@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/providers/mistral-transport.ts

@@ -0,0 +1,207 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
+import { configuredOutboundFetch } from "../lib/proxy-env";
+import { waitOutsideProviderHeaderDeadline } from "../lib/provider-admission-wait";
+import { markSameTargetRetryHold, sleepWithAbort } from "../lib/upstream-retry";
+import { RequestPacingQueueOverloadError } from "./request-pacing";
+import type { OcxProviderTransport } from "./xai-transport";
+
+const MAX_IDENTITIES = 128;
+const DEFAULT_MAX_WAIT_MS = 60_000; // Existing retry wait budget, not an inferred rate window.
+const MINUTE_MS = 60 * 1000; // Unit named by the observed headers, never an account quota.
+type RecoveryState = { generation: number; probe?: { done: Promise<void>; finish(): void } };
+
+/** Match the supported key-auth Chat destination, including one optional trailing slash. */
+export function isCanonicalMistralChat(
+  provider: Pick<OcxProviderConfig, "adapter" | "authMode" | "baseUrl">,
+): boolean {
+  if (provider.adapter !== "openai-chat" || (provider.authMode !== undefined && provider.authMode !== "key")) return false;
+  try {
+    const url = new URL(provider.baseUrl);
+    return url.origin === "https://api.mistral.ai" && /^\/v1\/?$/.test(url.pathname)
+      && !url.username && !url.password && !url.search && !url.hash;
+  } catch { return false; }
+}
+
+/** Read a nonnegative integer counter; reject missing or malformed values. */
+function count(headers: Headers, name: string): number | undefined {
+  const raw = headers.get(name)?.trim();
+  if (!raw || !/^\d+$/.test(raw)) return undefined;
+  const value = Number(raw);
+  return Number.isSafeInteger(value) ? value : undefined;
+}
+
+/** Read the server delay as seconds or an HTTP date; ignore invalid hints. */
+function retryDelay(headers: Headers, now: number): number | undefined {
+  const raw = headers.get("retry-after")?.trim();
+  if (!raw) return undefined;
+  const value = /^\d+(?:\.\d+)?$/.test(raw) ? Number(raw) * 1000 : Date.parse(raw) - now;
+  return Number.isFinite(value) ? Math.max(0, value) : undefined;
+}
+
+/** Classify measured refusal evidence only; never predict a future cache hit or token charge. */
+export function mistralMinuteRefusal(headers: Headers): "temporary" | "charge-above-allowance" | "unknown" {
+  const month = count(headers, "x-ratelimit-limit-tokens-month");
+  if (month !== undefined && count(headers, "x-ratelimit-remaining-tokens-month") === 0) return "unknown";
+  const limit = count(headers, "x-ratelimit-limit-tokens-minute");
+  const remaining = count(headers, "x-ratelimit-remaining-tokens-minute");
+  const cost = count(headers, "x-ratelimit-tokens-query-cost");
+  if (limit !== undefined && limit > 0 && cost !== undefined && cost > limit) return "charge-above-allowance";
+  if (limit !== undefined && limit > 0 && remaining !== undefined && remaining <= limit
+    && (remaining === 0 || (cost !== undefined && cost > remaining))) return "temporary";
+  const requests = count(headers, "x-ratelimit-limit-req-minute");
+  if (requests !== undefined && requests > 0 && count(headers, "x-ratelimit-remaining-req-minute") === 0) return "temporary";
+  return "unknown";
+}
+
+/** Process-local observations, never a fixed account/plan quota or a persisted credential. */
+export class MistralBudgetPacer {
+  private readonly deadlines = new Map<string, number>();
+  private readonly recoveries = new Map<string, RecoveryState>();
+  /** Latest live deadline evicted at capacity; unknown identities wait it out instead of sending early. */
+  private evictedUntil = 0;
+  private waiting = 0;
+
+  constructor(
+    private readonly now: () => number = Date.now,
+    private readonly sleep: (ms: number, signal?: AbortSignal) => Promise<void> = sleepWithAbort,
+  ) {}
+
+  /** Record server delays and confirmed minute pressure for this credential and model. */
+  observe(identity: string, headers: Headers, status = 200): void {
+    const tokens = count(headers, "x-ratelimit-remaining-tokens-minute");
+    const requests = count(headers, "x-ratelimit-remaining-req-minute");
+    // Healthy remaining counters never predict the next request's cache/charge.
+    if (status !== 429 && tokens !== 0 && requests !== 0) return;
+    // With no explicit time, activate a conservative minute hold only AFTER a
+    // refusal establishes pressure. Healthy responses never predict the next cost.
+    const delay = retryDelay(headers, this.now())
+      ?? (status === 429 && mistralMinuteRefusal(headers) === "temporary" ? MINUTE_MS : undefined);
+    if (delay === undefined || delay === 0) return;
+    for (const [key, deadline] of this.deadlines) {
+      if (deadline <= this.now()) this.deadlines.delete(key);
+    }
+    if (!this.deadlines.has(identity) && this.deadlines.size >= MAX_IDENTITIES) {
+      const [evicted, until] = this.deadlines.entries().next().value!;
+      this.evictedUntil = Math.max(this.evictedUntil, until);
+      this.deadlines.delete(evicted);
+    }
+    this.deadlines.set(identity, Math.max(this.deadlines.get(identity) ?? 0, this.now() + delay));
+    if (status === 429) {
+      if (!this.recoveries.has(identity) && this.recoveries.size >= MAX_IDENTITIES) {
+        const idle = [...this.recoveries].find(([, state]) => !state.probe);
+        if (!idle) return;
+        this.recoveries.delete(idle[0]);
+      }
+      const state = this.recoveries.get(identity) ?? { generation: 0 };
+      state.generation++;
+      this.recoveries.set(identity, state);
+    }
+  }
+
+  /** Wait within the admission budget and return a release callback for one recovery probe. */
