fix(anthropic): keep pool session affinity across restarts and transient detours

docs-site/src/content/docs/fr/guides/claude-code.md

@@ -34,8 +34,8 @@ consultez les conditions actuelles d'Anthropic.
 Comportement lorsque cette option est activée :
 
 - Un **429** en amont place le compte en temporisation selon `Retry-After` lorsqu'il est présent, ou selon un délai de repli,
-  efface ses affinités et peut faire basculer la requête vers un autre compte admissible, dans les limites prévues.
-- L'affinité est **locale au processus** et disparaît au redémarrage du proxy.
+  et peut faire basculer la requête vers un autre compte admissible, dans les limites prévues. Seul un refus de quota partagé efface ses affinités ; une limitation temporaire les conserve.
+- L'affinité survit au redémarrage dans le même répertoire de configuration et la même instance fournisseur (24 heures d'inactivité, 2 000 liaisons au maximum). Le fichier privé ne contient que des empreintes de session et d'identité de connexion, jamais de clé de session brute ni de jeton. Les anciens comptes sans identité persistante restent locaux au processus jusqu'à leur prochaine connexion. Le renouvellement du jeton conserve la liaison ; une nouvelle connexion, la suppression, la pause, une réauthentification requise ou une sélection manuelle pendant l'exécution l'invalident. Un détour temporaire dû à une limitation de débit conserve la liaison initiale.
 - Les erreurs de renouvellement du jeton conservent la règle `needsReauth`. Un 403 confirmé lié à un abonnement ou à la facturation du compte peut déclencher un basculement avant la sortie, avec une temporisation selon `Retry-After` ou de dix minutes. Un refus d’autorisation ordinaire reste terminal. Voir la [reprise des comptes](/guides/claude-code/).
 - Si chaque compte éligible est en temporisation, le proxy renvoie **429** (et non 401) avec `Retry-After`
   lorsqu'il est connu.

docs-site/src/content/docs/guides/claude-code.md

@@ -109,7 +109,7 @@ Operational contract when enabled:
   not postpone usage probes or clear a failed usage probe's unavailable status. Measurements
   whose known reset time has passed are discarded as unknown, including retained model-specific
   windows. Values without a known reset are preserved; missing data is never reported as zero usage.
-- Affinity is **process-local** (lost on proxy restart).
+- Affinity survives proxy restart within the same config home and provider instance (24-hour idle lifetime, newest 2,000 bindings). The private snapshot stores session digests and login fences, never raw session keys or tokens. Legacy accounts without a persistent login identity remain process-local until their next login. Token refresh preserves affinity; replacement login, account removal, pause/reauthentication and explicit runtime account selection invalidate it. A transient throttle detour preserves the original binding even when its pause expires before the retry commits.
 - A complete, structured **403** account-entitlement or billing refusal can rotate before
   output. Recognized cases include no Claude Code access, an expired/inactive subscription,
   and an insufficient Anthropic credit balance. The refused account loses its affinities and

docs-site/src/content/docs/tr/guides/claude-code.md

@@ -37,10 +37,9 @@ tavsiye değildir; Anthropic'in güncel koşullarını kontrol edin.
 Etkinleştirildiğinde operasyonel sözleşme:
 
 - Yukarı akıştan gelen **429**, varsa `Retry-After` (yoksa varsayılan bir geri
-  çekilme) kullanarak o hesabı soğutur, bağlılıklarını temizler ve aynı istek
-  içinde uygun başka bir hesaba dönebilir (sınırlı).
-- Bağlılık **işleme özeldir (process-local)** (proxy yeniden başlatıldığında
-  kaybolur).
+  çekilme) kullanarak o hesabı soğutur ve aynı istek içinde uygun başka bir hesaba
+  dönebilir (sınırlı). Yalnızca ortak kota reddi bağlılıkları temizler; geçici hız sınırlaması bunları korur.
+- Bağlılık aynı yapılandırma dizini ve sağlayıcı örneğinde yeniden başlatma sonrasında korunur (24 saat boşta kalma, en yeni 2.000 bağ). Özel dosya yalnızca oturum ve giriş kimliği özetlerini saklar; ham oturum anahtarı veya token içermez. Kalıcı giriş kimliği olmayan eski hesaplar yeniden girişe kadar işleme özeldir. Token yenileme bağı korur; yeniden giriş, kaldırma, duraklatma, yeniden kimlik doğrulama gereksinimi veya çalışma sırasında elle hesap seçimi bağı geçersiz kılar. Geçici hız sınırlaması nedeniyle başka hesaba yönelme özgün bağı değiştirmez.
 - Token yenileme hataları mevcut `needsReauth` kuralını korur. Doğrulanmış abonelik veya hesap ödeme 403 hatası çıktı başlamadan hesap değiştirebilir; soğuma `Retry-After` veya varsayılan on dakikadır. Genel izin reddi terminal kalır. Bkz. [hesap kurtarma](/guides/claude-code/).
 - Uygun tüm hesaplar soğutuluyorsa, proxy bilindiğinde `Retry-After` ile
   birlikte **429** (401 değil) döndürür.

docs-site/src/content/docs/zh-tw/guides/claude-code.md

@@ -28,9 +28,9 @@ Anthropic 未認可自動帳號池；同一組織的帳號可能共用配額（
 
 啟用時的營運契約：
 
-- 上游 **429** 會讓該帳號冷卻（有 `Retry-After` 時使用它，否則用預設 backoff）、清除其 affinity，
-  並可能在同一個請求內輪換到另一個合格帳號（有上限）。
-- Affinity 是**程序本機**的（proxy 重啟後就會遺失）。
+- 上游 **429** 會讓該帳號冷卻（有 `Retry-After` 時使用它，否則用預設 backoff），
+  並可能在同一個請求內輪換到另一個合格帳號（有上限）。只有共享配額拒絕會清除 affinity；暫時限流會保留綁定。
+- Affinity 可在相同設定目錄及提供者實例中跨 proxy 重啟保留（閒置 24 小時，最多 2,000 筆）。快照只存工作階段摘要及登入識別圍欄，不存原始工作階段金鑰或 token。沒有持久登入識別的舊帳號在再次登入前僅保留程序內綁定；一般 token 更新保留綁定，重新登入、移除、暫停、需要重新驗證或執行期間手動選擇帳號則使其失效。暫時限流的替代帳號不會覆寫原綁定。
 - Token 更新失敗保留既有 `needsReauth` 規則。明確的訂閱或帳號計費 403 可在輸出前切換帳號，冷卻遵循 `Retry-After` 或預設十分鐘；一般權限拒絕不切換。詳見[帳號復原](/guides/claude-code/)。
 - 如果每個合格帳號都在冷卻，proxy 會回傳 **429**（不是 401），並在已知時附上 `Retry-After`。
 - 復原（包括 429 容錯移轉）會使用 `quotaWindow` 為合格的替代帳號排序，且不改變現有的冷卻或

scripts/test-layout/layout-adapters.json

@@ -11,5 +11,7 @@
   "provider-quota-abliteration.test.ts": "providers",
   "claude-inbound-tool-loading.test.ts": "claude-integration",
   "command-code-plan-denial.test.ts": "providers",
-  "claude-tool-loading-destinations.test.ts": "claude-integration"
+  "claude-tool-loading-destinations.test.ts": "claude-integration",
+  "anthropic-affinity-restart.test.ts": "adapters/anthropic",
+  "anthropic-affinity-store.test.ts": "adapters/anthropic"
 }

src/oauth/anthropic-rate-limit-policy.ts

@@ -6,6 +6,12 @@ export type AnthropicRateLimitKind = "shared-quota" | "family-quota" | "transien
 export type RateLimitHeaders = Pick<Headers, "get">;
 export const ANTHROPIC_SHORT_RETRY_MS = 100;
 export const ANTHROPIC_MAX_INLINE_THROTTLE_MS = 1_000;
+/**
+ * How long a transient pause keeps marking its account as only detoured from (#7813). A detour
+ * awaits the alternate's credential and selection commit after the pause is set; a pause that
+ * expires during those awaits must not turn the detour into a permanent rebinding.
+ */
+export const ANTHROPIC_DETOUR_GRACE_MS = 5 * 60_000;
 
 export function anthropicRetryAfterMs(value: string | null | undefined, now: number): number | undefined {
   const text = value?.trim();
@@ -27,6 +33,9 @@ export function classifyAnthropic429(headers: RateLimitHeaders, now = Date.now()
 
 function createAnthropicRatePolicy(instance: AnthropicInstanceId) {
   let pauses: Map<string, { until: number; generation: string }> | undefined;
+  // Accounts paused within the detour grace window, by credential generation. Bounded by the
+  // stored account set (one row per account) and pruned with the pauses.
+  let recent: Map<string, { at: number; generation: string }> | undefined;
   function pauseAnthropicRateAdmission(accountId: string, until: number): void {
     const credential = getAccountCredential(instance, accountId);
     if (!credential) return;
@@ -36,6 +45,9 @@ function createAnthropicRatePolicy(instance: AnthropicInstanceId) {
     for (const [id, pause] of rows) if (pause.until <= now) rows.delete(id);
     const previous = rows.get(accountId);
     rows.set(accountId, { until: Math.max(previous?.generation === generation ? previous.until : 0, until), generation });
+    const marks = recent ??= new Map();
+    for (const [id, mark] of marks) if (now - mark.at > ANTHROPIC_DETOUR_GRACE_MS) marks.delete(id);
+    marks.set(accountId, { at: now, generation });
   }
   function anthropicRatePauseUntil(accountId: string, now = Date.now()): number | undefined {
     const pause = pauses?.get(accountId);
@@ -46,21 +58,33 @@ function createAnthropicRatePolicy(instance: AnthropicInstanceId) {
     }
     return pause.until;
   }
-  function clearAnthropicRatePauses(): void { pauses = undefined; }
+  /** True while the account's latest transient pause is younger than the detour grace window. */
+  function anthropicRatePausedRecently(accountId: string, now = Date.now()): boolean {
+    const mark = recent?.get(accountId);
+    if (!mark) return false;
+    const credential = getAccountCredential(instance, accountId);
+    if (now - mark.at > ANTHROPIC_DETOUR_GRACE_MS || !credential || credentialGeneration(credential) !== mark.generation) {
+      recent!.delete(accountId); return false;
+    }
+    return true;
+  }
+  function clearAnthropicRatePauses(): void { pauses = undefined; recent = undefined; }
   function reconcileAnthropicRatePauses(context: GenerationContext): number {
     let removed = 0;
     for (const id of pauses?.keys() ?? []) {
       if (context.oauthAccountKeys.has(`${instance}\0${id}`)) continue;
       pauses!.delete(id); removed++;
     }
+    for (const id of recent?.keys() ?? []) if (!context.oauthAccountKeys.has(`${instance}\0${id}`)) recent!.delete(id);
     return removed;
   }
   function sweepExpiredAnthropicRatePauses(now = Date.now()): number {
     let removed = 0;
     for (const [id, pause] of pauses ?? []) if (pause.until <= now) { pauses!.delete(id); removed++; }
+    for (const [id, mark] of recent ?? []) if (now - mark.at > ANTHROPIC_DETOUR_GRACE_MS) recent!.delete(id);
     return removed;
   }
-  return Object.freeze({ instance, pauseAnthropicRateAdmission, anthropicRatePauseUntil,
+  return Object.freeze({ instance, pauseAnthropicRateAdmission, anthropicRatePauseUntil, anthropicRatePausedRecently,
     clearAnthropicRatePauses, reconcileAnthropicRatePauses, sweepExpiredAnthropicRatePauses });
 }
 export type AnthropicRatePolicy = ReturnType<typeof createAnthropicRatePolicy>;