@centerforagenticai/pi-multi-account 0.1.2 → 0.1.4

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Global Anthropic and OpenAI Codex multi-account OAuth routing for Pi.",
   "type": "module",
   "bin": {

package/src/anthropic-adaptive-stream.ts

@@ -24,8 +24,9 @@
  * Provenance: pi-anthropic-oauth@0.2.4-intel.2, private pin
  * 99ac00f290efbcb93e7f23e6b7482d8727367aa7, upstream baseline
  * 53266ecb51b6d1890ef3f7251a64cb1d71d96099, source src/stream.ts.
- * Local delta: adaptive thinking emits type=adaptive and mapped output effort,
- * without budget_tokens; all other request and response behavior is unchanged.
+ * Local delta: adaptive thinking emits type=adaptive and mapped output effort
+ * without budget_tokens; request-local retry/timeout options reach the SDK; and
+ * refusal or unknown stop reasons retain bounded, structured error details.
  */
 
 import { Anthropic } from "@anthropic-ai/sdk";
@@ -41,6 +42,8 @@ import {
   type SimpleStreamOptions,
   type StopReason,
 } from "@earendil-works/pi-ai";
+import { sanitizeDiagnosticText } from "./diagnostics.js";
+import type { ProviderErrorCode } from "./error-classification.js";
 type IndexedBlock =
   | ({ type: "text"; text: string } & { index: number })
   | ({ type: "thinking"; thinking: string; thinkingSignature?: string } & {
@@ -95,18 +98,51 @@ const REQUIRED_BETAS = [
   "interleaved-thinking-2025-05-14",
 ] as const;
 
-function mapStopReason(reason: string | null | undefined): StopReason {
+type StopReasonResult = Readonly<{
+  stopReason: StopReason;
+  errorMessage?: string;
+  code?: Extract<ProviderErrorCode, "refusal" | "unknown_stop">;
+}>;
+
+function mapStopReason(
+  reason: string | null | undefined,
+  stopDetails?: unknown,
+): StopReasonResult {
   switch (reason) {
     case "end_turn":
     case "pause_turn":
     case "stop_sequence":
-      return "stop";
+      return { stopReason: "stop" };
     case "max_tokens":
-      return "length";
+      return { stopReason: "length" };
     case "tool_use":
-      return "toolUse";
-    default:
-      return "error";
+      return { stopReason: "toolUse" };
+    case "refusal": {
+      const explanation =
+        typeof stopDetails === "object" &&
+        stopDetails !== null &&
+        typeof (stopDetails as { explanation?: unknown }).explanation === "string"
+          ? sanitizeDiagnosticText(
+              (stopDetails as { explanation: string }).explanation,
+            )
+          : "";
+      return {
+        stopReason: "error",
+        errorMessage:
+          explanation || "The model refused to complete the request",
+        code: "refusal",
+      };
+    }
+    default: {
+      const boundedReason = sanitizeDiagnosticText(reason ?? "unknown");
+      return {
+        stopReason: "error",
+        errorMessage: sanitizeDiagnosticText(
+          `Provider stopped with: ${boundedReason}`,
+        ),
+        code: "unknown_stop",
+      };
+    }
   }
 }
 
@@ -163,7 +199,7 @@ export function streamAnthropicAdaptive(
   const stream = createAssistantMessageEventStream();
 
   void (async () => {
-    const output: AssistantMessage = {
+    const output: AssistantMessage & { code?: ProviderErrorCode } = {
       role: "assistant",
       content: [],
       api: model.api,
@@ -276,10 +312,24 @@ export function streamAnthropicAdaptive(
       // which throws under fine-grained-tool-streaming (input may be invalid
       // mid-flight) and aborts the turn. The raw stream yields the same
       // RawMessageStreamEvents; tool args are already parsed leniently below.
+      const maxRetries = options?.maxRetries;
+      const timeoutMs = options?.timeoutMs;
       const { data: anthropicStream, response: httpResponse } =
         await client.messages
           .create(params, {
             signal: options?.signal,
+            ...(Number.isFinite(maxRetries) &&
+            Number.isInteger(maxRetries) &&
+            (maxRetries ?? -1) >= 0
+              ? { maxRetries }
+              : {}),
+            // Any finite positive timeout is honored; the SDK timer takes whole
+            // milliseconds, so a fractional value is floored to at least 1.
+            ...(typeof timeoutMs === "number" &&
+            Number.isFinite(timeoutMs) &&
+            timeoutMs > 0
+              ? { timeout: Math.max(1, Math.floor(timeoutMs)) }
+              : {}),
           })
           .withResponse();
 
@@ -474,7 +524,19 @@ export function streamAnthropicAdaptive(
         }
 
         if (event.type === "message_delta") {
-          output.stopReason = mapStopReason(event.delta.stop_reason);
+          const rawStopReason = event.delta.stop_reason;
+          const mapped = mapStopReason(
+            rawStopReason,
+            (event.delta as { stop_details?: unknown }).stop_details,
+          );
+          output.stopReason = mapped.stopReason;
+          if (typeof rawStopReason === "string") {
+            output.rawStopReason = sanitizeDiagnosticText(rawStopReason);
+          }
+          if (mapped.errorMessage !== undefined) {
+            output.errorMessage = mapped.errorMessage;
+          }
+          if (mapped.code !== undefined) output.code = mapped.code;
           output.usage.input =
             (event.usage as { input_tokens?: number }).input_tokens ||
             output.usage.input;
@@ -505,11 +567,15 @@ export function streamAnthropicAdaptive(
       }
 
       if (options?.signal?.aborted) throw new Error("Request aborted");
-      stream.push({
-        type: "done",
-        reason: output.stopReason as "stop" | "length" | "toolUse",
-        message: output,
-      });
+      if (output.stopReason === "error") {
+        stream.push({ type: "error", reason: "error", error: output });
+      } else {
+        stream.push({
+          type: "done",
+          reason: output.stopReason as "stop" | "length" | "toolUse",
+          message: output,
+        });
+      }
       stream.end();
     } catch (error) {
       for (const block of output.content as Array<{

package/src/anthropic-alias-stream.ts

@@ -13,6 +13,7 @@ import {
   sanitizeDiagnosticText,
   sanitizeHeaderValue,
 } from "./diagnostics.js";
+import { hostFinalStopMessage } from "./host-final-stop-message.js";
 
 export const ANTHROPIC_ALIAS_API = "hypha-anthropic-oauth" as const;
 
