@bitkyc08/opencodex 2.30.0-preview.20260821 → 2.31.0

package/src/server/responses/compact.ts

@@ -461,7 +461,6 @@ export async function handleResponsesCompact(
       }
       compactHostAdmissionLease = null;
     };
-    const compactThreadId = req.headers.get("x-codex-parent-thread-id");
     const connectMs = config.connectTimeoutMs ?? 200_000;
     // Takes its context explicitly: the alternate-account flow below records a rejection
     // against A while promoting B, then records B's own outcome. A closure over a single
@@ -478,7 +477,7 @@ export async function handleResponsesCompact(
       if (!usesCodexForwardPoolAuth(ctx, route.provider)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
-        threadId: compactThreadId,
+        threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
         fixedAccount: ctx.fixedAccount,
         modelId: selectedModelId,
         probeLeaseId: codexProbeLeaseId(ctx),

package/src/server/responses/core.ts

@@ -111,6 +111,7 @@ import { describeImagesInPlace, isModelTextOnly, planVisionSidecar, resolveOpenA
 import { createAdapterEventQueue, preflightAdapterEvents, type AdapterEventQueue } from "../../adapters/run-turn-queue";
 import {
   applyCodexAuthContextToProvider,
+  codexPoolAffinityKey,
   CodexAccountCooldownError,
   codexMainProfileDrainingResponse,
   cooldownErrorResponse,
@@ -139,6 +140,7 @@ import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-m
 import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import {
   computeQuotaCooldown,
+  codexQuotaScopeForModel,
   formatCodexProviderForLog,
   previewCodexAccountForRequest,
   recordCodexUpstreamOutcome,
@@ -328,11 +330,10 @@ export function adapterNeedsForcedContinuation(name: string): boolean {
 export function sidecarOutcomeRecorder(
   config: OcxConfig,
   authCtx: CodexAuthContext,
-  threadId?: string | null,
 ): ((outcome: CodexUpstreamOutcome) => void) | undefined {
   return authCtx.kind === "pool" || authCtx.kind === "main-pool"
     ? outcome => recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
-      threadId,
+      threadId: authCtx.affinityKey,
       fixedAccount: authCtx.fixedAccount,
       probeLeaseId: authCtx.probeLeaseId,
       probeQuotaScope: authCtx.probeQuotaScope,
@@ -946,7 +947,7 @@ async function retryCodexPoolOnAlternateAccount(
   const recordFirstOutcome = (): void => {
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
-      threadId: req.headers.get("x-codex-parent-thread-id"),
+      threadId: firstAuthCtx.affinityKey,
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
       probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
@@ -1081,7 +1082,6 @@ export function codexForwardTerminalOutcomeRecorder(
   provider: OcxProviderConfig,
   modelId?: string,
   logCtx?: RequestLogContext,
-  threadId?: string | null,
 ): ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined {
   if (!usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
   return (status, httpStatusOverride) => {
@@ -1090,7 +1090,7 @@ export function codexForwardTerminalOutcomeRecorder(
       // request. Don't penalize account health; record success to clear any
       // prior soft-avoid so a healthy account isn't stuck avoided.
       recordCodexUpstreamOutcome(config, authCtx.accountId, 200, {
-        threadId,
+        threadId: authCtx.affinityKey,
         fixedAccount: authCtx.fixedAccount,
         modelId,
         probeLeaseId: codexProbeLeaseId(authCtx),
@@ -1112,7 +1112,7 @@ export function codexForwardTerminalOutcomeRecorder(
       ? 200
       : (httpStatusOverride ?? logCtx?.terminalHttpStatus ?? 502);
     recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
-      threadId,
+      threadId: authCtx.affinityKey,
       fixedAccount: authCtx.fixedAccount,
       modelId,
       probeLeaseId: codexProbeLeaseId(authCtx),
@@ -1227,6 +1227,15 @@ export interface HandleResponsesOptions {
   onConsumedComboFailure?: (failure: ConsumedComboFailure) => void;
   /** Caller-owned for Chat/Claude replay; omitted only at genuine Responses ingress. */
   translatorBudget?: TranslatorBudget;
+  /**
+   * Terminal vision-describe marker (roadmap 180): true when the inbound
+   * request IS the vision sidecar's own loopback describe call. The plan site
+   * then STRIPS images instead of planning another describe — a depth cap of 1
+   * that holds under predicate drift and combo re-resolution. The Chat surface
+   * detects the raw `x-opencodex-vision-describe` header before its bridge
+   * rebuilds headers and carries the fact through this flag.
+   */
+  visionDescribeTerminal?: boolean;
 }
 
