cartethyia 2.7.9 → 2.8.1

package/src/providers/quota/quota-support.ts

@@ -3,7 +3,7 @@ import { cleanError, unsupportedQuota } from "./quota-contracts";
 import type { ProviderRegistry } from "../provider-registry";
 import { parseProviderId } from "../provider-contracts";
 import { providerBaseUrl } from "../provider-metadata";
-import { createProbeFetch } from "../operations/probe-fetch";
+import { createProbeFetch } from "../provider-probe";
 /**
  * Verifies an API key against the provider's OpenAI-compatible `/models`
  * endpoint. For providers that expose no billing/quota surface, a reachable

package/src/providers/quota/quota-window-parser.ts

@@ -98,6 +98,75 @@ function findReset(root: unknown, mapping: QuotaWindowMapping): string | null {
   return mapping.resetFallback ?? null;
 }
 
+/**
+ * The raw per-window candidates the shared emission core resolves.
+ *
+ * Both quota walkers (`parseQuotaWindows` and `parseLimitWindows`) feed their
+ * independently-read fields into one resolution so the percent fallback chain
+ * and the skip rule cannot drift between them.
+ */
+export interface WindowFieldCandidates {
+  /** Provider-preferred percent (e.g. a `derivePercent` result). */
+  readonly explicitPercent: number | null;
+  /** Raw used-percent read from the payload. */
+  readonly usedPercent: number | null;
+  /** Raw remaining-percent read from the payload. */
+  readonly remainingPercent: number | null;
+  /** Absolute used value. */
+  readonly used: number | null;
+  /** Absolute limit value. */
+  readonly limit: number | null;
+  /** Reset timestamp; required to emit a reset-only window. */
+  readonly reset: string | null;
+  /**
+   * Whether percent may be derived from absolute used/limit when no percentage
+   * was reported. Only `parseQuotaWindows` does this — `parseLimitWindows`
+   * reports percentages and resets the upstream gave it, never ones it
+   * invented, so Cline entries stay reset-only instead of gaining a derived
+   * percent.
+   */
+  readonly deriveFromUsedLimit: boolean;
+  /**
+   * When true, a reset-only window (percent null, reset present) is still
+   * emitted. When false/absent, an entry with neither percent nor reset is
+   * dropped — never rendered as 0% — and a reset-only window is dropped too.
+   */
+  readonly emitWithoutPercent?: boolean;
+}
+
+/**
+ * Shared per-window field resolution: the percent fallback chain plus the
+ * "emit or skip" decision.
+ *
+ * Percent resolution order is exact: explicit percent, then used-percent, then
+ * remaining-percent inverted (100 − remaining), then derived from absolute
+ * used/limit (only when the limit is positive and `deriveFromUsedLimit` is
+ * set). The result is never coerced to 0: a missing percentage stays `null`,
+ * so a window can be omitted or rendered as a countdown depending on
+ * `emitWithoutPercent`.
+ */
+export function resolveWindowEmission(candidates: WindowFieldCandidates): {
+  readonly emit: boolean;
+  readonly percent: number | null;
+} {
+  let percent = candidates.explicitPercent;
+  if (percent === null && candidates.usedPercent !== null) percent = candidates.usedPercent;
+  if (percent === null && candidates.remainingPercent !== null) {
+    percent = Math.max(0, 100 - candidates.remainingPercent);
+  }
+  if (
+    percent === null &&
+    candidates.deriveFromUsedLimit &&
+    candidates.used !== null &&
+    candidates.limit !== null &&
+    candidates.limit > 0
+  ) {
+    percent = (candidates.used / candidates.limit) * 100;
+  }
+  const emit = percent !== null || (candidates.emitWithoutPercent === true && candidates.reset !== null);
+  return { emit, percent };
+}
+
 /** Parses a generic quota payload using the provided window mappings. */
 export function parseQuotaWindows(
   body: unknown,
@@ -110,27 +179,30 @@ export function parseQuotaWindows(
   for (const mapping of windowMappings) {
     const used = findNumber(payload, mapping.usedPaths);
     const limit = findNumber(payload, mapping.limitPaths);
+    const reset = findReset(payload, mapping);
 