@@ -53,12 +54,19 @@ function withAliasAttribution(
   };
 }
 
+/**
+ * Bounds an upstream error and, for a structured refusal or unknown stop,
+ * publishes the shared host-final message. A direct alias turn reaches the
+ * host's retry and compaction predicates without the unified provider, so
+ * provider-authored stop wording must not make the host resend the request.
+ */
 function sanitizeUpstreamError(message: AssistantMessage): AssistantMessage {
   if (message.errorMessage === undefined) return message;
-  return {
+  const sanitized: AssistantMessage = {
     ...message,
     errorMessage: sanitizeDiagnosticText(message.errorMessage),
   };
+  return { ...sanitized, ...hostFinalStopMessage(sanitized) };
 }
 
 function withAliasEvent(

package/src/codex-adapter.ts

@@ -235,9 +235,33 @@ function normalizeAliasContext(
 }
 
 /**
- * Wraps the exact maintained stream without replacing transport or OAuth. Pi's
+ * Temporary containment for the Pi 0.99 Codex WebSocket failure: a WebSocket
+ * error leaves the session in a state where the next Codex turn crashes with
+ * "Cannot read properties of undefined (reading 'length')". Routes this
+ * extension owns always request SSE. The base `openai-codex` provider is never
+ * touched; only options on calls we already route are adjusted. Remove once the
+ * WebSocket path is fixed upstream.
+ */
+export const CODEX_FORCED_TRANSPORT = "sse" as const;
+
+/** Returns options with Codex transport pinned to SSE, and whether a value was overridden. */
+export function forceCodexSseOptions<T extends SimpleStreamOptions>(
+  options: T | undefined,
+): { options: T; overridden: boolean } {
+  if (options?.transport === CODEX_FORCED_TRANSPORT) {
+    return { options, overridden: false };
+  }
+  return {
+    options: { ...(options ?? {}), transport: CODEX_FORCED_TRANSPORT } as T,
+    overridden: true,
+  };
+}
+
+/**
+ * Wraps the exact maintained stream without replacing OAuth. Pi's
  * alias-resolved apiKey and every other option field are forwarded unchanged;
- * only model/context identity and callback attribution are adapted.
+ * model/context identity and callback attribution are adapted, and transport
+ * is pinned to SSE (see {@link CODEX_FORCED_TRANSPORT}).
  */
 export function createCodexAliasStream(
   maintainedStream: NonNullable<ProviderConfig["streamSimple"]>,
@@ -251,12 +275,12 @@ export function createCodexAliasStream(
     };
     const upstreamContext = normalizeAliasContext(context, aliasModel);
 
-    let upstreamOptions = options;
+    let upstreamOptions = forceCodexSseOptions(options).options;
     if (options?.onPayload || options?.onResponse) {
       const aliasOnPayload = options.onPayload;
       const aliasOnResponse = options.onResponse;
       upstreamOptions = {
-        ...options,
+        ...upstreamOptions,
         ...(aliasOnPayload
           ? {
               onPayload: (payload: unknown) =>

package/src/error-classification.ts

@@ -13,6 +13,8 @@ export const PROVIDER_ERROR_CODES = [
 	"model_not_found",
 	"unsupported_api_version",
 	"invalid_request",
+	"refusal",
+	"unknown_stop",
 ] as const;
 export type ProviderErrorCode = (typeof PROVIDER_ERROR_CODES)[number];
 
@@ -50,10 +52,12 @@ export type FailureCategory =
 
 export interface FailureClassification {
 	readonly category: FailureCategory;
+	readonly kind?: "refusal" | "unknown-stop";
 	readonly accountAction:
 		| "cooldown-and-route"
 		| "invalidate-and-route"
-		| "route-without-retry";
+		| "route-without-retry"
+		| "retain-account";
 	readonly cooldownReason?: CooldownReason;
 	readonly serverHint?: NumericServerHint;
 }
@@ -248,6 +252,14 @@ export function classifyFailure(
 		return { category: "config", accountAction: "route-without-retry" };
 	}
 
+	if (signal.code === "refusal" || signal.code === "unknown_stop") {
+		return {
+			category: "unknown",
+			kind: signal.code === "refusal" ? "refusal" : "unknown-stop",
+			accountAction: "retain-account",
+		};
+	}
+
 	if (isTransportFailure(signal)) {
 		return cooldown("transport", "transport", signal);
 	}

