@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/responses/state.ts

@@ -21,6 +21,9 @@ import {
 import { collectReferencedSpillFileNames, snapshotReferencedSpillFileNames } from "./state/spill-inspect";
 import { selectSnapshotEntries, snapshotPayload } from "./state/snapshot-select";
 import { clientCarriedPrefixLength, providerIssuedIdentity } from "./state/replay-fingerprint";
+import { hasPendingClientToolCall, allowsUnforcedStoreFalseReplay } from "./state/unforced-store-false";
+import { computeResponseStateMetrics, type ResponseStateMetrics } from "./state/metrics";
+export type { ResponseStateMetrics } from "./state/metrics";
 export type { ResponseStateTempRecoveryResult, ResponseStateTempRecoveryOptions } from "./state/temp-recovery";
 export type { ResponseSpillDirInspection } from "./spill-store";
 export { recoverStaleResponseStateTemps, reclaimAbandonedResponseStateTemps, inspectAbandonedResponseStateTemps, sweepAbandonedResponseStateTemps } from "./state/temp-recovery";
@@ -28,7 +31,7 @@ import { recoverStaleResponseStateTemps } from "./state/temp-recovery";
 export type { ResponseSpillWriteFailureCode, ResponseSpillWriteStatus, ResponseSpillWriteFailureOrigin } from "./state/spill-failure";
 import type { ResponseSpillWriteFailureCode, ResponseSpillWriteStatus, ResponseSpillWriteFailureOrigin } from "./state/spill-failure";
 export { responseAdmissionCountersForTests } from "./state/spill-failure";
-import { admissionCounters, noteSpillWriteFailure, noteSpillWriteSuccess, spillCounters, spillWriteHealth } from "./state/spill-failure";
+import { admissionCounters, noteSpillWriteFailure, noteSpillWriteSuccess, resetSpillCountersForTests, spillCounters, spillWriteHealth } from "./state/spill-failure";
 import { loadSnapshotEntry } from "./state/snapshot-codec";
 import { isBodyNonPersistable } from "./state/body-policy";
 export { isBodyNonPersistable, markBodyNonPersistable } from "./state/body-policy";
@@ -118,6 +121,7 @@ export interface ResidentResponseState {
   /** Index in `items` where provider output begins; see clientCarriedPrefixLength. */
   providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
+  unforcedStoreFalse?: boolean;
   sizeBytes: number;
 }
 
