qwenproxy-cli 1.0.0 → 1.0.1

package/src/routes/chat/account.ts

@@ -1,1817 +1,1817 @@
-import { v4 as uuidv4 } from "uuid";
-import {
-	getAccountCooldownInfo,
-	getNextAccount,
-	getNextAvailableAccount,
-	markAccountRateLimited,
-	syncCooldownsFromDb,
-} from "../../core/account-manager.ts";
-import { markAccountSuccessful, markAccountFailed, getAccountsByPriority } from "../../core/account-priority.ts";
-import { recordWafHardBlock, noteWafRecovery } from "../../core/waf-isolation.ts";
-import { loadAccounts, type QwenAccount } from "../../core/accounts.ts";
-import { config, type ChatMode } from "../../core/config.ts";
-import { ClientAbortedError, UpstreamRateLimit, ValidationError } from "../../core/errors.ts";
-import {
-  assertPromptWithinLimits,
-  truncatePromptToIntelligentLimit,
-} from "../../core/prompt-limits.ts";
-import {
-	formatCooldownUntil,
-	isToolcallDebugEnabled,
-	logger,
-	maskEmail,
-} from "../../core/logger.ts";
-import { Mutex } from "../../core/mutex.ts";
-import { registerStream, removeStream } from "../../core/stream-registry.ts";
-import {
-	abortLeaseByLabel,
-	acquireAccountLease,
-	isAccountBusy,
-	isAccountSlotHeldByOtherSession,
-	isAccountTemporarilyBusy,
-	markAccountTemporarilyBusy,
-	markLeaseCompletion,
-	tryAcquireAccountLease,
-	type AccountLease,
-} from "../../core/account-concurrency.ts";
-import { isAuthMockEnabled } from "../../services/auth-playwright.ts";
-import { refreshHeaders } from "../../services/playwright.ts";
-import {
-	clearAllSessionsForAccount,
-	createQwenStream,
-	fetchQwenModels,
-	getQwenErrorCode,
-	getLogicalThreadState,
-	invalidateLogicalThreadParent,
-	type LogicalThreadEntry,
-	PersonalizationSyncError,
-	QwenSessionExpiredError,
-	RetryableQwenStreamError,
-	syncQwenRequestPersonalization,
-	updateLogicalThreadState,
-} from "../../services/qwen.ts";
-import type { TokenEstimationContext } from "../../services/token-estimation-metrics.ts";
-import {
-  buildContextMeterSnapshot,
-  contextMeterLogData,
-  type ContextMeterMode,
-} from "../../services/context-meter.ts";
-import type { QwenFileEntry } from "../upload.ts";
-import type { Message } from "../../utils/types.ts";
-import { buildRepeatedToolCallReminder } from "../../utils/tool-call-guard.ts";
-import {
-	classifyRetryAction,
-	isAntiBotError as isAntiBotPolicyError,
-	isAccountInitializationError,
-	isChatInProgressError,
-	isQuotaLikeError,
-	isTerminalLocalError,
-	shouldRetryInvalidInputOnSameAccount,
-} from "./retry-policy.ts";
-
-/** How many alternate accounts a single request may try after a WAF challenge. */
-const MAX_ANTI_BOT_ROTATIONS = 1;
-
-/**
- * Hard deadline for the whole personalization sync. A normal sync takes ~2s;
- * a stuck account page (closed context / WAF) can otherwise hold each browser
- * op for 60s and keep the personalization mutex blocked for minutes.
- */
-const PERSONALIZATION_SYNC_DEADLINE_MS = 30_000;
-
-/**
- * Hard deadline for a single stream-acquire attempt (models sync + truncation
- * + personalization + header capture + completion fetch metadata + internal
- * retries). A silent hang past this (observed: 180s with zero logs) fails the
- * attempt with a visible retryable error so the outer loop switches account.
- * Configurable via ACQUIRE_DEADLINE_MS (default 120000).
- */
-
-// Per-chat lock: serializes requests to the same Qwen chat session
-const chatLocks = new Map<string, Mutex>();
-// Account-level personalization is global mutable Qwen state; keep update+stream
-// creation serialized per account when the experimental request-sync mode is used.
-const personalizationLocks = new Map<string, Mutex>();
-
-	export async function acquireChatLock(chatId: string): Promise<() => void> {
-	const acquireStartedAt = Date.now();
-	const timeoutMs = config.concurrency.chatLockTimeoutMs;
-	let mutex = chatLocks.get(chatId);
-	if (!mutex) {
-		mutex = new Mutex(
-			`chat:${chatId.substring(0, 8)}`,
-			// The chat lock is held for the whole stream lifetime. A long
-			// generation (reasoning + huge context) can legitimately exceed the
-			// global 120s hold limit; use the same budget as the acquire timeout
-			// so the force-release never kills a healthy mid-stream turn.
-			timeoutMs,
-		);
-		chatLocks.set(chatId, mutex);
-	}
-	const release = await mutex.acquire(timeoutMs, `chat:${chatId.substring(0, 12)}`);
-	// Held time must exclude the wait: capture right after the acquire settles,
-	// not at function entry (the wait is already visible as `waited Xms` above).
-	const heldStartedAt = Date.now();
-	if (logger.isLevelEnabled("info")) {
-		console.log(
-			`🔐 [Chat] Chat lock acquired | chat=${chatId.substring(0, 12)} | waited ${heldStartedAt - acquireStartedAt}ms`,
-		);
-	}
-	return () => {
-		release();
-		if (logger.isLevelEnabled("info")) {
-			console.log(
-				`🔓 [Chat] Chat lock released | chat=${chatId.substring(0, 12)} | held ${Date.now() - heldStartedAt}ms`,
-			);
-		}
-		if (mutex!.isIdle()) {
-			chatLocks.delete(chatId);
-		}
-	};
-}
-
-async function acquirePersonalizationLock(
-	accountId: string,
-): Promise<() => void> {
-	let mutex = personalizationLocks.get(accountId);
-	if (!mutex) {
-		mutex = new Mutex(`personalization:${accountId.substring(0, 8)}`);
-		personalizationLocks.set(accountId, mutex);
-	}
-	const release = await mutex.acquire(60_000, `personalization:${accountId.substring(0, 8)}`);
-	return () => {
-		release();
-		if (mutex!.isIdle()) {
-			personalizationLocks.delete(accountId);
-		}
-	};
-}
-
-export interface SelectedAccount {
-	id: string;
-	email: string;
-	password: string;
-}
-
-export interface StreamCreationResult {
-	stream: ReadableStream;
-	uiSessionId: string;
-	activeAccountId: string;
-	activeAccountLabel: string;
-	/** True when the request resent the FULL prompt on a new upstream chat
-	 * (account switch / missing thread parent). The 📤 log line uses this to
-	 * show the real payload instead of the thread-native delta. */
-	replayedFullContext: boolean;
-	completionId: string;
-	logicalSessionId: string | null;
-	createdNewChat: boolean;
-	tokenEstimationContext: TokenEstimationContext;
-	releaseAccountLease: () => void;
-}
-
-export interface StreamCreationFailure {
-	error: any;
-	completionId: string;
-	allOnCooldown: boolean;
-	retryAfterMs?: number;
-}
-
-export interface AcquireParams {
-	finalPrompt: string;
-	fullPrompt: string;
-	isThinkingModel: boolean;
-	model: string;
-	reasoningMode?: "auto" | "thinking" | "fast";
-	shouldResetUpstreamThread: boolean;
-	allFiles: QwenFileEntry[];
-	isNewSession: boolean;
-	sessionId: string | null;
-	useThreadNative: boolean;
-	updateLogicalThread: boolean;
-	allowThreadReuse: boolean;
-	/** "thread" (reuse upstream chat) or "temp" (new ephemeral chat per request). */
-	chatMode: ChatMode;
-	/** Full message history for intelligent context truncation after model sync. */
-	messages?: Message[];
-	forceNewChat?: boolean;
-	/**
-	 * Prefer this account when available.
-	 * - undefined/omit: use sticky thread account when present, else round-robin
-	 * - string: pin to that account if configured
-	 * - null: explicitly rotate away from sticky/current account (error failover)
-	 */
-	preferredAccountId?: string | null;
-	/** When rotating, exclude these account ids from the first pick. */
-	excludeAccountIds?: string[];
-	messageCount?: number;
-	fullMessageCount?: number;
-	  toolsCount?: number;
-	  requestPersonalizationInstruction?: string | null;
-	  /** Mapped Qwen model id used for local prompt-budget validation. */
-	  contextModelId?: string;
-	  requestSignal?: AbortSignal;
-	  /** Context accounting mode for this concrete upstream attempt. */
-	  contextMode?: ContextMeterMode;
-	  /** Allow this request to retry the account it just marked temporarily busy. */
-	  allowTemporarilyBusyAccountId?: string;
-	  /**
-	   * True when this request races a same-session stream that has NOT emitted
-	   * yet: run on its OWN chat and hop accounts fast instead of waiting.
-	   */
-	  parallelEscape?: boolean;
-	}
-
-/** Exported for unit tests — selects the first account for a request. */
-export function resolveInitialAccount(
-  preferredAccountId?: string | null,
-  excludeAccountIds?: Iterable<string>,
-): {
-  account: SelectedAccount;
-  configuredAccounts: SelectedAccount[];
-} {
-	if (isAuthMockEnabled()) {
-		return {
-			account: { id: "mock-account", email: "mock@test.com", password: "" },
-			configuredAccounts: [],
-		};
-	}
-
-	const configuredAccounts = loadAccounts();
-	if (configuredAccounts.length > 0) {
-		syncCooldownsFromDb(configuredAccounts);
-		const excluded = new Set(excludeAccountIds ?? []);
-
-		// Explicit preferred account (sticky / same-account retry)
-		if (typeof preferredAccountId === "string" && preferredAccountId) {
-			const preferred = configuredAccounts.find(
-				(candidate) => candidate.id === preferredAccountId,
-			);
-			if (preferred && !getAccountCooldownInfo(preferred.id)) {
-				return { account: preferred, configuredAccounts };
-			}
-			// Preferred is missing/on cooldown: fall through to next available.
-			if (preferred) excluded.add(preferred.id);
-		}
-
-		// Error failover: rotate away from sticky/current account when requested.
-		if (preferredAccountId === null || excluded.size > 0) {
-			const next = getNextAvailableAccount(excluded);
-			if (next) return { account: next, configuredAccounts };
-		}
-
-		const account = getNextAccount();
-		if (!account) {
-			// All accounts on cooldown; caller will handle this.
-			return { account: configuredAccounts[0], configuredAccounts };
-		}
-		return { account, configuredAccounts };
-	}
-
-	throw new ValidationError(
-		"Nenhuma conta Qwen configurada no servidor. Adicione uma conta na aba [5] Contas da TUI.",
-	);
-}
-
-function isAccountUnavailableError(err: any): boolean {
-	// Quota/rate-limit style failures that should cool the account and rotate.
-	if (isQuotaLikeError(err)) return true;
-	return (
-		(err instanceof UpstreamRateLimit &&
-			!(err instanceof RetryableQwenStreamError)) ||
-		err?.upstreamCode === "RateLimited" ||
-		err?.upstreamStatus === 429
-	);
-}
-
-function isAntiBotError(err: any): boolean {
-	return isAntiBotPolicyError(err);
-}
-
-function hasFreeAlternateAccount(
-	accounts: SelectedAccount[],
-	currentAccountId: string,
-	triedAccountIds: Set<string>,
-): boolean {
-	return accounts.some(
-		(candidate) =>
-			candidate.id !== currentAccountId &&
-			!triedAccountIds.has(candidate.id) &&
-			!getAccountCooldownInfo(candidate.id) &&
-			!isAccountTemporarilyBusy(candidate.id) &&
-			!isAccountBusy(candidate.id),
-	);
-}
-
-/**
- * Pick the next account for a PARALLEL escape, preferring one with a FREE slot:
- * not busy, not temporarily busy, not on cooldown, not already tried. A normal
- * request keeps getNextAvailableAccount (cooldown-only picker) so saturated or
- * single-account pools stay lossless — but an auxiliary parallel request must
- * land on an available slot fast and never queue behind a second occupied
- * account (the 2026-08-20 stall rotated ldyjl->cgnx3, both busy, ~14s wait).
- * Falls back to the cooldown-only picker when no FREE account is left, so a
- * fully-busy pool still rotates instead of dead-ending.
- */
-function getNextFreeAccountForParallel(
-	accounts: QwenAccount[],
-	triedAccountIds: Set<string>,
-	currentAccountId: string,
-): QwenAccount | null {
-	const ordered = getAccountsByPriority(accounts);
-	const free = ordered.find(
-		(c) =>
-			c.id !== currentAccountId &&
-			!triedAccountIds.has(c.id) &&
-			!getAccountCooldownInfo(c.id) &&
-			!isAccountTemporarilyBusy(c.id) &&
-			!isAccountBusy(c.id),
-	);
-	if (free) return free;
-	// No free slot anywhere: fall back to the normal picker so we still rotate
-	// (the tryAcquireAccountLease fail-fast will report account_busy and the
-	// loop gives up rather than blocking on a busy pool).
-	return getNextAvailableAccount(triedAccountIds);
-}
-
-
-async function attemptRelogin(
-	accountId: string,
-	accountEmail: string,
-): Promise<boolean> {
-	try {
-		await refreshHeaders(accountId);
-		console.log(
-			`✅ [Chat] Playwright headers refreshed for ${maskEmail(accountEmail)}. Retrying...`,
-		);
-		return true;
-	} catch (refreshErr: unknown) {
-		logger.error("[Chat] Playwright header refresh failed", {
-			accountEmail: maskEmail(accountEmail),
-			error:
-				refreshErr instanceof Error ? refreshErr.message : String(refreshErr),
-			cause:
-				refreshErr instanceof Error
-					? refreshErr.constructor.name
-					: typeof refreshErr,
-		});
-	}
-	return false;
-}
-
-export async function acquireUpstreamStream(
-	params: AcquireParams,
-): Promise<StreamCreationResult | StreamCreationFailure> {
-	const {
-		finalPrompt,
-		isThinkingModel,
-		model,
-		reasoningMode,
-		shouldResetUpstreamThread,
-		allFiles,
-		isNewSession,
-		sessionId,
-		useThreadNative,
-		updateLogicalThread,
-		allowThreadReuse,
-		chatMode,
-		forceNewChat = false,
-		preferredAccountId,
-		excludeAccountIds,
-	} = params;
-
-	const completionId = "chatcmpl-" + uuidv4();
-	// Sticky thread binding is independent of forceNewChat. forceNewChat only
-	// means "open a fresh upstream chat", not "forget which account owned the
-	// logical conversation".
-	const threadState =
-		allowThreadReuse && sessionId ? getLogicalThreadState(sessionId) : null;
-	const stickyThreadAccountId = threadState?.accountId ?? null;
-	const canReuseUpstreamChat =
-		!!threadState &&
-		!forceNewChat &&
-		!!threadState.chatSessionId &&
-		threadState.chatSessionId.length > 0 &&
-		!!threadState.parentId;
-	// A thread with an upstream chat but no committed parent is dirty (failed
-	// first turn, interrupted generation, corrupted history). It must not be
-	// appended to; rebuild a fresh chat with the full prompt instead.
-	const threadMissingParent =
-		!!threadState &&
-		!!threadState.chatSessionId &&
-		threadState.chatSessionId.length > 0 &&
-		!threadState.parentId;
-	const existingThread = canReuseUpstreamChat ? threadState : null;
-
-	// preferredAccountId:
-	// - string: pin to account
-	// - null: explicit failover away from sticky (error path)
-	// - undefined: keep sticky when available
-	// A PARALLEL escape must NOT pin to the sticky thread owner: it races the
-	// main generation that is likely using that very account, so targeting the
-	// sticky would just fail-fast account_busy and waste a rotation hop (the
-	// 2026-08-20 02:43:41 stall: parallel req chose the sticky busy account, then
-	// a second busy one, ~18s until the client aborted). Rotate to any account
-	// so the first hop has a real chance of landing on a free slot.
-	const effectivePreferred = params.parallelEscape ? null : preferredAccountId;
-	const resolvedPreferred =
-		effectivePreferred === null
-			? null
-			: (effectivePreferred ?? stickyThreadAccountId ?? undefined);
-	const excludeSet = new Set(excludeAccountIds ?? []);
-	// When rotating away (resolvedPreferred === null) — either an explicit
-	// failover OR a parallel escape — exclude the sticky owner so the rotation
-	// can never land back on the account the main generation is using.
-	if (resolvedPreferred === null && stickyThreadAccountId) {
-		excludeSet.add(stickyThreadAccountId);
-	}
-
-	const resolved = resolveInitialAccount(resolvedPreferred, excludeSet);
-
-	if (logger.isLevelEnabled("info")) {
-		// Why THIS account? The operator needs the decision, not just the
-		// result — the previous rounds' "stale label" / "switching" confusion
-		// came from logs that showed only the outcome.
