@bitkyc08/opencodex 2.88.0 → 2.90.0

package/src/providers/quota/antigravity.ts

@@ -45,8 +45,31 @@ function quotaInfoEntries(modelInfo: Record<string, unknown>): Record<string, un
   return entries;
 }
 
+/**
+ * Gemini 4 Argon has its own quota pool. Its names also contain "gemini", so every family
+ * decision below checks Argon first; otherwise Argon readings fill or replace the Gem family.
+ */
+const ARGON_TOKEN = /(?:^|[^a-z0-9])argon(?:[^a-z0-9]|$)/i;
+const GEMINI_TOKEN = /(?:^|[^a-z0-9])gemini(?:[^a-z0-9]|$)/i;
+const CLAUDE_FAMILY_TOKEN = /(?:^|[^a-z0-9])(?:claude|3p|gpt|opus|sonnet)(?:[^a-z0-9]|$)/i;
+/** Canonical model of the Argon summary pool; tagging keeps the window out of routing. */
+const ARGON_POOL_MODEL_ID = "gemini-4-argon";
+
+type AntigravitySummaryFamily = "argon" | "gem" | "cla";
+
+/** A bucket's own id and name decide its family when they name one; the group decides otherwise. */
+function antigravitySummaryBucketFamily(bucket: Record<string, unknown>): AntigravitySummaryFamily | undefined {
+  const identity = `${typeof bucket.bucketId === "string" ? bucket.bucketId : ""} ${typeof bucket.displayName === "string" ? bucket.displayName : ""}`;
+  if (ARGON_TOKEN.test(identity)) return "argon";
+  if (GEMINI_TOKEN.test(identity)) return "gem";
+  if (CLAUDE_FAMILY_TOKEN.test(identity)) return "cla";
+  return undefined;
+}
+
 function classifyAntigravityFamily(modelId: string, modelInfo: Record<string, unknown>, quotaInfo: Record<string, unknown>): "Gem" | "Cla" | null {
   const displayName = typeof modelInfo.displayName === "string" ? modelInfo.displayName : "";
+  // Argon models keep their exact model rows but never seed the shared Gem family bar.
+  if (ARGON_TOKEN.test(`${modelId} ${displayName}`)) return null;
   const tier = typeof quotaInfo.tier === "string" ? quotaInfo.tier : "";
   const haystack = `${modelId} ${displayName} ${tier}`.toLowerCase();
   if (haystack.includes("gemini")) return "Gem";
@@ -128,9 +151,13 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
   for (const rawGroup of groups) {
     const group = asRecord(rawGroup);
     if (!group) continue;
-    const groupName = `${typeof group.displayName === "string" ? group.displayName : ""} ${typeof group.description === "string" ? group.description : ""}`.toLowerCase();
-    const isGemini = groupName.includes("gemini");
-    const isClaude = groupName.includes("claude") || groupName.includes("3p") || groupName.includes("gpt");
+    const groupDisplayName = typeof group.displayName === "string" ? group.displayName : "";
+    const groupName = `${groupDisplayName} ${typeof group.description === "string" ? group.description : ""}`.toLowerCase();
+    // A description that merely mentions Argon must not move a whole Gemini group.
+    const groupFamily: AntigravitySummaryFamily | undefined = ARGON_TOKEN.test(groupDisplayName) ? "argon"
+      : groupName.includes("gemini") ? "gem"
+        : groupName.includes("claude") || groupName.includes("3p") || groupName.includes("gpt") ? "cla"
+          : undefined;
 
     const buckets = Array.isArray(group.buckets) ? (group.buckets as unknown[]) : [];
     for (const rawBucket of buckets) {
@@ -143,13 +170,19 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
 
       const isWeekly = windowStr.includes("week");
       const is5h = windowStr.includes("5h") || windowStr.includes("five");
+      const family = antigravitySummaryBucketFamily(bucket) ?? groupFamily;
 
