@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -21,6 +21,7 @@ import { existsSync, mkdirSync, readFileSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { atomicWriteFileStreamed } from "../config/atomic-write";
 import { getConfigDir } from "../config/paths";
+import type { AnthropicInstanceId } from "./anthropic-instance-id";
 
 export const ANTHROPIC_RESET_LEASE_MS = 90_000;
 export const ANTHROPIC_RESET_RETRY_WINDOW_MS = 600_000;
@@ -83,7 +84,16 @@ export function anthropicOrgDigest(organizationUuid: string): string {
 }
 
 export function anthropicResetJournalPath(customDir?: string): string {
-  return join(customDir ?? getConfigDir(), "anthropic-reset-grant-ledger.json");
+  return anthropicResetJournalPathForInstance("anthropic", customDir);
+}
+
+export function anthropicResetJournalPathForInstance(instance: AnthropicInstanceId, customDir?: string): string {
+  return join(customDir ?? getConfigDir(), `${instance}-reset-grant-ledger.json`);
+}
+
+/** Namespace is in the path; A's version-1 journal bytes and record schema stay unchanged. */
+export function anthropicResetLedgerOptionsForInstance(instance: AnthropicInstanceId, customDir?: string): AnthropicResetLedgerOptions {
+  return { journalPath: anthropicResetJournalPathForInstance(instance, customDir) };
 }
 
 function isRecordShape(value: unknown): value is OperationRecord {

package/src/providers/azure-model-metadata.ts

@@ -0,0 +1,115 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config/atomic-write";
+import { getConfigDir } from "../config/paths";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+
+const SOURCE_URL = "https://models.dev/api.json";
+const FILENAME = "azure-model-metadata-cache.json";
+const TTL_MS = 24 * 60 * 60 * 1000;
+
+export type AzureModelMetadata = { input?: string[]; contextWindow?: number; maxTokens?: number };
+type Snapshot = { version: 1; fetchedAt: number; models: Record<string, AzureModelMetadata> };
+type CacheState = { snapshot?: Snapshot | null; inFlight?: Promise<void>; retryAfter: number };
+const cacheByConfigDir = new Map<string, CacheState>();
+
+function cacheState(configDir: string): CacheState {
+  let state = cacheByConfigDir.get(configDir);
+  if (!state) {
+    state = { retryAfter: 0 };
+    cacheByConfigDir.set(configDir, state);
+  }
+  return state;
+}
+
+export function isAzureModelMetadataDestination(baseUrl: string | undefined): boolean {
+  try {
+    return !!baseUrl && new URL(baseUrl).hostname.endsWith(".openai.azure.com");
+  } catch {
+    return false;
+  }
+}
+
+function positiveInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function parseModels(models: unknown, published: boolean): Record<string, AzureModelMetadata> {
+  const out: Record<string, AzureModelMetadata> = Object.create(null);
+  for (const [id, value] of Object.entries(record(models) ?? {}).slice(0, 2000)) {
+    const row = record(value);
+    if (!row || id.length > 256) continue;
+    const limit = published ? record(row.limit) : row;
+    const input = published ? record(row.modalities)?.input : row.input;
+    const modalities = Array.isArray(input)
+      ? [...new Set(input.filter((item): item is string => item === "text" || item === "image" || item === "audio"))]
+      : [];
