cartethyia 2.7.4 → 2.7.5

package/src/providers/integrations/zcode-start-plan/quota.ts

@@ -0,0 +1,152 @@
+import { asCoercedNumber, asRecord, asTrimmedString } from "../../../shared/coerce";
+import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
+
+const BALANCE_URL = "https://zcode.z.ai/api/v1/zcode-plan/billing/balance?app_version=3.16.3";
+const DEVICE_MID = "9f1b0d4e-3c2a-4e7b-9f1d-6a2c8b5e0d31";
+const APP_VERSION = "3.16.3";
+
+function instant(value: unknown): string | null {
+  const seconds = asCoercedNumber(value);
+  if (seconds === undefined || seconds <= 0) return null;
+  const date = new Date(seconds * 1000);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+}
+
+function boundary(values: readonly unknown[], latest: boolean): string | null {
+  const instants = values.map(instant).filter((value): value is string => value !== null);
+  if (instants.length === 0) return null;
+  return instants.reduce((a, b) => (latest ? a > b : a < b) ? a : b);
+}
+
+// The upstream capabilities, not the display name, declare which models a grant serves.
+function modelIds(value: unknown): readonly string[] {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.flatMap((entry: unknown) => {
+    const capability = asTrimmedString(entry);
+    if (capability === undefined || (capability.includes(":") && !capability.startsWith("model:"))) return [];
+    const model = capability.replace(/^model:/, "").trim().toLowerCase();
+    return model ? [model] : [];
+  }))];
+}
+
+function periodLabel(period: string | undefined): string {
+  if (period === "daily_night") return "nightly";
+  if (period === "one_time") return "one-time";
+  return period ?? "grant";
+}
+
+function grantLabel(name: string): string {
+  return /^(?:zcode\s+)?start plan$/i.test(name) ? "Start" : name;
+}
+
+function percent(value: number | null, limit: number | null): number | null {
+  return value !== null && limit !== null && limit > 0
+    ? Math.min(100, Math.max(0, value / limit * 100))
+    : null;
+}
+
+function samePlan(bucket: Record<string, unknown>, plan: Record<string, unknown>): boolean {
+  const userPlan = asTrimmedString(bucket["user_plan_id"]);
+  const owner = asTrimmedString(plan["user_plan_id"]);
+  if (userPlan !== undefined && owner !== undefined) return userPlan === owner;
+  const id = asTrimmedString(bucket["plan_id"]);
+  return id !== undefined && id === asTrimmedString(plan["plan_id"]);
+}
+
+/** Billing shape verified against opencode-zcode-auth 0.1.42; see the provider guide. */
+export async function fetchZcodeStartPlanQuota(
+  credential: string,
+  fetcher: FetchLike,
+): Promise<ProviderQuotaResult> {
+  const source = "zcode-start";
+  try {
+    const response = await fetcher(BALANCE_URL, {
+      headers: {
+        authorization: `Bearer ${credential}`,
+        accept: "application/json",
+        "x-device-mid": DEVICE_MID,
+        "x-zcode-app-version": APP_VERSION,
+        "x-client-language": "en-US",
+      },
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) return { source, plan: null, windows: [], error: `plan billing answered ${response.status}` };
+    const payload = asRecord(await response.json());
+    const code = payload?.["code"];
+    if (!payload || payload["success"] === false ||
+      (code !== undefined && ![0, 200, "0", "200"].includes(code as string | number))) {
+      return { source, plan: null, windows: [], error: "plan billing rejected request" };
+    }
+    const data = asRecord(payload["data"]);
+    if (!data || !Array.isArray(data["balances"]) || !Array.isArray(data["plans"])) {
+      return { source, plan: null, windows: [], error: "plan billing returned an unreadable balance" };
+    }
+    const plans = data["plans"].flatMap((value: unknown) => {