@@ -128,6 +132,7 @@ export interface SpilledResponseState {
   /** Mirrors the spilled payload boundary so a spilled entry keeps its anchor. */
   providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
+  unforcedStoreFalse?: boolean;
   spill: ResponseSpillRef;
   sizeBytes: number;
 }
@@ -315,6 +320,7 @@ function measureResidentEntry(id: string, entry: ResidentInput): ResidentRespons
     items: entry.items,
     ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
     ...(entry.providers ? { providers: entry.providers } : {}),
+    ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
   });
   return sizeBytes === null ? null : { kind: "resident", ...entry, sizeBytes };
 }
@@ -417,7 +423,9 @@ function swapResidentForSpill(id: string, expected: ResidentResponseState, ref:
     kind: "spill",
     createdAt: expected.createdAt,
     ...(expected.clientThreadId ? { clientThreadId: expected.clientThreadId } : {}),
+    ...(expected.providerOutputStart !== undefined ? { providerOutputStart: expected.providerOutputStart } : {}),
     ...(expected.providers ? { providers: expected.providers } : {}),
+    ...(expected.unforcedStoreFalse ? { unforcedStoreFalse: expected.unforcedStoreFalse } : {}),
     spill: ref,
   };
   const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -441,6 +449,7 @@ function replaceSpillEntryAtomically(
       items: candidate.items,
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
     });
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
       kind: "spill",
@@ -448,6 +457,7 @@ function replaceSpillEntryAtomically(
       ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
       spill: ref,
     };
     const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -533,6 +543,7 @@ function admitOversizedCandidate(
       items: candidate.items,
       ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
     });
     // Enforce the ceiling against the REAL envelope: the spill payload adds
     // the {version, responseId, ...} wrapper, so a candidate within the
@@ -547,7 +558,9 @@ function admitOversizedCandidate(
       kind: "spill",
       createdAt: candidate.createdAt,
       ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
+      ...(candidate.providerOutputStart !== undefined ? { providerOutputStart: candidate.providerOutputStart } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
+      ...(candidate.unforcedStoreFalse ? { unforcedStoreFalse: candidate.unforcedStoreFalse } : {}),
       spill: ref,
     };
     const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
@@ -863,20 +876,29 @@ export function replayOverlapSkipsForTests(): number {
  * This ceiling therefore bounds what the store owns, which is every file it can
  * account for, and not the directory as a whole.
  */
-function enforceSpilledResponseBudget(): number {
+function enforceSpilledResponseBudget(requiredHeadroomBytes?: number): number {
   // Price in-flight publications too: a file being created by
   // `writeResponseSpillDurablyAsync` occupies the volume before it reaches `states`.
   let spilledBytes = accountedResponseSpillBytes();
-  if (spilledBytes <= spillByteCap()) return 0;
+  // Admission (#6747) passes the room its publication needs, 0 included. Evict only while that
+  // room is still reachable: re-read accounting after each attempt, since a failed unlink stays
+  // charged, and stop the moment the publication cannot fit so no unrelated continuation pays.
+  const admission = requiredHeadroomBytes !== undefined;
+  const headroom = admission && requiredHeadroomBytes > 0 ? requiredHeadroomBytes : 0;
+  const feasible = (): boolean => !admission
+    || (spilledBytes = accountedResponseSpillBytes()) - spilledResponseBytes() + headroom <= spillByteCap();
+  if (!feasible() || spilledBytes <= spillByteCap() - headroom) return 0;
   const before = spilledBytes;
   // Deferred generations go first. They are already superseded, so releasing one
   // costs only the crash window the queue exists to cover — the same trade
   // PENDING_SPILL_UNLINKS_MAX already makes against unbounded disk. Evicting a
   // live continuation to make room for a dead file would be the wrong order.
-  while (spilledBytes > spillByteCap() && pendingSpillUnlinks.length > 0) {
+  while (spilledBytes > spillByteCap() - headroom && pendingSpillUnlinks.length > 0) {
     const ref = pendingSpillUnlinks.shift()!;
     spilledBytes -= ref.payloadBytes;
     deleteResponseSpill(ref);
+    if (admission) spillCounters.headroomEvictions += 1;
