@coool/opencode-adaptive 1.0.1 → 1.2.1

package/dist/health/classifier/classify.js

@@ -4,6 +4,9 @@
  * classification cost or smuggle patterns in late bytes (ADP-008).
  */
 const TEXT_BOUND = 512;
+// These messages describe the subscription's shared allowance or balance,
+// unlike a generic quota error or a named model-family limit (ADP-007).
+const SHARED_QUOTA_PATTERN = /\byou['’]ve hit your (?:session|usage|weekly) limit(?=\s*(?:$|[·.,;(:]|resets?\b))|\b(?:out of credits|insufficient credits|credit balance)\b/i;
 /**
  * Retry/failover policy per category (ADP-010, ADP-011).
  *
@@ -54,7 +57,19 @@ const TEXTUAL_PATTERNS = [
         category: "context_overflow",
         pattern: /context (length|window)|maximum context|input length exceeds|prompt is too long|too many (input )?tokens|exceeds the maximum/i,
     },
-    { category: "quota_exhausted", pattern: /\bquota\b|credit balance/i },
+    {
+        // Subscription limits ("You've hit your session/usage limit") are quota
+        // exhaustion with a provider-side reset window; the reset time in the
+        // text is not parsed (the classifier has no clock) — the health layer's
+        // default quota window bounds the quarantine instead.
+        // Sibling fallback plugins' issue trackers document the real-world
+        // phrasings that missed curated whitelists (oh-my-openagent #2393/#5815,
+        // lichter's 429 lesson): snake-cased limits, "usage exceeded" without
+        // "limit", credit exhaustion without "balance". Qualifiers stay required
+        // so "token limit reached" (context overflow) never matches quota.
+        category: "quota_exhausted",
+        pattern: /\bquota\b|credit balance|(?:session|usage|free usage|message|plan|monthly|weekly|daily)[ _-]?limit|usage exceeded|out of credits|insufficient credits/i,
+    },
     { category: "rate_limited", pattern: /rate ?limit/i },
     { category: "timeout", pattern: /\btimeout\b|timed? ?out|deadline exceeded|etimedout/i },
     {
@@ -141,7 +156,7 @@ function retryAdvice(category, retryAfterMs) {
     }
     return { retryable: policy.retryable, retryAfterMs: bounded };
 }
-function classification(category, layer, definitive, retryAfterMs) {
+function classification(category, layer, definitive, retryAfterMs, quotaScope) {
     const policy = CATEGORY_POLICY[category];
     return {
         category,
@@ -149,6 +164,7 @@ function classification(category, layer, definitive, retryAfterMs) {
         definitive,
         retry: retryAdvice(category, retryAfterMs),
         failoverEligible: policy.failoverEligible,
+        ...(quotaScope !== undefined ? { quotaScope } : {}),
     };
 }
 /**
@@ -237,7 +253,10 @@ export function classifyFailure(evidence) {
     if (text !== undefined) {
         const category = classifyText(text);
         if (category !== undefined) {
-            return classification(category, "textual", false, structuredRetryAfterMs);
+            const quotaScope = category === "quota_exhausted" && SHARED_QUOTA_PATTERN.test(text.slice(0, TEXT_BOUND))
+                ? "provider"
+                : undefined;
+            return classification(category, "textual", false, structuredRetryAfterMs, quotaScope);
         }
     }
     return classification("unknown", "none", false, undefined);

package/dist/health/classifier/classify.js.map

@@ -1 +1 @@
-{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../../src/health/classifier/classify.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAEjB;IACF,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACzD,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE;IAC7D,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACnD,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACrD,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC3D,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC5D,gBAAgB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC/D,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC7D,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC7D,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;CACvD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAA0B;IACxD,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAClC,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACvC,CAAC,uBAAuB,EAAE,eAAe,CAAC;IAC1C,CAAC,yBAAyB,EAAE,QAAQ,CAAC;CACtC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAGhB;IACJ;QACE,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EACL,+HAA+H;KAClI;IACD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACrE,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE;IACrD,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACxF;QACE,QAAQ,EAAE,cAAc;QACxB,OAAO,EACL,mGAAmG;KACtG;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EACL,wFAAwF;KAC3F;IACD,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC1E,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,kDAAkD,EAAE;CAC5F,CAAA;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,CAAA;AACjG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9C,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAqD;IAErD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAoC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAoC;IAChE,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7C,YAAY,GAAG,IAAI,CAAA;YACnB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,YAAgC;IAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,QAAyB,EACzB,KAAqC,EACrC,UAAmB,EACnB,YAAgC;IAEhC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,OAAO;QACL,QAAQ;QACR,KAAK;QACL,UAAU;QACV,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAc,EACd,OAAoC;IAEpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACnE,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACtC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3E,CAAC,CAAC,UAAU,CAAC,YAAY;QACzB,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;QAC3E,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,cAAc,CACnB,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,sBAAsB,IAAI,kBAAkB,CAAC,OAAO,CAAC,CACtD,CAAA;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;IAC7E,CAAC;IAED,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACvD,OAAO,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,cAAc,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;IACtF,CAAC;IAED,kEAAkE;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;AAC5D,CAAC","sourcesContent":["import type { ErrorEvidence, FailureCategory, FailureClassification, RetryAdvice } from \"./types.js\"\n\n/**\n * Text fed to the textual last-resort layer is truncated to this bound before\n * matching, so adversarial or enormous error bodies cannot dominate\n * classification cost or smuggle patterns in late bytes (ADP-008).