package/src/host-final-stop-message.ts

@@ -0,0 +1,124 @@
+import {
+	isContextOverflow,
+	isRetryableAssistantError,
+	type AssistantMessage,
+} from "@earendil-works/pi-ai";
+import { sanitizeDiagnosticText } from "./diagnostics.js";
+
+/** Fixed fallbacks for a structured provider stop; none matches a host re-dispatch pattern. */
+export const REFUSAL_FALLBACK_MESSAGE = "The model refused to complete the request";
+export const UNKNOWN_STOP_FALLBACK_MESSAGE =
+	"Provider stopped with an unrecognized stop reason";
+
+/** Upper bound on the normalized stop reason named in a reworded message. */
+const MAX_NAMED_REASON_LENGTH = 64;
+
+/**
+ * Whether the pinned host would re-dispatch an error terminal carrying `text`.
+ *
+ * The host re-dispatches when either retry predicate matches the prose:
+ * `AgentSession._isRetryableError` runs pi-ai `isRetryableAssistantError`, and
+ * `_checkCompaction` runs `isContextOverflow` before compacting and retrying once
+ * (pi-coding-agent dist/core/agent-session.js, both from `@earendil-works/pi-ai`).
+ * An unreadable predicate result counts as a match, so the caller keeps looking
+ * for a safer form.
+ */
+function hostWouldRedispatch(message: AssistantMessage, text: string): boolean {
+	try {
+		const probe = { ...message, errorMessage: text };
+		return isRetryableAssistantError(probe) || isContextOverflow(probe, 0);
+	} catch {
+		return true;
+	}
+}
+
+function namedReasonMessage(reason: string): string {
+	return `Provider stopped (reason: ${reason})`;
+}
+
+/**
+ * Normalizes a bounded, sanitized raw stop reason into plain words: every run of
+ * non-alphanumeric characters (underscores included) becomes one space, and the
+ * result is capped at a word boundary where possible.
+ */
+function normalizedReasonWords(rawStopReason: unknown): string[] {
+	if (typeof rawStopReason !== "string") return [];
+	const words = sanitizeDiagnosticText(rawStopReason)
+		.replace(/[^A-Za-z0-9]+/g, " ")
+		.trim()
+		.split(" ")
+		.filter((word) => word.length > 0);
+	const kept: string[] = [];
+	let length = 0;
+	for (const word of words) {
+		const next = length === 0 ? word.length : length + 1 + word.length;
+		if (next > MAX_NAMED_REASON_LENGTH) {
+			if (kept.length === 0) kept.push(word.slice(0, MAX_NAMED_REASON_LENGTH));
+			break;
+		}
+		kept.push(word);
+		length = next;
+	}
+	return kept;
+}
+
+/**
+ * Names an unknown stop reason in a message neither host predicate acts on.
+ *
+ * The first form keeps every normalized word. When that still matches a host
+ * predicate (a reason containing "overloaded" or "timeout", say), the second
+ * form admits words in order and drops each one whose addition would make the
+ * message match. Every admitted prefix was probed, so the result is host-final
+ * by construction. An empty result yields `undefined`.
+ */
+function unknownStopNamingReason(
+	message: AssistantMessage,
+	rawStopReason: unknown,
+): string | undefined {
+	const words = normalizedReasonWords(rawStopReason);
+	if (words.length === 0) return undefined;
+	const reworded = namedReasonMessage(words.join(" "));
+	if (!hostWouldRedispatch(message, reworded)) return reworded;
+	const kept: string[] = [];
+	for (const word of words) {
+		const tentative = namedReasonMessage([...kept, word].join(" "));
+		if (!hostWouldRedispatch(message, tentative)) kept.push(word);
+	}
+	return kept.length === 0 ? undefined : namedReasonMessage(kept.join(" "));
+}
+
+/**
+ * The public error text for a structured refusal or unknown provider stop.
+ *
+ * The pinned host re-dispatches an error terminal from its prose alone (see
+ * `hostWouldRedispatch`). A refusal explanation or stop reason is
+ * provider-authored, so text such as "overloaded", "prompt is too long", or
+ * "model_context_window_exceeded" would make the host send the stopped request
+ * again. The structured code alone selects this path; the provider text is kept
+ * only when neither host predicate would act on it. An unknown stop is then
+ * reworded so it still names its reason, and only when no reworded form is safe
+ * is a fixed fallback published. A refusal whose explanation is unsafe publishes
+ * its fixed fallback directly. A message without the structured code, or that is
+ * not an error terminal, yields `undefined` and must be published unchanged.
+ */
+export function hostFinalStopMessage(
+	message: AssistantMessage,
+): { readonly errorMessage: string } | undefined {
+	const code = (message as { code?: unknown }).code;
+	if (message.stopReason !== "error") return undefined;
+	if (code !== "refusal" && code !== "unknown_stop") return undefined;
+	const candidate = message.errorMessage;
+	if (
+		typeof candidate === "string" &&
+		candidate.length > 0 &&
+		!hostWouldRedispatch(message, candidate)
+	) {
+		return { errorMessage: candidate };
+	}
+	if (code === "refusal") return { errorMessage: REFUSAL_FALLBACK_MESSAGE };
+	return {
+		errorMessage:
+			unknownStopNamingReason(message, message.rawStopReason) ??
+			UNKNOWN_STOP_FALLBACK_MESSAGE,
+	};
+}

package/src/index.ts

@@ -3890,6 +3890,18 @@ export const createMultiAccountExtension =
 				modelSupport,
 				alreadyCooled: classified.alreadyCooled === true,
 			});
+			if (decision.status === "retained") {
+				// A structured refusal or unknown stop keeps the account: no switch,
+				// no park, no OpenRouter, and no continuation. The same context would
+				// stop the same way on any account.
+				diagnostics.record(
+					"info",
+					"routing.retained",
+					"The provider stopped the turn with a refusal or unknown stop reason; the account was kept and no follow-up was scheduled.",
+					{ providerId, kind: decision.classification.kind ?? "unknown" },
+				);
+				return;
+			}
 			if (decision.status === "paused") {
 				// OpenRouter is an explicitly enabled, metered FINAL rung. The helper
 				// re-checks every managed family so family-chain policy cannot bypass
@@ -4873,7 +4885,7 @@ export const createMultiAccountExtension =
 								config,
 								nowMs,
 							});
-							if (reactive.status === "paused") return;
+							if (reactive.status !== "selected") return;
 							reactiveCandidate = reactive;
 							destinationProviderId = reactive.destination.providerId;
 						}
@@ -5299,9 +5311,17 @@ export const createMultiAccountExtension =
 			turnRouteOrigin = origin;
 			handledFailures.add(event.message);
 			const responseFailure = lastFailure.get(providerId) ?? {};
-			const messageCode = providerErrorCodeFromMessage(
-				event.message.errorMessage,
-			);
+			// A structured provider stop is copied only from this two-value allowlist,
+			// never spread, and it wins over any code parsed from provider-authored
+			// errorMessage prose: refusal text must not read as a rate limit.
+			const rawStopCode = (event.message as { code?: unknown }).code;
+			const stopCode =
+				rawStopCode === "refusal" || rawStopCode === "unknown_stop"
+					? rawStopCode
+					: undefined;
+			const messageCode =
+				stopCode ??
+				providerErrorCodeFromMessage(event.message.errorMessage);
 			const failure: ProviderFailureSignal = {
 				...responseFailure,
 				...(messageCode === undefined ? {} : { code: messageCode }),

package/src/logical-provider.ts

@@ -22,6 +22,7 @@ import {
 	type SimpleStreamOptions,
 } from "@earendil-works/pi-ai";
 import { RuntimeState, type LogicalRoutePin } from "./runtime-state.js";
+import { hostFinalStopMessage } from "./host-final-stop-message.js";
 import { DEFAULT_CONFIG } from "./config.js";
 import type {
 	AllowedFamily,
@@ -47,6 +48,16 @@ import type { ProviderType, Vendor } from "./vendor.js";
 
 export { LOGICAL_PROVIDER_ID } from "./models-declaration.js";
 import { LOGICAL_PROVIDER_ID } from "./models-declaration.js";
+import { forceCodexSseOptions } from "./codex-adapter.js";
+
+/** Fixed diagnostic label for a caller-supplied transport; never echoes the raw value. */
+function codexTransportLabel(
+	transport: unknown,
+): "websocket" | "websocket-cached" | "auto" | "other" {
+	return transport === "websocket" || transport === "websocket-cached" || transport === "auto"
+		? transport
+		: "other";
+}
 
