@bitkyc08/opencodex 2.87.0 → 2.89.0

package/src/providers/api-key-resolve.ts

@@ -16,6 +16,7 @@
  * Policy: a reference that cannot be resolved fails closed (no key) and is warned once per
  * account; nothing ever rewrites plaintext into config or its backups.
  */
+import { invalidateDecisionKeyQuotas, observeDecisionKeyCredential } from "../lib/decision-quota-sink";
 import { resolveEnvValue } from "../config/proxy-env";
 import { loadKeyringBinding } from "../lib/keyring-native";
 import { isGcpCredentialMaterial } from "../lib/gcp-credential-input";
@@ -52,6 +53,7 @@ export function providerKeyResolutionGeneration(): number {
 /** Test seam: swap the OS entry for an in-memory one and drop caches. */
 export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychainEntryFactory | null): void {
   entryFactory = factory ?? defaultEntryFactory;
+  invalidateDecisionKeyQuotas();
   resolvedCache.clear();
   resolutionGeneration++;
   warnedAccounts.clear();
@@ -59,6 +61,7 @@ export function setProviderKeychainEntryFactoryForTests(factory: ProviderKeychai
 
 /** Write-path seam: a store/restore mutated secrets, so cached reads and warnings are stale. */
 export function invalidateResolvedProviderKeyCache(): void {
+  invalidateDecisionKeyQuotas();
   resolvedCache.clear();
   resolutionGeneration++;
   warnedAccounts.clear();
@@ -114,15 +117,18 @@ function readKeychain(account: string, quiet = false): string | undefined {
  */
 export function resolveProviderApiKey(value: string | undefined): string | undefined {
   if (!value) return undefined;
-  if (isKeychainReference(value)) return readKeychain(keychainAccount(value));
-  return resolveEnvValue(value);
+  const resolved = isKeychainReference(value) ? readKeychain(keychainAccount(value)) : resolveEnvValue(value);
+  observeDecisionKeyCredential(value, resolved);
+  return resolved;
 }
 
 /** The same resolution without the unreadable-reference warning, for observe-only callers. */
 export function resolveProviderApiKeyQuietly(value: string | undefined): string | undefined {
   if (!value) return undefined;
-  if (isKeychainReference(value)) return readKeychain(keychainAccount(value), true);
-  return resolveEnvValue(value);
+  const resolved = isKeychainReference(value) ? readKeychain(keychainAccount(value), true) : resolveEnvValue(value);
+  // A quiet read still sees a replaced secret; advisory key evidence published under the old one must not outlive it.
+  observeDecisionKeyCredential(value, resolved);
+  return resolved;
 }
 
 export type ProviderKeyStoreKind = "keychain" | "env" | "file" | "none";

package/src/providers/api-key-selection.ts

@@ -13,6 +13,9 @@ import { captureProviderApiKeySelection } from "./api-key-selection-capture";
 export { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
 function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
+  if (expected.distributed) return provider.apiKeySelectionRevision === expected.revision
+    && provider.requestPacing?.enabled === true && provider.requestPacing.keySelection === "round-robin"
+    && !!provider.apiKeyPool?.some(entry => !entry.disabled && entry.id === expected.entryId && entry.key === expected.reference);
   const current = captureProviderApiKeySelection(provider);
   return current.entryId === expected.entryId && current.reference === expected.reference
     && current.revision === expected.revision;
@@ -24,10 +27,12 @@ function currentKeyProvider(config: OcxConfig, name: string, selection?: Provide
   let row = configured;
   if (selection?.distributed) {
     const entry = configured.apiKeyPool?.find(key => key.id === selection.entryId && key.key === selection.reference);
-    if (!entry || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
+    if (!entry || entry.disabled || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
       || !configured.requestPacing?.enabled || configured.requestPacing.keySelection !== "round-robin") return null;
     row = { ...configured, apiKey: entry.key, _apiKeyAttempt: selection };
   }
+  if (row.apiKeyPool?.some(entry => entry.disabled && entry.key === row.apiKey)
+    || row.apiKeyPool?.length && row.apiKeyPool.every(entry => entry.disabled)) return null;
   const current = routedProviderConfig(name, { ...row, _apiKeyAttempt: selection?.distributed ? selection : undefined });
   if (current.authMode === "oauth" || current.authMode === "forward") return null;
   if (current.authMode === "key" && !current.keyOptional && !current.apiKey?.trim()) return null;

package/src/providers/api-keys.ts

@@ -21,6 +21,8 @@ export interface ProviderApiKeyInfo extends AccountQuotaFields {
   /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
   masked: string;
   active: boolean;
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   addedAt?: number;
 }
 