-		const poolSize = resolved.configuredAccounts.length;
-		const cooldownCount = resolved.configuredAccounts.filter((a) =>
-			getAccountCooldownInfo(a.id),
-		).length;
-		const why =
-			resolved.account.id === stickyThreadAccountId
-				? "sticky"
-				: typeof resolvedPreferred === "string" &&
-					resolved.account.id === resolvedPreferred
-					? "preferred"
-					: resolvedPreferred === null
-						? "failover-rotate"
-						: "round-robin";
-		console.log(
-			`🎯 [Chat] Account selected | ${maskEmail(resolved.account.email)} (${resolved.account.id}) | reason=${why} | pool=${poolSize}${cooldownCount ? ` | cooldown=${cooldownCount}` : ""}${stickyThreadAccountId ? ` | sticky=${stickyThreadAccountId === resolved.account.id}` : ""}`,
-		);
-	}
-
-	let account: SelectedAccount | null = resolved.account;
-	const configuredAccounts = resolved.configuredAccounts;
-	const triedAccountIds = new Set<string>();
-	let lastError: any = null;
-	let antiBotRotations = 0;
-
-	while (account) {
-		const accountId = account.id;
-		const accountEmail = maskEmail(account.email);
-
-		if (triedAccountIds.has(accountId)) {
-			account = getNextAvailableAccount(triedAccountIds);
-			continue;
-		}
-		triedAccountIds.add(accountId);
-
-		// Skip accounts that recently returned chat_in_progress (temporary busy) —
-		// except the sticky thread owner: hopping the owner splinters the
-		// conversation and replays the full context on a cold account (~12s
-		// reopen + captcha) when the upstream chat is merely settling (2-4s,
-		// covered by the same-chat settle retries). Mirrors the saturated-account
-		// exception below.
-		if (
-			isAccountTemporarilyBusy(accountId) &&
-			params.allowTemporarilyBusyAccountId !== accountId &&
-			accountId !== stickyThreadAccountId
-		) {
-			console.log(
-				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) temporarily busy (chat in progress)`,
-			);
-			account = getNextAvailableAccount(triedAccountIds);
-			continue;
-		}
-
-		// Do not wait 30 seconds on a saturated account when another account is
-		// already free. Keep the queue behavior only when this is the last usable
-		// account, so single-account deployments remain lossless.
-		// The thread owner is excluded: rotating the sticky account during a
-		// tool/think pause splinters the conversation across upstream chats, so
-		// it must queue on its own slot instead of being skipped.
-		if (
-			isAccountBusy(accountId) &&
-			accountId !== stickyThreadAccountId &&
-			hasFreeAlternateAccount(configuredAccounts, accountId, triedAccountIds)
-		) {
-			console.log(
-				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) busy; rotating to a free account`,
-			);
-			const nextCandidate = getNextAvailableAccount(triedAccountIds);
-			if (nextCandidate && !getAccountCooldownInfo(nextCandidate.id)) {
-				account = nextCandidate;
-				continue;
-			}
-			// No usable alternate account exists (e.g. all other accounts are on cooldown):
-			// do NOT skip this busy account to death. Fall through and queue on its slot.
-		}
-
-		const cooldownInfo = getAccountCooldownInfo(accountId);
-		if (cooldownInfo) {
-			console.log(
-				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) on cooldown for ${Math.round(cooldownInfo.remainingMs / 1000)}s (${cooldownInfo.reason})`,
-			);
-			if (stickyThreadAccountId === accountId) {
-				console.warn(
-					`⚠️  [Chat] Sticky account is on cooldown; recreating upstream chat on another account with full context.`,
-				);
-			}
-			account = getNextAvailableAccount(triedAccountIds);
-			continue;
-		}
-
-		if (isToolcallDebugEnabled()) {
-			logger.debug("[chat] account selected", {
-				accountId,
-				accountEmail,
-				isNewSession,
-				isThinkingModel,
-				promptLength: finalPrompt.length,
-			});
-		}
-
-		if (useThreadNative && logger && process.env.CHAT_REQUEST_LOG === "true") {
-			logger.info("[chat] thread-native routing", {
-				sessionId,
-				accountId,
-				stickyAccountId: stickyThreadAccountId,
-				hasExistingThread: !!existingThread,
-				existingChatSessionId: existingThread?.chatSessionId || null,
-				existingParentId: existingThread?.parentId || null,
-				instructionsSent: existingThread?.instructionsSent || false,
-				allowThreadReuse,
-				forceNewChat,
-				hasExplicitConversationKey: params.allowThreadReuse,
-			});
-		}
-
-		try {
-			// Any account change vs the sticky owner must resend full history into a
-			// brand-new upstream chat — the previous account's parent chain is unusable.
-			// Same-account forceNewChat keeps the caller's finalPrompt (may already be
-			// a rollover summary or a full-history rebuild from the retry layer).
-			const recreatingOnNewAccount =
-				!!stickyThreadAccountId && accountId !== stickyThreadAccountId;
-			const mustReplayFullContext =
-				recreatingOnNewAccount || threadMissingParent;
-			const attemptForceNewChat = forceNewChat || mustReplayFullContext;
-			const attemptFinalPrompt = mustReplayFullContext
-				? params.fullPrompt
-				: finalPrompt;
-			// The thread owner (or a deployment where no alternate account is
-			// free) must queue on its own slot until generation finishes. A hard
-			// 30s busy timeout here would needlessly 500 the same conversation
-			// while the model is paused mid-tool/think.
-			const waitForSlot =
-				(!!stickyThreadAccountId && accountId === stickyThreadAccountId) ||
-				!hasFreeAlternateAccount(
-					configuredAccounts,
-					accountId,
-					triedAccountIds,
-				);
-			const result = await tryCreateStreamWithRetry(
-				{
-					finalPrompt: attemptFinalPrompt,
-					isThinkingModel,
-					model,
-					reasoningMode,
-					shouldResetUpstreamThread,
-					allFiles,
-					sessionId,
-					useThreadNative,
-					updateLogicalThread,
-					forceNewChat: attemptForceNewChat,
-					existingThread:
-						!mustReplayFullContext &&
-						existingThread &&
-						existingThread.accountId === accountId
-							? existingThread
-							: null,
-					messageCount: mustReplayFullContext
-						? (params.fullMessageCount ?? params.messageCount)
-						: params.messageCount,
-					fullMessageCount: params.fullMessageCount,
-					toolsCount: params.toolsCount,
-					requestPersonalizationInstruction:
-						params.requestPersonalizationInstruction,
-					contextModelId: params.contextModelId,
-					fullPrompt: params.fullPrompt,
-					contextMode: mustReplayFullContext
-						? "replay"
-						: params.contextMode,
-					requestSignal: params.requestSignal,
-					queueSlotUntilFree: waitForSlot,
-					messages: params.messages,
-					completionId,
-					parallelEscape: params.parallelEscape,
-					chatMode,
-				},
-				accountId,
-				accountEmail,
-			);
-
-			if (result.success) {
-				registerStream(completionId, {
-					abortController: result.controller,
-					accountId: result.accountId,
-					uiSessionId: result.uiSessionId,
-					targetResponseId: "",
-					headers: result.headers,
-				});
-
-				return {
-					stream: result.stream,
-					uiSessionId: result.uiSessionId,
-					activeAccountId: result.accountId,
-					activeAccountLabel: result.accountEmail,
-					replayedFullContext: mustReplayFullContext,
-					completionId,
-					logicalSessionId:
-						useThreadNative && updateLogicalThread ? sessionId : null,
-					createdNewChat: result.createdNewChat,
-					tokenEstimationContext: {
-						...result.tokenEstimationContext,
-						requestDeclaredToolCount: params.toolsCount ?? 0,
-					},
-					releaseAccountLease: result.releaseAccountLease,
-				};
-			}
-
-			lastError = result.error;
-		} catch (err: any) {
-			lastError = err;
-		}
-
-		// The request signal is shared by every account attempt. Once the client
-		// disconnects, stop the outer rotation loop as well as inner retries.
-		if (params.requestSignal?.aborted) {
-			break;
-		}
-
-		// Client/proxy validation errors must not be retried on other accounts.
-		// In particular, an oversized prompt is independent of the selected
-		// account; rotating accounts only repeats the same 400 response and can
-		// also rebuild the full history several times.
-		if (isTerminalLocalError(lastError)) {
-			break;
-		}
-
-		const quotaInfo = (lastError as any)?.quotaInfo as
-			| {
-					email: string;
-					cooldownSeconds: number;
-					untilStr: string;
-					message: string;
-			  }
-			| undefined;
-		if (quotaInfo) {
-			const stickyRotation =
-				stickyThreadAccountId === accountId &&
-				(isAccountUnavailableError(lastError) ||
-					isAccountInitializationError(lastError) ||
-					isChatInProgressError(lastError));
-			console.warn(
-				`⚠️  [Chat] Quota exceeded | ${quotaInfo.email} | cooldown=${quotaInfo.cooldownSeconds}s${quotaInfo.untilStr} | ${quotaInfo.message}${stickyRotation ? " | switching sticky account with full context" : ""}`,
-			);
-		}
-
-		// chat_in_progress exhaustion is TERMINAL: tryCreateStreamWithRetry already
-		// spent the full same-chat settle budget AND its single bounded escalation
-		// (fresh chat + full replay). Reaching this point means even the escalated
-		// fresh chat failed — the inner loop already cleared the origin binding, so
-		// the client's next turn starts fresh. Rotating from here would only add a
-		// SECOND full-context replay on a cold account for no gain.
-		if (isChatInProgressError(lastError)) {
-			if (logger.isLevelEnabled("info")) {
-				console.log(
-					`🛑 [Chat] chat_in_progress budget exhausted (post-escalation) | ${maskEmail(accountEmail)} | failing without account rotation`,
-				);
-			}
-			break;
-		}
-
-		if (stickyThreadAccountId === accountId) {
-			// A challenged sticky account must be allowed to fall through to the
-			// anti-bot handling below; otherwise the whole conversation dies on the
-			// account the WAF happened to pick.
-			const stickyAccountMustRotate =
-				isAccountUnavailableError(lastError) ||
-				isAccountInitializationError(lastError) ||
-				isAntiBotError(lastError);
-			if (stickyAccountMustRotate) {
-				if (!quotaInfo) {
-					console.warn(
-						`⚠️  [Chat] Sticky account unavailable (${isAntiBotError(lastError) ? "waf_challenge" : "upstream failure"}); trying another account with full context.`,
-					);
-				}
-			} else {
-				break;
-			}
-		}
-
-		// The inner retry loop already replayed this account and tried to clear the
-		// challenge. Hand the request to one other account rather than failing it
-		// outright, then stop: walking the whole pool would only get every account
-		// challenged in turn and multiply the solver budget by the pool size.
-		if (isAntiBotError(lastError)) {
-			// Hard block: the challenge was NOT solved here. Quarantine with an
-			// escalating window AND rotate the device fingerprint + reset the
-			// browser context, so the account does not return from cooldown on the
-			// same identity the WAF already flagged (upstream account-isolation).
-			recordWafHardBlock(accountId);
-
-			if (antiBotRotations >= MAX_ANTI_BOT_ROTATIONS) {
-				console.warn(
-					`⚠️  [Chat] WAF challenge retries exhausted | ${accountEmail} | no further rotation`,
-				);
-				break;
-			}
-
-			const nextAfterChallenge = getNextAvailableAccount(triedAccountIds);
-			if (!nextAfterChallenge) {
-				console.warn(
-					`⚠️  [Chat] WAF challenge retries exhausted | ${accountEmail} | no other account available`,
-				);
-				break;
-			}
-
-			antiBotRotations++;
-			console.warn(
-				`🔄 [Chat] WAF challenge on ${accountEmail}; retrying on ${maskEmail(nextAfterChallenge.email)}`,
-			);
-			account = nextAfterChallenge;
-			continue;
-		}
-
-		if (isToolcallDebugEnabled()) {
-			logger.debug("[chat] account failed, rotating", {
-				accountId,
-				accountEmail: maskEmail(accountEmail),
-				triedAccounts: Array.from(triedAccountIds),
-			});
-		}
-
-		account = getNextAvailableAccount(triedAccountIds);
-	}
-
-	// All accounts exhausted.
-	removeStream(completionId);
-
-	if (!lastError && configuredAccounts.length > 0) {
-		const cooldownInfos = configuredAccounts
-			.map((acc) => getAccountCooldownInfo(acc.id))
-			.filter(
-				(
-					info,
-				): info is NonNullable<ReturnType<typeof getAccountCooldownInfo>> =>
-					info !== null,
-			);
-
-		if (cooldownInfos.length === configuredAccounts.length) {
-			const retryAfterMs = Math.min(
-				...cooldownInfos.map((info) => info.remainingMs),
-			);
-			const cooldownError: any = new Error(
-				`All configured accounts are on cooldown. Retry in about ${Math.max(1, Math.ceil(retryAfterMs / 1000))}s.`,
-			);
-			cooldownError.upstreamStatus = 429;
-			cooldownError.retryAfterMs = retryAfterMs;
-			return {
-				error: cooldownError,
-				completionId,
-				allOnCooldown: true,
-				retryAfterMs,
-			};
-		}
-	}
-
-	if (!lastError) {
-		const busyOrCooldownError: any = new Error(
-			"No accounts available: all accounts are either in use or on cooldown. Retry shortly.",
-		);
-		busyOrCooldownError.upstreamStatus = 429;
-		return {
-			error: busyOrCooldownError,
-			completionId,
-			allOnCooldown: false,
-		};
-	}
-
-	return {
-		error: lastError,
-		completionId,
-		allOnCooldown: false,
-	};
-}
-
-interface CreateStreamSuccess {
-	success: true;
-	stream: ReadableStream;
-	uiSessionId: string;
-	accountId: string;
-	/** Account email that actually served the request (inner rotation may
-	 * switch accounts — parallel escape / other retry policies). */
-	accountEmail: string;
-	controller: AbortController;
-	headers: Record<string, string>;
-	createdNewChat: boolean;
-	tokenEstimationContext: TokenEstimationContext;
-	releaseAccountLease: () => void;
-}
-
-interface CreateStreamFailure {
-	success: false;
-	error: any;
-}
-
-/**
- * Pure: jittered same-chat settle wait for the nth chat_in_progress retry.
- * The base grows with the failure count (busyMs → 2×busyMs from the 4th
- * retry) and context size (promptChars > 500KB/1MB/2MB), randomized within ±25%
- * so concurrent sessions sharing an account never retry in lock-step.
- */
-export function jitterChatInProgressDelay(
-	retryCount: number,
-	busyMs: number,
-	rand: () => number = Math.random,
-	promptChars: number = 0,
-): number {
-	let base = retryCount >= 4 ? busyMs * 2 : busyMs;
-	if (promptChars > 2_000_000) {
-		base = Math.round(base * 1.75);
-	} else if (promptChars > 1_000_000) {
-		base = Math.round(base * 1.5);
-	} else if (promptChars > 500_000) {
-		base = Math.round(base * 1.25);
-	}
-	const raw = base * (0.75 + 0.5 * Math.min(1, Math.max(0, rand())));
-	return Math.min(20_000, Math.max(1, Math.round(raw)));
-}
-
-/**
- * Decision helper for the per-account lease queue deadline.
- *
- * `true` means the request may wait up to `queueWaitForeverCapMs` for the
- * slot (thread owner waiting on its OWN session, or the last usable account).
- * `false` means it waits at most `busyWaitMs` and then fails with
- * `account_busy` so the attempt loop can rotate accounts.
- *
- * The thread-owner preference is NOT enough on its own: when another session
- * holds the slot, waiting long is pure latency (the other session may keep
- * generating for minutes). Only the same-session holder justifies the long
- * wait (same-session latest-wins / tool loop).
- */
-export function shouldWaitQueueForever(
-	isThreadOwnerWaiting: boolean,
-	heldByOtherSession: boolean,
-	hasFreeAlternate: boolean,
-): boolean {
-	return (isThreadOwnerWaiting && !heldByOtherSession) || !hasFreeAlternate;
-}
-
-async function tryCreateStreamWithRetry(
-	params: {
-		finalPrompt: string;
-		fullPrompt: string;
-		isThinkingModel: boolean;
-		model: string;
-		reasoningMode?: "auto" | "thinking" | "fast";
-		shouldResetUpstreamThread: boolean;
-		allFiles: QwenFileEntry[];
-		sessionId: string | null;
-		useThreadNative: boolean;
-		updateLogicalThread: boolean;
-		forceNewChat: boolean;
-		existingThread: LogicalThreadEntry | null;
-		messageCount?: number;
-		fullMessageCount?: number;
-		toolsCount?: number;
-		requestPersonalizationInstruction?: string | null;
-		contextModelId?: string;
-		contextMode?: ContextMeterMode;
-		requestSignal?: AbortSignal;
-		queueSlotUntilFree?: boolean;
-		messages?: Message[];
-		/** Stream registry key; the emit-aware supersede links the lease to it. */
-		completionId: string;
-		/**
-		 * True when this request races a same-session stream that has NOT
-		 * emitted yet (title/parallel request): run on its OWN chat instead of
-		 * waiting on the main chat's lock, and hop accounts fast (tryAcquire).
-		 */
-		parallelEscape?: boolean;
-		/** "thread" (reuse upstream chat) or "temp" (new ephemeral chat per request). */
-		chatMode: ChatMode;
-	},
-	accountId: string,
-	accountEmail: string,
-): Promise<CreateStreamSuccess | CreateStreamFailure> {
-	const maxAttempts = Math.max(1, config.retry.maxAttempts);
-	const maxAccountSwitches = Math.max(0, config.retry.maxAccountSwitches);
-	let attemptsLeft = maxAttempts;
-	let retryDelay = config.retry.baseDelayMs;
-	let attempt = 0;
-	let quotaRetried = false;
-	let accountSwitches = 0;
-	let chatInProgressCount = 0;
-	let chatInProgressEscalated = false;
-	// Account that accumulated the chat_in_progress failures (the one whose
-	// upstream chat is actually stuck "in progress"). The post-budget
-	// escalation switches to a FRESH chat, and the loop-exit session clear
-	// must drop the binding to the stuck chat — NOT clear the sessions of an
-	// account that never served this session (cross-session damage).
