountKey = probedAccountId ? accountCacheKey("anthropic", probedAccountId) : null;
+  const initialRow = getAccountSet(instance)?.accounts.find(row => row.id === probedAccountId);
+  const epoch = captureProviderAccountQuotaEpoch(instance);
+  const incarnation = probedAccountId ? recovery.reserveAnthropicAccountIncarnation(probedAccountId) : undefined;
+  const probedAccountKey = probedAccountId ? accountCacheKey(instance, probedAccountId) : null;
   const writerGeneration = captureConfigGeneration();
   let accessToken: string;
   try {
-    accessToken = await getValidAccessToken("anthropic");
+    accessToken = await getValidAccessToken(instance);
   } catch {
     return null;
   }
   if (!probedAccountId || !probedAccountKey) return null;
+  const currentRow = getAccountSet(instance)?.accounts.find(row => row.id === probedAccountId);
+  if (!initialRow || !currentRow || initialRow.loginId !== currentRow.loginId || initialRow.addedAt !== currentRow.addedAt
+    || epoch !== captureProviderAccountQuotaEpoch(instance) || recovery.anthropicAccountIncarnation(probedAccountId) !== incarnation) return null;
   let quota: ProviderQuota | null;
   let anthropicCurrent: (() => boolean) | undefined;
   try {
-    const result = await probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
-      fresh => { assertAnthropicQuotaSendAllowed(probedAccountId, accessToken); return fetchAnthropicUsageQuota(accessToken, fresh); },
-      () => mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
+    const result = await recovery.probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
+      fresh => {
+        if (!targetCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota target changed");
+        recovery.assertAnthropicQuotaSendAllowed(probedAccountId, accessToken);
+        return fetchAnthropicUsageQuotaForInstance(instance, accessToken, fresh);
+      },
+      () => targetCurrent() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
     if (result && !result.isCurrent()) return null;
     quota = result?.quota ?? null;
     anthropicCurrent = result?.isCurrent;
@@ -380,14 +412,14 @@ export async function fetchAnthropicQuota(provider: string): Promise<ProviderQuo
   // Share the active-account probe with the per-account cache so Providers-page
   // loads do not double-hit Anthropic's rate-limited usage endpoint.
   if (probedAccountId && probedAccountKey) {
-    const stillOwnsToken = getAccountCredential("anthropic", probedAccountId)?.access === accessToken;
+    const stillOwnsToken = getAccountCredential(instance, probedAccountId)?.access === accessToken;
     if (stillOwnsToken && anthropicCurrent?.() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
       accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent });
     }
   }
   const quotaReport = report(provider, "anthropic:oauth-usage", quota);
   if (quotaReport && anthropicCurrent) {
-    accountReportCurrent.set(quotaReport, () => anthropicCurrent() && getAccountSet("anthropic")?.activeAccountId === probedAccountId);
+    accountReportCurrent.set(quotaReport, () => anthropicCurrent() && getAccountSet(instance)?.activeAccountId === probedAccountId);
   }
   return quotaReport;
 }