+      const plan = asRecord(value);
+      return plan ? [plan] : [];
+    });
+    const windows: ProviderQuotaWindow[] = [];
+    const names = new Set<string>();
+    const represented = new Set<Record<string, unknown>>();
+    for (const raw of data["balances"]) {
+      const bucket = asRecord(raw);
+      if (!bucket) continue;
+      const owner = plans.find((plan) => samePlan(bucket, plan));
+      if (owner) represented.add(owner);
+      const name = asTrimmedString(owner?.["name"]) ?? "Start Plan";
+      names.add(name);
+      const entitlement = (Array.isArray(owner?.["entitlements"]) ? owner["entitlements"] : [])
+        .map(asRecord).find((entry) => entry?.["entitlement_id"] === bucket["entitlement_id"]);
+      const period = asTrimmedString(entitlement?.["period"]);
+      const limit = asCoercedNumber(bucket["total_units"]) ?? null;
+      const reportedUsed = asCoercedNumber(bucket["used_units"]);
+      const reportedRemaining = asCoercedNumber(bucket["remaining_units"]);
+      const used = reportedUsed ?? (limit !== null && reportedRemaining !== undefined ? Math.max(0, limit - reportedRemaining) : null);
+      const remaining = reportedRemaining ?? (limit !== null && used !== null ? Math.max(0, limit - used) : null);
+      const models = modelIds(bucket["capabilities"] ?? entitlement?.["capabilities"]);
+      const expired = asTrimmedString(owner?.["status"])?.toLowerCase() === "expired";
+      windows.push({
+        kind: period ?? "grant",
+        label: `${asTrimmedString(bucket["show_name"]) ?? (models.join(", ") || "GLM")} · ${grantLabel(name)} · ${periodLabel(period)}`,
+        accounting: "independent",
+        modelIds: models,
+        startsAt: boundary([owner?.["starts_at"], bucket["period_start"]], true),
+        resetsAt: boundary([bucket["expires_at"], bucket["period_end"], owner?.["ends_at"]], false),
+        usedPercent: expired ? 100 : percent(used, limit),
+        remainingPercent: expired ? 0 : percent(remaining, limit),
+        used,
+        limit,
+        remaining,
+        recurring: !expired && (period === "daily" || period === "daily_night"),
+      });
+    }
+    // The balance may list a future plan before it has materialized any buckets.
+    for (const plan of plans) {
+      const startsAt = instant(plan["starts_at"]);
+      if (represented.has(plan) || !startsAt || Date.parse(startsAt) <= Date.now() || plan["status"] === "expired") continue;
+      const name = asTrimmedString(plan["name"]) ?? "Start Plan";
+      names.add(name);
+      const entitlements = Array.isArray(plan["entitlements"]) ? plan["entitlements"] : [];
+      const pending = entitlements.length > 0 ? entitlements : [{}];
+      for (const raw of pending) {
+        const entitlement = asRecord(raw);
+        windows.push({
+          kind: "grant", label: `${grantLabel(name)} · ${asTrimmedString(entitlement?.["show_name"]) ?? "not started yet"}`,
+          accounting: "independent", modelIds: modelIds(entitlement?.["capabilities"]), startsAt,
+          resetsAt: instant(plan["ends_at"]), usedPercent: null, remainingPercent: null,
+          remaining: null, used: null, limit: asCoercedNumber(entitlement?.["grant_units"]) ?? null,
+          recurring: false,
+        });
+      }
+    }
+    return { source, plan: [...names].join(", ") || null, windows, error: null };
+  } catch (error) {
+    const name = error instanceof Error ? error.name : "";
+    const message = name === "TimeoutError" || name === "AbortError"
+      ? "plan billing operation timed out or was aborted"
+      : name === "SyntaxError"
+        ? "plan billing returned unreadable JSON"
+        : "plan billing network request failed";
+    return { source, plan: null, windows: [], error: message };
+  }
+}