-      if (isGemini) {
+      if (family === "argon") {
+        const label = is5h ? "Argon" : isWeekly ? "Argon (Weekly)" : "";
+        if (label && !customWindowsMap.has(label)) {
+          customWindowsMap.set(label, { label, modelId: ARGON_POOL_MODEL_ID, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
+        }
+      } else if (family === "gem") {
         const label = is5h ? "Gem" : isWeekly ? "Gem (Weekly)" : "";
         if (label && !customWindowsMap.has(label)) {
           customWindowsMap.set(label, { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
         }
-      } else if (isClaude) {
+      } else if (family === "cla") {
         const label = is5h ? "Cla" : isWeekly ? "Cla (Weekly)" : "";
         if (label && !customWindowsMap.has(label)) {
           customWindowsMap.set(label, { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) });
@@ -164,7 +197,7 @@ function parseAntigravityQuotaSummary(body: Record<string, unknown> | null): Pro
     }
   }
 
-  const PREFERRED_ORDER = ["Gem", "Gem (Weekly)", "Cla", "Cla (Weekly)"];
+  const PREFERRED_ORDER = ["Gem", "Gem (Weekly)", "Cla", "Cla (Weekly)", "Argon", "Argon (Weekly)"];
   const customWindows = Array.from(customWindowsMap.values()).sort((a, b) => {
     const ia = PREFERRED_ORDER.indexOf(a.label);
     const ib = PREFERRED_ORDER.indexOf(b.label);
@@ -273,13 +306,16 @@ function antigravityUnavailableFailure(
   return fallbackFailure;
 }
 
-export async function probeAntigravityUsageQuota(accessToken: string, projectId: string): Promise<AntigravityQuotaProbeResult> {
+export async function probeAntigravityUsageQuota(accessToken: string, projectId: string, signal?: AbortSignal): Promise<AntigravityQuotaProbeResult> {
+  // An optional caller signal (account import) cancels every request of this probe, including the
+  // 403 retry and the models fallback, alongside the per-request deadline.
+  const requestSignal = () => signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
   const fetchQuota = (url: string, userAgent = antigravityUserAgent()) => providerOutboundPost("google-antigravity", { baseUrl: ANTIGRAVITY_ACCOUNT_QUOTA_BASE }, url, {
     headers: {
       Accept: "application/json", "Content-Type": "application/json",
       "User-Agent": userAgent, Authorization: `Bearer ${accessToken}`,
     },
-    body: JSON.stringify({ project: projectId }), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    body: JSON.stringify({ project: projectId }), signal: requestSignal(),
   }, antigravityOutboundDependencies);
   let summaryFailure: QuotaFailureCode | undefined;
   try {
@@ -299,6 +335,7 @@ export async function probeAntigravityUsageQuota(accessToken: string, projectId:
     // Existing behavior: summary transport/parse failure may recover through the models probe.
     summaryFailure = quotaTransportFailure(error);
   }
+  if (signal?.aborted) return unavailableAntigravityQuota(summaryFailure ?? "transport_error");
   try {
     const response = await fetchQuota(ANTIGRAVITY_QUOTA_MODELS_URL);
     if (await providerRedirectError(response, ANTIGRAVITY_QUOTA_MODELS_URL)) {

package/src/providers/quota/failure-codes.ts

@@ -0,0 +1,18 @@
+import type { QuotaFailureCode } from "../quota-types";
+
+/**
+ * Closed quota-probe diagnoses derived from an HTTP status class or a thrown dispatch. They carry
+ * no upstream text, URL, header or credential: only one of `QUOTA_FAILURE_CODES`.
+ */
+export function httpQuotaFailure(status: number): QuotaFailureCode {
+  if (status >= 300 && status < 400) return "redirect_blocked";
+  if (status === 401 || status === 403) return "access_denied";
+  if (status === 429) return "rate_limited";
+  return "upstream_error";
+}
+
+/** A thrown fetch: the request deadline is a timeout, anything else a transport failure. */
+export function thrownQuotaFailure(error: unknown): QuotaFailureCode {
+  const name = error && typeof error === "object" ? (error as { name?: unknown }).name : undefined;
+  return name === "TimeoutError" ? "timeout" : "transport_error";
+}

package/src/providers/quota/report-cache.ts

@@ -1,3 +1,5 @@
+import { decisionQuotaSinkActive, invalidateDecisionKeyQuotas, publishDecisionKeyQuota } from "../../lib/decision-quota-sink";
+import { providerDecisionWindows } from "../quota-decision-publication";
 import { createHash } from "node:crypto";
 import { effectiveCodexAuthAccountId, listCodexAuthAccountsSnapshot } from "../../codex/auth-api";
 import { withoutRetiredCodexQuota, type StoredAccountQuota } from "../../codex/quota";
@@ -345,6 +347,18 @@ export function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolea
     && (accountReportCurrent.get(value)?.() ?? true);
 }
 