+    const contextWindow = positiveInteger(published ? limit?.context : limit?.contextWindow);
+    const maxTokens = positiveInteger(published ? limit?.output : limit?.maxTokens);
+    if (!modalities.length && contextWindow === undefined && maxTokens === undefined) continue;
+    out[id.toLowerCase()] = {
+      ...(modalities.length ? { input: modalities } : {}),
+      ...(contextWindow !== undefined ? { contextWindow } : {}),
+      ...(maxTokens !== undefined ? { maxTokens } : {}),
+    };
+  }
+  return out;
+}
+
+function loadSnapshot(configDir: string, state: CacheState): Snapshot | null {
+  if (state.snapshot !== undefined) return state.snapshot;
+  state.snapshot = null;
+  try {
+    const raw = record(JSON.parse(readFileSync(join(configDir, FILENAME), "utf8")));
+    if (raw?.version === 1 && positiveInteger(raw.fetchedAt) !== undefined && record(raw.models)) {
+      state.snapshot = { version: 1, fetchedAt: raw.fetchedAt as number, models: parseModels(raw.models, false) };
+    }
+  } catch { /* Missing or corrupt optional metadata leaves bundled hints available. */ }
+  return state.snapshot;
+}
+
+/** Synchronous catalog fallback. Generation requests never fetch this snapshot. */
+export function publishedAzureModelMetadata(modelId: string, configDir = getConfigDir()): AzureModelMetadata | undefined {
+  return loadSnapshot(configDir, cacheState(configDir))?.models[modelId.toLowerCase()];
+}
+
+/** Refresh once per day during discovery, coalesced and bounded; retain stale data offline. */
+export async function refreshAzureModelMetadata(baseUrl: string | undefined, configDir = getConfigDir()): Promise<void> {
+  if (!isAzureModelMetadataDestination(baseUrl)) return;
+  // Capture state and destination together: tests and embedders can change config roots.
+  const state = cacheState(configDir);
+  const current = loadSnapshot(configDir, state);
+  if ((current && Date.now() - current.fetchedAt < TTL_MS) || Date.now() < state.retryAfter) return;
+  if (state.inFlight) return state.inFlight;
+  const path = join(configDir, FILENAME);
+  state.inFlight = (async () => {
+    try {
+      const signal = AbortSignal.timeout(2000);
+      const response = await fetch(SOURCE_URL, {
+        headers: { accept: "application/json" },
+        redirect: "error",
+        signal,
+      });
+      if (!response.ok) return;
+      const body = await readBoundedResponseBytes(response, { maxBytes: 16 * 1024 * 1024, signal });
+      if (body.oversized) return;
+      const raw = record(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body.bytes)));
+      // Provider-specific rows matter: Azure may expose text only where the direct vendor has vision.
+      const models = parseModels(record(raw?.azure)?.models, true);
+      if (!Object.keys(models).length) return;
+      state.snapshot = { version: 1, fetchedAt: Date.now(), models };
+      try { atomicWriteFile(path, JSON.stringify(state.snapshot) + "\n"); } catch { /* Memory still serves discovery. */ }
+    } catch { /* A public metadata outage must not fail provider discovery. */ }
+    finally { state.retryAfter = Date.now() + 60_000; }
+  })().finally(() => { state.inFlight = undefined; });
+  return state.inFlight;
+}
+
+export function resetAzureModelMetadataForTests(): void {
+  cacheByConfigDir.clear();
+}