package/src/providers/integrations/zcode-start-plan/zcode_prompt.json

@@ -0,0 +1,10 @@
+{
+  "_source": "ZCode 3.14.5 client Messages prompt; preserve text with the pinned identity version",
+  "cliPrefix": "You are ZCode, an interactive coding agent",
+  "stableSections": [
+    "\nYou are an interactive ZCode agent that helps users with software engineering tasks.\n\nIMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.\n\n# Harness\n- Text you output outside of tool use is displayed to the user as Github-flavored markdown in a terminal.\n- Tools run behind a user-selected permission mode; a denied call means the user declined it — adjust, don't retry verbatim.\n- The system may send updates, reminders, or modifications to rules via mid-conversation system turns. These are system-controlled, unlike function results. Hooks may intercept tool calls; treat hook output as user feedback.\n- Prefer the dedicated file/search tools over shell commands when one fits. Independent tool calls can run in parallel in one response.\n- Reference code as `file_path:line_number` — it's clickable.",
+    "# ZCode Desktop Context\n\n### Files & URLs\n- Return local web URLs as Markdown links (e.g., [label](http://127.0.0.1:8080)).\n- File should be an absolute path or include the workspace folder segment so it can be resolved relative to the workspace.\n- Unless otherwise specified, return local file references as Markdown links (e.g., [name.md](/absolute/path/to/name.md)).\n\n### Inline Code Comments\n- Use the ::code-comment{...} directive when you need to attach feedback directly to specific code lines.\n- Emit one directive per inline comment; emit none when there are no actionable inline comments.\n- Required attributes: title (short label), body (one-paragraph explanation), file (path to the file).\n- Optional attributes: start, end (1-based line numbers), priority (0-3).\n- file should be an absolute path or include the workspace folder segment so it can be resolved relative to the workspace.\n- Keep line ranges tight; end defaults to start.\n- Example: ::code-comment{title=\"[P2] Off-by-one\" body=\"Loop iterates past the end when length is 0.\" file=\"/path/to/foo.ts\" start=10 end=11 priority=2}",
+    "# Working style\n\nWhen you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has already made, or narrate options you will not pursue. If you are weighing a choice, give a recommendation, not an exhaustive survey. Prefer reading the actual file or running the actual command over reasoning about what it probably contains. When a signal pattern-matches to a known failure, check that the evidence actually supports that specific diagnosis before acting on it."
+  ],
+  "environmentTemplate": "# Environment\nYou have been invoked in the following environment:\n - Primary working directory: {cwd}\n - Platform: {platform}\n - Shell: {shell}\n - You are powered by the model named {provider}/{model}."
+}

package/src/providers/operations/account-error-classification.ts

@@ -57,6 +57,26 @@ const UNCLASSIFIED_COOLDOWN_MS = resolveAccountUnclassifiedCooldownMs;
  * which let the account re-enter rotation inside the window.
  */
 const GROK_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Trae answers `4013 "AI service is not available in the current region now."`
+ * when the upstream does not serve the account's region. A day because the
+ * verdict is durable: it reproduces on every request until the region opens,
+ * and the account must not be re-dialled every thirty seconds for the whole
+ * window.
+ */
+const TRAE_REGION_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Trae's free-tier quota (`4008` / "exceeded the quota") resets daily, so its
+ * exhaustion is a full-day model backoff — never the generic 1h fallback,
+ * which let the account re-enter rotation inside the window.
+ */
+const TRAE_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Qoder's quota verdicts (`110` billing-daily-count, the upstream-499 close)
+ * are per-model: one model's spend cap does not drain another. A day matches
+ * the daily billing window the provider names.
+ */
+const QODER_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000;
 /**
  * The buddy family's policy/channel block (`11140`, `11128`) is a *base* backoff,
  * not a flat penalty — see {@link resolveAccountPolicyBlockCooldownMs}. It used
@@ -586,20 +606,10 @@ interface AccountErrorSignals {
   readonly staticToken: boolean;
   readonly credentialKind: string | undefined;
   /** Buddy-family provider: the only family with provider-specific codes below. */
-  readonly buddy: boolean;
-  /**
-   * The upstream named a restriction on this account, not a refusal of the
-   * request. Only the `11140` shape carries `displayMsg` about the account
-   * being restricted, so the policy arm can tell a ban from a bad request
-   * instead of treating both as one cooldown.
-   */
   readonly buddyBanned: boolean;
   readonly priceRefusal: boolean;
-  readonly deploymentInfraError: boolean;
   readonly quotaSignal: boolean;
   readonly policyRejection: boolean;
-  readonly requestScoped: boolean;
-  readonly channelRejection: boolean;
   readonly hostedToolFailure: boolean;
   readonly modelEntitlementFailure: boolean;
   readonly queuedUpstream: boolean;
@@ -793,7 +803,20 @@ export function classifyAccountError(
   const modelBlockHits = Math.max(1, Math.floor(options?.modelBlockHits ?? 1));
   const staticToken = options?.staticToken === true;
   const credentialKind = options?.credentialKind;
-  const buddy = BUDDY_PROVIDER_IDS.has(options?.providerId?.toLowerCase() ?? "");
+
+  // Start Plan is a separate provider: its named trial refusal rests only that model.
+  const providerId = options?.providerId ?? (error instanceof GatewayError ? error.details.providerId : undefined);
+  const refusedModel = statusCode === 400
+    ? /no active limited quota for ([\w.-]+)/i.exec(message)?.[1]
+    : statusCode === 429
+      ? /limited quota(?: for)? ([\w.-]+)(?: is)? exhausted/i.exec(message)?.[1]
+      : undefined;
+  if (providerId === "zcode-start" && modelId !== undefined && refusedModel !== undefined &&
+    refusedModel.toLowerCase().replace(/-trial$/, "") === modelId.toLowerCase().replace(/-trial$/, "")) {
+    const cooldownMs = statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
+    return result("model_unreachable", "cooldown", cooldownMs, new Date(Date.now() + cooldownMs),
+      reason("Start Plan trial unavailable for this model"), origin === "upstream");
+  }
 