+/** Called only by an accepted collector/cache publication, never the JEV read path. */
+export function publishCollectedDecisionQuota(reports: ProviderQuotaReport[], config: OcxConfig): void {
+  if (!decisionQuotaSinkActive()) return;
+  invalidateDecisionKeyQuotas();
+  for (const report of reports) {
+    const provider = config.providers[report.provider];
+    const evidence = routingEvidence.get(report);
+    if (provider && evidence && evidence.binding === providerQuotaRoutingBinding(report.provider, provider))
+      publishDecisionKeyQuota(report.provider, provider, providerDecisionWindows(evidence.quota));
+  }
+}
+
 /**
  * The reports this process already holds for the configured providers, for a passive read (#6959):
  * no probe, token refresh, account snapshot or publication into routing evidence. The Home's own

package/src/providers/quota/vendor-probes-oauth.ts

@@ -8,7 +8,7 @@ import { captureOAuthAccountSelection, credentialGeneration, getAccountCredentia
 import { hydrateKiroAccountState, persistKiroAccountState } from "../kiro-account-state-disk";
 import { kiroProbeCurrent, kiroProbeIdentity } from "./kiro-account-probe";
 import { fetchMuseKeyQuotaSnapshot } from "../muse-key-quota";
-import { readAnthropicUsageQuota } from "../claude-cli-usage";
+import { probeAnthropicUsageQuota, type AnthropicUsageProbe } from "../claude-cli-usage";
 import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "../xai-transport";
 import {
   commitKiroAccountUsageState,
@@ -227,7 +227,7 @@ export async function fetchXaiQuota(provider: string, context: { accessToken: st
   }
 }
 
-const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
+const anthropicUsageInflight = new Map<string, Promise<AnthropicUsageProbe>>();
 
 /**
  * Anthropic per-credential usage.
@@ -256,6 +256,15 @@ export async function fetchAnthropicUsageQuotaForInstance(
   accessToken: string,
   requireFreshDispatch = false,
 ): Promise<ProviderQuota | null> {
+  return (await fetchAnthropicUsageProbeForInstance(instance, accessToken, requireFreshDispatch)).quota;
+}
+
+/** The same shared flight as `fetchAnthropicUsageQuotaForInstance`, keeping the closed failure reason. */
+export async function fetchAnthropicUsageProbeForInstance(
+  instance: AnthropicInstanceId,
+  accessToken: string,
+  requireFreshDispatch = false,
+): Promise<AnthropicUsageProbe> {
   // Recovery evidence must be requested after the claimed cooldown. Joining an older request
   // can return after the 429 while still describing provider state from before that refusal.
   const credentialIdentity = getAccountSet(instance)?.accounts.filter(row => row.credential.access === accessToken)
@@ -264,7 +273,7 @@ export async function fetchAnthropicUsageQuotaForInstance(
   const joinable = requireFreshDispatch ? undefined : anthropicUsageInflight.get(key);
   if (joinable) return joinable;
 
