eggpool 0.7.2__tar.gz → 0.7.3__tar.gz

{eggpool-0.7.2 → eggpool-0.7.3}/AGENTS.md

@@ -147,6 +147,9 @@ Non-obvious wiring:
 - **`static_models` is source of truth for provider-specific protocol**: providers serving non-default protocols must ship `[[providers.<id>.static_models]]` rows
 - **No pre-commit hooks configured**: CI runs ruff, pyright, and pytest via GitHub Actions
 - **When constructing `RequestCoordinator` in tests**: pass an explicit `transcoder_policy` or assert the desired default
+- **`ProviderBoundRequest` dispatch-freeze**: `serialize_provider_payload()` freezes the body; `replace_provider_payload()` and `set_provider_payload(increment_generation=False)` reject when frozen. Only generation-incrementing methods (`set_provider_payload(increment_generation=True)`, `adopt_provider_payload(increment_generation=True)`) clear the freeze — the post-selection transcoder relies on this to replace a previously dispatched body on retry
+- **Thinking rejection error class**: `CapabilityError` (400) only when the aggregated thinking status is genuinely `unknown` or `unsupported`. When all supporting accounts are quarantined but the provider entry reports `supported`/`mixed`, a transient 503/502 is raised instead. Aggregation iterates `cache.get_provider_model_entries()` (which applies overrides), not `cache.get_model()` (which does not). See `RequestCoordinator._determine_thinking_rejection_status` and `architecture/deep-dive-request-lifecycle.md`
+- **Per-model quarantine suppresses account-wide circuit breaker**: when `effects.model_effect != "none"` (quarantine), `EffectsApplier._apply_account_effect` skips `HealthManager.record_failure()` for that account. The account-wide breaker advances only when the classifier sets `source="transport"` (genuine account-wide failure: DNS, TLS, persistent transport failure with no per-model cause). A per-model 5xx must quarantine the `(account, model)` pair, not the whole account. See `architecture/deep-dive-health.md`
 
 ## Error Handling
 

{eggpool-0.7.2 → eggpool-0.7.3}/CHANGELOG.md

@@ -36,6 +36,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   no-account-disable path for keyword false-positives in client-error bodies,
   5xx cooldown non-extension to siblings, and applier resilience under partial
   side-effect failure.
+- **muse-spark-1.2-contributor routing fix.** Three coordinated changes
+  restore the canonical ``OpenCode Go`` Muse Spark request path and stop
+  one model's failure from black-holing sibling models on the same
+  subscription:
+
+  1. `ProviderBoundRequest.set_provider_payload` and
+     `adopt_provider_payload` now clear the dispatch-freeze flag when a new
+     generation begins. Pre-fix, the post-selection transcoder's
+     `adopt_provider_payload` raised `RuntimeError: provider payload is
+     frozen` after the first attempt's serialization, breaking every retry
+     against a different selected provider.
+
+  2. `RequestCoordinator._determine_thinking_rejection_status` now
+     aggregates per-provider capability overrides when the collapsed
+     entry reports `unknown`. Built-in overrides (e.g. the canonical
+     OpenCode Go host capabilities for `muse-spark-1.2-contributor`) live
+     in the provider-scoped cache row, so the previous bare-model lookup
+     missed them and surfaced a misleading client-validation 400. The
+     capability-error path now requires `rejected_status` to be truly
+     `unknown`/`unsupported` before surfacing the 400; otherwise the
+     router falls through to a transient `No accounts available` (503).
+
+  3. `EffectsApplier._apply_account_effect` now skips
+     `HealthManager.record_failure` when the classifier set
+     `model_effect="quarantine"` — the per-model disable is the only
+     shared-state penalty in that case. Pre-fix, a single muse-spark 5xx
+     per account advanced the account-wide circuit breaker so five
+     per-model 5xxes tripped the breaker for ALL models on the same
+     subscription. Post-fix, sibling models on the same opencode-go
+     account keep routing while only muse-spark-1.2-contributor is
+     quarantined for the bounded TTL. Tests:
+  `tests/integration/test_muse_spark_live_e2e.py` (3 tests covering the
+  end-to-end live routing path with thinking controls and sibling-model
+  isolation), `tests/integration/test_muse_spark_capability_status_attribution.py`
+  (catalog + status attribution), and `tests/unit/test_provider_bound_request.py`
+  + `tests/unit/test_effects_idempotency.py` (per-fix unit coverage).
 