+    if (!feasible()) return before - spilledBytes;
   }
   // Ordered by createdAt, not by map order. `states` is not an age index:
   // demotion and spill replacement delete and reinsert entries, and
@@ -893,9 +915,11 @@ function enforceSpilledResponseBudget(): number {
     .sort((a, b) => a[1].createdAt - b[1].createdAt
       || (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
   for (const [id, entry] of spilled) {
-    if (spilledBytes <= spillByteCap()) break;
+    if (spilledBytes <= spillByteCap() - headroom) break;
     spilledBytes -= entry.spill.payloadBytes;
     deleteEntry(id);
+    if (admission) spillCounters.headroomEvictions += 1;
+    if (!feasible()) return before - spilledBytes;
   }
   return before - spilledBytes;
 }
@@ -935,6 +959,7 @@ function pruneResponses(at = now()): void {
         items: entry.items,
         ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
         ...(entry.providers ? { providers: entry.providers } : {}),
+        ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
       });
       if (swapResidentForSpill(oldestId, entry, ref)) noteSpillWriteSuccess();
     } catch (error) {
@@ -994,6 +1019,7 @@ export function evictOldestResponseContinuationForBudget(): number {
       items: entry.items,
       ...(entry.providerOutputStart !== undefined ? { providerOutputStart: entry.providerOutputStart } : {}),
       ...(entry.providers ? { providers: entry.providers } : {}),
+      ...(entry.unforcedStoreFalse ? { unforcedStoreFalse: entry.unforcedStoreFalse } : {}),
     });
     if (swapResidentForSpill(id, entry, ref)) noteSpillWriteSuccess();
   } catch (error) {
@@ -1030,6 +1056,15 @@ function materializeEntry(
     schedulePersist();
     return { ok: false, failure };
   }
+  // A restricted snapshot stub must agree with the validated spill's provenance.
+  if (entry.unforcedStoreFalse && (result.payload.unforcedStoreFalse !== true
+    || entry.providerOutputStart === undefined || entry.providerOutputStart > result.payload.items.length
+    || entry.providerOutputStart !== result.payload.providerOutputStart)) {
+    spillCounters.readFailures += 1;
+    replaceWithSpillFailure(id, entry);
+    schedulePersist();
+    return { ok: false, failure: { code: "previous_response_not_found", reason: "spill_corrupt" } };
+  }
   const state = measureResidentEntry(id, {
     createdAt: result.payload.createdAt,
     ...(result.payload.clientThreadId ? { clientThreadId: result.payload.clientThreadId } : {}),
@@ -1038,6 +1073,7 @@ function materializeEntry(
       ? { providerOutputStart: result.payload.providerOutputStart }
       : {}),
     ...(result.payload.providers ? { providers: result.payload.providers } : {}),
+    ...(result.payload.unforcedStoreFalse ? { unforcedStoreFalse: result.payload.unforcedStoreFalse } : {}),
   });
   if (!state) {
     spillCounters.readFailures += 1;
@@ -1075,6 +1111,15 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
     replayScopeMismatchDrops += 1;
     return body;
   }
+  const clientInput = inputItems(request.input);
+  const stored = materialized.state.items;
+  const carried = clientCarriedPrefixLength(stored, clientInput);
+  if (
+    materialized.state.unforcedStoreFalse
+    && !allowsUnforcedStoreFalseReplay(stored, materialized.state.providerOutputStart, clientInput, carried)
+  ) {
+    return body;
+  }
   // The client already replayed this history verbatim. Prepending the stored copy would
   // double it, and the doubled turn is stored again, so the next turn triples (#1412 saw
   // 127k of real context reach 1.3M tokens this way).
@@ -1087,10 +1132,7 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
   // There is no invariant that provider output always carries ids, so an entry whose output
   // has none simply never skips.
   {
-    const clientInput = inputItems(request.input);
-    const stored = materialized.state.items;
     const anchor = materialized.state.providerOutputStart;
-    const carried = clientCarriedPrefixLength(stored, clientInput);
     if (
       carried === stored.length
       && anchor !== undefined
@@ -1110,9 +1152,9 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
   }
   const expanded = {
     ...request,
-    input: [...materialized.state.items, ...inputItems(request.input)],
+    input: [...stored, ...clientInput],
   };
-  replayedInputPrefixLengths.set(expanded, materialized.state.items.length);
+  replayedInputPrefixLengths.set(expanded, stored.length);
   return expanded;
 }
 
