cartethyia 2.7.2 → 2.7.4

package/src/transport/guards/pipeline.ts

@@ -1,4 +1,4 @@
-import { Elysia } from "elysia";
+import { Elysia, type AnyElysia } from "elysia";
 import { createIngressPolicyMiddleware } from "./body-policy";
 import {
   createCanonicalRequestMiddleware,
@@ -81,9 +81,9 @@ export interface TransportPipelineContext {
  */
 export interface TransportPipeline {
   /** Applies root-scoped request context and error normalization. */
-  mountRoot(app: Elysia<any, any, any, any, any, any, any, any>): void;
+  mountRoot(app: AnyElysia): void;
   /** Builds the complete `/v1/*` gateway plugin around registered routes. */
-  createGateway(registerRoutes: (routes: Elysia<any, any, any, any, any, any, any, any>) => void): Elysia;
+  createGateway(registerRoutes: (routes: AnyElysia) => void): Elysia;
 }
 
 /**
@@ -129,7 +129,7 @@ export function createTransportPipeline(context: TransportPipelineContext): Tran
       preparer: context.preparer,
     }),
   ];
-  const mountRoot = (app: Elysia<any, any, any, any, any, any, any, any>): void => {
+  const mountRoot = (app: AnyElysia): void => {
     app.use(
       createRequestContextMiddleware({
         stateStore: context.stateStore,
@@ -205,8 +205,8 @@ export function createTransportPipeline(context: TransportPipelineContext): Tran
     }
   };
   const createGateway = (
-    registerRoutes: (routes: Elysia<any, any, any, any, any, any, any, any>) => void,
-  ): Elysia<any, any, any, any, any, any, any, any> => {
+    registerRoutes: (routes: AnyElysia) => void,
+  ): AnyElysia => {
     const gateway = new Elysia({ prefix: "/v1" });
     for (const plugin of stages) gateway.use(plugin);
     // No telemetry/cleanup registration here: the lifecycle is owned by

package/src/transport/guards/readiness-guard.ts

@@ -21,8 +21,22 @@ export function createDependencyReadinessMiddleware(deps: ReadinessMiddlewareDep
         throw new GatewayError(notice.code, 503, notice.message);
       }
       const readiness = await deps.readiness();
-      if (readiness.status !== "ready")
-        throw new GatewayError("platform_unavailable", 503, "The gateway's dependencies are not ready, so no request can be served. Retry shortly; if it persists, check the database and coordination backend.");
+      if (readiness.status !== "ready") {
+        // A probe that timed out under load says nothing about the dependencies —
+        // it could not get a backend in time, usually because the process is
+        // saturated. Surface that as overload, not as a broken dependency. A
+        // hard failure (connection refused, migrations missing) keeps the
+        // dependency message, which tells the operator what to actually fix.
+        if (readiness.reason?.endsWith("timed out")) {
+          throw new GatewayError(
+            "overloaded",
+            503,
+            "The gateway is overloaded (request {requestId}); retry shortly. It's not you, it's us — back in a moment ☕️",
+            { retryAfterMs: 1_000 },
+          );
+        }
+        throw new GatewayError("platform_unavailable", 503, "The gateway's dependencies are not ready, so no request can be served (request {requestId}). Retry shortly; if it persists, check the database and coordination backend. Warming up — back in a moment ☕️");
+      }
     })
     .as("plugin");
 }

package/src/transport/guards/request-context.ts

@@ -159,7 +159,7 @@ export function createCanonicalRequestMiddleware(deps: {
       // literal `null` body) is a valid single-read value and flows to the
       // surface adapter's parse error rather than triggering a second read.
       if (state.ingressBody === undefined)
-        throw new GatewayError("admission_unavailable", 503, "The request body was never read, so this route cannot be served. Resend the request.");
+        throw new GatewayError("route_unavailable", 503, "The request body was never read, so this route cannot be served (request {requestId}). Resend the request. The bouncer stepped out — resend shortly 🚪");
       const body = state.ingressBody;
       const headers: Record<string, string> = {};
       request.headers.forEach((value, key) => {
@@ -192,7 +192,7 @@ export function createCanonicalRequestMiddleware(deps: {
         throw new GatewayError(
           "capability_unsupported",
           400,
-          `Surface adapter unavailable: ${detection.surface}`,
+          `Surface adapter unavailable: ${detection.surface} (request {requestId}). Know your tools — this one just isn't in the box 🧰`,
           { surface: detection.surface },
         );
       const ingress = deps.stateStore.require(request);
@@ -224,7 +224,7 @@ export function createProxyRoutePreparationMiddleware(deps: {
       if (!isJsonRoute || path === "/v1/responses/compact" || isOpaqueBodyRoute(path)) return;
       const state = deps.stateStore.require(request);
       if (!state.authorization || !state.canonicalRequest)
-        throw new GatewayError("admission_unavailable", 503, "The request was not authenticated and parsed, so this route cannot be served. Resend the request.");
+        throw new GatewayError("route_unavailable", 503, "The request was not authenticated and parsed, so this route cannot be served (request {requestId}). Resend the request. The bouncer stepped out — resend shortly 🚪");
       // The key rides along so a strike is charged to the caller that made it.
       // Without it, one recipient of a shared link could escalate a ban onto
       try {

package/src/transport/request/preparer.ts

@@ -2,6 +2,7 @@ import { GatewayError } from "../../protocol/gateway-error";
 import type { CanonicalRequest, ServiceKind } from "../../protocol/canonical-model";
 import { toolResultParts } from "../../protocol/canonical-model";
 import type { ApiKeyAdmissionService } from "../../security/admission/service";
+import type { CallerIdentity } from "../../security/access-control";
 import type { RouteCandidate as RouteCandidate, InMemoryRouteSnapshotService, RoutePlan } from "../routing/route-model";
 import type { RouteContinuationAffinity } from "../routing/route-model";
 import { resolveAliasTarget, type RoutingEngine } from "../routing/router";
@@ -80,6 +81,8 @@ export function resolveContinuationAffinity(
     apiKeyId: authorization.id,
   };
   let affinity: RouteContinuationAffinity | undefined;
+  let anyResolved = false;
+  let allResolved = true;
   for (const callId of ids) {
     // The registry resolves by tenant + API key + provider + account, so a call
     // id replayed from another key or tenant resolves nothing.
@@ -91,22 +94,32 @@ export function resolveContinuationAffinity(
       // through the ids that still resolve; when none do, the ordinary routing
       // path decides (a Cursor adapter may rebase the full history into a
       // fresh Run).
+      allResolved = false;
       continue;
     }
     if (affinity !== undefined && affinity.providerAccountId !== record.providerAccountId) {
       throw new GatewayError(
         "invalid_request",
         400,
-        "These tool results belong to different Cursor accounts; resend them one account at a time.",
+        "These tool results belong to different Cursor accounts (request {requestId}); resend them one account at a time. The session went cold — reconnect or resend 🔌",
         { callIds: [...ids] },
       );
     }
+    anyResolved = true;
     affinity = {
       providerId: record.providerId,
       providerAccountId: record.providerAccountId,
+      rebaseable: false,
     };
   }
-  return affinity;
+  if (affinity !== undefined) {
+    // Rebaseable when every supplied call id resolved to a live pending call
+    // (so none is owed to another account) — or when none resolved and the
+    // whole history is present. In both cases the conversation is complete and
+    // may travel as history to a fresh Run.
+    return { ...affinity, rebaseable: anyResolved ? allResolved : true };
+  }
+  return undefined;
 }
 
 /** Looks up one pending call across every provider that records continuations. */
@@ -137,6 +150,8 @@ export interface PreparedProxyRequest {
    * second account and pool slot.
    */
   readonly continuationAffinity?: RouteContinuationAffinity;
+  /** Single "who is speaking" identity, derived at auth. */
+  readonly caller: CallerIdentity;
   readonly estimatedInputTokens: number;
   readonly estimatedOutputTokens: number;
   readonly deadlineMs: number;
@@ -174,9 +189,9 @@ export class ProxyRequestPreparer {
   }): Promise<PreparedProxyRequest> {
     const { canonicalRequest: initialRequest, authorization, signal } = input;
     if (signal?.aborted)
-      throw new GatewayError("transport_closed", 499, "request was cancelled");
+      throw new GatewayError("transport_closed", 499, "The request was cancelled (request {requestId}). Send it again whenever ready 🙃");
     if (!initialRequest.model || initialRequest.model.trim().length === 0) {
-      throw new GatewayError("invalid_request", 400, "Request requires a non-empty model identifier", {
+      throw new GatewayError("invalid_request", 400, "Request requires a non-empty model identifier (request {requestId}). Check the shape of what you sent — then resend 🪞", {
         field: "model",
       });
     }
@@ -227,13 +242,13 @@ export class ProxyRequestPreparer {
       !allowedForKey
     )
       throw new GatewayError(
-        "model_not_found",
-        404,
-        `This key may only use models starting with '${authorization.modelPrefix}'. Ask for one inside that prefix, or have an operator widen the key.`,
+        "model_not_allowed",
+        403,
+        `This key may only use models starting with '${authorization.modelPrefix}' (request {requestId}). Ask for one inside that prefix, or have an operator widen the key. The door's locked for this one — check the allowlist 🔒`,
         { model: request.model, required_prefix: authorization.modelPrefix },
       );
     if (!allowedForKey) {
-      throw new GatewayError("model_not_found", 404, "model is not allowed for this API key", {
+      throw new GatewayError("model_not_allowed", 403, "model is not allowed for this API key (request {requestId}). The door's locked for this one — check the allowlist 🔒", {
         model: request.model,
       });
     }
@@ -292,7 +307,7 @@ export class ProxyRequestPreparer {
       throw new GatewayError(
         "capability_unsupported",
         400,
-        "no eligible route supports this request's capabilities",
+        "no eligible route supports this request's capabilities (request {requestId}). Drop the unsupported capability, or route to a model that accepts it. Know your tools — this one just isn't in the box 🧰",
         { model: request.model },
       );
     const policyCandidates = plan.candidates.filter((candidate) =>
@@ -304,7 +319,7 @@ export class ProxyRequestPreparer {
       ),
     );
     if (policyCandidates.length === 0)
-      throw new GatewayError("model_not_found", 404, "model is not allowed for this API key", {
+      throw new GatewayError("model_not_allowed", 403, "model is not allowed for this API key (request {requestId}). The door's locked for this one — check the allowlist 🔒", {
         model: request.model,
       });
     if (policyCandidates.length !== plan.candidates.length)
@@ -326,7 +341,7 @@ export class ProxyRequestPreparer {
       throw new GatewayError(
         "capability_unsupported",
         400,
-        `this model is not served on a chat wire — it is a '${kind}' service model${route === undefined ? "" : `; call it at POST ${route}`}`,
+        `this model is not served on a chat wire — it is a '${kind}' service model${route === undefined ? "" : `; call it at POST ${route}`} (request {requestId}). Know your tools — this one just isn't in the box 🧰`,
         { model: request.model, service_kind: kind, ...(route === undefined ? {} : { route }) },
       );
     }
@@ -351,7 +366,7 @@ export class ProxyRequestPreparer {
       }
     }
     if (signal?.aborted)
-      throw new GatewayError("transport_closed", 499, "request was cancelled");
+      throw new GatewayError("transport_closed", 499, "The request was cancelled (request {requestId}). Send it again whenever ready 🙃");
     const eligible = plan.candidates;
     // The buddy gateway rejects partial tool rounds outright (`11148`) where
     // the generic synthesis policy would insert a placeholder result, so a
@@ -386,7 +401,7 @@ export class ProxyRequestPreparer {
       effectiveRequest = sanitizeRequestToolIds(effectiveRequest);
     }
     if (signal?.aborted)
-      throw new GatewayError("transport_closed", 499, "request was cancelled");
+      throw new GatewayError("transport_closed", 499, "The request was cancelled (request {requestId}). Send it again whenever ready 🙃");
     // Project against the chosen candidate, not the intersection of every
     // candidate in the plan. Still required for generation-control stripping
     // even on the no-tools path — keep it, but it is cheap vs message clones.
@@ -407,6 +422,7 @@ export class ProxyRequestPreparer {
       degradedCapabilities: degraded,
       plan,
       ...(continuationAffinity === undefined ? {} : { continuationAffinity }),
+      caller: authorization.caller,
       estimatedInputTokens,
       estimatedOutputTokens,
       deadlineMs: input.deadlineMs,
@@ -432,7 +448,7 @@ export class ProxyRequestPreparer {
     readonly emptyMessage: string;
   }): Promise<PreparedNativeRequest> {
     if (input.signal?.aborted)
-      throw new GatewayError("transport_closed", 499, "request was cancelled");
+      throw new GatewayError("transport_closed", 499, "The request was cancelled (request {requestId}). Send it again whenever ready 🙃");
     const snapshot = await this.deps.snapshotService.getSnapshot();
     const allowCliMappings = allowsCliToolMappings(input.authorization.scopes, {
       ...(input.clientUserAgent === undefined ? {} : { userAgent: input.clientUserAgent }),
@@ -457,13 +473,13 @@ export class ProxyRequestPreparer {
       !allowedForKey
     )
       throw new GatewayError(
-        "model_not_found",
-        404,
-        `This key may only use models starting with '${input.authorization.modelPrefix}'. Ask for one inside that prefix, or have an operator widen the key.`,
+        "model_not_allowed",
+        403,
+        `This key may only use models starting with '${input.authorization.modelPrefix}' (request {requestId}). Ask for one inside that prefix, or have an operator widen the key. The door's locked for this one — check the allowlist 🔒`,
         { model: input.model, required_prefix: input.authorization.modelPrefix },
       );
     if (!allowedForKey)
-      throw new GatewayError("model_not_found", 404, "model is not allowed for this API key", {
+      throw new GatewayError("model_not_allowed", 403, "model is not allowed for this API key (request {requestId}). The door's locked for this one — check the allowlist 🔒", {
         model: input.model,
       });
     const plan = await this.deps.routingEngine.plan(
@@ -475,7 +491,7 @@ export class ProxyRequestPreparer {
       input.authorization.cliMappingOwnerId ?? input.authorization.id,
     );
     if (input.signal?.aborted)
-      throw new GatewayError("transport_closed", 499, "request was cancelled");
+      throw new GatewayError("transport_closed", 499, "The request was cancelled (request {requestId}). Send it again whenever ready 🙃");
     const policyCandidates = plan.candidates.filter((candidate) =>
       isModelAllowed(
         input.authorization.snapshot,
@@ -485,12 +501,12 @@ export class ProxyRequestPreparer {
       ),
     );
     if (policyCandidates.length === 0)
-      throw new GatewayError("model_not_found", 404, "model is not allowed for this API key", {
+      throw new GatewayError("model_not_allowed", 403, "model is not allowed for this API key (request {requestId}). The door's locked for this one — check the allowlist 🔒", {
         model: input.model,
       });
     const candidates = policyCandidates.filter(input.eligible);
     if (candidates.length === 0)
-      throw new GatewayError("capability_unsupported", 400, input.emptyMessage, {
+      throw new GatewayError("capability_unsupported", 400, `${input.emptyMessage} (request {requestId}). Know your tools — this one just isn't in the box 🧰`, {
         model: input.model,
       });
     return {

package/src/transport/request/state.ts

@@ -191,15 +191,12 @@ function subscribeInFlightSnapshot(
   store: { inFlightSnapshot(): InFlightSnapshot },
   listener: (snapshot: InFlightSnapshot) => void,
 ): () => void {
-  const timers = new Set<ReturnType<typeof setTimeout>>();
   const push = (): void => listener(store.inFlightSnapshot());
   push();
   const handle = setInterval(push, 1_000);
   (handle as unknown as { unref?: () => void })?.unref?.();
   return () => {
     clearInterval(handle);
-    for (const t of timers) clearTimeout(t);
-    timers.clear();
   };
 }
 
@@ -259,7 +256,7 @@ export class ProxyRequestStateStore {
       try {
         if (controller && !controller.signal.aborted) {
           controller.abort(
-            new GatewayError("deadline_exceeded", 504, "in-flight request exceeded its deadline"),
+            new GatewayError("deadline_exceeded", 504, "in-flight request exceeded its deadline (request {requestId}). Some things just take longer 🐢"),
           );
         }
       } catch {
@@ -292,7 +289,7 @@ export class ProxyRequestStateStore {
     const abortReason =
       reason instanceof Error || reason instanceof DOMException
         ? reason
-        : new GatewayError("shutting_down", 503, "The gateway is shutting down, so this request cannot be served. Retry against a live instance.");
+        : new GatewayError("shutting_down", 503, "The gateway is shutting down, so this request cannot be served (request {requestId}). Retry against a live instance. Maintenance mode — back in a minute 🧘");
     for (const controller of controllers) {
       try {
         if (!controller.signal.aborted) controller.abort(abortReason);
@@ -330,7 +327,7 @@ export class ProxyRequestStateStore {
           new GatewayError(
             "deadline_exceeded",
             504,
-            "request deadline exceeded",
+            "request deadline exceeded (request {requestId}). Some things just take longer 🐢",
             {},
             "cartethyia",
           ),
@@ -418,7 +415,7 @@ export class ProxyRequestStateStore {
   require(request: Request): ProxyRequestState {
     const state = this.states.get(request);
     if (!state)
-      throw new GatewayError("admission_unavailable", 503, "The request was never registered, so it cannot be served. Resend the request.");
+      throw new GatewayError("route_unavailable", 503, "The request was never registered, so it cannot be served (request {requestId}). Resend the request. The bouncer stepped out — resend shortly 🚪");
     return state;
   }
 

package/src/transport/request/system-prompt-injection.ts

@@ -0,0 +1,89 @@
+/**
+ * Tenant system-prompt injection at the canonical level.
+ *
+ * Runs inside `applyTenantPreferences`, after reasoning/thinking shaping and
+ * before RTK/PonyTail, so the injected text composes with (and is then
+ * appended-to by) the compression directive. Wire-agnostic: one transform
+ * covers messages/chat/responses/gemini/codex/kiro; provider-native
+ * injection (Claude identity/billing prepend, buddy fixed system turn,
+ * antigravity identity) happens later, in the adapters, and is untouched.
+ *
+ * Resolution is most-specific-wins: model > provider > global, where a
+ * provider either follows the tenant's global prompt or carries a custom one.
+ * Failure is non-fatal — an unusable configuration must not fail a
+ * dispatchable request.
+ */
+import type { CanonicalRequest } from "../../protocol/canonical-model";
+import type { ServiceKind } from "../../protocol/canonical-model";
+import type {
+  PromptSetting,
+  TenantSystemPrompts,
+} from "../../console/system-prompt/contracts";
+import {
+  systemPromptModelKey,
+} from "../../console/system-prompt/contracts";
+
+/** The route facts the resolution needs. */
+export interface SystemPromptRoute {
+  readonly providerId: string;
+  readonly modelId: string;
+  readonly serviceKind: ServiceKind;
+}
+
+/**
+ * Resolves the effective prompt for a route: the most-specific enabled scope
+ * wins. A provider scope honours its `followGlobal` toggle; model scope is
+ * always explicit. Returns `undefined` when nothing applies.
+ */
+export function resolveTenantSystemPrompt(
+  prompts: TenantSystemPrompts | undefined,
+  route: Pick<SystemPromptRoute, "providerId" | "modelId">,
+): PromptSetting | undefined {
+  if (prompts === undefined) return undefined;
+  const model = prompts.models[systemPromptModelKey(route.providerId, route.modelId)];
+  if (model !== undefined && model.enabled) return model;
+  const provider = prompts.providers[route.providerId];
+  if (provider !== undefined) {
+    if (provider.followGlobal) {
+      return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+    }
+    if (provider.setting !== undefined && provider.setting.enabled) return provider.setting;
+  }
+  return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+}
+
+/** Marker text guard so retries never double-inject. */
+function carriesText(system: readonly { kind: string }[] | undefined, text: string): boolean {
+  return (system ?? []).some((part) => part.kind === "text" && (part as { text?: string }).text === text);
+}
+
+/**
+ * Applies the resolved tenant prompt to the canonical request. Appends after
+ * existing system content (or replaces the caller's system content for
+ * `override` — provider-native identity injection later re-adds the fixed
+ * provider prompt, so override is never a bare wire).
+ */
+export function applyInjectSystemPrompt(
+  request: CanonicalRequest,
+  prompts: TenantSystemPrompts | undefined,
+  route: SystemPromptRoute,
+): CanonicalRequest {
+  // Non-chat native protocols have no system surface to inject into.
+  if (route.serviceKind !== "llm") return request;
+  const setting = resolveTenantSystemPrompt(prompts, route);
+  if (setting === undefined || setting.text.length === 0) return request;
+
+  const text = setting.text;
+  // `override` replaces only the CALLER's system content: the adapters later
+  // prepend their mandatory identity/billing blocks (claude, antigravity) or
+  // install their fixed system turn (buddy), so the wire always keeps the
+  // provider-native prompt. For wrapped-injection providers the override
+  // cannot survive the replace at all — the identity must stay the opener —
+  // so it degrades to append there.
+  const existing = request.system ?? [];
+  if (setting.mode === "override" && existing.length > 0) {
+    return { ...request, system: [{ kind: "text", text }] };
+  }
+  if (carriesText(existing, text)) return request;
+  return { ...request, system: [...existing, { kind: "text", text }] };
+}

package/src/transport/request/tenant-preferences.ts

@@ -12,9 +12,42 @@ import type { CanonicalRequest } from "../../protocol/canonical-model";
 import type { PreparedProxyRequest } from "./preparer";
 import { normalizeThinkingConfig } from "../../protocol/translation/thinking";
 import { compressRequest } from "./rtk/compress-request";
+import { applyInjectSystemPrompt } from "./system-prompt-injection";
 import { preferencesReaderFor } from "../../persistence/tenant-preferences";
+import {
+  readTenantSystemPrompts,
+  type StoredTenantSystemPrompts,
+} from "../../persistence/system-prompt-store";
+import { currentSettingsRevision } from "../../persistence/settings-revision";
+import { TtlCache } from "../../persistence/ttl-cache";
 import { resolveUpstreamTimeoutMs } from "../../config/timeouts";
 
+/**
+ * Revision-keyed cached read of the tenant's system-prompt configuration, the
+ * same convergence mechanism as the runtime-preferences reader: a mutation
+ * bumps the settings revision, which changes every cache key, so writes are
+ * visible to the dispatch path immediately without a per-request round trip.
+ */
+const systemPromptCache = new TtlCache<StoredTenantSystemPrompts>({
+  ttlMs: 5_000,
+  maxEntries: 128,
+});
+
+async function readTenantSystemPromptsCached(
+  db: CartethyiaDatabase,
+  tenantId: string,
+): Promise<StoredTenantSystemPrompts> {
+  const cacheKey = `${tenantId}:${currentSettingsRevision()}`;
+  const cached = systemPromptCache.get(cacheKey);
+  if (cached !== undefined) return cached;
+  const prompts = await readTenantSystemPrompts(db, tenantId);
+  systemPromptCache.set(cacheKey, prompts);
+  return prompts;
+}
+
+/** Cached read for the dispatch path (same revision-keyed cache). */
+export { readTenantSystemPromptsCached as readTenantSystemPromptsForDispatch };
+
 /**
  * Re-arms the request deadline from the tenant's timeout override.
  *
@@ -91,6 +124,16 @@ export async function applyTenantPreferences(
       const next = normalizeThinkingConfig(canonicalRequest);
       if (next !== canonicalRequest) canonicalRequest = next;
     }
+    // Tenant system-prompt injection runs before compression: the PonyTail
+    // directive must stay the tail of the system content, and the injected
+    // prompt is itself stable per scope, so the prefix-cache invariant holds.
+    const prompts = await readTenantSystemPromptsCached(db, tenantId);
+    const candidate = prepared.candidate;
+    canonicalRequest = applyInjectSystemPrompt(canonicalRequest, prompts, {
+      providerId: candidate.provider_id,
+      modelId: candidate.model_id,
+      serviceKind: candidate.service_kind ?? "llm",
+    });
     if (prefs) {
       // When the routed model is Responses (codex/openai/muse-spark) and the
       // client hit a Chat surface, force the configured summary mode so the

package/src/transport/routing/admission.ts

@@ -17,15 +17,25 @@ import type {
 /**
  * The admission bucket one candidate draws from.
  *
+ * Bucket identity is `provider:model[:account][:ownerTenant]`:
+ * - A candidate with no account (credential-less provider) buckets per
+ *   provider:model.
+ * - A **shared** account (`owner_tenant_id` null) is one bucket across all
+ *   tenants — the account is pool-wide, so its concurrency ceiling is global.
+ * - A **tenant-owned** account is scoped to its owner tenant, so two tenants
+ *   cannot drain each other's ceiling on an account only one of them owns.
+ *
  * Exported so the router can order candidates by the same counters admission
  * enforces against: a second copy of this format would drift and quietly
  * deprioritize the wrong accounts.
  */
 export function admissionKey(candidate: RouteCandidate): string {
   const base = `${candidate.provider_id}:${candidate.model_id}`;
-  return candidate.provider_account_id === undefined
-    ? base
-    : `${base}:${candidate.provider_account_id}`;
+  if (candidate.provider_account_id === undefined) return base;
+  const account = `${base}:${candidate.provider_account_id}`;
+  return candidate.owner_tenant_id === undefined || candidate.owner_tenant_id === null
+    ? account
+    : `${account}:${candidate.owner_tenant_id}`;
 }
 
 /**