 /** One physical account the logical provider may dispatch to. */
 export interface LogicalPhysicalAccount {
@@ -666,6 +677,7 @@ export function createLogicalProvider(
 	deps: LogicalProviderDeps,
 ): LogicalProvider {
 	const coordinator = createHostRetryCoordinator(deps);
+	let codexTransportNoticeSent = false;
 
 	const diagnose = (message: string): void => {
 		deps.onDiagnostic?.(message);
@@ -936,6 +948,7 @@ export function createLogicalProvider(
 
 	const projectMessage = (message: AssistantMessage, modelId: string): AssistantMessage => ({
 		...message, api: LOGICAL_PROVIDER_ID, provider: LOGICAL_PROVIDER_ID, model: modelId,
+		...hostFinalStopMessage(message),
 	});
 
 	const projectEvent = (event: unknown, modelId: string): unknown => {
@@ -1127,8 +1140,24 @@ export function createLogicalProvider(
 					await originalOnResponse(response, responseModel);
 				}
 			};
+			let routedOptions = options;
+			if (account.family === "openai-codex") {
+				// Temporary Pi 0.99 WebSocket containment; see CODEX_FORCED_TRANSPORT.
+				const forced = forceCodexSseOptions(options);
+				routedOptions = forced.options;
+				if (forced.overridden && options?.transport !== undefined && !codexTransportNoticeSent) {
+					codexTransportNoticeSent = true;
+					try {
+						deps.onDiagnostic?.(
+							`Codex transport "${codexTransportLabel(options.transport)}" overridden to "sse" on routed calls (Pi 0.99 WebSocket containment).`,
+						);
+					} catch {
+						// A diagnostic sink failure cannot replace a provider result.
+					}
+				}
+			}
 			const attributedOptions: SimpleStreamOptions = {
-				...options,
+				...routedOptions,
 				onPayload: wrappedOnPayload,
 				onResponse: wrappedOnResponse,
 			};

package/src/routing.ts

@@ -98,7 +98,18 @@ export interface PausedRoute {
 	readonly retryAfterMs: number | null;
 }
 
-export type ReactiveRouteDecision = SelectedRoute | PausedRoute;
+/**
+ * A structured refusal or unknown provider stop. The failed account is kept
+ * as-is: no cooldown, no invalidation, no alternative, and no continuation.
+ * The stop is deterministic for the request context, so another account would
+ * only spend another request on the same answer.
+ */
+export interface RetainedRoute {
+	readonly status: "retained";
+	readonly classification: FailureClassification;
+}
+
+export type ReactiveRouteDecision = SelectedRoute | PausedRoute | RetainedRoute;
 
 export interface HealthSelectionDecision {
 	readonly providerId: string;
@@ -1092,6 +1103,11 @@ export function routeAfterFailure(options: {
 		throw new TypeError("failedAccount must be a canonical managed provider.");
 	}
 	const classification = classifyFailure(failure);
+	// Before any state observation: a retained stop writes nothing and routes
+	// nowhere, so settlement cannot turn it into a switch or a continuation.
+	if (classification.accountAction === "retain-account") {
+		return { status: "retained", classification };
+	}
 	if (
 		classification.category === "config" &&
 		failure.code === "model_not_found" &&

package/src/shared-usage.ts

@@ -65,25 +65,22 @@ export const EXHAUSTION_HOLD_MS = 60 * 60_000;
  * policy.
  */
 const MAX_REFRESH_DEBOUNCE_MS = 60 * 60_000;
+/** Longest persisted usage-attempt delay produced by the capped retry ladder. */
+export const MAX_USAGE_ATTEMPT_DELAY_MS = 15 * 60_000;
 
 export const SHARED_USAGE_MAX_BYTES = 512 * 1024;
 const MAX_RECORD_BYTES = 4_096;
 const MAX_OBSERVER_ID_LENGTH = 256;
 /**
- * Shape a field name must have inside a record type this build does not
- * recognise, applied when deciding whether compaction may carry it forward
- * rather than delete it.
- *
- * A length bound alone was the first attempt and round 3 refuted it: a key
- * called `Bearer SECRET` is short, so the credential simply moved from the
- * value into the key. Field names this project writes are lower-camel
- * identifiers.
- *
- * There is no companion value-length bound: unknown string VALUES are refused
- * outright rather than length-capped, because a bounded short string is
- * exactly the shape of a leaked bearer token.
+ * Exactly the grammar `defaultObserverId()` can emit: a hostname mapped into
+ * `[A-Za-z0-9._-]`, then at most one `:` followed only by decimal pid digits,
+ * sliced to MAX_OBSERVER_ID_LENGTH. The rule is derived from the producer
+ * rather than from a guess about what a credential looks like
+ * (internal issue #108), and it deliberately does not require the
+ * colon or the pid: on a host whose name fills the slice, the delimiter and pid
+ * are cut off, and the store must not refuse or delete those records.
  */
-const CARRYABLE_FIELD_NAME = /^[a-z][A-Za-z0-9]{0,63}$/;
+const OBSERVER_ID_PATTERN = /^(?=.{1,256}$)[A-Za-z0-9._-]*(?::[0-9]*)?$/;
 
 export type UsageObservationSource = "rate-limit-header" | "usage-endpoint";
 
@@ -123,6 +120,25 @@ const USAGE_FAILURE_DETAILS = new Set<UsageFailureDetail>([
 	"quota-summary-error",
 ]);
 
+/**
+ * The closed set `failureReason()` in usage-fetch.ts can produce. A persisted
+ * attempt may carry only one of these, so the field cannot hold caller text.
+ */
+export type SharedUsageFailureReason =
+	| "rate-limit"
+	| "server-error"
+	| "credential-unavailable"
+	| "malformed-response"
+	| "network-error";
+
+const USAGE_FAILURE_REASONS = new Set<SharedUsageFailureReason>([
+	"rate-limit",
+	"server-error",
+	"credential-unavailable",
+	"malformed-response",
+	"network-error",
+]);
+
 /** Machine-global fetch-attempt state; deliberately ignored by usage aggregation. */
 export interface SharedUsageAttemptRecord {
 	readonly recordType: "usage-attempt";
@@ -133,9 +149,10 @@ export interface SharedUsageAttemptRecord {
 	readonly observedAtMs: number;
 	readonly observerId: string;
 	readonly failureCount: number;
+	/** Bounded relative to `observedAtMs` by the capped retry ladder. */
 	readonly nextAttemptAtMs: number;
 	readonly disabled: boolean;
-	readonly failureReason?: string;
+	readonly failureReason?: SharedUsageFailureReason;
 	/** Fixed, sanitized classification detail; never an upstream error body. */
 	readonly failureDetail?: UsageFailureDetail;
 	/**
@@ -238,141 +255,9 @@ function validTimestamp(value: unknown): value is number {
 	return typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
 