-    let percent: number | null = mapping.derivePercent ? mapping.derivePercent(payload) : null;
-    if (percent === null) {
-      const usedPercent = findNumber(payload, mapping.usedPercentPaths);
-      const remainingPercent = findNumber(payload, mapping.remainingPercentPaths);
-      if (usedPercent !== null) {
-        percent = usedPercent;
-      } else if (remainingPercent !== null) {
-        percent = Math.max(0, 100 - remainingPercent);
-      } else if (used !== null && limit !== null && limit > 0) {
-        percent = (used / limit) * 100;
-      }
-    }
-    if (percent !== null && mapping.valueMultiplier !== undefined && mapping.valueMultiplier !== 0) {
-      percent = Math.min(100, Math.max(0, percent * mapping.valueMultiplier));
-    }
+    const { emit, percent } = resolveWindowEmission({
+      explicitPercent: mapping.derivePercent ? mapping.derivePercent(payload) : null,
+      usedPercent: findNumber(payload, mapping.usedPercentPaths),
+      remainingPercent: findNumber(payload, mapping.remainingPercentPaths),
+      used,
+      limit,
+      reset,
+      deriveFromUsedLimit: true,
+      ...(mapping.emitWithoutPercent === undefined ? {} : { emitWithoutPercent: mapping.emitWithoutPercent }),
+    });
+    if (!emit) continue;
 
-    const reset = findReset(payload, mapping);
-    if (percent === null && !(mapping.emitWithoutPercent === true && reset !== null)) continue;
+    let resolvedPercent = percent;
+    if (
+      resolvedPercent !== null &&
+      mapping.valueMultiplier !== undefined &&
+      mapping.valueMultiplier !== 0
+    ) {
+      resolvedPercent = Math.min(100, Math.max(0, resolvedPercent * mapping.valueMultiplier));
+    }
 
-    windows.push(percentWindow(mapping.kind, mapping.label, percent, reset, used, limit, "independent"));
+    windows.push(percentWindow(mapping.kind, mapping.label, resolvedPercent, reset, used, limit, "independent"));
   }
 
   if (options.extraWindows) windows.push(...options.extraWindows(payload));

package/src/providers/quota/refresh.ts

@@ -18,8 +18,10 @@ import type { ProviderId } from "../provider-contracts";
 import type { ProviderRegistry } from "../provider-registry";
 import { quotaLens, setCachedQuota } from "./cache";
 import { persistQuotaSnapshot } from "./snapshot";
+import { applyAccountVerdict } from "../operations/account-health-service";
 import { asJsonbRecord } from "../../shared/coerce";
 import { KIRO_DEFAULT_LABELS } from "../integrations/kiro/kiro-oauth";
+import { invalidateCredentialCache } from "../operations/provider-credential-service";
 
 /**
  * The stock Kiro fallback labels as a SQL literal list. Built once from the
@@ -33,7 +35,7 @@ const KIRO_DEFAULT_LABEL_IN = sql.raw(
 );
 
 /** Why an account quota refresh failed; `null` means the fetch succeeded. */
-export type QuotaRefreshFailureCode = "missing_credential" | "quota_fetch_failed";
+export type QuotaRefreshFailureCode = "missing_credential" | "quota_fetch_failed" | "auth_invalidated";
 
 export interface QuotaRefreshOutcome {
   readonly quota: ProviderQuotaResult;
@@ -149,13 +151,69 @@ function isTransientTimeout(error: string | null | undefined): boolean {
 export async function recordAccountCheck(
   db: CartethyiaDatabase,
   accountId: string,
-  outcome: { ok: boolean; error?: string | null; category?: string | null },
+  outcome: { ok: boolean; error?: string | null; category?: string | null; authInvalidated?: boolean },
+  snapshotInvalidator?: { invalidate(): unknown },
 ): Promise<void> {
-  const activeOnly = and(
-    eq(providerAccounts.id, accountId),
-    eq(providerAccounts.status, "active"),
-  );
+  if (outcome.authInvalidated === true) {
+    const disabled = await applyAccountVerdict(db, {
+      accountId,
+      status: "disabled",
+      reason: outcome.error ?? "Provider rejected account authentication",
+      category: "auth_invalidated",
+      // No deadline: a credential rejected as invalid cannot heal by waiting,
+      // and the OAuth refresh sweep must not keep spending refresh attempts.
+      cooldownUntil: null,
+    });
+    if (disabled) {
+      invalidateCredentialCache(accountId);
+      await snapshotInvalidator?.invalidate();
+    }
+    return;
+  }
   if (outcome.ok) {
+    // A successful quota refresh is the freshest evidence about the account's
+    // health: heal a cooldown that the refresh shows is no longer justified, so
+    // the account returns to rotation immediately instead of waiting out the
+    // remainder of a stale fallback window. Only healable scopes heal — an
+    // auth/policy cooldown must never be lifted by a quota report (the
+    // credential is still refused). `lastErrorCategory` carries the category
+    // that parked the account, so the heal is scoped by the same verdict the
+    // health machine wrote.
+    const healableCategories = new Set([
+      "quota_exhausted",
+      "rate_limit_transient",
+      "model_capacity",
+      "model_unreachable",
+      "unknown",
+      "check_failed",
+    ]);
+    const rows = await db
+      .select({ status: providerAccounts.status, lastErrorCategory: providerAccounts.lastErrorCategory })
+      .from(providerAccounts)
+      .where(eq(providerAccounts.id, accountId))
+      .limit(1);
+    const account = rows[0];
+    const healable =
+      account?.status === "cooldown" &&
+      (account.lastErrorCategory === null || healableCategories.has(account.lastErrorCategory));
+    if (healable) {
+      const healed = await db
+        .update(providerAccounts)
+        .set({
+          status: "active",
+          lastSuccessAt: new Date(),
+          lastError: null,
+          lastErrorCategory: null,
+          lastErrorAt: null,
+          consecutiveFailures: 0,
+          cooldownUntil: null,
+          lastRecoveredAt: new Date(),
+        })
+        .where(eq(providerAccounts.id, accountId))
+        .returning({ id: providerAccounts.id });
+      if (healed.length > 0) await snapshotInvalidator?.invalidate();
+      return;
+    }
     await db
       .update(providerAccounts)
       .set({
@@ -165,7 +223,7 @@ export async function recordAccountCheck(
         lastErrorAt: null,
         consecutiveFailures: 0,
       })
-      .where(activeOnly);
+      .where(and(eq(providerAccounts.id, accountId), eq(providerAccounts.status, "active")));
     return;
   }
   const transient = isTransientTimeout(outcome.error);
@@ -186,7 +244,7 @@ export async function recordAccountCheck(
       lastErrorAt: new Date(),
       ...(transient ? {} : { consecutiveFailures: sql`${providerAccounts.consecutiveFailures} + 1` }),
     })
-    .where(activeOnly)
+    .where(and(eq(providerAccounts.id, accountId), eq(providerAccounts.status, "active")))
     .returning({ consecutiveFailures: providerAccounts.consecutiveFailures });
   if (transient) return;
   const failures = failing[0]?.consecutiveFailures ?? 0;
@@ -196,13 +254,18 @@ export async function recordAccountCheck(
   // pass. The cooldown clears itself; a success before it elapses resets the
   // count above.
   if (failures >= QUOTA_FAILURE_PARK_THRESHOLD) {
-    await db
-      .update(providerAccounts)
-      .set({
-        status: "cooldown",
-        cooldownUntil: new Date(Date.now() + QUOTA_FAILURE_COOLDOWN_MS),
-      })
-      .where(activeOnly);
+    // Converge on the health application seam (proposal §3.5): quota refresh
+    // parking is a producer into `applyAccountVerdict`, not a separate state
+    // machine.
+    const parked = await applyAccountVerdict(db, {
+      accountId,
+      status: "cooldown",
+      reason: outcome.error ?? "Account check failed",
+      category: outcome.category ?? "quota_fetch_failed",
+      cooldownUntil: new Date(Date.now() + QUOTA_FAILURE_COOLDOWN_MS),
+      fromStatus: "active",
+    });
+    if (parked) await snapshotInvalidator?.invalidate();
   }
 }
 
@@ -407,7 +470,11 @@ async function runQuotaRefresh(
         error: error instanceof Error ? error.message : "Failed to refresh quota",
       };
     }
-    failure = quota.error === null ? null : "quota_fetch_failed";
+    failure = quota.error === null
+      ? null
+      : quota.authInvalidated === true
+        ? "auth_invalidated"
+        : "quota_fetch_failed";
   }
 
   // Cache even a failed fetch: the error view ("credential expired", "quota
@@ -427,7 +494,13 @@ async function runQuotaRefresh(
     try {
       await deps.db
         .update(providerAccounts)
-        .set({ quotaPlan: quota.plan })
+        .set({
+          quotaPlan: quota.plan,
+          // Freshness stamp for the plan column: routing uses it to downgrade
+          // a plan older than the freshness horizon to `unknown` instead of
+          // trusting a weeks-old string.
+          quotaPlanFetchedAt: new Date(),
+        })
         .where(eq(providerAccounts.id, target.accountId));
     } catch (error) {
       log.warn(`[quota] failed to record plan for account=${target.accountId}`, error as Error);
@@ -469,10 +542,16 @@ async function runQuotaRefresh(
     }
   }
   try {
-    await recordAccountCheck(deps.db, target.accountId, {
-      ok: quota.error === null,
-      ...(quota.error === null ? {} : { error: quota.error, category: failure ?? "quota_fetch_failed" }),
-    });
+    await recordAccountCheck(
+      deps.db,
+      target.accountId,
+      {
+        ok: quota.error === null,
+        ...(quota.error === null ? {} : { error: quota.error, category: failure ?? "quota_fetch_failed" }),
+        ...(quota.authInvalidated === true ? { authInvalidated: true } : {}),
+      },
+      deps.snapshotInvalidator,
+    );
   } catch (error) {
     // A stamp failure must not lose the freshly fetched quota.
     log.warn(`[quota] failed to stamp check outcome for account=${target.accountId}`, error as Error);

package/src/security/api-key-auth-cache.ts

@@ -1,7 +1,7 @@
 /** Bounded process-local authorization cache; shared-cache I/O stays in the auth service. */
 export const AUTH_CACHE_TTL_MS = 3_000;
 const AUTH_CACHE_MAX_ENTRIES = 10_000;
-const AUTH_NEGATIVE_CACHE_TTL_MS = 1_500;
+export const AUTH_NEGATIVE_CACHE_TTL_MS = 1_500;
 const AUTH_FAILURE_COOLDOWN_MS = 1_000;
 
 interface CacheEntry<T> {

package/src/security/api-key-auth.ts

@@ -21,8 +21,12 @@ import type { ApiKeyModelAccessMode } from "../persistence/schema";
  * snapshot's consumed value is a reference point, so a brief stale window
  * cannot meaningfully over-consume a budget.
  *
- * Negative results (unknown/revoked tokens) are deliberately NOT cached, so
- * a newly minted key is usable immediately.
+ * Unknown or revoked tokens are negative-cached for
+ * `AUTH_NEGATIVE_CACHE_TTL_MS` (1.5s): a token rejected within that window
+ * stays refused even if its key is minted or un-revoked in between. A newly
+ * minted key is usable immediately only because `invalidateApiKeyCache`
+ * clears the negative entries when a mutation lands — not because negatives
+ * are absent.
  */
 const authorizationCache = createApiKeyAuthorizationCache<ResolvedApiKey>();
 

package/src/security/ip-boundary.ts

@@ -9,7 +9,7 @@ import {
   ipv6ToBigInt,
   isLoopbackAddress,
   unwrapMappedIpv4,
-} from "../network/ip-utils";
+} from "../network/util/ip";
 
 export { isLoopbackAddress };
 

package/src/transport/dispatch/attempt-finalize.ts

@@ -20,7 +20,7 @@ import { modelsDevCatalog } from "../../providers/discovery/models-dev-catalog";
 import {
   disablePoolForProxyHttpStatus,
   recordPoolDispatchOutcome,
-} from "../../network/pool-health-machine";
+} from "../../network/pool/health";
 import { ProxyConnectRefusalError } from "../../network/pool/agent";
 import { captureDepthMaxBytes, providerCaptureMaxBytes } from "./capture-policy";
 
@@ -622,19 +622,20 @@ export function nativeCompletionBase(input: {
   | "tokensPerSec"
 > {
   return {
-    providerId: input.providerId,
-    modelId: input.modelId,
-    tenantId: input.tenantId,
-    ingressBody: input.ingressBody,
-    terminal: true,
-    ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
-    ...(input.accountLabel === undefined ? {} : { accountLabel: input.accountLabel }),
-    ...(input.networkPoolId === undefined ? {} : { networkPoolId: input.networkPoolId }),
-    ...(input.lease === undefined ? {} : { lease: input.lease }),
-    db: input.db,
-    ...(input.telemetryBuffer === undefined ? {} : { telemetryBuffer: input.telemetryBuffer }),
-    ...(input.snapshotService === undefined ? {} : { snapshotService: input.snapshotService }),
-    ...(input.providerCapture === undefined ? {} : { providerCapture: input.providerCapture }),
+    ...completionContext({
+      providerId: input.providerId,
+      modelId: input.modelId,
+      tenantId: input.tenantId,
+      ingressBody: input.ingressBody,
+      ...(input.providerCapture === undefined ? {} : { providerCapture: input.providerCapture }),
+      db: input.db,
+      ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
+      ...(input.accountLabel === undefined ? {} : { accountLabel: input.accountLabel }),
+      ...(input.networkPoolId === undefined ? {} : { networkPoolId: input.networkPoolId }),
+      ...(input.lease === undefined ? {} : { lease: input.lease }),
+      ...(input.telemetryBuffer === undefined ? {} : { telemetryBuffer: input.telemetryBuffer }),
+      ...(input.snapshotService === undefined ? {} : { snapshotService: input.snapshotService }),
+    }),
     ...(input.usage === undefined ? {} : { usage: input.usage }),
     ...(input.commitUsage === undefined ? {} : { commitUsage: input.commitUsage }),
   };