+  async acquire(identity: string, signal?: AbortSignal, maxWaitMs = DEFAULT_MAX_WAIT_MS): Promise<(success?: boolean) => void> {
+    signal?.throwIfAborted();
+    if (this.waiting >= MAX_IDENTITIES) throw new RequestPacingQueueOverloadError("mistral", "queue_full", 60);
+    this.waiting++;
+    const deadline = this.now() + maxWaitMs;
+    try {
+      for (;;) {
+        signal?.throwIfAborted();
+        // An evicted identity may have re-entered with a shorter delay; the evicted one still binds.
+        const live = this.evictedUntil > this.now() ? this.evictedUntil : undefined;
+        const own = this.deadlines.get(identity);
+        const readyAt = own === undefined ? live : live === undefined ? own : Math.max(own, live);
+        if (readyAt !== undefined && readyAt > deadline) {
+          const delay = readyAt - this.now();
+          throw new RequestPacingQueueOverloadError("mistral", "queue_expired", Math.ceil(delay / 1000));
+        }
+        if (readyAt !== undefined && readyAt > this.now()) {
+          await this.sleep(readyAt - this.now(), signal);
+          continue;
+        }
+        const state = this.recoveries.get(identity);
+        if (!state) { this.deadlines.delete(identity); return () => {}; }
+        if (state.probe) {
+          const remaining = deadline - this.now();
+          if (remaining <= 0) throw new RequestPacingQueueOverloadError("mistral", "queue_expired", 1);
+          const local = new AbortController();
+          try {
+            await Promise.race([state.probe.done, this.sleep(remaining, AbortSignal.any([local.signal, ...(signal ? [signal] : [])]))]);
+          } finally { local.abort(); }
+          continue;
+        }
+        let finish!: () => void;
+        const probe = { done: new Promise<void>(resolve => { finish = resolve; }), finish: () => finish() };
+        state.probe = probe;
+        const generation = state.generation;
+        let released = false;
+        return success => {
+          if (released) return;
+          released = true;
+          if (state.probe === probe) delete state.probe;
+          // Only this probe can settle recovery; an older concurrent success must
+          // not erase a more recent refusal or the server's minimum wait.
+          if (success && state.generation === generation) {
+            if (this.recoveries.get(identity) === state) this.recoveries.delete(identity);
+            if ((this.deadlines.get(identity) ?? 0) <= this.now()) this.deadlines.delete(identity);
+          }
+          probe.finish();
+        };
+      }
+    } finally { this.waiting--; }
+  }
+}
+
+const pacer = new MistralBudgetPacer();
+const wrapped = new WeakSet<typeof globalThis.fetch>();
+
+/** Wrap canonical Mistral Chat sends with bounded admission and server-delay protection. */
+export function resolveMistralTransport(
+  provider: OcxProviderTransport,
+  budgetPacer = pacer,
+): OcxProviderTransport {
+  if (!isCanonicalMistralChat(provider) || (provider.fetch && wrapped.has(provider.fetch))) return provider;
+  const baseFetch = provider.fetch
+    ?? markEgressTransparentExecutor(((input, init) => configuredOutboundFetch(input, init)) as typeof globalThis.fetch);
+  const attemptFetch = (async (input, init) => {
+    const url = new URL(input instanceof Request ? input.url : String(input));
+    if (url.origin !== "https://api.mistral.ai" || url.pathname !== "/v1/chat/completions"
+      || url.search || url.hash || init?.method?.toUpperCase() !== "POST" || typeof init.body !== "string") {
+      return baseFetch(input, init);
+    }
+    // The Chat adapter serializes model first. Read only that bounded prefix rather
+    // than parsing/copying a potentially million-token conversation a second time.
+    const encodedModel = /^\s*\{\s*"model"\s*:\s*("(?:[^"\\]|\\.)*")\s*[,}]/.exec(init.body.slice(0, 4096))?.[1];
+    let model: unknown;
+    try { model = encodedModel === undefined ? undefined : JSON.parse(encodedModel); } catch { return baseFetch(input, init); }
+    const authorization = new Headers(init.headers).get("authorization");
+    if (!authorization || typeof model !== "string" || !model || model.length > 256) return baseFetch(input, init);
+    // Bind to the actual send credential, including after pool rotation; keep no raw key.
+    const identity = createHash("sha256").update(JSON.stringify([authorization, model])).digest("hex");
+    const pacing = provider.requestPacing?.enabled !== false && provider.retryOn429?.respectRetryAfter !== false;
+    const release = pacing ? await waitOutsideProviderHeaderDeadline(init,
+      signal => budgetPacer.acquire(identity, signal, provider.retryOn429?.maxIntervalMs)) : undefined;
+    let response: Response;
+    try {
+      init.signal?.throwIfAborted();
+      response = await baseFetch(input, init);
+      if (pacing) budgetPacer.observe(identity, response.headers, response.status);
+    } catch (error) { release?.(); throw error; }
+    release?.(response.ok);
+    const retry = provider.retryOn429;
+    if (response.status === 429 && retry?.respectRetryAfter !== false) {
+      const delay = retryDelay(response.headers, Date.now());
+      if (delay !== undefined && delay > (retry?.maxIntervalMs ?? DEFAULT_MAX_WAIT_MS)) {
+        // The shared retry helper caps waits. Stop same-key replays sooner than Mistral permits;
+        // another credential may still serve, and the original status/body/Retry-After reach the caller.
+        markSameTargetRetryHold(response);
+      }
+    }
+    return response;
+  }) as typeof globalThis.fetch;
+  if (isEgressTransparentExecutor(baseFetch)) markEgressTransparentExecutor(attemptFetch);
+  wrapped.add(attemptFetch);
+  return { ...provider, fetch: attemptFetch };
+}