-  const probe = readAnthropicUsageQuota(accessToken).finally(() => {
+  const probe = probeAnthropicUsageQuota(accessToken).finally(() => {
     if (anthropicUsageInflight.get(key) === probe) anthropicUsageInflight.delete(key);
   });
   anthropicUsageInflight.set(key, probe);
@@ -300,7 +309,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
   if (!initialRow || !currentRow || initialRow.loginId !== currentRow.loginId || initialRow.addedAt !== currentRow.addedAt
     || epoch !== captureProviderAccountQuotaEpoch(instance) || recovery.anthropicAccountIncarnation(probedAccountId) !== incarnation) return null;
   let quota: ProviderQuota | null;
-  let anthropicCurrent: (() => boolean) | undefined;
+  let anthropicCurrent: (() => boolean) | undefined; let anthropicPublish: (() => void) | undefined;
   try {
     const result = await recovery.probeAnthropicQuotaWithRecovery(probedAccountId, accessToken,
       fresh => {
@@ -311,7 +320,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
       () => targetCurrent() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration));
     if (result && !result.isCurrent()) return null;
     quota = result?.quota ?? null;
-    anthropicCurrent = result?.isCurrent;
+    anthropicCurrent = result?.isCurrent; anthropicPublish = result?.publishDecisionQuota;
   } catch (error) {
     if (error instanceof AnthropicQuotaProbeOwnershipError) return null;
     throw error;
@@ -322,7 +331,7 @@ export async function fetchAnthropicQuota(provider: string, config: OcxConfig =
   if (probedAccountId && probedAccountKey) {
     const stillOwnsToken = getAccountCredential(instance, probedAccountId)?.access === accessToken;
     if (stillOwnsToken && anthropicCurrent?.() && mayCommitAccountQuotaKey(probedAccountKey, writerGeneration)) {
-      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent });
+      accountQuotaCache.set(probedAccountKey, { ts: Date.now(), quota, isCurrent: anthropicCurrent }); anthropicPublish?.();
     }
   }
   const quotaReport = report(provider, "anthropic:oauth-usage", quota);

package/src/providers/quota-decision-publication.ts

@@ -0,0 +1,77 @@
+/** Producer projection: only measured subscription windows reach advisory snapshots. */
+import type { ProviderQuota } from "./quota-types";
+import type { StoredAccountQuota } from "../codex/quota-types";
+import { resetAtToMs } from "../codex/quota-types";
+import type { DecisionQuotaWindow } from "./quota-decision-snapshot";
+import { decisionQuotaSinkActive, publishDecisionAccountQuota } from "../lib/decision-quota-sink";
+const rawWindows = new WeakMap<ProviderQuota, readonly DecisionQuotaWindow[]>();
+/** Producer retains raw advisory projection separately from unchanged display/hard policy. */
+export function bindRawDecisionWindows(quota: ProviderQuota, windows: readonly DecisionQuotaWindow[]): void { if (decisionQuotaSinkActive()) rawWindows.set(quota, windows); }
+/**
+ * Raw windows a binding producer attached to this observation, or undefined. Binding producers
+ * (Anthropic usage/header parsers) bind only while advisory evidence is active, so an observation
+ * parsed while inactive has none and must stay unknown rather than fall back to display fields,
+ * which drop invalid resets and clamp percentages.
+ */
+export function boundDecisionWindows(quota: ProviderQuota): DecisionQuotaWindow[] | undefined {
+  const raw = rawWindows.get(quota);
+  return raw ? raw.map(row => ({ ...row })) : undefined;
+}
+/** Project a provider quota report onto decision windows, preferring raw windows bound by the producer over the display fields. */
+export function providerDecisionWindows(quota: ProviderQuota): DecisionQuotaWindow[] {
+  const raw = rawWindows.get(quota);
+  if (raw) return raw.map(row => ({ ...row }));