   // A price refusal is a verdict on the *request*, not on the account. inferhub
   // answers 402 with `no provider's ask matches your max-per-mtok bid`: the
@@ -869,6 +892,7 @@ export function classifyAccountError(
       // keeps serving its other models.
       providerCode === "112" ||
       providerCode === "110" ||
+      providerCode === "116" ||
       providerCode === "insufficient_quota" ||
       providerCode === "quota_exceeded" ||
       providerCode === "subscription:free-usage-exhausted" ||
@@ -1067,7 +1091,8 @@ export function classifyAccountError(
   // for all other models. Disabling the whole account breaks healthy models.
   const modelEntitlementFailure =
     statusCode === 403 &&
-    (lower.includes("not have a valid license") ||
+    ((providerId === "commandcode" && lower.includes("model_not_in_plan")) ||
+      lower.includes("not have a valid license") ||
       lower.includes("valid license of this product") ||
       lower.includes("model not supported") ||
       lower.includes("not entitled to") ||
@@ -1131,14 +1156,10 @@ export function classifyAccountError(
     modelBlockHits,
     staticToken,
     credentialKind,
-    buddy,
     buddyBanned,
     priceRefusal,
-    deploymentInfraError,
     quotaSignal,
     policyRejection,
-    requestScoped,
-    channelRejection,
     hostedToolFailure,
     modelEntitlementFailure,
     queuedUpstream,
@@ -1225,101 +1246,6 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
         false,
       ),
   },
-  {
-    name: "deployment-infrastructure",
-    match: (s) => s.deploymentInfraError,
-    decide: (s) =>
-      s.result(
-        "server_error",
-        "cooldown",
-        60_000,
-        null,
-        `Proxy deployment error: ${s.message.slice(0, 160)}`,
-        false,
-      ),
-  },
-  {
-    name: "model-frequency-window",
-    match: (s) => s.lower.includes("frequency limit") && s.lower.includes("switch to the other models"),
-    decide: (s) => {
-      const cooldownMs = s.statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
-      return s.result(
-        "rate_limit_transient",
-        "cooldown",
-        cooldownMs,
-        new Date(Date.now() + cooldownMs),
-        s.reason("Provider frequency limit for this model"),
-        // Provider-scoped evidence still has to reach the writer: a stream frame
-        // carries no credential detail, so `canMutate` is false and without this
-        // the pair would be retried for the whole window it was closed for.
-        s.origin === "upstream" && s.scope === "provider",
-      );
-    },
-  },
-  {
-    name: "content-policy-block",
-    match: (s) => s.policyRejection && s.buddy,
-    decide: (s) => {
-      // A ban is a verdict on the credential, and cooldown cannot answer it:
-      // the account is refused, not throttled. Disabling is the fix, and
-      // disabling *immediately* is a feature — a client's retry budget is spent
-      // in seconds, so a banned account that merely cooled stayed in the plan
-      // and burned sibling accounts that were still healthy before the window
-      // expired.
-      //
-      // The two shapes are told apart by the body, not the code alone: `11140`
-      // names a restriction on the account, `11-128` refuses the request.
-      if (s.buddyBanned) {
-        return s.result(
-          "policy_blocked_banned",
-          "disabled",
-          0,
-          null,
-          s.reason("Account banned by upstream"),
-          // A ban is evidence about the credential even at provider scope, for
-          // the same reason a named revocation is: the message is the evidence.
-          // Without this a stream frame's missing credential detail would leave
