[patrykkopycinski]

What this fixes

Two independent root causes of the Anthropic 400 messages.N.content.K: "thinking" or "redacted_thinking" blocks in the latest assistant message cannot be modified on multi-turn conversations routed through OmniRoute (#17324). Both were verified live against the Anthropic API before fixing. Stacked on #17344 — the first two commits are that PR's recovery work rebased onto current main; the last three are this PR's root-cause fixes.

Cause 1 — fabricated redacted_thinking placeholder on adaptive-thinking replays

The #5312 placeholder (a fixed DEFAULT_THINKING_CLAUDE_SIGNATURE blob) was injected for any reasoning_content + tool_use turn with thinking enabled — including adaptive thinking. Anthropic's prompt cache holds the genuine signed blocks for those tool_use ids; a fabricated blob mismatches and the whole request 400s.

Fix: inject only for manual budget thinking (thinking.type === "enabled"); adaptive omits it entirely. Verified live: the identical body 400s with the blob inside the cache window and passes without it, and a tool_use turn with no thinking block at all is accepted under thinking: adaptive — so omission is safe. Recovery paths likewise drop rejected/store-restored blocks without re-injecting the placeholder; the remaining tool_use turn is a valid request shape.

Cause 2 — thinking store replayed signed blocks across OAuth orgs

The signed-thinking continuity store keyed entries by provider + model only. A combo that load-balances one model across two Claude Max OAuth orgs restores org-A-signed blocks onto org-B connections; Anthropic verifies block integrity against the producing org and rejects the request — failing both legs once each carries a foreign-org turn.

Fix: bind store entries to the serving connection id — capture side (initTranslateStreamState raw connectionId + non-streaming provider leg), restore side (translateRequest threads signatureNamespace as _connectionId into thinkingBinding). A cross-connection restore becomes a cache miss → block omitted → request passes (adaptive-safe per the cause-1 finding).

Diagnostics follow-up

shouldEmitThinkingSignatureDiagnostics (#15534) only matched the invalid-signature variant, so this 400 class emitted no structural facts for post-mortems. The gate now also matches Anthropic's canonical "cannot be modified" phrasing — deliberately strict so generic 400s do not over-match — with the same allowlist-only scalar shape (no signature/thinking/header values, sentinel-enforced by tests).

Verification

• Live probes on both OAuth legs: producer turn on connection A, replay forced onto connection B → before: 400 on both legs; after: 200, tool_use-only outbound turn
• 62/62 across claude-thinking-continuity, anthropic-thinking-modified-recovery/-review-17344, anthropic-thinking-signature-recovery, thinking-signature-diagnostics-15534 (+ chatcore wiring), diagnostics-claude-thinking-5108, openai-to-claude-redacted-replay-5312 — including new cross-connection and canonical-phrase regressions
• Post-deploy on a production-traffic gateway: 0 recurrence across ~2,370 calls in 12h+

Fixes #17324

[patrykkopycinski]

Follow-up: the 400 reappeared on a live deployment of the v3.8.53 line carrying this PR's earlier fixes, on claude-opus-5-5 (adaptive-only thinking). Correlated diagnostics showed the ingress request carrying zero thinking blocks, the outbound body gaining +3 redacted_thinking, and recoveryAttempted:false — four gaps survived the earlier rounds:

1. Restore gate too broad (openai-to-claude.ts): stored signed blocks were replayed for adaptive-only models whenever a later request held a tool_result turn for them. Adaptive thinking accepts a tool_use turn with no thinking precursor, so restoring blocks there breaks warm-cache block-equality whenever the restore hits/misses differently than the turn that warmed the cache (TTL, eviction, completed-turn rewrite). Restore is now gated to manual extended thinking (thinking.type === "enabled"), the same gate as the [BUG] Claude adaptive-thinking corrupts tool calls & leaks </think> on Cursor/OpenAI path; Thinking Budget UI is a no-op #5312 placeholder — consistent with 2643ede's split between the two modes.
2. Unbound captures were accepted (claudeThinkingStore.ts): entries stored without a connectionId could later match any equally-unbound restore ("" === ""), inviting cross-org replay. Capture now refuses unbound provenance at store time.
3. Modified-recovery swept only the latest assistant turn (passthroughHelpers.ts): Anthropic flags the modified message by cache warmth, not recency — live 400s pointed at messages.1/messages.3 while the latest assistant message was clean, so the strip no-oped and the request failed through unrecovered. The sweep now drops store-restored blocks from every assistant turn; manual-thinking tool_use turns keep the [BUG] Claude adaptive-thinking corrupts tool calls & leaks </think> on Cursor/OpenAI path; Thinking Budget UI is a no-op #5312 placeholder (mirrors 2643ede's keepToolUsePlaceholder semantics).
4. Diagnostics missed redacted_thinking (thinkingSignatureDiagnostics.ts): collectSignatures counted only thinking.signature, hiding half the signed-block population from the before/after diff. It now also counts redacted_thinking.data (counts only — no content is logged).

Coverage: new red-first suite thinking-modified-recovery-recurrence.test.ts reproduces all four failure modes; 95/95 across the 12 affected and guard suites on this branch head (dc5d586), including 2643ede's manual-mode tests. Sustained zero cannot be modified events on the live deployment since the same fixes were rolled out there.