 
@@ -2177,6 +2186,27 @@ async function handleResponsesInner(
     if (inboundClientThreadId) {
       parsed._clientThreadId = inboundClientThreadId;
       parsed._reasoningReplayScope = { clientThreadId: inboundClientThreadId };
+    } else if (
+      options.inboundWire === "anthropic"
+      && options.promptCacheKeyIsSharedCohort !== true
+      && typeof parsed.options.promptCacheKey === "string"
+      && parsed.options.promptCacheKey.trim().length > 0
+    ) {
+      // Claude Code has no Codex parent-thread header, but its metadata.user_id is
+      // translated into a stable per-session prompt_cache_key. Use it as the replay
+      // thread identity so Gemini thought signatures are remembered by call_id for
+      // Anthropic Messages clients too (#1735/#1926). Keep `_clientThreadId` unset so
+      // existing provider session-id derivation (first-user-text fallback) is unchanged.
+      // Normalize through anthropicSessionKeyFromParts so overlong keys are hashed and
+      // trimming matches the affinity/session-key path exactly (no raw >128-char ids).
+      const normalizedCacheKey = anthropicSessionKeyFromParts({
+        promptCacheKey: parsed.options.promptCacheKey,
+        // The enclosing branch already proves this is not the shared cohort.
+        promptCacheKeyIsSharedCohort: false,
+      });
+      if (normalizedCacheKey) {
+        parsed._reasoningReplayScope = { clientThreadId: normalizedCacheKey };
+      }
     }
   } catch (err) {
     if (isTranslatorBudgetExceededError(err)) {
@@ -2278,6 +2308,7 @@ async function handleResponsesInner(
   let subagentFallbackPreviewAccountId: string | null | undefined;
   let subagentQuotaFailureModel = parsed.modelId;
   const parentThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() ?? null;
+  const poolAffinityKey = codexPoolAffinityKey(req.headers) ?? null;
 
   try {
     if (
@@ -2293,12 +2324,15 @@ async function handleResponsesInner(
   // Preview the preferred Codex account without acquiring a probe lease or refreshing
   // tokens — auth is resolved only after the final route is selected.
   if (threadSpawn && !options.comboAttempt && route.codexAccountId === undefined) {
-    const threadId = req.headers.get("x-codex-parent-thread-id");
+    // The final resolveCodexAuthContext binds under codexQuotaScopeForModel(route.modelId),
+    // so the preview must read the same scope slot — an undefined scope would map to the
+    // "legacy" affinity bucket and never find a binding made under "shared" or a native
+    // model scope, making the preview diverge from the account that actually authenticates.
     const previewAccountId = previewCodexAccountForRequest(
-      threadId,
+      poolAffinityKey,
       config,
       Date.now(),
-      undefined,
+      codexQuotaScopeForModel(route.modelId),
       previewSelectionOptions,
     );
     subagentFallbackPreviewAccountId = previewAccountId;
@@ -2725,7 +2759,15 @@ async function handleResponsesInner(
   // Vision sidecar: the routed model can't see images (provider.noVisionModels). Describe each
   // attached image through the selected sidecar backend and replace it with text BEFORE the main
   // call, so the text-only model can reason about it.
-  const visionPlan = planVisionSidecar(config, route.provider, route.modelId, parsed, openAiSidecar);
+  // Terminal describe fence (roadmap 180): the sidecar's OWN loopback describe
+  // call must never plan another describe. The flag arrives from the Chat
+  // surface (whose bridge rebuilds headers) or as the raw header for native
+  // Responses callers. Marked + text-only routed model → strip, depth cap 1.
+  const visionDescribeTerminal = options.visionDescribeTerminal === true
+    || req.headers.get("x-opencodex-vision-describe") === "1";
+  const visionPlan = visionDescribeTerminal
+    ? undefined
+    : planVisionSidecar(config, route.provider, route.modelId, parsed, openAiSidecar);
   const recordSidecarOutcome = openAiSidecar?.recordOutcome;
   if (visionPlan) {
     await describeImagesInPlace(
@@ -3005,7 +3047,7 @@ async function handleResponsesInner(
       }
       if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
         recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
-          threadId: req.headers.get("x-codex-parent-thread-id"),
+          threadId: authCtx.affinityKey,
           fixedAccount: authCtx.fixedAccount,
           modelId: route.modelId,
           probeLeaseId: codexProbeLeaseId(authCtx),
@@ -3388,7 +3430,6 @@ async function handleResponsesInner(
       route.provider,
       route.modelId,
       logCtx,
-      req.headers.get("x-codex-parent-thread-id"),
     );
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;
     // Capture quota from upstream response for multi-account tracking
@@ -3429,7 +3470,7 @@ async function handleResponsesInner(
       )) {
         recordCodexUpstreamOutcome(config, authCtx.accountId, upstreamResponse.status, {
           ...quotaMeta,
-          threadId: req.headers.get("x-codex-parent-thread-id"),
+          threadId: authCtx.affinityKey,
           fixedAccount: authCtx.fixedAccount,
           modelId: route.modelId,
           probeLeaseId: codexProbeLeaseId(authCtx),