-	let chatInProgressOriginAccountId: string | null = null;
-	let chatInProgressOriginAccountEmail: string | null = null;
-	let lastAttemptError: any = null;
-	let invalidInputSameAccountRetried = false;
-	const accounts = loadAccounts();
-	const isSingleAccount = accounts.length <= 1;
-	let currentAccountId = accountId;
-	let currentAccountEmail = accountEmail;
-	const triedAccounts = new Set<string>([accountId]);
-
-	while (attemptsLeft > 0) {
-		attempt++;
-		if (attempt > 1) {
-			console.log(
-				`🔄 [Chat] Retrying request | ${currentAccountEmail} | ${params.model} | ${params.messageCount ?? "?"} msg(s) | ${params.finalPrompt.length} chars${params.toolsCount ? ` | ${params.toolsCount} tool(s)` : ""} | attempt ${attempt}`,
-			);
-		}
-		let attemptError: any = null;
-		let accountLease: AccountLease | null = null;
-		const acquireStartedAt = Date.now();
-
-		try {
-			// The client may have cancelled between account selection and this
-			// attempt (or while a previous attempt was running). Bail before
-			// spending time on model sync, truncation or personalization.
-			if (params.requestSignal?.aborted) {
-				return {
-					success: false,
-					error: new ClientAbortedError(
-						"client aborted before stream creation",
-					),
-				};
-			}
-
-			// Always sync the model catalog so the truncation and prompt-limit
-			// checks use the real context window published by Qwen, not the
-			// conservative registry fallback. The call is cached per account.
-			try {
-				await fetchQwenModels(currentAccountId);
-			} catch (metadataError) {
-				logger.warn("[chat] model metadata sync unavailable; using registry fallback", {
-					model: params.contextModelId ?? params.model,
-					error:
-						metadataError instanceof Error
-							? metadataError.message
-							: String(metadataError),
-				});
-			}
-
-			// Truncate after the real context window is known so long conversations
-			// are not cut down to the conservative 128K fallback.
-			const contextModelId = params.contextModelId ?? params.model;
-			const truncation = truncatePromptToIntelligentLimit(
-				params.finalPrompt,
-				contextModelId,
-				currentAccountId,
-				params.messages,
-			);
-			if (truncation.wasTruncated) {
-				logger.warn(
-					"[chat] prompt exceeded model context limit; intelligent truncation applied",
-					{
-						originalTokens: truncation.originalTokens,
-						truncatedTokens: truncation.truncatedTokens,
-						messagesKept: truncation.messagesKept,
-						messagesDropped: truncation.messagesDropped,
-					},
-				);
-			}
-			const loopReminder = buildRepeatedToolCallReminder(
-				params.messages,
-				config.retry.repeatedToolCallWarnThreshold,
-			);
-			const effectivePrompt = loopReminder
-				? `${truncation.prompt}\n\n${loopReminder}`
-				: truncation.prompt;
-
-			assertPromptWithinLimits(
-				effectivePrompt,
-				contextModelId,
-				{ accountId: currentAccountId },
-			);
-
-			const threadParentId = params.useThreadNative
-				? params.forceNewChat || params.parallelEscape
-					? null
-					: (params.existingThread?.parentId ?? null)
-				: params.shouldResetUpstreamThread
-					? null
-					: undefined;
-			// Acquire account concurrency lease before personalization + stream creation.
-			// The lease is held for the entire stream lifetime and released by the caller
-			// via the returned releaseAccountLease function.
-			// The thread owner or the last usable account waits without a hard
-			// deadline (bounded by the client's abort signal): a fixed 30s timeout
-			// here rejects a single conversation while the model is paused
-			// mid-tool/thinking, which burns the request instead of serving it.
-			const hasFreeAlt =
-				!isSingleAccount &&
-				hasFreeAlternateAccount(accounts, currentAccountId, triedAccounts);
-			const sessionLabel = params.sessionId ?? currentAccountEmail;
-			// The thread owner (or the last usable account) may wait for the slot
-			// without a short deadline — but ONLY when the slot is busy with OUR
-			// session (same-session latest-wins / tool loop). If ANOTHER session is
-			// generating on this account, waiting 120s is pure latency: the other
-			// session may hold the slot for minutes. Fail fast with account_busy so
-			// the attempt loop rotates to a different account instead (or retries
-			// quickly when no alternative exists).
-			const heldByOtherSession = isAccountSlotHeldByOtherSession(
-				currentAccountId,
-				sessionLabel,
-			);
-			const waitQueueForever = shouldWaitQueueForever(
-				params.queueSlotUntilFree === true,
-				heldByOtherSession,
-				hasFreeAlt,
-			);
-
-			// Latest-wins: if the client retried the same session, abort the old
-			// generation and free the slot immediately instead of queueing behind it.
-			// onlyIfEmitted: a stream that has NOT reached the client yet is
-			// protected — killing it would waste a generation the client has not
-			// consumed. A PARALLEL request (parallelEscape) never kills at all: it
-			// runs on its own chat and must not abort the main generation even
-			// after the main emits its first chunk.
-			if (params.sessionId && !params.parallelEscape) {
-				abortLeaseByLabel(currentAccountId, sessionLabel, {
-					onlyIfEmitted: true,
-				});
-			}
-
-			// Create an AbortController for this lease so a future same-session
-			// retry can abort it via abortLeaseByLabel().
-			const leaseAbort = new AbortController();
-			// Second per-attempt controller: the acquire deadline aborts it so a
-			// race-lost createQwenStream (still queued on the account stream
-			// lock) dies instead of winning the lock later and burning an
-			// upstream request while unobserved.
-			const acquireAbort = new AbortController();
-			const combinedSignal = params.requestSignal
-				? AbortSignal.any([
-						params.requestSignal,
-						leaseAbort.signal,
-						acquireAbort.signal,
-					])
-				: AbortSignal.any([leaseAbort.signal, acquireAbort.signal]);
-
-			if (params.parallelEscape) {
-				// Parallel request racing an unemitted stream: do NOT queue on this
-				// account's slot (the main may hold it for minutes while thinking).
-				// Fail fast with account_busy so the attempt loop hops to a free
-				// account; on a free account the request proceeds on its own chat.
-				const quick = tryAcquireAccountLease(
-					currentAccountId,
-					sessionLabel,
-					leaseAbort,
-					true,
-				);
-				if (!quick) {
-					const busyError = new Error(
-						`Account ${currentAccountId} busy: parallel request (session stream unemitted)`,
-					) as Error & { code?: string; parallelEscape?: boolean };
-					busyError.code = "account_busy";
-					// Expected hop, not an error: suppress the "Request failed" warn.
-					busyError.parallelEscape = true;
-					throw busyError;
-				}
-				accountLease = quick;
-			} else {
-				accountLease = await acquireAccountLease(currentAccountId, {
-					timeoutMs: waitQueueForever
-						? config.concurrency.queueWaitForeverCapMs
-						: config.concurrency.busyWaitMs,
-					signal: combinedSignal,
-					label: sessionLabel,
-					leaseAbortController: leaseAbort,
-				});
-			}
-			// Client may have disconnected (or a same-session retry superseded us)
-			// while waiting for the lease. Bail before spending time on
-			// personalization sync / captcha solve.
-			if (combinedSignal.aborted) {
-				accountLease.release();
-				return {
-					success: false,
-					error: new ClientAbortedError(
-						"client aborted before stream creation",
-					),
-				};
-			}
-			if (logger.isLevelEnabled("info")) {
-				console.log(
-					`⏱️ [Chat] Acquire: lease | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
-				);
-			}
-			const hasRequestPersonalization =
-				params.requestPersonalizationInstruction !== null &&
-				params.requestPersonalizationInstruction !== undefined;
-			const releasePersonalization = hasRequestPersonalization
-				? await acquirePersonalizationLock(currentAccountId)
-				: null;
-			// A same-session retry (or client disconnect) can abort this request
-			// while the personalization sync is still stuck on a hung page op
-			// (closed Playwright context / WAF). The sync never resolves, so the
-			// finally below would not run and the mutex would stay held for
-			// minutes, blocking the retry until its 60s acquire timeout fires.
-			// Release the lock immediately on abort instead.
-			const onPersonalizationAbort = () => releasePersonalization?.();
-			if (combinedSignal.aborted) {
-				onPersonalizationAbort();
-			} else {
-				combinedSignal.addEventListener("abort", onPersonalizationAbort, {
-					once: true,
-				});
-			}
-			let result: Awaited<ReturnType<typeof createQwenStream>>;
-			try {
-				let promptForUpstream = effectivePrompt;
-				if (hasRequestPersonalization) {
-					// Let the hash-based cache in syncQwenRequestPersonalization decide
-					// whether to actually POST. A new chat does not imply the account's
-					// global settings were reset — only session refresh or profile reset
-					// should bypass the cache.
-					const instruction =
-						params.requestPersonalizationInstruction ?? "";
-					let personalizationApplied = false;
-					let syncFailure: string | null = null;
-					try {
-						// Hard deadline for the whole sync (browser ops each have
-						// their own 60s timeout; several sequential stuck ops can
-						// hold the personalization mutex for minutes). A normal
-						// sync takes ~2s; beyond 30s the account page is stuck —
-						// fail fast so the retry loop switches accounts.
-						let syncSettled = false;
-						let personalizationDeadlineTimer: NodeJS.Timeout | undefined;
-						const syncPromise = syncQwenRequestPersonalization(
-							instruction,
-							currentAccountId === "global"
-								? undefined
-								: currentAccountId,
-							{
-								model: params.model,
-								toolsCount: params.toolsCount ?? 0,
-								sessionId: params.sessionId,
-								promptChars: effectivePrompt.length,
-								forceSync: false,
-							},
-						).then(
-							(value) => {
-								syncSettled = true;
-								return value;
-							},
-							(error) => {
-								syncSettled = true;
-								syncFailure =
-									error instanceof Error ? error.message : String(error);
-								return false;
-							},
-						);
-						personalizationApplied = await Promise.race([
-							syncPromise,
-							new Promise<boolean>((resolve) => {
-								personalizationDeadlineTimer = setTimeout(() => {
-									if (!syncSettled) {
-										syncFailure = `sync timed out after ${PERSONALIZATION_SYNC_DEADLINE_MS}ms`;
-									}
-									resolve(false);
-								}, PERSONALIZATION_SYNC_DEADLINE_MS);
-							}),
-						]);
-						// The sync won the race: stop the deadline so it cannot keep the
-						// event loop alive for the full 30s window (it used to leak one
-						// 30s timer per request → ~30s of test-suite drain per file).
-						if (personalizationDeadlineTimer) {
-							clearTimeout(personalizationDeadlineTimer);
-						}
-					} catch (error) {
-						syncFailure =
-							error instanceof Error ? error.message : String(error);
-					}
-
-					// Agent instructions ride ONLY the account-level personalization —
-					// the prompt never carries them. An unconfirmed sync must fail the
-					// attempt (retryable → rotates accounts, each re-syncs on its own
-					// account) instead of degrading to inline. An empty instruction has
-					// nothing to guarantee (plain chat), so it stays best-effort.
-					if (instruction && !personalizationApplied) {
-						throw new PersonalizationSyncError(
-							`personalization sync not confirmed for ${currentAccountEmail}: ${syncFailure ?? "settings response did not confirm the instruction"}`,
-						);
-					}
-					}
-					if (logger.isLevelEnabled("info")) {
-						console.log(
-							`⏱️ [Chat] Acquire: sync | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
-						);
-					}
-
-					assertPromptWithinLimits(
-					promptForUpstream,
-					params.contextModelId ?? params.model,
-					{ accountId: currentAccountId },
-				);
-				// Bound the whole acquire with a hard deadline: a silent hang in any
-				// phase (mutex wait, header capture, fetch metadata, internal retries)
-				// fails fast and retryable instead of blocking the request for minutes
-				// with zero log output.
-				const acquireDeadlineMs = config.concurrency.acquireDeadlineMs;
-				let acquireDeadlineTimer: NodeJS.Timeout | undefined;
-				const acquireDeadline = new Promise<never>((_, reject) => {
-					acquireDeadlineTimer = setTimeout(() => {
-						// Abort the losing createQwenStream (it is still queued on the
-						// stream lock or mid-create); the post-lock signal re-check in
-						// createQwenStream then throws instead of letting the orphan
-						// win the lock later and waste an upstream request.
-						acquireAbort.abort();
-						const err = new Error(
-							`Acquire deadline (${acquireDeadlineMs}ms) exceeded creating stream on ${currentAccountEmail}`,
-						) as Error & { code?: string };
-						err.code = "acquire_deadline";
-						reject(err);
-					}, acquireDeadlineMs);
-					acquireDeadlineTimer.unref?.();
-				});
-				result = await Promise.race([
-					createQwenStream(
-						promptForUpstream,
-						params.isThinkingModel,
-						params.model,
-						threadParentId,
-						currentAccountId === "global" ? undefined : currentAccountId,
-						params.allFiles.length > 0 ? params.allFiles : undefined,
-						params.forceNewChat || params.useThreadNative || params.parallelEscape
-							? {
-									chatSessionId:
-										params.forceNewChat || params.parallelEscape
-											? null
-											: (params.existingThread?.chatSessionId ?? null),
-									forceNewChat: false,
-									reasoningMode: params.reasoningMode,
-									parallelEscape: params.parallelEscape,
-									chatMode: params.chatMode,
-								}
-							: params.reasoningMode ? { reasoningMode: params.reasoningMode } : undefined,
-						combinedSignal,
-					),
-					acquireDeadline,
-				]);
-				// The acquire won: stop the deadline so it cannot fire later and
-				// abort a signal nobody observes anymore.
-				if (acquireDeadlineTimer) clearTimeout(acquireDeadlineTimer);
-
-				if (logger.isLevelEnabled("info")) {
-					console.log(
-						`⏱️ [Chat] Acquire done | completion=${params.completionId.substring(0, 8)} | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
-					);
-				}
-
-				const contextMeter = buildContextMeterSnapshot({
-					modelId: params.contextModelId ?? params.model,
-					accountId: currentAccountId,
-					requestPrompt: promptForUpstream,
-					fullPrompt: params.fullPrompt,
-					mode:
-						params.contextMode ??
-						(params.forceNewChat
-							? "replay"
-							: params.existingThread
-								? "delta"
-								: "full"),
-					qwenPayloadBytes: result.tokenEstimationContext.qwenPayloadBytes,
-					qwenPayloadPromptChars:
-						result.tokenEstimationContext.qwenPayloadPromptChars,
-					qwenPayloadMessageCount:
-						result.tokenEstimationContext.qwenPayloadMessageCount,
-					messageCount: params.messageCount,
-					fullMessageCount: params.fullMessageCount,
-					toolsCount: params.toolsCount,
-					filesCount: params.allFiles.length,
-					activePersonalization:
-						result.tokenEstimationContext.activePersonalization,
-				});
-
-				if (contextMeter) {
-					logger.debug("[context_meter] request", {
-						...contextMeterLogData(contextMeter),
-						account: currentAccountEmail,
-						attempt,
-					});
-					result = {
-						...result,
-						tokenEstimationContext: {
-							...result.tokenEstimationContext,
-							contextMeter,
-						},
-					};
-				}
-			} finally {
-				combinedSignal.removeEventListener(
-					"abort",
-					onPersonalizationAbort,
-				);
-				releasePersonalization?.();
-			}
-
-			// Client cancelled (or a same-session retry superseded us) during the
-			// (potentially slow) personalization sync. Bail before createQwenStream
-			// spends time on header capture / captcha.
-			if (combinedSignal.aborted) {
-				// Never drop a created stream without cancelling it: the wrapped
-				// stream's cancel() releases the per-account stream lock. Dropping it
-				// silently LEAKS that lock and the next acquire on this account blocks
-				// until the acquire deadline (observed symptom: 150s phantom wait).
-				void result.stream
-					.cancel("client aborted after stream creation")
-					.catch(() => {});
-				accountLease?.release();
-				return {
-					success: false,
-					error: new ClientAbortedError(
-						"client aborted during stream creation",
-					),
-				};
-			}
-
-			if (
-				params.useThreadNative &&
-				params.updateLogicalThread &&
-				!params.parallelEscape &&
-				params.sessionId &&
-				result.uiSessionId
-			) {
-				// Bind chat/account immediately. Do NOT write the request parent as the
-				// sticky parent — that is the *previous* assistant id we attached to.
-				// Streaming will rememberParent(response_id) with the new assistant id
-				// so the next turn appends (user_action=chat + parent_id=last response).
-				// Preserve any existing sticky parent until the stream updates it.
-				const priorParent =
-					params.existingThread?.parentId ??
-					getLogicalThreadState(params.sessionId)?.parentId ??
-					null;
-				updateLogicalThreadState(params.sessionId, {
-					accountId: result.accountId,
-					chatSessionId: result.uiSessionId,
-					parentId: params.forceNewChat ? null : priorParent,
-					instructionsSent: true,
-				});
-
-				if (process.env.CHAT_REQUEST_LOG === "true") {
-					logger.info("[chat] thread-native upstream session", {
-						sessionId: params.sessionId,
-						accountId: result.accountId,
-						chatSessionId: result.uiSessionId,
-						requestParentId: threadParentId ?? null,
-						stickyParentId: params.forceNewChat ? null : priorParent,
-						createdNewChat: !params.existingThread,
-					});
-				}
-			}
-
-			if (isToolcallDebugEnabled()) {
-				logger.debug("[chat] stream created successfully", {
-					accountId: currentAccountId,
-					accountEmail: currentAccountEmail,
-					uiSessionId: result.uiSessionId,
-				});
-			}
-
-			// A served stream means the WAF accepted this account's identity:
-			// clear the hard-block escalation streak (keeps the next block at the
-			// base window instead of compounding forever).