+  const windows: DecisionQuotaWindow[] = [];
+  for (const [window, percent, reset] of [
+    ["5h", "fiveHourPercent", "fiveHourResetAt"], ["weekly", "weeklyPercent", "weeklyResetAt"], ["monthly", "monthlyPercent", "monthlyResetAt"],
+  ] as const) {
+    if (quota[percent] !== undefined) windows.push({ window, percent: quota[percent]!, observedAt: quota.updatedAt, ...(quota[reset] !== undefined ? { resetAt: quota[reset] } : {}) });
+  }
+  for (const row of Array.isArray(quota.customWindows) ? quota.customWindows : []) {
+    const window = typeof row?.label === "string" ? row.label.trim().toLowerCase() : "";
+    if (row?.scope === "model" && (window === "fable" || window === "opus" || window === "sonnet")) {
+      windows.push({ window, percent: row.percent, observedAt: row.passiveObservedAt ?? quota.updatedAt, ...(row.resetAt !== undefined ? { resetAt: row.resetAt } : {}) });
+    }
+  }
+  return windows;
+}
+/** Publish decision windows for one Anthropic pool account, bound to its credential generation; a null quota publishes no windows. */
+export function publishAnthropicDecisionQuota(id: string, generation: string, quota: ProviderQuota | null, partial = false): void {
+  if (!decisionQuotaSinkActive()) return;
+  // A non-null observation without a raw binding was parsed while inactive: unknown, never display fallback.
+  const windows = quota ? boundDecisionWindows(quota) : [];
+  if (windows) publishDecisionAccountQuota("anthropic", id, generation, windows, partial);
+}
+type CodexObservation = Omit<StoredAccountQuota, "updatedAt">;
+type CodexWindow = "short" | "weekly" | "monthly";
+const rawCodexWindows = new WeakMap<CodexObservation, readonly DecisionQuotaWindow[]>();
+/** Keep invalid resets and the producer clock apart from compatibility display/policy parsing. */
+export function bindRawCodexDecisionResets(raw: CodexObservation, resets: Record<CodexWindow, unknown>, observedAt: number): void {
+  if (!decisionQuotaSinkActive()) return;
+  const windows = codexDecisionWindows(raw, observedAt).map(row => {
+    const value = resets[row.window === "5h" ? "short" : row.window as CodexWindow];
+    if (value === undefined || value === null) return row;
+    const numeric = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+    return { ...row, resetAt: Number.isFinite(numeric) && numeric >= 0 ? resetAtToMs(numeric) : NaN };
+  });
+  rawCodexWindows.set(raw, windows);
+}
+/** Build decision windows from a raw Codex observation, stamping each with the producer clock rather than a merge-time clock. */
+function codexDecisionWindows(raw: CodexObservation, observedAt: number): DecisionQuotaWindow[] {
+  const windows: DecisionQuotaWindow[] = [];
+  for (const kind of ["short", "weekly", "monthly"] as const) {
+    const percent = raw[`${kind}Percent`];
+    const reset = raw[`${kind}ResetAt`];
+    if (percent !== undefined) windows.push({ window: kind === "short" ? "5h" : kind, percent, observedAt,
+      ...(reset !== undefined ? { resetAt: resetAtToMs(reset) } : {}) });
+  }
+  return windows;
+}
+/** Publish decision windows for a Codex or main account from the raw observation, never from the display merge, so carried windows cannot acquire a fresh clock. */
+export function publishCodexDecisionQuota(id: string, generation: number, raw: CodexObservation, observedAt: number, provider = "codex", partial = true): void {
+  if (!decisionQuotaSinkActive()) return;
+  // RAW observation, never the display merge: carried windows cannot acquire a fresh clock.
+  // Header/WHAM parsers bind reset validity only while active; an unbound observation stays unknown.
+  const windows = rawCodexWindows.get(raw);
+  if (windows) publishDecisionAccountQuota(provider, id, generation, windows, partial);
+}