package/src/providers/derive.ts

@@ -1,5 +1,7 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
+import { COST_VENDOR_PRIORITY, getModelMetadata, getModelMetadataCaseInsensitive } from "../generated/model-metadata";
 import { cloneFastWire } from "./fastwire";
+import { isAzureModelMetadataDestination, publishedAzureModelMetadata, type AzureModelMetadata } from "./azure-model-metadata";
 import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
@@ -245,6 +247,8 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     // Preserve the registry auth kind verbatim (including "local") so fail-closed gates that
     // distinguish local runtimes from API-key providers keep working after the seed round-trip.
     authMode: entry.authKind,
+    ...(entry.id === "anthropic2" && entry.authKind === "oauth" && entry.oauthFamily === "anthropic"
+      ? { anthropicOAuthInstance: "anthropic2" as const } : {}),
     ...(entry.codexAccountMode ? { codexAccountMode: entry.codexAccountMode } : {}),
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
     ...(entry.freeTier !== undefined ? { freeTier: entry.freeTier } : {}),
@@ -649,6 +653,25 @@ export function shouldCaseFoldMetadataModelId(providerId: string): boolean {
   return entry?.metadataModelIdNormalize === "case-insensitive";
 }
 
+const AZURE_VENDOR_METADATA_PRIORITY = [
+  "azure-openai",
+  ...COST_VENDOR_PRIORITY.filter(provider => provider !== "azure-openai"),
+];
+
+/**
+ * Fill missing Azure model metadata by destination and known model id. Custom provider
+ * names miss PROVIDER_ALIASES; arbitrary deployment aliases still need explicit metadata.
+ */
+export function azureVendorModelMetadata(baseUrl: string | undefined, modelId: string, metadataConfigDir?: string): AzureModelMetadata | undefined {
+  if (!isAzureModelMetadataDestination(baseUrl)) return undefined;
+  const published = publishedAzureModelMetadata(modelId, metadataConfigDir);
+  for (const provider of AZURE_VENDOR_METADATA_PRIORITY) {
+    const meta = getModelMetadata(provider, modelId) ?? getModelMetadataCaseInsensitive(provider, modelId);
+    if (meta) return { ...meta, ...published };
+  }
+  return published;
+}
+
 function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
   return {
     id: entry.id,

package/src/providers/kiro-models.ts

@@ -25,6 +25,8 @@ export const KIRO_MODELS = [
   "claude-sonnet-4.6",
   "claude-sonnet-4.5",
   "claude-sonnet-4.0",
+  // 261008 preemptive: Haiku 5.5; calls fail upstream until Kiro ships it.
+  "claude-haiku-5.5",
   "claude-haiku-4.5",
   "deepseek-3.2",
   "minimax-m2.5",
@@ -55,6 +57,7 @@ export const KIRO_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "claude-sonnet-4.6": 1_000_000,
   "claude-sonnet-4.5": 200_000,
   "claude-sonnet-4.0": 200_000,
+  "claude-haiku-5.5": 1_000_000,
   "claude-haiku-4.5": 200_000,
   "deepseek-3.2": 128_000,
   "minimax-m2.5": 200_000,

package/src/providers/label.ts

@@ -89,6 +89,6 @@ export function stampOAuthAccountLabel(
   if (!accountId) return;
   if (provider.authMode !== "oauth") return;
   const base = baseProviderLabel(providerName);
-  if (base === "openai" || base === "anthropic") return;
+  if (base === "openai" || (base === "anthropic" || base === "anthropic2")) return;
   logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
 }

package/src/providers/model-rename-fields.ts

@@ -78,6 +78,8 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   modelVercelGatewayRouting: "record",
   authMode: "none",
   oauthAccountFailover: "none",
+  anthropicAccountPool: "none",
+  anthropicOAuthInstance: "none",
   keyOptional: "none",
   freeTier: "none",
   note: "none",

package/src/providers/quota/account-cache.ts

@@ -1,8 +1,9 @@
 import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
-import { observeAnthropicFamilyQuota, clearAnthropicRequestedFamilyQuota, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
+import { anthropicModelQuotaFor, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
 import { getValidAccessTokenForAccount } from "../../oauth";
 import { credentialGeneration, getAccountCredential, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../anthropic-instance-id";
 import type { GenerationContext } from "../../lib/state-store-sweeper";
 import { ACCOUNT_QUOTA_TTL_MS, toFiniteNumber } from "../quota-wire";
 import { clearKiroAccountUsageState, hydrateKiroUsageVerdict, kiroPersistableVerdicts, reconcileKiroAccountUsageState } from "../kiro-usage";
@@ -96,8 +97,19 @@ export function normalizeAnthropicQuota(quota: ProviderQuota | null | undefined,
   return hasQuotaRows(result) ? result : null;
 }
 
+function isAnthropicAccountCacheKey(key: string): boolean {
+  const separator = key.indexOf("\0");
+  return separator > 0 && isAnthropicInstanceId(key.slice(0, separator));
+}
+
 export const accountQuotaCache = new Map<string, AccountQuotaCacheEntry>();
 export let explicitAccountEpoch = 0;
+let allAccountQuotaEpoch = 0;
+const providerAccountQuotaEpochs = new Map<string, number>();
+/** Instance-owned cache clears do not revoke an unrelated account's probe. */
+export function captureProviderAccountQuotaEpoch(provider: string): number {
+  return allAccountQuotaEpoch + (providerAccountQuotaEpochs.get(provider) ?? 0);
+}
 