@@ -1156,29 +1198,6 @@ export function previousResponseProviderState(responseId: string | undefined): O
   return providers ? structuredClone(providers) : undefined;
 }
 
-export interface ResponseStateMetrics {
-  count: number;
-  residentCount: number;
-  spillStubCount: number;
-  tombstoneCount: number;
-  totalBytes: number;
-  spillPayloadBytes: number;
-  largestBytes: number;
-  oldestAgeMs: number;
-  spillWrites: number;
-  spillWriteFailures: number;
-  spillWriteStatus: ResponseSpillWriteStatus;
-  spillWriteConsecutiveFailures: number;
-  spillLastWriteFailureCode: ResponseSpillWriteFailureCode | null;
-  spillLastWriteFailureOrigin: ResponseSpillWriteFailureOrigin | null;
-  spillAclRetryReturnedTimeouts: number;
-  spillAclTimeoutMemoRefusals: number;
-  spillLastWriteFailureAt: number | null;
-  spillLastWriteSuccessAt: number | null;
-  spillReadFailures: number;
-  replayScopeMismatchDrops: number;
-}
-
 /**
  * Observe-only snapshot of the in-RAM continuation store, surfaced via GET /api/system/memory.
  * Additive and side-effect free — it does NOT lazy-load the disk snapshot, prune, or evict — so a
@@ -1189,50 +1208,24 @@ export interface ResponseStateMetrics {
  * store (JS heap) or in the runtime allocator (native).
  */
 export function responseStateMetrics(): ResponseStateMetrics {
-  const at = now();
-  let largestBytes = 0;
-  let oldestCreatedAt = at;
-  let residentCount = 0;
-  let spillStubCount = 0;
-  let tombstoneCount = 0;
-  let spillPayloadBytes = 0;
-  for (const state of states.values()) {
-    const bytes = state.sizeBytes;
-    if (bytes > largestBytes) largestBytes = bytes;
-    if (state.createdAt < oldestCreatedAt) oldestCreatedAt = state.createdAt;
-    if (state.kind === "resident") {
-      residentCount += 1;
-    } else if (state.kind === "spill") {
-      spillStubCount += 1;
-      spillPayloadBytes += state.spill.payloadBytes;
-    } else tombstoneCount += 1;
-  }
-  return {
-    count: states.size,
-    residentCount,
-    spillStubCount,
-    tombstoneCount,
+  return computeResponseStateMetrics({
+    states: states.values(),
+    stateCount: states.size,
+    now: now(),
     totalBytes: responseContinuationRetainedStoreSnapshot().bytes,
-    spillPayloadBytes,
-    largestBytes,
-    oldestAgeMs: states.size > 0 ? at - oldestCreatedAt : 0,
     spillWrites: spillCounters.writes,
     spillWriteFailures: spillCounters.writeFailures,
-    spillWriteStatus: spillWriteHealth.consecutiveFailures > 0
-      ? "degraded"
-      : spillWriteHealth.lastSuccessAt !== null
-        ? "healthy"
-        : "initial",
     spillWriteConsecutiveFailures: spillWriteHealth.consecutiveFailures,
-    spillLastWriteFailureCode: spillWriteHealth.lastFailureCode,
-    spillLastWriteFailureOrigin: spillWriteHealth.lastFailureOrigin,
+    spillLastFailureCode: spillWriteHealth.lastFailureCode,
+    spillLastFailureOrigin: spillWriteHealth.lastFailureOrigin,
+    spillLastSuccessAt: spillWriteHealth.lastSuccessAt,
     spillAclRetryReturnedTimeouts: spillCounters.aclRetryReturnedTimeouts,
     spillAclTimeoutMemoRefusals: spillCounters.aclTimeoutMemoRefusals,
-    spillLastWriteFailureAt: spillWriteHealth.lastFailureAt,
-    spillLastWriteSuccessAt: spillWriteHealth.lastSuccessAt,
+    spillCapacityRefusals: spillCounters.capacityRefusals, spillHeadroomEvictions: spillCounters.headroomEvictions,
+    spillLastFailureAt: spillWriteHealth.lastFailureAt,
     spillReadFailures: spillCounters.readFailures,
     replayScopeMismatchDrops,
-  };
+  });
 }
 