package/src/providers/model-rename-fields.ts

@@ -51,6 +51,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   apiKeyTransport: "none",
   apiKeyPool: "none",
   apiKeyPoolStrategy: "none",
+  accountAutoPause: "none",
   apiKeySelectionRevision: "none",
   _apiKeyAttempt: "none",
   defaultModel: "scalar",

package/src/providers/openai-sidecar.ts

@@ -12,6 +12,7 @@ import {
   type CodexAuthPolicyConfig,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../codex/routing/failure-window";
 import { inspectChatGptDomainClaim } from "../oauth/chatgpt";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "../server/auth-cors";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
@@ -205,6 +206,7 @@ export async function resolveFirstUsableOpenAiSidecar(
         releaseCodexAuthContextProbeLease(authContext);
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
+      const windowMeta = codexFailureWindowOutcomeMeta(authContext);
       return {
         ...candidate,
         authContext,
@@ -220,6 +222,7 @@ export async function resolveFirstUsableOpenAiSidecar(
             probeLeaseId: authContext.probeLeaseId,
             probeQuotaScope: authContext.probeQuotaScope,
             writerGeneration: authContext.writerGeneration,
+            ...windowMeta,
             // 401/403 here is evidence about this exact stored credential; without the generation a
             // replacement inherits the quarantine (#2892 gap 4).
             ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
@@ -256,6 +259,7 @@ export async function resolveFirstUsableOpenAiSidecar(
       releaseCodexAuthContextProbeLease(authContext);
       continue;
     }
+    const windowMeta = codexFailureWindowOutcomeMeta(authContext);
     return {
       ...candidate,
       authContext,
@@ -271,6 +275,7 @@ export async function resolveFirstUsableOpenAiSidecar(
               threadId: authContext.affinityKey,
               probeLeaseId: authContext.probeLeaseId,
               writerGeneration: authContext.writerGeneration,
+              ...windowMeta,
               // Same fence as the exact-account recorder above (#2892 gap 4).
               ...(authContext.kind === "pool" ? { credentialGeneration: authContext.generation } : {}),
             },

