@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/server/inspection-tee.ts

@@ -0,0 +1,107 @@
+/** Read-ahead allowance, not a lifetime limit on SSE inspection or delivery. */
+export const MAX_INSPECTION_READ_AHEAD_BYTES = 32 * 1024 * 1024;
+
+export interface InspectionTeeOptions {
+  /** Release pacing so the inspection owner's existing bounded drain can run. */
+  clientGoneSignal?: AbortSignal;
+  /** Internal test seam; callers must not take this value from upstream data. */
+  maxReadAheadBytes?: number;
+}
+
+/**
+ * Keep native tee cancellation semantics while pacing the inspection branch.
+ *
+ * Inspection may lead raw client consumption by the allowance plus one source
+ * chunk (and native tee prefetch). It never stops merely because the whole turn
+ * crossed that size: terminal, usage and continuation observers retain ownership.
+ * Count raw client bytes BEFORE rewrites, which may shrink, drop or expand them.
+ * Push sources still need their own producer-side bound; this is not an RSS cap.
+ */
+export function teeWithBoundedInspection(
+  source: ReadableStream<Uint8Array>,
+  options: InspectionTeeOptions = {},
+): [ReadableStream<Uint8Array>, ReadableStream<Uint8Array>] {
+  const limit = options.maxReadAheadBytes ?? MAX_INSPECTION_READ_AHEAD_BYTES;
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new RangeError("Inspection read-ahead limit must be a positive safe integer");
+  }
+  const [client, inspection] = source.tee();
+  let leadBytes = 0;
+  let pacingReleased = false;
+  let credit: Promise<void> | undefined;
+  let wake: (() => void) | undefined;
+
+  const wakeReader = () => {
+    const resolve = wake;
+    wake = undefined;
+    credit = undefined;
+    resolve?.();
+  };
+  const releasePacing = () => {
+    pacingReleased = true;
+    wakeReader();
+  };
+  const signal = options.clientGoneSignal;
+  if (signal?.aborted) releasePacing();
+  else signal?.addEventListener("abort", releasePacing, { once: true });
+
+  const wrap = (
+    body: ReadableStream<Uint8Array>,
+    isClient: boolean,
+  ): ReadableStream<Uint8Array> => {
+    const reader = body.getReader();
+    let ended = false;
+    // An upstream error must wake an inspector waiting for credit, not remain
+    // hidden until the client happens to issue another read. One observer per
+    // reader, not a permanent Promise.race reaction attached on every chunk.
+    void reader.closed.catch(releasePacing);
+    const releaseLock = () => {
+      try { reader.releaseLock(); } catch { /* a pending read owns the lock */ }
+    };
+    const finish = () => {
+      ended = true;
+      releasePacing();
+      if (!isClient) signal?.removeEventListener("abort", releasePacing);
+    };
+    return new ReadableStream<Uint8Array>({
+      async pull(controller) {
+        if (ended) return;
+        if (!isClient && !pacingReleased && leadBytes >= limit) {
+          credit ??= new Promise<void>(resolve => { wake = resolve; });
+          await credit;
+          if (ended) return;
+        }
+        try {
+          const result = await reader.read();
+          if (ended) return;
+          if (result.done) {
+            finish();
+            releaseLock();
+            controller.close();
+            return;
+          }
+          if (isClient) {
+            leadBytes -= result.value.byteLength;
+            if (leadBytes < limit) wakeReader();
+          } else {
+            leadBytes += result.value.byteLength;
+          }
+          controller.enqueue(result.value);
+        } catch (error) {
+          if (ended) return;
+          finish();
+          releaseLock();
+          controller.error(error);
+        }
+      },
+      cancel(reason) {
+        finish();
+        // Awaiting one tee branch's cancellation waits for the sibling. The
+        // owner must be free to finish cleanup and cancel/read that sibling.
+        void reader.cancel(reason).catch(() => undefined);
+        releaseLock();
+      },
+    }, { highWaterMark: 0 });
+  };
+  return [wrap(client, true), wrap(inspection, false)];
+}

package/src/server/live.ts

@@ -72,7 +72,17 @@ export const LIVE_SIDEBAND_API_ROOT = "https://api.openai.com/v1";
  * Client protocol headers relayed verbatim to the upstream on call-create and sideband upgrade.
  * `openai-alpha: quicksilver=v2` carries the Frameless protocol negotiation — without it the
  * ChatGPT backend validates the type-less Frameless session as v1 quicksilver and 400s
- * (openai/codex `realtime_request_headers`, core/src/realtime_conversation.rs). Auth headers
+ * (openai/codex `realtime_request_headers`, core/src/realtime_conversation.rs).
+ *
+ * `x-codex-turn-metadata` is on the same list upstream builds for the sideband upgrade and was
+ * missing here, so every realtime turn reached the model with metadata the client had attached
+ * and this proxy silently dropped. The Responses passthrough already forwards it
+ * (`src/adapters/openai-responses/passthrough.ts`); the sideband goes to the same realtime
+ * upstream the caller was addressing, so there is nothing to scope it away from. That is not
+ * true of the images sidecar, which strips it deliberately and keeps doing so.
+ *
+ * Every name here is relayed only when the caller sent it. Nothing on this list is invented,
+ * which is what keeps a caller that omits one byte-identical upstream. Auth headers
  * (`authorization`, `chatgpt-account-id`) stay proxy-owned and are never taken from this list.
  */
 export const LIVE_CLIENT_PROTOCOL_HEADERS = [
@@ -82,6 +92,7 @@ export const LIVE_CLIENT_PROTOCOL_HEADERS = [
   "thread-id",
   "originator",
   "x-oai-attestation",
+  "x-codex-turn-metadata",
 ] as const;
 
 /**
@@ -128,6 +139,40 @@ export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void {
   }
 }
 
+/**
+ * Sideband lifecycle stages, recorded in the same JSONL as the frame records.
+ *
+ * Frame forensics alone cannot separate the three realtime-voice failures reported in #4721.
+ * A join that never reached this proxy, a join whose upstream handshake was refused, and a
+ * relay that opened and then carried nothing all leave the same empty file, which is why the
+ * original report could only say "no frame log". One record per stage makes them distinct:
+ * no record at all means the client never dialed the proxy, `upstream-failed` carries the
+ * status the client was handed, and `relay-attached` with no following frame record means the
+ * transport is live and the silence is upstream of it.
+ */
+export type LiveSidebandStage = "upstream-open" | "upstream-failed" | "relay-attached" | "relay-closed";
+
+/**
+ * Append one lifecycle record. Same privacy rule as the frame records and for the same reason:
+ * no URL, no call id, no header, no frame content — only the stage and, on failure, the status
+ * and error code this proxy synthesized itself.
+ */
+export function logLiveSidebandStage(
+  stage: LiveSidebandStage,
+  detail?: { status?: number; code?: string },
+): void {
+  const logPath = process.env[LIVE_FRAME_LOG_ENV];
+  if (!logPath) return;
+  try {
+    const record: Record<string, unknown> = { ts: new Date().toISOString(), stage };
+    if (detail?.status !== undefined) record.status = detail.status;
+    if (detail?.code !== undefined) record.code = detail.code;
+    appendFileSync(logPath, JSON.stringify(record) + "\n");
+  } catch {
+    // Diagnostics must never break the relay.
+  }
+}
+
 function clientProtocolHeaders(reqHeaders: Headers): Record<string, string> {
   const out: Record<string, string> = {};
   for (const name of LIVE_CLIENT_PROTOCOL_HEADERS) {

package/src/server/management/combo-routes.ts

@@ -80,17 +80,20 @@ function sparseComboConfig<T extends {
   waitForCooldownMs?: number;
   imageInput?: "auto" | "disabled";
   reasoningEffortMode?: "strict" | "adaptive";
-}>(combo: T): Omit<T, "cooldownMs" | "waitForCooldownMs" | "imageInput" | "reasoningEffortMode"> & {
+  defaultEffortMode?: "fallback" | "force";
+}>(combo: T): Omit<T, "cooldownMs" | "waitForCooldownMs" | "imageInput" | "reasoningEffortMode" | "defaultEffortMode"> & {
   cooldownMs?: number;
   waitForCooldownMs?: number;
   imageInput?: "disabled";
   reasoningEffortMode?: "adaptive";
+  defaultEffortMode?: "force";
 } {
   const {
     cooldownMs,
     waitForCooldownMs,
     imageInput,
     reasoningEffortMode,
+    defaultEffortMode,
     ...rest
   } = combo;
   return {
@@ -101,6 +104,7 @@ function sparseComboConfig<T extends {
       : {}),
     ...(imageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
     ...(reasoningEffortMode === "adaptive" ? { reasoningEffortMode: "adaptive" as const } : {}),
+    ...(defaultEffortMode === "force" ? { defaultEffortMode: "force" as const } : {}),
   };
 }
 
@@ -170,6 +174,11 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "waitForCooldownMs") && previous?.waitForCooldownMs !== undefined
         ? { waitForCooldownMs: previous.waitForCooldownMs }
         : {}),
+      // The dashboard does not expose this advanced CLI/API policy. Preserve it when
+      // a GUI round-trip omits the field instead of silently downgrading to fallback.
+      ...(!Object.hasOwn(requestedCombo, "defaultEffortMode") && previous?.defaultEffortMode !== undefined
+        ? { defaultEffortMode: previous.defaultEffortMode }
+        : {}),
     };
     const error = comboConfigError(id, effectiveCombo, config.providers, {
       requireEnabledTarget: true,

