Java also exercises the opt-in `shutdown-error` mode. It rejects

`runtime.shutdown`, writes `<cleanup-marker>.eof` when stdin closes, and holds

cleanup-marker creation and process exit until the test creates

`<cleanup-marker>.release`. This handshake verifies that a failed shutdown RPC

still allows EOF-driven finalization before forced cleanup.

| Session-owned provider quota observations | `session.quota.get` and `session.quota.refresh` | Session | RPC |

| Provider admission-state updates | `session.quota_observation` | Session | Event |

`session.quota.get` reads local runtime state; `session.quota.refresh` refreshes the provider catalogs and quota sources. Both return `providerQuotas`, keyed by provider identity, quota ID, and observation kind. The runtime keeps one observation store. The legacy `snapshots` field is a derived compatibility view of authoritative budgets, not a second source of quota state.

Provider cardinality is an emergent property of actual usage and observations supplied to the seam. This API neither knows nor enforces how many providers a user may use: it records and projects zero, one, or many entries identically. Producers supply stable provider/account-scoped references; usage adds model identity, and quota adds quota identity and observation kind. `get()` returns the full known collection, so callers can select an exact key, a subset, or all entries without provider-specific methods. Acquisition uses the sources supplied by the upstream account/model layer; it does not manufacture a union or impose a selected-provider filter on reads.

Check `observationKind`, `quantityKind`, and `acquisitionStatus` before interpreting a reading. An `authoritative_budget` can supply progress and reset metadata. An `advisory_balance` reports independent signed 64-bit quantities without promising a percentage, reset window, or post-call balance. An `admission_state` reports permission/capacity at request admission and carries no quantities; it does not replace an account balance. Preserve missing values and explicit nulls rather than converting them to zero. A failed or unavailable acquisition is not quota exhaustion.

For Microsoft 365 Copilot, access and capacity are service verdicts, while quantities are advisory. For example, `allowed`/`available` with both quantities explicitly zero means **0 / 0 AIC reported**, not 100% consumed or inconsistent state. A missing entitlement is different from a zero entitlement. The `-1` entitlement sentinel means unlimited entitlement without changing the reported capacity state. Inference headers can reflect cached admission state; neither those headers nor an on-demand quota refresh establish the charge for the preceding call.

Usage totals belong to a session, not the active account. In the CLI, switching away from a non-empty Microsoft 365 Copilot session requires starting a new session. The previous session retains its usage and history for resume; the new session starts its own totals.

Closing a session stops subscribed event delivery, drops queued events, and releases

subscriptions without waiting for handlers already admitted for dispatch. Pending `SendAndWaitAsync`

operations fail with `IOException` if the session closes before their final response arrives.

Stops session event dispatch and releases queued events and subscriptions. A handler already

admitted for dispatch may finish; shutdown does not wait for it. Pending `SendAndWaitAsync` operations fail

with `IOException` if the session closes before their final response arrives.

The SDK releases its references to later handlers' captured objects even if an admitted handler remains blocked.

Local retirement also releases tool, command, hook, auth/input, provider, canvas,

and transform registrations, without changing caller-owned configuration or joining

callbacks already admitted. Registration and callback lookup share a retirement fence;

late accepted tool replacements cannot restore handlers. Ordinary disposal retains

hook callbacks through the detach response and performs local retirement in `finally`.

Both stop methods close session admission before taking the session snapshot. Concurrent

create/resume setup on that connection is rejected and retired locally; restarting the

client opens admission only for the new connection.

Cleanup of a rejected cloud creation stays on its original connection and cannot

restart the client during shutdown.

Use the experimental request-object overload to select the `modelId` and `providerId` from a model catalog entry:

using GitHub.Copilot.Rpc;

#pragma warning disable GHCP001 // Provider-qualified model selection is experimental.

await session.Rpc.Model.SwitchToAsync(new ModelSwitchToRequest

{

ModelId = modelId,

ProviderId = providerId,

});

#pragma warning restore GHCP001

The SDK supplies the session ID. Existing positional calls, including `session.Rpc.Model.SwitchToAsync("auto", AutoTier.Balance)`, retain their original parameter order and defaults.

private readonly object _sessionAdmissionLock = new();

private bool _sessionAdmissionClosed;

lock (_sessionAdmissionLock)

{

if (_connectionTask is null)

{

_sessionAdmissionClosed = false;

}

return _connectionTask ??= StartCoreAsync(cancellationToken);

}

var sessions = CloseSessionAdmission(clearSessions: false);

CancelPendingExternalTools(sessions);

foreach (var session in sessions)

/// <item>Stops session event delivery without waiting for running handlers</item>

var sessions = CloseSessionAdmission(clearSessions: true);

CancelPendingExternalTools(sessions);

foreach (var session in sessions)

{

session.Retire();

}

private CopilotSession[] CloseSessionAdmission(bool clearSessions)

{

lock (_sessionAdmissionLock)

{

_sessionAdmissionClosed = true;

var sessions = _sessions.Values.ToArray();

if (clearSessions)

{

_sessions.Clear();

}

return sessions;

}

}

Task<Connection>? connectionTask;

lock (_sessionAdmissionLock)

{

connectionTask = _connectionTask;

_connectionTask = null;

}

RegisterSession(session, rpc);

var deletion = await InvokeRpcAsync<DeleteSessionResponse>(

connection.Rpc, "session.delete", [new DeleteSessionRequest(serverAssignedSessionId)],

cleanupTimeout.Token).ConfigureAwait(false);

if (!deletion.Success)

{

throw new InvalidOperationException($"Failed to delete session {serverAssignedSessionId}: {deletion.Error}");

}

session.SetSessionFsHandler(provider);

private void CancelPendingExternalTools(IEnumerable<CopilotSession>? sessions = null)

foreach (var session in sessions ?? _sessions.Values)

private void RegisterSession(CopilotSession session, JsonRpc rpc)

Exception error;

lock (_sessionAdmissionLock)

// A restarted connection must not admit setup that began on the stopped transport.

if (!_sessionAdmissionClosed

&& _connectionTask?.Status == System.Threading.Tasks.TaskStatus.RanToCompletion

&& ReferenceEquals(_connectionTask.Result.Rpc, rpc))

{

if (_sessions.TryAdd(session.SessionId, session))

{

return;

}

error = new InvalidOperationException($"Session '{session.SessionId}' is already tracked by this client.");

}

else

{

error = new IOException("Cannot register a session on a stopped connection.");

}

session.Retire();

throw error;