package/src/providers/opencode-zen-rate-limit.ts

@@ -1,22 +1,16 @@
 /**
  * OpenCode Zen short-window rate-limit guidance (#1145 / OCX-56).
  *
- * OpenCode's keyed and keyless Zen chat endpoints share `https://opencode.ai/zen/v1`.
+ * OpenCode's keyed Zen chat endpoint uses `https://opencode.ai/zen/v1`.
  * Free-model traffic can hit a short-window burst ceiling around 15–20 RPM
  * (community-measured). Zen often answers with opaque `429 Rate limit exceeded`
  * bodies and may omit `Retry-After` / `X-RateLimit-*`; when those headers are
- * present they still take precedence. Distinct from the keyless desktop
- * ~200 requests / 5h quota documented on `opencode-free`.
- *
- * The same module also owns the keyless free-tier admission explanation (#4121):
- * Zen rejects a request that carries no `x-opencode-session` header with
- * `MissingSessionID` / "OpenCode's free tier can only be used in OpenCode".
- * opencodex does not synthesize that header — see {@link enrichOpenCodeZenFreeTierMessage}.
+ * present they still take precedence.
  */
 import { validateClientRetryAfterHeader } from "../lib/retry-after";
 import { registryEntryForProviderDestination } from "./registry";
 
-const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen", "opencode-free"]);
+const OPENCODE_ZEN_PROVIDER_IDS = new Set(["opencode-zen"]);
 
 /** Observed free-model burst ceiling on Zen (not an official OpenCode figure). */
 export const OPENCODE_ZEN_OBSERVED_RPM_HINT = "roughly 15-20 requests per minute";
@@ -49,7 +43,7 @@ export function isOpenCodeZenRateLimitProvider(opts: {
 
 /**
  * Same-key `retryOn429` only applies on key-authenticated HTTP paths — not
- * keyless `opencode-free` traffic and not custom `runTurn` transports.
+ * keyless traffic and not custom `runTurn` transports.
  */
 export function supportsOpenCodeZenRetryOn429Guidance(opts: {
   authMode?: string;
@@ -112,73 +106,13 @@ export function enrichOpenCodeZenRateLimitMessage(
 }
 
 /**
- * Zen's keyless free tier admits only OpenCode's own client. A request without an
- * `x-opencode-session` header is refused with error type `MissingSessionID` and the
- * message "OpenCode's free tier can only be used in OpenCode" (#4121).
- *
- * Presence of the header is the whole gate — any value clears it — so opencodex could
- * pass by minting one. It does not. Fabricating a session identifier and a versioned
- * `opencode/<version>` User-Agent is a claim to *be* the OpenCode client, and no upstream
- * contract authorizes a third-party agent to make it; an HTTP 200 obtained that way is a
- * bypassed admission check, not permission. Until OpenCode publishes a third-party
- * integration path for this exact keyless tier, the supported route is the keyed
- * `opencode-zen` provider.
- *
- * Two markers are matched because the two request surfaces expose different parts of the
- * upstream envelope: the Responses path forwards the bounded raw body (which carries the
- * `MissingSessionID` type), while the native Chat path forwards only the parsed message.
- */
-const OPENCODE_ZEN_FREE_TIER_LOCK_IN = /MissingSessionID|free tier can only be used in OpenCode/i;
-
-/** Idempotence marker — the appended guidance must not stack across enrichment layers. */
-const FREE_TIER_ENRICHMENT_MARKER = "does not send a fabricated OpenCode session header";
-
-/** True when an upstream error body is Zen's keyless free-tier admission refusal. */
-export function isOpenCodeZenFreeTierLockIn(message: string, upstreamErrorType?: string | null): boolean {
-  if (upstreamErrorType && OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(upstreamErrorType)) return true;
-  return OPENCODE_ZEN_FREE_TIER_LOCK_IN.test(message);
-}
-
-/**
- * Replace a raw `MissingSessionID` passthrough with an explanation of the upstream
- * restriction and the supported alternative. No-op for every other provider and every
- * other error, and idempotent so layered enrichment cannot append it twice.
- */
-export function enrichOpenCodeZenFreeTierMessage(
-  message: string,
-  opts: {
-    providerName?: string;
-    baseUrl?: string;
-    adapter?: string;
-    /** Upstream `error.type`, when the caller parsed one out of the envelope. */
-    upstreamErrorType?: string | null;
-  },
-): string {
-  if (message.includes(FREE_TIER_ENRICHMENT_MARKER)) return message;
-  if (!isOpenCodeZenFreeTierLockIn(message, opts.upstreamErrorType)) return message;
-  if (!isOpenCodeZenRateLimitProvider(opts)) return message;
-  return (
-    `${message}`
-    + " OpenCode Zen's keyless free tier admits only OpenCode's own client: it refuses any"
-    + " request that arrives without an x-opencode-session header."
-    + ` opencodex ${FREE_TIER_ENRICHMENT_MARKER}, because presenting itself as the OpenCode`
-    + " client is a claim no upstream contract supports."
-    + " Use the keyed opencode-zen provider with an OpenCode Zen API key"
-    + " (https://opencode.ai/auth), or route this model through another provider."
-    + " Upstream terms: https://opencode.ai/docs/zen/."
-  );
-}
-
-/**
- * Single entry point for Zen upstream-error guidance on Responses and native Messages: short-window
- * rate limits first, then the keyless free-tier admission refusal. Each layer is a no-op
- * outside its own case, so the composition is safe for every other upstream failure.
+ * Zen upstream-error guidance on Responses and native Messages.
  */
 export function enrichOpenCodeZenUpstreamMessage(
   message: string,
   opts: Parameters<typeof enrichOpenCodeZenRateLimitMessage>[1] & { upstreamErrorType?: string | null },
 ): string {
-  return enrichOpenCodeZenFreeTierMessage(enrichOpenCodeZenRateLimitMessage(message, opts), opts);
+  return enrichOpenCodeZenRateLimitMessage(message, opts);
 }
 
 /** The effective HTTP endpoint, never the configured row name, identifies Console. */

package/src/providers/quota/account-cache.ts

@@ -1,3 +1,6 @@
+import { rawAnthropicHeaderWindows } from "./anthropic-decision-windows";
+import { clearDecisionAccountQuotas, decisionQuotaSinkActive } from "../../lib/decision-quota-sink";
+import { bindRawDecisionWindows, publishAnthropicDecisionQuota } from "../quota-decision-publication";
 import { parseAnthropicFamilyHeaders, mergeAnthropicFamilyWindows } from "./anthropic-family-headers";
 import { anthropicModelQuotaFor, ANTHROPIC_PASSIVE_FAMILY_MAX_AGE_MS } from "../../oauth/anthropic-model-quota";
 import { createHash } from "node:crypto";
@@ -289,6 +292,7 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
   writerGeneration: number,
   status?: number,
   model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
   if (!accountId) return;
   const key = accountCacheKey(instance, accountId);
@@ -318,14 +322,20 @@ export function recordAnthropicAccountQuotaFromHeadersForInstance(
       ...(observed.customWindows ? { customWindows: mergeAnthropicFamilyWindows(previous?.quota?.customWindows, observed.customWindows) } : {}),
     }, observed.updatedAt),
   });
+  // Advisory evidence is published for the primary pool only; Pool 2 stays unknown to decisions.
+  if (instance === "anthropic" && generation && generation === decisionCredentialGeneration && decisionQuotaSinkActive()) {
+    bindRawDecisionWindows(observed, rawAnthropicHeaderWindows(headers, observed.updatedAt));
+    publishAnthropicDecisionQuota(accountId, generation, observed, true);
+  }
   persistAccountQuotaCache();
 }
 
 /** Legacy recorder: config/roster generation is numeric and distinct from bearer ownership. */
 export function recordAnthropicAccountQuotaFromHeaders(
   accountId: string, headers: Headers, writerGeneration: number, status?: number, model?: string,
+  decisionCredentialGeneration?: string,
 ): void {
-  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model);
+  recordAnthropicAccountQuotaFromHeadersForInstance("anthropic", accountId, headers, writerGeneration, status, model, decisionCredentialGeneration);
 }
 
 /**
@@ -446,6 +456,7 @@ export function resetProviderQuotaReconcileStateForTests(): void {
 
 /** Drop cached per-account rows (all, or just one provider's). */
 export function clearAccountQuotaCache(provider?: string): void {
+  clearDecisionAccountQuotas(provider);
   // Anthropic readers use provider-owned epochs; B cannot revoke an A flight.
   if (provider !== "anthropic2") explicitAccountEpoch += 1;
   if (!provider) {
@@ -475,6 +486,9 @@ export function clearAccountQuotaCache(provider?: string): void {
 
 /** Drop one account's cached bars and any joined probe so a reset is not ranked from the old window. */
 export function forgetCachedProviderAccountQuota(provider: string, accountId: string): void {
+  // Advisory decision evidence of the same account is a copy of the dropped bars; it must not
+  // keep ranking the account from the pre-reset window while the reread is pending or fails.
+  clearDecisionAccountQuotas(provider, accountId);
   hydrateAccountQuotaCache();
   const key = accountCacheKey(provider, accountId);
   accountQuotaCache.delete(key);

package/src/providers/quota/anthropic-account-quota.ts

@@ -4,7 +4,9 @@ import { getAccountSet } from "../../oauth/store";
 import { captureConfigGeneration, sweepExpiredOnWrite } from "../../lib/state-store-sweeper";
 import { configuredAnthropicInstance, type AnthropicInstanceId } from "../anthropic-instance";
 import { ACCOUNT_QUOTA_TTL_MS } from "../quota-wire";
-import { fetchAnthropicUsageQuotaForInstance } from "./vendor-probes-oauth";
+import { fetchAnthropicUsageProbeForInstance } from "./vendor-probes-oauth";
+import { thrownQuotaFailure } from "./failure-codes";
+import type { QuotaFailureCode } from "../quota-types";
 import { AnthropicQuotaProbeOwnershipError, anthropicCooldownRecoveryFor, type AnthropicQuotaRecoveryResult } from "./anthropic-cooldown-recovery";
 import {
   accountCacheKey, accountQuotaCache, accountQuotaInflight, captureProviderAccountQuotaEpoch,
@@ -49,7 +51,10 @@ export async function fetchAnthropicAccountQuota(
   }
   let token: string;
   try { token = await getTokenForAccountQuotaProbe(instance, accountId); }
-  catch { return unavailable(); }
+  catch {
+    // Missing, signed-out or unrefreshable credential: a reauthentication matter, never a quota fact.
+    return { ...unavailable(), quotaFailure: "account_unavailable", quotaFailureIsCurrent: ownerCurrent };
+  }
   if (!ownerCurrent()) return unavailable();
   const flightKey = recovery.anthropicCredentialQuotaFlightKey(key, accountId);
   const flightCurrent = () => ownerCurrent()
@@ -64,30 +69,38 @@ export async function fetchAnthropicAccountQuota(
   // and a thrown read (network failure) both record the unavailable row over the retained
   // in-flight observations, as the pre-instance A path did, so joined callers and later cached
   // reads agree and windows that expired during the shared probe are normalized away.
-  const publish = (result: AnthropicQuotaRecoveryResult | null): AccountQuotaCacheEntry => {
+  /** Cache the settled probe result for an account and publish its decision evidence only while the flight is still current for its credential and generation. */
+  const publish = (result: AnthropicQuotaRecoveryResult | null, failure?: QuotaFailureCode): AccountQuotaCacheEntry => {
     const previous = accountQuotaCache.get(key);
     const retained = previous?.isCurrent?.() === false ? undefined : previous;
     const isCurrent = result?.isCurrent ?? flightCurrent;
     const entry: AccountQuotaCacheEntry = {
       ts: Date.now(), quota: normalizeAnthropicQuota(result?.quota ?? retained?.quota, Date.now()),
       ...(!result ? { unavailable: true as const } : {}), isCurrent,
+      ...(!result && failure ? { quotaFailure: failure, quotaFailureIsCurrent: isCurrent } : {}),
     };
-    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); sweepExpiredOnWrite(entry.ts); }
+    if (isCurrent() && mayCommitAccountQuotaKey(key, writerGeneration)) { accountQuotaCache.set(key, entry); result?.publishDecisionQuota(); sweepExpiredOnWrite(entry.ts); }
     return entry;
   };
   const probe = (async (): Promise<AccountQuotaCacheEntry> => {
+    // The closed reason of the last usage read in this flight: an HTTP status class, an unusable
+    // body, or a thrown dispatch. Ownership and cooldown refusals never set it.
+    let failure: QuotaFailureCode | undefined;
     try {
       const result = await recovery.probeAnthropicQuotaWithRecovery(accountId, token, fresh => {
         if (!flightCurrent()) throw new AnthropicQuotaProbeOwnershipError("quota flight changed");
         recovery.assertAnthropicQuotaSendAllowed(accountId, token);
-        return fetchAnthropicUsageQuotaForInstance(instance, token, fresh || freshDispatch);
+        return fetchAnthropicUsageProbeForInstance(instance, token, fresh || freshDispatch).then(
+          read => { failure = read.failure; return read.quota; },
+          error => { failure = thrownQuotaFailure(error); throw error; },
+        );
       }, () => ownerCurrent() && mayCommitAccountQuotaKey(key, writerGeneration));
       if (result && !result.isCurrent()) return unavailable();
       if (!result && !flightCurrent()) return unavailable();
-      return publish(result);
+      return publish(result, failure);
     } catch (error) {
       if (error instanceof AnthropicQuotaProbeOwnershipError || !flightCurrent()) return unavailable();
-      return publish(null);
+      return publish(null, failure);
     }
   })().finally(() => { if (accountQuotaInflight.get(flightKey) === probe) accountQuotaInflight.delete(flightKey); });
   accountQuotaInflight.set(flightKey, probe);

