[JxnLexn]

Problem and resulting behavior

A valid native Responses continuation could be terminated with HTTP 400 after its accounts became temporarily unavailable. The client was told to start a new turn even though the blocker was a quota limit or cooldown. Generic account availability misses were also treated as model-level failures merely because the provider supports per-model quota.

Preserve the turn binding through temporary unavailability:

• Recognized active model quota/rate-limit locks return HTTP 429; transient service locks return HTTP 503. Retry-After reflects the internal cooldown, not a guaranteed upstream reset time.
• Account quota, cooldown, capacity, and policy filters use the normal dispatch gates. A generic availability miss no longer invalidates a pinned model or triggers an unnecessary model switch.
• Model-specific lock safeguards, alternate-model eligibility checks, pending-tool/opaque-state safety, and the single-resume limit remain enforced. Existing bounded short-lock waits remain intact.

The account catalog repair remains separate in #15487.

Regression coverage

The isolated SQLite reproduction creates an exhausted session-quota account and a sibling in a persisted overload cooldown, with no active model lock. Before the fix, the same-turn continuation returns HTTP 400. After the fix it returns retryable unavailability, retains the pin, and succeeds in the same turn once the cooldown expires.

Additional cases cover opaque continuation state, pending tool calls, plain input with a healthy alternate, quota-lock recovery, permanent/unknown lock reasons, and the maximum resume count. Auto-resume tests now expect retryable quota responses while retaining the no-model-switch assertions. Account fixtures are cleaned between scenarios so earlier accounts cannot accidentally satisfy sibling failover.

Validation

• 81 focused routing, continuation, quota-policy, and account-selection tests passed on the upstream branch.
• 78 corresponding tests passed on the fork integration branch.
• 493 Vitest tests and core TypeScript checks passed on both branches.
• Formatting/lint hooks passed for the changed files.
• Full repository CI is not claimed green. Base-red inherited: 🔴 Release branch not green: release/v3.8.52 #15306. Current CI also reports generated-skills drift, a translation-manifest mismatch for docs/architecture/QUALITY_GATES.md, and an existing dependency audit failure before ESLint. This patch changes no dependencies or generated documentation.

Deployment verification

Deployed the successful GitHub-built image to LeonAPI: ghcr.io/jxnlexn/omniroute:sha-39f7a67, revision 39f7a6746b54f31bf6e834bbcf5fd357eb9cf09a, AMD64 digest sha256:b5c02347debec6a8c3d3103bb4b4abb6f9489c22e928159d4cf86f14d3514e4d.

SQLite backup passed quick_check; the previous image is retained for rollback. Only the application container was recreated.

• docker inspect omniroute: expected revision, healthy, zero restarts.
• Local and public GET /api/health/ping: status: ok.
• Two minimal POST /v1/responses requests to gpt-6-astra-combo, using identical synthetic thread/turn metadata: HTTP 200 with output text in 2.179 s and 2.926 s.

The quota/cooldown failure and recovery were reproduced in isolated tests. Production account and quota settings were not artificially changed for the smoke test; existing private conversations were not replayed.

[diegosouzapw]

Thanks @JxnLexn — this is in the upcoming release.