package/src/service.ts

@@ -3274,6 +3274,7 @@ export async function serviceStatusReport(
 }
 
 export function normalizeServiceSubcommand(sub?: string): string {
+  if (sub === "restart") return "repair";
   return sub ?? "install";
 }
 
@@ -3283,6 +3284,119 @@ export interface ParsedServiceArgs {
   invalid: string[];
 }
 
+export type ServiceInstallationState = "installed" | "absent" | "unknown";
+
+export interface ServiceInstallationProbe {
+  state: ServiceInstallationState;
+  detail?: string;
+}
+
+export interface ServiceInstallationProbeHooks {
+  platform?: NodeJS.Platform;
+  exists?: (path: string) => boolean;
+  probeWindowsTask?: () => WindowsSchedulerTaskProbe;
+  nativeStatus?: () => WinswStatus;
+}
+
+/**
+ * Read only enough registration state to choose between install and repair.
+ * Windows must keep query failure distinct from proven absence: treating an
+ * unreadable scheduler/SCM as absent would send a bare command into the
+ * elevated registration path and recreate the original #2287 failure.
+ */
+export function probeServiceInstallation(
+  hooks: ServiceInstallationProbeHooks = {},
+): ServiceInstallationProbe {
+  const platform = hooks.platform ?? process.platform;
+  const exists = hooks.exists ?? existsSync;
+  if (platform === "darwin") {
+    return { state: exists(plistPath()) ? "installed" : "absent" };
+  }
+  if (platform === "linux") {
+    return { state: exists(unitPath()) ? "installed" : "absent" };
+  }
+  if (platform !== "win32") return { state: "absent" };
+
+  let scheduler: WindowsSchedulerTaskProbe;
+  try {
+    scheduler = (hooks.probeWindowsTask ?? probeWindowsSchedulerTask)();
+  } catch (cause) {
+    scheduler = { status: "unknown", detail: schtasksErrorDetail(cause) };
+  }
+  let native: WinswStatus;
+  try {
+    native = (hooks.nativeStatus ?? statusWinswRaw)();
+  } catch {
+    native = "unknown";
+  }
+
+  if (scheduler.status === "present" || native === "started" || native === "stopped") {
+    return { state: "installed" };
+  }
+  if (scheduler.status === "unknown" || native === "unknown") {
+    const parts = [
+      scheduler.status === "unknown" ? `Task Scheduler: ${scheduler.detail}` : null,
+      native === "unknown" ? "WinSW status could not be determined" : null,
+    ].filter((part): part is string => Boolean(part));
+    return { state: "unknown", detail: parts.join("; ") };
+  }
+  return { state: "absent" };
+}
+
+/**
+ * A bare invocation is an idempotent "make the installed service current"
+ * operation. First-time setup still installs, but an existing registration must
+ * use the repair path so Windows does not re-run the elevated `schtasks /create`.
+ * Backend flags remain an explicit install request because they select which
+ * registration mechanism to create.
+ */
+export function selectServiceSubcommand(
+  parsed: ParsedServiceArgs,
+  options: { hasExplicitSubcommand: boolean; installed: boolean },
+): string {
+  if (!options.hasExplicitSubcommand && parsed.backend === null && options.installed) return "repair";
+  return parsed.sub;
+}
+
+export type ServiceCommandPlan =
+  | { ok: true; parsed: ParsedServiceArgs; command: string }
+  | { ok: false; message: string };
+
+export function planServiceCommand(
+  args: string[],
+  options: { platform?: NodeJS.Platform; probeInstallation?: () => ServiceInstallationProbe } = {},
+): ServiceCommandPlan {
+  const parsed = parseServiceArgs(args);
+  if (parsed.invalid.length > 0) {
+    return { ok: false, message: `Unknown service option: ${parsed.invalid.join(" ")}` };
+  }
+  if (parsed.backend && parsed.sub !== "install") {
+    return { ok: false, message: "--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend." };
+  }
+  if (parsed.backend === "native" && (options.platform ?? process.platform) !== "win32") {
+    return { ok: false, message: "--native (WinSW) is Windows-only." };
+  }
+
+  const hasExplicitSubcommand = args.some(arg => !arg.startsWith("--"));
+  let installed = false;
+  if (!hasExplicitSubcommand && parsed.backend === null) {
+    const probe = (options.probeInstallation ?? probeServiceInstallation)();
+    if (probe.state === "unknown") {
+      const suffix = probe.detail ? ` (${probe.detail})` : "";
+      return {
+        ok: false,
+        message: `Could not safely determine whether the service is installed${suffix}. Run 'ocx service status' and retry; use explicit 'ocx service install' only after confirming it is absent.`,
+      };
+    }
+    installed = probe.state === "installed";
+  }
+  return {
+    ok: true,
+    parsed,
+    command: selectServiceSubcommand(parsed, { hasExplicitSubcommand, installed }),
+  };
+}
+
 /**
  * `ocx service [sub] [--native|--scheduler]`. The first non-flag token is the
  * subcommand; backend flags are only meaningful for `install` (validated by the caller).
@@ -3308,20 +3422,13 @@ export function parseServiceArgs(args: string[]): ParsedServiceArgs {
 }
 
 export async function serviceCommand(...args: (string | undefined)[]): Promise<void> {
-  const parsed = parseServiceArgs(args.filter((a): a is string => Boolean(a)));
-  const command = parsed.sub;
-  if (parsed.invalid.length > 0) {
-    console.error(`Unknown service option: ${parsed.invalid.join(" ")}`);
-    process.exit(1);
-  }
-  if (parsed.backend && command !== "install") {
-    console.error("--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend.");
-    process.exit(1);
-  }
-  if (parsed.backend === "native" && process.platform !== "win32") {
-    console.error("--native (WinSW) is Windows-only.");
+  const filteredArgs = args.filter((a): a is string => Boolean(a));
+  const plan = planServiceCommand(filteredArgs);
+  if (!plan.ok) {
+    console.error(plan.message);
     process.exit(1);
   }
+  const { parsed, command } = plan;
   if (command === "repair") {
     assertServiceEnvironmentMatchesInstall();
     assertServiceAuthEnvironment();
@@ -3458,9 +3565,10 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       console.log("✅ service uninstalled.");
       break;
     default:
-      console.error("Usage: ocx service [install|repair|start|stop|status|uninstall|remove] [--native|--scheduler]");
-      console.error("       With no subcommand, installs/updates and starts the background service.");
+      console.error("Usage: ocx service [install|repair|restart|start|stop|status|uninstall|remove] [--native|--scheduler]");
+      console.error("       With no subcommand, installs when absent or repairs/restarts an existing service.");
       console.error("       repair: refresh assets and restart an already-installed service (no admin re-prompt).");
+      console.error("       restart: alias of repair.");
       console.error("       --native (Windows only): register a real SCM service via WinSW instead of Task Scheduler.");
       process.exit(1);
   }