package/src/providers/quota-decision-snapshot.ts

@@ -0,0 +1,145 @@
+/** Loaded-only advisory evidence. No auth, disk, keychain, selectors, timers or probes. Imported only by src/combos/jev-quota-activation.ts; core producers reach it through src/lib/decision-quota-sink.ts while activation is registered. */
+import { createHash } from "node:crypto";
+import { getConfigDir } from "../config/paths";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
+import type { OcxProviderConfig } from "../types";
+
+export interface DecisionQuotaWindow {
+  window: "5h" | "weekly" | "monthly" | "fable" | "opus" | "sonnet";
+  percent: number;
+  observedAt: number;
+  resetAt?: number;
+}
+export interface DecisionQuotaAccount {
+  id: string;
+  generation: string | number;
+  usable: boolean;
+}
+type Evidence = { generation: string | number; windows: readonly DecisionQuotaWindow[] };
+type Roster = { root: string; accounts: readonly DecisionQuotaAccount[] };
+const rosters = new Map<string, Roster>();
+const accounts = new Map<string, Evidence>();
+const unusable = new Map<string, string | number | true>();
+const POOL_PROVIDERS = new Set(["anthropic", "codex", "codex-main"]);
+const MAX_ROWS = 1024;
+const MAX_WINDOWS = 64;
+let keyEpoch = 0;
+let writesForTests = 0;
+/** Test-only: count of write entry calls, so signals-off tests can assert that nothing reached the snapshot. */
+export function decisionQuotaSnapshotWriteCountForTests(): number { return writesForTests; }
+const credentialVersions = new Map<string, string>();
+/** Credential owner calls this after its normal read; JEV never invokes that owner. */
+export function observeDecisionKeyCredential(reference: string, resolved: string | undefined): void {
+  writesForTests++;
+  const version = createHash("sha256").update(resolved ?? "").digest("hex");
+  const referenceId = createHash("sha256").update(reference).digest("hex");
+  const previous = credentialVersions.get(referenceId);
+  if (previous !== undefined && previous !== version) invalidateDecisionKeyQuotas();
+  if (credentialVersions.size >= 256 && !credentialVersions.has(referenceId)) {
+    credentialVersions.delete(credentialVersions.keys().next().value!);
+    invalidateDecisionKeyQuotas();
+  }
+  credentialVersions.set(referenceId, version);
+}
+const keys = new Map<string, { root: string; epoch: number; configGeneration: number; policy: string; windows: readonly DecisionQuotaWindow[] }>();
+/** Compose the per-provider, per-account map key. */
+const accountKey = (provider: string, id: string) => `${provider}\0${id}`;
+// Private policy digest, never returned or serialized. Resolving the configured credential is
+// the collector's responsibility; request reads only this already-published generation.
+/** Digest the provider settings a key-based evidence row was published under; it is never returned or serialized. */
+function keyPolicy(provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([
+    provider.adapter, provider.baseUrl, provider.authMode, provider.apiKey, provider.apiKeyPool, provider.headers,
+    provider.apiKey && credentialVersions.get(createHash("sha256").update(provider.apiKey).digest("hex")),
+  ])).digest("hex");
+}
+/** Drop all key-based decision evidence and advance the epoch so earlier publications cannot be read. */
+export function invalidateDecisionKeyQuotas(): void { keyEpoch++; keys.clear(); }
+/** Publish decision windows for a single-key provider; pooled, disabled or non-key providers are never published, and the table is bounded. */
+export function publishDecisionKeyQuota(name: string, provider: OcxProviderConfig, windows: readonly DecisionQuotaWindow[]): void {
+  writesForTests++;
+  if (name.length > 1024 || provider.disabled || (provider.authMode ?? "key") !== "key" || (provider.apiKeyPool?.length ?? 0) > 1) return;
+  if (keys.size >= 256 && !keys.has(name)) keys.delete(keys.keys().next().value!);
+  keys.set(name, { root: getConfigDir(), epoch: keyEpoch, configGeneration: captureConfigGeneration(), policy: keyPolicy(provider), windows: copyWindows(windows) });
+}
+/** Read key-based evidence only when the config root, epoch, generation and provider policy still match what was published. */
+export function readLoadedDecisionKeyQuota(name: string, provider: OcxProviderConfig): readonly DecisionQuotaWindow[] | undefined {
+  const row = keys.get(name);
+  if (!row || provider.disabled || (provider.authMode ?? "key") !== "key" || (provider.apiKeyPool?.length ?? 0) > 1
+    || row.root !== getConfigDir() || row.epoch !== keyEpoch || row.configGeneration !== captureConfigGeneration()
+    || row.policy !== keyPolicy(provider)) return undefined;
+  return row.windows.map(row => ({ ...row }));
+}
+/** Replace a pool provider's roster; an oversized pool makes the whole pool unknown rather than hiding usable rows. */
