fix(codex): self-heal Spark-contaminated account quotas

Keep model-scoped Spark windows out of account state, preserve authoritative WHAM exhaustion flags, and repair historical cross-family quota generations without weakening stale-response guards.

apps/aether-gateway/src/orchestration/codex_quota_breaker.rs

@@ -167,17 +167,43 @@ fn codex_quota_breaker_ttl(quota_metadata: &Value, now_unix_secs: u64) -> (u64,
 pub(crate) fn codex_quota_exhaustion_reset_at(
     quota_metadata: &Value,
     now_unix_secs: u64,
+) -> Option<u64> {
+    codex_quota_exhaustion_reset_at_for_prefixes(
+        quota_metadata,
+        now_unix_secs,
+        &["primary", "secondary"],
+    )
+}
+
+/// Returns the reset deadline for an exhausted model-scoped Codex window without promoting that
+/// window to account-wide exhaustion.
+pub(crate) fn codex_model_quota_exhaustion_reset_at(
+    quota_metadata: &Value,
+    now_unix_secs: u64,
+) -> Option<u64> {
+    codex_quota_exhaustion_reset_at_for_prefixes(
+        quota_metadata,
+        now_unix_secs,
+        &["spark_primary", "spark_secondary"],
+    )
+}
+
+fn codex_quota_exhaustion_reset_at_for_prefixes(
+    quota_metadata: &Value,
+    now_unix_secs: u64,
+    window_prefixes: &[&str],
 ) -> Option<u64> {
     let Some(metadata) = quota_metadata.as_object() else {
         return None;
     };
 
-    let exhausted_windows = ["primary", "secondary"]
-        .into_iter()
+    let exhausted_windows = window_prefixes
+        .iter()
+        .copied()
         .filter(|prefix| codex_window_is_exhausted(metadata, prefix))
         .collect::<Vec<_>>();
     let prefixes = if exhausted_windows.is_empty() {
-        vec!["primary", "secondary"]
+        window_prefixes.to_vec()
     } else {
         exhausted_windows
     };

apps/aether-gateway/src/orchestration/mod.rs

@@ -34,9 +34,10 @@ pub(crate) use self::classifier::{
     LocalTransportFailoverClassification,
 };
 pub(crate) use self::codex_quota_breaker::{
-    codex_account_id_from_headers, codex_quota_breaker_blocks_candidate,
-    codex_quota_exhaustion_reset_at, install_codex_quota_exhaustion_breaker,
-    log_codex_quota_breaker_check_failure, log_codex_quota_breaker_install_failure,
+    codex_account_id_from_headers, codex_model_quota_exhaustion_reset_at,
+    codex_quota_breaker_blocks_candidate, codex_quota_exhaustion_reset_at,
+    install_codex_quota_exhaustion_breaker, log_codex_quota_breaker_check_failure,
+    log_codex_quota_breaker_install_failure,
 };
 pub(crate) use self::effects::{
     apply_local_execution_effect, apply_local_stream_failure_effects,