@north-light/crouter 0.3.318 → 0.3.319

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/integration/provider-rotation.test.ts

@@ -1,2530 +0,0 @@
-import { before, after, test } from "node:test";
-import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { LockedJsonFile } from "../../../../../core/locked-file.ts";
-import { initializeFreshScopedStore } from "../../../../../core/scoped-state/migrate.ts";
-import { writeRawConfig } from "../../../../../core/config.ts";
-import { expandModelCandidates } from "../../../../../core/model-routes.ts";
-import type { SubscriptionCredential } from "../../../lib/subscription-state.ts";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-// Child processes reach crouter's locked-file primitive by absolute URL: they run under
-// tsx with `--input-type=module`, so a bare relative specifier has no base to resolve from.
-const lockedFileUrl = new URL("../../../../../core/locked-file.ts", import.meta.url).href;
-
-let home: string;
-let nodeCwd: string;
-let helpers: typeof import("../../../lib/subscription-state.ts");
-let providerManagement: typeof import("../../../../../core/provider-management.ts");
-let rotationModule: typeof import("../../provider-rotation.ts");
-let providerRotationExtension: typeof import("../../provider-rotation.ts").default;
-const previousHome = process.env.HOME;
-const previousAgentDir = process.env.PI_CODING_AGENT_DIR;
-const previousModelIntent = process.env.CRTR_MODEL_INTENT;
-const previousNodeCwd = process.env.CRTR_NODE_CWD;
-
-function writeLadderConfig() {
-  writeRawConfig("user", {
-    modelLadders: {
-      anthropic: {
-        ultra: "anthropic/claude-fable-5:high",
-        strong: "anthropic/claude-opus-4-8:high",
-        medium: "anthropic/claude-sonnet-4-6:high",
-        light: "anthropic/custom-light-x",
-      },
-      openai: {
-        ultra: "openai-codex/gpt-5.6-sol:max",
-        strong: "openai-codex/gpt-5.6-sol:high",
-        medium: "openai-codex/gpt-5.6-terra:medium",
-        light: "openai-codex/gpt-5.6-luna:low",
-      },
-    },
-  });
-}
-
-function writeSameModelRouteConfig() {
-  writeRawConfig("user", {
-    modelRoutes: {
-      primary: { family: "openai", credentialSource: "primary", providerId: "openai-codex", models: { ultra: "openai-codex/gpt-5.6-sol:high", strong: "openai-codex/gpt-5.6-sol:high", medium: "openai-codex/gpt-5.6-sol:high", light: "openai-codex/gpt-5.6-sol:high" } },
-      alternate: { family: "openai", credentialSource: "alternate", providerId: "anthropic", models: { ultra: "anthropic/gpt-5.6-sol:high", strong: "anthropic/gpt-5.6-sol:high", medium: "anthropic/gpt-5.6-sol:high", light: "anthropic/gpt-5.6-sol:high" } },
-    },
-    modelRouting: { credentialSourceOrder: ["primary", "alternate"], familyOrder: ["openai"] },
-  });
-}
-
-function credential(label: string, overrides: Partial<SubscriptionCredential> = {}): SubscriptionCredential {
-  return {
-    label,
-    refresh: `refresh-${label}`,
-    access: `access-${label}`,
-    expires: Date.now() + 60_000,
-    rateLimitedUntil: 0,
-    lastAttemptAt: 0,
-    lastRateLimitedAt: 0,
-    ...overrides,
-  };
-}
-
-async function resetRotationState() {
-  rmSync(join(home, ".pi", "agent", "auth.json"), { force: true });
-  await helpers.writeSubscriptionPool("anthropic", []);
-  await helpers.writeSubscriptionPool("openai-codex", []);
-  rmSync(join(home, ".pi", "agent", "provider-rotation.json"), { force: true });
-}
-
-function observeLines(stream: NodeJS.ReadableStream, onLine: (line: string) => void): void {
-  let buffer = "";
-  stream.setEncoding("utf8");
-  stream.on("data", (chunk: string) => {
-    buffer += chunk;
-    let newlineIndex = buffer.indexOf("\n");
-    while (newlineIndex !== -1) {
-      const line = buffer.slice(0, newlineIndex);
-      buffer = buffer.slice(newlineIndex + 1);
-      onLine(line);
-      newlineIndex = buffer.indexOf("\n");
-    }
-  });
-}
-
-function within<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
-  return new Promise<T>((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    promise.then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (error: unknown) => {
-        clearTimeout(timer);
-        reject(error);
-      },
-    );
-  });
-}
-
-before(async () => {
-  home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
-  nodeCwd = mkdtempSync(join(tmpdir(), "pi-provider-rotation-cwd-"));
-  process.env.HOME = home;
-  process.env.PI_CODING_AGENT_DIR = join(home, ".pi", "agent");
-  process.env.CRTR_NODE_CWD = nodeCwd;
-  initializeFreshScopedStore({ kind: "user", root: join(home, ".crouter") });
-  initializeFreshScopedStore({ kind: "provider", root: process.env.PI_CODING_AGENT_DIR });
-  helpers = await import("../../../lib/subscription-state.ts");
-  providerManagement = await import("../../../../../core/provider-management.ts");
-  rotationModule = await import("../../provider-rotation.ts");
-  providerRotationExtension = rotationModule.default;
-});
-
-after(() => {
-  if (previousHome === undefined) delete process.env.HOME;
-  else process.env.HOME = previousHome;
-  if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
-  else process.env.PI_CODING_AGENT_DIR = previousAgentDir;
-  if (previousModelIntent === undefined) delete process.env.CRTR_MODEL_INTENT;
-  else process.env.CRTR_MODEL_INTENT = previousModelIntent;
-  if (previousNodeCwd === undefined) delete process.env.CRTR_NODE_CWD;
-  else process.env.CRTR_NODE_CWD = previousNodeCwd;
-  rmSync(home, { recursive: true, force: true });
-  rmSync(nodeCwd, { recursive: true, force: true });
-});
-
-// Concurrent refreshes of the same expired pool credential serialize read, token exchange,
-// and write under one lock. The injected refresh runs once; the second caller observes the
-// winner's fresh token and does not make a second single-use refresh request.
-test("brick-repro: concurrent refreshes of the same expired pool token serialize through the lock (exactly one network refresh)", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "shared-refresh", access: "access-stale", expires: 1 })]);
-  const poolEntry = helpers.readSubscriptionPool("anthropic")[0];
-  assert.equal(poolEntry.label, "anthropic");
-
-  let refreshCalls = 0;
-  const requestController = new AbortController();
-  const refreshSignals: (AbortSignal | undefined)[] = [];
-  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken, signal) => {
-    refreshCalls += 1;
-    refreshSignals.push(signal);
-    if (refreshCalls === 1) {
-      return { refresh: "shared-refresh-rotated", access: "access-fresh", expires: Date.now() + 60_000 };
-    }
-    // Any refresh call after the first is simulating "this refresh token was already
-    // consumed by the winner" -- a genuine invalid_grant from the provider.
-    throw Object.assign(new Error(`HTTP request failed. status=400; body={"error":"invalid_grant"} for token ${refreshToken}`), { status: 400 });
-  });
-
-  try {
-    const [a, b] = await Promise.all([
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
-      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry, requestController.signal),
-    ]);
-
-    assert.equal(refreshCalls, 1);
-    assert.deepEqual(refreshSignals, [requestController.signal], 'the request abort signal reaches the serialized token exchange');
-    assert.equal(a.access, "access-fresh");
-    assert.equal(b.access, "access-fresh");
-
-    // The rotated value landed on the account it came from -- the pool is the only store now.
-    const [stored] = helpers.readSubscriptionPool("anthropic");
-    assert.equal(stored.label, "anthropic");
-    assert.equal(stored.access, "access-fresh");
-    assert.equal(stored.refresh, "shared-refresh-rotated");
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-  }
-});
-
-test("a fresh default credential bypasses the cross-process refresh lock", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [
-    credential("openai-codex", { refresh: "refresh-codex", access: "access-codex-fresh", expires: Date.now() + 60_000 }),
-  ]);
-  const poolEntry = helpers.readSubscriptionPool("openai-codex")[0];
-  const originalWithLockAsync = LockedJsonFile.prototype.withLockAsync;
-  LockedJsonFile.prototype.withLockAsync = async () => {
-    throw new Error("fresh credential unexpectedly joined the auth refresh lock");
-  };
-
-  try {
-    const resolved = await rotationModule.__refreshCredentialIfNeededForTest("openai-codex", poolEntry);
-    assert.equal(resolved.access, "access-codex-fresh");
-  } finally {
-    LockedJsonFile.prototype.withLockAsync = originalWithLockAsync;
-  }
-});
-
-test("subscription bookkeeping retries lock collisions and then degrades without failing the provider turn", async () => {
-  const waits: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => { waits.push(ms); });
-  try {
-    let eventualCalls = 0;
-    const eventual = await rotationModule.__recordSubscriptionMutationForTest("testing eventual acquisition", async () => {
-      eventualCalls++;
-      if (eventualCalls < 4) throw Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED" });
-    });
-    assert.equal(eventual, true);
-    assert.equal(eventualCalls, 4);
-    assert.deepEqual(waits, [25, 75, 150]);
-
-    waits.length = 0;
-    let exhaustedCalls = 0;
-    const exhausted = await rotationModule.__recordSubscriptionMutationForTest("testing exhaustion", async () => {
-      exhaustedCalls++;
-      throw Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED" });
-    });
-    assert.equal(exhausted, false);
-    assert.equal(exhaustedCalls, 4);
-    assert.deepEqual(waits, [25, 75, 150]);
-  } finally {
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// A GENUINE invalid_grant (the refresh token is actually dead, not merely raced) must
-// still reach the real cooldown -> reauth path through the new lock-delegated seam --
-// the fix must not accidentally swallow or misclassify a real failure. Drives it through
-// the actual provider stream (not the raw helper) so `isInvalidRefreshTokenError` +
-// reauthentication + the credential-store persist all fire for real.