+export function publishDecisionQuotaRoster(provider: string, rows: readonly DecisionQuotaAccount[]): void {
+  writesForTests++;
+  if (!POOL_PROVIDERS.has(provider)) return;
+  const old = rosters.get(provider);
+  if (old?.root !== getConfigDir()) {
+    clearDecisionAccountQuotas(provider);
+    for (const key of unusable.keys()) if (key.startsWith(`${provider}\0`)) unusable.delete(key);
+  }
+  // Overflow or oversized identities make the WHOLE pool unknown; never hide a usable row.
+  if (rows.length > MAX_ROWS || rows.some(row => row.id.length > 1024
+    || typeof row.generation === "string" && row.generation.length > 128)) {
+    clearDecisionAccountQuotas(provider);
+    rosters.delete(provider);
+    return;
+  }
+  const live = new Map(rows.map(row => [row.id, row]));
+  for (const row of old?.accounts ?? []) {
+    if (live.get(row.id)?.generation !== row.generation) {
+      const key = accountKey(provider, row.id);
+      accounts.delete(key);
+      if (!live.has(row.id) || unusable.get(key) !== true) unusable.delete(key);
+    }
+  }
+  rosters.set(provider, { root: getConfigDir(), accounts: rows.map(row => ({ id: row.id, generation: row.generation, usable: row.usable })) });
+}
+/** Withdraw a pool provider's roster and evidence so readers see it as unknown rather than stale or empty. */
+export function withdrawDecisionQuotaRoster(provider: string): void {
+  clearDecisionAccountQuotas(provider);
+  rosters.delete(provider);
+  for (const key of unusable.keys()) if (key.startsWith(`${provider}\0`)) unusable.delete(key);
+}
+/** Publish windows for a roster account at the matching credential generation; a partial observation retains other windows of the same generation. */
+export function publishDecisionAccountQuota(provider: string, id: string, generation: string | number, windows: readonly DecisionQuotaWindow[], partial = false): void {
+  writesForTests++;
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir() || !roster.accounts.some(row => row.id === id && row.generation === generation)) return;
+  const key = accountKey(provider, id);
+  const previous = accounts.get(key);
+  const retained = partial && previous?.generation === generation ? previous.windows.filter(row => !windows.some(next => row.window === next.window)) : [];
+  accounts.set(key, { generation, windows: copyWindows([...retained, ...windows]) });
+}
+/** Read a pool's already-loaded roster with generation-matched windows; undefined when nothing is loaded for the current config root. */
+export function readLoadedDecisionQuotaPool(provider: string): readonly { id: string; usable: boolean; windows?: readonly DecisionQuotaWindow[] }[] | undefined {
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir()) return undefined;
+  return roster.accounts.map(row => {
+    const evidence = accounts.get(accountKey(provider, row.id));
+    const quarantine = unusable.get(accountKey(provider, row.id));
+    return { id: row.id, usable: row.usable && quarantine !== true && quarantine !== row.generation, ...(evidence?.generation === row.generation ? { windows: evidence.windows.map(window => ({ ...window })) } : {}) };
+  });
+}
+/** Mark a roster account usable or unusable, optionally scoped to one credential generation so an unrelated generation is left intact. */
+export function setDecisionAccountUsable(provider: string, id: string, usable: boolean, generation?: string | number): void {
+  writesForTests++;
+  const roster = rosters.get(provider);
+  if (roster?.root !== getConfigDir()) return;
+  const row = roster.accounts.find(row => row.id === id && (generation === undefined || generation === row.generation));
+  if (!row) return;
+  const key = accountKey(provider, id);
+  if (usable) {
+    if (generation === undefined || unusable.get(key) !== true) unusable.delete(key);
+  } else if (generation === undefined || unusable.get(key) !== true) unusable.set(key, generation ?? true);
+}
+/** Drop published account windows for a provider or one account, or for every provider when none is given. */
+export function clearDecisionAccountQuotas(provider?: string, id?: string): void {
+  for (const key of accounts.keys()) if (!provider || key.startsWith(`${provider}\0`) && (!id || key === accountKey(provider, id))) accounts.delete(key);
+}
+/** Copy only known window kinds into the bounded evidence table, so callers cannot retain a mutable reference. */
+function copyWindows(windows: readonly DecisionQuotaWindow[]): DecisionQuotaWindow[] {
+  if (windows.length > MAX_WINDOWS) return [];
+  return windows.filter(row => ["5h", "weekly", "monthly", "fable", "opus", "sonnet"].includes(row.window)).map(row => ({ window: row.window, percent: row.percent, observedAt: row.observedAt, ...(row.resetAt !== undefined ? { resetAt: row.resetAt } : {}) }));
+}

package/src/providers/quota-routing-cache.ts

@@ -1,3 +1,4 @@
+import { invalidateDecisionKeyQuotas } from "../lib/decision-quota-sink";
 import { createHash } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 import type { ProviderQuota, ProviderQuotaReport } from "./quota";
@@ -28,7 +29,7 @@ export function providerQuotaRoutingBinding(
   // A key probe must not constrain that later account selection.
   const entry = getProviderRegistryEntry(name);
   if (entry && (entry.authKind === "oauth" || entry.authKind === "forward")
-    && !providerUsesKeyAuthOverride(entry, provider, credential)) return null;
+    && !providerUsesKeyAuthOverride(entry, provider)) return null;
   // Static auth headers can replace or combine with the probed API-key header.
   // Its semantics belong to the adapter, so it is not provider-wide quota evidence.
   if (Object.keys(provider.headers ?? {}).some(header =>
@@ -38,7 +39,9 @@ export function providerQuotaRoutingBinding(
   ])).digest("hex");
 }
 
+/** Clear the routing quota cache together with key-based decision evidence, so one cannot outlive the other. */
 export function clearCachedProviderQuotas(): void {
+  invalidateDecisionKeyQuotas();
   quotaCache.clear();
 }
 

package/src/providers/quota-types.ts

@@ -19,7 +19,12 @@ export interface ProviderQuotaWindow {
   label: string;
   percent: number;
   resetAt?: number;
-  /** Exact CCA wire model measured by this window; display evidence only, not eligibility. */
+  /**
+   * Model this window is attributed to: the exact CCA wire model of a fallback measurement, or
+   * the canonical model of a quota-summary bucket dedicated to one model (Antigravity's Gemini 4
+   * Argon pool). Display evidence only, never eligibility: routing, exhaustion, reset ordering
+   * and reset notifications ignore every window that carries it.
+   */
   modelId?: string;
   /**
    * Set only when the PRODUCER proved this window covers one model family, structurally rather

package/src/providers/quota.ts

@@ -1,6 +1,7 @@
 import { listCodexAuthAccountsSnapshot } from "../codex/auth-api";
 import { isAnthropicInstanceId, configuredAnthropicInstance } from "./anthropic-instance";
 import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
+import { thrownQuotaFailure } from "./quota/failure-codes";
 import { resolveEnvValue } from "../config";
 import { getAccountCredential, getAccountSet } from "../oauth/store";
 import { apiKeyPoolEntryId } from "./api-keys";
@@ -31,7 +32,7 @@ import {
   isProviderQuotaReportCurrent,
   LAST_GOOD_MAX_AGE_MS,
   providerQuotaBeforePublishForTests,
-  routingEvidence,
+  routingEvidence, publishCollectedDecisionQuota,
   setProviderQuotaReportCache,
   TERMINAL_QUOTA_FAILURE,
   type CodexAuthAccountsSnapshotPromise,
@@ -228,6 +229,7 @@ export function flushProviderQuotaObservationsForTests(): Promise<void> {
   return pendingProviderObservation;
 }
 
+/** Collect provider quota reports, using the cache unless refresh is forced, and publish the secret-free decision evidence from the collected reports. */
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
   // A passive read (a Remote Link Child's, #6959) shows the held reports and starts nothing.
   if (isPassiveRead()) return heldProviderQuotaReports(Object.keys(config.providers));
@@ -328,7 +330,7 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
     ) {
       const reports = response.reports.filter(item => mayCommitProviderQuotaKey(item.provider, writerGeneration));
       setProviderQuotaReportCache({ key, ts: Date.now(), response: { ...response, reports } });
-      replaceCachedProviderQuotas(reports, routingEvidence);
+      replaceCachedProviderQuotas(reports, routingEvidence); publishCollectedDecisionQuota(reports, config);
       notifyProviderQuotaSnapshot(reports, config);
     }
     return response;
@@ -514,7 +516,10 @@ async function fetchAccountQuota(
       }
       return entry;
     } catch (error) {
-      if (provider === "google-antigravity") quotaFailure = "account_unavailable";
+      // The probe itself reports HTTP and transport failures as results; what throws here is the
+      // credential side (missing/paused account, failed refresh, no project). A refresh that hit
+      // its deadline is a timeout to retry, not an account the operator must re-sign.
+      if (provider === "google-antigravity") quotaFailure = thrownQuotaFailure(error) === "timeout" ? "timeout" : "account_unavailable";
       return unavailable();
     }
   })().finally(() => {