-			noteWafRecovery(currentAccountId);
-			markAccountSuccessful(currentAccountId);
-			if (accountLease) {
-				markLeaseCompletion(
-					currentAccountId,
-					accountLease.leaseId,
-					params.completionId,
-				);
-			}
-			return {
-				success: true,
-				...result,
-				accountEmail: currentAccountEmail,
-				releaseAccountLease: accountLease.release,
-			};
-		} catch (err: any) {
-			attemptError = err;
-			lastAttemptError = err;
-			// Release the lease on failure — the stream was never created or
-			// will not be consumed by the caller.
-			accountLease?.release();
-		}
-
-		attemptsLeft--;
-		const err = attemptError;
-		// The account that actually failed THIS attempt — captured before any
-		// branch below can switch currentAccountId/Email (chat_in_progress
-		// escalation moves to a fresh account). The generic retry log must name
-		// the account that failed, not the newly-selected one that was never
-		// attempted (observed: "Qwen request failed for 280wu" when 280wu had
-		// never been tried and ldyjl had failed 4x with chat_in_progress).
-		const failedAccountEmail = currentAccountEmail;
-
-		// Once the client request is aborted, do not rotate accounts or retry. The
-		// old request can otherwise keep acquiring leases after the client is gone.
-		if (params.requestSignal?.aborted) {
-			return { success: false, error: err };
-		}
-
-		// Log the error details for debugging (skip quota errors — logged separately below,
-		// client aborts — they are silent by design, and chat_in_progress — handled
-		// by the dedicated settling log below to avoid alarming false-positive error spam).
-		const errMsg = err instanceof Error ? err.message : String(err || "");
-		if (
-			err &&
-			!(err instanceof ClientAbortedError) &&
-			!isAccountUnavailableError(err) &&
-			!(err as any)?.parallelEscape &&
-			!isChatInProgressError(err)
-		) {
-				const errCode = getQwenErrorCode(err) || "unknown";
-				console.warn(
-						`❌ [Chat] Request failed | ${currentAccountEmail} | ${errCode} | ${errMsg.substring(0, 200)}`,
-					);
-			}
-
-
-
-		if (!err) {
-			return {
-				success: false,
-				error: new Error("Failed to create Qwen stream"),
-			};
-		}
-
-		if (
-			err instanceof QwenSessionExpiredError ||
-			err.name === "QwenSessionExpiredError"
-		) {
-			console.warn(
-				`🔄 [Chat] Session expired for ${currentAccountEmail} (${currentAccountId}). Attempting re-login...`,
-			);
-			const reLoginOk = await attemptRelogin(
-				currentAccountId,
-				currentAccountEmail,
-			);
-			if (reLoginOk) continue;
-			return { success: false, error: err };
-		}
-
-
-
-
-
-		// Account-scoped quota/rate-limit: cool this account and stop local retries
-			// so outer account rotation can pick another one immediately.
-			if (isAccountUnavailableError(err)) {
-				const quotaMsg = err.message || "Unknown quota error";
-				const policy = classifyRetryAction(err, {
-					requestAborted: params.requestSignal?.aborted === true,
-				});
-				const isTemporary = policy.accountCooldownReason === "RateLimitTemporary";
-				
-				// Temporary load shedding or single account: retry same account
-				// after a short delay before giving up / rotating.
-				if ((isTemporary || isSingleAccount) && !quotaRetried && attemptsLeft > 0) {
-					quotaRetried = true;
-					const delayMs = isTemporary ? 3_000 : config.retry.baseDelayMs;
-					console.warn(
-						`⚠️  [Chat] Quota exceeded | ${currentAccountEmail} | ${isTemporary ? "temporary, " : ""}retrying in ${delayMs}ms...`,
-					);
-					await new Promise((resolve) =>
-						setTimeout(resolve, delayMs),
-					);
-					continue;
-				}
-
-				// Consolidate quota details into a single log emitted by the outer
-				// rotation loop. The cooldown itself is set silently to avoid duplicates.
-				const cooldownSeconds = policy.accountCooldownMs
-					? Math.round(policy.accountCooldownMs / 1000)
-					: 0;
-				const cooldownUntil = policy.accountCooldownMs
-					? new Date(Date.now() + policy.accountCooldownMs)
-					: null;
-				const untilStr = cooldownUntil
-					? ` | until=${formatCooldownUntil(cooldownUntil)}`
-					: "";
-
-				try {
-					(err as any).quotaInfo = {
-						email: currentAccountEmail,
-						cooldownSeconds,
-						untilStr,
-						message: quotaMsg.substring(0, 150),
-					};
-				} catch {
-					// Best-effort metadata for logging.
-				}
-
-				markAccountFailed(currentAccountId);
-				markAccountRateLimited(
-					currentAccountId,
-					policy.accountCooldownMs,
-					policy.accountCooldownReason || "QuotaExceeded",
-					{ silent: true },
-				);
-				return { success: false, error: err };
-			}
-
-		const policy = classifyRetryAction(err, {
-			requestAborted: params.requestSignal?.aborted === true,
-		});
-
-		// The full retry decision — the `❌ Request failed` line shows the error
-		// but not WHY this action was chosen. Surface every field so the next
-		// escalation/switch/cooldown is explainable from the log alone.
-		if (logger.isLevelEnabled("info")) {
-			console.log(
-				`🧭 [Chat] Retry policy | account=${currentAccountEmail} | reason=${policy.reason} | retryable=${policy.retryable} | switch=${policy.switchAccount} | newChat=${policy.forceNewChat} | fullPrompt=${policy.retryWithFullPrompt}${policy.dropFiles ? ` | dropFiles` : ""} | retryAfter=${policy.retryAfterMs}ms${policy.accountCooldownMs ? ` | cooldown=${Math.round(policy.accountCooldownMs / 1000)}s (${policy.accountCooldownReason ?? ""})` : ""}`,
-			);
-		}
-
-		// Corrupted history means the stored parent chain is unusable. Purge the
-		// parent immediately so a failed recovery cannot leave the tainted thread
-		// bound for the next turn.
-		if (policy.reason === "corrupted_chat_history") {
-			invalidateLogicalThreadParent(params.sessionId);
-		}
-
-		// A generic invalid_input is often a stale/corrupted upstream chat rather
-		// than an account failure. Rebuild it once on the same account first. If the
-		// fresh chat fails again, the normal policy is allowed to rotate.
-		const retryInvalidInputOnSameAccount =
-			shouldRetryInvalidInputOnSameAccount(
-				policy.reason,
-				invalidInputSameAccountRetried,
-			);
-		if (retryInvalidInputOnSameAccount) {
-			invalidInputSameAccountRetried = true;
-		}
-		const shouldSwitchAccount =
-			policy.switchAccount && !retryInvalidInputOnSameAccount;
-
-		// chat_in_progress means the previous Qwen generation has not stopped
-		// yet (the tool loop fires the next turn the instant the previous one
-		// completes; the upstream chat stays "in progress" for a few seconds
-		// after the terminal event — usually 2-4s, measured >6s after a 491KB
-		// turn). Policy design (settle-aware, upstream-aligned):
-		//  1. Retry the SAME chat with JITTERED busyMs-based waits — never a
-		//     fixed ladder (concurrent sessions would retry in lock-step).
-		//  2. After the settle budget (CHAT_IN_PROGRESS_MAX_RETRIES, ~35s):
-		//     ONE bounded escalation. A chat can be "in progress" for MINUTES
-		//     when a superseded generation keeps running server-side — retrying
-		//     the same chat then fails every request until it frees (observed:
-		//     2.1MB turn held a chat busy ~9min). The single escalation opens a
-		//     FRESH chat with the full context so the turn makes progress; it
-		//     fires at most once per request (a second replay would only repeat
-		//     the ~1MB re-upload cost the settle design removes).
-		//  3. If the escalated attempt ALSO fails with chat_in_progress, the
-		//     request FAILS and the origin binding is cleared (next client turn
-		//     starts fresh with a replay instead of wedging on the stuck chat).
-		if (policy.reason === "chat_in_progress") {
-			if (chatInProgressOriginAccountId === null) {
-				// First chat_in_progress of this request: remember the account
-				// whose chat is stuck (used by the loop-exit session handling).
-				chatInProgressOriginAccountId = currentAccountId;
-				chatInProgressOriginAccountEmail = currentAccountEmail;
-			}
-			chatInProgressCount++;
-			markAccountTemporarilyBusy(
-				currentAccountId,
-				config.retry.chatInProgressBusyMs,
-			);
-
-			if (chatInProgressCount > config.retry.chatInProgressMaxAttempts) {
-				if (!chatInProgressEscalated) {
-					// Same-chat settle budget exhausted: the chat is genuinely
-					// busy, not settling. One bounded escalation — a fresh chat
-					// with the full context (the only way to progress while the
-					// old chat runs on server-side). Bounded: this fires at most
-					// once per request.
-					chatInProgressEscalated = true;
-					console.warn(
-						`🔄 [Chat] chat_in_progress escalation (${chatInProgressCount}) | forcing a new chat with full context on ${currentAccountEmail}`,
-					);
-					if (params.useThreadNative) {
-						params.existingThread = null;
-						params.finalPrompt = params.fullPrompt;
-						params.messageCount =
-							params.fullMessageCount ?? params.messageCount;
-						params.forceNewChat = true;
-					}
-					// The escalation targets a FRESH chat (not the busy one), so
-					// no settle wait — it gets its own attempt budget.
-					attemptsLeft = Math.max(attemptsLeft, 1);
-					policy.retryAfterMs = 0;
-				} else {
-					// The escalated fresh chat ALSO failed with chat_in_progress
-					// (bizarre, but possible on a wedged account). Give up — the
-					// outer rotation treats this as terminal.
-					attemptsLeft = 0;
-					policy.retryable = false;
-				}
-			} else {
-				// The settle window has its own budget, independent of the
-				// global RETRY_MAX_ATTEMPTS: with maxAttempts=3 the counter
-				// above would hit 0 on the 3rd failure and skip the longer
-				// waits that absorb the >6s settles of huge turns (2026-08-11).
-				attemptsLeft = Math.max(attemptsLeft, 1);
-
-				// The 1st failure keeps the upstream-suggested wait (~1.2s);
-				// later retries wait a jittered context-scaled busyMs-based window.
-				if (chatInProgressCount >= 2) {
-					const promptChars =
-						params.fullPrompt?.length ??
-						params.finalPrompt?.length ??
-						0;
-					policy.retryAfterMs = jitterChatInProgressDelay(
-						chatInProgressCount,
-						config.retry.chatInProgressBusyMs,
-						Math.random,
-						promptChars,
-					);
-				}
-			}
-		}
-
-		if (policy.reason === "account_initialization_failed") {
-			console.warn(
-				`⚠️  [Chat] Account initialization failed | ${currentAccountEmail} | cooldown=${Math.round((policy.accountCooldownMs ?? 0) / 1000)}s`,
-			);
-			markAccountFailed(currentAccountId);
-			markAccountRateLimited(
-				currentAccountId,
-				policy.accountCooldownMs,
-				policy.accountCooldownReason,
-			);
-			return { success: false, error: err };
-		}
-
-		// Prefer switching account for any retryable upstream error when possible.
-		// A PARALLEL escape hops to a FREE account (skip busy/temporarily-busy):
-		// the auxiliary request must land on an available slot fast, never on a
-		// second occupied account (the 2026-08-20 stall rotated ldyjl→cgnx3, both
-		// busy, ~14s lease wait). Normal requests keep the cooldown-only picker so
-		// single-account/saturated pools stay lossless.
-		if (
-			policy.retryable &&
-			shouldSwitchAccount &&
-			!isSingleAccount &&
-			accountSwitches < maxAccountSwitches
-		) {
-			const nextAccount = params.parallelEscape
-				? getNextFreeAccountForParallel(accounts, triedAccounts, currentAccountId)
-				: getNextAvailableAccount(triedAccounts);
-			if (nextAccount && nextAccount.id !== currentAccountId) {
-				console.warn(
-					`🔄 [Chat] Switching account after ${policy.reason} | ${currentAccountEmail} -> ${maskEmail(nextAccount.email)}`,
-				);
-				if (policy.accountCooldownMs || policy.accountCooldownReason) {
-					markAccountRateLimited(
-						currentAccountId,
-						policy.accountCooldownMs,
-						policy.accountCooldownReason || "RetrySwitch",
-					);
-				}
-				triedAccounts.add(currentAccountId);
-				currentAccountId = nextAccount.id;
-				currentAccountEmail = maskEmail(nextAccount.email);
-				accountSwitches++;
-
-				// Account switch always rebuilds a fresh upstream chat with full history.
-				// Do NOT persist sticky binding until create succeeds — premature empty
-				// chatSessionId writes make subsequent turns rotate/lose context.
-				if (params.useThreadNative) {
-					params.existingThread = null;
-					params.finalPrompt = params.fullPrompt;
-					params.messageCount = params.fullMessageCount ?? params.messageCount;
-					params.forceNewChat = true;
-				}
-
-				await new Promise((resolve) =>
-					setTimeout(
-						resolve,
-						Math.min(policy.retryAfterMs ?? config.retry.baseDelayMs, 1000),
-					),
-				);
-				continue;
-			}
-
-			console.warn(
-				`⚠️  [Chat] No other account available after ${policy.reason} | Retrying on same account`,
-			);
-		}
-
-		// Force new chat / full context when policy requests it (invalid_input, chat gone, etc.)
-		if (
-			policy.retryable &&
-			(policy.forceNewChat || policy.retryWithFullPrompt) &&
-			params.useThreadNative
-		) {
-			console.warn(
-				`🔄 [Chat] Forcing new chat/full context | reason=${policy.reason}`,
-			);
-			params.existingThread = null;
-			params.finalPrompt = params.fullPrompt;
-			params.messageCount = params.fullMessageCount ?? params.messageCount;
-			params.forceNewChat = true;
-		}
-
-		// Drop files on retry for invalid_input to isolate file-related errors
-		if (policy.dropFiles && params.allFiles.length > 0) {
-			console.warn(
-				`🗂️  [Chat] Dropping ${params.allFiles.length} file(s) on retry to isolate invalid_input error:`,
-				params.allFiles.map((f) => ({
-						name: f.name,
-						type: f.type,
-						size: f.size ?? "unknown",
-					})),
-			);
-			params.allFiles = [];
-		}
-
-		if (!policy.retryable || attemptsLeft <= 0) {
-			if (policy.accountCooldownMs || policy.accountCooldownReason) {
-				markAccountRateLimited(
-					currentAccountId,
-					policy.accountCooldownMs,
-					policy.accountCooldownReason || "RetryExhausted",
-				);
-			}
-
-			if (
-				err instanceof RetryableQwenStreamError ||
-				isChatInProgressError(err)
-			) {
-				// Chat_in_progress give-up only happens AFTER the bounded escalation
-				// (the settle window alone cannot exhaust the budget — the first
-				// over-budget failure escalates). The escalated chat was freshly
-				// created; the STORED binding still points at the stuck chat, so
-				// clearing the origin account's sessions frees the next turn to
-				// start fresh instead of re-wedging on the stuck chat. For other
-				// retryable upstream errors (network/quota) the same clear drops a
-				// binding that may point at a genuinely stuck chat. Clear the ORIGIN
-				// account — never the current one (other policies may have switched).
-				const clearTargetId = chatInProgressOriginAccountId ?? currentAccountId;
-				const clearTargetEmail =
-					chatInProgressOriginAccountEmail ?? currentAccountEmail;
-				console.warn(
-					`🧹 [Chat] Clearing session state for ${clearTargetEmail} (${clearTargetId}) after exhausted retries`,
-				);
-				clearAllSessionsForAccount(clearTargetId);
-			}
-
-			return { success: false, error: err };
-		}
-
-		const useDelay = Math.max(
-			0,
-			policy.retryAfterMs ?? retryDelay ?? config.retry.baseDelayMs,
-		);
-
-		if (policy.reason === "chat_in_progress") {
-			const promptChars =
-				params.fullPrompt?.length ??
-				params.finalPrompt?.length ??
-				0;
-			const contextLabel =
-				promptChars > 1_000_000
-					? `${(promptChars / (1024 * 1024)).toFixed(1)}MB context`
-					: promptChars > 100_000
-						? `${Math.round(promptChars / 1024)}KB context`
-						: "";
-			const contextSuffix = contextLabel ? ` | ${contextLabel}` : "";
-			console.warn(
-				`⏳ [Chat] Chat settling | ${failedAccountEmail}${contextSuffix} | waiting ${(useDelay / 1000).toFixed(1)}s (attempt ${chatInProgressCount}/${config.retry.chatInProgressMaxAttempts})...`,
-			);
-		} else {
-			console.warn(
-				`🔄 [Chat] Qwen request failed for ${failedAccountEmail}, retrying in ${useDelay}ms... (${attemptsLeft} left). reason=${policy.reason} error=${errMsg.slice(0, 200)}`,
-			);
-		}
-		await new Promise((r) => setTimeout(r, useDelay));
-		retryDelay = Math.min(retryDelay * 2, config.retry.maxDelayMs);
-	}
-
-	return {
-		success: false,
-		error:
-			lastAttemptError ??
-			new Error("Qwen stream retry attempts were exhausted"),
-	};
-}
+import { v4 as uuidv4 } from "uuid";
+import {
+	getAccountCooldownInfo,
+	getNextAccount,
+	getNextAvailableAccount,
+	markAccountRateLimited,
+	syncCooldownsFromDb,
+} from "../../core/account-manager.ts";
+import { markAccountSuccessful, markAccountFailed, getAccountsByPriority } from "../../core/account-priority.ts";
+import { recordWafHardBlock, noteWafRecovery } from "../../core/waf-isolation.ts";
+import { loadAccounts, type QwenAccount } from "../../core/accounts.ts";
+import { config, type ChatMode } from "../../core/config.ts";
+import { ClientAbortedError, UpstreamRateLimit, ValidationError } from "../../core/errors.ts";
+import {
+  assertPromptWithinLimits,
+  truncatePromptToIntelligentLimit,
+} from "../../core/prompt-limits.ts";
+import {
+	formatCooldownUntil,
+	isToolcallDebugEnabled,
+	logger,
+	maskEmail,
+} from "../../core/logger.ts";
+import { Mutex } from "../../core/mutex.ts";
+import { registerStream, removeStream } from "../../core/stream-registry.ts";
+import {
+	abortLeaseByLabel,
+	acquireAccountLease,
+	isAccountBusy,
+	isAccountSlotHeldByOtherSession,
+	isAccountTemporarilyBusy,
+	markAccountTemporarilyBusy,
+	markLeaseCompletion,
+	tryAcquireAccountLease,
+	type AccountLease,
+} from "../../core/account-concurrency.ts";
+import { isAuthMockEnabled } from "../../services/auth-playwright.ts";
+import { refreshHeaders } from "../../services/playwright.ts";
+import {
+	clearAllSessionsForAccount,
+	createQwenStream,
+	fetchQwenModels,
+	getQwenErrorCode,
+	getLogicalThreadState,
+	invalidateLogicalThreadParent,
+	type LogicalThreadEntry,
+	PersonalizationSyncError,
+	QwenSessionExpiredError,
+	RetryableQwenStreamError,
+	syncQwenRequestPersonalization,
+	updateLogicalThreadState,
+} from "../../services/qwen.ts";
+import type { TokenEstimationContext } from "../../services/token-estimation-metrics.ts";
+import {
+  buildContextMeterSnapshot,
+  contextMeterLogData,
+  type ContextMeterMode,
+} from "../../services/context-meter.ts";
+import type { QwenFileEntry } from "../upload.ts";
+import type { Message } from "../../utils/types.ts";
+import { buildRepeatedToolCallReminder } from "../../utils/tool-call-guard.ts";
+import {
+	classifyRetryAction,
+	isAntiBotError as isAntiBotPolicyError,
+	isAccountInitializationError,
+	isChatInProgressError,
+	isQuotaLikeError,
+	isTerminalLocalError,
+	shouldRetryInvalidInputOnSameAccount,
+} from "./retry-policy.ts";
+
+/** How many alternate accounts a single request may try after a WAF challenge. */
+const MAX_ANTI_BOT_ROTATIONS = 1;
+
+/**
+ * Hard deadline for the whole personalization sync. A normal sync takes ~2s;
+ * a stuck account page (closed context / WAF) can otherwise hold each browser
+ * op for 60s and keep the personalization mutex blocked for minutes.
+ */
+const PERSONALIZATION_SYNC_DEADLINE_MS = 30_000;
+
+/**
+ * Hard deadline for a single stream-acquire attempt (models sync + truncation
+ * + personalization + header capture + completion fetch metadata + internal
+ * retries). A silent hang past this (observed: 180s with zero logs) fails the
+ * attempt with a visible retryable error so the outer loop switches account.
+ * Configurable via ACQUIRE_DEADLINE_MS (default 120000).
+ */
+
+// Per-chat lock: serializes requests to the same Qwen chat session
+const chatLocks = new Map<string, Mutex>();
+// Account-level personalization is global mutable Qwen state; keep update+stream
+// creation serialized per account when the experimental request-sync mode is used.
+const personalizationLocks = new Map<string, Mutex>();
+
+	export async function acquireChatLock(chatId: string): Promise<() => void> {
+	const acquireStartedAt = Date.now();
+	const timeoutMs = config.concurrency.chatLockTimeoutMs;
+	let mutex = chatLocks.get(chatId);
+	if (!mutex) {
+		mutex = new Mutex(
+			`chat:${chatId.substring(0, 8)}`,
+			// The chat lock is held for the whole stream lifetime. A long
+			// generation (reasoning + huge context) can legitimately exceed the
+			// global 120s hold limit; use the same budget as the acquire timeout
+			// so the force-release never kills a healthy mid-stream turn.
+			timeoutMs,
+		);
+		chatLocks.set(chatId, mutex);
+	}
+	const release = await mutex.acquire(timeoutMs, `chat:${chatId.substring(0, 12)}`);
+	// Held time must exclude the wait: capture right after the acquire settles,
+	// not at function entry (the wait is already visible as `waited Xms` above).
+	const heldStartedAt = Date.now();
+	if (logger.isLevelEnabled("info")) {
+		console.log(
+			`🔐 [Chat] Chat lock acquired | chat=${chatId.substring(0, 12)} | waited ${heldStartedAt - acquireStartedAt}ms`,
+		);
+	}
+	return () => {
+		release();
+		if (logger.isLevelEnabled("info")) {
+			console.log(
+				`🔓 [Chat] Chat lock released | chat=${chatId.substring(0, 12)} | held ${Date.now() - heldStartedAt}ms`,
+			);
+		}
+		if (mutex!.isIdle()) {
+			chatLocks.delete(chatId);
+		}
+	};
+}
+
+async function acquirePersonalizationLock(
+	accountId: string,
+): Promise<() => void> {
+	let mutex = personalizationLocks.get(accountId);
+	if (!mutex) {
+		mutex = new Mutex(`personalization:${accountId.substring(0, 8)}`);
+		personalizationLocks.set(accountId, mutex);
+	}
+	const release = await mutex.acquire(60_000, `personalization:${accountId.substring(0, 8)}`);
+	return () => {
+		release();
+		if (mutex!.isIdle()) {
+			personalizationLocks.delete(accountId);
+		}
+	};
+}
+
+export interface SelectedAccount {
+	id: string;
+	email: string;
+	password: string;
+}
+
+export interface StreamCreationResult {
+	stream: ReadableStream;
+	uiSessionId: string;
+	activeAccountId: string;
+	activeAccountLabel: string;
+	/** True when the request resent the FULL prompt on a new upstream chat
+	 * (account switch / missing thread parent). The 📤 log line uses this to
+	 * show the real payload instead of the thread-native delta. */
+	replayedFullContext: boolean;
+	completionId: string;
+	logicalSessionId: string | null;
+	createdNewChat: boolean;
+	tokenEstimationContext: TokenEstimationContext;
+	releaseAccountLease: () => void;
+}
+
+export interface StreamCreationFailure {
+	error: any;
+	completionId: string;
+	allOnCooldown: boolean;
+	retryAfterMs?: number;
+}
+
+export interface AcquireParams {
+	finalPrompt: string;
+	fullPrompt: string;
+	isThinkingModel: boolean;
+	model: string;
+	reasoningMode?: "auto" | "thinking" | "fast";
+	shouldResetUpstreamThread: boolean;
+	allFiles: QwenFileEntry[];
+	isNewSession: boolean;
+	sessionId: string | null;
+	useThreadNative: boolean;
+	updateLogicalThread: boolean;
+	allowThreadReuse: boolean;
+	/** "thread" (reuse upstream chat) or "temp" (new ephemeral chat per request). */
+	chatMode: ChatMode;
+	/** Full message history for intelligent context truncation after model sync. */
+	messages?: Message[];
+	forceNewChat?: boolean;
+	/**
+	 * Prefer this account when available.
+	 * - undefined/omit: use sticky thread account when present, else round-robin
+	 * - string: pin to that account if configured
+	 * - null: explicitly rotate away from sticky/current account (error failover)
+	 */
+	preferredAccountId?: string | null;
+	/** When rotating, exclude these account ids from the first pick. */
+	excludeAccountIds?: string[];
+	messageCount?: number;
+	fullMessageCount?: number;
+	  toolsCount?: number;
+	  requestPersonalizationInstruction?: string | null;
+	  /** Mapped Qwen model id used for local prompt-budget validation. */
+	  contextModelId?: string;
+	  requestSignal?: AbortSignal;
+	  /** Context accounting mode for this concrete upstream attempt. */
+	  contextMode?: ContextMeterMode;
+	  /** Allow this request to retry the account it just marked temporarily busy. */
+	  allowTemporarilyBusyAccountId?: string;
+	  /**
+	   * True when this request races a same-session stream that has NOT emitted
+	   * yet: run on its OWN chat and hop accounts fast instead of waiting.
+	   */
+	  parallelEscape?: boolean;
+	}
+
+/** Exported for unit tests — selects the first account for a request. */
+export function resolveInitialAccount(
+  preferredAccountId?: string | null,
+  excludeAccountIds?: Iterable<string>,
+): {
+  account: SelectedAccount;
+  configuredAccounts: SelectedAccount[];
+} {
+	if (isAuthMockEnabled()) {
+		return {
+			account: { id: "mock-account", email: "mock@test.com", password: "" },
+			configuredAccounts: [],
+		};
+	}
+
+	const configuredAccounts = loadAccounts();
+	if (configuredAccounts.length > 0) {
+		syncCooldownsFromDb(configuredAccounts);
+		const excluded = new Set(excludeAccountIds ?? []);
+
+		// Explicit preferred account (sticky / same-account retry)
+		if (typeof preferredAccountId === "string" && preferredAccountId) {
+			const preferred = configuredAccounts.find(
+				(candidate) => candidate.id === preferredAccountId,
+			);
+			if (preferred && !getAccountCooldownInfo(preferred.id)) {
+				return { account: preferred, configuredAccounts };
+			}
+			// Preferred is missing/on cooldown: fall through to next available.
+			if (preferred) excluded.add(preferred.id);
+		}
+
+		// Error failover: rotate away from sticky/current account when requested.
+		if (preferredAccountId === null || excluded.size > 0) {
+			const next = getNextAvailableAccount(excluded);
+			if (next) return { account: next, configuredAccounts };
+		}
+
+		const account = getNextAccount();
+		if (!account) {
+			// All accounts on cooldown; caller will handle this.
+			return { account: configuredAccounts[0], configuredAccounts };
+		}
+		return { account, configuredAccounts };
+	}
+
+	throw new ValidationError(
+		"Nenhuma conta Qwen configurada no servidor. Adicione uma conta na aba [5] Contas da TUI.",
+	);
+}
+
+function isAccountUnavailableError(err: any): boolean {
+	// Quota/rate-limit style failures that should cool the account and rotate.
+	if (isQuotaLikeError(err)) return true;
+	return (
+		(err instanceof UpstreamRateLimit &&
+			!(err instanceof RetryableQwenStreamError)) ||
+		err?.upstreamCode === "RateLimited" ||
+		err?.upstreamStatus === 429
+	);
+}
+
+function isAntiBotError(err: any): boolean {
+	return isAntiBotPolicyError(err);
+}
+
+function hasFreeAlternateAccount(
+	accounts: SelectedAccount[],
+	currentAccountId: string,
+	triedAccountIds: Set<string>,
+): boolean {
+	return accounts.some(
+		(candidate) =>
+			candidate.id !== currentAccountId &&
+			!triedAccountIds.has(candidate.id) &&
+			!getAccountCooldownInfo(candidate.id) &&
+			!isAccountTemporarilyBusy(candidate.id) &&
+			!isAccountBusy(candidate.id),
+	);
+}
+
+/**
+ * Pick the next account for a PARALLEL escape, preferring one with a FREE slot:
+ * not busy, not temporarily busy, not on cooldown, not already tried. A normal
+ * request keeps getNextAvailableAccount (cooldown-only picker) so saturated or
+ * single-account pools stay lossless — but an auxiliary parallel request must
+ * land on an available slot fast and never queue behind a second occupied
+ * account (the 2026-08-20 stall rotated ldyjl->cgnx3, both busy, ~14s wait).
+ * Falls back to the cooldown-only picker when no FREE account is left, so a
+ * fully-busy pool still rotates instead of dead-ending.
+ */
+function getNextFreeAccountForParallel(
+	accounts: QwenAccount[],
+	triedAccountIds: Set<string>,
+	currentAccountId: string,
+): QwenAccount | null {
+	const ordered = getAccountsByPriority(accounts);
+	const free = ordered.find(
+		(c) =>
+			c.id !== currentAccountId &&
+			!triedAccountIds.has(c.id) &&
+			!getAccountCooldownInfo(c.id) &&
+			!isAccountTemporarilyBusy(c.id) &&
+			!isAccountBusy(c.id),
+	);
+	if (free) return free;
+	// No free slot anywhere: fall back to the normal picker so we still rotate
+	// (the tryAcquireAccountLease fail-fast will report account_busy and the
+	// loop gives up rather than blocking on a busy pool).
+	return getNextAvailableAccount(triedAccountIds);
+}
+
+
+async function attemptRelogin(
+	accountId: string,
+	accountEmail: string,
+): Promise<boolean> {
+	try {
+		await refreshHeaders(accountId);
+		console.log(
+			`✅ [Chat] Playwright headers refreshed for ${maskEmail(accountEmail)}. Retrying...`,
+		);
+		return true;
+	} catch (refreshErr: unknown) {
+		logger.error("[Chat] Playwright header refresh failed", {
+			accountEmail: maskEmail(accountEmail),
+			error:
+				refreshErr instanceof Error ? refreshErr.message : String(refreshErr),
+			cause:
+				refreshErr instanceof Error
+					? refreshErr.constructor.name
+					: typeof refreshErr,
+		});
+	}
+	return false;
+}
+
+export async function acquireUpstreamStream(
+	params: AcquireParams,
+): Promise<StreamCreationResult | StreamCreationFailure> {
+	const {
+		finalPrompt,
+		isThinkingModel,
+		model,
+		reasoningMode,
+		shouldResetUpstreamThread,
+		allFiles,
+		isNewSession,
+		sessionId,
+		useThreadNative,
+		updateLogicalThread,
+		allowThreadReuse,
+		chatMode,
+		forceNewChat = false,
+		preferredAccountId,
+		excludeAccountIds,
+	} = params;
+
+	const completionId = "chatcmpl-" + uuidv4();
+	// Sticky thread binding is independent of forceNewChat. forceNewChat only
+	// means "open a fresh upstream chat", not "forget which account owned the
+	// logical conversation".
+	const threadState =
+		allowThreadReuse && sessionId ? getLogicalThreadState(sessionId) : null;
+	const stickyThreadAccountId = threadState?.accountId ?? null;
+	const canReuseUpstreamChat =
+		!!threadState &&
+		!forceNewChat &&
+		!!threadState.chatSessionId &&
+		threadState.chatSessionId.length > 0 &&
+		!!threadState.parentId;
+	// A thread with an upstream chat but no committed parent is dirty (failed
+	// first turn, interrupted generation, corrupted history). It must not be
+	// appended to; rebuild a fresh chat with the full prompt instead.
+	const threadMissingParent =
+		!!threadState &&
+		!!threadState.chatSessionId &&
+		threadState.chatSessionId.length > 0 &&
+		!threadState.parentId;
+	const existingThread = canReuseUpstreamChat ? threadState : null;
+
+	// preferredAccountId:
+	// - string: pin to account
+	// - null: explicit failover away from sticky (error path)
+	// - undefined: keep sticky when available
+	// A PARALLEL escape must NOT pin to the sticky thread owner: it races the
+	// main generation that is likely using that very account, so targeting the
+	// sticky would just fail-fast account_busy and waste a rotation hop (the
+	// 2026-08-20 02:43:41 stall: parallel req chose the sticky busy account, then
+	// a second busy one, ~18s until the client aborted). Rotate to any account
+	// so the first hop has a real chance of landing on a free slot.
+	const effectivePreferred = params.parallelEscape ? null : preferredAccountId;
+	const resolvedPreferred =
+		effectivePreferred === null
+			? null
+			: (effectivePreferred ?? stickyThreadAccountId ?? undefined);
+	const excludeSet = new Set(excludeAccountIds ?? []);
+	// When rotating away (resolvedPreferred === null) — either an explicit
+	// failover OR a parallel escape — exclude the sticky owner so the rotation
+	// can never land back on the account the main generation is using.
+	if (resolvedPreferred === null && stickyThreadAccountId) {
+		excludeSet.add(stickyThreadAccountId);
+	}
+
+	const resolved = resolveInitialAccount(resolvedPreferred, excludeSet);
+
+	if (logger.isLevelEnabled("info")) {
+		// Why THIS account? The operator needs the decision, not just the
+		// result — the previous rounds' "stale label" / "switching" confusion
+		// came from logs that showed only the outcome.
+		const poolSize = resolved.configuredAccounts.length;
+		const cooldownCount = resolved.configuredAccounts.filter((a) =>
+			getAccountCooldownInfo(a.id),
+		).length;
+		const why =
+			resolved.account.id === stickyThreadAccountId
+				? "sticky"
+				: typeof resolvedPreferred === "string" &&
+					resolved.account.id === resolvedPreferred
+					? "preferred"
+					: resolvedPreferred === null
+						? "failover-rotate"
+						: "round-robin";
+		console.log(
+			`🎯 [Chat] Account selected | ${maskEmail(resolved.account.email)} (${resolved.account.id}) | reason=${why} | pool=${poolSize}${cooldownCount ? ` | cooldown=${cooldownCount}` : ""}${stickyThreadAccountId ? ` | sticky=${stickyThreadAccountId === resolved.account.id}` : ""}`,
+		);
+	}
+
+	let account: SelectedAccount | null = resolved.account;
+	const configuredAccounts = resolved.configuredAccounts;
+	const triedAccountIds = new Set<string>();
+	let lastError: any = null;
+	let antiBotRotations = 0;
+
+	while (account) {
+		const accountId = account.id;
+		const accountEmail = maskEmail(account.email);
+
+		if (triedAccountIds.has(accountId)) {
+			account = getNextAvailableAccount(triedAccountIds);
+			continue;
+		}
+		triedAccountIds.add(accountId);
+
+		// Skip accounts that recently returned chat_in_progress (temporary busy) —
+		// except the sticky thread owner: hopping the owner splinters the
+		// conversation and replays the full context on a cold account (~12s
+		// reopen + captcha) when the upstream chat is merely settling (2-4s,
+		// covered by the same-chat settle retries). Mirrors the saturated-account
+		// exception below.
+		if (
+			isAccountTemporarilyBusy(accountId) &&
+			params.allowTemporarilyBusyAccountId !== accountId &&
+			accountId !== stickyThreadAccountId
+		) {
+			console.log(
+				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) temporarily busy (chat in progress)`,
+			);
+			account = getNextAvailableAccount(triedAccountIds);
+			continue;
+		}
+
+		// Do not wait 30 seconds on a saturated account when another account is
+		// already free. Keep the queue behavior only when this is the last usable
+		// account, so single-account deployments remain lossless.
+		// The thread owner is excluded: rotating the sticky account during a
+		// tool/think pause splinters the conversation across upstream chats, so
+		// it must queue on its own slot instead of being skipped.
+		if (
+			isAccountBusy(accountId) &&
+			accountId !== stickyThreadAccountId &&
+			hasFreeAlternateAccount(configuredAccounts, accountId, triedAccountIds)
+		) {
+			console.log(
+				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) busy; rotating to a free account`,
+			);
+			const nextCandidate = getNextAvailableAccount(triedAccountIds);
+			if (nextCandidate && !getAccountCooldownInfo(nextCandidate.id)) {
+				account = nextCandidate;
+				continue;
+			}
+			// No usable alternate account exists (e.g. all other accounts are on cooldown):
+			// do NOT skip this busy account to death. Fall through and queue on its slot.
+		}
+
+		const cooldownInfo = getAccountCooldownInfo(accountId);
+		if (cooldownInfo) {
+			console.log(
+				`⏭️  [Chat] Skipping account ${accountEmail} (${accountId}) on cooldown for ${Math.round(cooldownInfo.remainingMs / 1000)}s (${cooldownInfo.reason})`,
+			);
+			if (stickyThreadAccountId === accountId) {
+				console.warn(
+					`⚠️  [Chat] Sticky account is on cooldown; recreating upstream chat on another account with full context.`,
+				);
+			}
+			account = getNextAvailableAccount(triedAccountIds);
+			continue;
+		}
+
+		if (isToolcallDebugEnabled()) {
+			logger.debug("[chat] account selected", {
+				accountId,
+				accountEmail,
+				isNewSession,
+				isThinkingModel,
+				promptLength: finalPrompt.length,
+			});
+		}
+
+		if (useThreadNative && logger && process.env.CHAT_REQUEST_LOG === "true") {
+			logger.info("[chat] thread-native routing", {
+				sessionId,
+				accountId,
+				stickyAccountId: stickyThreadAccountId,
+				hasExistingThread: !!existingThread,
+				existingChatSessionId: existingThread?.chatSessionId || null,
+				existingParentId: existingThread?.parentId || null,
+				instructionsSent: existingThread?.instructionsSent || false,
+				allowThreadReuse,
+				forceNewChat,
+				hasExplicitConversationKey: params.allowThreadReuse,
+			});
+		}
+
+		try {
+			// Any account change vs the sticky owner must resend full history into a
+			// brand-new upstream chat — the previous account's parent chain is unusable.
+			// Same-account forceNewChat keeps the caller's finalPrompt (may already be
+			// a rollover summary or a full-history rebuild from the retry layer).
+			const recreatingOnNewAccount =
+				!!stickyThreadAccountId && accountId !== stickyThreadAccountId;
+			const mustReplayFullContext =
+				recreatingOnNewAccount || threadMissingParent;
+			const attemptForceNewChat = forceNewChat || mustReplayFullContext;
+			const attemptFinalPrompt = mustReplayFullContext
+				? params.fullPrompt
+				: finalPrompt;
+			// The thread owner (or a deployment where no alternate account is
+			// free) must queue on its own slot until generation finishes. A hard
+			// 30s busy timeout here would needlessly 500 the same conversation
+			// while the model is paused mid-tool/think.
+			const waitForSlot =
+				(!!stickyThreadAccountId && accountId === stickyThreadAccountId) ||
+				!hasFreeAlternateAccount(
+					configuredAccounts,
+					accountId,
+					triedAccountIds,
+				);
+			const result = await tryCreateStreamWithRetry(
+				{
+					finalPrompt: attemptFinalPrompt,
+					isThinkingModel,
+					model,
+					reasoningMode,
+					shouldResetUpstreamThread,
+					allFiles,
+					sessionId,
+					useThreadNative,
+					updateLogicalThread,
+					forceNewChat: attemptForceNewChat,
+					existingThread:
+						!mustReplayFullContext &&
+						existingThread &&
+						existingThread.accountId === accountId
+							? existingThread
+							: null,
+					messageCount: mustReplayFullContext
+						? (params.fullMessageCount ?? params.messageCount)
+						: params.messageCount,
+					fullMessageCount: params.fullMessageCount,
+					toolsCount: params.toolsCount,
+					requestPersonalizationInstruction:
+						params.requestPersonalizationInstruction,
+					contextModelId: params.contextModelId,
+					fullPrompt: params.fullPrompt,
+					contextMode: mustReplayFullContext
+						? "replay"
+						: params.contextMode,
+					requestSignal: params.requestSignal,
+					queueSlotUntilFree: waitForSlot,
+					messages: params.messages,
+					completionId,
+					parallelEscape: params.parallelEscape,
+					chatMode,
+				},
+				accountId,
+				accountEmail,
+			);
+
+			if (result.success) {
+				registerStream(completionId, {
+					abortController: result.controller,
+					accountId: result.accountId,
+					uiSessionId: result.uiSessionId,
+					targetResponseId: "",
+					headers: result.headers,
+				});
+
+				return {
+					stream: result.stream,
+					uiSessionId: result.uiSessionId,
+					activeAccountId: result.accountId,
+					activeAccountLabel: result.accountEmail,
+					replayedFullContext: mustReplayFullContext,
+					completionId,
+					logicalSessionId:
+						useThreadNative && updateLogicalThread ? sessionId : null,
+					createdNewChat: result.createdNewChat,
+					tokenEstimationContext: {
+						...result.tokenEstimationContext,
+						requestDeclaredToolCount: params.toolsCount ?? 0,
+					},
+					releaseAccountLease: result.releaseAccountLease,
+				};
+			}
+
+			lastError = result.error;
+		} catch (err: any) {
+			lastError = err;
+		}
+
+		// The request signal is shared by every account attempt. Once the client
+		// disconnects, stop the outer rotation loop as well as inner retries.
+		if (params.requestSignal?.aborted) {
+			break;
+		}
+
+		// Client/proxy validation errors must not be retried on other accounts.
+		// In particular, an oversized prompt is independent of the selected
+		// account; rotating accounts only repeats the same 400 response and can
+		// also rebuild the full history several times.
+		if (isTerminalLocalError(lastError)) {
+			break;
+		}
+
+		const quotaInfo = (lastError as any)?.quotaInfo as
+			| {
+					email: string;
+					cooldownSeconds: number;
+					untilStr: string;
+					message: string;
+			  }
+			| undefined;
+		if (quotaInfo) {
+			const stickyRotation =
+				stickyThreadAccountId === accountId &&
+				(isAccountUnavailableError(lastError) ||
+					isAccountInitializationError(lastError) ||
+					isChatInProgressError(lastError));
+			console.warn(
+				`⚠️  [Chat] Quota exceeded | ${quotaInfo.email} | cooldown=${quotaInfo.cooldownSeconds}s${quotaInfo.untilStr} | ${quotaInfo.message}${stickyRotation ? " | switching sticky account with full context" : ""}`,
+			);
+		}
+
+		// chat_in_progress exhaustion is TERMINAL: tryCreateStreamWithRetry already
+		// spent the full same-chat settle budget AND its single bounded escalation
+		// (fresh chat + full replay). Reaching this point means even the escalated
+		// fresh chat failed — the inner loop already cleared the origin binding, so
+		// the client's next turn starts fresh. Rotating from here would only add a
+		// SECOND full-context replay on a cold account for no gain.
+		if (isChatInProgressError(lastError)) {
+			if (logger.isLevelEnabled("info")) {
+				console.log(
+					`🛑 [Chat] chat_in_progress budget exhausted (post-escalation) | ${maskEmail(accountEmail)} | failing without account rotation`,
+				);
+			}
+			break;
+		}
+
+		if (stickyThreadAccountId === accountId) {
+			// A challenged sticky account must be allowed to fall through to the
+			// anti-bot handling below; otherwise the whole conversation dies on the
+			// account the WAF happened to pick.
+			const stickyAccountMustRotate =
+				isAccountUnavailableError(lastError) ||
+				isAccountInitializationError(lastError) ||
+				isAntiBotError(lastError);
+			if (stickyAccountMustRotate) {
+				if (!quotaInfo) {
+					console.warn(
+						`⚠️  [Chat] Sticky account unavailable (${isAntiBotError(lastError) ? "waf_challenge" : "upstream failure"}); trying another account with full context.`,
+					);
+				}
+			} else {
+				break;
+			}
+		}
+
+		// The inner retry loop already replayed this account and tried to clear the
+		// challenge. Hand the request to one other account rather than failing it
+		// outright, then stop: walking the whole pool would only get every account
+		// challenged in turn and multiply the solver budget by the pool size.
+		if (isAntiBotError(lastError)) {
+			// Hard block: the challenge was NOT solved here. Quarantine with an
+			// escalating window AND rotate the device fingerprint + reset the
+			// browser context, so the account does not return from cooldown on the
+			// same identity the WAF already flagged (upstream account-isolation).
+			recordWafHardBlock(accountId);
+
+			if (antiBotRotations >= MAX_ANTI_BOT_ROTATIONS) {
+				console.warn(
+					`⚠️  [Chat] WAF challenge retries exhausted | ${accountEmail} | no further rotation`,
+				);
+				break;
+			}
+
+			const nextAfterChallenge = getNextAvailableAccount(triedAccountIds);
+			if (!nextAfterChallenge) {
+				console.warn(
+					`⚠️  [Chat] WAF challenge retries exhausted | ${accountEmail} | no other account available`,
+				);
+				break;
+			}
+
+			antiBotRotations++;
+			console.warn(
+				`🔄 [Chat] WAF challenge on ${accountEmail}; retrying on ${maskEmail(nextAfterChallenge.email)}`,
+			);
+			account = nextAfterChallenge;
+			continue;
+		}
+
+		if (isToolcallDebugEnabled()) {
+			logger.debug("[chat] account failed, rotating", {
+				accountId,
+				accountEmail: maskEmail(accountEmail),
+				triedAccounts: Array.from(triedAccountIds),
+			});
+		}
+
+		account = getNextAvailableAccount(triedAccountIds);
+	}
+
+	// All accounts exhausted.
+	removeStream(completionId);
+
+	if (!lastError && configuredAccounts.length > 0) {
+		const cooldownInfos = configuredAccounts
+			.map((acc) => getAccountCooldownInfo(acc.id))
+			.filter(
+				(
+					info,
+				): info is NonNullable<ReturnType<typeof getAccountCooldownInfo>> =>
+					info !== null,
+			);
+
+		if (cooldownInfos.length === configuredAccounts.length) {
+			const retryAfterMs = Math.min(
+				...cooldownInfos.map((info) => info.remainingMs),
+			);
+			const cooldownError: any = new Error(
+				`All configured accounts are on cooldown. Retry in about ${Math.max(1, Math.ceil(retryAfterMs / 1000))}s.`,
+			);
+			cooldownError.upstreamStatus = 429;
+			cooldownError.retryAfterMs = retryAfterMs;
+			return {
+				error: cooldownError,
+				completionId,
+				allOnCooldown: true,
+				retryAfterMs,
+			};
+		}
+	}
+
+	if (!lastError) {
+		const busyOrCooldownError: any = new Error(
+			"No accounts available: all accounts are either in use or on cooldown. Retry shortly.",
+		);
+		busyOrCooldownError.upstreamStatus = 429;
+		return {
+			error: busyOrCooldownError,
+			completionId,
+			allOnCooldown: false,
+		};
+	}
+
+	return {
+		error: lastError,
+		completionId,
+		allOnCooldown: false,
+	};
+}
+
+interface CreateStreamSuccess {
+	success: true;
+	stream: ReadableStream;
+	uiSessionId: string;
+	accountId: string;
+	/** Account email that actually served the request (inner rotation may
+	 * switch accounts — parallel escape / other retry policies). */
+	accountEmail: string;
+	controller: AbortController;
+	headers: Record<string, string>;
+	createdNewChat: boolean;
+	tokenEstimationContext: TokenEstimationContext;
+	releaseAccountLease: () => void;
+}
+
+interface CreateStreamFailure {
+	success: false;
+	error: any;
+}
+
+/**
+ * Pure: jittered same-chat settle wait for the nth chat_in_progress retry.
+ * The base grows with the failure count (busyMs → 2×busyMs from the 4th
+ * retry) and context size (promptChars > 500KB/1MB/2MB), randomized within ±25%
+ * so concurrent sessions sharing an account never retry in lock-step.
+ */
+export function jitterChatInProgressDelay(
+	retryCount: number,
+	busyMs: number,
+	rand: () => number = Math.random,
+	promptChars: number = 0,
+): number {
+	let base = retryCount >= 4 ? busyMs * 2 : busyMs;
+	if (promptChars > 2_000_000) {
+		base = Math.round(base * 1.75);
+	} else if (promptChars > 1_000_000) {
+		base = Math.round(base * 1.5);
+	} else if (promptChars > 500_000) {
+		base = Math.round(base * 1.25);
+	}
+	const raw = base * (0.75 + 0.5 * Math.min(1, Math.max(0, rand())));
+	return Math.min(20_000, Math.max(1, Math.round(raw)));
+}
+
+/**
+ * Decision helper for the per-account lease queue deadline.
+ *
+ * `true` means the request may wait up to `queueWaitForeverCapMs` for the
+ * slot (thread owner waiting on its OWN session, or the last usable account).
+ * `false` means it waits at most `busyWaitMs` and then fails with
+ * `account_busy` so the attempt loop can rotate accounts.
+ *
+ * The thread-owner preference is NOT enough on its own: when another session
+ * holds the slot, waiting long is pure latency (the other session may keep
+ * generating for minutes). Only the same-session holder justifies the long
+ * wait (same-session latest-wins / tool loop).
+ */
+export function shouldWaitQueueForever(
+	isThreadOwnerWaiting: boolean,
+	heldByOtherSession: boolean,
+	hasFreeAlternate: boolean,
+): boolean {
+	return (isThreadOwnerWaiting && !heldByOtherSession) || !hasFreeAlternate;
+}
+
+async function tryCreateStreamWithRetry(
+	params: {
+		finalPrompt: string;
+		fullPrompt: string;
+		isThinkingModel: boolean;
+		model: string;
+		reasoningMode?: "auto" | "thinking" | "fast";
+		shouldResetUpstreamThread: boolean;
+		allFiles: QwenFileEntry[];
+		sessionId: string | null;
+		useThreadNative: boolean;
+		updateLogicalThread: boolean;
+		forceNewChat: boolean;
+		existingThread: LogicalThreadEntry | null;
+		messageCount?: number;
+		fullMessageCount?: number;
+		toolsCount?: number;
+		requestPersonalizationInstruction?: string | null;
+		contextModelId?: string;
+		contextMode?: ContextMeterMode;
+		requestSignal?: AbortSignal;
+		queueSlotUntilFree?: boolean;
+		messages?: Message[];
+		/** Stream registry key; the emit-aware supersede links the lease to it. */
+		completionId: string;
+		/**
+		 * True when this request races a same-session stream that has NOT
+		 * emitted yet (title/parallel request): run on its OWN chat instead of
+		 * waiting on the main chat's lock, and hop accounts fast (tryAcquire).
+		 */
+		parallelEscape?: boolean;
+		/** "thread" (reuse upstream chat) or "temp" (new ephemeral chat per request). */
+		chatMode: ChatMode;
+	},
+	accountId: string,
+	accountEmail: string,
+): Promise<CreateStreamSuccess | CreateStreamFailure> {
+	const maxAttempts = Math.max(1, config.retry.maxAttempts);
+	const maxAccountSwitches = Math.max(0, config.retry.maxAccountSwitches);
+	let attemptsLeft = maxAttempts;
+	let retryDelay = config.retry.baseDelayMs;
+	let attempt = 0;
+	let quotaRetried = false;
+	let accountSwitches = 0;
+	let chatInProgressCount = 0;
+	let chatInProgressEscalated = false;
+	// Account that accumulated the chat_in_progress failures (the one whose
+	// upstream chat is actually stuck "in progress"). The post-budget
+	// escalation switches to a FRESH chat, and the loop-exit session clear
+	// must drop the binding to the stuck chat — NOT clear the sessions of an
+	// account that never served this session (cross-session damage).