 ### Added
 

{eggpool-0.7.2 → eggpool-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: eggpool
-Version: 0.7.2
+Version: 0.7.3
 Summary: A lightweight proxy that aggregates multiple LLM provider accounts behind an OpenAI Chat Completions-compatible endpoint
 Project-URL: Homepage, https://github.com/eggstack/eggpool
 Project-URL: Repository, https://github.com/eggstack/eggpool

{eggpool-0.7.2 → eggpool-0.7.3}/architecture/deep-dive-health.md

@@ -126,6 +126,24 @@ records the circuit failure; the effects applier never records that same
 transition a second time. Request-local errors and cancellation release a
 half-open probe without provider penalties.
 
+### Per-model quarantine suppresses account-wide circuit advance
+
+When the classifier sets `model_effect = "quarantine"` on a 5xx, the
+effects applier (`EffectsApplier._apply_account_effect`) skips the
+`HealthManager.record_failure()` call for that account. The per-model
+disable (`disable_model`) is the **sole** shared-state penalty in that
+case; the account-wide circuit breaker stays closed. The breaker
+advances only when the classifier sets `source = "transport"`
+(genuine account-wide failure: DNS failure, TLS error, persistent 503
+with no model-specific cause) **and** `model_effect = "none"`.
+
+This isolation prevents N per-model 5xx failures from tripping the
+breaker for all models on the same subscription. A single model's
+upstream anomaly must not black-hole sibling models on the same
+account. The `effects.account_effect` is still `"failure"` in the
+quarantined case; the `model_effect` flag gates whether the breaker
+call fires.
+
 ## Key Invariants
 
 - Health driven solely by upstream-observed failures, operator disablement, and catalog/protocol incompatibility
@@ -138,3 +156,4 @@ half-open probe without provider penalties.
 - Half-open probe acquisition always converges through success, failure, cancellation, or local release
 - Cooldown timers are monotonic
 - `AccountHealth` fields: `consecutive_failures`, `disabled_models`, `disabled_until`, `disabled_reason`, `cooldown_until`
+- Per-model quarantine (`model_effect != "none"`) is the SOLE shared-state penalty; the account-wide circuit breaker advances only when `source="transport"` AND `model_effect="none"` (genuine account-wide failure). A single model's 5xx must not black-hole sibling models on the same account

{eggpool-0.7.2 → eggpool-0.7.3}/architecture/deep-dive-providers.md

@@ -50,3 +50,13 @@ truth when a provider serves a non-default protocol or capability contract.
   provider's capability row. Speculative universal ceilings (such as a
   universal 5 MiB local-runtime ceiling) are not encoded in bundled templates;
   only verified provider-defined limits are advertised.
+- Per-provider capability overrides (e.g. `thinking.status`) live in the
+  provider-scoped cache row and are applied by
+  `ModelCatalogCache.get_provider_model_entry()` /
+  `ModelCatalogCache.get_provider_model_entries()`. The collapsed `models`
+  row (`get_model()`) deliberately does **not** apply overrides — it
+  represents the raw catalog state. Capability rejection attribution must
+  consult provider-scoped entries, not just the collapsed row, to avoid
+  false `"unknown"` readings when overrides are present. Quarantine does
+  **not** erase a provider's capability — quarantined entries still
+  contribute to the aggregated status.

{eggpool-0.7.2 → eggpool-0.7.3}/architecture/deep-dive-request-lifecycle.md

@@ -192,6 +192,19 @@ re-raising.
 - `recompute_thinking_budget_for_provider()` — re-resolves budget against selected provider's capability
 - `adapt_provider_thinking_controls()` — validates and adapts controls against the provider contract
 
+`_determine_thinking_rejection_status()` (coordinator) — attributes a
+thinking rejection to an aggregated capability status when all
+eligible accounts are filtered out. Consults the collapsed
+`models` row first, then falls back to the provider-scoped row when
+`context.provider_id` is known, and otherwise iterates every
+provider entry returned by `cache.get_provider_model_entries()` —
+including quarantined accounts — and aggregates the most permissive
+status. Most-permissive order: `supported` > `mixed` >
+`unsupported` > `unknown`. Returns `"unknown"` or `"unsupported"`
+only when the aggregated status is genuinely authoritative;
+otherwise returns `None` so the caller falls through to the
+generic transient `no_eligible_providers` reason.
+
 ### `request/upstream_helpers.py` — Upstream URL and endpoint validation
 
 Extracted from `RequestCoordinator` in Plan 136 Phase 5.  Resolves the absolute
@@ -299,6 +312,42 @@ graph afterward. `replace_provider_payload()` remains as a conservative
 conditional ownership primitive for compatibility callers; the former
 `provider_payload_copy()` transcode helper was removed in Plan 124.
 
+### Dispatch-freeze lifecycle
+
+`serialize_provider_payload()` serializes the current generation and
+sets a dispatch-freeze flag (`_frozen`). Once frozen, mutations that
+do **not** begin a new generation — `replace_provider_payload()` and
+`set_provider_payload(increment_generation=False)` — raise
+`RuntimeError("provider payload is frozen")` because they cannot
+safely overwrite a body that downstream dispatch already consumed.
+
+Methods that **begin a new generation** — `set_provider_payload(increment_generation=True)` and `adopt_provider_payload(increment_generation=True)` — reset `_frozen` alongside the cached serialized-bytes. The new generation is the canonical provider payload, and the next `serialize_provider_payload()` call re-encodes from scratch. This is what allows the post-selection cross-protocol transcoder (`_apply_selected_provider_transcode`) to replace a body that the previous attempt already serialized and dispatched — a retry that selects a different provider must rebuild from the original client payload, but the transcoder may also need to replace the previously adopted transcode result when account failover picks a different upstream. `adopt_provider_payload(increment_generation=False)` still raises when
+frozen: it does not begin a new generation.
+
+### Thinking rejection attribution
+
+When all eligible accounts are filtered out (including quarantine) and
+the request carries thinking controls,
+`_determine_thinking_rejection_status()` attributes the rejection to a
+capability status. Per-provider thinking overrides (e.g. the bundled
+OpenCode Go host capabilities for `muse-spark-1.2-contributor`)
+live in the provider-scoped cache row, **not** the collapsed
+`models` row. `cache.get_model()` deliberately does **not** apply
+overrides; `cache.get_provider_model_entry()` and
+`cache.get_provider_model_entries()` do.
+
+When `context.provider_id` is unset, the method iterates every
+provider entry for the model and aggregates the most permissive
+status. Quarantine does **not** erase a provider's capability —
+quarantined entries still contribute to the aggregated status. A
+400 (`CapabilityError`) is surfaced only when the aggregated status
+is genuinely `unknown` or `unsupported`; when the status is
+`supported` or `mixed` but every supporting account is currently
+quarantined, the caller falls through to `ModelUnavailableError`
+(503) / `UpstreamExhaustedError` so a transient retry is possible.
+This prevents a misleading `thinking capability status: unknown`
+400 from masking a recoverable quarantine-state failure.
+
 Prepared transcode results retain one request-local translated JSON generation
 without recursively freezing or rematerializing it. Valid unchanged reuse
 adopts that generation through `adopt_provider_payload()` and attaches the
@@ -463,3 +512,4 @@ Streaming usage accumulation across chunks.
 - Same URL composition rules for catalog fetch and chat dispatch
 - Selection-claim lock splits DB I/O from runtime publication (Milestone B)
 - Dispatch persistence is one direct per-request transaction
+- `ProviderBoundRequest` dispatch-freeze flag resets together with `payload_generation`; mutations that do not start a new generation (`replace_provider_payload`, `set_provider_payload(increment_generation=False)`, `adopt_provider_payload(increment_generation=False)`) reject when frozen. The post-selection transcoder relies on the generation-incrementing methods to replace a previously dispatched body on retry

{eggpool-0.7.2 → eggpool-0.7.3}/architecture/deep-dive-retry.md

@@ -76,7 +76,11 @@ Upstream HTTP response
     → RetryClassifier().classify(status_code, headers, body)
     → RetryableError(category, retry_after)
     → RequestCoordinator._should_retry()
-    → HealthManager.record_failure() / record_success()
+    → EffectsApplier.apply_once()
+        - model_effect="quarantine": disable_model only;
+          record_failure() skipped (per-model failure isolation)
+        - source="transport" + model_effect="none":
+          record_failure() advances account-wide breaker
     → Retry with excluded accounts
 ```
 

{eggpool-0.7.2 → eggpool-0.7.3}/architecture/deep-dive-routing.md

@@ -185,6 +185,18 @@ Authentication failure and authoritative catalog withdrawal are separate
 terminal gates; they recover only through corrected credentials/operator action
 or authoritative model reappearance.
 
+When all eligible accounts are excluded (including quarantine) and the
+request carries thinking controls, the error class depends on the
+aggregated capability status across every provider entry for the model,
+not just the collapsed row. A 400 (`CapabilityError`) is returned only
+when the aggregated status is genuinely `unknown` or `unsupported`.
+When the aggregated status is `supported` or `mixed` but every
+supporting account is quarantined, a transient 502/503 (`UpstreamError`,
+`ModelUnavailableError`) is returned so the client can retry. This
+prevents a misleading `thinking capability status: unknown` 400 from
+being surfaced when the underlying provider does support the request
+but is currently unhealthy across every account.
+
 ## Score Components
 
 Every `routing_decisions` row carries `score_components_json`:

{eggpool-0.7.2 → eggpool-0.7.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "eggpool"
-version = "0.7.2"
+version = "0.7.3"
 description = "A lightweight proxy that aggregates multiple LLM provider accounts behind an OpenAI Chat Completions-compatible endpoint"
 readme = "README.md"
 requires-python = ">=3.11"

{eggpool-0.7.2 → eggpool-0.7.3}/src/eggpool/failure/applier.py

@@ -265,32 +265,31 @@ class EffectsApplier:
             self._health_manager.record_rate_limit(account, retry_after)
             self._health_manager.release_request(account)
         elif effects.account_effect == "failure":
-            # Record the failure for the account's circuit breaker without
-            # applying an account-wide cooldown.  When the classifier also
-            # set ``model_effect = "quarantine"`` the per-model disable
-            # applied via ``_apply_model_effect`` is the only shared-state
-            # penalty; the account itself stays eligible so sibling models
-            # on the same account keep routing.
-            self._health_manager.record_failure(
-                account,
-                model_id=obs.model_id,
-                reason=effects.backoff_reason or "unknown",
-            )
-            if (
-                effects.model_effect == "none"
-                and effects.backoff_until
-                and effects.backoff_reason
-            ):
-                # Legacy/fallback path: no per-model suppression was
-                # requested, so fall back to the previous account-wide
-                # bounded cooldown.  This branch only fires for callers
-                # that opt into account-only failure handling.
-                delay = effects.backoff_until - now
-                if delay > 0:
-                    health = self._health_manager.get_account_health(account)
-                    health.cooldown_until = self._health_manager.clock() + delay
-                    health.health_state = "cooldown"
-                    health.is_healthy = False
+            # Per-model failures (``model_effect = "quarantine"``) must
+            # never advance the account-wide circuit breaker: a single
+            # model/provider anomaly should not black-hole sibling
+            # models on the same account.  The per-model disable applied
+            # via ``_apply_model_effect`` is the only shared-state
+            # penalty in that case.  Only when the failure is genuinely
+            # account-wide (no per-model suppression requested) do we
+            # call ``record_failure`` to advance the breaker counter.
+            if effects.model_effect == "none":
+                self._health_manager.record_failure(
+                    account,
+                    model_id=obs.model_id,
+                    reason=effects.backoff_reason or "unknown",
+                )
+                if effects.backoff_until and effects.backoff_reason:
+                    # Legacy/fallback path: no per-model suppression was
+                    # requested, so fall back to the previous account-wide
+                    # bounded cooldown.  This branch only fires for callers
+                    # that opt into account-only failure handling.
+                    delay = effects.backoff_until - now
+                    if delay > 0:
+                        health = self._health_manager.get_account_health(account)
+                        health.cooldown_until = self._health_manager.clock() + delay
+                        health.health_state = "cooldown"
+                        health.is_healthy = False
         elif effects.account_effect == "cooldown":
             self._health_manager.record_failure(
                 account,

{eggpool-0.7.2 → eggpool-0.7.3}/src/eggpool/request/coordinator.py

@@ -2251,34 +2251,61 @@ class RequestCoordinator:
                     context=context,
                     thinking_req=thinking_req,
                 )
-                if rejected_status == "unknown":
-                    await _thinking_counter.increment_unknown_capability(
+                # ``rejected_status`` is ``"unknown"`` or
+                # ``"unsupported"`` when the capability row is
+                # truly authoritative (built-in override plus any
+                # provider-scoped row report the same status);
+                # ``None`` means every supporting provider has been
+                # quarantined or filtered for reasons unrelated to
+                # the thinking capability — the underlying provider
+                # still supports thinking, so do not surface a
+                # misleading client-validation 400.  Fall through to
+                # the standard ``UpstreamExhaustedError`` /
+                # ``ModelUnavailableError`` path so the operator
+                # observes a transient upstream unavailability.
+                if rejected_status in {"unknown", "unsupported"}:
+                    if rejected_status == "unknown":
+                        await _thinking_counter.increment_unknown_capability(
+                            client_protocol=thinking_req.client_protocol,
+                        )
+                    else:
+                        await _thinking_counter.increment_unsupported_capability(
+                            client_protocol=thinking_req.client_protocol,
+                        )
+                    await _thinking_counter.increment_rejected(
                         client_protocol=thinking_req.client_protocol,
+                        capability_status="no_eligible_providers",
                     )
-                elif rejected_status == "unsupported":
-                    await _thinking_counter.increment_unsupported_capability(
-                        client_protocol=thinking_req.client_protocol,
+                    if context.thinking_trace is not None:
+                        context.thinking_trace["decision"] = "rejected"
+                        context.thinking_trace["capability_status"] = rejected_status
+                    raise CapabilityError(
+                        model_id=context.model_id,
+                        capability="thinking",
+                        requested_fields=thinking_req.fields,
+                        message=(
+                            f"Model {context.model_id!r} is available, "
+                            f"but no eligible provider is known to "
+                            f"support requested thinking controls "
+                            f"(thinking capability status: "
+                            f"{rejected_status or 'unknown'})."
+                        ),
                     )
-                await _thinking_counter.increment_rejected(
-                    client_protocol=thinking_req.client_protocol,
-                    capability_status="no_eligible_providers",
-                )
-                if context.thinking_trace is not None:
-                    context.thinking_trace["decision"] = "rejected"
-                    context.thinking_trace["capability_status"] = (
-                        rejected_status or "no_eligible_providers"
+                # Capability status is genuinely ``supported`` (or
+                # ``mixed``) for the selected provider but every
+                # supporting account is currently filtered out
+                # (typically due to transient quarantine). Surface a
+                # 502/503 transient unavailability so the request
+                # can be retried after the upstream cools down.
+                if self._all_accounts_attempted(
+                    context, capability_policy=_capability_policy
+                ):
+                    raise UpstreamExhaustedError(
+                        f"All eligible accounts attempted for model "
+                        f"{context.model_id!r}"
                     )
-                raise CapabilityError(
-                    model_id=context.model_id,
-                    capability="thinking",
-                    requested_fields=thinking_req.fields,
-                    message=(
-                        f"Model {context.model_id!r} is available, "
-                        f"but no eligible provider is known to "
-                        f"support requested thinking controls "
-                        f"(thinking capability status: "
-                        f"{rejected_status or 'unknown'})."
-                    ),
+                raise ModelUnavailableError(
+                    f"No accounts available for model {context.model_id!r}"
                 )
             if self._all_accounts_attempted(
                 context, capability_policy=_capability_policy
@@ -4539,9 +4566,17 @@ class RequestCoordinator:
         provider-scoped thinking rows live in
         ``provider_model_metadata`` and are applied on the per-candidate
         eligibility check but never make it into the collapsed entry.
-        To avoid a false ``unknown`` reading that would mis-attribute a
-        rejection, also consult the provider-scoped entry when the
-        collapsed one reports ``unknown``.
+        To avoid a false ``"unknown"`` reading that would mis-attribute a
+        rejection, also consult the provider-scoped entries when the
+        collapsed one reports ``"unknown"`` — first the routing
+        ``context.provider_id`` if it is set, and otherwise every
+        provider with a known provider-scoped row. Built-in capability
+        overrides (e.g. the canonical OpenCode Go host capabilities for
+        ``muse-spark-1.2-contributor``) are applied at request time by
+        ``ModelCatalogCache.get_provider_model_entry``; the bare-model
+        request path therefore still resolves the correct
+        ``supported`` status even when ``provider_id`` was not parsed
+        out of the client request.
         """
         from eggpool.catalog.capabilities import extract_thinking_status_from_entry
 
@@ -4549,15 +4584,45 @@ class RequestCoordinator:
         try:
             cache = self._catalog.cache
             collapsed_entry = cache.get_model(context.model_id)
-            status = extract_thinking_status_from_entry(collapsed_entry)
-            if status == "unknown" and context.provider_id is not None:
+            collapsed_status = extract_thinking_status_from_entry(collapsed_entry)
+            if collapsed_status != "unknown":
+                status = collapsed_status
+            elif context.provider_id is not None:
                 provider_entry = cache.get_provider_model_entry(
                     context.model_id,
                     context.provider_id,
                 )
-                provider_status = extract_thinking_status_from_entry(provider_entry)
-                if provider_status != "unknown":
-                    status = provider_status
+                status = extract_thinking_status_from_entry(provider_entry)
+            else:
+                # No provider hint: aggregate every provider with a
+                # known provider-scoped entry for the model so per-
+                # provider built-in overrides still surface as
+                # ``supported`` rather than collapsing to a misleading
+                # ``unknown``. The router may have just marked every
+                # supporting account as quarantined for this model
+                # while the provider entry (and its built-in override)
+                # is still authoritative for the catalog.
+                # ``get_provider_model_entries`` returns the override-
+                # applied view for every ``(model_id, provider_id)``
+                # row in the cache, including rows whose accounts were
+                # removed from ``_account_support`` by quarantine. The
+                # most permissive status wins because the failure is
+                # attributed to the request, not to any specific
+                # provider.
+                statuses: set[str] = {collapsed_status}
+                for model_id, provider_id in cache.get_provider_model_entries():
+                    if model_id != context.model_id:
+                        continue
+                    entry = cache.get_provider_model_entry(model_id, provider_id)
+                    statuses.add(extract_thinking_status_from_entry(entry))
+                if "supported" in statuses:
+                    status = "supported"
+                elif "mixed" in statuses:
+                    status = "mixed"
+                elif "unsupported" in statuses:
+                    status = "unsupported"
+                else:
+                    status = collapsed_status
         except Exception:  # noqa: BLE001
             return None
         if status in ("unknown", "unsupported"):

{eggpool-0.7.2 → eggpool-0.7.3}/src/eggpool/request/provider_bound_request.py

@@ -251,8 +251,17 @@ class ProviderBoundRequest:
         is the ownership boundary for path-level transformations such as
         safe compression.  Unknown or externally-owned graphs must use
         :meth:`set_provider_payload` instead.
+
+        When ``increment_generation=True`` the call begins a new generation
+        that supersedes any previously serialized/frozen dispatch body.
+        The dispatch-freeze flag is reset alongside the cached serialized
+        bytes so the next ``serialize_provider_payload`` call re-encodes
+        the freshly adopted graph. This is what allows the
+        post-selection cross-protocol transcoder to replace the
+        preflight-prepared body after a previous attempt has already
+        serialized and dispatched once.
         """
-        if self._frozen:
+        if self._frozen and not increment_generation:
             raise RuntimeError("provider payload is frozen")
         object.__setattr__(self, "_provider_payload", dict(payload))
         object.__setattr__(self, "mutated", True)
@@ -261,6 +270,9 @@ class ProviderBoundRequest:
             self.diagnostics.generation_changes += 1
             self.mutation_log.append(PayloadMutation(self.payload_generation, reason))
             del self.mutation_log[: -self.mutation_log_limit]
+            # A new generation invalidates the previous dispatch freeze;
+            # the newly adopted graph is the canonical provider payload.
+            object.__setattr__(self, "_frozen", False)
         object.__setattr__(self, "_provider_bytes", None)
         object.__setattr__(self, "_serialized_generation", None)
 
@@ -309,6 +321,15 @@ class ProviderBoundRequest:
         incremented so
         downstream caches (segmentation, prepared-transcode) can detect
         staleness.
+
+        When ``increment_generation=True`` the call begins a brand-new
+        generation that supersedes any previously serialized/frozen
+        dispatch body. The serialized-bytes cache and the dispatch-freeze
+        flag are both reset so the next ``serialize_provider_payload`` call
+        re-encodes the new graph; the retry path through
+        ``_apply_selected_provider_transcode`` relies on this so a
+        cross-protocol translation against a different selected provider
+        can replace a body that the previous attempt already serialized.
         """
         if not increment_generation and self._frozen:
             raise RuntimeError("provider payload is frozen")
@@ -321,6 +342,10 @@ class ProviderBoundRequest:
                 PayloadMutation(self.payload_generation, "set_provider_payload")
             )
             del self.mutation_log[: -self.mutation_log_limit]
+            # A new generation invalidates any prior serialized/frozen
+            # dispatch body — the new graph is the canonical provider
+            # payload until the next serialization call.
+            object.__setattr__(self, "_frozen", False)
         object.__setattr__(self, "_provider_bytes", None)
         object.__setattr__(self, "_serialized_generation", None)
 

{eggpool-0.7.2 → eggpool-0.7.3}/uv.lock

@@ -178,7 +178,7 @@ toml = [
 
 [[package]]
 name = "eggpool"
-version = "0.7.2"
+version = "0.7.3"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },