OAuth Max 20x: bare 429 rate_limit_error on premium models without the Claude Code system block first — entitlement gate, not quota; headerless 429 indistinguishable from pushback

Root cause (verified 17/08/2026, 5/5 alternating trials)

This is NOT a quota issue and NOT a provider outage. Anthropic's OAuth subscription entitlement gate refuses premium-model (claude-opus-5, claude-sonnet-5, etc.) inference unless the FIRST system block is verbatim:

You are Claude Code, Anthropic's official CLI for Claude.

Refusal = 429 {"type":"error","error":{"type":"rate_limit_error","message":"Error"}} with no anthropic-ratelimit-unified-* headers and no Retry-After. claude-haiku-4-5 is exempt from the gate (200 regardless of system), which is why a "premium-model shed" was misread.

Measured discriminator (same token, same IP, seconds apart — only system varying)

| Request shape | Result |
|---|---|
| no system block | 429 headerless |
| CC block first (array) | 200 + unified headers |
| CC block first + extra blocks after | 200 |
| CC block present but SECOND | 429 headerless |
| CC block as plain string | 200 |
| haiku, no system block | 200 |

anthropic-beta: oauth-2025-04-20 present or absent → no difference.

Reproduce

TOK=$(jq -r .claudeAiOauth.accessToken ~/.claude/.credentials.json)
# 429
curl -q -sS https://api.anthropic.com/v1/messages \
  -H "authorization: Bearer $TOK" -H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
  -d '{"model":"claude-opus-5","max_tokens":1,"messages":[{"role":"user","content":"hi"}]}'
# 200
curl -q -sS https://api.anthropic.com/v1/messages \
  -H "authorization: Bearer $TOK" -H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
  -d '{"model":"claude-opus-5","max_tokens":1,"system":[{"type":"text","text":"You are Claude Code, Anthropic'"'"'s official CLI for Claude."}],"messages":[{"role":"user","content":"hi"}]}'

The actionable complaint for Anthropic

The headerless 429 makes the entitlement refusal indistinguishable from real quota pushback: no retry-after, no anthropic-ratelimit-unified-* headers, message just "Error". Downstream clients (throttle proxies, orchestrators, raw SDK callers) cannot tell "your request is missing the entitlement marker" from "slow down" — so a probe without the system block is misread as budget pressure and triggers AIMD shrink / synthetic pauses on healthy allowed_warning accounts. This caused a cascade on the reporter's fleet (17/08): 3 system-block-less probes through the proxy → 429 → 2×30s synthetic pause → max_concurrent 5→1 on two accounts that were serving 200s.

Requested: either (a) include the unified/entitlement headers or a distinct error type on shape-gated 429s, or (b) document the gate so clients can carry the required system block.