package/src/providers/quota/anthropic-cooldown-recovery.ts

@@ -1,3 +1,5 @@
+import { boundDecisionWindows } from "../quota-decision-publication";
+import { decisionQuotaSinkActive, publishDecisionAccountQuota } from "../../lib/decision-quota-sink";
 import { mergeAnthropicFamilyWindows, hasAnthropicFamilyEnumeration } from "./anthropic-family-headers";
 import { getCachedProviderAccountQuota, captureProviderAccountQuotaEpoch } from "./account-cache";
 import { anthropicModelQuotaFor } from "../../oauth/anthropic-model-quota";
@@ -10,6 +12,7 @@ export class AnthropicQuotaProbeOwnershipError extends Error {}
 
 export type AnthropicCooldownRecoveryProbe = Readonly<{
   instance: AnthropicInstanceId;
+  generation: string;
   requiresFreshDispatch: boolean;
   isCurrentCredential(): boolean;
   isCurrentFamily(): boolean;
@@ -20,10 +23,13 @@ export type AnthropicCooldownRecoveryProbe = Readonly<{
 export type AnthropicQuotaRecoveryResult = Readonly<{
   instance: AnthropicInstanceId;
   quota: ProviderQuota;
+  /** Publishes secret-free advisory evidence for the primary pool only; a no-op for Pool 2. */
+  publishDecisionQuota(): void;
   /** Must be checked synchronously at each publication boundary. */
   isCurrent(): boolean;
 }>;
 
+/** Create the cooldown-recovery probe owner for one Anthropic instance; its results are credential- and generation-bound before they may publish. */
 function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
   const familyGeneration = (accountId: string) => anthropicModelQuotaFor(instance).anthropicFamilyQuotaGeneration(accountId);
 
@@ -129,6 +135,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     };
     return {
       instance,
+      generation,
       requiresFreshDispatch: claim !== null,
       isCurrentCredential,
       isCurrentFamily: () => familyGeneration(accountId) === capturedFamilyGeneration,
@@ -165,6 +172,7 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     // Clearing the claimed cooldown intentionally advances the fence. Adopt that exact new
     // generation; any later observation/429 then invalidates publication before a cache write.
+    const rawQuota = quota;
     const ownsFamily = probe.isCurrentFamily();
     const authoritative = ownsFamily && hasAnthropicFamilyEnumeration(quota);
     if (ownsFamily) anthropicModelQuotaFor(instance).observeAnthropicFamilyQuota(accountId, quota.customWindows ?? [], quota.updatedAt, authoritative);
@@ -177,14 +185,24 @@ function createAnthropicCooldownRecovery(instance: AnthropicInstanceId) {
     }
     const publicationGeneration = anthropicCooldownGeneration(accountId);
     const publicationFamilyGeneration = familyGeneration(accountId);
+    /** True while the probed credential, cooldown generation and family generation are unchanged and publication is still permitted. */
+    const isCurrent = () => probe.isCurrentCredential()
+      && anthropicCooldownGeneration(accountId) === publicationGeneration
+      && familyGeneration(accountId) === publicationFamilyGeneration
+      && mayPublish();
     afterSettlementForTests?.();
     return {
       instance,
       quota,
-      isCurrent: () => probe.isCurrentCredential()
-        && anthropicCooldownGeneration(accountId) === publicationGeneration
-        && familyGeneration(accountId) === publicationFamilyGeneration
-        && mayPublish(),
+      isCurrent,
+      publishDecisionQuota: () => {
+        // Activation first: ownership validation reads the auth store and must not run for signals-off installs.
+        if (instance !== "anthropic" || !decisionQuotaSinkActive() || !isCurrent()) return;
+        // An unbound probe result was parsed while inactive: unknown, never display fallback.
+        const windows = boundDecisionWindows(rawQuota);
+        if (windows) publishDecisionAccountQuota("anthropic", accountId, probe.generation,
+          windows.filter(row => ownsFamily || ["5h", "weekly", "monthly"].includes(row.window)), !authoritative);
+      },
     };
   }
 