-/**
- * Whether a record this build cannot interpret may survive compaction.
- *
- * Compaction rebuilds the file from recognised records, so anything not carried
- * here is deleted. That is how an older build destroys a record type added
- * after it. Carrying unknown records forward keeps a newer build's state alive
- * across a mixed-version fleet.
- *
- * The filter exists because "unrecognised" also covers records this build
- * rejected as malformed, including the credential-bearing ones that
- * `append` refuses and compaction currently scrubs. Carrying those would turn a
- * durability fix into a privacy regression, so a carried record must still look
- * like a usage record for a known account: a `recordType` string this build
- * does not know, the same account identity fields every record carries, and no
- * field outside that shape. A future record type satisfies this; a leaked
- * authorization header does not.
- */
-function carryableUnknownRecord(value: unknown): boolean {
-	if (typeof value !== "object" || value === null || Array.isArray(value))
-		return false;
-	const record = value as Record<string, unknown>;
-	// `recordType` must look like a record type, not merely be non-empty.
-	//
-	// Round 2 proved "non-empty string" is not a constraint: `Bearer <token>`
-	// is a non-empty string, so a credential placed here survived compaction.
-	// A real record type is a lower-kebab identifier, and nothing that fails
-	// this shape is a record type this build should carry blind.
-	if (
-		typeof record.recordType !== "string" ||
-		!CARRYABLE_RECORD_TYPE.test(record.recordType)
-	)
-		return false;
-	if (
-		typeof record.providerId !== "string" ||
-		typeof record.family !== "string" ||
-		!isAllowedFamily(record.family) ||
-		!isCanonicalManagedProviderId(record.providerId, record.family) ||
-		!validTimestamp(record.observedAtMs) ||
-		!validObserverId(record.observerId) ||
-		// Stricter than `validObserverId` on purpose: that only bounds length,
-		// and a bearer token is a bounded string. See CARRYABLE_OBSERVER_ID.
-		!CARRYABLE_OBSERVER_ID.test(record.observerId)
-	)
-		return false;
-	// Beyond the identity fields above, a carried record may hold only
-	// NON-STRING values.
-	//
-	// The first version of this filter bounded value shape -- primitives only,
-	// length-capped -- and review proved it unsound: `{ authorization: "Bearer
-	// SHORT" }` is a bounded primitive and survived compaction, which is exactly
-	// the privacy regression the carry-through was not allowed to create.
-	//
-	// Refusing unknown strings outright is the only defensible rule here. A
-	// denylist of sensitive-looking field names would be a guess about what a
-	// future record type calls its fields, and every credential this project
-	// handles is a string. Timestamps, counts, fractions and flags -- what a
-	// forward-compatible usage record actually needs -- are unaffected. A future
-	// type that genuinely needs a string field must teach this build about
-	// itself rather than rely on being carried blind.
-	for (const [key, entry] of Object.entries(record)) {
-		// Field NAMES are constrained by shape, not only length. Round 3 found
-		// a length bound alone lets a key called `Bearer SECRET` through: the
-		// credential rides in the key rather than the value. A field name in a
-		// JSON record written by this project is a lower-camel identifier.
-		if (!CARRYABLE_FIELD_NAME.test(key)) return false;
-		if (CARRYABLE_IDENTITY_FIELDS.has(key)) continue;
-		if (!carryableUnknownValue(entry)) return false;
-	}
-	return true;
-}
-
-/**
- * Record types compaction may carry forward: the project's own namespace.
- *
- * Two weaker rules were tried and both refuted. "Non-empty" fell to
- * `Bearer <token>` in round 2. A lower-kebab shape fell in round 3 to
- * `sk-ant-api03-deadbeef`, which IS lower-kebab -- an API key and a record
- * type are not distinguishable by shape, so no amount of character-class
- * tightening can separate them.
- *
- * A namespace can. Every record type this file writes is `usage-`-prefixed
- * (`usage-attempt`, `usage-exhaustion-hold`), so a future type from a newer
- * build will be too. That is a property of the writer rather than a guess
- * about what a credential looks like, which is why it holds where the shape
- * checks did not.
- */
-const CARRYABLE_RECORD_TYPE = /^usage-[a-z][a-z0-9-]{0,56}$/;
-
-/**
- * Shape a carried record's `observerId` must have.
- *
- * `validObserverId` only bounds length, and round 2 proved that insufficient:
- * a bearer token is a bounded string. This restricts the CHARACTER SET instead,
- * which is what makes the field unusable for smuggling while still accepting
- * everything the producer can emit.
- *
- * The colon is deliberately NOT required. `defaultObserverId` builds
- * `${hostname()}:${process.pid}` and then truncates to MAX_OBSERVER_ID_LENGTH,
- * so on a host with a very long name the pid -- and the colon with it -- is cut
- * off entirely. Round 3 found an earlier version of this expression required
- * the colon, which would have made compaction DELETE legitimate records on such
- * a machine: the precise data loss this carry-through exists to prevent, caused
- * by the fix for it. A verified probe produced a 256-character id with no colon
- * at all.
- *
- * The length bound matches MAX_OBSERVER_ID_LENGTH rather than guessing a
- * narrower one, so the accepted domain covers every value the producer can
- * actually return.
- */
-const CARRYABLE_OBSERVER_ID = /^[A-Za-z0-9._:-]{1,256}$/;
-
-/**
- * Identity fields every record carries. They are the only strings a carried
- * unknown record may contain, and each is format-checked above rather than
- * merely bounded.
- */
-const CARRYABLE_IDENTITY_FIELDS = new Set([
-	"recordType",
-	"providerId",
-	"family",
-	"observerId",
-]);
-
-function carryableUnknownValue(value: unknown): boolean {
-	return (
-		value === null || typeof value === "boolean" || typeof value === "number"
-	);
-}
 
 function validObserverId(value: unknown): value is string {
-	return (
-		typeof value === "string" &&
-		value.length > 0 &&
-		value.length <= MAX_OBSERVER_ID_LENGTH
-	);
+	return typeof value === "string" && OBSERVER_ID_PATTERN.test(value);
 }
 
