@mlx-node/server 0.0.9 → 0.0.12

package/dist/endpoints/messages.js

@@ -31,7 +31,7 @@
  *   * **Non-paged path** (Qwen3.5 dense + MoE — default-off pending a
  *     perf decision; the Qianfan-OCR VLM — no adapter wired). Each
  *     request looks up the warm slot via
- *     `SessionRegistry.getOrCreateWarmAny(requestedSystem)`. On a
+ *     `SessionRegistry.getOrCreateWarmAny(requestedSystem, cacheSalt)`. On a
  *     HIT we keep the underlying native KV cache alive
  *     (`resetPreservingNativeCacheForWarmReuse` wipes only JS-side
  *     session state) so the native `verify_cache_prefix_direct` can
@@ -62,9 +62,10 @@ import { sendAnthropicBadRequest, sendAnthropicInternalError, sendAnthropicNotFo
 import { canonicalizeSystemForCacheKey, mapAnthropicRequest } from '../mappers/anthropic-request.js';
 import { buildAnthropicResponse, buildContentBlockDelta, buildContentBlockStart, buildContentBlockStop, buildMessageDelta, buildMessageStartEvent, buildMessageStop, containsToolCallMarkup, internalToolCallIdToAnthropic, recoverSuppressedToolCallText, mapStopReason, } from '../mappers/anthropic-response.js';
 import { genId } from '../mappers/response.js';
+import { ModelLoadQueueFullError, } from '../model-work-coordinator.js';
 import { QueueFullError } from '../session-registry.js';
 import { StopSequenceBuffer } from '../stop-sequence-buffer.js';
-import { beginSSE, endSSE, writeSSEEvent } from '../streaming.js';
+import { awaitDrainOrClose, beginSSE, endSSE, trackSSEClientAbort, writeSSEEvent as writeRawSSEEvent, } from '../streaming.js';
 import { longestSuffixPrefixOverlap } from '../text-recovery.js';
 import { resolveServerTuningForUsage } from '../timing.js';
 import { ToolCallTagBuffer } from '../tool-call-buffer.js';
@@ -82,8 +83,16 @@ import { MAX_OUTPUT_TOKENS, validateAndCanonicalizeHistoryToolOrder } from './re
  */
 const MESSAGES_WARM_SLOT_ID = '__msg_warm__';
 const CLAUDE_CODE_TITLE_MAX_TOKENS = 128;
-function withAdmissionControlledInference(sessionReg, modelWorkCoordinator, fn) {
-    return sessionReg.withExclusive(() => (modelWorkCoordinator ? modelWorkCoordinator.withInference(fn) : fn()));
+function withAdmissionControlledInference(sessionReg, modelWorkCoordinator, 
+// Pre-dispatch permit handed off ATOMICALLY as this call's admission
+// (the selected admission lane consumes it instead of charging
+// `queuedCount` a second time). See `beginPreDispatchAdmission`. Placed BEFORE `fn`
+// so call sites keep the trailing-closure layout.
+permit, fn) {
+    const run = () => (modelWorkCoordinator ? modelWorkCoordinator.withInference(fn) : fn());
+    return sessionReg.concurrentAdmissionLimit > 1
+        ? sessionReg.withAdmission(run, permit)
+        : sessionReg.withExclusive(run, permit);
 }
 function requestAllowsToolUse(body) {
     return Array.isArray(body.tools) && body.tools.length > 0;
@@ -197,14 +206,21 @@ async function handleNonStreaming(res, result, body, visibility, stopSequences,
     // by default, matching how `cachedTokens` is treated through
     // `buildAnthropicResponse`.
     const response = buildAnthropicResponse(responseResult, body, messageId, result.performance, requestAllowsToolUse(body), serverTiming, matchedStopSequence);
-    // Native `chatSession*` has no AbortSignal surface yet, so a client that
-    // disconnects mid-decode still burns every remaining token under the
-    // per-model mutex. Disconnect handling is delegated to `endJson`'s
-    // pre-entry destroyed check, which rejects synchronously after `responseMode`
-    // has been committed to 'json' — the outer catch then destroys the socket.
+    // The request AbortSignal reaches the normal session method, whose wrapper
+    // maps it to native cancellation at the next model safepoint. `endJson` keeps
+    // the final pre-entry destroyed check for the transport race after decode.
     await endJson(res, JSON.stringify(response), visibility);
 }
 async function handleStreamingNative(res, chatStream, body, wasCommitted, httpReq, visibility, emitReasoning, stopSequences, serverTiming) {
+    const abort = trackSSEClientAbort(res, httpReq);
+    try {
+        return await handleStreamingNativeWithAbort(res, chatStream, body, wasCommitted, abort, visibility, emitReasoning, stopSequences, serverTiming);
+    }
+    finally {
+        abort.dispose();
+    }
+}
+async function handleStreamingNativeWithAbort(res, chatStream, body, wasCommitted, abort, visibility, emitReasoning, stopSequences, serverTiming) {
     const messageId = genId('msg_');
     // `runSessionStreaming` completed the exact token/capacity preflight before
     // handing us this iterator. Commit SSE immediately instead of entering the
@@ -214,7 +230,24 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
     // Commit SSE wire format now so any throw before the terminal event routes
     // to the streaming error epilogue instead of corrupting the JSON path.
     markSSEMode(visibility);
-    writeSSEEvent(res, 'message_start', buildMessageStartEvent(body, messageId, 0));
+    // A native event can expand into several SSE frames. Preserve the first
+    // false write until the loop awaits it, and install the drain/close/error
+    // listeners immediately so an intervening iterator fetch cannot miss drain.
+    let pendingDrain = null;
+    const writeSSEEvent = (response, eventType, data) => {
+        const ok = writeRawSSEEvent(response, eventType, data);
+        if (!ok && pendingDrain === null) {
+            pendingDrain = awaitDrainOrClose(response, { onTimeout: () => abort.markAborted() });
+        }
+    };
+    const drainPending = async () => {
+        const drain = pendingDrain;
+        if (drain === null)
+            return;
+        await drain;
+        if (pendingDrain === drain)
+            pendingDrain = null;
+    };
     let contentBlockIndex = 0;
     let hasEmittedThinking = false;
     let hasEmittedText = false;
@@ -279,38 +312,17 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
     let terminalErrorMessage = null;
     const allowToolUse = requestAllowsToolUse(body);
     let suppressedToolCalls = false;
-    // `thrownError` sticks on a generator throw; `clientAborted` sticks on
-    // HTTP `close`/`error` on req, res, or res.socket. Either one routes the
-    // post-loop block to the failure epilogue. Native decode has no
-    // AbortSignal yet, so on a client disconnect we can only stop consuming
-    // deltas — the native decode still runs to completion under the mutex.
+    // `thrownError` sticks on a generator throw. The outer abort tracker remains
+    // armed through post-loop residual writes and the terminal flush as well as
+    // the decode loop itself.
     let thrownError = null;
-    let clientAborted = false;
-    const onClientClose = () => {
-        clientAborted = true;
-    };
-    const onClientError = (_err) => {
-        clientAborted = true;
-    };
-    const onResClose = () => {
-        clientAborted = true;
-    };
-    const onResError = (_err) => {
-        clientAborted = true;
-    };
-    const resSocketForAbort = res.socket;
-    if (httpReq) {
-        httpReq.once('close', onClientClose);
-        httpReq.once('error', onClientError);
-    }
-    res.once('close', onResClose);
-    res.once('error', onResError);
-    if (resSocketForAbort != null) {
-        resSocketForAbort.once('close', onResClose);
-    }
+    // The outer wrapper's abort listeners precede the first body write so an
+    // asynchronous socket error is authoritative before the drain wait resumes.
+    writeSSEEvent(res, 'message_start', buildMessageStartEvent(body, messageId, 0));
     try {
         for await (const event of chatStream) {
-            if (clientAborted)
+            await drainPending();
+            if (abort.aborted)
                 break;
             if (event.done) {
                 sawDone = true;
@@ -636,15 +648,7 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
         thrownError = err instanceof Error ? err : new Error(String(err));
     }
     finally {
-        if (httpReq) {
-            httpReq.off('close', onClientClose);
-            httpReq.off('error', onClientError);
-        }
-        res.off('close', onResClose);
-        res.off('error', onResError);
-        if (resSocketForAbort != null) {
-            resSocketForAbort.off('close', onResClose);
-        }
+        await drainPending();
     }
     // Success requires ALL of: sawDone, wasCommitted, no terminal error, no thrown
     // error, no client abort. `terminalErrorMessage` is set when a stream done event
@@ -653,7 +657,7 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
     // withhold `message_stop`. Every failure path emits a streaming `error` and
     // withholds `message_stop`.
     const committed = wasCommitted();
-    const successful = sawDone && committed && terminalErrorMessage == null && thrownError == null && !clientAborted;
+    const successful = sawDone && committed && terminalErrorMessage == null && thrownError == null && !abort.aborted;
     if (successful) {
         const stopReason = terminalStopReason ?? 'end_turn';
         writeSSEEvent(res, 'message_delta', buildMessageDelta(stopReason, terminalNumTokens, terminalPromptTokens, terminalCachedTokens, terminalPerformance, serverTiming, matchedStopSequence));
@@ -675,9 +679,14 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
                 // up front — non-fatal; the SSE usage field still carries the value.
             }
         }
-        await flushTerminalSSE(res, 'message_stop', buildMessageStop(), visibility);
-        endSSE(res);
-        return { ok: true, suppressedToolCalls };
+        await drainPending();
+        // The residual drain may have settled because the transport closed or
+        // errored. Never emit/adopt a success terminal from the stale snapshot.
+        if (!abort.aborted) {
+            await flushTerminalSSE(res, 'message_stop', buildMessageStop(), visibility);
+            endSSE(res);
+            return { ok: true, suppressedToolCalls };
+        }
     }
     // Close any dangling content block so the error frame lands at a clean state,
     // then emit the streaming error. Never emit `message_stop` here — pairing it
@@ -688,11 +697,12 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
     else if (hasEmittedText) {
         writeSSEEvent(res, 'content_block_stop', buildContentBlockStop(contentBlockIndex));
     }
+    await drainPending();
     let message;
     if (thrownError != null) {
         message = thrownError.message;
     }
-    else if (clientAborted) {
+    else if (abort.aborted) {
         message = 'client disconnected before the stream completed';
     }
     else if (terminalErrorMessage != null) {
@@ -710,7 +720,7 @@ async function handleStreamingNative(res, chatStream, body, wasCommitted, httpRe
     return { ok: false, suppressedToolCalls };
 }
 /** Prime a session with the full history and run a single turn. */
-async function runSessionNonStreaming(session, messages, config, resetNativeCache) {
+async function runSessionNonStreaming(session, messages, config, resetNativeCache, signal) {
     // Dual-branch reset gated by the caller's native-cache policy:
     //
     //   * Full native reset (`resetNativeCache === true`) — run a full
@@ -742,7 +752,7 @@ async function runSessionNonStreaming(session, messages, config, resetNativeCach
     }
     session.primeHistory(messages);
     const initialTurns = session.turns;
-    const result = await session.startFromHistory(config);
+    const result = await session.startFromHistory(config, { signal });
     // Mirror the streaming-side dual-gate (`streamResult.ok &&
     // outcome.wasCommitted()`) and the sibling `/v1/responses` adopt
     // gate. `ChatSession.startFromHistory` advances `turnCount`
@@ -782,6 +792,9 @@ async function runSessionStreaming(session, messages, config, signal, resetNativ
 }
 // Public handler
 export async function handleCreateMessage(res, body, registry, httpReq, idleSweeper, resolveModel, modelWorkCoordinator) {
+    if (modelWorkCoordinator) {
+        registry.setModelLoadAdmissionCoordinator(modelWorkCoordinator);
+    }
     const handlerStartedAt = Date.now();
     let serverModelResolveMs;
     // Split observability for the resolve path: a request that arrives
@@ -850,9 +863,50 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
         sendAnthropicBadRequest(res, err instanceof Error ? err.message : 'Invalid request');
         return;
     }
-    // Lazy-load hook: give the host a chance to register the requested
-    // model before we look it up. Errors bubble up to the handler's
-    // top-level catch which returns 500.
+    // Pre-dispatch admission gate (H3, host mode). Mirror of the
+    // `/v1/responses` gate — see the long-form rationale there. In host
+    // mode resident arrivals bypass the `ModelWorkCoordinator` writer bracket
+    // below and proceed toward the continuous-batching lane, but can still park
+    // in pre-lock work. Admit-or-429 (Anthropic envelope) against the same
+    // per-model budget so that work stays bounded too. Non-resident (cold-load)
+    // requests use the coordinator's bounded pre-resolution permit below
+    // because no `SessionRegistry` exists yet. The permit is RETAINED through every pre-lock
+    // await and handed to `withExclusive` at placement, which consumes it
+    // atomically as this request's admission (one budget, one token,
+    // never double-counted); it is released only on bail-out exits —
+    // explicitly on the early returns before the outer `try`, and by the
+    // outer `finally` for everything inside it (idempotent + no-op after
+    // handoff).
+    let preDispatchAdmission;
+    let modelLoadAdmission;
+    const preDispatchRegistry = registry.getSessionRegistry(body.model);
+    if (preDispatchRegistry) {
+        try {
+            preDispatchAdmission = preDispatchRegistry.beginPreDispatchAdmission();
+        }
+        catch (err) {
+            if (err instanceof QueueFullError) {
+                sendAnthropicRateLimit(res, `${err.message}. Retry after 1s.`);
+                return;
+            }
+            throw err;
+        }
+    }
+    else if (resolveModel && modelWorkCoordinator) {
+        try {
+            modelLoadAdmission = modelWorkCoordinator.beginRequestLoadAdmission(body.model);
+        }
+        catch (err) {
+            if (err instanceof ModelLoadQueueFullError) {
+                sendAnthropicRateLimit(res, `Model queue full: admission footprint ${err.admissionFootprint} (limit ${err.limit}). Retry after 1s.`);
+                return;
+            }
+            throw err;
+        }
+    }
+    // Lazy-load hook for a requested name with no resident registry: give the
+    // host a chance to register it before we look it up. Resident requests skip
+    // this writer bracket so they can reach the continuous-batching lane.
     //
     // The load is bracketed by `idleSweeper.withSuspendedDrains` so the
     // post-request drain timer armed by the PREVIOUS request's
@@ -866,7 +920,7 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
     // The wrapper handles try/finally itself and is a pass-through on
     // the disabled sweeper, so the bracket is unconditional whenever
     // a sweeper is supplied.
-    if (resolveModel) {
+    if (resolveModel && !preDispatchRegistry) {
         // A throw here (bad model path, corrupt weights, native loader failure)
         // would otherwise bubble up to the outer `createHandler` catch which
         // emits the OpenAI-shape `{ error: ... }` envelope via `sendInternalError`.
@@ -892,7 +946,8 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
                 // observability fields:
                 //  - owner driving a cold load → waitMs ≈ 0, ownMs ≈ load duration
                 //  - follower parked behind peer → waitMs ≈ peer load, ownMs ≈ 0
-                //  - already-loaded fast path  → waitMs ≈ 0, ownMs ≈ 0
+                // Resident requests bypass this block entirely and therefore omit all
+                // three load-timing fields.
                 // This matches the documented contract in `timing.ts` where
                 // `server_model_resolve_ms` excludes peer-wait time.
                 const outcome = await modelWorkCoordinator.withModelLoadInstrumented(runResolve);
@@ -906,12 +961,19 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
             }
         }
         catch (err) {
+            preDispatchAdmission?.release();
+            modelLoadAdmission?.release();
             sendAnthropicInternalError(res, err instanceof Error ? err.message : 'Failed to resolve model');
             return;
         }
     }
+    // NOTE: the permit is NOT released here. The request must stay counted
+    // through the remaining pre-lock work until `withExclusive` consumes
+    // the permit at placement. Only bail-out exits release.
     const model = registry.get(body.model);
     if (!model) {
+        preDispatchAdmission?.release();
+        modelLoadAdmission?.release();
         sendAnthropicNotFound(res, `Model "${body.model}" not found`);
         return;
     }
@@ -921,10 +983,26 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
     // against one shared native model. Must be released in the `finally` below.
     const lease = registry.acquireDispatchLease(body.model);
     if (!lease) {
+        preDispatchAdmission?.release();
+        modelLoadAdmission?.release();
         sendAnthropicInternalError(res, 'session registry missing for registered model');
         return;
     }
     const leaseModel = lease.model;
+    if (modelLoadAdmission) {
+        try {
+            preDispatchAdmission = modelLoadAdmission.transferToResident(lease.registry);
+        }
+        catch (err) {
+            registry.releaseDispatchLease(leaseModel);
+            modelLoadAdmission.release();
+            if (err instanceof QueueFullError) {
+                sendAnthropicRateLimit(res, `${err.message}. Retry after 1s.`);
+                return;
+            }
+            throw err;
+        }
+    }
     // AbortController wired to disconnect events. Declared at function scope
     // so the outer `finally` can detach listeners on early returns; the
     // `abortListenersAttached` flag gates the detach so pre-validation exits
@@ -1021,6 +1099,17 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
             httpReq.once('close', onAbortClose);
             httpReq.once('error', onAbortError);
         }
+        // Catch-up abort: a response torn down BEFORE the attach above has
+        // already emitted its terminal event, so the `once('close')`
+        // listeners will never fire. Consult the response-side socket state
+        // directly (the REQUEST side is deliberately excluded — a fully
+        // consumed IncomingMessage auto-destroys after 'end' on every
+        // normal request, so `httpReq.destroyed` is not a disconnect
+        // signal). Makes `streamSignal.aborted` authoritative for the H2
+        // pre-dispatch disconnect check inside the mutex callback.
+        if (res.destroyed || res.writableEnded || abortSocket?.destroyed === true) {
+            abortController.abort();
+        }
         abortListenersAttached = true;
         const streamSignal = abortController.signal;
         // Bracket the native-model dispatch with the idle sweeper.
@@ -1043,309 +1132,357 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
         idleListenersAttached = true;
         try {
             const mutexQueuedAt = Date.now();
-            const runInference = () => withAdmissionControlledInference(sessionReg, modelWorkCoordinator, async () => {
-                const serverTiming = {
-                    server_model_resolve_ms: serverModelResolveMs,
-                    server_load_wait_ms: serverLoadWaitMs,
-                    server_load_owner: serverLoadOwner,
-                    server_queue_ms: Date.now() - mutexQueuedAt,
-                    server_pre_inference_ms: Date.now() - handlerStartedAt,
-                    ...resolveServerTuningForUsage(),
-                };
-                // Hot-swap race guard. `ModelRegistry.register()` is not coordinated with
-                // `withExclusive`, so a concurrent re-register of the same friendly name
-                // could silently dispatch this request through a stale model. Any drift
-                // from the pre-lock snapshot is fatal.
-                const lockedSessionReg = registry.getSessionRegistry(body.model);
-                const lockedInstanceId = registry.getInstanceId(body.model);
-                if (lockedSessionReg === undefined ||
-                    lockedInstanceId === undefined ||
-                    lockedSessionReg !== sessionReg ||
-                    lockedInstanceId !== preLockInstanceId) {
-                    sendAnthropicBadRequest(res, `Model "${body.model}" binding changed while the request was queued behind the per-model ` +
-                        `execution mutex. A concurrent register() re-pointed the name at a different model instance ` +
-                        `(or released it entirely) while this waiter was parked, so the session registry and instance ` +
-                        `id captured before the mutex wait no longer match the live binding. Dispatching anyway would ` +
-                        `service this request through a stale model object — a silent cross-model handoff. Retry the ` +
-                        `request — if the swap was intentional, the new binding will service the retry cleanly.`);
-                    return;
-                }
-                // Per-model session selection for `/v1/messages` reuse.