 /**
  * Seed the cache from the last run, once.
@@ -127,7 +139,7 @@ export function hydrateAccountQuotaCache(): void {
     }
     // Disk stores observation time, not the Anthropic usage probe's clock.
     if (!accountQuotaCache.has(key)) {
-      const anthropic = key.startsWith("anthropic\u0000");
+      const anthropic = isAnthropicAccountCacheKey(key);
       accountQuotaCache.set(key, {
         ts: anthropic ? 0 : quota.updatedAt,
         quota: anthropic ? normalizeAnthropicQuota(quota, now)
@@ -148,7 +160,7 @@ export function persistAccountQuotaCache(): void {
     const liveKiro = new Map<string, ProviderAccount>(getAccountSet("kiro")?.accounts.map(account =>
       [accountCacheKey("kiro", account.id), account]) ?? []);
     for (const [key, entry] of accountQuotaCache) {
-      const quota = key.startsWith("anthropic\u0000") ? normalizeAnthropicQuota(entry.quota, now) : entry.quota;
+      const quota = isAnthropicAccountCacheKey(key) ? normalizeAnthropicQuota(entry.quota, now) : entry.quota;
       if (quota && key.startsWith("kiro\0")) {
         const account = liveKiro.get(key);
         if (account && entry.identity === kiroEvidenceIdentity(account))
@@ -182,7 +194,7 @@ export interface ProviderAccountQuota {
 
 /** Providers whose per-account quota can be probed. Extend as other OAuth APIs are covered. */
 export function supportsPerAccountQuota(provider: string): boolean {
-  return provider === "anthropic" || provider === "kiro" || provider === "google-antigravity"
+  return isAnthropicInstanceId(provider) || provider === "kiro" || provider === "google-antigravity"
     || explicitAccountReader(provider);
 }
 
@@ -209,12 +221,12 @@ export function getCachedProviderAccountQuota(provider: string, accountId: strin
     const account = getAccountSet("kiro")?.accounts.find(row => row.id === accountId);
     if (!account || entry?.identity !== kiroEvidenceIdentity(account)) return null;
   }
-  if (provider === "anthropic" && entry?.anthropicCredentialGeneration) {
+  if (isAnthropicInstanceId(provider) && entry?.anthropicCredentialGeneration) {
     const credential = getAccountCredential(provider, accountId);
     if (!credential || credentialGeneration(credential) !== entry.anthropicCredentialGeneration) return null;
   }
   if (entry?.isCurrent && !entry.isCurrent()) return null;
-  return provider === "anthropic" ? normalizeAnthropicQuota(entry?.quota, Date.now()) : entry?.quota ?? null;
+  return isAnthropicInstanceId(provider) ? normalizeAnthropicQuota(entry?.quota, Date.now()) : entry?.quota ?? null;
 }
 
 /** Test-only: seed or clear the per-account quota cache without probing upstream. */
@@ -270,7 +282,8 @@ function normalizeUtilizationFraction(value: string | null): number | undefined
  * erasing model-specific windows. The caller owns credential attribution; this guard
  * prevents a retired account key from being revived by an older config generation.
  */
-export function recordAnthropicAccountQuotaFromHeaders(
+export function recordAnthropicAccountQuotaFromHeadersForInstance(
+  instance: AnthropicInstanceId,
   accountId: string,
   headers: Headers,
   writerGeneration: number,
@@ -278,7 +291,8 @@ export function recordAnthropicAccountQuotaFromHeaders(
   model?: string,
 ): void {
   if (!accountId) return;
-  const key = accountCacheKey("anthropic", accountId);
+  const key = accountCacheKey(instance, accountId);
+  const { observeAnthropicFamilyQuota, clearAnthropicRequestedFamilyQuota } = anthropicModelQuotaFor(instance);
   if (!mayCommitAccountQuotaKey(key, writerGeneration)) return;
   if (status !== undefined && status >= 200 && status < 300) clearAnthropicRequestedFamilyQuota(accountId, model);
   const observed = parseAnthropicRateLimitHeaders(headers, status);
@@ -289,7 +303,7 @@ export function recordAnthropicAccountQuotaFromHeaders(
   // every other provider's saved row.
   hydrateAccountQuotaCache();
   const candidate = accountQuotaCache.get(key);
-  const credential = getAccountCredential("anthropic", accountId);
+  const credential = getAccountCredential(instance, accountId);
   const generation = credential && credentialGeneration(credential);
   const previous = candidate?.isCurrent?.() === false
     || candidate?.anthropicCredentialGeneration && candidate.anthropicCredentialGeneration !== generation ? undefined : candidate;
@@ -307,6 +321,13 @@ export function recordAnthropicAccountQuotaFromHeaders(
   persistAccountQuotaCache();
 }
 