@@ -217,7 +219,7 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
   const pool = provider.apiKeyPool?.length
     ? provider.apiKeyPool
     : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
-  const activeId = (pool.find(entry => entry.key === provider.apiKey) ?? pool[0])?.id ?? null;
+  const activeId = pool.find(entry => entry.key === provider.apiKey)?.id ?? null;
   return {
     activeId,
     keys: pool.map(entry => ({
@@ -225,6 +227,8 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
       ...(entry.label ? { label: entry.label } : {}),
       masked: maskApiKey(entry.key),
       active: entry.id === activeId,
+      ...(entry.disabled ? { disabled: true } : {}),
+      ...(entry.pauseDetails ? { pauseDetails: entry.pauseDetails } : {}),
       ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
     })),
   };
@@ -300,7 +304,7 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
     } else {
       pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
     }
-    fresh.apiKey = trimmed;
+    if (!existing?.disabled) fresh.apiKey = trimmed;
     return { changed: true, selectionChanged: true, value: id };
   });
   if (committed.status !== "committed") return { error: "provider selection unavailable" };
@@ -313,7 +317,7 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
     const entry = provider.apiKeyPool?.find(e => e.id === id)
       ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
         ? { id, key: provider.apiKey } : undefined);
-    if (!entry) return { changed: false, value: false };
+    if (!entry || entry.disabled) return { changed: false, value: false };
     ensurePool(provider);
     provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
@@ -344,7 +348,7 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
     removed = entry.key;
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool[0];
+      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }

package/src/providers/claude-cli-usage.ts

@@ -1,4 +1,7 @@
 import { markAnthropicFamilyEnumeration } from "./quota/anthropic-family-headers";
+import { rawAnthropicUsageWindows } from "./quota/anthropic-decision-windows";
+import { bindRawDecisionWindows } from "./quota-decision-publication";
+import { decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { CLAUDE_CLI_USER_AGENT } from "./claude-cli-identity";
 import { asRecord, normalizePercent, normalizeResetAt, readQuotaJson, REQUEST_TIMEOUT_MS } from "./quota-wire";
 import type { ProviderQuota, ProviderQuotaWindow } from "./quota-types";
@@ -41,6 +44,7 @@ function parseClaudeLimit(value: unknown): ProviderQuotaWindow | null {
   return { label, scope: "model", percent, ...(resetAt !== undefined ? { resetAt } : {}) };
 }
 
+/** Read the Anthropic OAuth usage endpoint for an access token and return the parsed quota, or null on a non-OK or malformed response. */
 export async function readAnthropicUsageQuota(accessToken: string): Promise<ProviderQuota | null> {
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
@@ -87,6 +91,7 @@ export async function readAnthropicUsageQuota(accessToken: string): Promise<Prov
     ...(customWindows.length > 0 ? { customWindows } : {}),
     updatedAt: Date.now(),
   };
+  if (decisionQuotaSinkActive()) bindRawDecisionWindows(quota, rawAnthropicUsageWindows(body, quota.updatedAt));
   // Empty / schema-changed payloads must not cache as "success with no bars".
   return hasQuotaRows(quota) ? markAnthropicFamilyEnumeration(quota, Array.isArray(body.limits) && body.limits.every(raw => {
     const kind = asRecord(raw)?.kind;

package/src/providers/key-failover.ts

@@ -493,9 +493,9 @@ export function selectProactiveApiKey(
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
-  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+  if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
-  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  const eligible = pool.filter(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now));
   if (eligible.length === 0) return null;
 
