cartethyia 2.7.1 → 2.7.3

package/src/transport/dispatch/empty-stream.ts

@@ -1,224 +1,224 @@
-/**
- * Empty-stream replay + pre-start failover.
- *
- * When a provider returns HTTP 200 but the response body decodes to zero
- * meaningful events, the request is replayed byte-identical (same headers,
- * same body) up to `maxEmptyReplays` times with exponential backoff. If all
- * replays on one endpoint fail, the helper advances to the next endpoint in
- * the caller-supplied ordered list.
- *
- * The helper is transport-layer: it owns fetch, watchdog, backoff, and
- * endpoint rotation. The caller owns SSE decoding via the `DrainStream`
- * callback and supplies materialized headers + serialized body so replays
- * are byte-identical.
- *
- * Design: the replay count, backoff, and the ordered endpoint list are the
- * caller's contract; this helper owns fetch, watchdog, and rotation so a
- * provider that answers 200 with no events is retried on the next endpoint
- * rather than surfacing an empty body to the client.
- */
-import { GatewayError } from "../../protocol/gateway-error";
-import {
-  fallbackRetryDelayMs,
-  MIN_RETRY_BUDGET_MS,
-  sleep as abortableSleep,
-} from "../failure-policy";
-
-// ─── Public types ──────────────────────────────────────────────────────────
-
-/** What the caller's drain observed. Counts only dispatched data events:
- *  comments/keepalives, `[DONE]`, and whitespace-only data are excluded. */
-export interface StreamTally {
-  readonly dataEvents: number;
-  readonly meaningful: boolean;
-  readonly thoughtOnly: boolean;
-}
-
-/** Drain one response body to a tally. Provider-supplied; uses decodeSseEvents. */
-export type DrainStream = (response: Response, signal: AbortSignal) => Promise<StreamTally>;
-
-/** Bound fetch for one endpoint. Receives materialized headers + serialized body. */
-export type EmptyStreamFetch = (
-  url: string,
-  init: { headers: Record<string, string>; body: string; signal: AbortSignal },
-) => Promise<Response>;
-
-/**
- * Retry-delay policy.
- *
- * Delays come from `fallbackRetryDelayMs` (capped exponential with full
- * jitter), whose base and cap are operator-tunable. There is deliberately no
- * per-caller base: the local formula this replaced was uncapped and
- * unjittered, so a provider returning 200-with-no-events could drive an
- * unbounded wait, and concurrent clients could resynchronize their retries.
- */
-export interface EmptyStreamPolicy {
-  readonly maxEmptyReplays?: number;
-  readonly firstEventTimeoutMs?: number;
-  readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
-}
-
-export interface EmptyStreamResult {
-  readonly response: Response;
-  readonly tally: StreamTally;
-  readonly endpoint: string;
-  readonly replaysUsed: number;
-}
-
-// ─── Defaults ──────────────────────────────────────────────────────────────
-
-const DEFAULT_MAX_REPLAYS = 2;
-const DEFAULT_FIRST_EVENT_TIMEOUT_MS = 200_000; // 200s, matches CARTETHYIA_STREAM_FIRST_CHUNK_TIMEOUT_MS default
-
-
-// ─── Helpers ───────────────────────────────────────────────────────────────
-
-/** Pure predicate: zero data events, or data events with nothing meaningful. */
-export function isEmptyStream(tally: StreamTally): boolean {
-  return tally.dataEvents === 0 || (!tally.meaningful && !tally.thoughtOnly);
-}
-
-
-
-// ─── Main function ─────────────────────────────────────────────────────────
-
-/**
- * Replays the byte-identical request while responses drain empty,
- * failing over across ordered endpoints pre-start.
- *
- * Throws GatewayError (platform_unavailable, 502, upstream) on exhaustion,
- * GatewayError (deadline_exceeded, 504, upstream) when a first event never
- * arrives within the window, and GatewayError (transport_closed, 499) on
- * client abort.
- */
-export async function fetchWithEmptyStreamRecovery(
-  endpoints: readonly string[],
-  request: { headers: Record<string, string>; body: string },
-  deps: {
-    fetch: EmptyStreamFetch;
-    drain: DrainStream;
-    signal: AbortSignal;
-    deadlineMs: number;
-    policy?: EmptyStreamPolicy;
-  },
-): Promise<EmptyStreamResult> {
-  const maxReplays = deps.policy?.maxEmptyReplays ?? DEFAULT_MAX_REPLAYS;
-  const firstEventTimeout = deps.policy?.firstEventTimeoutMs ?? DEFAULT_FIRST_EVENT_TIMEOUT_MS;
-  const sleep = deps.policy?.sleep ?? abortableSleep;
-
-  if (endpoints.length === 0) {
-    throw new GatewayError("platform_unavailable", 502, "No endpoints available", {}, "upstream");
-  }
-
-  for (let endpointIndex = 0; endpointIndex < endpoints.length; endpointIndex++) {
-    const endpoint = endpoints[endpointIndex]!;
-    const isLastEndpoint = endpointIndex === endpoints.length - 1;
-    const replaysAllowed = isLastEndpoint ? maxReplays : maxReplays;
-
-    for (let replay = 0; replay <= replaysAllowed; replay++) {
-      // Check abort before each fetch
-      if (deps.signal.aborted) {
-        throw new GatewayError("transport_closed", 499, "Aborted");
-      }
-
-      // Check deadline floor
-      const now = Date.now();
-      const remaining = deps.deadlineMs - now;
-      if (remaining < MIN_RETRY_BUDGET_MS) {
-        throw new GatewayError(
-          "platform_unavailable",
-          502,
-          "Deadline exhausted before empty-stream replay",
-          {},
-          "upstream",
-        );
-      }
-
-      const fetchTimeout = Math.min(firstEventTimeout, remaining);
-
-      let response: Response;
-      try {
-        response = await fetchWithTimeout(deps.fetch, endpoint, request, deps.signal, fetchTimeout);
-      } catch (error) {
-        if (error instanceof GatewayError) throw error;
-        break; // advance to next endpoint
-      }
-
-      // Drain the response
-      let tally: StreamTally;
-      try {
-        tally = await deps.drain(response, deps.signal);
-      } catch (error) {
-        if (error instanceof GatewayError) throw error;
-        break; // advance to next endpoint
-      }
-
-      // Check if empty
-      if (!isEmptyStream(tally)) {
-        // Success — return the response and tally
-        return {
-          response,
-          tally,
-          endpoint,
-          replaysUsed: replay,
-        };
-      }
-
-      // Empty — replay if we haven't exhausted this endpoint's budget
-      if (replay < replaysAllowed) {
-        const delay = fallbackRetryDelayMs(replay);
-        try {
-          await sleep(delay, deps.signal);
-        } catch (error) {
-          if (error instanceof GatewayError) throw error;
-          throw error;
-        }
-      }
-    }
-  }
-
-  // All endpoints exhausted
-  throw new GatewayError(
-    "platform_unavailable",
-    502,
-    "All endpoints returned empty streams",
-    {},
-    "upstream",
-  );
-}
-
-// ─── Internal helpers ──────────────────────────────────────────────────────
-
-async function fetchWithTimeout(
-  fetch: EmptyStreamFetch,
-  url: string,
-  request: { headers: Record<string, string>; body: string },
-  signal: AbortSignal,
-  timeoutMs: number,
-): Promise<Response> {
-  // Race the fetch against a first-event timeout
-  const timeoutPromise = new Promise<never>((_, reject) => {
-    const timer = setTimeout(() => {
-      // A first-event timeout is the gateway waiting on a silent upstream (e.g.
-      // a provider that holds the request in a queue), not the client leaving.
-      // It must surface as a deadline failure, never as a `transport_closed`
-      // 499 — that code is reserved for genuine client cancellations and would
-      // otherwise hide a real upstream wait behind "cancelled by client".
-      reject(new GatewayError("deadline_exceeded", 504, "First event timeout", {}, "upstream"));
-    }, timeoutMs);
-    signal.addEventListener("abort", () => {
-      clearTimeout(timer);
-      reject(new GatewayError("transport_closed", 499, "Aborted"));
-    }, { once: true });
-  });
-
-  try {
-    return await Promise.race([
-      fetch(url, { headers: request.headers, body: request.body, signal }),
-      timeoutPromise,
-    ]);
-  } catch (error) {
-    if (error instanceof GatewayError) throw error;
-    throw error;
-  }
-}
+/**
+ * Empty-stream replay + pre-start failover.
+ *
+ * When a provider returns HTTP 200 but the response body decodes to zero
+ * meaningful events, the request is replayed byte-identical (same headers,
+ * same body) up to `maxEmptyReplays` times with exponential backoff. If all
+ * replays on one endpoint fail, the helper advances to the next endpoint in
+ * the caller-supplied ordered list.
+ *
+ * The helper is transport-layer: it owns fetch, watchdog, backoff, and
+ * endpoint rotation. The caller owns SSE decoding via the `DrainStream`
+ * callback and supplies materialized headers + serialized body so replays
+ * are byte-identical.
+ *
+ * Design: the replay count, backoff, and the ordered endpoint list are the
+ * caller's contract; this helper owns fetch, watchdog, and rotation so a
+ * provider that answers 200 with no events is retried on the next endpoint
+ * rather than surfacing an empty body to the client.
+ */
+import { GatewayError } from "../../protocol/gateway-error";
+import {
+  fallbackRetryDelayMs,
+  MIN_RETRY_BUDGET_MS,
+  sleep as abortableSleep,
+} from "../failure-policy";
+
+// ─── Public types ──────────────────────────────────────────────────────────
+
+/** What the caller's drain observed. Counts only dispatched data events:
+ *  comments/keepalives, `[DONE]`, and whitespace-only data are excluded. */
+export interface StreamTally {
+  readonly dataEvents: number;
+  readonly meaningful: boolean;
+  readonly thoughtOnly: boolean;
+}
+
+/** Drain one response body to a tally. Provider-supplied; uses decodeSseEvents. */
+export type DrainStream = (response: Response, signal: AbortSignal) => Promise<StreamTally>;
+
+/** Bound fetch for one endpoint. Receives materialized headers + serialized body. */
+export type EmptyStreamFetch = (
+  url: string,
+  init: { headers: Record<string, string>; body: string; signal: AbortSignal },
+) => Promise<Response>;
+
+/**
+ * Retry-delay policy.
+ *
+ * Delays come from `fallbackRetryDelayMs` (capped exponential with full
+ * jitter), whose base and cap are operator-tunable. There is deliberately no
+ * per-caller base: the local formula this replaced was uncapped and
+ * unjittered, so a provider returning 200-with-no-events could drive an
+ * unbounded wait, and concurrent clients could resynchronize their retries.
+ */
+export interface EmptyStreamPolicy {
+  readonly maxEmptyReplays?: number;
+  readonly firstEventTimeoutMs?: number;
+  readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+}
+
+export interface EmptyStreamResult {
+  readonly response: Response;
+  readonly tally: StreamTally;
+  readonly endpoint: string;
+  readonly replaysUsed: number;
+}
+
+// ─── Defaults ──────────────────────────────────────────────────────────────
+
+const DEFAULT_MAX_REPLAYS = 2;
+const DEFAULT_FIRST_EVENT_TIMEOUT_MS = 200_000; // 200s, matches CARTETHYIA_STREAM_FIRST_CHUNK_TIMEOUT_MS default
+
+
+// ─── Helpers ───────────────────────────────────────────────────────────────
+
+/** Pure predicate: zero data events, or data events with nothing meaningful. */
+export function isEmptyStream(tally: StreamTally): boolean {
+  return tally.dataEvents === 0 || (!tally.meaningful && !tally.thoughtOnly);
+}
+
+
+
+// ─── Main function ─────────────────────────────────────────────────────────
+
+/**
+ * Replays the byte-identical request while responses drain empty,
+ * failing over across ordered endpoints pre-start.
+ *
+ * Throws GatewayError (platform_unavailable, 502, upstream) on exhaustion,
+ * GatewayError (deadline_exceeded, 504, upstream) when a first event never
+ * arrives within the window, and GatewayError (transport_closed, 499) on
+ * client abort.
+ */
+export async function fetchWithEmptyStreamRecovery(
+  endpoints: readonly string[],
+  request: { headers: Record<string, string>; body: string },
+  deps: {
+    fetch: EmptyStreamFetch;
+    drain: DrainStream;
+    signal: AbortSignal;
+    deadlineMs: number;
+    policy?: EmptyStreamPolicy;
+  },
+): Promise<EmptyStreamResult> {
+  const maxReplays = deps.policy?.maxEmptyReplays ?? DEFAULT_MAX_REPLAYS;
+  const firstEventTimeout = deps.policy?.firstEventTimeoutMs ?? DEFAULT_FIRST_EVENT_TIMEOUT_MS;
+  const sleep = deps.policy?.sleep ?? abortableSleep;
+
+  if (endpoints.length === 0) {
+    throw new GatewayError("platform_unavailable", 502, "No endpoints available", {}, "upstream");
+  }
+
+  for (let endpointIndex = 0; endpointIndex < endpoints.length; endpointIndex++) {
+    const endpoint = endpoints[endpointIndex]!;
+    const isLastEndpoint = endpointIndex === endpoints.length - 1;
+    const replaysAllowed = isLastEndpoint ? maxReplays : maxReplays;
+
+    for (let replay = 0; replay <= replaysAllowed; replay++) {
+      // Check abort before each fetch
+      if (deps.signal.aborted) {
+        throw new GatewayError("transport_closed", 499, "Aborted");
+      }
+
+      // Check deadline floor
+      const now = Date.now();
+      const remaining = deps.deadlineMs - now;
+      if (remaining < MIN_RETRY_BUDGET_MS) {
+        throw new GatewayError(
+          "platform_unavailable",
+          502,
+          "Deadline exhausted before empty-stream replay",
+          {},
+          "upstream",
+        );
+      }
+
+      const fetchTimeout = Math.min(firstEventTimeout, remaining);
+
+      let response: Response;
+      try {
+        response = await fetchWithTimeout(deps.fetch, endpoint, request, deps.signal, fetchTimeout);
+      } catch (error) {
+        if (error instanceof GatewayError) throw error;
+        break; // advance to next endpoint
+      }
+
+      // Drain the response
+      let tally: StreamTally;
+      try {
+        tally = await deps.drain(response, deps.signal);
+      } catch (error) {
+        if (error instanceof GatewayError) throw error;
+        break; // advance to next endpoint
+      }
+
+      // Check if empty
+      if (!isEmptyStream(tally)) {
+        // Success — return the response and tally
+        return {
+          response,
+          tally,
+          endpoint,
+          replaysUsed: replay,
+        };
+      }
+
+      // Empty — replay if we haven't exhausted this endpoint's budget
+      if (replay < replaysAllowed) {
+        const delay = fallbackRetryDelayMs(replay);
+        try {
+          await sleep(delay, deps.signal);
+        } catch (error) {
+          if (error instanceof GatewayError) throw error;
+          throw error;
+        }
+      }
+    }
+  }
+
+  // All endpoints exhausted
+  throw new GatewayError(
+    "platform_unavailable",
+    502,
+    "All endpoints returned empty streams",
+    {},
+    "upstream",
+  );
+}
+
+// ─── Internal helpers ──────────────────────────────────────────────────────
+
+async function fetchWithTimeout(
+  fetch: EmptyStreamFetch,
+  url: string,
+  request: { headers: Record<string, string>; body: string },
+  signal: AbortSignal,
+  timeoutMs: number,
+): Promise<Response> {
+  // Race the fetch against a first-event timeout
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    const timer = setTimeout(() => {
+      // A first-event timeout is the gateway waiting on a silent upstream (e.g.
+      // a provider that holds the request in a queue), not the client leaving.
+      // It must surface as a deadline failure, never as a `transport_closed`
+      // 499 — that code is reserved for genuine client cancellations and would
+      // otherwise hide a real upstream wait behind "cancelled by client".
+      reject(new GatewayError("deadline_exceeded", 504, "First event timeout", {}, "upstream"));
+    }, timeoutMs);
+    signal.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(new GatewayError("transport_closed", 499, "Aborted"));
+    }, { once: true });
+  });
+
+  try {
+    return await Promise.race([
+      fetch(url, { headers: request.headers, body: request.body, signal }),
+      timeoutPromise,
+    ]);
+  } catch (error) {
+    if (error instanceof GatewayError) throw error;
+    throw error;
+  }
+}

package/src/transport/dispatch/proxy-request.ts

@@ -1,6 +1,9 @@
 import { isBundledProviderId } from "../../providers/provider-contracts";
 import type { ProviderDispatchContext, ProviderId, ProviderAdapter } from "../../providers/provider-contracts";
 import { GatewayError } from "../../protocol/gateway-error";
+import { isWrappedInjectionProvider } from "../../console/system-prompt/contracts";
+import { resolveTenantSystemPrompt } from "../request/system-prompt-injection";
+import { readTenantSystemPromptsForDispatch } from "../request/tenant-preferences";
 import type { CanonicalEvent } from "../../protocol/canonical-model";
 import { resolveCredentialForAccount } from "../../providers/operations/provider-credential-service";
 import type { ByokUpstreamHost } from "../../providers/operations/provider-catalog-service";
@@ -115,6 +118,26 @@ export async function handleProviderProxyRequest(
   if (!prepared)
     throw new GatewayError("admission_unavailable", 503, "The request was not prepared, so no route can be dialed. Resend the request.");
   const canonicalRequest = await applyTenantPreferences(prepared, deps.db);
+  // Tenant system-prompt injection, resolved once per request. For providers
+  // whose upstream validates the fixed system prompt as a channel identity
+  // (the buddy family), the text cannot ride the canonical `system` array —
+  // the adapter replaces it — so it travels through dispatch context and the
+  // adapter folds it into its fixed turn, wrapped in the gateway's markers.
+  // `override` degrades to wrapped append there: stripping the identity would
+  // have the upstream refuse the request outright.
+  const candidateForPrompt = prepared.candidate;
+  const tenantSystemPromptText = isWrappedInjectionProvider(candidateForPrompt.provider_id)
+    ? resolveTenantSystemPrompt(
+        await readTenantSystemPromptsForDispatch(
+          deps.db,
+          prepared.authorization.snapshot.tenant_id,
+        ),
+        {
+          providerId: candidateForPrompt.provider_id,
+          modelId: candidateForPrompt.model_id,
+        },
+      )?.text
+    : undefined;
   // Per-tenant timeout, applied as soon as the tenant is known. The deadline
   // was armed at admission with the deployment default; this re-arms it.
   await applyTenantDeadlineOverride(
@@ -153,8 +176,13 @@ export async function handleProviderProxyRequest(
       estimatedOutputTokens: prepared.estimatedOutputTokens,
       authorizationSnapshot: prepared.authorization.snapshot,
       // A continuation borrows the held Cursor Run: one upstream turn must not
-      // occupy two account/pool concurrency slots.
-      ...(prepared.continuationAffinity === undefined ? {} : { borrowsHeldSession: true }),
+      // occupy two account/pool concurrency slots. A rebaseable continuation
+      // (complete history, pinned account no longer routable) does NOT borrow —
+      // it starts a fresh Run on a newly selected account, so it leases like a
+      // normal request.
+      ...(prepared.continuationAffinity === undefined || prepared.continuationAffinity.rebaseable
+        ? {}
+        : { borrowsHeldSession: true }),
     },
     candidates: attemptCandidates,
     tenantId: prepared.authorization.tenantId,
@@ -231,6 +259,7 @@ export async function handleProviderProxyRequest(
           ? {}
           : { imageClampMaxBytes: state.imageClampMaxBytes }),
         ...(conversationAffinity ? { conversationAffinity } : {}),
+        ...(tenantSystemPromptText === undefined ? {} : { tenantSystemPrompt: tenantSystemPromptText }),
         ...(candidate.user_agent === undefined ? {} : { userAgent: candidate.user_agent }),
         ...(deps.networkBindingFactory
           ? {

package/src/transport/dispatch/streaming/stream.ts

@@ -50,7 +50,9 @@ import {
   resolveCaptureModeForRequest,
   shouldCaptureProviderBodyForRequest,
 } from "../capture-policy";
-import { resolveTenantImageClampMaxBytes } from "../../request/tenant-preferences";
+import { resolveTenantImageClampMaxBytes, readTenantSystemPromptsForDispatch } from "../../request/tenant-preferences";
+import { resolveTenantSystemPrompt } from "../../request/system-prompt-injection";
+import { isWrappedInjectionProvider } from "../../../console/system-prompt/contracts";
 import { proxySuccessHeaders, buildUpstreamDispatchContext } from "../upstream";
 import type { AttemptLeaseOwnership } from "../leases";
 import type { ProviderContinuationScope } from "../../../providers/provider-contracts";
@@ -217,6 +219,19 @@ export async function dispatchStreamingAttempt(input: StreamingDispatchInput): P
       ? {}
       : { imageClampMaxBytes: state.imageClampMaxBytes }),
     ...(conversationAffinity ? { conversationAffinity } : {}),
+    // Same wrapped-injection text the non-streaming path carries: providers
+    // whose upstream validates the fixed system prompt as a channel identity
+    // (the buddy family) receive the tenant prompt through dispatch context
+    // so the adapter can fold it into its fixed turn. `override` degrades to
+    // wrapped append there; stripping the identity would be refused outright.
+    ...(await (async () => {
+      if (!isWrappedInjectionProvider(candidate.provider_id)) return {};
+      const text = resolveTenantSystemPrompt(
+        await readTenantSystemPromptsForDispatch(deps.db, prepared.authorization.snapshot.tenant_id),
+        { providerId: candidate.provider_id, modelId: candidate.model_id },
+      )?.text;
+      return text === undefined ? {} : { tenantSystemPrompt: text };
+    })()),
     ...(candidate.user_agent === undefined ? {} : { userAgent: candidate.user_agent }),
     ...(wrappedOutboundFetch ? { outboundFetch: wrappedOutboundFetch } : {}),
     ...(outboundFetch ? { outboundAttachmentFetch: outboundFetch } : {}),

package/src/transport/dispatch/upstream.ts

@@ -61,6 +61,13 @@ export function buildUpstreamDispatchContext(input: {
    * database handle.
    */
   readonly imageClampMaxBytes?: number;
+  /**
+   * Tenant system-prompt text resolved once per request (append/override
+   * injection). Carried through dispatch because the buddy adapters fold it
+   * into their fixed system turn after serialization — the canonical level
+   * cannot reach that turn.
+   */
+  readonly tenantSystemPrompt?: string;
   /** Opaque identity shared by retries of one logical gateway request. */
   readonly requestIdentity?: object;
 }): Record<string, unknown> {
@@ -101,6 +108,9 @@ export function buildUpstreamDispatchContext(input: {
     ...(input.imageClampMaxBytes === undefined
       ? {}
       : { image_clamp_max_bytes: input.imageClampMaxBytes }),
+    ...(input.tenantSystemPrompt === undefined
+      ? {}
+      : { tenant_system_prompt: input.tenantSystemPrompt }),
     ...(input.requestIdentity ? { request_identity: input.requestIdentity } : {}),
   } as Record<string, unknown>;
 }

package/src/transport/failure-policy.ts

@@ -2,6 +2,7 @@ import { GatewayError, type GatewayErrorCode, type GatewayErrorOrigin } from "..
 import { isRecord } from "../protocol/codecs";
 import { resolveFallbackRetryBaseMs, resolveFallbackRetryCapMs } from "../config/timeouts";
 import { parseUpstreamBackoff } from "../protocol/upstream-parsing";
+import { resolveAccountQuotaCooldownMs } from "../config/cooldowns";
 
 /**
  * How much of the upstream's error body is kept and surfaced.
@@ -232,6 +233,31 @@ export function classifyUpstreamFailure(error: unknown): UpstreamFailurePolicy {
   // DNS failure. Failing the client request instead of failing over is the wrong
   // outcome for a whole class the table already names as platform-wide.
   const statusCode = error.status;
+  // Qoder answers an exhausted quota by closing the stream with an upstream 499
+  // (nginx client-close style). That is a refusal from the upstream — the
+  // gateway's own aborts are `transport_closed`, produced locally, and never
+  // carry a qoder providerId — so a 499 scoped to qoder is quota, not a
+  // malformed request. Without this it fell through to `invalid_request`
+  // (non-retryable, no cooldown) and the account was re-dialled on every
+  // request inside the exhausted window until a late 429 finally classified it.
+  if (
+    error.origin === "upstream" &&
+    statusCode === 499 &&
+    (providerId === "qoder" || providerId === "qodercn")
+  ) {
+    const cooldownMs = resolveAccountQuotaCooldownMs();
+    return {
+      retryable: true,
+      mutatesAccount: true,
+      category: "quota_exceeded",
+      scope: "account",
+      origin: error.origin,
+      ...(providerCode ? { providerCode } : {}),
+      ...(providerId ? { providerId } : {}),
+      cooldownMs,
+      statusCode,
+    };
+  }
   const retryableByStatus =
     statusCode === 401 ||
     statusCode === 403 ||
@@ -459,6 +485,13 @@ const CONTEXT_LENGTH_CODES: ReadonlySet<string> = new Set([
   "model_context_window_exceeded",
   // InferHub's spelling for the same condition.
   "context_too_long",
+  // Trae answers an overflow on its streaming surface with the bare numeric
+  // code `4026` and the prose "We're sorry, your context length has exceeded
+  // the maximum limit." — no HTTP status, no symbolic code (verified live
+  // 2026-10: `event:error data:{"code":4026,"message":"..."}`). Without it
+  // the frame fell to the 502 `platform_unavailable` fallback and the client
+  // never saw the 413 it compacts on.
+  "4026",
 ]);
 
 /**