+/** Legacy recorder: config/roster generation is numeric and distinct from bearer ownership. */
+export function recordAnthropicAccountQuotaFromHeaders(
+  accountId: string, headers: Headers, writerGeneration: number, status?: number, model?: string,
+): void {
+  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model);
+}
+
 /**
  * Providers whose per-account quota is OBSERVED in-band, never probed.
  *
@@ -380,7 +401,7 @@ export function sweepExpiredProviderAccountQuotaRows(now = Date.now()): number {
   let removed = 0;
   for (const [key, entry] of accountQuotaCache) {
     // Anthropic observations extend retention, never the usage probe's eligibility clock.
-    const retainedAt = key.startsWith("anthropic\u0000")
+    const retainedAt = isAnthropicAccountCacheKey(key)
       ? Math.max(entry.ts, entry.quota?.updatedAt ?? 0)
       : entry.ts;
     if (retainedAt + ACCOUNT_QUOTA_TTL_MS > now) continue;
@@ -425,8 +446,10 @@ export function resetProviderQuotaReconcileStateForTests(): void {
 
 /** Drop cached per-account rows (all, or just one provider's). */
 export function clearAccountQuotaCache(provider?: string): void {
-  explicitAccountEpoch += 1;
+  // Anthropic readers use provider-owned epochs; B cannot revoke an A flight.
+  if (provider !== "anthropic2") explicitAccountEpoch += 1;
   if (!provider) {
+    allAccountQuotaEpoch += 1;
     accountQuotaCache.clear();
     accountQuotaInflight.clear();
     clearKiroAccountUsageState();
@@ -436,6 +459,7 @@ export function clearAccountQuotaCache(provider?: string): void {
     cancelPendingAccountQuotaPersist();
     return;
   }
+  providerAccountQuotaEpochs.set(provider, (providerAccountQuotaEpochs.get(provider) ?? 0) + 1);
   hydrateAccountQuotaCache();
   const prefix = `${provider}\u0000`;
   for (const key of [...accountQuotaCache.keys()]) {
@@ -464,7 +488,9 @@ export async function getTokenForAccountQuotaProbe(provider: string, accountId:
   const row = getAccountCredentialWithStatus(provider, accountId);
   if (!row) throw new Error("account credential missing");
   // An operator-paused account is excluded from every automatic upstream use, quota reads included.
+  // Anthropic instances also skip a needs-reauth row; other providers keep their probe behavior.
   if (row.paused) throw new Error("account is paused; quota probe skipped");
+  if (row.needsReauth && isAnthropicInstanceId(provider)) throw new Error("account needs sign-in; quota probe skipped");
   const stored = row.credential;
   if (stored.expires > Date.now() + ACCOUNT_TOKEN_SKEW_MS) return stored.access;
   const activeId = getAccountSet(provider)?.activeAccountId;

package/src/providers/quota/anthropic-account-quota.ts

@@ -0,0 +1,93 @@
+import { loadConfig } from "../../config";
+import type { OcxConfig } from "../../types";
+import { getAccountSet } from "../../oauth/store";
+import { captureConfigGeneration, sweepExpiredOnWrite } from "../../lib/state-store-sweeper";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
+import { ACCOUNT_QUOTA_TTL_MS } from "../quota-wire";
+import { fetchAnthropicUsageQuotaForInstance } from "./vendor-probes-oauth";
+import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor, type AnthropicQuotaRecoveryResult } from "./anthropic-cooldown-recovery";
+import {
+  accountCacheKey, accountQuotaCache, accountQuotaInflight, captureProviderAccountQuotaEpoch,
+  getTokenForAccountQuotaProbe, hydrateAccountQuotaCache, mayCommitAccountQuotaKey,
+  normalizeAnthropicQuota, type AccountQuotaCacheEntry,
+} from "./account-cache";
+
+/**
+ * Resolve renewal first: a flight always belongs to the credential actually dispatched.
+ * `config` is the caller's live object. Currency re-reads that one object, never a fresh file
+ * load, so memory/disk drift cannot refuse every probe; commit authority stays with the
+ * captured writer generation.
+ */
+export async function fetchAnthropicAccountQuota(
+  instance: AnthropicInstanceId, accountId: string, force: boolean, config: OcxConfig = loadConfig(),
+): Promise<AccountQuotaCacheEntry> {
+  const unavailable = (): AccountQuotaCacheEntry => ({ ts: Date.now(), quota: null, unavailable: true });
+  const target = config.providers[instance];
+  if (target?.disabled || target && target.authMode !== "oauth" || configuredAnthropicInstance(config, instance) !== instance) return unavailable();
+  const targetIdentity = JSON.stringify(target);
+  const epoch = captureProviderAccountQuotaEpoch(instance);
+  const initialRow = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+  if (!initialRow) return unavailable();
+  const recovery = anthropicCooldownRecoveryFor(instance);
+  const incarnation = recovery.reserveAnthropicAccountIncarnation(accountId);
+  const ownerCurrent = () => {
+    const row = getAccountSet(instance)?.accounts.find(row => row.id === accountId);
+    return epoch === captureProviderAccountQuotaEpoch(instance)
+      && configuredAnthropicInstance(config, instance) === instance
+      && JSON.stringify(config.providers[instance]) === targetIdentity
+      && recovery.anthropicAccountIncarnation(accountId) === incarnation
+      && !!row && row.loginId === initialRow.loginId && row.addedAt === initialRow.addedAt;
+  };
+  hydrateAccountQuotaCache();
+  const key = accountCacheKey(instance, accountId);
+  const candidate = accountQuotaCache.get(key);
+  const cached = candidate?.isCurrent?.() === false ? undefined : candidate;
+  if (!force && cached && Date.now() - cached.ts < ACCOUNT_QUOTA_TTL_MS) {
+    return { ...cached, quota: normalizeAnthropicQuota(cached.quota, Date.now()) };
+  }
+  let token: string;
+  try { token = await getTokenForAccountQuotaProbe(instance, accountId); }
+  catch { return unavailable(); }
+  if (!ownerCurrent()) return unavailable();
+  const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
+  const flightCurrent = () => ownerCurrent()
+    && recovery.anthropicCredentialQuotaFlightKey(key, accountId) === flightKey;
+  const joinable = accountQuotaInflight.get(flightKey);
+  if (joinable) {
+    const joined = await joinable;
+    return ownerCurrent() && (joined.isCurrent?.() ?? flightCurrent()) ? joined : unavailable();
+  }
+  const writerGeneration = captureConfigGeneration();
+  // One publication path for a result and for a failed dispatch. A null result (HTTP refusal)
+  // and a thrown read (network failure) both record the unavailable row over the retained
+  // in-flight observations, as the pre-instance A path did, so joined callers and later cached
+  // reads agree and windows that expired during the shared probe are normalized away.
+  const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
+    const previous = accountQuotaCache.get(key);
+    const retained = previous?.isCurrent?.() === false ? undefined : previous;
+    const isCurrent = result?.isCurrent ?? flightCurrent;
+    const entry: AccountQuotaCacheEntry = {
+      ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
+      ...(!result ? { unavailable: true as const } : {}), isCurrent,
+    };
+    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); sweepExpiredOnWrite(entry.ts); }
+    return entry;
+  };
+  const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    try {
+      const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
+        if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
+        recovery.assertAnthropicQuotaSendAllowed(accountId, token);
+        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh);
+      }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
+      if (result && !result.isCurrent()) return unavailable();
+      if (!result && !flightCurrent()) return unavailable();
+      return publish(result);
+    } catch (error) {
+      if (error instanceof AnthropicQuotaProbeOwnershipError || !flightCurrent()) return unavailable();
+      return publish(null);
+    }
+  })().finally(() => { if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey); });
+  accountQuotaInflight.set(flightKey, probe);
+  return probe;
+}