package/src/types/config.ts

@@ -130,7 +130,7 @@ export interface OcxClaudeCodeConfig {
   /** Claude-originated web-search override. Unset fields inherit the global sidecar settings. */
   webSearchSidecar?: { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa"; model?: string };
   /** Claude-originated vision override. Unset fields inherit the global sidecar settings. */
-  visionSidecar?: { backend?: "openai" | "anthropic"; model?: string };
+  visionSidecar?: { backend?: "openai" | "anthropic" | "routed"; model?: string };
   /** Persisted Claude Desktop four-family routing profile. */
   desktopProfile?: OcxClaudeDesktopProfile;
   /** Auto-reconcile Desktop 3P config when provider catalog changes. Default: enabled. */
@@ -774,8 +774,14 @@ export interface OcxSearchConfig {
 export interface OcxVisionSidecarConfig {
   /** Master switch. Default: enabled when the selected backend has a usable credential. */
   enabled?: boolean;
-  /** Description backend. Unset prefers a usable stored Anthropic OAuth credential, else OpenAI. */
-  backend?: "openai" | "anthropic";
+  /**
+   * Description backend. Unset prefers a usable stored Anthropic OAuth credential, else OpenAI —
+   * the historical default order, deliberately unchanged by the union widening (#2188 roadmap
+   * 170/180 revised): "routed" describes through the proxy's OWN routing (loopback
+   * /v1/chat/completions) with a NAMESPACED "provider/model" describer, is explicit-only, and is
+   * never auto-selected from credential availability.
+   */
+  backend?: "openai" | "anthropic" | "routed";
   /** Vision model that describes images. */
   model?: string;
   /** Max description cache misses admitted in one main-model turn. Zero disables description calls. */

package/src/types/provider.ts

@@ -352,6 +352,12 @@ export interface OcxProviderConfig {
    * passthrough compatibility for OpenAI and unclassified gateways.
    */
   supportsOpenAiWebSearchToolFields?: boolean;
+  /**
+   * Whether the Responses upstream accepts native custom tools and custom_tool_call items.
+   * Set false only for a provider whose native contract rejects them; absence preserves
+   * apply_patch passthrough compatibility for OpenAI and unclassified gateways.
+   */
+  supportsResponsesCustomTools?: boolean;
   /**
    * Provider-local repair for Responses gateways whose lifecycle snapshots omit canonical
    * fields or closing events (#893). Disabled by default and applied only to client-facing

package/src/usage/cost.ts

@@ -22,7 +22,8 @@ import { activeConfiguredProviders, activeUserCostOverlays, userCostOverlayVersi
 import {
   EXPECTED_PRICE_OVERLAYS,
   findExpectedPriceOverlay,
-  resolvePriorityMultiplier,
+  findVerifiedPriceOverride,
+  findPriorityPricingRule,
   findContextTier,
   isLongContext,
   type Cost4,
@@ -81,12 +82,12 @@ export interface AttemptCostEstimate {
   price: MatchedPrice;
   cost: CostBreakdown;
   estimated: boolean;
-  /** Applied OpenAI priority-tier multiplier (undefined or 1 = standard). */
+  /** Applied provider priority-tier multiplier (undefined or 1 = standard). */
   priorityMultiplier?: number;
-  /** Standard-price estimate is a known floor for a confirmed, unpriced priority endpoint. */
-  priorityLowerBound?: boolean;
   /** Set when the published long-context rate was applied (#908). */
   contextTier?: ContextTierName;
+  /** The numeric estimate is a known floor because the exact Priority price is unavailable. */
+  priorityLowerBound?: boolean;
 }
 
 export interface CostEstimate {
@@ -95,12 +96,12 @@ export interface CostEstimate {
   estimated: boolean;
   attempts?: AttemptCostEstimate[];
   price?: MatchedPrice;
-  /** Applied OpenAI priority-tier multiplier (undefined or 1 = standard). */
+  /** Applied provider priority-tier multiplier (undefined or 1 = standard). */
   priorityMultiplier?: number;
-  /** Standard-price estimate is a known floor for a confirmed, unpriced priority endpoint. */
-  priorityLowerBound?: boolean;
   /** Set when any priced attempt used the published long-context rate (#908). */
   contextTier?: ContextTierName;
+  /** The aggregate is a known floor because every priced attempt is a lower bound. */
+  priorityLowerBound?: boolean;
 }
 
 function finiteNonNegative(value: number): boolean {
@@ -236,7 +237,7 @@ function resolveMatchedPriceInner(
 