package/src/transport/dispatch/attempt-loop.ts

@@ -20,7 +20,7 @@ import {
 import { resolveRouteMaxAttempts } from "../../config/timeouts";
 import type { OAuthTokenRefresher } from "../../providers/authentication/oauth-refresh-service";
 import type { OAuthRefreshService } from "../../providers/authentication/oauth-refresh-service";
-import type { ValidatedNetworkBindingFactory } from "../../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../../network/egress/factory";
 import type { ByokUpstreamHost } from "../../providers/operations/provider-catalog-service";
 import type { AdmissionLease } from "../../security/admission/contracts";
 import type { RouteCandidate, Reservation, RouteSnapshotService } from "../routing/route-model";
@@ -32,7 +32,7 @@ import { metrics } from "../../observability/metrics";
 import type { NetworkPoolSelector } from "../../network/pool/selector";
 import type { ProxyRequestState } from "../request/state";
 import type { TelemetryBatchBuffer } from "../../observability/telemetry-buffer";
-import { flagPoolBlocked, flagPoolCooldown } from "../../network/pool-health";
+import { flagPoolOnEgressFailure } from "../../network/pool/health";
 import {
   completeAttempt,
   errorClientResponseBody,
@@ -41,7 +41,7 @@ import {
   type ProviderExchangeCapture,
 } from "./attempt-finalize";
 import { repriceUsage } from "../../providers/provider-usage";
-import { classifyEgressFailure } from "../../network/rate-limit-verdict";
+import { classifyEgressFailure } from "../../network/verdict";
 import { isOAuthCredentialInvalidated } from "./retry-policy";
 import { drainAbortReason } from "../shutdown-notice";
 
@@ -61,6 +61,41 @@ function comboCandidateKey(candidate: RouteCandidate): string {
   ].join(":");
 }
 
