fix(domain): bound quota park windows and add healthy override (#14359)

[texastoland]

Fixes #14359.

Problem

qwen-cloud-token-plan stopped receiving traffic with
All qwen-cloud-token-plan accounts have exhausted their quota while the same upstream key
kept serving: the plan was topped up with a credit pack, which the console window percentage
does not reflect. Root cause chain (all read at release/v3.8.51):

1. src/domain/quotaCache.ts — an exhausted entry with a nextResetAt is never TTL-expired;
   the park holds until that timestamp, however far out.
2. open-sse/services/qwenTokenPlanQuotaFetcher.ts — the 5-hour window is "Temporarily
   Removed" from the console, so the fetcher reports the weekly window and its reset
   (~4 days) as the worst case -> setQuotaCache parks the connection on the weekly reset.
3. src/sse/services/auth.ts — with zero quota candidates, the router refuses pre-dispatch
   with the synthetic message; no call_logs row is written (log-visibility half: fix(sse): requests skipped by the quota-parking path leave no call_logs row #14360).

Measured on the reporter's install: last real dispatch 2026-09-21T06:26Z, then ~12.5 h of
zero real dispatches while hourly connection-test probes returned 200, breaker CLOSED,
failureCount: 0, dashboard "Weekly window 0% left, 40,000 / 40,000".

Fix

"Upstream facts outrank console scrapes — but only within a freshness window."

• Park cap (EXHAUSTED_MAX_PARK_MS, 30 min): every park writer (setQuotaCache,
  snapshot hydration, Codex hydration) caps the deadline at observation + park window, so
  nextResetAt becomes "when we stop trusting the park", not "when quota resets". Display
  paths read per-window resetAt, so dashboards stay truthful.
• Streak preservation: while the same exhausted streak continues (prior entry exhausted
  with a future deadline), setQuotaCache keeps the existing capped deadline instead of
  re-anchoring at Date.now(). Without this the quota monitor's periodic rewrites re-anchor
  the park every tick and it never expires (this is exactly why a cap-only first attempt
  failed its live test).
• Healthy override (healthyUntil map on the #8065 shared globalThis state): a
  successful upstream dispatch (chat.ts success hook, beside clearModelLock) arms
  now + 30 min, sliding; both predicates stand down while armed; a genuine 429
  (markAccountExhaustedFrom429) clears it and re-parks on the existing 5-minute TTL.
  The map lives on the shared state, not module scope, because standalone builds duplicate
  this module across webpack chunks (fix(backend): quota cache keeps renewed Codex accounts exhausted after restart #8065) — per-entry fields silently no-op on the
  apikey + hydration path, which is precisely the qwen path.
• Preflight parity: evaluateQuotaCutoff reads fetcher data independently of the cache,
  so it honoured neither the cap nor the override; it now accepts
  QuotaCutoffScope.connectionId and has the same healthy escape, beside the existing
  isClaudeExtraUsageAllowed escape.
• Refusal diagnostics: the all-accounts-skipped message appends (cached quota state, no upstream attempt; earliest reset ...) after the existing text — the literal
  have exhausted their quota substring is preserved because classify429 matches on it
  (fix(backend): auto/coding zero-config routes do not fall back when LKGP-sticky provider is quota-exhausted (429) #9269); only the reset hint travels in Retry-After.

Behaviour change: Retry-After

Far-reset providers now advertise at most the park window; clients retry sooner. Extra 429
traffic is bounded: genuinely exhausted accounts are re-probed at most once per park window,
and the first real 429 re-parks them on the existing 5-minute TTL.

Scope

Standard providers only. Codex/antigravity per-window branches are intentionally untouched
beyond the shared writer caps (their parks are released via the capped nextResetAt through
advancedWindowResetAt, but getQuotaWindowStatus().reachedThreshold still reads raw window
data once dispatched).

Prior art

#8065 (chunk-duplicated quota cache state), #12860 (Codex preflight cooldown never lifted),
#12451 / #12452 (healthy accounts persisted as exhausted), #14072 (Antigravity stuck 11+ h).

Tests

New (fail on ea3c12264b = current release/v3.8.51, pass here):

• tests/unit/quota-park-cap-14359.test.ts — writer/hydration caps, streak preservation,
  stale-snapshot hydration unblocks, fresh snapshot still parks, expired park unblocks both
  predicates.
• tests/unit/quota-healthy-override-14359.test.ts — override arms/stands down both
  predicates, 429 clears it, expiry after the park window.
• tests/unit/quota-preflight-healthy-override-14359.test.ts — evaluateQuotaCutoff
  honours the override; still cuts off without it.
• qwen-token-plan-quota-fetcher — weekly-only, fully-used case pins the parked-state
  precondition (limitReached, weekly resetAt).

Existing suites re-run green: quota-cache-hydrate-5015, repro-8065-quota-cache-cross-instance,
13601-quota-far-reset-skip, quota-preflight, account-fallback-anthropic-quota,
classify429, tests/integration/combo-matrix/quota-aware. npm run typecheck:core clean.

Live validation (reporter's install, 3.8.51-dev dist)

The same design, hot-patched into the running gateway's compiled chunks, was validated
end-to-end: a routed combo test dispatched the previously-parked qwen-cloud-token-plan
member (HTTP 200 "pong", 1.5 s) while the other members reached their real upstreams
(command-code 400 insufficient-credits, opencode-go 429 weekly) — no synthetic pre-dispatch
refusals anywhere.

Out of scope

#14360 (the skip writes no call_logs row) — separate log-visibility issue.

[diegosouzapw]

Nicely instrumented root-cause writeup with real production timestamps, and the fix design
("upstream facts outrank console scrapes, but only within a freshness window") is sound —
verified the cap is applied at all three park-writing call sites and the healthy override is
correctly armed on real success / disarmed on a genuine 429 in both directions. The streak-
preservation detail (and the note that a cap-only first attempt failed live) is a good sign
this was validated against the real upstream, not just theorized. Looks merge-ready.