 /**
  * Exact provider/model price lookup: user-configured `modelCosts` first, then
- * the jawcode provider bundle, then the expected-price overlay, then the
+ * an exact official correction, the jawcode provider bundle, the expected-price overlay, then the
  * model-level vendor fallback. All-zero rows fall through ("not billable").
  */
 function resolveMatchedPriceExact(
@@ -249,6 +250,20 @@ function resolveMatchedPriceExact(
   // operator's explicit price is authoritative for the ~$ estimate.
   const userOverlay = userOverlayMatch(provider, modelId, userOverlays);
   if (userOverlay) return userOverlay;
+  const verifiedOverride = overlays === EXPECTED_PRICE_OVERLAYS
+    ? findVerifiedPriceOverride(provider, modelId)
+    : undefined;
+  if (verifiedOverride && validCost4(verifiedOverride.cost4) && hasNonZeroCost(verifiedOverride.cost4)) {
+    return {
+      provider,
+      modelId,
+      cost4: verifiedOverride.cost4,
+      source: "expected",
+      sourceRef: verifiedOverride.source,
+      verifiedAt: verifiedOverride.verifiedAt,
+      status: "verified",
+    };
+  }
   const metadataProvider = resolveMetadataProvider(provider);
   const bundled = metadataProvider
     ? getModelMetadata(metadataProvider, modelId)
@@ -320,13 +335,6 @@ function isEstimated(usage: OcxUsage, usageStatus: UsageStatus, priceStatus: Exp
   return usage.estimated === true || usageStatus === "estimated" || priceStatus === "verified-derived";
 }
 
-/**
- * OpenAI provider ids eligible for service_tier "priority" price multipliers.
- * Only canonical OpenAI forward providers use the priority tier; routed providers
- * (OpenRouter, Cursor, etc.) may share model slugs but have independent pricing.
- */
-const OPENAI_TIER_PROVIDER_IDS = new Set(["openai", "openai-apikey"]);
-
 /**
  * Resolve the effective service tier from persisted log fields.
  * Priority: responseServiceTier (server-confirmed) > requestedServiceTier
@@ -405,9 +413,9 @@ function isConfirmedFast(tier?: ServiceTierInput): boolean {
  * normalized billable input — normalization subtracts cache read/write, so a
  * cache-heavy long prompt would fall below the boundary and under-bill.
  *
- * Skipped entirely for a response-confirmed Fast request: OpenAI does not serve
- * long context in Fast mode, so the two are mutually exclusive regimes rather
- * than composable multipliers.
+ * A provider's declaration decides how a response-confirmed priority tier relates to this band.
+ * OpenAI declares the bands exclusive. xAI publishes neither a combined rate nor an exclusion,
+ * so its long-context rate remains the known lower bound instead of inventing a stacked multiplier.
  */
 function applyContextTier(
   cost4: Cost4,
@@ -415,25 +423,27 @@ function applyContextTier(
   modelId: string,
   rawInputTokens: number | undefined,
   tier?: ServiceTierInput,
-): [Cost4, ContextTierName | undefined] {
-  if (rawInputTokens === undefined) return [cost4, undefined];
-  if (isConfirmedFast(tier)) return [cost4, undefined];
+): [Cost4, ContextTierName | undefined, boolean] {
+  if (rawInputTokens === undefined) return [cost4, undefined, false];
   const rule = findContextTier(baseProviderLabel(provider), modelId);
-  if (!rule || !isLongContext(rule, rawInputTokens)) return [cost4, undefined];
+  if (!rule || !isLongContext(rule, rawInputTokens)) return [cost4, undefined, false];
+  const confirmedFast = isConfirmedFast(tier);
+  if (confirmedFast && rule.confirmedPriorityRelation === "exclusive") {
+    return [cost4, undefined, false];
+  }
   return [{
     input: cost4.input * rule.multiplier.input,
     output: cost4.output * rule.multiplier.output,
     cacheRead: cost4.cacheRead * rule.multiplier.cacheRead,
     cacheWrite: cost4.cacheWrite * rule.multiplier.cacheWrite,
-  }, "long"];
+  }, "long", confirmedFast && rule.confirmedPriorityRelation === "lower-bound"];
 }
 