+	let chatInProgressOriginAccountId: string | null = null;
+	let chatInProgressOriginAccountEmail: string | null = null;
+	let lastAttemptError: any = null;
+	let invalidInputSameAccountRetried = false;
+	const accounts = loadAccounts();
+	const isSingleAccount = accounts.length <= 1;
+	let currentAccountId = accountId;
+	let currentAccountEmail = accountEmail;
+	const triedAccounts = new Set<string>([accountId]);
+
+	while (attemptsLeft > 0) {
+		attempt++;
+		if (attempt > 1) {
+			console.log(
+				`🔄 [Chat] Retrying request | ${currentAccountEmail} | ${params.model} | ${params.messageCount ?? "?"} msg(s) | ${params.finalPrompt.length} chars${params.toolsCount ? ` | ${params.toolsCount} tool(s)` : ""} | attempt ${attempt}`,
+			);
+		}
+		let attemptError: any = null;
+		let accountLease: AccountLease | null = null;
+		const acquireStartedAt = Date.now();
+
+		try {
+			// The client may have cancelled between account selection and this
+			// attempt (or while a previous attempt was running). Bail before
+			// spending time on model sync, truncation or personalization.
+			if (params.requestSignal?.aborted) {
+				return {
+					success: false,
+					error: new ClientAbortedError(
+						"client aborted before stream creation",
+					),
+				};
+			}
+
+			// Always sync the model catalog so the truncation and prompt-limit
+			// checks use the real context window published by Qwen, not the
+			// conservative registry fallback. The call is cached per account.
+			try {
+				await fetchQwenModels(currentAccountId);
+			} catch (metadataError) {
+				logger.warn("[chat] model metadata sync unavailable; using registry fallback", {
+					model: params.contextModelId ?? params.model,
+					error:
+						metadataError instanceof Error
+							? metadataError.message
+							: String(metadataError),
+				});
+			}
+
+			// Truncate after the real context window is known so long conversations
+			// are not cut down to the conservative 128K fallback.
+			const contextModelId = params.contextModelId ?? params.model;
+			const truncation = truncatePromptToIntelligentLimit(
+				params.finalPrompt,
+				contextModelId,
+				currentAccountId,
+				params.messages,
+			);
+			if (truncation.wasTruncated) {
+				logger.warn(
+					"[chat] prompt exceeded model context limit; intelligent truncation applied",
+					{
+						originalTokens: truncation.originalTokens,
+						truncatedTokens: truncation.truncatedTokens,
+						messagesKept: truncation.messagesKept,
+						messagesDropped: truncation.messagesDropped,
+					},
+				);
+			}
+			const loopReminder = buildRepeatedToolCallReminder(
+				params.messages,
+				config.retry.repeatedToolCallWarnThreshold,
+			);
+			const effectivePrompt = loopReminder
+				? `${truncation.prompt}\n\n${loopReminder}`
+				: truncation.prompt;
+
+			assertPromptWithinLimits(
+				effectivePrompt,
+				contextModelId,
+				{ accountId: currentAccountId },
+			);
+
+			const threadParentId = params.useThreadNative
+				? params.forceNewChat || params.parallelEscape
+					? null
+					: (params.existingThread?.parentId ?? null)
+				: params.shouldResetUpstreamThread
+					? null
+					: undefined;
+			// Acquire account concurrency lease before personalization + stream creation.
+			// The lease is held for the entire stream lifetime and released by the caller
+			// via the returned releaseAccountLease function.
+			// The thread owner or the last usable account waits without a hard
+			// deadline (bounded by the client's abort signal): a fixed 30s timeout
+			// here rejects a single conversation while the model is paused
+			// mid-tool/thinking, which burns the request instead of serving it.
+			const hasFreeAlt =
+				!isSingleAccount &&
+				hasFreeAlternateAccount(accounts, currentAccountId, triedAccounts);
+			const sessionLabel = params.sessionId ?? currentAccountEmail;
+			// The thread owner (or the last usable account) may wait for the slot
+			// without a short deadline — but ONLY when the slot is busy with OUR
+			// session (same-session latest-wins / tool loop). If ANOTHER session is
+			// generating on this account, waiting 120s is pure latency: the other
+			// session may hold the slot for minutes. Fail fast with account_busy so
+			// the attempt loop rotates to a different account instead (or retries
+			// quickly when no alternative exists).
+			const heldByOtherSession = isAccountSlotHeldByOtherSession(
+				currentAccountId,
+				sessionLabel,
+			);
+			const waitQueueForever = shouldWaitQueueForever(
+				params.queueSlotUntilFree === true,
+				heldByOtherSession,
+				hasFreeAlt,
+			);
+
+			// Latest-wins: if the client retried the same session, abort the old
+			// generation and free the slot immediately instead of queueing behind it.
+			// onlyIfEmitted: a stream that has NOT reached the client yet is
+			// protected — killing it would waste a generation the client has not
+			// consumed. A PARALLEL request (parallelEscape) never kills at all: it
+			// runs on its own chat and must not abort the main generation even
+			// after the main emits its first chunk.
+			if (params.sessionId && !params.parallelEscape) {
+				abortLeaseByLabel(currentAccountId, sessionLabel, {
+					onlyIfEmitted: true,
+				});
+			}
+
+			// Create an AbortController for this lease so a future same-session
+			// retry can abort it via abortLeaseByLabel().
+			const leaseAbort = new AbortController();
+			// Second per-attempt controller: the acquire deadline aborts it so a
+			// race-lost createQwenStream (still queued on the account stream
+			// lock) dies instead of winning the lock later and burning an
+			// upstream request while unobserved.
+			const acquireAbort = new AbortController();
+			const combinedSignal = params.requestSignal
+				? AbortSignal.any([
+						params.requestSignal,
+						leaseAbort.signal,
+						acquireAbort.signal,
+					])
+				: AbortSignal.any([leaseAbort.signal, acquireAbort.signal]);
+
+			if (params.parallelEscape) {
+				// Parallel request racing an unemitted stream: do NOT queue on this
+				// account's slot (the main may hold it for minutes while thinking).
+				// Fail fast with account_busy so the attempt loop hops to a free
+				// account; on a free account the request proceeds on its own chat.
+				const quick = tryAcquireAccountLease(
+					currentAccountId,
+					sessionLabel,
+					leaseAbort,
+					true,
+				);
+				if (!quick) {
+					const busyError = new Error(
+						`Account ${currentAccountId} busy: parallel request (session stream unemitted)`,
+					) as Error & { code?: string; parallelEscape?: boolean };
+					busyError.code = "account_busy";
+					// Expected hop, not an error: suppress the "Request failed" warn.
+					busyError.parallelEscape = true;
+					throw busyError;
+				}
+				accountLease = quick;
+			} else {
+				accountLease = await acquireAccountLease(currentAccountId, {
+					timeoutMs: waitQueueForever
+						? config.concurrency.queueWaitForeverCapMs
+						: config.concurrency.busyWaitMs,
+					signal: combinedSignal,
+					label: sessionLabel,
+					leaseAbortController: leaseAbort,
+				});
+			}
+			// Client may have disconnected (or a same-session retry superseded us)
+			// while waiting for the lease. Bail before spending time on
+			// personalization sync / captcha solve.
+			if (combinedSignal.aborted) {
+				accountLease.release();
+				return {
+					success: false,
+					error: new ClientAbortedError(
+						"client aborted before stream creation",
+					),
+				};
+			}
+			if (logger.isLevelEnabled("info")) {
+				console.log(
+					`⏱️ [Chat] Acquire: lease | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
+				);
+			}
+			const hasRequestPersonalization =
+				params.requestPersonalizationInstruction !== null &&
+				params.requestPersonalizationInstruction !== undefined;
+			const releasePersonalization = hasRequestPersonalization
+				? await acquirePersonalizationLock(currentAccountId)
+				: null;
+			// A same-session retry (or client disconnect) can abort this request
+			// while the personalization sync is still stuck on a hung page op
+			// (closed Playwright context / WAF). The sync never resolves, so the
+			// finally below would not run and the mutex would stay held for
+			// minutes, blocking the retry until its 60s acquire timeout fires.
+			// Release the lock immediately on abort instead.
+			const onPersonalizationAbort = () => releasePersonalization?.();
+			if (combinedSignal.aborted) {
+				onPersonalizationAbort();
+			} else {
+				combinedSignal.addEventListener("abort", onPersonalizationAbort, {
+					once: true,
+				});
+			}
+			let result: Awaited<ReturnType<typeof createQwenStream>>;
+			try {
+				let promptForUpstream = effectivePrompt;
+				if (hasRequestPersonalization) {
+					// Let the hash-based cache in syncQwenRequestPersonalization decide
+					// whether to actually POST. A new chat does not imply the account's
+					// global settings were reset — only session refresh or profile reset
+					// should bypass the cache.
+					const instruction =
+						params.requestPersonalizationInstruction ?? "";
+					let personalizationApplied = false;
+					let syncFailure: string | null = null;
+					try {
+						// Hard deadline for the whole sync (browser ops each have
+						// their own 60s timeout; several sequential stuck ops can
+						// hold the personalization mutex for minutes). A normal
+						// sync takes ~2s; beyond 30s the account page is stuck —
+						// fail fast so the retry loop switches accounts.
+						let syncSettled = false;
+						let personalizationDeadlineTimer: NodeJS.Timeout | undefined;
+						const syncPromise = syncQwenRequestPersonalization(
+							instruction,
+							currentAccountId === "global"
+								? undefined
+								: currentAccountId,
+							{
+								model: params.model,
+								toolsCount: params.toolsCount ?? 0,
+								sessionId: params.sessionId,
+								promptChars: effectivePrompt.length,
+								forceSync: false,
+							},
+						).then(
+							(value) => {
+								syncSettled = true;
+								return value;
+							},
+							(error) => {
+								syncSettled = true;
+								syncFailure =
+									error instanceof Error ? error.message : String(error);
+								return false;
+							},
+						);
+						personalizationApplied = await Promise.race([
+							syncPromise,
+							new Promise<boolean>((resolve) => {
+								personalizationDeadlineTimer = setTimeout(() => {
+									if (!syncSettled) {
+										syncFailure = `sync timed out after ${PERSONALIZATION_SYNC_DEADLINE_MS}ms`;
+									}
+									resolve(false);
+								}, PERSONALIZATION_SYNC_DEADLINE_MS);
+							}),
+						]);
+						// The sync won the race: stop the deadline so it cannot keep the
+						// event loop alive for the full 30s window (it used to leak one
+						// 30s timer per request → ~30s of test-suite drain per file).
+						if (personalizationDeadlineTimer) {
+							clearTimeout(personalizationDeadlineTimer);
+						}
+					} catch (error) {
+						syncFailure =
+							error instanceof Error ? error.message : String(error);
+					}
+
+					// Agent instructions ride ONLY the account-level personalization —
+					// the prompt never carries them. An unconfirmed sync must fail the
+					// attempt (retryable → rotates accounts, each re-syncs on its own
+					// account) instead of degrading to inline. An empty instruction has
+					// nothing to guarantee (plain chat), so it stays best-effort.
+					if (instruction && !personalizationApplied) {
+						throw new PersonalizationSyncError(
+							`personalization sync not confirmed for ${currentAccountEmail}: ${syncFailure ?? "settings response did not confirm the instruction"}`,
+						);
+					}
+					}
+					if (logger.isLevelEnabled("info")) {
+						console.log(
+							`⏱️ [Chat] Acquire: sync | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
+						);
+					}
+
+					assertPromptWithinLimits(
+					promptForUpstream,
+					params.contextModelId ?? params.model,
+					{ accountId: currentAccountId },
+				);
+				// Bound the whole acquire with a hard deadline: a silent hang in any
+				// phase (mutex wait, header capture, fetch metadata, internal retries)
+				// fails fast and retryable instead of blocking the request for minutes
+				// with zero log output.
+				const acquireDeadlineMs = config.concurrency.acquireDeadlineMs;
+				let acquireDeadlineTimer: NodeJS.Timeout | undefined;
+				const acquireDeadline = new Promise<never>((_, reject) => {
+					acquireDeadlineTimer = setTimeout(() => {
+						// Abort the losing createQwenStream (it is still queued on the
+						// stream lock or mid-create); the post-lock signal re-check in
+						// createQwenStream then throws instead of letting the orphan
+						// win the lock later and waste an upstream request.
+						acquireAbort.abort();
+						const err = new Error(
+							`Acquire deadline (${acquireDeadlineMs}ms) exceeded creating stream on ${currentAccountEmail}`,
+						) as Error & { code?: string };
+						err.code = "acquire_deadline";
+						reject(err);
+					}, acquireDeadlineMs);
+					acquireDeadlineTimer.unref?.();
+				});
+				result = await Promise.race([
+					createQwenStream(
+						promptForUpstream,
+						params.isThinkingModel,
+						params.model,
+						threadParentId,
+						currentAccountId === "global" ? undefined : currentAccountId,
+						params.allFiles.length > 0 ? params.allFiles : undefined,
+						params.forceNewChat || params.useThreadNative || params.parallelEscape
+							? {
+									chatSessionId:
+										params.forceNewChat || params.parallelEscape
+											? null
+											: (params.existingThread?.chatSessionId ?? null),
+									forceNewChat: false,
+									reasoningMode: params.reasoningMode,
+									parallelEscape: params.parallelEscape,
+									chatMode: params.chatMode,
+								}
+							: params.reasoningMode ? { reasoningMode: params.reasoningMode } : undefined,
+						combinedSignal,
+					),
+					acquireDeadline,
+				]);
+				// The acquire won: stop the deadline so it cannot fire later and
+				// abort a signal nobody observes anymore.
+				if (acquireDeadlineTimer) clearTimeout(acquireDeadlineTimer);
+
+				if (logger.isLevelEnabled("info")) {
+					console.log(
+						`⏱️ [Chat] Acquire done | completion=${params.completionId.substring(0, 8)} | account=${currentAccountEmail} | +${Date.now() - acquireStartedAt}ms`,
+					);
+				}
+
+				const contextMeter = buildContextMeterSnapshot({
+					modelId: params.contextModelId ?? params.model,
+					accountId: currentAccountId,
+					requestPrompt: promptForUpstream,
+					fullPrompt: params.fullPrompt,
+					mode:
+						params.contextMode ??
+						(params.forceNewChat
+							? "replay"
+							: params.existingThread
+								? "delta"
+								: "full"),
+					qwenPayloadBytes: result.tokenEstimationContext.qwenPayloadBytes,
+					qwenPayloadPromptChars:
+						result.tokenEstimationContext.qwenPayloadPromptChars,
+					qwenPayloadMessageCount:
+						result.tokenEstimationContext.qwenPayloadMessageCount,
+					messageCount: params.messageCount,
+					fullMessageCount: params.fullMessageCount,
+					toolsCount: params.toolsCount,
+					filesCount: params.allFiles.length,
+					activePersonalization:
+						result.tokenEstimationContext.activePersonalization,
+				});
+
+				if (contextMeter) {
+					logger.debug("[context_meter] request", {
+						...contextMeterLogData(contextMeter),
+						account: currentAccountEmail,
+						attempt,
+					});
+					result = {
+						...result,
+						tokenEstimationContext: {
+							...result.tokenEstimationContext,
+							contextMeter,
+						},
+					};
+				}
+			} finally {
+				combinedSignal.removeEventListener(
+					"abort",
+					onPersonalizationAbort,
+				);
+				releasePersonalization?.();
+			}
+
+			// Client cancelled (or a same-session retry superseded us) during the
+			// (potentially slow) personalization sync. Bail before createQwenStream
+			// spends time on header capture / captcha.
+			if (combinedSignal.aborted) {
+				// Never drop a created stream without cancelling it: the wrapped
+				// stream's cancel() releases the per-account stream lock. Dropping it
+				// silently LEAKS that lock and the next acquire on this account blocks
+				// until the acquire deadline (observed symptom: 150s phantom wait).
+				void result.stream
+					.cancel("client aborted after stream creation")
+					.catch(() => {});
+				accountLease?.release();
+				return {
+					success: false,
+					error: new ClientAbortedError(
+						"client aborted during stream creation",
+					),
+				};
+			}
+
+			if (
+				params.useThreadNative &&
+				params.updateLogicalThread &&
+				!params.parallelEscape &&
+				params.sessionId &&
+				result.uiSessionId
+			) {
+				// Bind chat/account immediately. Do NOT write the request parent as the
+				// sticky parent — that is the *previous* assistant id we attached to.
+				// Streaming will rememberParent(response_id) with the new assistant id
+				// so the next turn appends (user_action=chat + parent_id=last response).
+				// Preserve any existing sticky parent until the stream updates it.
+				const priorParent =
+					params.existingThread?.parentId ??
+					getLogicalThreadState(params.sessionId)?.parentId ??
+					null;
+				updateLogicalThreadState(params.sessionId, {
+					accountId: result.accountId,
+					chatSessionId: result.uiSessionId,
+					parentId: params.forceNewChat ? null : priorParent,
+					instructionsSent: true,
+				});
+
+				if (process.env.CHAT_REQUEST_LOG === "true") {
+					logger.info("[chat] thread-native upstream session", {
+						sessionId: params.sessionId,
+						accountId: result.accountId,
+						chatSessionId: result.uiSessionId,
+						requestParentId: threadParentId ?? null,
+						stickyParentId: params.forceNewChat ? null : priorParent,
+						createdNewChat: !params.existingThread,
+					});
+				}
+			}
+
+			if (isToolcallDebugEnabled()) {
+				logger.debug("[chat] stream created successfully", {
+					accountId: currentAccountId,
+					accountEmail: currentAccountEmail,
+					uiSessionId: result.uiSessionId,
+				});
+			}
+
+			// A served stream means the WAF accepted this account's identity:
+			// clear the hard-block escalation streak (keeps the next block at the
+			// base window instead of compounding forever).