-                //
-                // Two paths, gated on whether the underlying native model has
-                // the block-paged KV cache adapter active
-                // (`hasBlockPagedCache()` — captured at load time from
-                // `<Inner>::paged_adapter.is_some()` and surfaced by the
-                // `SessionCapableModel` structural interface):
-                //
-                //   * **Paged-active** (Qwen3 + LFM2 + Gemma4 today; Qwen3.5
-                //     dense + Qwen3.5 MoE once their perf trade-off is
-                //     decided). Allocate a fresh `ChatSession` per request via
-                //     `createFreshSession()`, do NOT touch the warm slot.
-                //     Cross-turn / cross-conversation prefix reuse is handled
-                //     entirely by the native `BlockAllocator`'s prefix-hash
-                //     table: SYS blocks shared across requests are refcounted
-                //     transparently, so two parallel `/v1/messages` requests
-                //     sharing a system prompt both run on distinct
-                //     `ChatSession` objects but reference the SAME physical
-                //     KV blocks. The JS-side warm slot would only serialize
-                //     them and force one into cold replay.
-                //
-                //   * **Non-paged** (Qwen3.5 dense + MoE — default-OFF pending
-                //     a perf decision against the compiled C++ flat path;
-                //     the Qianfan-OCR VLM — no adapter wired). Fall through to
-                //     `getOrCreateWarmAny`, which is the ONLY cross-conversation
-                //     reuse mechanism these models have. The Anthropic Messages
-                //     API is stateless on the wire (no `previous_response_id`,
-                //     clients don't propagate `prompt_cache_key`), so without
-                //     the warm slot every turn is a full cold start.
-                //
-                // The `hasBlockPagedCache?()` getter is optional on the
-                // structural interface so the `QianfanOCRModel` VLM (which
-                // has no paged-adapter wiring) still satisfies the type
-                // contract — a missing getter falls into the non-paged branch
-                // here.
-                //
-                // Adoption stays keyed by the literal sentinel
-                // `MESSAGES_WARM_SLOT_ID = '__msg_warm__'`. The Anthropic
-                // Messages API never produces a `previous_response_id` clients
-                // could echo back (and the OpenAI side mints `resp_*` ids),
-                // so cross-endpoint capture via tier-1 is impossible by
-                // construction — no `/v1/responses` request can collide with
-                // the sentinel through the tier-1 path.
-                //
-                // The two endpoints DO share the single warm slot under the
-                // registry's single-warm invariant on the non-paged path: a
-                // `/v1/messages` turn following a `/v1/responses` turn can
-                // evict (and vice versa). On the paged path neither side
-                // touches the warm slot, so cross-endpoint contention
-                // disappears.
-                //
-                // The `prompt_cache_key` request field is still NOT exposed
-                // on this endpoint. Cross-conversation block-level cache
-                // reuse on paged-active models is now driven by native
-                // content-addressing instead of the JS warm slot, so adding
-                // the field is no longer a prerequisite for that use case.
-                const pagedActive = leaseModel.hasBlockPagedCache?.() === true;
-                const lookup = pagedActive ? sessionReg.createFreshSession() : sessionReg.getOrCreateWarmAny(requestedSystem);
-                const session = lookup.session;
-                // `X-Session-Cache` observability header.
-                //
-                // Non-paged path:
-                //   * Non-streaming: set the optimistic `prefix_hit` value
-                //     BEFORE dispatch on `lookup.hit` (so the header is on the
-                //     wire even if the dispatch throws) and demote
-                //     post-dispatch to `fresh` when the warm slot was leased
-                //     but native prefix reuse did not actually happen
-                //     (`result.cachedTokens === 0`). `res.end` has not fired
-                //     yet, so the overwrite still lands on the wire.
-                //   * Streaming: emits `streaming` to signal the authoritative
-                //     post-dispatch value rides on the SSE stream
-                //     (`message_delta.usage.cache_read_input_tokens` and the
-                //     `X-Cached-Tokens` HTTP trailer, set below in
-                //     `handleStreamingNative` once `terminalCachedTokens` is
-                //     known). Reporting `fresh` here would be a lie — the
-                //     paged engine routinely returns `cachedTokens > 0` on
-                //     turn-2+ and the prior `'fresh'` default falsely advertised
-                //     a cache miss. The previous comment documented this as
-                //     intentional but it was a logging bug.
-                //
-                // Paged path:
-                //   * Non-streaming: `lookup.hit` is always `false` (we
-                //     `createFreshSession`); the post-dispatch promotion
-                //     branch flips `prefix_hit` when the native engine
-                //     reports `cachedTokens > 0`, which is the authoritative
-                //     signal that the block allocator's content-addressed
-                //     reuse picked up shared SYS blocks on this turn.
-                //   * Streaming: same `streaming` value as non-paged; the SSE
-                //     `usage.cache_read_input_tokens` field carries the
-                //     authoritative value.
-                //
-                // Header values: `'fresh' | 'prefix_hit' | 'streaming'`. The
-                // `'streaming'` value tells operators to read the SSE
-                // `message_delta.usage.cache_read_input_tokens` for the
-                // resolved cache-hit count (or `X-Cached-Tokens` trailer if
-                // the client supports HTTP trailers).
-                let sessionCacheStatus = body.stream === true ? 'streaming' : lookup.hit ? 'prefix_hit' : 'fresh';
-                res.setHeader('X-Session-Cache', sessionCacheStatus);
-                // HTTP/1.1 chunked-encoding trailer announcement for streaming.
-                // The actual value is filled in by `handleStreamingNative`
-                // once it has captured `terminalCachedTokens` from the final
-                // SSE chunk.
-                if (body.stream === true) {
-                    res.setHeader('Trailer', 'X-Cached-Tokens');
-                }
-                // Outer catch branches on `responseMode` (not `res.headersSent`, which
-                // flips in `writeHead` before the body lands) so a crash after
-                // `writeHead(application/json)` cannot leak SSE frames into a JSON body.
-                const visibility = createVisibility();
-                try {
+            const runInference = () => {
+                return withAdmissionControlledInference(sessionReg, modelWorkCoordinator, preDispatchAdmission, async () => {
+                    const serverTiming = {
+                        server_model_resolve_ms: serverModelResolveMs,
+                        server_load_wait_ms: serverLoadWaitMs,
+                        server_load_owner: serverLoadOwner,
+                        server_queue_ms: Date.now() - mutexQueuedAt,
+                        server_pre_inference_ms: Date.now() - handlerStartedAt,
+                        ...resolveServerTuningForUsage(),
+                    };
+                    // Hot-swap race guard. `ModelRegistry.register()` is not coordinated with
+                    // `withExclusive`, so a concurrent re-register of the same friendly name
+                    // could silently dispatch this request through a stale model. Any drift
+                    // from the pre-lock snapshot is fatal.
+                    const lockedSessionReg = registry.getSessionRegistry(body.model);
+                    const lockedInstanceId = registry.getInstanceId(body.model);
+                    if (lockedSessionReg === undefined ||
+                        lockedInstanceId === undefined ||
+                        lockedSessionReg !== sessionReg ||
+                        lockedInstanceId !== preLockInstanceId) {
+                        sendAnthropicBadRequest(res, `Model "${body.model}" binding changed while the request was queued behind the per-model ` +
+                            `execution mutex. A concurrent register() re-pointed the name at a different model instance ` +
+                            `(or released it entirely) while this waiter was parked, so the session registry and instance ` +
+                            `id captured before the mutex wait no longer match the live binding. Dispatching anyway would ` +
+                            `service this request through a stale model object — a silent cross-model handoff. Retry the ` +
+                            `request — if the swap was intentional, the new binding will service the retry cleanly.`);
+                        return;
+                    }
+                    // Per-model session selection for `/v1/messages` reuse.
+                    //
+                    // Two paths, gated on whether the underlying native model has
+                    // the block-paged KV cache adapter active
+                    // (`hasBlockPagedCache()` — captured at load time from
+                    // `<Inner>::paged_adapter.is_some()` and surfaced by the
+                    // `SessionCapableModel` structural interface):
+                    //
+                    //   * **Paged-active** (Qwen3 + LFM2 + Gemma4 today; Qwen3.5
+                    //     dense + Qwen3.5 MoE once their perf trade-off is
+                    //     decided). Allocate a fresh `ChatSession` per request via
+                    //     `createFreshSession()`, do NOT touch the warm slot.
+                    //     Cross-turn / cross-conversation prefix reuse is handled
+                    //     entirely by the native `BlockAllocator`'s prefix-hash
+                    //     table: SYS blocks shared across requests are refcounted
+                    //     transparently, so two parallel `/v1/messages` requests
+                    //     sharing a system prompt both run on distinct
+                    //     `ChatSession` objects but reference the SAME physical
+                    //     KV blocks. The JS-side warm slot would only serialize
+                    //     them and force one into cold replay.
+                    //
+                    //   * **Non-paged** (Qwen3.5 dense + MoE — default-OFF pending
+                    //     a perf decision against the compiled C++ flat path;
+                    //     the Qianfan-OCR VLM — no adapter wired). Fall through to
+                    //     `getOrCreateWarmAny`, which is the ONLY cross-conversation
+                    //     reuse mechanism these models have. The Anthropic Messages
+                    //     API is stateless on the wire (no `previous_response_id`,
+                    //     clients don't propagate `prompt_cache_key`), so without
+                    //     the warm slot every turn is a full cold start.
+                    //
+                    // The `hasBlockPagedCache?()` getter is optional on the
+                    // structural interface so the `QianfanOCRModel` VLM (which
+                    // has no paged-adapter wiring) still satisfies the type
+                    // contract — a missing getter falls into the non-paged branch
+                    // here.
+                    //
+                    // Adoption stays keyed by the literal sentinel
+                    // `MESSAGES_WARM_SLOT_ID = '__msg_warm__'`. The Anthropic
+                    // Messages API never produces a `previous_response_id` clients
+                    // could echo back (and the OpenAI side mints `resp_*` ids),
+                    // so cross-endpoint capture via tier-1 is impossible by
+                    // construction — no `/v1/responses` request can collide with
+                    // the sentinel through the tier-1 path.
+                    //
+                    // The two endpoints DO share the single warm slot under the
+                    // registry's single-warm invariant on the non-paged path: a
+                    // `/v1/messages` turn following a `/v1/responses` turn can
+                    // evict (and vice versa). On the paged path neither side
+                    // touches the warm slot, so cross-endpoint contention
+                    // disappears.
+                    //
+                    // The `prompt_cache_key` request field is still NOT exposed
+                    // on this endpoint. Cross-conversation block-level cache
+                    // reuse on paged-active models is now driven by native
+                    // content-addressing instead of the JS warm slot, so adding
+                    // the field is no longer a prerequisite for that use case.
+                    // H2 pre-dispatch disconnect check (non-streaming only). A
+                    // client that vanished while this request was parked behind
+                    // the per-model mutex must not burn a whole prefill+decode
+                    // budget producing a JSON body nobody can receive. Checked
+                    // BEFORE the warm-slot lease so no session state is consumed
+                    // or mutated — the early return composes with the permit
+                    // lifecycle exactly like the binding-changed return above
+                    // (the pre-dispatch permit was already consumed atomically by
+                    // `withExclusive`; the outer `finally` release is an
+                    // idempotent no-op after handoff). Streaming keeps its
+                    // existing paths: the signal fast-aborts `_runChatStream` and
+                    // the SSE drain loop breaks on `clientAborted` at loop-top.
+                    if (body.stream !== true && streamSignal.aborted) {
+                        return;
+                    }
+                    const pagedActive = leaseModel.hasBlockPagedCache?.() === true;
+                    const lookup = pagedActive
+                        ? sessionReg.createFreshSession()
+                        : sessionReg.getOrCreateWarmAny(requestedSystem, config.cacheSalt ?? null);
+                    const session = lookup.session;
+                    await sessionReg.flushPendingDisposals();
+                    let sessionRetained = false;
+                    // `X-Session-Cache` observability header.
+                    //
+                    // Non-paged path:
+                    //   * Non-streaming: set the optimistic `prefix_hit` value
+                    //     BEFORE dispatch on `lookup.hit` (so the header is on the
+                    //     wire even if the dispatch throws) and demote
+                    //     post-dispatch to `fresh` when the warm slot was leased
+                    //     but native prefix reuse did not actually happen
+                    //     (`result.cachedTokens === 0`). `res.end` has not fired
+                    //     yet, so the overwrite still lands on the wire.
+                    //   * Streaming: emits `streaming` to signal the authoritative
+                    //     post-dispatch value rides on the SSE stream
+                    //     (`message_delta.usage.cache_read_input_tokens` and the
+                    //     `X-Cached-Tokens` HTTP trailer, set below in
+                    //     `handleStreamingNative` once `terminalCachedTokens` is
+                    //     known). Reporting `fresh` here would be a lie — the
+                    //     paged engine routinely returns `cachedTokens > 0` on
+                    //     turn-2+ and the prior `'fresh'` default falsely advertised
+                    //     a cache miss. The previous comment documented this as
+                    //     intentional but it was a logging bug.
+                    //
+                    // Paged path:
+                    //   * Non-streaming: `lookup.hit` is always `false` (we
+                    //     `createFreshSession`); the post-dispatch promotion
+                    //     branch flips `prefix_hit` when the native engine
+                    //     reports `cachedTokens > 0`, which is the authoritative
+                    //     signal that the block allocator's content-addressed
+                    //     reuse picked up shared SYS blocks on this turn.
+                    //   * Streaming: same `streaming` value as non-paged; the SSE
+                    //     `usage.cache_read_input_tokens` field carries the
+                    //     authoritative value.
+                    //
+                    // Header values: `'fresh' | 'prefix_hit' | 'streaming'`. The
+                    // `'streaming'` value tells operators to read the SSE
+                    // `message_delta.usage.cache_read_input_tokens` for the
+                    // resolved cache-hit count (or `X-Cached-Tokens` trailer if
+                    // the client supports HTTP trailers).
+                    let sessionCacheStatus = body.stream === true ? 'streaming' : lookup.hit ? 'prefix_hit' : 'fresh';
+                    res.setHeader('X-Session-Cache', sessionCacheStatus);
+                    // HTTP/1.1 chunked-encoding trailer announcement for streaming.
+                    // The actual value is filled in by `handleStreamingNative`
+                    // once it has captured `terminalCachedTokens` from the final
+                    // SSE chunk.
                     if (body.stream === true) {
-                        // On the paged path the underlying native cache is the
-                        // sole reuse mechanism, so preserve it even though the JS
-                        // `ChatSession` is freshly allocated. The native paged
-                        // adapter validates reuse by token/hash before any cached
-                        // prefix is trusted, and the MoE GDN checkpoint layer now
-                        // follows the same content-checked policy. Non-paged keeps
-                        // the original `!lookup.hit` semantics so only warm-slot
-                        // hits preserve native cache.
-                        const resetNativeCache = pagedActive ? false : !lookup.hit;
-                        const outcome = await runSessionStreaming(session, messages, config, streamSignal, resetNativeCache);
-                        const streamResult = await handleStreamingNative(res, outcome.stream, body, outcome.wasCommitted, httpReq, visibility, config.includeReasoning !== false, stopSequences, serverTiming);
-                        // Warm-slot adopt/drop only applies to the non-paged
-                        // path. On the paged path the JS-side warm slot plays no
-                        // role (block reuse is content-addressed in native), so
-                        // we never touch it — the fresh `ChatSession` allocated
-                        // for this request is dropped on the floor and GC'd once
-                        // the handler scope exits.
-                        //
-                        // Non-paged dual-gate adopt: BOTH the producer-side commit
-                        // signal (`outcome.wasCommitted()`, which reads
-                        // `session.turns` bumped in `startFromHistoryStream`'s
-                        // `finally`) AND the handler-side success signal
-                        // (`streamResult.ok`, true only when we reached the clean
-                        // `message_stop` terminal) must be true to adopt. The
-                        // producer's `finally` runs on every break — including
-                        // client abort, mid-decode throw, and
-                        // `finishReason=error` — so `wasCommitted()` alone is NOT
-                        // sufficient: it can return `true` after the SSE side
-                        // emitted an `error` terminal (not re-thrown by
-                        // `handleStreamingNative`), leaving a session whose
-                        // observable wire state is failure but whose `turns`
-                        // counter advanced. Adopting in that window would seed the
-                        // warm slot with a session the next request can lease but
-                        // whose history does not match what the client received.
-                        //
-                        // Mirrors `responses.ts` (around line 3277) where the
-                        // analogous gate combines `committed`, `handlerError`, and
-                        // `streamFailureMode === null` — the producer-side commit
-                        // and a clean handler-side terminal must both hold before
-                        // the session is reachable from a subsequent request.
-                        if (!pagedActive) {
-                            if (streamResult.ok && outcome.wasCommitted() && !streamResult.suppressedToolCalls) {
-                                sessionReg.adopt(MESSAGES_WARM_SLOT_ID, session, requestedSystem, null);
+                        res.setHeader('Trailer', 'X-Cached-Tokens');
+                    }
+                    // Outer catch branches on `responseMode` (not `res.headersSent`, which
+                    // flips in `writeHead` before the body lands) so a crash after
+                    // `writeHead(application/json)` cannot leak SSE frames into a JSON body.
+                    const visibility = createVisibility();
+                    try {
+                        if (body.stream === true) {
+                            // On the paged path the underlying native cache is the
+                            // sole reuse mechanism, so preserve it even though the JS
+                            // `ChatSession` is freshly allocated. The native paged
+                            // adapter validates reuse by token/hash before any cached
+                            // prefix is trusted, and the MoE GDN checkpoint layer now
+                            // follows the same content-checked policy. Non-paged keeps
+                            // the original `!lookup.hit` semantics so only warm-slot
+                            // hits preserve native cache.
+                            const resetNativeCache = pagedActive ? false : !lookup.hit;
+                            const outcome = await runSessionStreaming(session, messages, config, streamSignal, resetNativeCache);
+                            const streamResult = await handleStreamingNative(res, outcome.stream, body, outcome.wasCommitted, httpReq, visibility, config.includeReasoning !== false, stopSequences, serverTiming);
+                            // Warm-slot adopt/drop only applies to the non-paged
+                            // path. On the paged path the JS-side warm slot plays no
+                            // role (block reuse is content-addressed in native), so
+                            // we never touch it. The fresh `ChatSession` is explicitly
+                            // disposed in the `finally` below so its native scheduler owner
+                            // and live paged request are released before the handler leaves
+                            // the admission lane; GC alone cannot perform that native
+                            // lifecycle transition.
+                            //
+                            // Non-paged dual-gate adopt: BOTH the producer-side commit
+                            // signal (`outcome.wasCommitted()`, which reads
+                            // `session.turns` bumped in `startFromHistoryStream`'s
+                            // `finally`) AND the handler-side success signal
+                            // (`streamResult.ok`, true only when we reached the clean
+                            // `message_stop` terminal) must be true to adopt. The
+                            // producer's `finally` runs on every break — including
+                            // client abort, mid-decode throw, and
+                            // `finishReason=error` — so `wasCommitted()` alone is NOT
+                            // sufficient: it can return `true` after the SSE side
+                            // emitted an `error` terminal (not re-thrown by
+                            // `handleStreamingNative`), leaving a session whose
+                            // observable wire state is failure but whose `turns`
+                            // counter advanced. Adopting in that window would seed the
+                            // warm slot with a session the next request can lease but
+                            // whose history does not match what the client received.
+                            //
+                            // Mirrors `responses.ts` (around line 3277) where the
+                            // analogous gate combines `committed`, `handlerError`, and
+                            // `streamFailureMode === null` — the producer-side commit
+                            // and a clean handler-side terminal must both hold before
+                            // the session is reachable from a subsequent request.
+                            if (!pagedActive) {
+                                if (streamResult.ok && outcome.wasCommitted() && !streamResult.suppressedToolCalls) {
+                                    sessionReg.adopt(MESSAGES_WARM_SLOT_ID, session, requestedSystem, null, config.cacheSalt ?? null);
+                                    sessionRetained = true;
+                                }
+                                else {
+                                    sessionReg.drop(MESSAGES_WARM_SLOT_ID);
+                                }
                             }
-                            else {
-                                sessionReg.drop(MESSAGES_WARM_SLOT_ID);
+                        }
+                        else {
+                            // See the streaming branch above for the rationale on
+                            // preserving native cache on the paged path.
+                            const resetNativeCache = pagedActive ? false : !lookup.hit;
+                            // Non-streaming cancellation (H2): `streamSignal` threads
+                            // through `ChatSession.startFromHistory` into the normal public
+                            // method; the wrapper maps it to the internal native operation — a mid-turn
+                            // disconnect flips the controller, the native turn unwinds
+                            // at the next safepoint, and the dispatch rejects with
+                            // "chat session cancelled" (routed through the catch below:
+                            // warm slot dropped, nothing persisted). The
+                            // disconnect-aware skip inside `handleNonStreaming` /
+                            // `endJson` remains the last line of defense for a
+                            // disconnect racing the final flush.
+                            const outcome = await runSessionNonStreaming(session, messages, config, resetNativeCache, streamSignal);
+                            const result = outcome.result;
+                            // Re-classify the `X-Session-Cache` header.
+                            //
+                            // Non-paged: a warm-slot hit that did NOT actually produce
+                            // native prefix reuse (`cachedTokens === 0` — e.g.
+                            // tokenizer change, system prompt drift squeaking past
+                            // the byte-equal compare via some upstream rewrite) gets
+                            // demoted from `prefix_hit` back to `fresh`.
+                            //
+                            // Paged: `lookup.hit` is always `false` so we entered
+                            // with `sessionCacheStatus = 'fresh'`. Promote to
+                            // `prefix_hit` when the native engine reports
+                            // `cachedTokens > 0` — that's the authoritative signal
+                            // that `BlockAllocator`'s content-addressed prefix lookup
+                            // recovered shared SYS blocks on this turn. `res.end` has
+                            // not fired yet (`handleNonStreaming` is what flushes via
+                            // `endJson`), so the overwrite still lands on the wire.
+                            if (lookup.hit && result.cachedTokens === 0) {
+                                sessionCacheStatus = 'fresh';
+                                res.setHeader('X-Session-Cache', sessionCacheStatus);
+                            }
+                            else if (pagedActive && result.cachedTokens > 0) {
+                                sessionCacheStatus = 'prefix_hit';
+                                res.setHeader('X-Session-Cache', sessionCacheStatus);
+                            }
+                            // Companion `X-Cached-Tokens` header: emitted only when
+                            // reuse genuinely happened, so operators can spot a stale
+                            // `prefix_hit` claim from telemetry alone.
+                            if (result.cachedTokens > 0) {
+                                res.setHeader('X-Cached-Tokens', String(result.cachedTokens));
+                            }
+                            await handleNonStreaming(res, result, body, visibility, stopSequences, serverTiming);
+                            // Non-paged success: adopt the warm slot only when the
+                            // dispatch actually committed. Mirrors the streaming-side
+                            // dual-gate at `streamResult.ok && outcome.wasCommitted()`
+                            // above and the sibling `/v1/responses` adopt gate, so the
+                            // local invariant — "never adopt an uncommitted session"
+                            // — is enforced by the same check on both wire formats and
+                            // both endpoints. Today every native failure throws (and
+                            // routes through the inner catch below), so the gate is
+                            // dead code on the current Rust paths; it defends the
+                            // invariant LOCALLY so a future native change that
+                            // resolves `chat_session_start_sync` with
+                            // `Ok(finish_reason="error")` cannot silently poison the
+                            // warm slot. Drop on the uncommitted branch matches the
+                            // streaming-side `else { drop(...) }` so the sentinel does
+                            // not accumulate stale entries from earlier turns.
+                            //
+                            // Paged success: never adopt — block-level reuse is
+                            // already in the native cache, and adopting would
+                            // re-introduce the cross-endpoint warm-slot eviction
+                            // that paged is supposed to eliminate.
+                            if (!pagedActive) {
+                                if (outcome.committed && !hasSuppressedToolCalls(result, body)) {
+                                    sessionReg.adopt(MESSAGES_WARM_SLOT_ID, session, requestedSystem, null, config.cacheSalt ?? null);
+                                    sessionRetained = true;
+                                }
+                                else {
+                                    sessionReg.drop(MESSAGES_WARM_SLOT_ID);
+                                }
                             }
                         }
                     }
-                    else {
-                        // See the streaming branch above for the rationale on
-                        // preserving native cache on the paged path.
-                        const resetNativeCache = pagedActive ? false : !lookup.hit;
-                        // Native `chatSessionStart` has no AbortSignal yet — disconnect handling
-                        // lives inside `handleNonStreaming` / `endJson`.
-                        const outcome = await runSessionNonStreaming(session, messages, config, resetNativeCache);
-                        const result = outcome.result;
-                        // Re-classify the `X-Session-Cache` header.
-                        //
-                        // Non-paged: a warm-slot hit that did NOT actually produce
-                        // native prefix reuse (`cachedTokens === 0` — e.g.
-                        // tokenizer change, system prompt drift squeaking past
-                        // the byte-equal compare via some upstream rewrite) gets
-                        // demoted from `prefix_hit` back to `fresh`.
-                        //
-                        // Paged: `lookup.hit` is always `false` so we entered
-                        // with `sessionCacheStatus = 'fresh'`. Promote to
-                        // `prefix_hit` when the native engine reports
-                        // `cachedTokens > 0` — that's the authoritative signal
-                        // that `BlockAllocator`'s content-addressed prefix lookup
-                        // recovered shared SYS blocks on this turn. `res.end` has
-                        // not fired yet (`handleNonStreaming` is what flushes via
-                        // `endJson`), so the overwrite still lands on the wire.
-                        if (lookup.hit && result.cachedTokens === 0) {
-                            sessionCacheStatus = 'fresh';
-                            res.setHeader('X-Session-Cache', sessionCacheStatus);
-                        }
-                        else if (pagedActive && result.cachedTokens > 0) {
-                            sessionCacheStatus = 'prefix_hit';
-                            res.setHeader('X-Session-Cache', sessionCacheStatus);
-                        }
-                        // Companion `X-Cached-Tokens` header: emitted only when
-                        // reuse genuinely happened, so operators can spot a stale
-                        // `prefix_hit` claim from telemetry alone.
-                        if (result.cachedTokens > 0) {
-                            res.setHeader('X-Cached-Tokens', String(result.cachedTokens));
-                        }
-                        await handleNonStreaming(res, result, body, visibility, stopSequences, serverTiming);
-                        // Non-paged success: adopt the warm slot only when the
-                        // dispatch actually committed. Mirrors the streaming-side
-                        // dual-gate at `streamResult.ok && outcome.wasCommitted()`
-                        // above and the sibling `/v1/responses` adopt gate, so the
-                        // local invariant — "never adopt an uncommitted session"
-                        // — is enforced by the same check on both wire formats and
-                        // both endpoints. Today every native failure throws (and
-                        // routes through the inner catch below), so the gate is
-                        // dead code on the current Rust paths; it defends the
-                        // invariant LOCALLY so a future native change that
-                        // resolves `chat_session_start_sync` with
-                        // `Ok(finish_reason="error")` cannot silently poison the
-                        // warm slot. Drop on the uncommitted branch matches the
-                        // streaming-side `else { drop(...) }` so the sentinel does
-                        // not accumulate stale entries from earlier turns.
-                        //
-                        // Paged success: never adopt — block-level reuse is
-                        // already in the native cache, and adopting would
-                        // re-introduce the cross-endpoint warm-slot eviction
-                        // that paged is supposed to eliminate.
-                        if (!pagedActive) {
-                            if (outcome.committed && !hasSuppressedToolCalls(result, body)) {
-                                sessionReg.adopt(MESSAGES_WARM_SLOT_ID, session, requestedSystem, null);
+                    catch (err) {
+                        // A failed turn on the non-paged path must not leave a
+                        // poisoned warm slot for the next request to lease — drop
+                        // the sentinel before emitting the error response.
+                        // Streaming half-failures are already covered by the
+                        // `wasCommitted()` gate above; this catch handles
+                        // non-streaming throws and any pre-handler failures from
+                        // the streaming path. The paged path never adopts, so the
+                        // drop is a no-op there but kept unconditional for
+                        // simplicity (the registry treats `drop` of an absent key
+                        // as a no-op).
+                        sessionReg.drop(MESSAGES_WARM_SLOT_ID);
+                        const message = err instanceof Error ? err.message : 'Unknown error during inference';
+                        if (visibility.responseMode === null) {
+                            if (isContextCapacityError(err)) {
+                                sendAnthropicBadRequest(res, message);
                             }
                             else {
-                                sessionReg.drop(MESSAGES_WARM_SLOT_ID);
+                                sendAnthropicInternalError(res, message);
                             }
                         }
-                    }
-                }
-                catch (err) {
-                    // A failed turn on the non-paged path must not leave a
-                    // poisoned warm slot for the next request to lease — drop
-                    // the sentinel before emitting the error response.
-                    // Streaming half-failures are already covered by the
-                    // `wasCommitted()` gate above; this catch handles
-                    // non-streaming throws and any pre-handler failures from
-                    // the streaming path. The paged path never adopts, so the
-                    // drop is a no-op there but kept unconditional for
-                    // simplicity (the registry treats `drop` of an absent key
-                    // as a no-op).
-                    sessionReg.drop(MESSAGES_WARM_SLOT_ID);
-                    const message = err instanceof Error ? err.message : 'Unknown error during inference';
-                    if (visibility.responseMode === null) {
-                        if (isContextCapacityError(err)) {
-                            sendAnthropicBadRequest(res, message);
+                        else if (visibility.responseMode === 'json') {
+                            // Already committed to JSON — destroy the socket rather than corrupt the body.
+                            try {
+                                res.destroy(err instanceof Error ? err : new Error(message));
+                            }
+                            catch {
+                                // Socket may already be gone.
+                            }
                         }
                         else {
-                            sendAnthropicInternalError(res, message);
-                        }
-                    }
-                    else if (visibility.responseMode === 'json') {
-                        // Already committed to JSON — destroy the socket rather than corrupt the body.
-                        try {
-                            res.destroy(err instanceof Error ? err : new Error(message));
-                        }
-                        catch {
-                            // Socket may already be gone.
+                            // SSE: best-effort streaming `error`, but only if no terminal landed
+                            // (a double terminal would confuse the client state machine).
+                            if (!visibility.terminalEmitted) {
+                                writeFallbackErrorSSE(res, 'error', {
+                                    error: { type: 'api_error', message },
+                                });
+                            }
+                            try {
+                                endSSE(res);
+                            }
+                            catch {
+                                // Already closed.
+                            }
                         }
                     }
-                    else {
-                        // SSE: best-effort streaming `error`, but only if no terminal landed
-                        // (a double terminal would confuse the client state machine).
-                        if (!visibility.terminalEmitted) {
-                            writeFallbackErrorSSE(res, 'error', {
-                                error: { type: 'api_error', message },
-                            });
-                        }
-                        try {
-                            endSSE(res);
-                        }
-                        catch {
-                            // Already closed.
+                    finally {
+                        // Every session that was not retained in the warm registry owns
+                        // request-local native state and must be released before leaving
+                        // the admission lane. Cleanup failure must not replace a terminal
+                        // response already delivered to the client.
+                        if (!sessionRetained) {
+                            try {
+                                await sessionReg.disposeSession(session);
+                            }
+                            catch (error) {
+                                console.error('[messages] failed to release an unretained chat-session cache owner:', error);
+                            }
                         }
+                        await sessionReg.flushPendingDisposals();
                     }
-                }
-            });
+                });
+            };
             await runInference();
         }
         catch (err) {
@@ -1360,7 +1497,7 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
             // still routes through the handler's existing error paths.
             if (err instanceof QueueFullError) {
                 if (!res.headersSent) {
-                    sendAnthropicRateLimit(res, `Model queue full: ${err.queuedCount} waiting (limit ${err.limit}). Retry after 1s.`);
+                    sendAnthropicRateLimit(res, `${err.message}. Retry after 1s.`);
                 }
             }
             else {
@@ -1369,6 +1506,12 @@ export async function handleCreateMessage(res, body, registry, httpReq, idleSwee
         }
     }
     finally {
+        // Balance the pre-dispatch admission on EVERY exit that never handed
+        // the permit to `withExclusive`: binding-changed 400s, disconnects,
+        // and any validation early-return inside the outer `try`. Idempotent
+        // and a no-op after handoff, so the unconditional call is safe.
+        preDispatchAdmission?.release();
+        modelLoadAdmission?.release();
         // Drop disconnect listeners so they don't pin the request past handler
         // return. Only detach if we actually attached (gated by the flag).
         if (abortListenersAttached) {