   let chosen = eligible[0]!;
@@ -504,7 +504,7 @@ export function selectProactiveApiKey(
     const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
     for (let offset = 1; offset <= pool.length; offset += 1) {
       const candidate = pool[(lastIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       chosen = candidate;
       break;
     }
@@ -518,11 +518,11 @@ export function selectProactiveApiKey(
   const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
     const freshPool = freshProvider.apiKeyPool ?? [];
     const target = freshPool.find(entry => entry.id === chosen.id);
-    if (!target) return { changed: false, value: null };
+    if (!target || target.disabled) return { changed: false, value: null };
     if (freshProvider.apiKey === target.key) return { changed: false, value: null };
     const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
     // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
-    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+    if (freshActive && !freshActive.disabled && !isKeyInCooldown(providerName, freshActive.id, now)) {
       return { changed: false, value: null };
     }
     freshProvider.apiKey = target.key;
@@ -564,7 +564,7 @@ export function selectProactiveApiKeyTransport(
 
 const dispatchKeyCursor = new Map<string, string>();
 function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
-  const pool = (provider.apiKeyPool ?? []).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  const pool = (provider.apiKeyPool ?? []).filter(entry => !entry.disabled).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
   const previous = dispatchKeyCursor.get(providerName);
   const start = pool.findIndex(entry => entry.id === previous);
   for (let offset = 1; offset <= pool.length; offset++) {
@@ -575,7 +575,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
       entryId: entry.id, reference: entry.key, revision: provider.apiKeySelectionRevision, distributed: true,
     } };
   }
-  const next = Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000));
+  const next = pool.length ? Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000)) : now + 1000;
   throw new RequestPacingQueueOverloadError(providerName, "keys_exhausted", Math.max(1, Math.ceil((next - now) / 1000)));
 }
 
@@ -711,7 +711,7 @@ export function recordDistributedKeyFailure(
   const provider = config.providers[providerName];
   if (!selection?.distributed || !provider || provider.authMode === "oauth" || provider.authMode === "forward") return false;
   const failed = provider.apiKeyPool?.find(entry => entry.id === selection.entryId && entry.key === selection.reference);
-  if (!failed || provider.apiKeySelectionRevision !== selection.revision) return false;
+  if (!failed || failed.disabled || provider.apiKeySelectionRevision !== selection.revision) return false;
   const delay = status === "billing" ? ANTHROPIC_BILLING_COOLDOWN_MS : status === 401 ? MAX_COOLDOWN_MS : quotaResetAt !== undefined
     ? Math.max(1, quotaResetAt - now) : parseRetryAfterMs(retryAfter, now) ?? DEFAULT_COOLDOWN_MS;
   for (const entry of provider.apiKeyPool ?? []) if (entry.key === failed.key) {
@@ -739,7 +739,7 @@ function rotateKeyAfterFailure(
   if (attemptedSelection?.distributed) {
     if (acceptsFreshProvider && !acceptsFreshProvider(provider)) return null;
     if (!recordDistributedKeyFailure(config, providerName, attemptedSelection, failureStatus, now, retryAfterHeader, quotaResetAt)) return null;
-    if (!(provider.apiKeyPool ?? []).some(entry => !isKeyInCooldown(providerName, entry.id, now))) return null;
+    if (!(provider.apiKeyPool ?? []).some(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now))) return null;
     return allocateDistributedKey(providerName, provider, now);
   }
 
@@ -764,7 +764,7 @@ function rotateKeyAfterFailure(
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
-      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+      if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
           value: { failedId: failedEntry?.id },
@@ -776,7 +776,7 @@ function rotateKeyAfterFailure(
     const candidateCount = failedEntry ? pool.length - 1 : pool.length;
     for (let offset = 1; offset <= candidateCount; offset += 1) {
       const candidate = pool[(currentIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       freshProvider.apiKey = candidate.key;
       return {
         changed: true,

package/src/providers/model-rename-fields.ts

@@ -51,6 +51,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   apiKeyTransport: "none",
   apiKeyPool: "none",
   apiKeyPoolStrategy: "none",
+  accountAutoPause: "none",
   apiKeySelectionRevision: "none",
   _apiKeyAttempt: "none",
   defaultModel: "scalar",