 const TOKEN_FIELDS = [
@@ -474,10 +359,15 @@ function validAttemptRecord(value: unknown): value is SharedUsageAttemptRecord {
 		validObserverId(record.observerId) &&
 		nonNegativeInteger(record.failureCount) &&
 		validTimestamp(record.nextAttemptAtMs) &&
+		record.nextAttemptAtMs >= record.observedAtMs &&
+		record.nextAttemptAtMs - record.observedAtMs <=
+			MAX_USAGE_ATTEMPT_DELAY_MS &&
 		typeof record.disabled === "boolean" &&
 		(record.failureReason === undefined ||
 			(typeof record.failureReason === "string" &&
-				record.failureReason.length <= 128)) &&
+				USAGE_FAILURE_REASONS.has(
+					record.failureReason as SharedUsageFailureReason,
+				))) &&
 		(record.failureDetail === undefined ||
 			(typeof record.failureDetail === "string" &&
 				USAGE_FAILURE_DETAILS.has(record.failureDetail as UsageFailureDetail))) &&
@@ -551,9 +441,19 @@ function defaultStorePath(): string {
 	return join(agentDir, "pi-multi-account", "usage.ndjson");
 }
 
-/** Identity is bounded metadata only; it contains no credential-derived value. */
-export function defaultObserverId(): string {
-	return `${hostname()}:${process.pid}`.slice(0, MAX_OBSERVER_ID_LENGTH);
+/**
+ * Identity is bounded metadata only; it contains no credential-derived value.
+ *
+ * Hostname characters outside the observer-id alphabet are mapped to `-`, so
+ * every value this producer returns is one `validObserverId` accepts. Without
+ * that, an unusual hostname would make the default store constructor throw.
+ */
+export function defaultObserverId(
+	host: string = hostname(),
+	pid: number = process.pid,
+): string {
+	const safeHost = host.replace(/[^A-Za-z0-9._-]/g, "-");
+	return `${safeHost}:${pid}`.slice(0, MAX_OBSERVER_ID_LENGTH);
 }
 
 function projectRecord(record: SharedUsageRecord): SharedUsageRecord {
@@ -829,24 +729,26 @@ function compactUsageFile(options: {
 		const latestRateLimits = new Map<string, SharedUsageRecord>();
 		const latestAttempts = new Map<string, SharedUsageAttemptRecord>();
 		const latestHolds = new Map<string, SharedUsageExhaustionHoldRecord>();
-		// Records this build has no reader for are carried through verbatim.
-		//
-		// Compaction rebuilds the file from what it recognises, so without this a
-		// process running an older build silently deletes every record type added
-		// after it -- including the exhaustion holds that keep a spent account out
-		// of rotation. The account then looks healthy
-		// to the next process and gets routed to again.
+		// Compaction is a CLOSED REGISTRY: only the three record types this
+		// build validates survive, and each survives as the JSON of its own
+		// validated projection, never as the source bytes.
 		//
-		// Carrying them verbatim rather than re-serialising keeps this build from
-		// imposing a shape on data it does not understand, and matches how the
-		// writer tail below is copied byte-for-byte.
+		// internal MR !83 carried unrecognised records verbatim so an
+		// older build would not delete a newer build's record types. Four rounds
+		// of shape rules (non-empty, lower-kebab, `usage-` namespace, lower-camel
+		// field names) tried to tell a future record from credential text and
+		// all were refuted (internal issue #110): `sk-ant-api03-deadbeef`
+		// is indistinguishable by shape from an identifier, a `usage-` prefix is
+		// free to any writer, and a retained source line keeps every field name
+		// and raw numeric text too. A record this build cannot interpret cannot
+		// be proved credential-free, so it is dropped.
 		//
-		// This is deliberately limited to whole unrecognised *records*.
-		// Unrecognised *fields* on a recognised record are still stripped by
-		// projectRecord/projectAttempt: that projection is the credential scrub
-		// required by AGENTS.md, and widening it here would trade a privacy
-		// guarantee for a durability one.
-		const unrecognisedLines: string[] = [];
+		// Mixed-version safety is kept for every type this build knows, the
+		// exhaustion hold included: each is re-emitted from its validated fields,
+		// so a peer on this build never deletes a live hold. The accepted cost
+		// is that a record type added after this build is dropped when this
+		// build compacts; a new type must stay advisory until every build in the
+		// fleet recognises it.
 
 		for (const line of completeUsageLines(options.path, completePrefixBytes)) {
 			let parsed: unknown;
@@ -893,10 +795,7 @@ function compactUsageFile(options: {
 				if (!previous || hold.observedAtMs >= previous.observedAtMs) {
 					latestHolds.set(hold.providerId, hold);
 				}
-			} else if (carryableUnknownRecord(parsed)) {
-				unrecognisedLines.push(line);
 			}
-
 		}
 		const compactedRecords = new Set([
 			...latest.values(),
@@ -905,12 +804,9 @@ function compactUsageFile(options: {
 			...latestAttempts.values(),
 			...latestHolds.values(),
 		]);
-		// Carried records go first and verbatim, so a build that cannot interpret
-		// them neither reorders them relative to each other nor reformats them.
-		const compacted = [
-			...unrecognisedLines.map((line) => `${line}\n`),
-			...[...compactedRecords].map((record) => `${JSON.stringify(record)}\n`),
-		].join("");
+		const compacted = [...compactedRecords]
+			.map((record) => `${JSON.stringify(record)}\n`)
+			.join("");
 		const compactedBytes = Buffer.byteLength(compacted, "utf8");
 		if (compactedBytes > options.maxBytes) return false;
 
@@ -1009,6 +905,11 @@ export class SharedUsageStore {
 
 	append(record: SharedUsageLogRecord): boolean {
 		try {
+			// Judge the caller's own value, not the projection: projecting slices
+			// the observer id, and a value this store would have to rewrite is
+			// not one the producer emitted.
+			if (!validObserverId((record as { observerId?: unknown }).observerId))
+				return false;
 			const projected = validExhaustionHoldRecord(record)
 				? projectExhaustionHold(record)
 				: validAttemptRecord(record)
@@ -1134,16 +1035,22 @@ export class SharedUsageStore {
 	 * records, so a hold that has lapsed simply stops being reported. Callers get
 	 * a time to compare, not a boolean, because routing has to combine it with an
 	 * authoritative recovery time and take whichever is later.
+	 *
+	 * `clearedAtMs` excludes holds whose own validated `failedAtMs` is at or
+	 * before it, so a caller's operator clear is judged against the failure
+	 * the record states rather than one reconstructed from its deadline.
 	 */
 	activeExhaustionHoldUntilMs(
 		providerId: string,
 		family: AllowedFamily,
 		nowMs: number,
+		clearedAtMs?: number,
 	): number | undefined {
 		let latest: number | undefined;
 		for (const hold of this.readExhaustionHolds()) {
 			if (hold.providerId !== providerId || hold.family !== family) continue;
 			if (hold.holdUntilMs <= nowMs) continue;
+			if (clearedAtMs !== undefined && hold.failedAtMs <= clearedAtMs) continue;
 			// A relative bound alone is not enough. `holdUntilMs - failedAtMs` can
 			// be a legitimate 60 minutes while `failedAtMs` itself sits in the year
 			// 3138, which would exclude the account for centuries. No honest hold

package/src/usage-fetch.ts

@@ -6,8 +6,10 @@ import {
 	type MachineLeaseHandle,
 } from "./machine-lease.js";
 import {
+	MAX_USAGE_ATTEMPT_DELAY_MS,
 	normalizeUsageEndpointPercent,
 	type SharedUsageAttemptRecord,
+	type SharedUsageFailureReason,
 	type SharedUsageStore,
 	type UsageFailureDetail,
 } from "./shared-usage.js";
@@ -39,9 +41,8 @@ export const USAGE_FETCH_TIMEOUT_MS = 10_000;
 const MAX_RESPONSE_BYTES = 128 * 1024;
 const MAX_ERROR_CHARS = 512;
 const BASE_BACKOFF_MS = 30_000;
-const MAX_BACKOFF_MS = 15 * 60_000;
 const BACKOFF_LADDER_STEPS =
-	Math.ceil(Math.log2(MAX_BACKOFF_MS / BASE_BACKOFF_MS)) + 1;
+	Math.ceil(Math.log2(MAX_USAGE_ATTEMPT_DELAY_MS / BASE_BACKOFF_MS)) + 1;
 /** Disable only after the capped rung has failed once more. */
 export const USAGE_FETCH_DISABLE_AFTER_FAILURES = BACKOFF_LADDER_STEPS + 1;
 
@@ -104,12 +105,7 @@ export interface UsageFetchStatus {
 	readonly disabled: boolean;
 	readonly failureCount: number;
 	readonly nextAttemptAtMs?: number;
-	readonly disabledReason?:
-		| "rate-limit"
-		| "server-error"
-		| "credential-unavailable"
-		| "malformed-response"
-		| "network-error";
+	readonly disabledReason?: SharedUsageFailureReason;
 }
 
 export type UsageFetchResultStatus =
@@ -217,7 +213,10 @@ function retryAfterMs(response: UsageFetchResponse): number | undefined {
 	}
 	const seconds = Number(value);
 	if (!Number.isFinite(seconds) || seconds < 0) return undefined;
-	return Math.min(MAX_BACKOFF_MS, Math.max(0, Math.ceil(seconds * 1_000)));
+	return Math.min(
+		MAX_USAGE_ATTEMPT_DELAY_MS,
+		Math.max(0, Math.ceil(seconds * 1_000)),
+	);
 }
 
 /** Redacts bearer and access-token values before an error can escape this module. */
@@ -642,14 +641,37 @@ async function queryEndpoint(
 		: normalizeAnthropicUsagePayload(payload);
 }
 
+/**
+ * The attempt's deadline, or undefined when no honest ladder could have set it.
+ *
+ * The store already bounds `nextAttemptAtMs` against the record's own
+ * `observedAtMs` on append and read (internal issue #108). That span
+ * check alone is not enough for a reader: a record whose ORIGIN sits centuries
+ * ahead carries a legitimate-looking span and would still suppress polling for
+ * that account forever. No honest deadline lies further than one capped rung
+ * from now, so anything beyond that is ignored rather than trusted.
+ */
+function plausibleAttemptDeadline(
+	attempt: SharedUsageAttemptRecord | undefined,
+	nowMs: number,
+): number | undefined {
+	if (attempt === undefined) return undefined;
+	if (attempt.nextAttemptAtMs > nowMs + MAX_USAGE_ATTEMPT_DELAY_MS) {
+		return undefined;
+	}
+	return attempt.nextAttemptAtMs;
+}
+
 function statusFromAttempt(
 	attempt: SharedUsageAttemptRecord | undefined,
 	enabled: boolean,
+	nowMs: number,
 ): UsageFetchStatus {
 	const nextAttemptAtMs =
-		attempt?.failureCount === 0 ? undefined : attempt?.nextAttemptAtMs;
-	const disabledReason =
-		attempt?.failureReason as UsageFetchStatus["disabledReason"];
+		attempt?.failureCount === 0
+			? undefined
+			: plausibleAttemptDeadline(attempt, nowMs);
+	const disabledReason = attempt?.failureReason;
 	return {
 		enabled,
 		disabled: attempt?.disabled ?? false,
@@ -833,6 +855,7 @@ export class UsageFetcher {
 		return statusFromAttempt(
 			this.#sharedStore.latestAttempt(providerId, family),
 			enabled,
+			this.#now(),
 		);
 	}
 
@@ -997,11 +1020,9 @@ export class UsageFetcher {
 		// forever. The bound belongs here, on the record, before any clause
 		// reads it.
 		//
-		// `nextAttemptAtMs` is allowed one debounce interval of headroom because
-		// Only the ORIGIN timestamps are bounded, not `nextAttemptAtMs`: a real
-		// failure ladder legitimately schedules its next rung far ahead, up to
-		// MAX_BACKOFF_MS, and bounding that would break genuine backoff
-		// suppression. An honest record cannot have been OBSERVED in the future.
+		// `nextAttemptAtMs` is bounded relative to `observedAtMs` by the store and
+		// checked again here before it may suppress a send. An honest record cannot
+		// have been OBSERVED in the future either.
 		if (
 			attempt.observedAtMs > nowMs ||
 			(attempt.failureTriggeredAtMs !== undefined &&
@@ -1009,7 +1030,12 @@ export class UsageFetcher {
 		) {
 			return undefined;
 		}
-		if (attempt.failureCount > 0 && attempt.nextAttemptAtMs > nowMs) {
+		const nextAttemptAtMs = plausibleAttemptDeadline(attempt, nowMs);
+		if (
+			attempt.failureCount > 0 &&
+			nextAttemptAtMs !== undefined &&
+			nextAttemptAtMs > nowMs
+		) {
 			return "backoff";
 		}
 		if (attempt.observedAtMs >= failedAtMs) return "already-answered";
@@ -1190,8 +1216,13 @@ export class UsageFetcher {
 		// Once the recorded backoff has elapsed, the account is retried whether or
 		// not it was disabled. A retry that fails again simply re-arms the ladder at
 		// its capped rung, so a genuinely dead endpoint is polled at most once per
-		// MAX_BACKOFF_MS rather than hammered.
-		if (prior !== undefined && prior.nextAttemptAtMs > nowMs) {
+		// MAX_USAGE_ATTEMPT_DELAY_MS rather than hammered.
+		const priorDeadline = plausibleAttemptDeadline(prior, nowMs);
+		if (
+			prior !== undefined &&
+			priorDeadline !== undefined &&
+			priorDeadline > nowMs
+		) {
 			await this.#persistWindowGap(
 				account,
 				nowMs,
@@ -1223,7 +1254,13 @@ export class UsageFetcher {
 			// over a stale `disabled` flag, so a recovered account can be observed
 			// again. Re-read under the lease because a peer may have attempted in
 			// between.
-			if (current !== undefined && current.nextAttemptAtMs > this.#now()) {
+			const currentNowMs = this.#now();
+			const currentDeadline = plausibleAttemptDeadline(current, currentNowMs);
+			if (
+				current !== undefined &&
+				currentDeadline !== undefined &&
+				currentDeadline > currentNowMs
+			) {
 				await this.#persistWindowGap(
 					account,
 					this.#now(),
@@ -1555,7 +1592,7 @@ export class UsageFetcher {
 					: new UsageEndpointError("usage endpoint failed", "network-error");
 			const failureCount = (prior?.failureCount ?? 0) + 1;
 			const backoff = Math.min(
-				MAX_BACKOFF_MS,
+				MAX_USAGE_ATTEMPT_DELAY_MS,
 				BASE_BACKOFF_MS * 2 ** Math.max(0, failureCount - 1),
 			);
 			const disabled = failureCount >= USAGE_FETCH_DISABLE_AFTER_FAILURES;

package/src/usage.ts

@@ -337,8 +337,8 @@ export class UsageLedger {
 	 * exhaustion hold is one. But a hold is machine-global: deleting the record
 	 * would revoke it for every other session on the machine, and those peers
 	 * may still be refusing work on that account. So the override is
-	 * PROCESS-LOCAL -- this session stops honouring holds installed up to the
-	 * moment of the clear, and peers keep theirs.
+	 * PROCESS-LOCAL -- this session stops honouring holds whose failure happened
+	 * at or before the clear, and peers keep theirs.
 	 *
 	 * Stored as the clear time rather than a boolean so a LATER failure still
 	 * installs a hold this session honours. A boolean would make one `clear`
@@ -346,6 +346,13 @@ export class UsageLedger {
 	 * which is a permanent effect from a transient instruction.
 	 */
 	readonly #holdOverrides = new Map<string, number>();
+	/**
+	 * When `clear()` with no account last ran. Clear-all is one point in time
+	 * for EVERY account, including ones with no hold visible at that instant:
+	 * enumerating the holds present then let a peer publish a pre-clear hold a
+	 * moment later and still have it honoured (internal issue #110).
+	 */
+	#clearAllAtMs: number | undefined;
 	readonly #sharedStore: SharedUsageStore | undefined;
 	readonly #now: () => number;
 
@@ -714,29 +721,29 @@ export class UsageLedger {
 		family: AllowedFamily,
 		nowMs = this.#now(),
 	): number | undefined {
-		const holdUntilMs = this.#sharedStore?.activeExhaustionHoldUntilMs(
+		// An operator `clear` in THIS process stops us honouring holds whose
+		// failure happened at or before it. A hold from a LATER failure is
+		// honoured again: the override is a point in time, not a permanent
+		// exemption. Peers keep honouring the record either way, because it is
+		// not deleted.
+		//
+		// The store compares each hold's own validated `failedAtMs`. Deriving
+		// the failure time from the deadline (`holdUntilMs - EXHAUSTION_HOLD_MS`)
+		// is only right for an exact one-hour hold, and the store accepts every
+		// shorter span (internal issue #110).
+		const accountClearedAtMs = this.#holdOverrides.get(providerId);
+		const clearedAtMs =
+			accountClearedAtMs === undefined
+				? this.#clearAllAtMs
+				: this.#clearAllAtMs === undefined
+					? accountClearedAtMs
+					: Math.max(accountClearedAtMs, this.#clearAllAtMs);
+		return this.#sharedStore?.activeExhaustionHoldUntilMs(
 			providerId,
 			family,
 			nowMs,
+			clearedAtMs,
 		);
-		if (holdUntilMs === undefined) return undefined;
-		// An operator `clear` in THIS process stops us honouring holds that were
-		// already installed when it ran. A hold from a LATER failure is honoured
-		// again: the override is a point in time, not a permanent exemption.
-		// Peers keep honouring the record either way, because it is not deleted.
-		//
-		// `holdUntilMs - EXHAUSTION_HOLD_MS` recovers the failure time from the
-		// reported deadline without a second store read. The writer always sets
-		// exactly that span (asserted by the hold-duration test), and the
-		// store's own read bound refuses any record claiming more.
-		const clearedAtMs = this.#holdOverrides.get(providerId);
-		if (
-			clearedAtMs !== undefined &&
-			holdUntilMs - EXHAUSTION_HOLD_MS <= clearedAtMs
-		) {
-			return undefined;
-		}
-		return holdUntilMs;
 	}
 
 	/**
@@ -811,11 +818,7 @@ export class UsageLedger {
 		if (providerId === undefined) {
 			this.#snapshots.clear();
 			this.#quotaObservations.clear();
-			for (const id of this.#sharedStore
-				?.readExhaustionHolds()
-				.map((hold) => hold.providerId) ?? []) {
-				this.#holdOverrides.set(id, nowMs);
-			}
+			this.#clearAllAtMs = Math.max(this.#clearAllAtMs ?? nowMs, nowMs);
 		} else {
 			this.#snapshots.delete(providerId);
 			this.#quotaObservations.delete(providerId);