package/src/providers/quota/anthropic-decision-windows.ts

@@ -0,0 +1,47 @@
+/** Raw advisory projection; compatibility display clamping/rounding remains unchanged. */
+import type { DecisionQuotaWindow } from "../quota-decision-snapshot";
+import { normalizeResetAt, toFiniteNumber } from "../quota-wire";
+/** Return a plain object value, or undefined for non-objects and arrays. */
+const record = (value: unknown): Record<string, unknown> | undefined =>
+  value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+/** Normalize a reset value; an explicit invalid reset becomes NaN so it cannot read as an undated valid measurement. */
+function reset(value: unknown): number | undefined {
+  // Explicit invalid reset must not become an apparently undated valid measurement.
+  return value === undefined || value === null ? undefined : normalizeResetAt(value) ?? NaN;
+}
+/** Extract raw decision windows (5h, weekly and per-model families) from an Anthropic usage body, keeping invalid resets distinct from display parsing. */
+export function rawAnthropicUsageWindows(body: Record<string, unknown>, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  /** Append one window when its percentage is a finite number, carrying its normalized reset. */
+  const add = (window: DecisionQuotaWindow["window"], raw: unknown, percentField: string) => {
+    const row = record(raw);
+    const percent = toFiniteNumber(row?.[percentField]);
+    if (percent === undefined) return;
+    const resetAt = reset(row?.resets_at);
+    rows.push({ window, percent, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  };
+  for (const [window, field] of [["5h", "five_hour"], ["weekly", "seven_day"], ["fable", "seven_day_fable"], ["opus", "seven_day_opus"], ["sonnet", "seven_day_sonnet"]] as const) add(window, body[field], "utilization");
+  for (const limit of Array.isArray(body.limits) ? body.limits : []) {
+    const row = record(limit);
+    if (row?.kind !== "weekly_scoped") continue;
+    const display = record(record(row.scope)?.model)?.display_name;
+    if (typeof display !== "string") continue;
+    const label = display.replace(/[\u0000-\u001f\u007f-\u009f]/gu, "").toLowerCase();
+    const family = (["fable", "opus", "sonnet"] as const).find(family => label.includes(family));
+    if (family) add(family, row, "percent");
+  }
+  return rows;
+}
+/** Extract decision windows from Anthropic unified rate-limit response headers, converting utilization fractions to percentages. */
+export function rawAnthropicHeaderWindows(headers: Headers, observedAt: number): DecisionQuotaWindow[] {
+  const rows: DecisionQuotaWindow[] = [];
+  for (const [window, wire] of [["5h", "5h"], ["weekly", "7d"], ["fable", "7d_oi"]] as const) {
+    const fraction = toFiniteNumber(headers.get(`anthropic-ratelimit-unified-${wire}-utilization`));
+    if (fraction === undefined || fraction < 0 || fraction > 1) continue;
+    const rawReset = headers.get(`anthropic-ratelimit-unified-${wire}-reset`);
+    const seconds = toFiniteNumber(rawReset);
+    const resetAt = rawReset === null ? undefined : seconds !== undefined && seconds > 0 ? seconds * 1000 : NaN;
+    rows.push({ window, percent: fraction * 100, observedAt, ...(resetAt !== undefined ? { resetAt } : {}) });
+  }
+  return rows;
+}