package/src/providers/opencode-zen-rate-limit.ts

@@ -1,22 +1,16 @@
 /**
  * OpenCode Zen short-window rate-limit guidance (#1145 / OCX-56).
  *
- * OpenCode's keyed and keyless Zen chat endpoints share `https://opencode.ai/zen/v1`.
+ * OpenCode's keyed Zen chat endpoint uses `https://opencode.ai/zen/v1`.
  * Free-model traffic can hit a short-window burst ceiling around 15–20 RPM
  * (community-measured). Zen often answers with opaque `429 Rate limit exceeded`
  * bodies and may omit `Retry-After` / `X-RateLimit-*`; when those headers are
- * present they still take precedence. Distinct from the keyless desktop
- * ~200 requests / 5h quota documented on `opencode-free`.
- *
- * The same module also owns the keyless free-tier admission explanation (#4121):
- * Zen rejects a request that carries no `x-opencode-session` header with
- * `MissingSessionID` / "OpenCode's free tier can only be used in OpenCode".
- * opencodex does not synthesize that header — see {@link enrichOpenCodeZenFreeTierMessage}.
+ * present they still take precedence.
  */
 import { validateClientRetryAfterHeader } from "../lib/retry-after";
 import { registryEntryForProviderDestination } from "./registry";
 
-const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen", "opencode-free"]);
+const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen"]);
 
 /** Observed free-model burst ceiling on Zen (not an official OpenCode figure). */
 export const OPENCODE_ZEN_OBSERVED_RPM_HINT = "roughly 15-20 requests per minute";
@@ -49,7 +43,7 @@ export function isOpenCodeZenRateLimitProvider(opts: {
 
 /**
  * Same-key `retryOn429` only applies on key-authenticated HTTP paths — not
- * keyless `opencode-free` traffic and not custom `runTurn` transports.
+ * keyless traffic and not custom `runTurn` transports.
  */
 export function supportsOpenCodeZenRetryOn429Guidance(opts: {
   authMode?: string;
@@ -70,6 +64,9 @@ export function enrichOpenCodeZenRateLimitMessage(
   message: string,
   opts: {
     status: number;
+    /** Parsed upstream error type, when available. */
+    upstreamErrorType?: string | null;
+    upstreamErrorCode?: string | null;
     providerName?: string;
     baseUrl?: string;
     adapter?: string;
@@ -84,7 +81,9 @@ export function enrichOpenCodeZenRateLimitMessage(
 ): string {
   if (opts.status !== 429) return message;
   if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  if (!/rate\s*limit/i.test(message)) return message;
+  const errorText = `${opts.upstreamErrorType ?? ""} ${opts.upstreamErrorCode ?? ""} ${message}`.replace(/[_-]/g, " ");
+  if (/\b(?:quota|billing)\b|\busage\s+limit\b|\binsufficient\s+(?:credits?|balance|funds)\b|\b(?:credits?|balance)\s+(?:exhausted|depleted)\b/i.test(errorText)) return message;
+  if (opts.upstreamErrorType !== "rate_limit_error" && !/rate\s*limit/i.test(message)) return message;
   if (message.includes(ENRICHMENT_MARKER)) return message;
 
   const upstreamRetry = validateClientRetryAfterHeader(
@@ -107,73 +106,13 @@ export function enrichOpenCodeZenRateLimitMessage(
 }
 