\n */\nconst TEXT_BOUND = 512\n\n/**\n * Retry/failover policy per category (ADP-010, ADP-011).\n *\n * - Infrastructure failures (rate limiting, quota, outage, overload, timeout)\n *   are failover-eligible: horizontal recovery within the tier is exactly\n *   their remedy.\n * - Permanent configuration failures (auth, invalid model, content policy)\n *   and context overflow never retry and never failover: retrying the same\n *   request cannot help and switching resources would reproduce the failure.\n * - User cancellation is final: no retry, no failover (ADP-010).\n * - Unknown failures defer to OpenCode's native handling.\n */\nconst CATEGORY_POLICY: Readonly<\n  Record<FailureCategory, { retryable: boolean; failoverEligible: boolean }>\n> = {\n  rate_limited: { retryable: true, failoverEligible: true },\n  quota_exhausted: { retryable: false, failoverEligible: true },\n  outage: { retryable: true, failoverEligible: true },\n  overload: { retryable: true, failoverEligible: true },\n  timeout: { retryable: true, failoverEligible: true },\n  auth_failure: { retryable: false, failoverEligible: false },\n  invalid_model: { retryable: false, failoverEligible: false },\n  context_overflow: { retryable: false, failoverEligible: false },\n  content_policy: { retryable: false, failoverEligible: false },\n  user_cancelled: { retryable: false, failoverEligible: false },\n  unknown: { retryable: false, failoverEligible: false },\n}\n\n/**\n * Error tags from the documented @opencode/protocol vocabulary that map\n * directly to a failure category. Tags absent here (`ProviderRequestError`,\n * `UnknownError`, anything unrecognized) are structured but not\n * category-specific: they never guess, and classification falls through to\n * the refining layers.\n */\nconst STRUCTURED_TYPES = new Map<string, FailureCategory>([\n  [\"UnauthorizedError\", \"auth_failure\"],\n  [\"ForbiddenError\", \"auth_failure\"],\n  [\"ModelNotFoundError\", \"invalid_model\"],\n  [\"UnsupportedModelError\", \"invalid_model\"],\n  [\"ServiceUnavailableError\", \"outage\"],\n])\n\n/**\n * Bounded textual patterns, last resort only (ADP-008). Ordered most\n * specific first; the first match wins. These encode provider error-message\n * conventions documented by the research phase, not a general-purpose\n * keyword classifier.\n */\nconst TEXTUAL_PATTERNS: readonly {\n  readonly category: FailureCategory\n  readonly pattern: RegExp\n}[] = [\n  {\n    category: \"context_overflow\",\n    pattern:\n      /context (length|window)|maximum context|input length exceeds|prompt is too long|too many (input )?tokens|exceeds the maximum/i,\n  },\n  { category: \"quota_exhausted\", pattern: /\\bquota\\b|credit balance/i },\n  { category: \"rate_limited\", pattern: /rate ?limit/i },\n  { category: \"timeout\", pattern: /\\btimeout\\b|timed? ?out|deadline exceeded|etimedout/i },\n  {\n    category: \"auth_failure\",\n    pattern:\n      /unauthorized|invalid (api|access) key|api key (expired|invalid)|authentication|permission denied/i,\n  },\n  {\n    category: \"invalid_model\",\n    pattern: /model.{0,30}(does not exist|not found)|invalid model|unknown model|no such model/i,\n  },\n  {\n    category: \"content_policy\",\n    pattern:\n      /content (management )?(policy|filter)|safety system|violates?.{0,32}policy|flagged as/i,\n  },\n  { category: \"overload\", pattern: /overloaded|over capacity|high demand/i },\n  { category: \"user_cancelled\", pattern: /cancel+(l)?ed|aborted by (the )?user|user abort/i },\n]\n\nfunction isHttpStatus(status: number | undefined): status is number {\n  return typeof status === \"number\" && Number.isInteger(status) && status >= 100 && status <= 599\n}\n\n/**\n * Upper bound on a provider-claimed retry delay. `Retry-After` and structured\n * retry metadata are untrusted provider data: a hostile or misconfigured\n * value (\"999999999\" seconds) must not convert one response into a\n * near-permanent resource blacklist. The host's own retry scheduling waits\n * out the raw header verbatim — this bound only concerns the health window\n * the supervisor derives from the classification (ADP-011 boundedness).\n */\nconst MAX_RETRY_AFTER_MS = 24 * 60 * 60 * 1000\n\nfunction boundedRetryAfterMs(retryAfterMs: number | undefined): number | undefined {\n  if (retryAfterMs === undefined) {\n    return undefined\n  }\n  return Math.min(retryAfterMs, MAX_RETRY_AFTER_MS)\n}\n\nfunction isNonNegativeInteger(value: number | undefined): value is number {\n  return typeof value === \"number\" && Number.isInteger(value) && value >= 0\n}\n\nfunction lowercasedHeaders(\n  headers: Readonly<Record<string, string>> | undefined,\n): ReadonlyMap<string, string> {\n  const lowered = new Map<string, string>()\n  if (headers === undefined) {\n    return lowered\n  }\n  for (const [name, value] of Object.entries(headers)) {\n    lowered.set(name.toLowerCase(), value)\n  }\n  return lowered\n}\n\n/**\n * Parses a `Retry-After` header into milliseconds. Only the integer-seconds\n * form is accepted: the HTTP-date form requires a clock, which the classifier\n * deliberately does not have (reset-time handling belongs to the capacity\n * boundary, T-05/T-15).\n */\nfunction retryAfterHeaderMs(headers: ReadonlyMap<string, string>): number | undefined {\n  const raw = headers.get(\"retry-after\")\n  if (raw === undefined || !/^\\d+$/.test(raw)) {\n    return undefined\n  }\n  return Number(raw) * 1000\n}\n\n/**\n * Standard rate-limit headers (case-insensitive `x-ratelimit-remaining*`).\n * All-zero remaining capacity indicates a fixed-window quota exhaustion\n * rather than a short burst limit.\n */\nfunction fixedWindowExhausted(headers: ReadonlyMap<string, string>): boolean {\n  let sawRemaining = false\n  for (const [name, value] of headers) {\n    if (name.startsWith(\"x-ratelimit-remaining\")) {\n      sawRemaining = true\n      if (value !== \"0\") {\n        return false\n      }\n    }\n  }\n  return sawRemaining\n}\n\nfunction retryAdvice(category: FailureCategory, retryAfterMs: number | undefined): RetryAdvice {\n  const policy = CATEGORY_POLICY[category]\n  const bounded = boundedRetryAfterMs(retryAfterMs)\n  if (bounded === undefined) {\n    return { retryable: policy.retryable }\n  }\n  return { retryable: policy.retryable, retryAfterMs: bounded }\n}\n\nfunction classification(\n  category: FailureCategory,\n  layer: FailureClassification[\"layer\"],\n  definitive: boolean,\n  retryAfterMs: number | undefined,\n): FailureClassification {\n  const policy = CATEGORY_POLICY[category]\n  return {\n    category,\n    layer,\n    definitive,\n    retry: retryAdvice(category, retryAfterMs),\n    failoverEligible: policy.failoverEligible,\n  }\n}\n\n/**\n * Classifies an HTTP status. 429 consults the standard rate-limit headers in\n * the same step: status plus documented standard headers are one HTTP\n * semantics layer, and the quota refinement is more specific evidence than a\n * bare 429, so it cannot weaken the ADP-008 precedence.\n */\nfunction classifyStatus(\n  status: number,\n  headers: ReadonlyMap<string, string>,\n): FailureCategory | undefined {\n  if (status === 429) {\n    return fixedWindowExhausted(headers) ? \"quota_exhausted\" : \"rate_limited\"\n  }\n  if (status === 401 || status === 403) {\n    return \"auth_failure\"\n  }\n  if (status === 408) {\n    return \"timeout\"\n  }\n  if (status === 413) {\n    return \"context_overflow\"\n  }\n  if (status === 502 || status === 503 || status === 504) {\n    return \"outage\"\n  }\n  return undefined\n}\n\nfunction classifyText(text: string): FailureCategory | undefined {\n  const bounded = text.length > TEXT_BOUND ? text.slice(0, TEXT_BOUND) : text\n  for (const { category, pattern } of TEXTUAL_PATTERNS) {\n    if (pattern.test(bounded)) {\n      return category\n    }\n  }\n  return undefined\n}\n\n/**\n * Total classification of layered failure evidence. Never throws and always\n * returns a category: any evidence shape outside the documented vocabularies\n * classifies as `unknown` via the `none` layer, deferring to OpenCode's\n * native failure handling (ADP-009, ADP-012).\n */\nexport function classifyFailure(evidence: ErrorEvidence): FailureClassification {\n  // Layer 0: interruption evidence. Interruptions are host decisions, not\n  // provider failures; a user cancellation is final (ADP-010).\n  if (evidence.interrupted === \"user\") {\n    return classification(\"user_cancelled\", \"interruption\", true, undefined)\n  }\n  if (evidence.interrupted !== undefined) {\n    return classification(\"unknown\", \"interruption\", true, undefined)\n  }\n\n  // Layer 1: structured OpenCode metadata.\n  const structured = evidence.structured\n  const structuredRetryAfterMs = isNonNegativeInteger(structured?.retryAfterMs)\n    ? structured.retryAfterMs\n    : undefined\n  if (structured !== undefined) {\n    const mapped = STRUCTURED_TYPES.get(structured.type)\n    if (mapped !== undefined) {\n      return classification(mapped, \"structured\", true, structuredRetryAfterMs)\n    }\n    // Unmapped tag: fall through so HTTP semantics can refine the category.\n  }\n\n  // Layer 2: HTTP status (+ standard headers for the 429 refinement).\n  const headers = lowercasedHeaders(evidence.headers)\n  if (isHttpStatus(evidence.status)) {\n    const category = classifyStatus(evidence.status, headers)\n    if (category !== undefined) {\n      return classification(\n        category,\n        \"status\",\n        true,\n        structuredRetryAfterMs ?? retryAfterHeaderMs(headers),\n      )\n    }\n  }\n\n  // Layer 3: standard headers alone (Retry-After without a decisive status).\n  const headerRetryAfterMs = retryAfterHeaderMs(headers)\n  if (headerRetryAfterMs !== undefined) {\n    return classification(\"rate_limited\", \"headers\", false, headerRetryAfterMs)\n  }\n\n  // Layer 4: documented provider-specific metadata, normalized by our own\n  // adapters after validation (T-15).\n  if (evidence.providerMetadata?.quotaExhausted === true) {\n    return classification(\"quota_exhausted\", \"provider-metadata\", true, undefined)\n  }\n  if (evidence.providerMetadata?.overloaded === true) {\n    return classification(\"overload\", \"provider-metadata\", true, structuredRetryAfterMs)\n  }\n\n  // Layer 5: bounded textual classification, always non-definitive.\n  const text = evidence.text\n  if (text !== undefined) {\n    const category = classifyText(text)\n    if (category !== undefined) {\n      return classification(category, \"textual\", false, structuredRetryAfterMs)\n    }\n  }\n\n  return classification(\"unknown\", \"none\", false, undefined)\n}\n"]}
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../../src/health/classifier/classify.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAG,CAAA;AAEtB,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,oBAAoB,GACxB,gJAAgJ,CAAA;AAElJ;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAEjB;IACF,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACzD,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE;IAC7D,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACnD,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACrD,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC3D,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC5D,gBAAgB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC/D,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC7D,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC7D,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;CACvD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAA0B;IACxD,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACrC,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAClC,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACvC,CAAC,uBAAuB,EAAE,eAAe,CAAC;IAC1C,CAAC,yBAAyB,EAAE,QAAQ,CAAC;CACtC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAGhB;IACJ;QACE,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EACL,+HAA+H;KAClI;IACD;QACE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,sDAAsD;QACtD,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,mEAAmE;QACnE,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EACL,wJAAwJ;KAC3J;IACD,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE;IACrD,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACxF;QACE,QAAQ,EAAE,cAAc;QACxB,OAAO,EACL,mGAAmG;KACtG;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,QAAQ,EAAE,gBAAgB;QAC1B,OAAO,EACL,wFAAwF;KAC3F;IACD,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC1E,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,EAAE,kDAAkD,EAAE;CAC5F,CAAA;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,CAAA;AACjG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9C,SAAS,mBAAmB,CAAC,YAAgC;IAC3D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAqD;IAErD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAoC;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAoC;IAChE,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7C,YAAY,GAAG,IAAI,CAAA;YACnB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB,EAAE,YAAgC;IAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;IACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,QAAyB,EACzB,KAAqC,EACrC,UAAmB,EACnB,YAAgC,EAChC,UAAuB;IAEvB,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,OAAO;QACL,QAAQ;QACR,KAAK;QACL,UAAU;QACV,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC1C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAc,EACd,OAAoC;IAEpC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB;IACrD,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,cAAc,CAAC,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACnE,CAAC;IAED,yCAAyC;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACtC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3E,CAAC,CAAC,UAAU,CAAC,YAAY;QACzB,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;QAC3E,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,cAAc,CACnB,QAAQ,EACR,QAAQ,EACR,IAAI,EACJ,sBAAsB,IAAI,kBAAkB,CAAC,OAAO,CAAC,CACtD,CAAA;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;IAC7E,CAAC;IAED,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,QAAQ,CAAC,gBAAgB,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACvD,OAAO,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,cAAc,CAAC,UAAU,EAAE,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;IACtF,CAAC;IAED,kEAAkE;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,UAAU,GACd,QAAQ,KAAK,iBAAiB,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpF,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,SAAS,CAAA;YACf,OAAO,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;AAC5D,CAAC","sourcesContent":["import type { ErrorEvidence, FailureCategory, FailureClassification, RetryAdvice } from \"./types.js\"\n\n/**\n * Text fed to the textual last-resort layer is truncated to this bound before\n * matching, so adversarial or enormous error bodies cannot dominate\n * classification cost or smuggle patterns in late bytes (ADP-008).\n */\nconst TEXT_BOUND = 512\n\n// These messages describe the subscription's shared allowance or balance,\n// unlike a generic quota error or a named model-family limit (ADP-007).\nconst SHARED_QUOTA_PATTERN =\n  /\\byou['’]ve hit your (?:session|usage|weekly) limit(?=\\s*(?:$|[·.,;(:]|resets?\\b))|\\b(?:out of credits|insufficient credits|credit balance)\\b/i\n\n/**\n * Retry/failover policy per category (ADP-010, ADP-011).\n *\n * - Infrastructure failures (rate limiting, quota, outage, overload, timeout)\n *   are failover-eligible: horizontal recovery within the tier is exactly\n *   their remedy.\n * - Permanent configuration failures (auth, invalid model, content policy)\n *   and context overflow never retry and never failover: retrying the same\n *   request cannot help and switching resources would reproduce the failure.\n * - User cancellation is final: no retry, no failover (ADP-010).\n * - Unknown failures defer to OpenCode's native handling.\n */\nconst CATEGORY_POLICY: Readonly<\n  Record<FailureCategory, { retryable: boolean; failoverEligible: boolean }>\n> = {\n  rate_limited: { retryable: true, failoverEligible: true },\n  quota_exhausted: { retryable: false, failoverEligible: true },\n  outage: { retryable: true, failoverEligible: true },\n  overload: { retryable: true, failoverEligible: true },\n  timeout: { retryable: true, failoverEligible: true },\n  auth_failure: { retryable: false, failoverEligible: false },\n  invalid_model: { retryable: false, failoverEligible: false },\n  context_overflow: { retryable: false, failoverEligible: false },\n  content_policy: { retryable: false, failoverEligible: false },\n  user_cancelled: { retryable: false, failoverEligible: false },\n  unknown: { retryable: false, failoverEligible: false },\n}\n\n/**\n * Error tags from the documented @opencode/protocol vocabulary that map\n * directly to a failure category. Tags absent here (`ProviderRequestError`,\n * `UnknownError`, anything unrecognized) are structured but not\n * category-specific: they never guess, and classification falls through to\n * the refining layers.\n */\nconst STRUCTURED_TYPES = new Map<string, FailureCategory>([\n  [\"UnauthorizedError\", \"auth_failure\"],\n  [\"ForbiddenError\", \"auth_failure\"],\n  [\"ModelNotFoundError\", \"invalid_model\"],\n  [\"UnsupportedModelError\", \"invalid_model\"],\n  [\"ServiceUnavailableError\", \"outage\"],\n])\n\n/**\n * Bounded textual patterns, last resort only (ADP-008). Ordered most\n * specific first; the first match wins. These encode provider error-message\n * conventions documented by the research phase, not a general-purpose\n * keyword classifier.\n */\nconst TEXTUAL_PATTERNS: readonly {\n  readonly category: FailureCategory\n  readonly pattern: RegExp\n}[] = [\n  {\n    category: \"context_overflow\",\n    pattern:\n      /context (length|window)|maximum context|input length exceeds|prompt is too long|too many (input )?tokens|exceeds the maximum/i,\n  },\n  {\n    // Subscription limits (\"You've hit your session/usage limit\") are quota\n    // exhaustion with a provider-side reset window; the reset time in the\n    // text is not parsed (the classifier has no clock) — the health layer's\n    // default quota window bounds the quarantine instead.\n    // Sibling fallback plugins' issue trackers document the real-world\n    // phrasings that missed curated whitelists (oh-my-openagent #2393/#5815,\n    // lichter's 429 lesson): snake-cased limits, \"usage exceeded\" without\n    // \"limit\", credit exhaustion without \"balance\". Qualifiers stay required\n    // so \"token limit reached\" (context overflow) never matches quota.\n    category: \"quota_exhausted\",\n    pattern:\n      /\\bquota\\b|credit balance|(?:session|usage|free usage|message|plan|monthly|weekly|daily)[ _-]?limit|usage exceeded|out of credits|insufficient credits/i,\n  },\n  { category: \"rate_limited\", pattern: /rate ?limit/i },\n  { category: \"timeout\", pattern: /\\btimeout\\b|timed? ?out|deadline exceeded|etimedout/i },\n  {\n    category: \"auth_failure\",\n    pattern:\n      /unauthorized|invalid (api|access) key|api key (expired|invalid)|authentication|permission denied/i,\n  },\n  {\n    category: \"invalid_model\",\n    pattern: /model.{0,30}(does not exist|not found)|invalid model|unknown model|no such model/i,\n  },\n  {\n    category: \"content_policy\",\n    pattern:\n      /content (management )?(policy|filter)|safety system|violates?.{0,32}policy|flagged as/i,\n  },\n  { category: \"overload\", pattern: /overloaded|over capacity|high demand/i },\n  { category: \"user_cancelled\", pattern: /cancel+(l)?ed|aborted by (the )?user|user abort/i },\n]\n\nfunction isHttpStatus(status: number | undefined): status is number {\n  return typeof status === \"number\" && Number.isInteger(status) && status >= 100 && status <= 599\n}\n\n/**\n * Upper bound on a provider-claimed retry delay. `Retry-After` and structured\n * retry metadata are untrusted provider data: a hostile or misconfigured\n * value (\"999999999\" seconds) must not convert one response into a\n * near-permanent resource blacklist. The host's own retry scheduling waits\n * out the raw header verbatim — this bound only concerns the health window\n * the supervisor derives from the classification (ADP-011 boundedness).\n */\nconst MAX_RETRY_AFTER_MS = 24 * 60 * 60 * 1000\n\nfunction boundedRetryAfterMs(retryAfterMs: number | undefined): number | undefined {\n  if (retryAfterMs === undefined) {\n    return undefined\n  }\n  return Math.min(retryAfterMs, MAX_RETRY_AFTER_MS)\n}\n\nfunction isNonNegativeInteger(value: number | undefined): value is number {\n  return typeof value === \"number\" && Number.isInteger(value) && value >= 0\n}\n\nfunction lowercasedHeaders(\n  headers: Readonly<Record<string, string>> | undefined,\n): ReadonlyMap<string, string> {\n  const lowered = new Map<string, string>()\n  if (headers === undefined) {\n    return lowered\n  }\n  for (const [name, value] of Object.entries(headers)) {\n    lowered.set(name.toLowerCase(), value)\n  }\n  return lowered\n}\n\n/**\n * Parses a `Retry-After` header into milliseconds. Only the integer-seconds\n * form is accepted: the HTTP-date form requires a clock, which the classifier\n * deliberately does not have (reset-time handling belongs to the capacity\n * boundary, T-05/T-15).\n */\nfunction retryAfterHeaderMs(headers: ReadonlyMap<string, string>): number | undefined {\n  const raw = headers.get(\"retry-after\")\n  if (raw === undefined || !/^\\d+$/.test(raw)) {\n    return undefined\n  }\n  return Number(raw) * 1000\n}\n\n/**\n * Standard rate-limit headers (case-insensitive `x-ratelimit-remaining*`).\n * All-zero remaining capacity indicates a fixed-window quota exhaustion\n * rather than a short burst limit.\n */\nfunction fixedWindowExhausted(headers: ReadonlyMap<string, string>): boolean {\n  let sawRemaining = false\n  for (const [name, value] of headers) {\n    if (name.startsWith(\"x-ratelimit-remaining\")) {\n      sawRemaining = true\n      if (value !== \"0\") {\n        return false\n      }\n    }\n  }\n  return sawRemaining\n}\n\nfunction retryAdvice(category: FailureCategory, retryAfterMs: number | undefined): RetryAdvice {\n  const policy = CATEGORY_POLICY[category]\n  const bounded = boundedRetryAfterMs(retryAfterMs)\n  if (bounded === undefined) {\n    return { retryable: policy.retryable }\n  }\n  return { retryable: policy.retryable, retryAfterMs: bounded }\n}\n\nfunction classification(\n  category: FailureCategory,\n  layer: FailureClassification[\"layer\"],\n  definitive: boolean,\n  retryAfterMs: number | undefined,\n  quotaScope?: \"provider\",\n): FailureClassification {\n  const policy = CATEGORY_POLICY[category]\n  return {\n    category,\n    layer,\n    definitive,\n    retry: retryAdvice(category, retryAfterMs),\n    failoverEligible: policy.failoverEligible,\n    ...(quotaScope !== undefined ? { quotaScope } : {}),\n  }\n}\n\n/**\n * Classifies an HTTP status. 429 consults the standard rate-limit headers in\n * the same step: status plus documented standard headers are one HTTP\n * semantics layer, and the quota refinement is more specific evidence than a\n * bare 429, so it cannot weaken the ADP-008 precedence.\n */\nfunction classifyStatus(\n  status: number,\n  headers: ReadonlyMap<string, string>,\n): FailureCategory | undefined {\n  if (status === 429) {\n    return fixedWindowExhausted(headers) ? \"quota_exhausted\" : \"rate_limited\"\n  }\n  if (status === 401 || status === 403) {\n    return \"auth_failure\"\n  }\n  if (status === 408) {\n    return \"timeout\"\n  }\n  if (status === 413) {\n    return \"context_overflow\"\n  }\n  if (status === 502 || status === 503 || status === 504) {\n    return \"outage\"\n  }\n  return undefined\n}\n\nfunction classifyText(text: string): FailureCategory | undefined {\n  const bounded = text.length > TEXT_BOUND ? text.slice(0, TEXT_BOUND) : text\n  for (const { category, pattern } of TEXTUAL_PATTERNS) {\n    if (pattern.test(bounded)) {\n      return category\n    }\n  }\n  return undefined\n}\n\n/**\n * Total classification of layered failure evidence. Never throws and always\n * returns a category: any evidence shape outside the documented vocabularies\n * classifies as `unknown` via the `none` layer, deferring to OpenCode's\n * native failure handling (ADP-009, ADP-012).\n */\nexport function classifyFailure(evidence: ErrorEvidence): FailureClassification {\n  // Layer 0: interruption evidence. Interruptions are host decisions, not\n  // provider failures; a user cancellation is final (ADP-010).\n  if (evidence.interrupted === \"user\") {\n    return classification(\"user_cancelled\", \"interruption\", true, undefined)\n  }\n  if (evidence.interrupted !== undefined) {\n    return classification(\"unknown\", \"interruption\", true, undefined)\n  }\n\n  // Layer 1: structured OpenCode metadata.\n  const structured = evidence.structured\n  const structuredRetryAfterMs = isNonNegativeInteger(structured?.retryAfterMs)\n    ? structured.retryAfterMs\n    : undefined\n  if (structured !== undefined) {\n    const mapped = STRUCTURED_TYPES.get(structured.type)\n    if (mapped !== undefined) {\n      return classification(mapped, \"structured\", true, structuredRetryAfterMs)\n    }\n    // Unmapped tag: fall through so HTTP semantics can refine the category.\n  }\n\n  // Layer 2: HTTP status (+ standard headers for the 429 refinement).\n  const headers = lowercasedHeaders(evidence.headers)\n  if (isHttpStatus(evidence.status)) {\n    const category = classifyStatus(evidence.status, headers)\n    if (category !== undefined) {\n      return classification(\n        category,\n        \"status\",\n        true,\n        structuredRetryAfterMs ?? retryAfterHeaderMs(headers),\n      )\n    }\n  }\n\n  // Layer 3: standard headers alone (Retry-After without a decisive status).\n  const headerRetryAfterMs = retryAfterHeaderMs(headers)\n  if (headerRetryAfterMs !== undefined) {\n    return classification(\"rate_limited\", \"headers\", false, headerRetryAfterMs)\n  }\n\n  // Layer 4: documented provider-specific metadata, normalized by our own\n  // adapters after validation (T-15).\n  if (evidence.providerMetadata?.quotaExhausted === true) {\n    return classification(\"quota_exhausted\", \"provider-metadata\", true, undefined)\n  }\n  if (evidence.providerMetadata?.overloaded === true) {\n    return classification(\"overload\", \"provider-metadata\", true, structuredRetryAfterMs)\n  }\n\n  // Layer 5: bounded textual classification, always non-definitive.\n  const text = evidence.text\n  if (text !== undefined) {\n    const category = classifyText(text)\n    if (category !== undefined) {\n      const quotaScope =\n        category === \"quota_exhausted\" && SHARED_QUOTA_PATTERN.test(text.slice(0, TEXT_BOUND))\n          ? \"provider\"\n          : undefined\n      return classification(category, \"textual\", false, structuredRetryAfterMs, quotaScope)\n    }\n  }\n\n  return classification(\"unknown\", \"none\", false, undefined)\n}\n"]}

package/dist/health/classifier/types.d.ts

@@ -59,6 +59,8 @@ export interface RetryAdvice {
 export interface FailureClassification {
     readonly category: FailureCategory;
     readonly layer: EvidenceLayer;
+    /** Explicit shared subscription/balance evidence; absent means keep the model scope. */
+    readonly quotaScope?: "provider";
     /**
      * True when the evidence conclusively identifies the failure. Textual
      * classifications are always non-definitive; scheduling treats

package/dist/health/classifier/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/health/classifier/types.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,SAAS;IACT,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;CAC2B,CAAA;AAItC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;CAC8B,CAAA","sourcesContent":["/**\n * Failure classification types (ADP-008, ADP-009).\n *\n * The classifier consumes a layered evidence record assembled by the OpenCode\n * adapter. Evidence layers exist so classification can honor the ADP-008\n * precedence chain: structured metadata beats HTTP status beats standard\n * headers beats documented provider-specific metadata beats bounded text.\n */\nimport type { InterruptReason } from \"../../core/work-unit/interruption.js\"\n\nexport const FAILURE_CATEGORIES = [\n  \"rate_limited\",\n  \"quota_exhausted\",\n  \"outage\",\n  \"overload\",\n  \"timeout\",\n  \"auth_failure\",\n  \"invalid_model\",\n  \"context_overflow\",\n  \"content_policy\",\n  \"user_cancelled\",\n  \"unknown\",\n] as const satisfies readonly string[]\n\nexport type FailureCategory = (typeof FAILURE_CATEGORIES)[number]\n\n/**\n * Where the winning classification came from. Exposed so receipts can show\n * why a decision was made and so tests can pin the precedence chain.\n */\nexport const EVIDENCE_LAYERS = [\n  \"interruption\",\n  \"structured\",\n  \"status\",\n  \"headers\",\n  \"provider-metadata\",\n  \"textual\",\n  \"none\",\n] as const satisfies readonly string[]\n\nexport type EvidenceLayer = (typeof EVIDENCE_LAYERS)[number]\n\n/**\n * Structured OpenCode evidence (`Session.StructuredError`): a server-assigned\n * error tag plus, when the provider sent it, a retry delay OpenCode already\n * parsed from `Retry-After`. `type` is a free-form string on the wire, so the\n * classifier only interprets types from the documented @opencode/protocol\n * vocabulary and falls through to lower layers for anything unmapped instead\n * of guessing.\n */\nexport interface StructuredSignal {\n  readonly type: string\n  readonly retryAfterMs?: number | undefined\n}\n\n/**\n * Documented provider-specific metadata, already normalized by our own\n * adapters (e.g. the Codex capacity sensor validates `x-codex-*` headers\n * before producing these). The classifier never reads raw provider headers\n * itself.\n */\nexport interface ProviderMetadata {\n  readonly quotaExhausted?: boolean | undefined\n  readonly overloaded?: boolean | undefined\n}\n\n/**\n * Layered failure evidence. `status` is the merged HTTP status (the adapter\n * prefers the wire status seen by `http.response` over any status echoed in\n * structured metadata). `text` is the bounded concatenation of error message\n * and response body, bounded again defensively inside the classifier.\n */\nexport interface ErrorEvidence {\n  readonly interrupted?: InterruptReason | undefined\n  readonly structured?: StructuredSignal | undefined\n  readonly status?: number | undefined\n  readonly headers?: Readonly<Record<string, string>> | undefined\n  readonly providerMetadata?: ProviderMetadata | undefined\n  readonly text?: string | undefined\n}\n\n/** Advisory retry semantics; the retry policy (T-12) makes final decisions. */\nexport interface RetryAdvice {\n  readonly retryable: boolean\n  readonly retryAfterMs?: number\n}\n\nexport interface FailureClassification {\n  readonly category: FailureCategory\n  readonly layer: EvidenceLayer\n  /**\n   * True when the evidence conclusively identifies the failure. Textual\n   * classifications are always non-definitive; scheduling treats\n   * non-definitive evidence more conservatively (ADP-012).\n   */\n  readonly definitive: boolean\n  readonly retry: RetryAdvice\n  /** Horizontal recovery (switch resource within the tier) is allowed. */\n  readonly failoverEligible: boolean\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/health/classifier/types.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,SAAS;IACT,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;CAC2B,CAAA;AAItC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;CAC8B,CAAA","sourcesContent":["/**\n * Failure classification types (ADP-008, ADP-009).\n *\n * The classifier consumes a layered evidence record assembled by the OpenCode\n * adapter. Evidence layers exist so classification can honor the ADP-008\n * precedence chain: structured metadata beats HTTP status beats standard\n * headers beats documented provider-specific metadata beats bounded text.\n */\nimport type { InterruptReason } from \"../../core/work-unit/interruption.js\"\n\nexport const FAILURE_CATEGORIES = [\n  \"rate_limited\",\n  \"quota_exhausted\",\n  \"outage\",\n  \"overload\",\n  \"timeout\",\n  \"auth_failure\",\n  \"invalid_model\",\n  \"context_overflow\",\n  \"content_policy\",\n  \"user_cancelled\",\n  \"unknown\",\n] as const satisfies readonly string[]\n\nexport type FailureCategory = (typeof FAILURE_CATEGORIES)[number]\n\n/**\n * Where the winning classification came from. Exposed so receipts can show\n * why a decision was made and so tests can pin the precedence chain.\n */\nexport const EVIDENCE_LAYERS = [\n  \"interruption\",\n  \"structured\",\n  \"status\",\n  \"headers\",\n  \"provider-metadata\",\n  \"textual\",\n  \"none\",\n] as const satisfies readonly string[]\n\nexport type EvidenceLayer = (typeof EVIDENCE_LAYERS)[number]\n\n/**\n * Structured OpenCode evidence (`Session.StructuredError`): a server-assigned\n * error tag plus, when the provider sent it, a retry delay OpenCode already\n * parsed from `Retry-After`. `type` is a free-form string on the wire, so the\n * classifier only interprets types from the documented @opencode/protocol\n * vocabulary and falls through to lower layers for anything unmapped instead\n * of guessing.\n */\nexport interface StructuredSignal {\n  readonly type: string\n  readonly retryAfterMs?: number | undefined\n}\n\n/**\n * Documented provider-specific metadata, already normalized by our own\n * adapters (e.g. the Codex capacity sensor validates `x-codex-*` headers\n * before producing these). The classifier never reads raw provider headers\n * itself.\n */\nexport interface ProviderMetadata {\n  readonly quotaExhausted?: boolean | undefined\n  readonly overloaded?: boolean | undefined\n}\n\n/**\n * Layered failure evidence. `status` is the merged HTTP status (the adapter\n * prefers the wire status seen by `http.response` over any status echoed in\n * structured metadata). `text` is the bounded concatenation of error message\n * and response body, bounded again defensively inside the classifier.\n */\nexport interface ErrorEvidence {\n  readonly interrupted?: InterruptReason | undefined\n  readonly structured?: StructuredSignal | undefined\n  readonly status?: number | undefined\n  readonly headers?: Readonly<Record<string, string>> | undefined\n  readonly providerMetadata?: ProviderMetadata | undefined\n  readonly text?: string | undefined\n}\n\n/** Advisory retry semantics; the retry policy (T-12) makes final decisions. */\nexport interface RetryAdvice {\n  readonly retryable: boolean\n  readonly retryAfterMs?: number\n}\n\nexport interface FailureClassification {\n  readonly category: FailureCategory\n  readonly layer: EvidenceLayer\n  /** Explicit shared subscription/balance evidence; absent means keep the model scope. */\n  readonly quotaScope?: \"provider\"\n  /**\n   * True when the evidence conclusively identifies the failure. Textual\n   * classifications are always non-definitive; scheduling treats\n   * non-definitive evidence more conservatively (ADP-012).\n   */\n  readonly definitive: boolean\n  readonly retry: RetryAdvice\n  /** Horizontal recovery (switch resource within the tier) is allowed. */\n  readonly failoverEligible: boolean\n}\n"]}

package/dist/supervisor/supervisor.js

@@ -152,6 +152,8 @@ export class Supervisor {
      * the stale decision instead of acting after it.
      */
     #recoveryPending = new Set();
+    /** Snapshot-sized budget shared by a task's terminal quota continuations. */
+    #quotaRecoveriesRemaining = new Map();
     /** Interruptions observed while a recovery was pending on the session. */
     #recoveryInterrupted = new Set();
     /**
@@ -346,6 +348,24 @@ export class Supervisor {
     #manuallySelected(sessionID, settings) {
         return settings.pin === null && this.#manualSelections.has(sessionID);
     }
+    /**
+     * The manual-pick suppression actually applied at an admission. It yields
+     * when the picked model is health-blocked: keeping the session on a
+     * quarantined resource does not honor the pick — the configured fallback
+     * takes over instead (the pick is re-honored only if the user picks again).
+     * Uses the non-mutating evaluation, never a probe admission.
+     */
+    #manualSuppressionHolds(sessionID, settings) {
+        if (!this.#manuallySelected(sessionID, settings))
+            return false;
+        const current = this.#tracker.lastModel(sessionID)?.model;
+        if (current === undefined)
+            return true;
+        if (this.#health.evaluate(refKey(current)).kind !== "blocked")
+            return true;
+        this.#manualSelections.delete(sessionID);
+        return false;
+    }
     /**
      * Handle one `retry` hook invocation. On a veto this mutates
      * `input.decision` to `{ retry: false }`; otherwise the decision is left
@@ -584,11 +604,17 @@ export class Supervisor {
             this.#promptAdmission.set(sessionID, tier !== undefined ? { tier } : {});
             return;
         }
+        // Prompt hooks also admit steering messages into an active episode. They
+        // are not routing boundaries: switching here interrupts productive work
+        // and resets its recovery budget before the host consumes the steering.
+        if (this.#tracker.active(sessionID) !== undefined)
+            return;
         // A fresh user prompt cancels any stale continuation intent and marker:
         // this admission re-routes from scratch.
         this.#continuationTiers.delete(sessionID);
         this.#promptAdmission.delete(sessionID);
         this.#escalations.delete(sessionID);
+        this.#quotaRecoveriesRemaining.delete(sessionID);
         // A pending probe ticket from an earlier prompt admission (or a failed
         // recovery) can only be carried by the unit the ORIGINAL prompt opens;
         // a fresh admission means that episode never ran, so the ticket is
@@ -598,10 +624,11 @@ export class Supervisor {
             this.#sessionProbeTickets.delete(sessionID);
             this.#health.releaseProbe(stale);
         }
-        if (this.#manuallySelected(sessionID, settings)) {
-            // ADP-028: the user's own model pick stands. Recording the defer (no
-            // switch, no marker) leaves OpenCode's choice — the picked model — in
-            // place; execution-started will skip routing the same way.
+        if (this.#manualSuppressionHolds(sessionID, settings)) {
+            // ADP-028: the user's own model pick stands (yielded to health if the
+            // picked resource is quarantined). Recording the defer (no switch, no
+            // marker) leaves OpenCode's choice — the picked model — in place;
+            // execution-started will skip routing the same way.
             await this.#recordReceipt({
                 sessionID,
                 decision: { kind: "defer", reason: "routing-defer", detail: "manual-selection" },
@@ -778,8 +805,9 @@ export class Supervisor {
         return { routing, decision, ...(probeTicket !== undefined ? { probeTicket } : {}) };
     }
     async #routeAdmission(unit, settings, mode) {
-        if (this.#manuallySelected(unit.sessionID, settings)) {
-            // ADP-028: the session runs on the user's own pick — no re-route.
+        if (this.#manualSuppressionHolds(unit.sessionID, settings)) {
+            // ADP-028: the session runs on the user's own pick (yielded to health
+            // if the picked resource is quarantined) — no re-route.
             await this.#recordReceipt({
                 sessionID: unit.sessionID,
                 unitID: unit.id,
@@ -901,8 +929,71 @@ export class Supervisor {
                 this.#reportProbeOutcome(probeTicket, { success: false, category: classification.category });
             }
         }
+        if (unit !== undefined &&
+            model !== undefined &&
+            classification.category === "quota_exhausted") {
+            await this.#recoverTerminalQuota(unit, admissionTier, settings);
+            return;
+        }
         await this.#escalateOnFailure(report, unitID, model, classification, admissionTier, escalationUsed, toolEvidence, settings);
     }
+    async #recoverTerminalQuota(unit, requiredTier, settings) {
+        const sessionID = unit.sessionID;
+        // A retry veto already owns the continuation; its terminal echo must not
+        // start another. OBSERVE computes the same admission without applying it.
+        const mode = this.#modeFor(sessionID, settings);
+        if (mode === "off" ||
+            this.#recoveryPending.has(sessionID) ||
+            this.#continuationTiers.has(sessionID) ||
+            this.#continuationPending.has(sessionID))
+            return;
+        if (mode === "active")
+            this.#manualSuppressionHolds(sessionID, settings);
+        const { routing, decision, probeTicket } = await this.#admit(settings, sessionID, requiredTier);
+        const tier = routingTier(routing);
+        if (mode === "observe") {
+            if (probeTicket !== undefined)
+                this.#health.releaseProbe(probeTicket);
+            await this.#recordReceipt({ sessionID, tier, decision: schedulerForMode(decision, mode) });
+            return;
+        }
+        // Quota windows can expire while session.wait is pending. Snapshot the
+        // configured ladder length once so even those recoveries cannot loop.
+        const remaining = this.#quotaRecoveriesRemaining.get(sessionID) ??
+            (tier === undefined ? 0 : settings.tiers[tier].length);
+        if (decision.kind === "apply" && remaining === 0) {
+            if (probeTicket !== undefined)
+                this.#health.releaseProbe(probeTicket);
+            return;
+        }
+        await this.#recordReceipt({ sessionID, tier, decision });
+        if (decision.kind !== "apply") {
+            if (decision.kind === "park" && tier !== undefined) {
+                await this.#parked.park({
+                    id: unit.id,
+                    sessionID,
+                    tier,
+                    reason: "all-blocked",
+                    detail: "quota exhausted",
+                    parkedAt: this.#options.clock(),
+                });
+            }
+            return;
+        }
+        this.#quotaRecoveriesRemaining.set(sessionID, remaining - 1);
+        if (probeTicket !== undefined)
+            this.#sessionProbeTickets.set(sessionID, probeTicket);
+        // The host rejected this attempt without invoking its retry hook. Continue
+        // from durable session state rather than waiting for another user message.
+        void this.#ownRecovery(sessionID, decision.model, tier, () => this.#modeFor(sessionID, this.#settings.get()) === "active").catch((error) => {
+            if (probeTicket !== undefined && this.#sessionProbeTickets.get(sessionID) === probeTicket) {
+                this.#sessionProbeTickets.delete(sessionID);
+                this.#health.releaseProbe(probeTicket);
+            }
+            if (!(error instanceof RecoveryAbortedError))
+                logFailOpen("quota-recovery", error);
+        });
+    }
     /**
      * Escalation targets must be usable: the scheduler contract hands
      * planEscalation "already gated" resources, so the wiring filters the next
@@ -1395,6 +1486,7 @@ export class Supervisor {
                 this.#promptAdmission.delete(sessionID);
                 this.#continuationPending.delete(sessionID);
                 this.#escalations.delete(sessionID);
+                this.#quotaRecoveriesRemaining.delete(sessionID);
                 if (this.#sessionModes.get(sessionID) !== null) {
                     try {
                         await this.#sessionModes.set(sessionID, null);
@@ -1614,11 +1706,22 @@ function refKey(ref) {
         ...(variant !== undefined ? { variantID: variant } : {}),
     };
 }
+/** Quota survives variantless host resolution; only shared-limit evidence blocks siblings. */
+function failureKey(key, classification) {
+    if (classification.quotaScope === "provider") {
+        // Host model refs expose the configured provider, not a credential/account id.
+        return { providerID: key.providerID };
+    }
+    if (classification.category === "quota_exhausted" && key.variantID !== undefined) {
+        return { providerID: key.providerID, modelID: key.modelID };
+    }
+    return key;
+}
 /** Health failure event from a classification (bounded structured evidence). */
 function failureEvent(key, classification) {
     return {
         kind: "failure",
-        key,
+        key: failureKey(key, classification),
         category: classification.category,
         definitive: classification.definitive,
         ...(classification.retry.retryAfterMs !== undefined