[maxmad64bis]

⚠️ base-red inherited: #15306

Summary

opencode-zen now joins the egress-IP lockout by default (opencode, opencode-go and opencode-cli before; the four family members now), so a quota 429 cools the accounts on that address instead of letting zen re-serve a failed egress, and paid setups keep the OMNIROUTE_EGRESS_IP_LOCK_PROVIDERS=none escape. Body-text error rules also reach the opencode family and cloudflare-ai now, so a monthly-quota or daily-allocation 429 reports quota_exhausted with its announced cooldown instead of a generic short rate_limit. Users saw repeated retries against an exhausted quota; now the verdict and its scope match what the catalog rules declare.

Related Issues

• No linked issue — reproduced on the release base

Target Branch

• Base is the active release/v3.8.x branch (the highest open release/v*), not main
• New feature? From 3.8.55 on it is held with the v4-feature label for the v4 channel

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/egress-lock-allowlist-10880.test.ts — asserts opencode-zen is in the egress lock scope; exclusivity for other providers is unchanged.
• tests/unit/egress-ip-lock-env-override.test.ts — the unset and blank defaults now list 4 members; none and explicit lists are unchanged.
• tests/unit/proxy-outcome-memory.test.ts — zen moved in-scope with a mirror case that skips the refused member.
• tests/unit/pool-ip-quota-429-path.test.ts — a zen 429 now skips the pool member; openai takes the out-of-scope role.
• tests/unit/opencode-429-pool-reselect.test.ts — a zen 429 now reselects; openai takes the out-of-list role.
• tests/unit/agentrouter-error-rules.test.ts — opencode body markers now yield quota_exhausted with connection scope; the cloudflare-ai daily case is added.
• tests/unit/opencode-400-model-unavailable.test.ts — quota-body markers now yield quota_exhausted with honored scope.
• tests/unit/egress-ip-lock-10880.test.ts — comment updated to the 4-member set; added zen case with one upstream call and a cooled sibling.

Coverage Notes

• open-sse/config/providerErrorRules.ts is covered by tests/unit/egress-lock-allowlist-10880.test.ts, tests/unit/egress-ip-lock-env-override.test.ts and tests/unit/agentrouter-error-rules.test.ts.

Reviewer Notes

• Behavior: a monthly usage limit body still meets the subscription-text fallback before the catalog rule, so that one path reports its 13-day cooldown without the rule scope.
• Follow-up: a direct rule-match test of the 13-day cooldown belongs in a later change. The leftover test-title prefixes want the same cleanup the renamed titles got.
• Merge: either order with fix(monitoring): log event-loop stalls with counter on health #15888, fix(monitoring): warn once on unusable stall sampler reading #15978, feat(models-health): report whether reasoning_effort none was honored per model #16253, perf(cache): serve the usage-history part of the cache page from the shared response cache #16361, fix(opencode): follow the published endpoint and the client's own headers #16608, fix(opencode): route each key-based model to the endpoint the published catalog declares #16798.