-          // a banned account serving.
-          true,
-        );
-      }
-      // Not a ban: the upstream refused this request. The account is fine, so
-      // the only correct move is to stop retrying it verbatim. Cooling the
-      // account here was the bug that made one malformed request look like a
-      // dead credential.
-      return s.result(
-        "policy_blocked_invalid_request",
-        "cooldown",
-        0,
-        null,
-        s.reason("Upstream refused this request"),
-        // Never mutates: a malformed body fails identically on every account,
-        // so cooling would burn a healthy credential on the gateway's own fault.
-        false,
-      );
-    },
-  },
-  {
-    name: "request-scoped-rejection",
-    match: (s) => s.requestScoped && s.buddy,
-    decide: (s) =>
-      s.result("unknown", "cooldown", 0, null, s.reason("Request-scoped upstream rejection"), false),
-  },
-  {
-    name: "channel-rejection",
-    match: (s) => s.channelRejection && s.buddy,
-    decide: (s) => {
-      const channelBlockMs = resolveAccountPolicyBlockCooldownMs();
-      return s.result(
-        "policy_blocked",
-        "cooldown",
-        channelBlockMs,
-        new Date(Date.now() + channelBlockMs),
-        s.reason("Provider channel rejection"),
-        s.origin === "upstream",
-      );
-    },
-  },
   {
     name: "validation-required",
     match: (s) => s.validationRequired,
@@ -1468,6 +1394,81 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
       );
     },
   },
+  {
+    // Trae answers `4013 "AI service is not available in the current region
+    // now."` when the upstream does not serve the account's region. That is a
+    // durable verdict on the account, not a transient transport fault: it
+    // reproduces on every request until the region opens, so it must cool hard
+    // for a day rather than be re-dialled every thirty seconds. Must run
+    // before `transport-fault`, which would read the 502 as a short
+    // `server_error`.
+    name: "trae-region-unavailable",
+    match: (s) =>
+      (s.providerId === "trae" || s.providerId === "traecn") &&
+      (s.providerCode === "4013" || s.lower.includes("not available in the current region")),
+    decide: (s) => {
+      const cooldownMs = TRAE_REGION_COOLDOWN_MS;
+      return s.result(
+        "quota_exhausted",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Trae service unavailable in the current region"),
+        // Account-scoped provider evidence still has to reach the writer: a
+        // stream frame carries no credential detail, so `canMutate` is false
+        // and without this the account stays in rotation to reproduce the
+        // refusal for the whole window the region is closed for.
+        true,
+      );
+    },
+  },
+  {
+    // Trae's free-tier quota (`4008` / "exceeded the quota") resets daily.
+    // Treating it like the generic quota cooldown (1h account-wide fallback)
+    // let the account re-enter rotation inside the window and reproduce the
+    // refusal every few minutes — the "cooldown not holding" report. The
+    // verdict is a full-day backoff on *any* model (the account's quota is
+    // spent, so every model on it shares the wall). Scoped to the model so
+    // the account is not disabled wholesale; the 1-day window means a model
+    // stays parked for the day instead of flapping. Must run before
+    // `quota-exhausted`, which would apply the generic shorter fallback.
+    name: "trae-quota-exhausted",
+    match: (s) =>
+      (s.providerId === "trae" || s.providerId === "traecn") &&
+      (s.providerCode === "4008" || s.lower.includes("have exceeded the quota")),
+    decide: (s) => {