+/**
+ * Extra dials allowed for a mid-response upstream socket drop when the
+ * candidate list is exhausted (single-account providers). One extra dial
+ * recovers the transient reset; more would stack latency on a dying origin.
+ */
+const MAX_SOCKET_DROP_RETRIES = 1;
+
+/**
+ * Normalizes a raw (non-GatewayError) failure before it escapes the loop.
+ *
+ * A transport-level throw — e.g. Bun's `TypeError` with
+ * `code: "ECONNRESET"` when the upstream socket dies mid-response — carries a
+ * `.code` of its own. The error middleware reads that `.code` for Elysia
+ * built-in errors, so a raw socket drop leaked to the client as
+ * `{"code":"ECONNRESET","status":400}` with origin `cartethyia`: the wrong
+ * code, the wrong status, and the wrong blame. The classifier already knows
+ * what this is (`transport_unavailable`, 502, upstream) — materialize it as a
+ * real GatewayError so the client and the captured Client Response see the
+ * same stable envelope every other upstream transport failure gets.
+ */
+function normalizeEscapeError(error: unknown, signal: AbortSignal): unknown {
+  if (error instanceof GatewayError) return error;
+  const terminal = classifyTerminalOutcome(error, signal);
+  if (terminal.errorCategory === "transport_unavailable") {
+    return new GatewayError(
+      "transport_unavailable",
+      502,
+      "The upstream closed the connection mid-response (request {requestId}). Retry; if it keeps happening, the account or pool is unstable. The connection ghosted us — come back in a moment 👻",
+      {},
+      "upstream",
+    );
+  }
+  return error;
+}
+
 /**
  * True when the rejection is about the API key or the gateway's own policy,
  * not about the provider account that was dialled.
@@ -321,7 +356,7 @@ export async function runAttemptLoop<TResult, TAdapter>(
             status: terminal.status === "cancelled" ? "cancelled" : "failed",
           });
         }
-        throw lastError;
+        throw normalizeEscapeError(lastError, state.abortController.signal);
       }
     }
     let lease: AdmissionLease | undefined;
@@ -381,6 +416,13 @@ export async function runAttemptLoop<TResult, TAdapter>(
       // names the real cause.
       const drain = drainAbortReason(state.abortController.signal.reason);
       if (drain !== undefined) error = drain;
+      // Normalize a raw transport throw (e.g. Bun's `TypeError` with
+      // `code: "ECONNRESET"` when the upstream socket dies mid-response) into
+      // the stable `transport_unavailable`/502/upstream GatewayError **before**
+      // classification, so the telemetry row, the captured Client Response, and
+      // the escaped error all agree — and the raw `.code` never leaks to the
+      // client as a fake Elysia built-in code (see `normalizeEscapeError`).
+      error = normalizeEscapeError(error, state.abortController.signal);
       lastError = error;
       // A drain is a *server* close, not a client cancel: it must be recorded
       // as a failure with the shutdown code, and it is never retryable.
@@ -411,21 +453,33 @@ export async function runAttemptLoop<TResult, TAdapter>(
       // the pool excluded. Both flag helpers write the local entry
       // synchronously, so the ordering holds even though the Redis mirror is
       // fire-and-forget.
-      if (networkPoolId && deps.poolSelector && error instanceof GatewayError) {
-        if (rateLimitedPool) {
-          flagPoolCooldown(deps.poolSelector, deps.db, networkPoolId, candidate.provider_id, error);
-        } else if (blockedPool) {
-          // The address itself is refused, not the request: retire the egress
-          // so the next attempt leaves by a different one instead of retrying
-          // a proxy the upstream has already flagged.
-          flagPoolBlocked(deps.poolSelector, deps.db, networkPoolId, candidate.provider_id, error);
-        }
-      }
+      flagPoolOnEgressFailure(
+        deps.poolSelector,
+        deps.db,
+        networkPoolId,
+        candidate.provider_id,
+        error,
+        egressVerdict,
+      );
+      // A mid-response upstream socket drop (`transport_unavailable`) is the one
+      // retryable failure that receives an extra dial even when the candidate
+      // list is exhausted: an origin that closes the connection before the
+      // response is often transient (Trae's edge resets under concurrency),
+      // and the fresh dial recovers it — verified live 2026-11-09, 7/7
+      // recovered on the first retry. Without this, a single-account provider
+      // (the common case) tripped `index === candidates.length - 1` on the very
+      // first attempt and the client saw the raw socket error. The retry is
+      // bounded to one extra dial per request, never unbounded.
+      const memberAttempts = attemptsByMember.get(memberKey) ?? 0;
+      const socketDropRetryLeft =
+        terminal.errorCategory === "transport_unavailable" &&
+        !cancelled &&
+        memberAttempts < MAX_SOCKET_DROP_RETRIES;
       const terminalAttempt =
         cancelled ||
         isClientScopedRejection(error) ||
         !isRetryableFailure(error) ||
-        (index === candidates.length - 1 && !poolScopedFailure);
+        ((index === candidates.length - 1 && !poolScopedFailure) && !socketDropRetryLeft);
       // Track only the most recent fired exchange; the array this replaced
       // accumulated every attempt's capture until the loop returned.
       if (providerCapture.request !== null) lastFiredCapture = providerCapture;
@@ -474,7 +528,7 @@ export async function runAttemptLoop<TResult, TAdapter>(
       // A 403 can be a deterministic provider policy rejection, not an
       // invalid OAuth credential. Only the evidence-based classifier above
       // may trigger a refresh.
-      const candidateKey = `${candidate.provider_id}:${candidate.provider_account_id ?? "global"}:${candidate.model_id}:${candidate.endpoint}`;
+      const candidateKey = comboCandidateKey(candidate);
       const authInvalidated = isOAuthCredentialInvalidated(error);
       if (
         !cancelled &&
@@ -499,7 +553,7 @@ export async function runAttemptLoop<TResult, TAdapter>(
       }
       if (terminalAttempt) {
         metrics.proxy_requests_total.inc(1, { status: cancelled ? "cancelled" : "failed" });
-        throw error;
+        throw normalizeEscapeError(error, state.abortController.signal);
       }
       // A failed combo member stays flagged for this request. Move it behind
       // every candidate that has not failed yet, so the next attempt cannot
@@ -542,7 +596,7 @@ export async function runAttemptLoop<TResult, TAdapter>(
         // as the sleep's own error would leave `proxy_requests_total` missing
         // the request.
         metrics.proxy_requests_total.inc(1, { status: "cancelled" });
-        throw lastError;
+        throw normalizeEscapeError(lastError, state.abortController.signal);
       }
     }
   }
@@ -577,5 +631,5 @@ export async function runAttemptLoop<TResult, TAdapter>(
     }));
   }
   metrics.proxy_requests_total.inc(1, { status: "failed" });
-  throw lastError;
+  throw normalizeEscapeError(lastError, state.abortController.signal);
 }