 /**
@@ -1256,7 +1249,7 @@ export function rememberResponseState(
   requestBody: unknown,
   response: { id?: unknown; output?: unknown; status?: unknown; incomplete_details?: unknown },
   providerState?: OcxProviderContinuationState | string,
-  opts?: { force?: boolean; clientThreadId?: string },
+  opts?: { force?: boolean; clientThreadId?: string; retainForToolContinuation?: boolean },
 ): void {
   if (!requestBody || typeof requestBody !== "object" || Array.isArray(requestBody)) return;
   const request = requestBody as Record<string, unknown>;
@@ -1266,8 +1259,10 @@ export function rememberResponseState(
   // The passthrough branch records with force so those chains can be expanded locally; the
   // store stays in-memory under RESPONSE_TTL_MS, so this is a proxy-internal continuation cache, not
   // real server-side response storage.
-  if (request.store === false && !opts?.force) return;
   if (typeof response.id !== "string" || !Array.isArray(response.output)) return;
+  // Only an explicitly opted-in adapter may retain pending client calls despite store:false.
+  const unforcedStoreFalse = request.store === false && !opts?.force;
+  if (unforcedStoreFalse && !(opts?.retainForToolContinuation === true && hasPendingClientToolCall(response.output))) return;
   if (response.status === "incomplete") {
     const details = response.incomplete_details;
     if (!details || typeof details !== "object" || Array.isArray(details)
@@ -1300,6 +1295,7 @@ export function rememberResponseState(
     // incomplete agent turn on the Cursor side (we suspended without a real mcpResult), so its
     // checkpoint must not be reused — but the conversation id string itself is still valid.
     ...(Object.keys(normalizedProviderState).length > 0 ? { providers: normalizedProviderState } : {}),
+    ...(unforcedStoreFalse ? { unforcedStoreFalse: true } : {}),
   });
   enforceAppOwnedMemoryBudget();
   schedulePersist();
@@ -1337,11 +1333,7 @@ export function clearResponseStateMemoryForTests(): void {
   oldestResidentAt = null;
   stateRevision = 0;
   pendingSpillUnlinks.length = 0;
-  spillCounters.writes = 0;
-  spillCounters.writeFailures = 0;
-  spillCounters.readFailures = 0;
-  spillCounters.aclRetryReturnedTimeouts = 0;
-  spillCounters.aclTimeoutMemoRefusals = 0;
+  resetSpillCountersForTests();
   spillWriteHealth.consecutiveFailures = 0;
   spillWriteHealth.lastFailureCode = null;
   spillWriteHealth.lastFailureOrigin = null;

package/src/responses/task-input.ts

@@ -54,3 +54,20 @@ export function externalTaskInputContent(item: unknown): string | OcxContentPart
     block.type === "output_text" ? { ...block, type: "input_text" } : block,
   ));
 }
+
+/**
+ * The same recognition, emitted as Responses-wire user content for the raw-body repairs (#6764).
+ *
+ * The passthrough and routed-compaction paths never read the parsed context, so they used to
+ * send this envelope through the generic orphan repair, which prefixes
+ * "[tool output for unknown call]". A summarizer then read an authorized handover as a stray tool
+ * result. Recognition is shared with the parser so both paths agree on what is task input.
+ */
+export function externalTaskInputResponsesContent(item: unknown): Record<string, unknown>[] | undefined {
+  if (externalTaskInputContent(item) === undefined) return undefined;
+  const output = (item as { output: string | TaskInputBlock[] }).output;
+  if (typeof output === "string") return [{ type: "input_text", text: output }];
+  return output.map(block => block.type === "input_image"
+    ? { type: "input_image", image_url: block.image_url, ...(block.detail ? { detail: block.detail === "original" ? "high" : block.detail } : {}) }
+    : { type: "input_text", text: block.text });
+}

package/src/router.ts

@@ -1,3 +1,4 @@
+import { CODEX_INTERNAL_OPENAI_MODELS } from "./codex/control-plane-models";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "./types";
 import { createHash } from "node:crypto";
 import { peekAuthStore } from "./oauth/store";
@@ -12,6 +13,7 @@ import {
 } from "./combos";
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
+import { anthropicInstanceRowShapeMatches } from "./providers/anthropic-instance-id";
 import { providerUsesKeyAuthOverride, resolveProviderApiKey } from "./providers/key-store";
 import { captureProviderApiKeySelection } from "./providers/api-key-selection-capture";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
@@ -53,6 +55,14 @@ import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/eva
 import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
 import { resolveModelPolicy, type ResolvedModelPolicy } from "./providers/resolved-model-policy";
 