+			noteWafRecovery(currentAccountId);
+			markAccountSuccessful(currentAccountId);
+			if (accountLease) {
+				markLeaseCompletion(
+					currentAccountId,
+					accountLease.leaseId,
+					params.completionId,
+				);
+			}
+			return {
+				success: true,
+				...result,
+				accountEmail: currentAccountEmail,
+				releaseAccountLease: accountLease.release,
+			};
+		} catch (err: any) {
+			attemptError = err;
+			lastAttemptError = err;
+			// Release the lease on failure — the stream was never created or
+			// will not be consumed by the caller.
+			accountLease?.release();
+		}
+
+		attemptsLeft--;
+		const err = attemptError;
+		// The account that actually failed THIS attempt — captured before any
+		// branch below can switch currentAccountId/Email (chat_in_progress
+		// escalation moves to a fresh account). The generic retry log must name
+		// the account that failed, not the newly-selected one that was never
+		// attempted (observed: "Qwen request failed for 280wu" when 280wu had
+		// never been tried and ldyjl had failed 4x with chat_in_progress).
+		const failedAccountEmail = currentAccountEmail;
+
+		// Once the client request is aborted, do not rotate accounts or retry. The
+		// old request can otherwise keep acquiring leases after the client is gone.
+		if (params.requestSignal?.aborted) {
+			return { success: false, error: err };
+		}
+
+		// Log the error details for debugging (skip quota errors — logged separately below,
+		// client aborts — they are silent by design, and chat_in_progress — handled
+		// by the dedicated settling log below to avoid alarming false-positive error spam).
+		const errMsg = err instanceof Error ? err.message : String(err || "");
+		if (
+			err &&
+			!(err instanceof ClientAbortedError) &&
+			!isAccountUnavailableError(err) &&
+			!(err as any)?.parallelEscape &&
+			!isChatInProgressError(err)
+		) {
+				const errCode = getQwenErrorCode(err) || "unknown";
+				console.warn(
+						`❌ [Chat] Request failed | ${currentAccountEmail} | ${errCode} | ${errMsg.substring(0, 200)}`,
+					);
+			}
+
+
+
+		if (!err) {
+			return {
+				success: false,
+				error: new Error("Failed to create Qwen stream"),
+			};
+		}
+
+		if (
+			err instanceof QwenSessionExpiredError ||
+			err.name === "QwenSessionExpiredError"
+		) {
+			console.warn(
+				`🔄 [Chat] Session expired for ${currentAccountEmail} (${currentAccountId}). Attempting re-login...`,
+			);
+			const reLoginOk = await attemptRelogin(
+				currentAccountId,
+				currentAccountEmail,
+			);
+			if (reLoginOk) continue;
+			return { success: false, error: err };
+		}
+
+
+
+
+
+		// Account-scoped quota/rate-limit: cool this account and stop local retries
+			// so outer account rotation can pick another one immediately.
+			if (isAccountUnavailableError(err)) {
+				const quotaMsg = err.message || "Unknown quota error";
+				const policy = classifyRetryAction(err, {
+					requestAborted: params.requestSignal?.aborted === true,
+				});
+				const isTemporary = policy.accountCooldownReason === "RateLimitTemporary";
+				
+				// Temporary load shedding or single account: retry same account
+				// after a short delay before giving up / rotating.
+				if ((isTemporary || isSingleAccount) && !quotaRetried && attemptsLeft > 0) {
+					quotaRetried = true;
+					const delayMs = isTemporary ? 3_000 : config.retry.baseDelayMs;
+					console.warn(
+						`⚠️  [Chat] Quota exceeded | ${currentAccountEmail} | ${isTemporary ? "temporary, " : ""}retrying in ${delayMs}ms...`,
+					);
+					await new Promise((resolve) =>
+						setTimeout(resolve, delayMs),
+					);
+					continue;
+				}
+
+				// Consolidate quota details into a single log emitted by the outer
+				// rotation loop. The cooldown itself is set silently to avoid duplicates.
+				const cooldownSeconds = policy.accountCooldownMs
+					? Math.round(policy.accountCooldownMs / 1000)
+					: 0;
+				const cooldownUntil = policy.accountCooldownMs
+					? new Date(Date.now() + policy.accountCooldownMs)
+					: null;
+				const untilStr = cooldownUntil
+					? ` | until=${formatCooldownUntil(cooldownUntil)}`
+					: "";
+
+				try {
+					(err as any).quotaInfo = {
+						email: currentAccountEmail,
+						cooldownSeconds,
+						untilStr,
+						message: quotaMsg.substring(0, 150),
+					};
+				} catch {
+					// Best-effort metadata for logging.
+				}
+
+				markAccountFailed(currentAccountId);
+				markAccountRateLimited(
+					currentAccountId,
+					policy.accountCooldownMs,
+					policy.accountCooldownReason || "QuotaExceeded",
+					{ silent: true },
+				);
+				return { success: false, error: err };
+			}
+
+		const policy = classifyRetryAction(err, {
+			requestAborted: params.requestSignal?.aborted === true,
+		});
+
+		// The full retry decision — the `❌ Request failed` line shows the error
+		// but not WHY this action was chosen. Surface every field so the next
+		// escalation/switch/cooldown is explainable from the log alone.
+		if (logger.isLevelEnabled("info")) {
+			console.log(
+				`🧭 [Chat] Retry policy | account=${currentAccountEmail} | reason=${policy.reason} | retryable=${policy.retryable} | switch=${policy.switchAccount} | newChat=${policy.forceNewChat} | fullPrompt=${policy.retryWithFullPrompt}${policy.dropFiles ? ` | dropFiles` : ""} | retryAfter=${policy.retryAfterMs}ms${policy.accountCooldownMs ? ` | cooldown=${Math.round(policy.accountCooldownMs / 1000)}s (${policy.accountCooldownReason ?? ""})` : ""}`,
+			);
+		}
+
+		// Corrupted history means the stored parent chain is unusable. Purge the
+		// parent immediately so a failed recovery cannot leave the tainted thread
+		// bound for the next turn.
+		if (policy.reason === "corrupted_chat_history") {
+			invalidateLogicalThreadParent(params.sessionId);
+		}
+
+		// A generic invalid_input is often a stale/corrupted upstream chat rather
+		// than an account failure. Rebuild it once on the same account first. If the
+		// fresh chat fails again, the normal policy is allowed to rotate.
+		const retryInvalidInputOnSameAccount =
+			shouldRetryInvalidInputOnSameAccount(
+				policy.reason,
+				invalidInputSameAccountRetried,
+			);
+		if (retryInvalidInputOnSameAccount) {
+			invalidInputSameAccountRetried = true;
+		}
+		const shouldSwitchAccount =
+			policy.switchAccount && !retryInvalidInputOnSameAccount;
+
+		// chat_in_progress means the previous Qwen generation has not stopped
+		// yet (the tool loop fires the next turn the instant the previous one
+		// completes; the upstream chat stays "in progress" for a few seconds
+		// after the terminal event — usually 2-4s, measured >6s after a 491KB
+		// turn). Policy design (settle-aware, upstream-aligned):
+		//  1. Retry the SAME chat with JITTERED busyMs-based waits — never a
+		//     fixed ladder (concurrent sessions would retry in lock-step).
+		//  2. After the settle budget (CHAT_IN_PROGRESS_MAX_RETRIES, ~35s):
+		//     ONE bounded escalation. A chat can be "in progress" for MINUTES
+		//     when a superseded generation keeps running server-side — retrying
+		//     the same chat then fails every request until it frees (observed:
+		//     2.1MB turn held a chat busy ~9min). The single escalation opens a
+		//     FRESH chat with the full context so the turn makes progress; it
+		//     fires at most once per request (a second replay would only repeat
+		//     the ~1MB re-upload cost the settle design removes).
+		//  3. If the escalated attempt ALSO fails with chat_in_progress, the
+		//     request FAILS and the origin binding is cleared (next client turn
+		//     starts fresh with a replay instead of wedging on the stuck chat).
+		if (policy.reason === "chat_in_progress") {
+			if (chatInProgressOriginAccountId === null) {
+				// First chat_in_progress of this request: remember the account
+				// whose chat is stuck (used by the loop-exit session handling).
+				chatInProgressOriginAccountId = currentAccountId;
+				chatInProgressOriginAccountEmail = currentAccountEmail;
+			}
+			chatInProgressCount++;
+			markAccountTemporarilyBusy(
+				currentAccountId,
+				config.retry.chatInProgressBusyMs,
+			);
+
+			if (chatInProgressCount > config.retry.chatInProgressMaxAttempts) {
+				if (!chatInProgressEscalated) {
+					// Same-chat settle budget exhausted: the chat is genuinely
+					// busy, not settling. One bounded escalation — a fresh chat
+					// with the full context (the only way to progress while the
+					// old chat runs on server-side). Bounded: this fires at most
+					// once per request.
+					chatInProgressEscalated = true;
+					console.warn(
+						`🔄 [Chat] chat_in_progress escalation (${chatInProgressCount}) | forcing a new chat with full context on ${currentAccountEmail}`,
+					);
+					if (params.useThreadNative) {
+						params.existingThread = null;
+						params.finalPrompt = params.fullPrompt;
+						params.messageCount =
+							params.fullMessageCount ?? params.messageCount;
+						params.forceNewChat = true;
+					}
+					// The escalation targets a FRESH chat (not the busy one), so
+					// no settle wait — it gets its own attempt budget.
+					attemptsLeft = Math.max(attemptsLeft, 1);
+					policy.retryAfterMs = 0;
+				} else {
+					// The escalated fresh chat ALSO failed with chat_in_progress
+					// (bizarre, but possible on a wedged account). Give up — the
+					// outer rotation treats this as terminal.
+					attemptsLeft = 0;
+					policy.retryable = false;
+				}
+			} else {
+				// The settle window has its own budget, independent of the
+				// global RETRY_MAX_ATTEMPTS: with maxAttempts=3 the counter
+				// above would hit 0 on the 3rd failure and skip the longer
+				// waits that absorb the >6s settles of huge turns (2026-08-11).
+				attemptsLeft = Math.max(attemptsLeft, 1);
+
+				// The 1st failure keeps the upstream-suggested wait (~1.2s);
+				// later retries wait a jittered context-scaled busyMs-based window.
+				if (chatInProgressCount >= 2) {
+					const promptChars =
+						params.fullPrompt?.length ??
+						params.finalPrompt?.length ??
+						0;
+					policy.retryAfterMs = jitterChatInProgressDelay(
+						chatInProgressCount,
+						config.retry.chatInProgressBusyMs,
+						Math.random,
+						promptChars,
+					);
+				}
+			}
+		}
+
+		if (policy.reason === "account_initialization_failed") {
+			console.warn(
+				`⚠️  [Chat] Account initialization failed | ${currentAccountEmail} | cooldown=${Math.round((policy.accountCooldownMs ?? 0) / 1000)}s`,
+			);
+			markAccountFailed(currentAccountId);
+			markAccountRateLimited(
+				currentAccountId,
+				policy.accountCooldownMs,
+				policy.accountCooldownReason,
+			);
+			return { success: false, error: err };
+		}
+
+		// Prefer switching account for any retryable upstream error when possible.
+		// A PARALLEL escape hops to a FREE account (skip busy/temporarily-busy):
+		// the auxiliary request must land on an available slot fast, never on a
+		// second occupied account (the 2026-08-20 stall rotated ldyjl→cgnx3, both
+		// busy, ~14s lease wait). Normal requests keep the cooldown-only picker so
+		// single-account/saturated pools stay lossless.
+		if (
+			policy.retryable &&
+			shouldSwitchAccount &&
+			!isSingleAccount &&
+			accountSwitches < maxAccountSwitches
+		) {
+			const nextAccount = params.parallelEscape
+				? getNextFreeAccountForParallel(accounts, triedAccounts, currentAccountId)
+				: getNextAvailableAccount(triedAccounts);
+			if (nextAccount && nextAccount.id !== currentAccountId) {
+				console.warn(
+					`🔄 [Chat] Switching account after ${policy.reason} | ${currentAccountEmail} -> ${maskEmail(nextAccount.email)}`,
+				);
+				if (policy.accountCooldownMs || policy.accountCooldownReason) {
+					markAccountRateLimited(
+						currentAccountId,
+						policy.accountCooldownMs,
+						policy.accountCooldownReason || "RetrySwitch",
+					);
+				}
+				triedAccounts.add(currentAccountId);
+				currentAccountId = nextAccount.id;
+				currentAccountEmail = maskEmail(nextAccount.email);
+				accountSwitches++;
+
+				// Account switch always rebuilds a fresh upstream chat with full history.
+				// Do NOT persist sticky binding until create succeeds — premature empty
+				// chatSessionId writes make subsequent turns rotate/lose context.
+				if (params.useThreadNative) {
+					params.existingThread = null;
+					params.finalPrompt = params.fullPrompt;
+					params.messageCount = params.fullMessageCount ?? params.messageCount;
+					params.forceNewChat = true;
+				}
+
+				await new Promise((resolve) =>
+					setTimeout(
+						resolve,
+						Math.min(policy.retryAfterMs ?? config.retry.baseDelayMs, 1000),
+					),
+				);
+				continue;
+			}
+
+			console.warn(
+				`⚠️  [Chat] No other account available after ${policy.reason} | Retrying on same account`,
+			);
+		}
+
+		// Force new chat / full context when policy requests it (invalid_input, chat gone, etc.)
+		if (
+			policy.retryable &&
+			(policy.forceNewChat || policy.retryWithFullPrompt) &&
+			params.useThreadNative
+		) {
+			console.warn(
+				`🔄 [Chat] Forcing new chat/full context | reason=${policy.reason}`,
+			);
+			params.existingThread = null;
+			params.finalPrompt = params.fullPrompt;
+			params.messageCount = params.fullMessageCount ?? params.messageCount;
+			params.forceNewChat = true;
+		}
+
+		// Drop files on retry for invalid_input to isolate file-related errors
+		if (policy.dropFiles && params.allFiles.length > 0) {
+			console.warn(
+				`🗂️  [Chat] Dropping ${params.allFiles.length} file(s) on retry to isolate invalid_input error:`,
+				params.allFiles.map((f) => ({
+						name: f.name,
+						type: f.type,
+						size: f.size ?? "unknown",
+					})),
+			);
+			params.allFiles = [];
+		}
+
+		if (!policy.retryable || attemptsLeft <= 0) {
+			if (policy.accountCooldownMs || policy.accountCooldownReason) {
+				markAccountRateLimited(
+					currentAccountId,
+					policy.accountCooldownMs,
+					policy.accountCooldownReason || "RetryExhausted",
+				);
+			}
+
+			if (
+				err instanceof RetryableQwenStreamError ||
+				isChatInProgressError(err)
+			) {
+				// Chat_in_progress give-up only happens AFTER the bounded escalation
+				// (the settle window alone cannot exhaust the budget — the first
+				// over-budget failure escalates). The escalated chat was freshly
+				// created; the STORED binding still points at the stuck chat, so
+				// clearing the origin account's sessions frees the next turn to
+				// start fresh instead of re-wedging on the stuck chat. For other
+				// retryable upstream errors (network/quota) the same clear drops a
+				// binding that may point at a genuinely stuck chat. Clear the ORIGIN
+				// account — never the current one (other policies may have switched).
+				const clearTargetId = chatInProgressOriginAccountId ?? currentAccountId;
+				const clearTargetEmail =
+					chatInProgressOriginAccountEmail ?? currentAccountEmail;
+				console.warn(
+					`🧹 [Chat] Clearing session state for ${clearTargetEmail} (${clearTargetId}) after exhausted retries`,
+				);
+				clearAllSessionsForAccount(clearTargetId);
+			}
+
+			return { success: false, error: err };
+		}
+
+		const useDelay = Math.max(
+			0,
+			policy.retryAfterMs ?? retryDelay ?? config.retry.baseDelayMs,
+		);
+
+		if (policy.reason === "chat_in_progress") {
+			const promptChars =
+				params.fullPrompt?.length ??
+				params.finalPrompt?.length ??
+				0;
+			const contextLabel =
+				promptChars > 1_000_000
+					? `${(promptChars / (1024 * 1024)).toFixed(1)}MB context`
+					: promptChars > 100_000
+						? `${Math.round(promptChars / 1024)}KB context`
+						: "";
+			const contextSuffix = contextLabel ? ` | ${contextLabel}` : "";
+			console.warn(
+				`⏳ [Chat] Chat settling | ${failedAccountEmail}${contextSuffix} | waiting ${(useDelay / 1000).toFixed(1)}s (attempt ${chatInProgressCount}/${config.retry.chatInProgressMaxAttempts})...`,
+			);
+		} else {
+			console.warn(
+				`🔄 [Chat] Qwen request failed for ${failedAccountEmail}, retrying in ${useDelay}ms... (${attemptsLeft} left). reason=${policy.reason} error=${errMsg.slice(0, 200)}`,
+			);
+		}
+		await new Promise((r) => setTimeout(r, useDelay));
+		retryDelay = Math.min(retryDelay * 2, config.retry.maxDelayMs);
+	}
+
+	return {
+		success: false,
+		error:
+			lastAttemptError ??
+			new Error("Qwen stream retry attempts were exhausted"),
+	};
+}