+      const cooldownMs = s.statedCooldownMs ?? TRAE_QUOTA_COOLDOWN_MS;
+      return s.result(
+        "model_unreachable",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Trae quota exhausted for this model"),
+        s.origin === "upstream" && s.modelId !== undefined,
+      );
+    },
+  },
+  {
+    // Qoder's quota verdicts — `110` "Billing daily count exceeded" and the
+    // upstream-499 exhausted-quota close — are per-model: one model's spend
+    // cap does not drain another. Scoping them to the model keeps the account
+    // serving its other models. Must run before `quota-exhausted`, which
+    // parks the whole account.
+    name: "qoder-model-quota",
+    match: (s) =>
+      (s.providerId === "qoder" || s.providerId === "qodercn") && s.quotaSignal,
+    decide: (s) => {
+      const cooldownMs = s.statedCooldownMs ?? QODER_QUOTA_COOLDOWN_MS;
+      return s.result(
+        "model_unreachable",
+        "cooldown",
+        cooldownMs,
+        new Date(Date.now() + cooldownMs),
+        s.reason("Qoder quota exhausted for this model"),
+        s.origin === "upstream" && s.modelId !== undefined,
+      );
+    },
+  },
   {
     name: "quota-exhausted",
     match: (s) => s.quotaSignal,
@@ -1478,11 +1479,21 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
       const grokFreeTier =
         s.providerCode === "subscription:free-usage-exhausted" ||
         s.providerCode.startsWith("subscription:") ||
+        // A 402 spend/entitlement wall (`personal-team-blocked:spending-limit`,
+        // "out of credits") is the same verdict: the account cannot serve until
+        // the operator tops up or upgrades. The default 1h fallback re-dialled
+        // it every hour inside a window that will not clear on its own.
+        s.providerCode.includes("spending") ||
+        s.providerCode.includes("credits") ||
         s.lower.includes("free-usage") ||
         s.lower.includes("free usage") ||
         s.lower.includes("included free usage") ||
         s.lower.includes("rolling 24-hour") ||
-        s.lower.includes("rolling 24 hour");
+        s.lower.includes("rolling 24 hour") ||
+        s.lower.includes("spending limit") ||
+        s.lower.includes("out of credits") ||
+        s.lower.includes("run out of credits") ||
+        s.lower.includes("need a grok subscription");
       const buddyCreditsExhausted =
         s.providerCode === "14018" || s.lower.includes("credits exhausted");
       const cooldownMs = grokFreeTier
@@ -1631,20 +1642,24 @@ const ACCOUNT_ERROR_RULES: readonly AccountErrorRule[] = [
     // verdict, not a transport fault. It must run before `transport-fault`,
     // which otherwise reads the status as a 5xx-class outage and cools the
     // account for the shorter transient window — or leaves it unmutated.
+    //
+    // The verdict is per-model, like Qoder's other quota signs: one model's
+    // spend cap does not drain another, so it cools the pair, never the whole
+    // account.
     name: "qoder-499-quota",
     match: (s) =>
       (s.providerId === "qoder" || s.providerId === "qodercn") &&
       s.statusCode === 499 &&
       s.origin === "upstream",
     decide: (s) => {
-      const cooldownMs = s.statedCooldownMs ?? DEFAULT_QUOTA_COOLDOWN_MS();
+      const cooldownMs = s.statedCooldownMs ?? QODER_QUOTA_COOLDOWN_MS;
       return s.result(
-        "quota_exhausted",
+        "model_unreachable",
         "cooldown",
         cooldownMs,
         new Date(Date.now() + cooldownMs),
-        s.reason("Qoder quota exhausted (upstream 499)"),
-        s.origin === "upstream",
+        s.reason("Qoder quota exhausted for this model (upstream 499)"),
+        s.origin === "upstream" && s.modelId !== undefined,
       );
     },
   },

package/src/providers/operations/account-health-service.ts

@@ -34,6 +34,30 @@ export interface AccountHealthEventRecord {
   readonly createdAt: string;
 }
 
+/**
+ * Runs a write against the db handle, wrapping it in a transaction when the
+ * handle supports one. Kept as a capability probe, not a correctness guard:
+ * health writes are reachable with a partially-implemented database handle
+ * (the dispatch tests pass a narrow double), and a transaction is an
+ * optimization here, not a requirement — the same writes are correct without
+ * one. Returns `fallback` when the write throws; health must never fail
+ * requests.
+ */
+async function withTransaction<T>(
+  db: CartethyiaDatabase,
+  mutate: (tx: CartethyiaDatabase) => Promise<T>,
+  fallback: T,
+): Promise<T> {
+  try {
+    if (typeof db.transaction === "function") {
+      return await db.transaction((tx) => mutate(tx as CartethyiaDatabase));
+    }
+    return await mutate(db);
+  } catch {
+    return fallback;
+  }
+}
+
 /** Persists one classified failure to the account row and appends a health event. */
 export async function recordAccountFailure(
   db: CartethyiaDatabase,
@@ -260,18 +284,7 @@ export async function recordAccountFailure(
     return { ...classification, routesVisible: true };
   };
 
-  try {
-    // Kept as a capability probe, not a correctness guard: this function is
-    // reachable with a partially-implemented database handle (the dispatch
-    // tests pass a narrow double), and a transaction is an optimization here,
-    // not a requirement — the same writes are correct without one.
-    if (typeof db.transaction === "function") {
-      return await db.transaction((tx) => persist(tx as CartethyiaDatabase));
-    }
-    return await persist(db);
-  } catch {
-    return null;
-  }
+  return withTransaction(db, persist, null);
 }
 
 /** Clears failure state after a successful dispatch; true when the account changed. */
@@ -333,14 +346,7 @@ export async function recordAccountSuccess(
     }
     return hadFailures;
   };
-  try {
-    if (typeof db.transaction === "function") {
-      return await db.transaction((tx) => mutate(tx as CartethyiaDatabase));
-    }
-    return await mutate(db);
-  } catch {
-    return false;
-  }
+  return withTransaction(db, mutate, false);
 }
 
 /** Operator-initiated recovery: forces the account back to active and logs the transition. */
@@ -393,14 +399,7 @@ export async function recoverAccount(
     }
     return true;
   };
-  try {
-    if (typeof db.transaction === "function") {
-      return await db.transaction((tx) => recover(tx as CartethyiaDatabase));
-    }
-    return await recover(db);
-  } catch {
-    return false;
-  }
+  return withTransaction(db, recover, false);
 }
 
 /** Recovers accounts whose cooldown elapsed and prunes expired per-model keys. */
@@ -481,14 +480,7 @@ export async function sweepExpiredCooldowns(db: CartethyiaDatabase): Promise<num
       .where(pruning.changed);
     return expired.length + affectedRows(pruned);
   };
-  try {
-    if (typeof db.transaction === "function") {
-      return await db.transaction((tx) => recover(tx as CartethyiaDatabase));
-    }
-    return await recover(db);
-  } catch {
-    return 0;
-  }
+  return withTransaction(db, recover, 0);
 }
 
 /**
@@ -519,8 +511,8 @@ async function writeHealthEvent(
   row: {
     readonly entityKind: "account";
     readonly accountId: string;
-    readonly fromStatus: string;
-    readonly toStatus: string;
+    readonly fromStatus: "active" | "cooldown" | "disabled" | null;
+    readonly toStatus: "active" | "cooldown" | "disabled";
     readonly reason: string;
     readonly errorCategory: string | null;
     readonly modelId?: string | null;
@@ -533,7 +525,7 @@ async function writeHealthEvent(
     return;
   }
   if (typeof client.insert !== "function") return;
-  await client.insert(healthEvents).values({ id: randomUUID(), ...row } as never);
+  await client.insert(healthEvents).values({ id: randomUUID(), ...row });
 }
 
 export async function reportAttemptOutcome(