+/** Explicit Pool 2 admission refusal; ingress must not recover it through default routing. */
+export class AnthropicSecondaryInstanceUnavailableError extends Error {
+  constructor() {
+    super("Anthropic Pool 2 requires an enabled configured provider with valid OAuth ownership");
+    this.name = "AnthropicSecondaryInstanceUnavailableError";
+  }
+}
+
 export class UnknownRoutingPolicyError extends Error {
   constructor(readonly profileId: string) {
     super(`Unknown routing policy: ${profileId}`);
@@ -521,9 +531,18 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   return resolved;
 }
 
+/**
+ * Rows eligible for bare-model inference (configured default model, model list, model alias).
+ *
+ * The marked builtin Pool 2 row is excluded: it seeds the same catalog as `anthropic`, so letting it
+ * compete would move a bare `claude-*` request onto Pool 2 by insertion order, or make a shared alias
+ * ambiguous. Pool 2 is reached only through `anthropic2/<model>`, its provider alias, or an explicit
+ * `defaultProvider`. An unmarked custom row named `anthropic2` keeps its ordinary custom meaning.
+ */
 function activeProviderEntries(config: OcxConfig): [string, OcxProviderConfig][] {
   return Object.entries(config.providers)
-    .filter(([name, provider]) => name !== LEGACY_CHATGPT_PROVIDER_ID && provider.disabled !== true);
+    .filter(([name, provider]) => name !== LEGACY_CHATGPT_PROVIDER_ID && provider.disabled !== true
+      && !(name === "anthropic2" && anthropicInstanceRowShapeMatches(name, provider)));
 }
 
 export class NoEnabledOpenAiProviderError extends Error {
@@ -564,9 +583,6 @@ export function comboRouteDecisionTrace(
   });
 }
 
-// Codex uses a small number of control-plane model ids that are not part of the public GPT/o
-// naming families. Keep this exact: a broad `codex-*` rule could capture a third-party model.
-const CODEX_INTERNAL_OPENAI_MODELS = new Set(["codex-auto-review"]);
 const MAX_BLOCKED_MODEL_REDIRECT_EDGES = 5;
 
 interface BlockedModelRedirectState {
@@ -620,6 +636,9 @@ function routeResult(
   routeReason: string,
   redirectState: BlockedModelRedirectState,
 ): RouteResult {
+  if (providerName === "anthropic2" && provider.authMode === "oauth" && !anthropicInstanceRowShapeMatches(providerName, provider)) {
+    throw new AnthropicSecondaryInstanceUnavailableError();
+  }
   const qualified = resolveBlockedModelRedirect(config, `${providerName}/${modelId}`);
   const bare = resolveBlockedModelRedirect(config, modelId);
   const crossTarget = config && (
@@ -813,6 +832,11 @@ function routeModelInternal(
   if (slash > 0) {
     const requestedProvider = modelId.slice(0, slash);
     const requestedLower = requestedProvider.toLowerCase();
+    // Literal B is a reserved instance selector even before its row exists. Keep other
+    // qualifiers, including exact uppercase custom keys, on the ordinary routing path.
+    if (requestedProvider === "anthropic2" && !hasOwnProvider(config.providers, requestedProvider)) {
+      throw new AnthropicSecondaryInstanceUnavailableError();
+    }
     let provName: string | undefined;
 
     if (hasOwnProvider(config.providers, requestedProvider)) {

package/src/routing/compatibility/assemble.ts

@@ -76,7 +76,7 @@ export function assemblePolicyCandidateEvidence(
       quota: quotaEvidenceForCandidate({
         provider: candidate.provider,
         model: candidate.model,
-      }),
+      }, config),
       cost: costEvidenceForCandidate({
         provider: candidate.provider,
         model: candidate.model,

package/src/routing/quota.ts

@@ -1,3 +1,5 @@
+import type { OcxConfig } from "../types";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 /**
  * Quota-aware policy scoring (RI-07).
  *
@@ -98,7 +100,7 @@ export function codexPoolQuotaEvidence(accounts: readonly CodexPoolQuotaAccount[
   };
 }
 
-export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuotaEvidence {
+export function quotaEvidenceForCandidate(input: QuotaEvidenceInput, config?: Pick<OcxConfig, "providers">): RouteQuotaEvidence {
   if (input.provider === "openai" && input.codexAccountId) {
     // listAccountQuotas() is the reconciled quota snapshot: config-generation
     // reconciliation prunes removed accounts. Other eligibility dimensions
@@ -113,8 +115,10 @@ export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuota
     return codexAccountQuotaEvidence(input.codexAccountId, input.codexAccountPlan);
   }
 
-  if (input.provider === "anthropic" && input.accountRef) {
-    const quota = getCachedProviderAccountQuota("anthropic", input.accountRef);
+  const instance = config ? configuredAnthropicInstance(config, input.provider)
+    : input.provider === "anthropic" ? "anthropic" : undefined;
+  if (instance && input.accountRef) {
+    const quota = getCachedProviderAccountQuota(instance, input.accountRef);
     if (quota) {
       const family = anthropicFamilyWindow(input.model, quota.customWindows ?? []);
       const percents = [quota.fiveHourPercent, quota.weeklyPercent, quota.monthlyPercent, family?.percent]

package/src/server/auth-cors.ts

@@ -38,6 +38,7 @@ import { redactSecretString } from "../lib/redact";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
+import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -785,6 +786,8 @@ export function providerManagementConfigError(
     return `provider ${name} must not include codexAccountMode`;
   }
   const typed = provider as unknown as OcxProviderConfig;
+  const markerError = anthropicOAuthInstanceConfigError({ providers: { [name]: provider } });
+  if (markerError) return markerError;
   // Every write path (POST, PUT, reload, both PATCH passes) funnels through here, so a PATCH
   // that changes authMode/baseUrl/adapter under a retained tlsProfile is refused before it
   // persists a row the config schema would later reject as document-fatal.
@@ -1057,6 +1060,8 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   modelVercelGatewayRouting: "editor",
   authMode: "editor",
   oauthAccountFailover: "editor",
+  anthropicAccountPool: "editor",
+  anthropicOAuthInstance: "editor",
   keyOptional: "editor",
   freeTier: "editor",
   note: "editor",

package/src/server/background-lifecycle.ts

@@ -14,6 +14,7 @@ import {
 } from "../storage/policy-scheduler";
 import { startQuotaResetPoller, stopQuotaResetPoller } from "../quota/reset-poller";
 import {
+  setCatalogAutoRefreshClientFanout,
   startCatalogAutoRefresh,
   stopCatalogAutoRefresh,
   syncCatalogAutoRefreshCadence,
@@ -40,6 +41,7 @@ type ProcessLoops = {
 
 type LeaseOwner = {
   token: symbol;
+  fanoutRevoked: boolean;
   applyPolicy: PolicyApply;
   resources: ServerResourceOwnerLease;
   lowQuota: LowQuotaRegistration;
@@ -48,6 +50,7 @@ type LeaseOwner = {
 export type ServerBackgroundLifecycleLease = {
   scheduleStartupRun(): void;
   listLowQuotaEvents(limit?: number): LowQuotaEvent[];
+  revokeClientFanout(): void;
   release(): Promise<void>;
   releaseAfterFailedStart(): void;
 };
@@ -61,6 +64,25 @@ function setLivePolicyOwner(applyPolicy: PolicyApply | null): void {
   setStorageCleanupPolicyJobLiveApply(applyPolicy);
 }
 