package/src/transport/dispatch/generation.ts

@@ -27,6 +27,7 @@ import { completeAttempt, estimatedUsage, nativeCompletionBase } from "./attempt
 import { runAttemptLoop } from "./attempt-loop";
 import { captureProviderRateLimit } from "./ratelimit-capture";
 import {
+  forwardUpstreamResponse,
   hasScope,
   jsonResponse,
   networkFetchContext,
@@ -133,14 +134,7 @@ async function passThrough(
     responseBody: null,
   });
   metrics.proxy_requests_total.inc(1, { status: "completed" });
-  return new Response(upstream.body, {
-    status: upstream.status,
-    headers: {
-      "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
-      "cache-control": "no-store",
-      "x-request-id": state.requestId,
-    },
-  });
+  return forwardUpstreamResponse(upstream, state.requestId, "text/event-stream");
 }
 
 /** Builds the handler for one generation surface. */

package/src/transport/dispatch/handler-deps.ts

@@ -11,7 +11,7 @@ import type { CartethyiaDatabase } from "../../persistence/db-handle";
 import type { ProviderAdapter } from "../../providers/provider-contracts";
 import type { OAuthRefreshService, OAuthTokenRefresher } from "../../providers/authentication/oauth-refresh-service";
 import type { NetworkPoolSelector } from "../../network/pool/selector";
-import type { ValidatedNetworkBindingFactory } from "../../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../../network/egress/factory";
 import type { TelemetryBatchBuffer } from "../../observability/telemetry-buffer";
 import type { ProxyRequestPreparer } from "../request/preparer";
 import type { ProxyRequestStateStore } from "../request/state";

package/src/transport/dispatch/leases.ts

@@ -5,7 +5,7 @@ import type { ApiKeyAuthorizationSnapshot } from "../../security/api-key-auth";
 import type { ByokUpstreamHost } from "../../providers/operations/provider-catalog-service";
 import type { PoolRotation, PoolSelectionFailure } from "../../network/pool/selector";
 import type { NetworkPoolSelector } from "../../network/pool/selector";
-import type { ValidatedNetworkBindingFactory } from "../../network/pool/resolver";
+import type { ValidatedNetworkBindingFactory } from "../../network/egress/factory";
 import type { RouteCandidate as RouteCandidate, Reservation, RoutePlan } from "../routing/route-model";
 import type { RoutingEngine } from "../routing/router";
 

package/src/transport/dispatch/native-shared.ts

@@ -71,6 +71,31 @@ export function jsonResponse(payload: unknown, status: number, requestId: string
   });
 }
 
+/**
+ * Forwards an upstream response body verbatim with the shared native-response
+ * header set.
+ *
+ * The native handlers (System One, responses-compact, token-count,
+ * generation's passThrough) each spelled the same three headers by hand; the
+ * copies drifted at least once (generation's JSON builder lost `cache-control`).
+ * Status and body come from the upstream untouched; only the content-type
+ * default differs per route (SSE vs JSON) and is passed per call.
+ */
+export function forwardUpstreamResponse(
+  response: Response,
+  requestId: string,
+  defaultContentType = "application/json",
+): Response {
+  return new Response(response.body, {
+    status: response.status,
+    headers: {
+      "content-type": response.headers.get("content-type") ?? defaultContentType,
+      "cache-control": "no-store",
+      "x-request-id": requestId,
+    },
+  });
+}
+
 /**
  * Strips a thinking suffix (`model(high)`) from the model name and rebuilds
  * the body with the bare model when it changed. Returns the bare model and