 /**
- * Apply the OpenAI priority-tier multiplier to a Cost4 when applicable.
+ * Apply a declared provider/model priority-tier multiplier to a Cost4 when applicable.
  * Returns [effectiveCost4, multiplier]. Multiplier is 1 (no-op) when:
  * - serviceTier is not "priority"
- * - provider is not a canonical OpenAI forward provider
- * - model is not in PRIORITY_MULTIPLIERS
+ * - no exact provider/model rule exists
  */
 function applyPriorityMultiplier(
   cost4: Cost4,
@@ -443,8 +453,9 @@ function applyPriorityMultiplier(
 ): [Cost4, number] {
   if (tierScalar(serviceTier) !== "priority") return [cost4, 1];
   const base = baseProviderLabel(provider);
-  if (!OPENAI_TIER_PROVIDER_IDS.has(base)) return [cost4, 1];
-  const multiplier = resolvePriorityMultiplier(modelId);
+  const rule = findPriorityPricingRule(base, modelId);
+  if (rule?.requiresResponseConfirmation && !isConfirmedFast(serviceTier)) return [cost4, 1];
+  const multiplier = rule?.multiplier ?? 1;
   if (multiplier === 1) return [cost4, 1];
   return [{
     input: cost4.input * multiplier,
@@ -495,16 +506,17 @@ export function estimateAttemptCost(
   const attemptServiceTier = attempt.tierOutcome
     ? serviceTierContextFromOutcome(attempt.tierOutcome)
     : serviceTier;
-  const [tieredCost4, contextTier] = applyContextTier(
+  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
     price.cost4, attempt.provider, attempt.model, attempt.usage.inputTokens, attemptServiceTier,
   );
-  // Exclusive both ways: if the long rate applied, the request was NOT served as
-  // Fast (Fast does not support long context), so the Fast multiplier must not
-  // also apply — otherwise a downgraded request bills at both rates.
+  // A published long-context row owns the numeric estimate. OpenAI declares that band
+  // exclusive with Fast; xAI's confirmed combination is deliberately left unmultiplied
+  // and marked as a lower bound because no combined price has been published.
   const [effectiveCost4, multiplier] = contextTier
     ? [tieredCost4, 1] as const
     : applyPriorityMultiplier(tieredCost4, attempt.provider, attempt.model, attemptServiceTier);
-  const priorityLowerBound = isOpenRouterPriorityLowerBound(attempt.provider, attempt.tierOutcome);
+  const priorityLowerBound = contextPriorityLowerBound
+    || isOpenRouterPriorityLowerBound(attempt.provider, attempt.tierOutcome);
   return {
     ordinal: attempt.ordinal,
     provider: attempt.provider,
@@ -514,8 +526,8 @@ export function estimateAttemptCost(
     cost: calculateCost(tokens, effectiveCost4),
     estimated: isEstimated(attempt.usage, attempt.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
-    ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }
 
@@ -557,8 +569,10 @@ export function estimateComboCost(
     ...(estimates.some(est => est.priorityMultiplier && est.priorityMultiplier !== 1)
       ? { priorityMultiplier: estimates.find(est => est.priorityMultiplier)?.priorityMultiplier }
       : {}),
-    ...(estimates.some(est => est.priorityLowerBound) ? { priorityLowerBound: true } : {}),
     ...(estimates.some(est => est.contextTier) ? { contextTier: "long" as const } : {}),
+    ...(estimates.every(est => est.priorityLowerBound === true)
+      ? { priorityLowerBound: true as const }
+      : {}),
   };
 }
 
@@ -579,13 +593,13 @@ export function estimateRequestCost(
   if (!tokens) return null;
   const price = resolveMatchedPrice(input.provider, input.model, overlays, userOverlays);
   if (!price) return null;
-  const [tieredCost4, contextTier] = applyContextTier(
+  const [tieredCost4, contextTier, contextPriorityLowerBound] = applyContextTier(
     price.cost4, input.provider, input.model, input.usage.inputTokens, input.serviceTier,
   );
   const [effectiveCost4, multiplier] = contextTier
     ? [tieredCost4, 1] as const
     : applyPriorityMultiplier(tieredCost4, input.provider, input.model, input.serviceTier);
-  const priorityLowerBound = isOpenRouterPriorityLowerBound(
+  const priorityLowerBound = contextPriorityLowerBound || isOpenRouterPriorityLowerBound(
     input.provider,
     typeof input.serviceTier === "object" ? input.serviceTier.tierOutcome : undefined,
   );
@@ -595,8 +609,8 @@ export function estimateRequestCost(
     cost: calculateCost(tokens, effectiveCost4),
     estimated: isEstimated(input.usage, input.usageStatus, price.status),
     ...(multiplier !== 1 ? { priorityMultiplier: multiplier } : {}),
-    ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
     ...(contextTier ? { contextTier } : {}),
+    ...(priorityLowerBound ? { priorityLowerBound: true } : {}),
   };
 }