+/** Resolve the current process owner at delivery time so lease hand-over cannot retain an old port. */
+async function refreshConnectedClientsAfterCatalogChange(isCurrent: () => boolean) {
+  const captured = owners.findLast(owner => !owner.fanoutRevoked);
+  if (!captured) return [];
+  const current = () => isCurrent() && !captured.fanoutRevoked && owners.includes(captured);
+  const [{ readRuntimePort }, { loadConfig }, { localClientSyncAllowed }, { syncEnabledClientIntegrations }] =
+    await Promise.all([
+      import("../config/process-state"),
+      import("../config"),
+      import("../codex/desired-state"),
+      import("./management/config-routes"),
+    ]);
+  const runtime = readRuntimePort(process.pid);
+  const config = loadConfig();
+  // An explicit catalog tick on a hub is not permission to enroll its local clients.
+  if (!runtime || !current() || !localClientSyncAllowed(config)) return [];
+  return syncEnabledClientIntegrations(runtime.port, config, {}, { unattended: { isCurrent: current } });
+}
+
 function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
   let memoryWatchdog: MemoryWatchdog | null = null;
   let stateStoreSweeper: ReturnType<typeof startStateStoreSweeper> | null = null;
@@ -83,6 +105,7 @@ function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
     // and interval timers are unref'd. The scheduler
     // module keeps every heavy import inside its tick, so naming it statically here
     // costs a module record and nothing else.
+    setCatalogAutoRefreshClientFanout(refreshConnectedClientsAfterCatalogChange);
     startCatalogAutoRefresh();
     // The scheduler starts at its default cadence because resolving the operator's value
     // reads the config barrel. Fire-and-forget: startup must not await an optional
@@ -106,6 +129,7 @@ function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
     stopStorageCleanupScheduler();
     stopQuotaResetPoller();
     stopCatalogAutoRefresh();
+    setCatalogAutoRefreshClientFanout(null);
     setLivePolicyOwner(null);
     throw error;
   }
@@ -119,6 +143,7 @@ function stopProcessLoops(): void {
   stopStorageCleanupScheduler();
   stopQuotaResetPoller();
   stopCatalogAutoRefresh();
+  setCatalogAutoRefreshClientFanout(null);
   setLivePolicyOwner(null);
 }
 
@@ -181,6 +206,7 @@ export function acquireServerBackgroundLifecycle(
 
   const owner: LeaseOwner = {
     token: Symbol("server-background-lifecycle"),
+    fanoutRevoked: false,
     applyPolicy,
     resources: acquireServerResourceOwner(),
     lowQuota: registerCodexLowQuotaProtection(config),
@@ -206,6 +232,7 @@ export function acquireServerBackgroundLifecycle(
     return stopStoragePolicyWorker().finally(() => { cleanupInProgress = false; });
   }
   return {
+    revokeClientFanout() { owner.fanoutRevoked = true; },
     listLowQuotaEvents(limit) { return owner.lowQuota.listEvents(limit); },
     scheduleStartupRun() {
       if (owners.some(candidate => candidate.token === owner.token)) {

package/src/server/chat-completions.ts

@@ -32,7 +32,7 @@ import {
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
 import { estimateTokens } from "../lib/token-estimate";
-import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { AnthropicSecondaryInstanceUnavailableError, captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
@@ -113,6 +113,7 @@ export async function handleChatCompletions(
     return finalizeTranslatorBudgetResponse(
       await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
       translatorBudget,
+      req.signal,
     );
   } catch (error) {
     translatorBudget.dispose();
@@ -242,6 +243,11 @@ async function handleChatCompletionsWithBudget(
       }
     }
   } catch (err) {
+    if (err instanceof AnthropicSecondaryInstanceUnavailableError) {
+      logCtx.requestedModel = requestedModel;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 401, { closeReason: "non_stream" });
+      return chatCompletionsErrorResponse(401, err.message, "authentication_error");
+    }
     if (err instanceof AdmissionModelDeniedError) {
       logCtx.requestedModel = requestedModel;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });