fix(sse): prevent Claude Code identity cloak overrides and fix fallback resilience (#2053)

2026-08-01 21:02:12 +03:00 · 2026-05-08 17:44:30 -03:00
parent aacd43bb45
commit a21aa1f53c
48 changed files with 435 additions and 103 deletions
--- a/open-sse/executors/base.ts
+++ b/open-sse/executors/base.ts
@@ -614,26 +614,40 @@ export class BaseExecutor {
            | Record<string, unknown>
            | undefined;

-          let identitySource: "upstream-metadata" | "upstream-header" | "synthesized" =
-            "synthesized";
+          let identitySource:
+            | "upstream-metadata"
+            | "upstream-header"
+            | "synthesized"
+            | "synthesized-cloaked" = "synthesized";
          let sessionId: string;
          let deviceId: string;
          let accountUUID: string;

-          const upstreamUserId = parseUpstreamMetadataUserId(tb);
+          // For any Claude OAuth request, ignore client-supplied metadata.user_id /
+          // X-Claude-Code-Session-Id and synthesize per-account: the CC device_id from
+          // ~/.claude.json is shared across every account on one machine, which lets
+          // Anthropic correlate accounts behind one OmniRoute.
+          const cloakIdentity = isClaudeCodeClient || hasClaudeOAuthToken;
+          const upstreamUserId = cloakIdentity ? null : parseUpstreamMetadataUserId(tb);
          if (upstreamUserId) {
            sessionId = upstreamUserId.session_id;
            deviceId = upstreamUserId.device_id;
            accountUUID = upstreamUserId.account_uuid;
            identitySource = "upstream-metadata";
          } else {
-            const headerSid = passthroughUpstreamSessionId(
-              clientHeaders as Record<string, string | undefined> | undefined
-            );
+            const headerSid = cloakIdentity
+              ? null
+              : passthroughUpstreamSessionId(
+                  clientHeaders as Record<string, string | undefined> | undefined
+                );
            sessionId = headerSid ?? getSessionId(seed);
            deviceId = resolveCliUserID(psd, seed);
            accountUUID = resolveAccountUUID(psd, seed, activeCredentials?.accessToken);
-            identitySource = headerSid ? "upstream-header" : "synthesized";
+            identitySource = headerSid
+              ? "upstream-header"
+              : cloakIdentity
+                ? "synthesized-cloaked"
+                : "synthesized";
          }

          // system[0] (billing) and system[1] (sentinel) must not carry
--- a/open-sse/executors/claudeIdentity.ts
+++ b/open-sse/executors/claudeIdentity.ts
@@ -132,12 +132,17 @@ const ACCOUNT_FETCH_RETRY_MS = 5 * 60 * 1000;
 const accountUuidCache = new Map<string, { uuid: string | null; fetchedAt: number }>();
 const inflightFetches = new Set<string>();

-async function backgroundFetchAccountUUID(accessToken: string, seed: string): Promise<void> {
-  if (inflightFetches.has(seed)) return;
-  const cached = accountUuidCache.get(seed);
-  if (cached?.uuid) return;
-  if (cached && Date.now() - cached.fetchedAt < ACCOUNT_FETCH_RETRY_MS) return;
-  inflightFetches.add(seed);
+export type ClaudeBootstrap = {
+  account_uuid: string | null;
+  account_email: string | null;
+  organization_uuid: string | null;
+  organization_name: string | null;
+  organization_type: string | null;
+  organization_rate_limit_tier: string | null;
+};
+
+/** GET /api/claude_cli/bootstrap with the same headers real CLI uses. */
+export async function fetchClaudeBootstrap(accessToken: string): Promise<ClaudeBootstrap | null> {
  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), BOOTSTRAP_FETCH_TIMEOUT_MS);
  try {
@@ -151,13 +156,40 @@ async function backgroundFetchAccountUUID(accessToken: string, seed: string): Pr
      },
      signal: ctrl.signal,
    });
-    const data: any = res.ok ? await res.json().catch(() => null) : null;
-    const uuid: string | null = data?.oauth_account?.account_uuid || null;
-    setBounded(accountUuidCache, seed, { uuid, fetchedAt: Date.now() }, IDENTITY_CACHE_LIMIT);
+    if (!res.ok) return null;
+    const data: any = await res.json().catch(() => null);
+    const acct = data?.oauth_account;
+    if (!acct || typeof acct !== "object") return null;
+    return {
+      account_uuid: acct.account_uuid || null,
+      account_email: acct.account_email || null,
+      organization_uuid: acct.organization_uuid || null,
+      organization_name: acct.organization_name || null,
+      organization_type: acct.organization_type || null,
+      organization_rate_limit_tier: acct.organization_rate_limit_tier || null,
+    };
  } catch {
-    setBounded(accountUuidCache, seed, { uuid: null, fetchedAt: Date.now() }, IDENTITY_CACHE_LIMIT);
+    return null;
  } finally {
    clearTimeout(timer);
+  }
+}
+
+async function backgroundFetchAccountUUID(accessToken: string, seed: string): Promise<void> {
+  if (inflightFetches.has(seed)) return;
+  const cached = accountUuidCache.get(seed);
+  if (cached?.uuid) return;
+  if (cached && Date.now() - cached.fetchedAt < ACCOUNT_FETCH_RETRY_MS) return;
+  inflightFetches.add(seed);
+  try {
+    const bootstrap = await fetchClaudeBootstrap(accessToken);
+    setBounded(
+      accountUuidCache,
+      seed,
+      { uuid: bootstrap?.account_uuid ?? null, fetchedAt: Date.now() },
+      IDENTITY_CACHE_LIMIT
+    );
+  } finally {
    inflightFetches.delete(seed);
  }
 }
--- a/open-sse/services/usage.ts
+++ b/open-sse/services/usage.ts
@@ -26,6 +26,7 @@ import {
  updateAntigravityRemainingCredits,
 } from "../executors/antigravity.ts";
 import { getCreditsMode } from "./antigravityCredits.ts";
+import { CLAUDE_CODE_VERSION, fetchClaudeBootstrap } from "../executors/claudeIdentity.ts";
 import {
  deriveAntigravityMachineId,
  generateAntigravityRequestId,
@@ -1719,17 +1720,30 @@ async function getAntigravitySubscriptionInfo(accessToken) {
 * Claude Usage - Try to fetch from Anthropic API
 */
 async function getClaudeUsage(accessToken) {
+  // Refresh bootstrap in parallel; best-effort, failure non-fatal.
+  const bootstrapPromise = fetchClaudeBootstrap(accessToken).catch(() => null);
  try {
-    // Primary: Try OAuth usage endpoint (works with Claude Code consumer OAuth tokens)
-    // Requires anthropic-beta: oauth-2025-04-20 header
-    const oauthResponse = await fetch(CLAUDE_CONFIG.oauthUsageUrl, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "anthropic-beta": "oauth-2025-04-20",
-        "anthropic-version": CLAUDE_CONFIG.apiVersion,
-      },
-    });
+    // Real CLI uses axios here, not Stainless — UA is `claude-code/<version>`
+    // (not `claude-cli/...`) and the shape is simpler than /v1/messages.
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 10_000);
+    let oauthResponse;
+    try {
+      oauthResponse = await fetch(CLAUDE_CONFIG.oauthUsageUrl, {
+        method: "GET",
+        headers: {
+          Accept: "application/json, text/plain, */*",
+          "Accept-Encoding": "gzip, compress, deflate, br",
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json",
+          "User-Agent": `claude-code/${CLAUDE_CODE_VERSION}`,
+          "anthropic-beta": "oauth-2025-04-20",
+        },
+        signal: ctrl.signal,
+      });
+    } finally {
+      clearTimeout(timer);
+    }

    if (oauthResponse.ok) {
      const data = await oauthResponse.json();
@@ -1761,11 +1775,15 @@ async function getClaudeUsage(accessToken) {
        quotas["weekly (7d)"] = createQuotaObject(data.seven_day);
      }

-      // Parse model-specific weekly windows (e.g., seven_day_sonnet, seven_day_opus)
+      // Map Anthropic's internal codenames (e.g., omelette → Designer) for display.
+      const MODEL_DISPLAY_NAMES: Record<string, string> = {
+        omelette: "designer",
+      };
      for (const [key, value] of Object.entries(data)) {
        const valueRecord = toRecord(value);
        if (key.startsWith("seven_day_") && key !== "seven_day" && hasUtilization(valueRecord)) {
-          const modelName = key.replace("seven_day_", "");
+          const codename = key.replace("seven_day_", "");
+          const modelName = MODEL_DISPLAY_NAMES[codename] || codename;
          quotas[`weekly ${modelName} (7d)`] = createQuotaObject(valueRecord);
        }
      }
@@ -1784,6 +1802,7 @@ async function getClaudeUsage(accessToken) {
        plan: planRaw || "Claude Code",
        quotas,
        extraUsage: data.extra_usage ?? null,
+        bootstrap: await bootstrapPromise,
      };
    }

@@ -1791,9 +1810,13 @@ async function getClaudeUsage(accessToken) {
    console.warn(
      `[Claude Usage] OAuth endpoint returned ${oauthResponse.status}, falling back to legacy`
    );
-    return await getClaudeUsageLegacy(accessToken);
+    const legacy = await getClaudeUsageLegacy(accessToken);
+    return { ...legacy, bootstrap: await bootstrapPromise };
  } catch (error) {
-    return { message: `Claude connected. Unable to fetch usage: ${(error as Error).message}` };
+    return {
+      message: `Claude connected. Unable to fetch usage: ${(error as Error).message}`,
+      bootstrap: await bootstrapPromise,
+    };
  }
 }

--- a/src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx
@@ -49,7 +49,9 @@ export default function RoutingTab() {
  const cliCompatProviders = useMemo(
    () =>
      Array.isArray(settings.cliCompatProviders)
-        ? settings.cliCompatProviders.map((providerId: string) => normalizeCliCompatProviderId(providerId))
+        ? settings.cliCompatProviders.map((providerId: string) =>
+            normalizeCliCompatProviderId(providerId)
+          )
        : [],
    [settings.cliCompatProviders]
  );
@@ -270,33 +272,54 @@ export default function RoutingTab() {
          {CLI_COMPAT_TOGGLE_IDS.map((providerId) => {
            const normalizedProviderId = normalizeCliCompatProviderId(providerId);
            const providerDisplay = CLI_COMPAT_PROVIDER_DISPLAY[providerId];
-            const checked = cliCompatProviderSet.has(normalizedProviderId);
+            // Claude OAuth force-applies the fingerprint regardless of this toggle
+            // (base.ts: shouldFingerprint), so render the tile as locked-on.
+            const forced = providerId === "claude";
+            const checked = forced || cliCompatProviderSet.has(normalizedProviderId);
            const label = providerDisplay?.name || providerId;
            const description = providerDisplay?.description || providerId;
+            const titleText = forced
+              ? t("forcedFingerprintTitle", { provider: label })
+              : checked
+                ? t("disableFingerprintTitle", { provider: label })
+                : t("enableFingerprintTitle", { provider: label });

            return (
              <button
                key={providerId}
                type="button"
-                onClick={() => toggleCliCompatProvider(providerId, !checked)}
-                disabled={loading}
+                onClick={() => {
+                  if (forced) return;
+                  toggleCliCompatProvider(providerId, !checked);
+                }}
+                disabled={loading || forced}
                aria-pressed={checked}
-                title={checked ? t("disableFingerprintTitle", { provider: label }) : t("enableFingerprintTitle", { provider: label })}
+                aria-disabled={forced || undefined}
+                title={titleText}
                className={`flex items-start gap-3 rounded-lg border p-3 text-left transition-all ${
                  checked
                    ? "border-indigo-500/50 bg-indigo-500/5 ring-1 ring-indigo-500/20"
                    : "border-border/50 hover:border-border hover:bg-surface/30"
-                } ${loading ? "cursor-not-allowed opacity-60" : ""}`}
+                } ${loading || forced ? "cursor-not-allowed" : ""} ${loading ? "opacity-60" : ""}`}
              >
                <span
                  className={`material-symbols-outlined mt-0.5 text-[18px] ${checked ? "text-indigo-400" : "text-text-muted"}`}
                  aria-hidden="true"
                >
-                  {checked ? "check_circle" : "radio_button_unchecked"}
+                  {forced ? "lock" : checked ? "check_circle" : "radio_button_unchecked"}
                </span>
                <span className="min-w-0 flex-1">
-                  <span className={`block text-sm font-medium ${checked ? "text-indigo-400" : ""}`}>
-                    {label}
+                  <span className="flex items-center gap-2">
+                    <span
+                      className={`block text-sm font-medium ${checked ? "text-indigo-400" : ""}`}
+                    >
+                      {label}
+                    </span>
+                    {forced ? (
+                      <span className="rounded-full border border-indigo-500/40 bg-indigo-500/10 px-2 py-0.5 text-[10px] font-medium uppercase tracking-wide text-indigo-400">
+                        {t("forcedFingerprintBadge")}
+                      </span>
+                    ) : null}
                  </span>
                  <span className="mt-1 block text-xs text-text-muted">{description}</span>
                </span>
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
@@ -214,6 +214,7 @@ export default function ProviderLimits() {
            plan: data.plan || null,
            message: data.message || null,
            raw: data,
+            stale: data._stale ? { since: data._staleSince, reason: data._staleReason } : null,
          },
        }));
        setLastRefreshedAt((prev) => ({
@@ -691,19 +692,30 @@ export default function ProviderLimits() {
                </div>

                {/* Last Refreshed */}
-                <div className="text-center text-[11px] text-text-muted">
-                  {refreshedAt ? (
-                    <span>
-                      {new Date(refreshedAt).toLocaleTimeString([], {
-                        hour: "2-digit",
-                        minute: "2-digit",
-                        second: "2-digit",
-                        hour12: false,
-                      })}
-                    </span>
-                  ) : (
-                    "-"
-                  )}
+                <div className="text-center text-[11px]">
+                  {(() => {
+                    const stale = quota?.stale;
+                    const displayTime = stale?.since || refreshedAt;
+                    if (!displayTime) return <span className="text-text-muted">-</span>;
+                    const formatted = new Date(displayTime).toLocaleTimeString([], {
+                      hour: "2-digit",
+                      minute: "2-digit",
+                      second: "2-digit",
+                      hour12: false,
+                    });
+                    if (stale) {
+                      return (
+                        <span
+                          className="text-amber-500 cursor-help"
+                          title={t("staleQuotaTooltip")}
+                          aria-label={t("staleQuotaTooltip")}
+                        >
+                          {formatted}
+                        </span>
+                      );
+                    }
+                    return <span className="text-text-muted">{formatted}</span>;
+                  })()}
                </div>