-test("a genuine invalid_grant through the pool account's lock still reauthenticates and persists to the pool", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "dead-refresh", access: "access-stale", expires: 1 })]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  ctx.ui.notify = () => {};
-  const loginCalls: string[] = [];
-  // Plain Error, no typed .status: real pi-ai refresh failures carry the HTTP status
-  // in the message text, so the refresh path still recognizes an invalid_grant from this
-  // shape.
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "anthropic") {
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setLoginForProviderForTest(async (providerId) => {
-    loginCalls.push(providerId);
-    return { refresh: "refresh-reauthed", access: "access-reauthed", expires: Date.now() + 60_000 };
-  });
-  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
-    return (async function* () {
-      yield { type: "text_delta", text: `hello with ${options?.apiKey}` };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple({ provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" }, ctx);
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(loginCalls, ["anthropic"]);
-    assert.deepEqual(setModelCalls, []);
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-
-    // Reauth persisted onto the pool account's own pool entry -- the single owner -- with the
-    // cooldown the failed refresh recorded cleared again.
-    const [entry] = helpers.readSubscriptionPool("anthropic");
-    assert.equal(entry.label, "anthropic");
-    assert.equal(entry.refresh, "refresh-reauthed");
-    assert.equal(entry.access, "access-reauthed");
-    assert.equal(entry.rateLimitedUntil, 0);
-    assert.equal(entry.authFailure, undefined);
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setLoginForProviderForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// A genuine invalid_grant through the pool account's lock seam cools the credential down
-// and falls back cross-provider when UI is unavailable: an expired default pool entry, an
-// authenticated Codex fallback, and the real streamSimple path all participate.
-test("a genuine invalid_grant through the pool account's lock with no UI reaches cooldown and falls back cross-provider", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "dead-refresh", access: "access-stale", expires: 1 })]);
-  // Authenticated Codex fallback already sitting in its own pool.
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  // ctx.hasUI is deliberately left falsy: reauth must be impossible, so the only path
-  // forward is cooldown + cross-provider fallback.
-  const streamedModels: any[] = [];
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "anthropic") {
-      // Plain Error, no typed .status: the refresh path reads the invalid_grant shape from
-      // the message text, matching production failures.
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    streamedModels.push(model);
-    return (async function* () {
-      yield { type: "text_delta", text: "hello from codex fallback" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // Fell back cross-provider and actually served the turn on Codex.
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
-    assert.equal(streamedModels.length, 1);
-    assert.equal(streamedModels[0].provider, "openai-codex");
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-
-    // The pool account's entry got the ~30-day invalid-refresh exclusion, tagged with its auth
-    // cause through the real locked-refresh seam -- not a bypass.
-    const [entry] = helpers.readSubscriptionPool("anthropic");
-    assert.equal(entry.label, "anthropic");
-    assert.ok(entry.rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
-    assert.equal(entry.authFailure, "invalid_grant");
-
-    // No UI -- no reauth happened; the dead credential is still stored unchanged.
-    assert.equal(entry.refresh, "dead-refresh");
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("the synthesized ladder registry preserves family preference before configured strength fallback", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  helpers.writeRotationConfig({ defaultFallbackStrength: "medium" });
-
-  const candidates = expandModelCandidates({
-    kind: "logical",
-    family: "anthropic",
-    strength: "strong",
-    spec: "anthropic/claude-opus-4-8:high",
-  }, nodeCwd, null);
-
-  assert.deepEqual(candidates.map((candidate) => `${candidate.family}/${candidate.strength}`), [
-    "anthropic/strong", "openai/strong", "anthropic/medium", "openai/medium",
-  ]);
-});
-
-test("shared launch/general candidate policy preserves a viable request, skips a cooling request, and reports total exhaustion", async () => {
-  const requested = { providerId: "anthropic", modelId: "claude-opus", registered: true, authenticated: true };
-  const fallback = { providerId: "openai-codex", modelId: "gpt-5", registered: true, authenticated: true };
-
-  assert.deepEqual(helpers.resolveProviderCandidates([requested, fallback], 100).candidates, [requested, fallback]);
-  assert.deepEqual(
-    helpers.resolveProviderCandidates([{ ...requested, coolingUntil: 200 }, fallback], 100).candidates,
-    [fallback],
-    "a cooling requested provider must not prevent launch/general selection of a viable fallback",
-  );
-  assert.deepEqual(
-    helpers.resolveProviderCandidates([
-      { ...requested, registered: false },
-      { ...fallback, authenticated: false },
-      { providerId: "anthropic", modelId: "claude-sonnet", registered: true, authenticated: true, coolingUntil: 200 },
-    ], 100).rejected.map(({ reason }) => reason),
-    ["unregistered", "unauthenticated", "cooling"],
-    "callers get one complete, actionable reason set when no candidate is viable",
-  );
-});
-
-test("parses Retry-After seconds and HTTP dates", async () => {
-  const now = Date.UTC(2026, 5, 16, 18, 30, 0);
-  assert.equal(helpers.parseRetryAfterHeader("1.5", now), 1500);
-
-  const retryAt = new Date(now + 15_000).toUTCString();
-  const parsed = helpers.parseRetryAfterHeader(retryAt, now);
-  assert.ok(parsed !== undefined && parsed >= 14_000 && parsed <= 15_000);
-  assert.equal(helpers.parseRetryAfterHeader("", now), undefined);
-  assert.equal(helpers.parseRetryAfterHeader("not-a-delay", now), undefined);
-});
-
-test("keeps newest Retry-After cooldown across overlapping attempts", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-
-  await helpers.markSubscriptionAttempt("anthropic", "personal", 100);
-  await helpers.markSubscriptionAttempt("anthropic", "personal", 200);
-  await helpers.markSubscriptionRateLimited("anthropic", "personal", 60_000, 100, 150);
-  await helpers.markSubscriptionRateLimited("anthropic", "personal", 5_000, 200, 205);
-  await helpers.markSubscriptionRateLimited("anthropic", "personal", 10_000, 100, 300);
-
-  const [entry] = helpers.readSubscriptionPool("anthropic");
-  assert.deepEqual(
-    { lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil },
-    { lastAttemptAt: 200, lastRateLimitedAt: 300, rateLimitedUntil: 10300 },
-  );
-
-  await helpers.markSubscriptionSuccess("anthropic", "personal", 250);
-  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 10300);
-  await helpers.markSubscriptionSuccess("anthropic", "personal", 400);
-  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
-});
-
-// Storage-hardening (design mrf6n12x): the locked read/modify/write primitive must preserve a
-// causally newer cooldown across a stale credential upsert, while still letting an equal-timestamp
-// reauth clear it.
-test("a stale upsert refreshes tokens but cannot erase a newer cooldown; an equal-timestamp reauth clears it", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("anthropic", [credential("work", { refresh: "r0", access: "a0", lastRateLimitedAt: 100 })]);
-  // What a node reads before doing a slow token refresh.
-  const snapshot = helpers.readSubscriptionPool("anthropic")[0];
-
-  // "Other node" 429s the slot with a strictly newer basis while the refresh is in flight.
-  await helpers.markSubscriptionRateLimited("anthropic", "work", 60_000, 500, 500);
-  const cooled = helpers.readSubscriptionPool("anthropic")[0];
-  assert.equal(cooled.lastRateLimitedAt, 500);
-  assert.equal(cooled.rateLimitedUntil, 60_500);
-
-  // Stale refresh upsert built from the pre-429 snapshot: fresh tokens, stale cooldown basis.
-  await helpers.upsertSubscription("anthropic", { ...snapshot, refresh: "r1", access: "a1", expires: snapshot.expires ?? 0 });
-  const merged = helpers.readSubscriptionPool("anthropic")[0];
-  assert.equal(merged.refresh, "r1", "token fields take the incoming value");
-  assert.equal(merged.access, "a1");
-  assert.equal(merged.rateLimitedUntil, 60_500, "the newer cooldown survives the stale upsert");
-  assert.equal(merged.lastRateLimitedAt, 500);
-
-  // Reauth clears the cooldown while preserving lastRateLimitedAt (equal timestamp -> incoming wins).
-  await helpers.upsertSubscription("anthropic", { ...merged, refresh: "r2", access: "a2", rateLimitedUntil: 0, lastRateLimitedAt: merged.lastRateLimitedAt });
-  const reauthed = helpers.readSubscriptionPool("anthropic")[0];
-  assert.equal(reauthed.rateLimitedUntil, 0, "an equal-timestamp reauth clears the cooldown");
-  assert.equal(reauthed.refresh, "r2");
-});
-
-test("a stale success cannot reopen a slot cooled down by a newer 429", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "personal", 30_000, 500, 500);
-  // A success whose attempt STARTED before the 429 must not clear the newer cooldown.
-  await helpers.markSubscriptionSuccess("anthropic", "personal", 200);
-  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 30_500);
-  // A success that started after the 429 legitimately clears it.
-  await helpers.markSubscriptionSuccess("anthropic", "personal", 600);
-  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
-});
-
-// A mutation must genuinely go through the per-pool-file cross-process lock: while another
-// process holds the pool file's lock (the SAME LockedJsonFile lock the backend uses),
-// a mutator throws after exhausting its retry budget rather than writing unlocked; once the
-// holder releases, the same call succeeds.
-test("pool mutations take the cross-process pool-file lock", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("work")]);
-  const poolFile = join(home, ".pi", "agent", "openai-codex-credentials.json");
-
-  const lockHolder = spawn(
-    process.execPath,
-    [
-      "--import",
-      "tsx/esm",
-      "--input-type=module",
-      "-e",
-      String.raw`const { LockedJsonFile } = await import(${JSON.stringify(lockedFileUrl)});
-const backend = new LockedJsonFile(${JSON.stringify(poolFile)});
-await backend.withLockAsync(async () => {
-  process.stdout.write("locked\n");
-  await new Promise((resolve) => {
-    process.stdin.setEncoding("utf8");
-    process.stdin.once("data", resolve);
-  });
-  return { result: undefined };
-});`,
-    ],
-    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
-  );
-  let lockStderr = "";
-  lockHolder.stderr!.setEncoding("utf8");
-  lockHolder.stderr!.on("data", (chunk: string) => {
-    lockStderr += chunk;
-  });
-  let sawLocked = false;
-  const lockReady = new Promise<void>((resolve, reject) => {
-    lockHolder.once("error", reject);
-    lockHolder.once("close", (code) => {
-      if (!sawLocked) reject(new Error(`lock-holder exited with ${code} before signalling readiness: ${lockStderr.trim()}`));
-    });
-    observeLines(lockHolder.stdout!, (line) => {
-      if (line === "locked") {
-        sawLocked = true;
-        resolve();
-      }
-    });
-  });
-  // Teardown releases the lock and proves the child completed its awaited unlock before the
-  // post-release mutation runs. A wedged child still gets bounded TERM/KILL cleanup.
-  const childClosed = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
-    lockHolder.once("close", (code, signal) => resolve({ code, signal })),
-  );
-  let readyTimer: NodeJS.Timeout | undefined;
-  try {
-    await Promise.race([
-      lockReady,
-      new Promise<never>((_, reject) => {
-        // Boot budget, not a semantics guard: the child is a fresh `node --import tsx/esm`
-        // process that compiles the TS module graph before it can signal. Under the full
-        // tier's --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s,
-        // so give it real headroom -- a genuine lock bug shows up as a wrong outcome below,
-        // never as a slow boot.
-        readyTimer = setTimeout(() => reject(new Error("lock-holder did not signal readiness within 60s")), 60_000);
-      }),
-    ]);
-    // Health is SQL-only, so the credential-file lock cannot delay it.
-    const pool = await within(helpers.markSubscriptionAttempt("openai-codex", "work", 123), 1_000, "health write waited on the credential-file lock");
-    assert.equal(pool[0].lastAttemptAt, 123);
-  } finally {
-    if (readyTimer) clearTimeout(readyTimer);
-    try {
-      lockHolder.stdin!.write("release\n");
-      lockHolder.stdin!.end();
-    } catch {
-      /* child already gone */
-    }
-    // Wait for clean exit first: code 0 proves the async unlock completed. A wedged child gets
-    // bounded SIGTERM/SIGKILL cleanup, and its test-owned lock is removed only on that fallback.
-    const closedWithin = (ms: number) =>
-      Promise.race([
-        childClosed,
-        new Promise<null>((resolve) => setTimeout(() => resolve(null), ms)),
-      ]);
-    let closed = await closedWithin(2000);
-    let forced = false;
-    if (!closed || closed.code !== 0) {
-      forced = true;
-      lockHolder.kill("SIGTERM");
-      closed = await closedWithin(2000);
-      if (!closed) {
-        lockHolder.kill("SIGKILL");
-        closed = await closedWithin(2000);
-      }
-      if (!closed) throw new Error("lock-holder child did not exit after SIGKILL");
-    }
-    if (forced) {
-      rmSync(`${poolFile}.lock`, { recursive: true, force: true });
-      throw new Error(`lock-holder exited without clean unlock (code=${closed.code}, signal=${closed.signal})`);
-    }
-  }
-
-  const pool = await helpers.markSubscriptionAttempt("openai-codex", "work", 456);
-  assert.equal(pool[0].lastAttemptAt, 456);
-});
-
-// Codex captures the login `accountId` and rejects the same account re-added under a different
-// label (a sticky browser session otherwise fakes redundancy on one quota); a distinct account
-// is stored with its own accountId.
-test("rejects a duplicate Codex account under a new label and stores accountId for a distinct one", async () => {
-  await resetRotationState();
-  const { ctx, commands, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  const notes: Array<{ message: string; type?: string }> = [];
-  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
-  ctx.ui.input = async () => "";
-  let nextAccountId = "acct-1";
-  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: nextAccountId }));
-
-  try {
-    await providerRotationExtension(pi);
-
-    await commands["provider-sub"].handler("openai-codex add codex-alt", ctx);
-    let pool = helpers.readSubscriptionPool("openai-codex");
-    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
-    assert.equal(pool[0].accountId, "acct-1");
-
-    // Same account, different label -> rejected, pool unchanged.
-    notes.length = 0;
-    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
-    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "duplicate account is rejected with an error");
-    pool = helpers.readSubscriptionPool("openai-codex");
-    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
-
-    // Distinct account -> stored with its own accountId.
-    nextAccountId = "acct-2";
-    await commands["provider-sub"].handler("openai-codex add codex-other", ctx);
-    pool = helpers.readSubscriptionPool("openai-codex");
-    assert.deepEqual(pool.map((e) => e.label).sort(), ["codex-alt", "codex-other"]);
-    assert.equal(pool.find((e) => e.label === "codex-other")?.accountId, "acct-2");
-  } finally {
-    rotationModule.__setLoginForProviderForTest(undefined);
-  }
-});
-
-// The default Codex slot carries its account identity, preventing a second label from claiming
-// the same quota and making that identity visible in the list.
-test("the default Codex slot carries its account identity: blocks re-adding the same account and renders it in list", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [
-    credential("openai-codex", { refresh: "r-def", access: "a-def", accountId: "acct-default" }),
-  ]);
-
-  let pool = helpers.readSubscriptionPool("openai-codex");
-  assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
-  assert.equal(pool[0].accountId, "acct-default");
-
-  const { ctx, commands, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  const notes: Array<{ message: string; type?: string }> = [];
-  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
-  ctx.ui.input = async () => "";
-  // A sticky browser re-login yields the SAME ChatGPT account already backing the pool account.
-  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "acct-default" }));
-  try {
-    await providerRotationExtension(pi);
-
-    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
-    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "re-adding the account under a new label is rejected");
-    pool = helpers.readSubscriptionPool("openai-codex");
-    assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
-
-    notes.length = 0;
-    await commands["provider-sub"].handler("openai-codex list", ctx);
-    assert.match(notes.map((n) => n.message).join("\n"), /account=/);
-  } finally {
-    rotationModule.__setLoginForProviderForTest(undefined);
-  }
-});
-
-// Drive the REAL login handler path: a collision with an explicit account must reject
-// before commitManagedLogin writes anything, so the failed OAuth result never partially
-// switches the default credential or creates a default pool entry with the duplicate identity.
-test("login handler rejects a colliding Codex account before switching the pool account", async () => {
-  await resetRotationState();
-  await helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-X" }));
-  const { ctx, commands, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  const notes: Array<{ message: string; type?: string }> = [];
-  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
-  ctx.ui.input = async () => "";
-  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r-X", access: "a-X", expires: Date.now() + 60_000, accountId: "acct-X" }));
-  try {
-    await providerRotationExtension(pi);
-    await commands["provider-sub"].handler("openai-codex add openai-codex", ctx);
-    assert.ok(notes.some((note) => note.type === "error" && /already added/i.test(note.message)));
-    assert.equal(readAuthRecord("openai-codex"), undefined, "rejected login must not write auth.json");
-    const pool = helpers.readSubscriptionPool("openai-codex");
-    assert.equal(pool.filter((entry) => entry.accountId === "acct-X").length, 1);
-    assert.equal(pool.some((entry) => entry.label === "openai-codex"), false);
-  } finally {
-    rotationModule.__setLoginForProviderForTest(undefined);
-  }
-});
-
-// The handler snapshots the pool account before OAuth. A 429 recorded while OAuth is open is
-// causally newer, so completing a same-account login must not reopen that quota.
-test("the uniqueness-aware reauth upsert refreshes its slot but rejects another slot's account", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("work", { accountId: "acct-old", rateLimitedUntil: 900, lastAttemptAt: 100, lastRateLimitedAt: 50 }), credential("other", { accountId: "acct-held" })]);
-  await helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-new", refresh: "r-new", access: "a-new" }));
-  let pool = helpers.readSubscriptionPool("openai-codex");
-  const refreshed = pool.find((entry) => entry.label === "work");
-  assert.equal(refreshed?.accountId, "acct-new");
-  assert.equal(refreshed?.rateLimitedUntil, 900);
-  assert.equal(refreshed?.lastAttemptAt, 100);
-  assert.equal(refreshed?.lastRateLimitedAt, 50);
-  await assert.rejects(
-    () => helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-held", refresh: "r-collision", access: "a-collision" })),
-    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
-  );
-  pool = helpers.readSubscriptionPool("openai-codex");
-  assert.equal(pool.find((entry) => entry.label === "work")?.accountId, "acct-new");
-  assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
-});
-
-// A rejected default identity move must leave the pool untouched — account uniqueness is decided
-// inside the pool lock, before anything is written — and must not touch auth.json at all, which
-// no managed path writes any more.
-test("addSubscription normalizes labels and enforces Codex account uniqueness inside the locked transform", async () => {
-  await resetRotationState();
-  await helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-1" }));
-  await assert.rejects(
-    () => helpers.addSubscription("openai-codex", credential(" work ", { accountId: "acct-2" })),
-    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already exists/i.test((err as Error).message),
-  );
-  await assert.rejects(
-    () => helpers.addSubscription("openai-codex", credential("   ", { accountId: "acct-3" })),
-    (err: unknown) => !(err instanceof helpers.DuplicateSubscriptionError) && /cannot be empty/i.test((err as Error).message),
-  );
-  await assert.rejects(
-    () => helpers.addSubscription("openai-codex", credential("work-2", { accountId: "acct-1" })),
-    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
-  );
-  await helpers.addSubscription("openai-codex", credential("work-3", { accountId: "acct-3" }));
-  assert.deepEqual(helpers.readSubscriptionPool("openai-codex").map((entry) => entry.label).sort(), ["work", "work-3"]);
-});
-
-// The first contender holds the real pool lock inside addSubscription's transform. The second
-// contender cannot reach its own transform until it has first attempted that same real lock.
-// This makes an outside-lock uniqueness check deterministic: both checks run while the pool is
-// empty, then both appends succeed after the holder releases.
-// Approved slow-test exception: two fresh TypeScript child processes can take over 10s to boot
-// on a hosted runner; the test's bounded coordination budgets distinguish a genuine regression.
-test("cross-process explicit adds admit exactly one duplicate Codex account", { timeout: 60_000 }, async () => {
-  await resetRotationState();
-  const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
-  const subscriptionStateUrl = new URL("../../../lib/subscription-state.ts", import.meta.url).href;
-  const spawnContender = (label: string) => {
-    const child = spawn(
-      process.execPath,
-      [
-        "--import",
-        "tsx/esm",
-        "--input-type=module",
-        "-e",
-        String.raw`const { addSubscription, DuplicateSubscriptionError } = await import(${JSON.stringify(subscriptionStateUrl)});
-try {
-  await addSubscription("openai-codex", {
-    label: ${JSON.stringify(label)}, refresh: "refresh-${label}", access: "access-${label}", expires: Date.now() + 60_000,
-    accountId: "acct-cross-process-race", rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0,
-  });
-  process.stdout.write("outcome:success\n");
-} catch (error) {
-  const outcome = error instanceof DuplicateSubscriptionError ? "duplicate" : "error";
-  process.stdout.write("outcome:" + outcome + "\n");
-  if (outcome === "error") process.stderr.write(String(error));
-}`,
-      ],
-      { env: { ...process.env, HOME: home }, stdio: ["ignore", "pipe", "pipe"] },
-    );
-    return new Promise<{ outcome: string; stderr: string }>((resolve, reject) => {
-      let stdout = "";
-      let stderr = "";
-      child.stdout!.on("data", (chunk: string) => { stdout += chunk; });
-      child.stderr!.on("data", (chunk: string) => { stderr += chunk; });
-      child.once("error", reject);
-      child.once("close", (code) => {
-        const outcome = /outcome:([^\n]+)/.exec(stdout)?.[1];
-        if (code !== 0 || outcome === undefined) reject(new Error(`${label} exited with ${code}: ${stderr.trim()}`));
-        else resolve({ outcome, stderr });
-      });
-    });
-  };
-
-  const results = await Promise.all([spawnContender("race-left"), spawnContender("race-right")]);
-  assert.deepEqual(results.map((result) => result.outcome).sort(), ["duplicate", "success"], results.map((result) => result.stderr).join("\n"));
-  const pool = helpers.readSubscriptionPool("openai-codex");
-  assert.equal(pool.length, 1);
-  assert.ok(["race-left", "race-right"].includes(pool[0].label));
-  assert.equal(existsSync(`${poolPath}.lock`), false, "cross-process add race must release the pool lock directory");
-});
-
-test("renames explicit subscriptions without permitting pool or case-insensitive collisions", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("openai-codex"), credential("work"), credential("personal")]);
-  assert.deepEqual((await helpers.renameSubscription("openai-codex", "work", "Lab")).map((entry) => entry.label), ["openai-codex", "Lab", "personal"]);
-  await assert.rejects(() => helpers.renameSubscription("openai-codex", "Lab", " PERSONAL "), helpers.DuplicateSubscriptionError);
-  await helpers.renameSubscription("openai-codex", "openai-codex", "anything");
-});
-
-test("treats numeric subscription refs as 1-based indexes", async () => {
-  await resetRotationState();
-  const pool = [credential("alpha"), credential("beta")];
-
-  await helpers.writeSubscriptionPool("openai-codex", pool);
-  assert.deepEqual(
-    (await helpers.removeSubscription("openai-codex", "1")).map((entry) => entry.label),
-    ["beta"],
-  );
-
-  await helpers.writeSubscriptionPool("openai-codex", pool);
-  assert.deepEqual(
-    (await helpers.promoteSubscription("openai-codex", "2")).map((entry) => entry.label),
-    ["beta", "alpha"],
-  );
-});
-
-function makeRotationCtx(modelIntent?: string) {
-  const concreteRequest = arguments.length > 0 && modelIntent === undefined;
-  if (modelIntent === undefined) delete process.env.CRTR_MODEL_INTENT;
-  else process.env.CRTR_MODEL_INTENT = modelIntent;
-  const ctx = {
-    model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-    thinkingLevel: "high",
-    cwd: nodeCwd,
-    ui: { setStatus() {} },
-    modelRegistry: {
-      find(provider: string, id: string) {
-        if (provider === "anthropic" && id === "claude-opus-4-8") return { provider, id, api: "anthropic-messages" };
-        if (provider === "openai-codex" && id === "gpt-5.6-sol") return { provider, id, api: "openai-codex-responses" };
-        return undefined;
-      },
-      // These rotation scenarios model an account with no hand-written non-pool
-      // credential — pool state alone drives authentication here.
-      hasConfiguredAuth() {
-        return false;
-      },
-    },
-  } as any;
-  const setModelCalls: any[] = [];
-  const thinkingLevelCalls: string[] = [];
-  const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
-  const events: Record<string, (...args: any[]) => unknown> = {};
-  const commands: Record<string, { handler: (args: string, ctx: any) => unknown }> = {};
-  const pi = {
-    registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
-      providers[name] = {
-        ...provider,
-        streamSimple(...args: any[]) {
-          if (!concreteRequest) {
-            const model = args[0] as { provider: string };
-            process.env.CRTR_MODEL_INTENT = model.provider === "anthropic" ? "anthropic/strong" : "openai/strong";
-          }
-          return provider.streamSimple(...args);
-        },
-      };
-    },
-    registerCommand(name: string, command: { handler: (args: string, ctx: any) => unknown }) {
-      commands[name] = command;
-    },
-    on(eventName: string, handler: (...args: any[]) => unknown) {
-      events[eventName] = handler;
-    },
-    async setModel(model: any) {
-      setModelCalls.push(model);
-      ctx.model = model;
-      return true;
-    },
-    setThinkingLevel(level: string) {
-      thinkingLevelCalls.push(level);
-      ctx.thinkingLevel = level;
-    },
-  } as any;
-  return { ctx, setModelCalls, thinkingLevelCalls, providers, events, commands, pi };
-}
-
-test("managed Anthropic requests opt into server-side fallback without changing other managed routes", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
-
-  const anthropicModel = { provider: "anthropic", id: "claude-opus-5", api: "anthropic-messages" };
-  const { ctx, providers, events, pi } = makeRotationCtx("anthropic/ultra");
-  ctx.model = anthropicModel;
-  const streamOptions: any[] = [];
-  const fetchCalls: Array<[RequestInfo | URL, RequestInit | undefined]> = [];
-  const callerPayloads: unknown[] = [];
-  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
-    streamOptions.push(options);
-    return (async function* () {
-      yield { type: "text_delta", text: "served" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(anthropicModel, ctx, {
-      onPayload(payload: unknown) {
-        callerPayloads.push(payload);
-        if ((payload as { replaceWithNull?: boolean })?.replaceWithNull) return null;
-        return { ...(payload as object), callerPayload: true };
-      },
-      fetch: async (input: RequestInfo | URL, init?: RequestInit) => {
-        fetchCalls.push([input, init]);
-        return new Response();
-      },
-    });
-    for await (const _event of stream) {
-      // Drain the managed request so the injected stream options are captured.
-    }
-
-    const [anthropicOptions] = streamOptions;
-    assert.deepEqual(await anthropicOptions.onPayload({ request: true }, anthropicModel), {
-      request: true,
-      callerPayload: true,
-      fallbacks: "default",
-    });
-    assert.deepEqual(await anthropicOptions.onPayload({ replaceWithNull: true }, anthropicModel), { fallbacks: "default" });
-    assert.deepEqual(callerPayloads, [{ request: true }, { replaceWithNull: true }]);
-
-    for (const headers of [
-      new Headers({ "anthropic-beta": "claude-code-20250219,oauth-2025-04-20", "x-keep": "headers" }),
-      { "anthropic-beta": "claude-code-20250219,oauth-2025-04-20", "x-keep": "object" },
-      [["anthropic-beta", "claude-code-20250219,oauth-2025-04-20"], ["x-keep", "pairs"]],
-    ]) {
-      await anthropicOptions.fetch("https://example.test/messages", { headers });
-    }
-    for (const [_input, init] of fetchCalls) {
-      const headers = new Headers(init?.headers);
-      assert.equal(headers.get("anthropic-beta"), "claude-code-20250219,oauth-2025-04-20,server-side-fallback-2026-07-01");
-      assert.ok(headers.get("x-keep"));
-    }
-
-    const haikuModel = { provider: "anthropic", id: "claude-haiku-4-5", api: "anthropic-messages" };
-    const haikuOnPayload = (payload: unknown) => payload;
-    const haikuFetch = async () => new Response();
-    for await (const _event of providers["anthropic"].streamSimple(haikuModel, ctx, {
-      onPayload: haikuOnPayload,
-      fetch: haikuFetch,
-    })) {
-      // Drain the managed Haiku request.
-    }
-    assert.equal(streamOptions[1].onPayload, haikuOnPayload);
-    assert.equal(streamOptions[1].fetch, haikuFetch);
-    assert.deepEqual(await streamOptions[1].onPayload({ request: true }, haikuModel), { request: true });
-
-    await resetRotationState();
-    await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-    const codexModel = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
-    const codex = makeRotationCtx("openai/strong");
-    const codexOptions: any[] = [];
-    rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
-      codexOptions.push(options);
-      return (async function* () {
-        yield { type: "text_delta", text: "served" };
-      })() as any;
-    });
-    await providerRotationExtension(codex.pi);
-    await codex.events.session_start?.({}, codex.ctx);
-    for await (const _event of codex.providers["openai-codex"].streamSimple(codexModel, codex.ctx)) {
-      // Drain the managed Codex route.
-    }
-    assert.equal(codexOptions[0].onPayload, undefined);
-    assert.equal(codexOptions[0].fetch, undefined);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// A live route carries the session's exact thinking level through every provider
-// request, including the requests that continue a turn after tool results.
-test("preserves a manually selected thinking level across provider requests", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, thinkingLevelCalls, providers, events, pi } = makeRotationCtx("openai/strong");
-  ctx.thinkingLevel = "max";
-  rotationModule.__setStreamForProviderForTest(() => (async function* () {
-    yield { type: "text_delta", text: "continued after tool result" };
-  })() as any);
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
-    for await (const _event of stream) {
-      // Drain the managed-provider request to completion.
-    }
-
-    assert.deepEqual(thinkingLevelCalls, ["max"]);
-    assert.equal(ctx.thinkingLevel, "max");
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// Codex exhaustion switches the model and serves the same turn on the Anthropic fallback.
-test("falls back transparently and serves the turn on Anthropic when Codex is exhausted", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  const streamedModels: any[] = [];
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      yield { type: "text_delta", text: "hello from anthropic" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // Session model was switched to the Anthropic fallback...
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
-    // ...and the turn was actually STREAMED on the Anthropic model (not the codex one).
-    assert.equal(streamedModels.length, 1);
-    assert.equal(streamedModels[0].provider, "anthropic");
-    // The turn was served with content, never failed with an error.
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// A concrete request only expands to routes carrying its exact model id. A
-// cooling Codex Sol route must not substitute Anthropic's different model.
-test("a cooling concrete model never substitutes a different-provider model", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
-  const expectedDeadline = helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil;
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
-  let streamCalls = 0;
-  rotationModule.__setStreamForProviderForTest((_model) => {
-    streamCalls += 1;
-    return (async function* () {
-      yield { type: "text_delta", text: "must not call a cooling or fallback provider" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, [], "the concrete Sol request never switches to Anthropic");
-    assert.equal(streamCalls, 0);
-    assert.equal(emitted.length, 1);
-    assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/i);
-    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("an exact override never substitutes another provider sharing its model id", async () => {
-  await resetRotationState();
-  writeSameModelRouteConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
-  const previousModelExact = process.env.CRTR_MODEL_EXACT;
-  process.env.CRTR_MODEL_EXACT = "1";
-  ctx.modelRegistry.find = (provider: string, id: string) => {
-    if (id !== "gpt-5.6-sol") return undefined;
-    return { provider, id, api: provider === "anthropic" ? "anthropic-messages" : "openai-codex-responses" };
-  };
-  let streamCalls = 0;
-  rotationModule.__setStreamForProviderForTest(() => {
-    streamCalls += 1;
-    return (async function* () {
-      yield { type: "text_delta", text: "must not reach an alternate provider" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const emitted = [] as any[];
-    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, [], "the exact provider/model never switches to the same-id alternate");
-    assert.equal(streamCalls, 0, "the alternate provider is never called");
-    assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/i);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    if (previousModelExact === undefined) delete process.env.CRTR_MODEL_EXACT;
-    else process.env.CRTR_MODEL_EXACT = previousModelExact;
-  }
-});
-
-// Request timeouts and other transient network/5xx blips retry the same provider in place
-// without cooling the credential down or rotating away.
-test("treats a request timeout as transient: retries the SAME provider in place, no cooldown or rotation", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedModels: any[] = [];
-  const sleepCalls: number[] = [];
-  let anthropicCalls = 0;
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      if (model.provider === "anthropic") {
-        anthropicCalls += 1;
-        if (anthropicCalls === 1) {
-          yield { type: "error", error: Object.assign(new Error("Request timed out."), { errorMessage: "Request timed out." }) };
-          return;
-        }
-        yield { type: "text_delta", text: "hello from anthropic, second try" };
-        return;
-      }
-      yield { type: "text_delta", text: "hello from codex" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // Never switched providers or models -- both attempts stayed on anthropic.
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(streamedModels.map((m) => m.provider), ["anthropic", "anthropic"]);
-    assert.deepEqual(sleepCalls, [250]);
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-    // No cooldown -- a transient blip must never cool down a healthy subscription.
-    assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// Once the in-place transient retry budget is exhausted, the credential is rotated away
-// for this turn without persisting a fake rate-limit cooldown.
-test("surfaces the transient error and rotates to the fallback once the in-place retry budget is exhausted", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const notifications: Array<{ message: string; level: string }> = [];
-  ctx.ui.notify = (message: string, level: string) => {
-    notifications.push({ message, level });
-  };
-  const streamedModels: any[] = [];
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      if (model.provider === "anthropic") {
-        // 503 with no retry-after header is transient by STATUS, not just by message.
-        yield { type: "error", error: Object.assign(new Error("Service Unavailable"), { status: 503 }) };
-        return;
-      }
-      yield { type: "text_delta", text: "hello from codex fallback" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // Retried the same anthropic credential in place (3 attempts) then rotated to codex.
-    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 3);
-    assert.deepEqual(sleepCalls, [250, 750]);
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
-    // The turn was served on the fallback, never failed with a terminal error.
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-    // A network failure is not a rate limit and must not poison future turns.
-    assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-test("surfaces the underlying transient error without reporting a rate limit when every route fails", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
-  const sleepCalls: number[] = [];
-  let streamCalls = 0;
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-  rotationModule.__setStreamForProviderForTest(() => {
-    streamCalls += 1;
-    return (async function* () {
-      yield {
-        type: "error",
-        error: Object.assign(new Error("WebSocket connection closed unexpectedly"), {
-          errorMessage: "WebSocket connection closed unexpectedly",
-        }),
-      };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.equal(streamCalls, 3);
-    assert.deepEqual(sleepCalls, [250, 750]);
-    assert.equal(emitted.length, 1);
-    assert.match(emitted[0].error.errorMessage, /WebSocket connection closed unexpectedly/);
-    assert.doesNotMatch(emitted[0].error.errorMessage, /rate limited/i);
-    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-test("carries an observed 503 into the terminal provider error after bounded recovery", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
-  rotationModule.__setSleepForTest(async () => {});
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => (async function* () {
-    await options?.onResponse?.({ status: 503, headers: {} }, model);
-    yield { type: "error", error: new Error("Request failed", { cause: Object.assign(new Error("socket reset"), { code: "ECONNRESET" }) }) };
-  })() as any);
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const emitted = [] as any[];
-    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
-
-    const terminal = emitted.find((event) => event.type === "error");
-    assert.ok(terminal, "the bounded attempts settle a terminal provider error");
-    assert.equal(terminal.error.provider, "openai-codex");
-    assert.equal(terminal.error.model, "gpt-5.6-sol");
-    const details = terminal.error.diagnostics?.find((diagnostic: any) => diagnostic.type === "crtr:provider-failure")?.details;
-    assert.equal(details?.status, 503, "the response status survives the stream error boundary");
-    assert.equal(details?.causes?.[0]?.code, "ECONNRESET", "the cause chain survives the stream error boundary");
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-test("does not replay a partially exposed response, while retaining its 503 facts", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  let attempts = 0;
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => (async function* () {
-    attempts += 1;
-    yield { type: "text_delta", text: "already exposed" };
-    await options?.onResponse?.({ status: 503, headers: {} }, model);
-    yield { type: "error", error: new Error("Request failed") };
-  })() as any);
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const emitted = [] as any[];
-    for await (const event of providers["anthropic"].streamSimple(ctx.model, ctx)) emitted.push(event);
-
-    assert.equal(attempts, 1, "content commits the attempt before its failure");
-    assert.ok(setModelCalls.every((selected) => selected.provider === "anthropic"), "a partial response never rotates to another route");
-    const terminal = emitted.find((event) => event.type === "error");
-    assert.equal(terminal.error.diagnostics?.find((diagnostic: any) => diagnostic.type === "crtr:provider-failure")?.details?.status, 503);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("keeps a known authentication rejection fatal", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
-  let attempts = 0;
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => (async function* () {
-    attempts += 1;
-    await options?.onResponse?.({ status: 401, headers: {} }, model);
-    yield { type: "error", error: new Error("Request failed") };
-  })() as any);
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const emitted = [] as any[];
-    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
-
-    assert.equal(attempts, 1, "a protocol/auth failure never enters transient retries");
-    const terminal = emitted.find((event) => event.type === "error");
-    assert.equal(terminal.error.diagnostics?.find((diagnostic: any) => diagnostic.type === "crtr:provider-failure")?.details?.status, 401);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// Regression: a transport-poisoned process (a corrupted TLS upload leaves undici's H2
-// session destroyed, so EVERY request fails with no HTTP response while fresh processes
-// succeed) must self-terminate after consecutive transport-only exhausted passes so the
-// daemon respawns the broker fresh — and any pass that saw a real HTTP status must reset
-// the counter so ordinary provider blips never kill a healthy process.
-test("self-terminates after consecutive transport-only exhausted passes; an HTTP status resets the counter", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx(undefined);
-  rotationModule.__setSleepForTest(async () => {});
-  let mode: "success" | "transport" | "http503" = "success";
-  rotationModule.__setStreamForProviderForTest(() => {
-    const current = mode;
-    return (async function* () {
-      if (current === "success") {
-        yield { type: "text_delta", text: "ok" };
-        return;
-      }
-      if (current === "http503") {
-        // Transient by status — but an HTTP response nonetheless: proof the
-        // process can still reach the provider.
-        yield { type: "error", error: Object.assign(new Error("Service Unavailable"), { status: 503 }) };
-        return;
-      }
-      // No status at all — the poisoned-transport signature.
-      yield {
-        type: "error",
-        error: Object.assign(new Error("fetch failed: The session has been destroyed"), {
-          errorMessage: "fetch failed: The session has been destroyed",
-        }),
-      };
-    })() as any;
-  });
-  const terminateCalls: string[] = [];
-  let resolveTerminated: (tried: string) => void;
-  const terminated = new Promise<string>((resolve) => { resolveTerminated = resolve; });
-  rotationModule.__setTerminatePoisonedProcessForTest(async (tried) => {
-    terminateCalls.push(tried);
-    resolveTerminated(tried);
-    return true;
-  });
-
-  const runPass = async () => {
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted: any[] = [];
-    for await (const event of stream) emitted.push(event);
-    return emitted;
-  };
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-
-    // Baseline success pass: the cross-turn counter starts at zero.
-    assert.ok((await runPass()).some((e) => e.type === "text_delta"));
-
-    // First transport-only exhaustion: ordinary terminal error, no termination.
-    mode = "transport";
-    assert.ok((await runPass()).some((e) => e.type === "error"));
-    assert.equal(terminateCalls.length, 0);
-
-    // An exhausted pass WITH an HTTP status resets the counter.
-    mode = "http503";
-    assert.ok((await runPass()).some((e) => e.type === "error"));
-
-    // One transport-only pass after the reset: still below the limit.
-    mode = "transport";
-    assert.ok((await runPass()).some((e) => e.type === "error"));
-    assert.equal(terminateCalls.length, 0);
-
-    // Second consecutive transport-only pass: terminate fires and the stream is
-    // deliberately left open (no terminal error), so the SIGTERM abort path owns
-    // how this turn settles. Don't await the never-ending stream.
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted: any[] = [];
-    void (async () => { for await (const event of stream) emitted.push(event); })();
-    await within(terminated, 5_000, "poisoned-process termination never fired");
-    assert.equal(terminateCalls.length, 1);
-    assert.equal(emitted.length, 0);
-  } finally {
-    rotationModule.__setTerminatePoisonedProcessForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// Regression: a genuine rate limit (HTTP 429) must never get the transient in-place
-// retry treatment -- it cools the credential down and rotates on the FIRST failure. The
-// cooldown duration must reflect a real Retry-After header (5s here) rather than always
-// falling back to the 5-minute default, so a misclassification is obvious from the numbers.
-test("treats HTTP 429 as a genuine rate limit: rotates immediately using the Retry-After header, no in-place retry", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedModels: any[] = [];
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    streamedModels.push(model);
-    return (async function* () {
-      if (model.provider === "anthropic") {
-        await options?.onResponse?.({ status: 429, headers: { "retry-after": "5" } }, model);
-        yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-        return;
-      }
-      yield { type: "text_delta", text: "hello from codex" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 1);
-    assert.deepEqual(sleepCalls, []); // a genuine rate limit rotates immediately, it never sleeps in place
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-    const [entry] = helpers.readSubscriptionPool("anthropic");
-    // Retry-After: 5 -> ~5s cooldown, not the 5-minute default backoff.
-    assert.ok(entry.rateLimitedUntil > Date.now() + 4_000 && entry.rateLimitedUntil <= Date.now() + 5_000);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-test("re-enters an already-attempted provider when a concurrent success makes it ready again", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedProviders: string[] = [];
-  let anthropicAttempts = 0;
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    streamedProviders.push(model.provider);
-    return (async function* () {
-      if (model.provider === "anthropic" && anthropicAttempts++ > 0) {
-        yield { type: "text_delta", text: "recovered on Anthropic" };
-        return;
-      }
-      if (model.provider === "openai-codex") {
-        // A concurrent turn began after this turn's 429, so its causal success
-        // may legitimately clear Anthropic's cooldown before Codex exhausts.
-        await helpers.markSubscriptionSuccess("anthropic", "primary", Date.now() + 1);
-      }
-      await options?.onResponse?.({ status: 429, headers: { "retry-after": "0" } }, model);
-      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(streamedProviders, ["anthropic", "openai-codex", "anthropic"]);
-    assert.deepEqual(setModelCalls.map((entry) => entry.provider), ["openai-codex", "anthropic"]);
-    assert.ok(emitted.some((event) => event.type === "text_delta"));
-    assert.ok(!emitted.some((event) => event.type === "error"), "the ready-again provider must not fall into fatal exhaustion");
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("does not cool down credentials or switch providers when the user aborts", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedModels: any[] = [];
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      yield {
-        type: "error",
-        reason: "aborted",
-        error: {
-          role: "assistant",
-          content: [],
-          api: model.api,
-          provider: model.provider,
-          model: model.id,
-          usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
-          stopReason: "aborted",
-          errorMessage: "Request was aborted",
-          timestamp: Date.now(),
-        },
-      };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    // No AbortSignal is threaded through options here on purpose: the abort must be recognized
-    // from the event's own `reason: "aborted"` marker alone. Requiring the signal is exactly the
-    // regression that let an ESC cool down every credential and drain both provider pools.
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(streamedModels.map((m) => m.provider), ["anthropic"]);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.equal(emitted[0].reason, "aborted");
-    assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
-    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("skips invalid refresh tokens and serves the turn on the fallback provider", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedModels: any[] = [];
-  // Plain Error, no typed .status: the pool path still recognizes invalid_grant
-  // from the message text.
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "anthropic") {
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      yield { type: "text_delta", text: "hello from codex" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
-    assert.equal(streamedModels.length, 1);
-    assert.equal(streamedModels[0].provider, "openai-codex");
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-    assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("all invalid refresh credentials surface an auth terminal instead of a typed cooldown", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic-stale", { expires: 1 })]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex-stale", { expires: 1 })]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  rotationModule.__setRefreshForProviderForTest(async () => {
-    throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant"}');
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    const terminal = emitted.find((event) => event.type === "error");
-    assert.ok(terminal, "all invalid credentials must terminate the turn");
-    assert.match(terminal.error.errorMessage, /authentication failed.*invalid_grant/i);
-    assert.equal(terminal.error.diagnostics, undefined, "an auth failure must not carry the auto-cooling diagnostic");
-    assert.equal(helpers.readSubscriptionPool("anthropic")[0].authFailure, "invalid_grant");
-    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].authFailure, "invalid_grant");
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-  }
-});
-
-test("automatically reauthenticates invalid refresh tokens when UI is available", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  ctx.ui.notify = () => {};
-  const loginCalls: string[] = [];
-  const streamedOptions: any[] = [];
-  // Plain Error, no typed .status: the pool path still recognizes invalid_grant
-  // from the message text.
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "anthropic") {
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setLoginForProviderForTest(async (providerId) => {
-    loginCalls.push(providerId);
-    return { refresh: "refresh-fresh", access: "access-fresh", expires: Date.now() + 60_000 };
-  });
-  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
-    streamedOptions.push(options);
-    return (async function* () {
-      yield { type: "text_delta", text: "hello after reauth" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(loginCalls, ["anthropic"]);
-    assert.deepEqual(setModelCalls, []);
-    assert.equal(streamedOptions[0].apiKey, "access-fresh");
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    const [stored] = helpers.readSubscriptionPool("anthropic");
-    assert.equal(stored.label, "stale");
-    assert.equal(stored.refresh, "refresh-fresh");
-    assert.equal(stored.access, "access-fresh");
-    assert.equal(stored.rateLimitedUntil, 0);
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setLoginForProviderForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// The real invalid-refresh path must route an explicit Codex reauth through the locked identity
-// gate. A colliding OAuth result is rejected, the old credential remains intact, and the slot is
-// cooled instead of being duplicated or streamed with another slot's quota.
-test("real explicit Codex reauth rejects an account held by another slot", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [
-    credential("stale", { expires: 1, accountId: "acct-old" }),
-    credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }),
-  ]);
-
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  const notes: Array<{ message: string; type?: string }> = [];
-  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "openai-codex") {
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setLoginForProviderForTest(async () => ({
-    refresh: "r-collision",
-    access: "a-collision",
-    expires: Date.now() + 60_000,
-    accountId: "acct-held",
-  }));
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
-    for await (const _event of stream) {
-      // Drain the real managed-provider stream to completion.
-    }
-
-    const pool = helpers.readSubscriptionPool("openai-codex");
-    const stale = pool.find((entry) => entry.label === "stale");
-    assert.equal(stale?.accountId, "acct-old");
-    assert.equal(stale?.refresh, "refresh-stale");
-    assert.ok((stale?.rateLimitedUntil ?? 0) > Date.now() + 29 * 24 * 60 * 60 * 1000);
-    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
-    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setLoginForProviderForTest(undefined);
-  }
-});
-
-// The default Codex reauth branch uses the same gate before it commits. A colliding login leaves
-// the default pool entry on the original account and keeps both pool identities unique.
-test("real default Codex reauth rejects an explicit slot's account before switching the default entry", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [
-    credential("openai-codex", { refresh: "dead-refresh", access: "stale-access", expires: 1, accountId: "acct-old" }),
-  ]);
-  await helpers.addSubscription("openai-codex", credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }));
-
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.hasUI = true;
-  const notes: Array<{ message: string; type?: string }> = [];
-  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
-  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
-    if (providerId === "openai-codex") {
-      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
-    }
-    throw new Error("unexpected refresh");
-  });
-  rotationModule.__setLoginForProviderForTest(async () => ({
-    refresh: "r-collision",
-    access: "a-collision",
-    expires: Date.now() + 60_000,
-    accountId: "acct-held",
-  }));
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
-    for await (const _event of stream) {
-      // Drain the real managed-provider stream to completion.
-    }
-
-    const pool = helpers.readSubscriptionPool("openai-codex");
-    const slot = pool.find((entry) => entry.label === "openai-codex");
-    assert.equal(slot?.accountId, "acct-old");
-    assert.equal(slot?.refresh, "dead-refresh");
-    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
-    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
-  } finally {
-    rotationModule.__setRefreshForProviderForTest(undefined);
-    rotationModule.__setLoginForProviderForTest(undefined);
-  }
-});
-
-// A resolved-but-unauthenticated fallback stays on the current model and returns an
-// actionable "not authenticated" error when no provider is logged in.
-test("emits an actionable 'not authenticated' error without switching models when neither provider has ever logged in", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-
-  await providerRotationExtension(pi);
-  await events.session_start?.({}, ctx);
-  const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
-  const emitted = [] as any[];
-  for await (const event of stream) emitted.push(event);
-
-  // Never switches to the unauthenticated fallback -- nothing to try it with.
-  assert.deepEqual(setModelCalls, []);
-  assert.equal(emitted.length, 1);
-  assert.equal(emitted[0].type, "error");
-  assert.match(emitted[0].error.errorMessage, /All provider routes exhausted \(tried openai\)/);
-});
-
-// The builtin ladder is available with no user configuration, so a config-less user can still
-// resolve cross-provider fallbacks.
-test("degrades gracefully via the builtin ladder when a config-less user has no cross-provider credentials", async () => {
-  await resetRotationState();
-  writeRawConfig("user", {});
-
-  const ctx = {
-    cwd: nodeCwd,
-    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-    ui: { setStatus() {} },
-    modelRegistry: {
-      find(provider: string, id: string) {
-        if (provider === "anthropic" && id === "claude-opus-4-8") return { provider, id, api: "anthropic-messages" };
-        if (provider === "openai-codex" && id === "gpt-5.6-sol") return { provider, id, api: "openai-codex-responses" };
-        return undefined;
-      },
-      // This scenario models a config-less user with no hand-written non-pool
-      // credential — pool state alone drives authentication here.
-      hasConfiguredAuth() {
-        return false;
-      },
-    },
-  } as any;
-  const setModelCalls: any[] = [];
-  const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
-  const events: Record<string, (...args: any[]) => unknown> = {};
-  const pi = {
-    registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
-      providers[name] = provider;
-    },
-    registerCommand() {},
-    on(eventName: string, handler: (...args: any[]) => unknown) {
-      events[eventName] = handler;
-    },
-    async setModel(model: any) {
-      setModelCalls.push(model);
-      ctx.model = model;
-      return true;
-    },
-    setThinkingLevel() {},
-  } as any;
-
-  process.env.CRTR_MODEL_INTENT = "anthropic/strong";
-  await providerRotationExtension(pi);
-  await events.session_start?.({}, ctx);
-  // Anthropic's pool is empty, so the credential loop never runs. The builtin ladder resolves
-  // a cross-provider target (openai-codex/gpt-5.6-sol), but that provider is also
-  // unauthenticated; the session model stays unchanged and the turn returns actionable advice.
-  const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
-  const emitted = [] as any[];
-  for await (const event of stream) emitted.push(event);
-
-  assert.deepEqual(setModelCalls, []);
-  assert.equal(emitted.length, 1);
-  assert.equal(emitted[0].type, "error");
-  assert.match(emitted[0].error.errorMessage, /All provider routes exhausted \(tried live:anthropic\/claude-opus-4-8\)/);
-  assert.ok(!emitted[0].error.errorMessage.includes("configure a openai ladder"));
-});
-
-// A cooling provider must settle the turn with a typed retry deadline. Holding
-// the stream open here rendered the node as generic `Working...` for five silent
-// minutes and prevented the broker's existing scheduled retry path from owning
-// recovery.
-test("settles a sole provider cooldown with a typed retry deadline instead of sleeping in-stream", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30_000);
-  const expectedDeadline = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
-  let streamCalls = 0;
-  rotationModule.__setStreamForProviderForTest((_model) => {
-    streamCalls += 1;
-    return (async function* () {
-      yield { type: "text_delta", text: "must not stream while cooling" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(sleepCalls, []);
-    assert.equal(streamCalls, 0);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// A fallback that is itself cooling must contribute its earlier deadline without
-// churning the live session model to a provider that cannot serve the turn.
-test("does not switch to a cooling fallback and schedules the earliest provider deadline", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "primary", 60_000);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
-  const expectedDeadline = helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil;
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const sleepCalls: number[] = [];
-  let streamCalls = 0;
-  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
-  rotationModule.__setStreamForProviderForTest((_model) => {
-    streamCalls += 1;
-    return (async function* () {
-      yield { type: "text_delta", text: "must not stream while cooling" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, [], "a cooling fallback does not churn the session model");
-    assert.deepEqual(sleepCalls, []);
-    assert.equal(streamCalls, 0);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// Even an unusually long provider deadline uses the same typed scheduled-retry
-// path; invalid-grant remains separately classified before this branch.
-test("emits a typed rate-limit cooling error for a long provider deadline", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
-  const expectedDeadline = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(sleepCalls, [], "a cooldown past the cap must not sleep in-process");
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    // Rate-limit-classifiable so classify('pi→provider', msg) → rate-limit/auto (not fatal other).
-    assert.match(emitted[0].error.errorMessage, /rate limit/i);
-    // The typed cooling diagnostic carries the exact pool deadline for the stophook.
-    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
-  } finally {
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-test("an excluded invalid_grant credential does not mask a cooling credential", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [
-    credential("dead", { authFailure: "invalid_grant", rateLimitedUntil: Date.now() + 30 * 24 * 60 * 60 * 1000 }),
-    credential("cooling", { rateLimitedUntil: Date.now() + 60_000 }),
-  ]);
-  const expectedDeadline = helpers.readSubscriptionPool("anthropic").find((entry) => entry.label === "cooling")!.rateLimitedUntil;
-
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-
-  await providerRotationExtension(pi);
-  await events.session_start?.({}, ctx);
-  const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
-  const emitted = [] as any[];
-  for await (const event of stream) emitted.push(event);
-
-  assert.equal(emitted.length, 1);
-  assert.equal(emitted[0].type, "error");
-  assert.match(emitted[0].error.errorMessage, /rate limited/i);
-  assert.doesNotMatch(emitted[0].error.errorMessage, /invalid_grant/);
-  assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-  assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
-});
-
-test("a same-turn 429 settles immediately instead of starting cooldown continuations", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  let attempts = 0;
-  let waits = 0;
-  rotationModule.__setSleepForTest(async () => { waits++; });
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    attempts++;
-    return (async function* () {
-      await options?.onResponse?.({ status: 429, headers: { "retry-after": "1" } }, model);
-      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.equal(attempts, 1, "the mocked clock keeps the credential cooling after its first 429");
-    assert.equal(waits, 0, "cooldown recovery never sleeps inside the active turn");
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-  } finally {
-    rotationModule.__setSleepForTest(undefined);
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("does not requeue a zero Retry-After credential without a later success", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  const { ctx, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  let attempts = 0;
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    attempts++;
-    return (async function* () {
-      await options?.onResponse?.({ status: 429, headers: { "retry-after": "0" } }, model);
-      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.equal(attempts, 1, "a zero deadline must not manufacture a fresh candidate");
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// Fresh-availability re-entry (Fix 3a): a credential that becomes ready AFTER the initial
-// `available` snapshot (a concurrent turn's cooldown expiring, or a causally valid success)
-// must be consumed by re-entering the SAME provider, not lost to a stale snapshot that would
-// wrongly declare exhaustion. Start on an unauthenticated Anthropic (empty pool) so the
-// fallback to Codex is already attempted; Codex has A ready + B cooling; A's 429 frees B
-// mid-attempt, so the re-entry must attempt B and stream the turn with no terminal error.
-test("re-enters the same provider to consume a credential that became ready after the initial snapshot", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  // Anthropic unauthenticated (empty) so the turn falls back to Codex immediately.
-  await helpers.writeSubscriptionPool("anthropic", []);
-  // Codex: A ready now, B cooling (absent from the initial ready snapshot).
-  await helpers.writeSubscriptionPool("openai-codex", [
-    credential("A"),
-    credential("B", { rateLimitedUntil: Date.now() + 60_000 }),
-  ]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const streamedModels: any[] = [];
-  let codexAttempt = 0;
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    streamedModels.push(model.provider);
-    return (async function* () {
-      if (model.provider === "openai-codex") {
-        codexAttempt += 1;
-        if (codexAttempt === 1) {
-          // Attempt A: 429 (cools A). Free B mid-attempt so it becomes ready AFTER the
-          // snapshot that only saw A — the fresh-availability condition under test.
-          await options?.onResponse?.({ status: 429, headers: { "retry-after": "5" } }, model);
-          const pool = helpers.readSubscriptionPool("openai-codex");
-          await helpers.writeSubscriptionPool(
-            "openai-codex",
-            pool.map((entry) => (entry.label === "B" ? { ...entry, rateLimitedUntil: 0 } : entry)),
-          );
-          yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-          return;
-        }
-        // Re-entry attempt: B is now ready — serve the turn.
-        yield { type: "text_delta", text: "hello from codex B after re-entry" };
-        return;
-      }
-      yield { type: "text_delta", text: "unexpected" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // Fell back to codex, attempted A (429), then re-entered and attempted B to success.
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
-    assert.equal(codexAttempt, 2, "re-entered the same provider once to consume the freshly-ready credential");
-    assert.ok(emitted.some((e) => e.type === "text_delta"), "the turn was served, not terminally failed");
-    assert.ok(!emitted.some((e) => e.type === "error"), "no terminal all-pools error despite the stale initial snapshot");
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// Both-pools-cooling typed diagnostic (Fix 3b): when EVERY managed pool tried this turn is
-// cooling with a finite future deadline, the terminal error must be rate-limit-classifiable
-// AND carry the typed cooling diagnostic whose deadline is the exact MINIMUM across the tried
-// pools (so the stophook stamps retry.nextAt at the soonest pool free-up).
-test("both pools cooling: emits a rate-limit-classifiable terminal carrying the exact earliest deadline as a typed diagnostic", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  const now = Date.now();
-  const anthropicDeadline = now + 10 * 60_000; // earliest
-  const codexDeadline = now + 20 * 60_000;
-  await helpers.writeSubscriptionPool("anthropic", [credential("a", { rateLimitedUntil: anthropicDeadline })]);
-  await helpers.writeSubscriptionPool("openai-codex", [credential("c", { rateLimitedUntil: codexDeadline })]);
-  const expectedMin = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const sleepCalls: number[] = [];
-  rotationModule.__setSleepForTest(async (ms) => {
-    sleepCalls.push(ms);
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // A cooling fallback contributes its deadline without churning the live model.
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(sleepCalls, [], "cooldowns are never waited out in-process");
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.match(emitted[0].error.errorMessage, /rate limit/i, "classifiable as rate-limit (auto), not fatal other");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-    assert.equal(
-      emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil,
-      expectedMin,
-      "the diagnostic carries the exact MINIMUM deadline across both tried pools",
-    );
-  } finally {
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// A 429 observed during this provider call must author the deadline from the
-// freshly-mutated pool, without retrying or sleeping inside the active turn.
-test("schedules a sole credential cooldown observed in this turn from fresh pool state", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  // openai-codex pool stays empty -- no authenticated fallback to switch to.
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-  const sleepCalls: number[] = [];
-  let anthropicCalls = 0;
-  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
-  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
-    return (async function* () {
-      anthropicCalls += 1;
-      if (anthropicCalls === 1) {
-        await options?.onResponse?.({ status: 429, headers: { "retry-after": "1" } }, model);
-        yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
-        return;
-      }
-      yield { type: "text_delta", text: "must not retry inside this turn" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["anthropic"].streamSimple(
-      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.deepEqual(sleepCalls, []);
-    assert.equal(anthropicCalls, 1);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].type, "error");
-    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-    rotationModule.__setSleepForTest(undefined);
-  }
-});
-
-// pi-ai's Codex adapter can surface a genuine usage-limit exhaustion on a non-429
-// status. Without Retry-After it is local to this turn (never a global gate),
-// while the authenticated fallback still serves the same turn.
-test("treats a headerless Codex usage-limit message as turn-local and falls back", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
-  const streamedModels: any[] = [];
-  rotationModule.__setStreamForProviderForTest((model) => {
-    streamedModels.push(model);
-    return (async function* () {
-      if (model.provider === "openai-codex") {
-        yield {
-          type: "error",
-          error: Object.assign(new Error("You have hit your ChatGPT usage limit. Please try again later."), {
-            status: 403,
-            errorMessage: "You have hit your ChatGPT usage limit. usage_limit_reached",
-          }),
-        };
-        return;
-      }
-      yield { type: "text_delta", text: "hello from anthropic fallback" };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const stream = providers["openai-codex"].streamSimple(
-      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
-      ctx,
-    );
-    const emitted = [] as any[];
-    for await (const event of stream) emitted.push(event);
-
-    // A headerless usage-limit signal is turn-local: it proves this request
-    // failed, not that unrelated brokers sharing the credential are cooling.
-    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
-    // Fell back to the authenticated Anthropic subscription and served the turn on it.
-    assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
-    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 1);
-    assert.ok(emitted.some((e) => e.type === "text_delta"));
-    assert.ok(!emitted.some((e) => e.type === "error"));
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-test("a concrete model's headerless usage-limit stays turn-local and carries its retry deadline", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
-  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx(undefined);
-  ctx.model = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
-  rotationModule.__setStreamForProviderForTest(() => {
-    return (async function* () {
-      yield {
-        type: "error",
-        error: Object.assign(new Error("You have hit your ChatGPT usage limit."), {
-          status: 403,
-          errorMessage: "usage_limit_reached",
-        }),
-      };
-    })() as any;
-  });
-
-  try {
-    await providerRotationExtension(pi);
-    await events.session_start?.({}, ctx);
-    const before = Date.now();
-    const emitted = [] as any[];
-    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
-
-    assert.deepEqual(setModelCalls, []);
-    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
-    assert.equal(emitted.length, 1);
-    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
-    const deadline = emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil;
-    assert.ok(deadline >= before + 14_000 && deadline <= Date.now() + 15_000);
-  } finally {
-    rotationModule.__setStreamForProviderForTest(undefined);
-  }
-});
-
-// Provider-management removal routing and login coordination
-
-function readAuthRecord(providerId: string): unknown {
-  const authPath = join(home, ".pi", "agent", "auth.json");
-  if (!existsSync(authPath)) return undefined;
-  return (JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>)[providerId];
-}
-
-// Removing a managed provider from its HEADER row (no label -- the default cursor position) tears
-// down the WHOLE pool, not just the account: a surviving explicit account would stay
-// configured and keep serving turns while the panel said "Removed".
-test("removeProviderRow on a managed HEADER row clears the whole pool", async () => {
-  await resetRotationState();
-  await helpers.upsertSubscription("anthropic", credential("anthropic"));
-  await helpers.upsertSubscription("anthropic", credential("work"));
-  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "anthropic"), "pool account present");
-  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "work"), "explicit account present");
-
-  const notice = await providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
-    providerId: "anthropic",
-    name: "Claude",
-    managed: true,
-    configured: true,
-    // no label -> the provider header row
-  });
-
-  assert.equal(notice, "Removed Claude");
-  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [], "pool fully torn down");
-});
-
-// An account ROW (has a label) removes just that account and leaves the rest of the pool intact.
-test("removeProviderRow on a managed account row removes only that account", async () => {
-  await resetRotationState();
-  await helpers.upsertSubscription("anthropic", credential("anthropic"));
-  await helpers.upsertSubscription("anthropic", credential("work"));
-
-  const notice = await providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
-    providerId: "anthropic",
-    name: "Claude",
-    managed: true,
-    label: "work",
-  });
-
-  assert.equal(notice, "Removed Claude account");
-  const remaining = helpers.readSubscriptionPool("anthropic");
-  assert.deepEqual(
-    remaining.map((e) => e.label),
-    ["anthropic"],
-    "only the pool account remains",
-  );
-  assert.equal(remaining[0].refresh, "refresh-anthropic", "the pool account keeps its own token");
-});
-
-// Managed login commits the pool account through commitManagedLogin; the default pool entry
-// carries its tokens and auth.json has no managed OAuth record.
-test("commitManagedLogin pool account writes tokens into the default pool entry, not auth.json", async () => {
-  await resetRotationState();
-  await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "r1", access: "a1", expires: Date.now() + 60_000, accountId: "acct-1", lastRateLimitedAt: 0 });
-
-  const slot = helpers.readSubscriptionPool("anthropic").find((e) => e.label === "anthropic");
-  assert.ok(slot, "pool account present");
-  assert.equal(slot?.accountId, "acct-1", "pool pool account carries the identity");
-  assert.equal(slot?.refresh, "r1", "pool pool account carries its own token");
-  assert.equal(readAuthRecord("anthropic"), undefined, "no auth.json record written for a managed login");
-});
-
-// A managed login that identifies an existing account refreshes that row rather than creating a
-// second quota slot under the requested label.
-test("commitManagedLogin updates an existing account identity", async () => {
-  await resetRotationState();
-  await helpers.commitManagedLogin("openai-codex", "first", { refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: "dup", lastRateLimitedAt: 0 });
-  await helpers.commitManagedLogin("openai-codex", "second", { refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "dup", lastRateLimitedAt: 0 });
-  const pool = helpers.readSubscriptionPool("openai-codex");
-  assert.equal(pool.length, 1);
-  assert.equal(pool[0].label, "first");
-  assert.equal(pool[0].refresh, "r2");
-});
-
-// A provider with NO account must never be switched onto: rotation would move the session model
-// onto a provider pi cannot serve, and the next turn dies with the non-retryable
-// `Provider is not configured: openai-codex`, which no agent can clear from inside a turn that
-// fails before it starts.
-test("a provider with no account: rotation never switches onto it", async () => {
-  await resetRotationState();
-  writeLadderConfig();
-  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
-  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
-  await helpers.writeSubscriptionPool("openai-codex", []);
-  assert.equal(helpers.readSubscriptionPool("openai-codex").length, 0, "no account stored");
-
-  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
-  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
-
-  await providerRotationExtension(pi);
-  await events.session_start?.({}, ctx);
-  const stream = providers["anthropic"].streamSimple(
-    { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
-    ctx,
-  );
-  const emitted = [] as any[];
-  for await (const event of stream) emitted.push(event);
-
-  assert.deepEqual(setModelCalls, [], "never switches the session model onto an unconfigured provider");
-  assert.equal(emitted.length, 1);
-  assert.equal(emitted[0].type, "error");
-  // An unauthenticated fallback never receives a model switch, while the live route's cooldown remains actionable.
-  assert.match(emitted[0].error.errorMessage, /All provider routes are rate limited/);
-});
-
-
-test("Anthropic profile enrichment reads the real account identity", async () => {
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async () => new Response(JSON.stringify({ account: { uuid: "account-a", email: "a@example.test" } }), { status: 200 });
-  try {
-    assert.deepEqual(
-      await helpers.enrichManagedLoginIdentity("anthropic", { access: "test-access" }),
-      { accountId: "account-a", email: "a@example.test" },
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("a failed Anthropic profile lookup leaves identity unknown", async () => {
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async () => { throw new Error("profile unavailable"); };
-  try {
-    assert.deepEqual(await helpers.enrichManagedLoginIdentity("anthropic", { access: "test-access" }), {});
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("Anthropic managed login auto-labels new accounts and updates the matching account", async () => {
-  await resetRotationState();
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async (_url, options) => {
-    const access = (options as RequestInit).headers as Record<string, string>;
-    const account = access.Authorization === "Bearer a1" || access.Authorization === "Bearer a2"
-      ? { uuid: "account-a", email: "a@example.test" }
-      : { uuid: "account-b", email: "b@example.test" };
-    return new Response(JSON.stringify({ account }), { status: 200 });
-  };
-  try {
-    const expires = Date.now() + 60_000;
-    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-a1", access: "a1", expires, lastRateLimitedAt: 0, autoLabel: true });
-    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-a2", access: "a2", expires, lastRateLimitedAt: 0, autoLabel: true });
-    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-b", access: "b", expires, lastRateLimitedAt: 0, autoLabel: true });
-    const pool = helpers.readSubscriptionPool("anthropic");
-    assert.deepEqual(pool.map((entry) => entry.label), ["a@example.test", "b@example.test"]);
-    assert.equal(pool[0]?.refresh, "refresh-a2");
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("managed login preserves a cooldown newer than its login snapshot", async () => {
-  await resetRotationState();
-  await helpers.writeSubscriptionPool("openai-codex", [credential("personal", { accountId: "account-a", lastRateLimitedAt: 100, rateLimitedUntil: 60_100 })]);
-  await helpers.commitManagedLogin("openai-codex", "personal", {
-    refresh: "refresh-new",
-    access: "access-new",
-    expires: Date.now() + 60_000,
-    accountId: "account-a",
-    lastRateLimitedAt: 0,
-  });
-  const [entry] = helpers.readSubscriptionPool("openai-codex");
-  assert.equal(entry.rateLimitedUntil, 60_100);
-  assert.equal(entry.lastRateLimitedAt, 100);
-});