 /**
- * Zen's keyless free tier admits only OpenCode's own client. A request without an
- * `x-opencode-session` header is refused with error type `MissingSessionID` and the
- * message "OpenCode's free tier can only be used in OpenCode" (#4121).
- *
- * Presence of the header is the whole gate — any value clears it — so opencodex could
- * pass by minting one. It does not. Fabricating a session identifier and a versioned
- * `opencode/<version>` User-Agent is a claim to *be* the OpenCode client, and no upstream
- * contract authorizes a third-party agent to make it; an HTTP 200 obtained that way is a
- * bypassed admission check, not permission. Until OpenCode publishes a third-party
- * integration path for this exact keyless tier, the supported route is the keyed
- * `opencode-zen` provider.
- *
- * Two markers are matched because the two request surfaces expose different parts of the
- * upstream envelope: the Responses path forwards the bounded raw body (which carries the
- * `MissingSessionID` type), while the native Chat path forwards only the parsed message.
- */
-const OPENCODE_ZEN_FREE_TIER_LOCK_IN = /MissingSessionID|free tier can only be used in OpenCode/i;
-
-/** Idempotence marker — the appended guidance must not stack across enrichment layers. */
-const FREE_TIER_ENRICHMENT_MARKER = "does not send a fabricated OpenCode session header";
-
-/** True when an upstream error body is Zen's keyless free-tier admission refusal. */
-export function isOpenCodeZenFreeTierLockIn(message: string, upstreamErrorType?: string | null): boolean {
-  if (upstreamErrorType && OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(upstreamErrorType)) return true;
-  return OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(message);
-}
-
-/**
- * Replace a raw `MissingSessionID` passthrough with an explanation of the upstream
- * restriction and the supported alternative. No-op for every other provider and every
- * other error, and idempotent so layered enrichment cannot append it twice.
- */
-export function enrichOpenCodeZenFreeTierMessage(
-  message: string,
-  opts: {
-    providerName?: string;
-    baseUrl?: string;
-    adapter?: string;
-    /** Upstream `error.type`, when the caller parsed one out of the envelope. */
-    upstreamErrorType?: string | null;
-  },
-): string {
-  if (message.includes(FREE_TIER_ENRICHMENT_MARKER)) return message;
-  if (!isOpenCodeZenFreeTierLockIn(message, opts.upstreamErrorType)) return message;
-  if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  return (
-    `${message}`
-    + " OpenCode Zen's keyless free tier admits only OpenCode's own client: it refuses any"
-    + " request that arrives without an x-opencode-session header."
-    + ` opencodex ${FREE_TIER_ENRICHMENT_MARKER}, because presenting itself as the OpenCode`
-    + " client is a claim no upstream contract supports."
-    + " Use the keyed opencode-zen provider with an OpenCode Zen API key"
-    + " (https://opencode.ai/auth), or route this model through another provider."
-    + " Upstream terms: https://opencode.ai/docs/zen/."
-  );
-}
-
-/**
- * Single entry point for Zen upstream-error guidance on the Responses wire: short-window
- * rate limits first, then the keyless free-tier admission refusal. Each layer is a no-op
- * outside its own case, so the composition is safe for every other upstream failure.
+ * Zen upstream-error guidance on Responses and native Messages.
  */
 export function enrichOpenCodeZenUpstreamMessage(
   message: string,
   opts: Parameters<typeof enrichOpenCodeZenRateLimitMessage>[1] & { upstreamErrorType?: string | null },
 ): string {
-  return enrichOpenCodeZenFreeTierMessage(enrichOpenCodeZenRateLimitMessage(message, opts), opts);
+  return enrichOpenCodeZenRateLimitMessage(message, opts);
 }
 
 /** The effective HTTP endpoint, never the configured row name, identifies Console. */

package/src/providers/quota/account-cache.ts

@@ -1,3 +1,6 @@
+import { rawAnthropicHeaderWindows } from "./anthropic-decision-windows";
+import { clearDecisionAccountQuotas, decisionQuotaSinkActive } from "../../lib/decision-quota-sink";
+import { bindRawDecisionWindows, publishAnthropicDecisionQuota } from "../quota-decision-publication";
 import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
 import { anthropicModelQuotaFor, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
@@ -289,6 +292,7 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
   writerGeneration: number,
   status?: number,
   model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
   if (!accountId) return;
   const key = accountCacheKey(instance, accountId);
@@ -318,14 +322,20 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
       ...(observed.customWindows ? { customWindows: mergeAnthropicFamilyWindows(previous?.quota?.customWindows, observed.customWindows) } : {}),
     }, observed.updatedAt),
   });
+  // Advisory evidence is published for the primary pool only; Pool 2 stays unknown to decisions.
+  if (instance === "anthropic" && generation && generation === decisionCredentialGeneration && decisionQuotaSinkActive()) {
+    bindRawDecisionWindows(observed, rawAnthropicHeaderWindows(headers, observed.updatedAt));
+    publishAnthropicDecisionQuota(accountId, generation, observed, true);
+  }
   persistAccountQuotaCache();
 }
 
 /** Legacy recorder: config/roster generation is numeric and distinct from bearer ownership. */
 export function recordAnthropicAccountQuotaFromHeaders(
   accountId: string, headers: Headers, writerGeneration: number, status?: number, model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
-  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model);
+  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model, decisionCredentialGeneration);
 }
 