                {/* Actions */}
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
@@ -341,6 +341,9 @@ export function resolvePlanValue(plan, providerSpecificData) {
    psd.subscription,
    psd.tier,
    psd.accountTier,
+    // Claude OAuth bootstrap: rate_limit_tier has the Max 5x/20x multiplier.
+    psd.organizationRateLimitTier,
+    psd.organizationType,
  ];

  for (const candidate of candidates) {
@@ -368,6 +371,29 @@ export function normalizePlanTier(plan) {
    return { key: "unknown", label: "Unknown", variant: "default", rank: 0, raw };
  }

+  // Match Anthropic bootstrap strings (claude_max, default_claude_max_20x, etc.)
+  // before the generic PRO/TEAM checks so underscored values don't fall through.
+  const claudeMatch = upper.match(/CLAUDE_(MAX|PRO|TEAM|ENTERPRISE|FREE)(?:_(\d+X))?/);
+  if (claudeMatch) {
+    const family = claudeMatch[1];
+    const multiplier = claudeMatch[2] ? ` ${claudeMatch[2].toLowerCase()}` : "";
+    if (family === "MAX") {
+      return { key: "ultra", label: `Max${multiplier}`, variant: "success", rank: 4, raw };
+    }
+    if (family === "PRO") {
+      return { key: "pro", label: "Pro", variant: "success", rank: 3, raw };
+    }
+    if (family === "TEAM") {
+      return { key: "team", label: "Team", variant: "info", rank: 6, raw };
+    }
+    if (family === "ENTERPRISE") {
+      return { key: "enterprise", label: "Enterprise", variant: "info", rank: 7, raw };
+    }
+    if (family === "FREE") {
+      return { key: "free", label: "Free", variant: "default", rank: 1, raw };
+    }
+  }
+
  if (upper.includes("PRO+") || upper.includes("PRO PLUS") || upper.includes("PROPLUS")) {
    return { key: "plus", label: "Pro+", variant: "success", rank: 4, raw };
  }
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "استراتيجية التوجيه",
    "routingAdvancedGuideTitle": "توجيه التوجيه المتقدم",
    "routingAdvancedGuideHint1": "استخدمFill First للحصول على الأولوية التي يمكن التنبؤ بها، وRound Robin للعدالة، وP2C لمرونة زمن الاستجابة.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "في انتظار التصريح",
--- a/src/i18n/messages/bg.json
+++ b/src/i18n/messages/bg.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Стратегия за маршрутизиране",
    "routingAdvancedGuideTitle": "Разширено ръководство за маршрутизиране",
    "routingAdvancedGuideHint1": "Използвайте Fill First за предвидим приоритет, Round Robin за справедливост и P2C за устойчивост на забавяне.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Изчакване на разрешение",
--- a/src/i18n/messages/bn.json
+++ b/src/i18n/messages/bn.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/cs.json
+++ b/src/i18n/messages/cs.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} poskytovatel(ů) s aktivním CLI otiskem",
    "enableFingerprintTitle": "Povolit otisk pro {provider}",
    "disableFingerprintTitle": "Zakázat otisk pro {provider}",
+    "forcedFingerprintTitle": "Vždy aktivní pro {provider} — vyžadováno pro bezpečnost OAuth účtu; nelze vypnout.",
+    "forcedFingerprintBadge": "Vyžadováno",
    "routingStrategy": "Strategie směrování",
    "routingAdvancedGuideTitle": "Pokročilé pokyny směrování",
    "routingAdvancedGuideHint1": "Pro předvídatelnou prioritu použijte Fill First, pro spravedlivé rozdělení Round Robin a pro odolnost vůči zpoždění P2C.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Očekávám Autorizaci",
--- a/src/i18n/messages/da.json
+++ b/src/i18n/messages/da.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Rutestrategi",
    "routingAdvancedGuideTitle": "Avanceret rutevejledning",
    "routingAdvancedGuideHint1": "Brug Fill First for forudsigelig prioritet, Round Robin for retfærdighed og P2C for latensmodstandsdygtighed.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Venter på autorisation",
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing-Strategie",
    "routingAdvancedGuideTitle": "Erweiterte Routenführung",
    "routingAdvancedGuideHint1": "Verwenden Sie Fill First für vorhersehbare Priorität, Round Robin für Fairness und P2C für Latenzstabilität.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Warten auf Autorisierung",
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -3355,6 +3355,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -4256,7 +4258,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Estrategia de enrutamiento",
    "routingAdvancedGuideTitle": "Guía de ruta avanzada",
    "routingAdvancedGuideHint1": "Utilice Fill First para una prioridad predecible, Round Robin para equidad y P2C para resistencia a la latencia.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Esperando autorización",
--- a/src/i18n/messages/fa.json
+++ b/src/i18n/messages/fa.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/fi.json
+++ b/src/i18n/messages/fi.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Reititysstrategia",
    "routingAdvancedGuideTitle": "Edistynyt reititysopastus",
    "routingAdvancedGuideHint1": "Käytä Täytä ensin ennustettavaa prioriteettia varten, Round Robinia oikeudenmukaisuuden varmistamiseksi ja P2C:tä latenssin kestävyyteen.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Odotetaan valtuutusta",
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Stratégie de routage",
    "routingAdvancedGuideTitle": "Guidage d'itinéraire avancé",
    "routingAdvancedGuideHint1": "Utilisez Fill First pour une priorité prévisible, Round Robin pour l’équité et P2C pour la résilience en matière de latence.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "En attente d'autorisation",
--- a/src/i18n/messages/gu.json
+++ b/src/i18n/messages/gu.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/he.json
+++ b/src/i18n/messages/he.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "אסטרטגיית ניתוב",
    "routingAdvancedGuideTitle": "הנחיית ניתוב מתקדמת",
    "routingAdvancedGuideHint1": "השתמש ב-Fill First לקבלת עדיפות צפויה, ב-Round Robin להגינות, וב-P2C עבור חוסן חביון.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "ממתין לאישור",
--- a/src/i18n/messages/hi.json
+++ b/src/i18n/messages/hi.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "रूटिंग रणनीति",
    "routingAdvancedGuideTitle": "उन्नत रूटिंग मार्गदर्शन",
    "routingAdvancedGuideHint1": "पूर्वानुमानित प्राथमिकता के लिए फ़िल फ़र्स्ट का उपयोग करें, निष्पक्षता के लिए राउंड रॉबिन और विलंबता लचीलेपन के लिए P2C का उपयोग करें।",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "प्राधिकरण की प्रतीक्षा की जा रही है",
--- a/src/i18n/messages/hu.json
+++ b/src/i18n/messages/hu.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Útválasztási stratégia",
    "routingAdvancedGuideTitle": "Speciális útbaigazítás",
    "routingAdvancedGuideHint1": "Használja a Fill First funkciót a kiszámítható prioritáshoz, a Round Robint a méltányossághoz és a P2C-t a késleltetési rugalmassághoz.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Várakozás az engedélyezésre",
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Strategi Perutean",
    "routingAdvancedGuideTitle": "Panduan perutean tingkat lanjut",
    "routingAdvancedGuideHint1": "Gunakan Fill First untuk prioritas yang dapat diprediksi, Round Robin untuk keadilan, dan P2C untuk ketahanan latensi.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Menunggu Otorisasi",
--- a/src/i18n/messages/in.json
+++ b/src/i18n/messages/in.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Strategia di instradamento",
    "routingAdvancedGuideTitle": "Guida al percorso avanzata",
    "routingAdvancedGuideHint1": "Utilizza Fill First per una priorità prevedibile, Round Robin per l'equità e P2C per la resilienza alla latenza.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "In attesa di autorizzazione",
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "ルーティング戦略",
    "routingAdvancedGuideTitle": "高度なルーティング ガイダンス",
    "routingAdvancedGuideHint1": "予測可能な優先度を得るには Fill First を使用し、公平性を得るにはラウンド ロビンを、レイテンシの回復力を得るには P2C を使用します。",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "承認を待っています",
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "라우팅 전략",
    "routingAdvancedGuideTitle": "고급 경로 안내",
    "routingAdvancedGuideHint1": "예측 가능한 우선순위를 위해서는 Fill First를 사용하고, 공정성을 위해서는 Round Robin을, 지연 시간 복원력을 위해서는 P2C를 사용하세요.",
@@ -3773,7 +3775,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "승인을 기다리는 중",
--- a/src/i18n/messages/mr.json
+++ b/src/i18n/messages/mr.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/ms.json
+++ b/src/i18n/messages/ms.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Strategi Penghalaan",
    "routingAdvancedGuideTitle": "Panduan laluan lanjutan",
    "routingAdvancedGuideHint1": "Gunakan Fill First untuk keutamaan yang boleh diramal, Round Robin untuk keadilan dan P2C untuk daya tahan latensi.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Menunggu Keizinan",
--- a/src/i18n/messages/nl.json
+++ b/src/i18n/messages/nl.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routeringsstrategie",
    "routingAdvancedGuideTitle": "Geavanceerde routebegeleiding",
    "routingAdvancedGuideHint1": "Gebruik Fill First voor voorspelbare prioriteit, Round Robin voor eerlijkheid en P2C voor latency-veerkracht.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Wachten op toestemming",
--- a/src/i18n/messages/no.json
+++ b/src/i18n/messages/no.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Rutingstrategi",
    "routingAdvancedGuideTitle": "Avansert ruteveiledning",
    "routingAdvancedGuideHint1": "Bruk Fill First for forutsigbar prioritet, Round Robin for rettferdighet og P2C for latensmotstandskraft.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Venter på autorisasjon",
--- a/src/i18n/messages/phi.json
+++ b/src/i18n/messages/phi.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Diskarte sa Pagruruta",
    "routingAdvancedGuideTitle": "Gabay sa advanced na pagruruta",
    "routingAdvancedGuideHint1": "Gamitin ang Fill First para sa predictable priority, Round Robin para sa fairness, at P2C para sa latency resilience.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Naghihintay ng Awtorisasyon",
--- a/src/i18n/messages/pl.json
+++ b/src/i18n/messages/pl.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Strategia routingu",
    "routingAdvancedGuideTitle": "Zaawansowane wskazówki dotyczące tras",
    "routingAdvancedGuideHint1": "Użyj opcji Fill First, aby uzyskać przewidywalny priorytet, Round Robin, aby zapewnić uczciwość, i P2C, aby zapewnić odporność na opóźnienia.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Oczekiwanie na autoryzację",
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -3032,6 +3032,8 @@
    "cliFingerprintEnabled": "{count} provider(s) com fingerprint CLI ativo",
    "enableFingerprintTitle": "Ativar fingerprint para {provider}",
    "disableFingerprintTitle": "Desativar fingerprint para {provider}",
+    "forcedFingerprintTitle": "Sempre ativado para {provider} — necessário para a segurança da conta OAuth; não pode ser desativado.",
+    "forcedFingerprintBadge": "Obrigatório",
    "routingStrategy": "Estratégia de Roteamento",
    "routingAdvancedGuideTitle": "Orientação avançada de roteamento",
    "routingAdvancedGuideHint1": "Use Fill First para prioridade previsível, Round Robin para justiça e P2C para resiliência de latência.",
@@ -3941,7 +3943,8 @@
    "cancel": "Cancel",
    "delete": "Delete",
    "save": "Save",
-    "edit": "Edit"
+    "edit": "Edit",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Aguardando Autorização",
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -2962,6 +2962,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Estratégia de Roteamento",
    "routingAdvancedGuideTitle": "Orientação avançada de roteamento",
    "routingAdvancedGuideHint1": "Use Fill First para prioridade previsível, Round Robin para justiça e P2C para resiliência de latência.",
@@ -3858,7 +3860,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Aguardando autorização",
--- a/src/i18n/messages/ro.json
+++ b/src/i18n/messages/ro.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Strategia de rutare",
    "routingAdvancedGuideTitle": "Ghid avansat de rutare",
    "routingAdvancedGuideHint1": "Folosiți Fill First pentru o prioritate previzibilă, Round Robin pentru corectitudine și P2C pentru rezistență la latență.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "În așteptarea autorizației",
--- a/src/i18n/messages/ru.json
+++ b/src/i18n/messages/ru.json
@@ -2944,6 +2944,8 @@
    "cliFingerprintEnabled": "{count} провайдер(ов) с активным CLI-отпечатком",
    "enableFingerprintTitle": "Включить отпечаток для {provider}",
    "disableFingerprintTitle": "Отключить отпечаток для {provider}",
+    "forcedFingerprintTitle": "Всегда включено для {provider} — требуется для безопасности OAuth-аккаунта; отключить нельзя.",
+    "forcedFingerprintBadge": "Обязательно",
    "routingStrategy": "Стратегия маршрутизации",
    "routingAdvancedGuideTitle": "Расширенное руководство по маршрутизации",
    "routingAdvancedGuideHint1": "Используйте «Fill First» для предсказуемого приоритета, Round Robin для обеспечения справедливости и P2C для устойчивости к задержкам.",
@@ -3795,7 +3797,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Ожидание авторизации",
--- a/src/i18n/messages/sk.json
+++ b/src/i18n/messages/sk.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Stratégia smerovania",
    "routingAdvancedGuideTitle": "Pokročilé vedenie trasy",
    "routingAdvancedGuideHint1": "Použite Fill First pre predvídateľnú prioritu, Round Robin pre spravodlivosť a P2C pre odolnosť latencie.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Čaká sa na autorizáciu",
--- a/src/i18n/messages/sv.json
+++ b/src/i18n/messages/sv.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routingstrategi",
    "routingAdvancedGuideTitle": "Avancerad vägledning",
    "routingAdvancedGuideHint1": "Använd Fill First för förutsägbar prioritet, Round Robin för rättvisa och P2C för latensförmåga.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Väntar på auktorisering",
--- a/src/i18n/messages/sw.json
+++ b/src/i18n/messages/sw.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/ta.json
+++ b/src/i18n/messages/ta.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/te.json
+++ b/src/i18n/messages/te.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/th.json
+++ b/src/i18n/messages/th.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "กลยุทธ์การกำหนดเส้นทาง",
    "routingAdvancedGuideTitle": "คำแนะนำการกำหนดเส้นทางขั้นสูง",
    "routingAdvancedGuideHint1": "ใช้ Fill First เพื่อลำดับความสำคัญที่คาดการณ์ได้ Round Robin เพื่อความยุติธรรม และ P2C เพื่อความยืดหยุ่นในการตอบสนอง",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "รอการอนุญาต",
--- a/src/i18n/messages/tr.json
+++ b/src/i18n/messages/tr.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} sağlayıcıda CLI parmak izi etkin",
    "enableFingerprintTitle": "{provider} için parmak izini etkinleştir",
    "disableFingerprintTitle": "{provider} için parmak izini devre dışı bırak",
+    "forcedFingerprintTitle": "{provider} için her zaman etkin — OAuth hesap güvenliği için gerekli; kapatılamaz.",
+    "forcedFingerprintBadge": "Zorunlu",
    "routingStrategy": "Yönlendirme Stratejisi",
    "routingAdvancedGuideTitle": "Gelişmiş yönlendirme rehberliği",
    "routingAdvancedGuideHint1": "Öngörülebilir öncelik için Önce Doldur'u, adil dağılım için Round Robin'i ve gecikme dayanıklılığı için P2C'yi kullanın.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Yetkilendirme bekleniyor",
--- a/src/i18n/messages/uk-UA.json
+++ b/src/i18n/messages/uk-UA.json
@@ -2906,6 +2906,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Стратегія маршрутизації",
    "routingAdvancedGuideTitle": "Розширені вказівки щодо маршрутизації",
    "routingAdvancedGuideHint1": "Використовуйте Fill First для передбачуваного пріоритету, Round Robin для справедливості та P2C для стійкості до затримок.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Очікування авторизації",
--- a/src/i18n/messages/ur.json
+++ b/src/i18n/messages/ur.json
@@ -3093,6 +3093,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Routing Strategy",
    "routingAdvancedGuideTitle": "Advanced routing guidance",
    "routingAdvancedGuideHint1": "Use Fill First for predictable priority, Round Robin for fairness, and P2C for latency resilience.",
@@ -3928,7 +3930,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Waiting for Authorization",
--- a/src/i18n/messages/vi.json
+++ b/src/i18n/messages/vi.json
@@ -2890,6 +2890,8 @@
    "cliFingerprintEnabled": "{count} provider(s) with CLI fingerprint active",
    "enableFingerprintTitle": "Enable fingerprint for {provider}",
    "disableFingerprintTitle": "Disable fingerprint for {provider}",
+    "forcedFingerprintTitle": "Always enabled for {provider} — required for OAuth account safety; cannot be turned off.",
+    "forcedFingerprintBadge": "Required",
    "routingStrategy": "Chiến lược định tuyến",
    "routingAdvancedGuideTitle": "Hướng dẫn định tuyến nâng cao",
    "routingAdvancedGuideHint1": "Sử dụng Fill First để có mức độ ưu tiên có thể dự đoán được, Round Robin để đảm bảo tính công bằng và P2C để có khả năng phục hồi độ trễ.",
@@ -3771,7 +3773,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "Đang chờ cấp phép",
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -3057,6 +3057,8 @@
    "cliFingerprintEnabled": "已有 {count} 个提供商启用了 CLI 指纹",
    "enableFingerprintTitle": "为 {provider} 启用指纹",
    "disableFingerprintTitle": "为 {provider} 禁用指纹",
+    "forcedFingerprintTitle": "{provider} 始终启用 — OAuth 账户安全所必需；无法关闭。",
+    "forcedFingerprintBadge": "必需",
    "routingStrategy": "路由策略",
    "routingAdvancedGuideTitle": "高级路由指南",
    "routingAdvancedGuideHint1": "需要可预测优先级时使用 Fill First，需要公平分配时使用 Round Robin，需要延迟弹性时使用 P2C。",
@@ -3880,7 +3882,8 @@
    "weeklyLimitSummary": "Weekly budget limit summary",
    "suiteBuilderDescriptionLabel": "Description",
    "targetComparisonHint": "Side-by-side comparison of evaluation results between targets.",
-    "compareCompletedWithScore": "Comparison completed — {score}% pass rate"
+    "compareCompletedWithScore": "Comparison completed — {score}% pass rate",
+    "staleQuotaTooltip": "Last refresh failed — showing cached data"
  },
  "modals": {
    "waitingAuth": "等待授权",
--- a/src/lib/usage/providerLimits.ts
+++ b/src/lib/usage/providerLimits.ts
@@ -2,6 +2,7 @@ import {
  getAllProviderLimitsCache,
  getProviderConnectionById,
  getProviderConnections,
+  getProviderLimitsCache,
  getSettings,
  resolveProxyForConnection,
  setProviderLimitsCache,
@@ -43,7 +44,14 @@ interface ProviderConnectionLike {
  backoffLevel?: number;
 }

-const PROVIDER_LIMITS_APIKEY_PROVIDERS = new Set(["glm", "glmt", "minimax", "minimax-cn", "crof", "nanogpt"]);
+const PROVIDER_LIMITS_APIKEY_PROVIDERS = new Set([
+  "glm",
+  "glmt",
+  "minimax",
+  "minimax-cn",
+  "crof",
+  "nanogpt",
+]);
 const DEFAULT_PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES = 70;
 const PROVIDER_LIMITS_AUTO_SYNC_SETTING_KEY = "provider_limits_auto_sync_last_run";

@@ -209,6 +217,43 @@ async function syncClaudeExtraUsageStateIfNeeded(
  };
 }

+/** Persist refreshed Claude bootstrap fields into psd; writes only on diff. */
+async function syncClaudeBootstrapIfNeeded(
+  connection: ProviderConnectionLike,
+  usage: JsonRecord
+): Promise<ProviderConnectionLike> {
+  if (connection.provider !== "claude") return connection;
+  const bootstrap = usage?.bootstrap as Record<string, string | null> | null | undefined;
+  if (!bootstrap || typeof bootstrap !== "object") return connection;
+
+  const psd = (connection.providerSpecificData || {}) as JsonRecord;
+  const mapping: Array<[keyof typeof bootstrap, string]> = [
+    ["account_uuid", "accountUUID"],
+    ["organization_uuid", "organizationUUID"],
+    ["organization_name", "organizationName"],
+    ["organization_type", "organizationType"],
+    ["organization_rate_limit_tier", "organizationRateLimitTier"],
+  ];
+
+  const nextPsd: JsonRecord = { ...psd };
+  let changed = false;
+  for (const [bsKey, psdKey] of mapping) {
+    const next = bootstrap[bsKey];
+    if (typeof next === "string" && next.length > 0 && psd[psdKey] !== next) {
+      nextPsd[psdKey] = next;
+      changed = true;
+    }
+  }
+
+  if (!changed) return connection;
+
+  await updateProviderConnection(connection.id, { providerSpecificData: nextPsd });
+  return {
+    ...connection,
+    providerSpecificData: nextPsd,
+  };
+}
+
 export function getProviderLimitsSyncIntervalMinutes(): number {
  const raw = Number.parseInt(process.env.PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES ?? "", 10);
  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES;
@@ -266,6 +311,7 @@ async function fetchLiveProviderLimitsWithOptions(
    }
    await syncExpiredStatusIfNeeded(connection, usage);
    connection = await syncClaudeExtraUsageStateIfNeeded(connection, usage);
+    connection = await syncClaudeBootstrapIfNeeded(connection, usage);
    return { connection, usage };
  }

@@ -325,6 +371,7 @@ async function fetchLiveProviderLimitsWithOptions(
  }
  await syncExpiredStatusIfNeeded(connection, result.usage);
  connection = await syncClaudeExtraUsageStateIfNeeded(connection, result.usage);
+  connection = await syncClaudeBootstrapIfNeeded(connection, result.usage);

  return {
    connection,
@@ -343,9 +390,33 @@ export async function fetchAndPersistProviderLimits(
  const { connection, usage } = await fetchLiveProviderLimitsWithOptions(connectionId, {
    forceRefresh: source === "manual",
  });
-  const cache = toProviderLimitsCacheEntry(usage, source);
-  setProviderLimitsCache(connectionId, cache);
-  return { connection, usage, cache };
+  const newCache = toProviderLimitsCacheEntry(usage, source);
+
+  // Don't persist error-only entries (429 etc.) — would wipe prior good cache.
+  // Serve the prior entry instead; only successful fetches update the cache.
+  const fetchFailed = !newCache.quotas && newCache.message;
+  if (fetchFailed) {
+    const previous = getProviderLimitsCache(connectionId);
+    if (previous?.quotas && Object.keys(previous.quotas).length > 0) {
+      // utils.tsx parseQuotaData ignores `quotas` if `message` is set — drop
+      // the message so the prior quotas render; surface staleness via _stale.
+      const staleUsage: JsonRecord = {
+        ...usage,
+        quotas: previous.quotas,
+        plan: previous.plan ?? usage.plan ?? null,
+        message: null,
+        _stale: true,
+        _staleSince: previous.fetchedAt,
+        _staleReason: newCache.message,
+      };
+      return { connection, usage: staleUsage, cache: previous };
+    }
+    // No prior cache; pass the error response through without persisting it.
+    return { connection, usage, cache: newCache };
+  }
+
+  setProviderLimitsCache(connectionId, newCache);
+  return { connection, usage, cache: newCache };
 }

 export async function syncAllProviderLimits(
@@ -385,11 +456,19 @@ export async function syncAllProviderLimits(
      if (!connectionId) return;

      if (result.status === "fulfilled") {
-        cacheEntries.push({
-          connectionId: result.value.connectionId,
-          entry: result.value.cache,
-        });
-        caches[result.value.connectionId] = result.value.cache;
+        const { cache } = result.value;
+        // Don't persist error-only entries; show prior cache or pass through.
+        if (!cache.quotas && cache.message) {
+          const previous = getProviderLimitsCache(connectionId);
+          if (previous?.quotas && Object.keys(previous.quotas).length > 0) {
+            caches[connectionId] = previous;
+          } else {
+            caches[connectionId] = cache;
+          }
+          return;
+        }
+        cacheEntries.push({ connectionId, entry: cache });
+        caches[connectionId] = cache;
        return;
      }