 /**
@@ -446,6 +456,7 @@ export function resetProviderQuotaReconcileStateForTests(): void {
 
 /** Drop cached per-account rows (all, or just one provider's). */
 export function clearAccountQuotaCache(provider?: string): void {
+  clearDecisionAccountQuotas(provider);
   // Anthropic readers use provider-owned epochs; B cannot revoke an A flight.
   if (provider !== "anthropic2") explicitAccountEpoch += 1;
   if (!provider) {
@@ -475,6 +486,9 @@ export function clearAccountQuotaCache(provider?: string): void {
 
 /** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
 export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  // Advisory decision evidence of the same account is a copy of the dropped bars; it must not
+  // keep ranking the account from the pre-reset window while the reread is pending or fails.
+  clearDecisionAccountQuotas(provider, accountId);
   hydrateAccountQuotaCache();
   const key = accountCacheKey(provider, accountId);
   accountQuotaCache.delete(key);

package/src/providers/quota/anthropic-account-quota.ts

@@ -64,6 +64,7 @@ export async function fetchAnthropicAccountQuota(
   // and a thrown read (network failure) both record the unavailable row over the retained
   // in-flight observations, as the pre-instance A path did, so joined callers and later cached
   // reads agree and windows that expired during the shared probe are normalized away.
+  /** Cache the settled probe result for an account and publish its decision evidence only while the flight is still current for its credential and generation. */
   const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
     const previous = accountQuotaCache.get(key);
     const retained = previous?.isCurrent?.() === false ? undefined : previous;
@@ -72,7 +73,7 @@ export async function fetchAnthropicAccountQuota(
       ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
       ...(!result ? { unavailable: true as const } : {}), isCurrent,
     };
-    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); sweepExpiredOnWrite(entry.ts); }
+    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); result?.publishDecisionQuota(); sweepExpiredOnWrite(entry.ts); }
     return entry;
   };
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -1,3 +1,5 @@
+import { boundDecisionWindows } from "../quota-decision-publication";
+import { decisionQuotaSinkActive, publishDecisionAccountQuota } from "../../lib/decision-quota-sink";
 import { mergeAnthropicFamilyWindows, hasAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { getCachedProviderAccountQuota, captureProviderAccountQuotaEpoch } from "./account-cache";
 import { anthropicModelQuotaFor } from "../../oauth/anthropic-model-quota";
@@ -10,6 +12,7 @@ export class AnthropicQuotaProbeOwnershipError extends Error {}
 
 export type AnthropicCooldownRecoveryProbe = Readonly<{
   instance: AnthropicInstanceId;
+  generation: string;
   requiresFreshDispatch: boolean;
   isCurrentCredential(): boolean;
   isCurrentFamily(): boolean;
@@ -20,10 +23,13 @@ export type AnthropicCooldownRecoveryProbe = Readonly<{
 export type AnthropicQuotaRecoveryResult = Readonly<{
   instance: AnthropicInstanceId;
   quota: ProviderQuota;
+  /** Publishes secret-free advisory evidence for the primary pool only; a no-op for Pool 2. */
+  publishDecisionQuota(): void;
   /** Must be checked synchronously at each publication boundary. */
   isCurrent(): boolean;
 }>;
 
+/** Create the cooldown-recovery probe owner for one Anthropic instance; its results are credential- and generation-bound before they may publish. */
 function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
   const familyGeneration = (accountId: string) => anthropicModelQuotaFor(instance).anthropicFamilyQuotaGeneration(accountId);
 
@@ -129,6 +135,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     };
     return {
       instance,
+      generation,
       requiresFreshDispatch: claim !== null,
       isCurrentCredential,
       isCurrentFamily: () => familyGeneration(accountId) === capturedFamilyGeneration,
@@ -165,6 +172,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
     // generation; any later observation/429 then invalidates publication before a cache write.
+    const rawQuota = quota;
     const ownsFamily = probe.isCurrentFamily();
     const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
     if (ownsFamily) anthropicModelQuotaFor(instance).observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
@@ -177,14 +185,24 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     const publicationGeneration = anthropicCooldownGeneration(accountId);
     const publicationFamilyGeneration = familyGeneration(accountId);
+    /** True while the probed credential, cooldown generation and family generation are unchanged and publication is still permitted. */
+    const isCurrent = () => probe.isCurrentCredential()
+      && anthropicCooldownGeneration(accountId) === publicationGeneration
+      && familyGeneration(accountId) === publicationFamilyGeneration
+      && mayPublish();
     afterSettlementForTests?.();
     return {
       instance,
       quota,
-      isCurrent: () => probe.isCurrentCredential()
-        && anthropicCooldownGeneration(accountId) === publicationGeneration
-        && familyGeneration(accountId) === publicationFamilyGeneration
-        && mayPublish(),
+      isCurrent,
+      publishDecisionQuota: () => {
+        // Activation first: ownership validation reads the auth store and must not run for signals-off installs.
+        if (instance !== "anthropic" || !decisionQuotaSinkActive() || !isCurrent()) return;
+        // An unbound probe result was parsed while inactive: unknown, never display fallback.
+        const windows = boundDecisionWindows(rawQuota);
+        if (windows) publishDecisionAccountQuota("anthropic", accountId, probe.generation,
+          windows.filter(row => ownsFamily || ["5h", "weekly", "monthly"].includes(row.window)), !authoritative);
+      },
     };
   }
 

package/src/providers/quota/anthropic-decision-windows.ts

@@ -0,0 +1,47 @@
+/** Raw advisory projection; compatibility display clamping/rounding remains unchanged. */
+import type { DecisionQuotaWindow } from "../quota-decision-snapshot";
+import { normalizeResetAt, toFiniteNumber } from "../quota-wire";
+/** Return a plain object value, or undefined for non-objects and arrays. */
+const record = (value: unknown): Record<string, unknown> | undefined =>
+  value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+/** Normalize a reset value; an explicit invalid reset becomes NaN so it cannot read as an undated valid measurement. */
+function reset(value: unknown): number | undefined {
+  // Explicit invalid reset must not become an apparently undated valid measurement.
+  return value === undefined || value === null ? undefined : normalizeResetAt(value) ?? NaN;
+}
+/** Extract raw decision windows (5h, weekly and per-model families) from an Anthropic usage body, keeping invalid resets distinct from display parsing. */
+export function rawAnthropicUsageWindows(body: Record<string, unknown>, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  /** Append one window when its percentage is a finite number, carrying its normalized reset. */
+  const add = (window: DecisionQuotaWindow["window"], raw: unknown, percentField: string) => {
+    const row = record(raw);
+    const percent = toFiniteNumber(row?.[percentField]);
+    if (percent === undefined) return;
+    const resetAt = reset(row?.resets_at);
+    rows.push({ window, percent, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  };
+  for (const [window, field] of [["5h", "five_hour"], ["weekly", "seven_day"], ["fable", "seven_day_fable"], ["opus", "seven_day_opus"], ["sonnet", "seven_day_sonnet"]] as const) add(window, body[field], "utilization");
+  for (const limit of Array.isArray(body.limits) ? body.limits : []) {
+    const row = record(limit);
+    if (row?.kind !== "weekly_scoped") continue;
+    const display = record(record(row.scope)?.model)?.display_name;
+    if (typeof display !== "string") continue;
+    const label = display.replace(/[\u0000-\u001f\u007f-\u009f]/gu, "").toLowerCase();
+    const family = (["fable", "opus", "sonnet"] as const).find(family => label.includes(family));
+    if (family) add(family, row, "percent");
+  }
+  return rows;
+}
+/** Extract decision windows from Anthropic unified rate-limit response headers, converting utilization fractions to percentages. */
+export function rawAnthropicHeaderWindows(headers: Headers, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  for (const [window, wire] of [["5h", "5h"], ["weekly", "7d"], ["fable", "7d_oi"]] as const) {
+    const fraction = toFiniteNumber(headers.get(`anthropic-ratelimit-unified-${wire}-utilization`));
+    if (fraction === undefined || fraction < 0 || fraction > 1) continue;
+    const rawReset = headers.get(`anthropic-ratelimit-unified-${wire}-reset`);
+    const seconds = toFiniteNumber(rawReset);
+    const resetAt = rawReset === null ? undefined : seconds !== undefined && seconds > 0 ? seconds * 1000 : NaN;
+    rows.push({ window, percent: fraction * 100, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  }
+  return rows;
+}