package/src/server/management/route-registry.ts

@@ -86,34 +86,34 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management-api
   { method: "POST", path: "/api/stop", module: "server/management-api", mutates: true },
   // codex/auth-api
-  { method: "DELETE", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
-  { method: "GET", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: false },
-  { method: "GET", path: "/api/codex-auth/active", module: "codex/auth-api", mutates: false },
-  { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api", mutates: false },
-  { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api", mutates: false },
-  { method: "GET", path: "/api/codex-auth/quota/history", module: "codex/auth-api", mutates: false },
-  { method: "GET", path: "/api/codex-auth/reset-credits", module: "codex/auth-api", mutates: false },
-  { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/accounts/refresh", module: "codex/auth-api", mutates: true },
+  { method: "DELETE", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: true },
+  { method: "GET", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/active", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/quota/history", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/reset-credits", module: "codex/auth-api/routes", mutates: false },
+  { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts/refresh", module: "codex/auth-api/routes", mutates: true },
   // codex/main-device-reauth-api (#3898): the native-main device reauth namespace;
   // /api/codex-auth/login stays pool-only and keeps rejecting __main__.
   { method: "POST", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
   { method: "GET", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: false },
   { method: "DELETE", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api", mutates: true },
-  { method: "POST", path: "/api/codex-auth/reset-credits/consume", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/accounts/alias", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/accounts/pause", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/accounts/pause-exhausted", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/accounts/priority", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/active", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/auto-switch", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/failover", module: "codex/auth-api", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true, exempt: { reason: "compatibility-alias", why: "Superseded by PUT /api/pool/settings, which the CLI now drives. Kept working for existing clients and pinned by exact-body goldens in tests/server/account-pool-management-api.test.ts; no CLI verb targets it any more." } },
+  { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api/routes", mutates: true },
+  { method: "POST", path: "/api/codex-auth/reset-credits/consume", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/alias", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/pause", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/pause-exhausted", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/priority", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/active", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/auto-switch", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/failover", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api/routes", mutates: true, exempt: { reason: "compatibility-alias", why: "Superseded by PUT /api/pool/settings, which the CLI now drives. Kept working for existing clients and pinned by exact-body goldens in tests/server/account-pool-management-api.test.ts; no CLI verb targets it any more." } },
   // codex/native-profile-api
   { method: "GET", path: "/api/native-main-profiles", module: "codex/native-profile-api", mutates: false },
   { method: "GET", path: "/api/native-main-profiles/doctor", module: "codex/native-profile-api", mutates: false },
@@ -308,6 +308,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
   // server/management/quota-reset-routes
   { method: "GET", path: "/api/quota-resets", module: "server/management/quota-reset-routes", mutates: false, mechanism: "negated-guard" },
+  // server/management/workflow-budget-routes
+  { method: "GET", path: "/api/workflow-budget", module: "server/management/workflow-budget-routes", mutates: false, exempt: { reason: "deferred-verb", why: "Reading a root's live budget is owed a CLI verb -- an operator staring at a 429 is usually already in a terminal -- but the ledger is process memory with no local transport to read it through, so the verb has to be an HTTP call the CLI does not yet make.", owner: "260915_workflow_budget_window wfc", ownerDoc: "devlog/_plan/260915_workflow_budget_window/030_wfc_diff_plan.md" } },
+  { method: "POST", path: "/api/workflow-budget/clear", module: "server/management/workflow-budget-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Clearing one root is owed the same verb as the read above and for the same reason. It is deliberately not shipped as a verb in this work-phase: the read comes first, because an operator who cannot see which ceiling fired has no basis for deciding to forgive it.", owner: "260915_workflow_budget_window wfc", ownerDoc: "devlog/_plan/260915_workflow_budget_window/030_wfc_diff_plan.md" } },
   // server/management/request-history-routes
   { method: "GET", path: "/api/request-history", module: "server/management/request-history-routes", mutates: false },
   // server/management/routing-analytics-routes

package/src/server/management/shared.ts

@@ -37,7 +37,7 @@ import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap
 import { resolveCodexHomeDir } from "../../codex/home";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
-import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
+import { cacheObservationFromUsage, parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -97,7 +97,7 @@ export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "firstOutputMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "firstOutputMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision" | "cacheProvenance"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -186,9 +186,12 @@ export function costResult(entry: MetricSource): CostResult {
   if (!estimate) return { kind: "unavailable", reason: unavailableCostReason(entry) };
   const estimateReasons = [
     entry.usageStatus === "estimated" || entry.usage?.estimated ? "usage_estimated" as const : undefined,
-    entry.usage && entry.usage.cachedInputTokens === undefined
-      && entry.usage.cacheReadInputTokens === undefined
-      && entry.usage.cacheCreationInputTokens === undefined ? "cache_detail_missing" as const : undefined,
+    // A cost estimate is qualified by cache detail it can TRUST. A detail object that exists only
+    // because a strict client requires the field carries no cache reading, so it qualifies the
+    // estimate exactly as a missing one does — reading it as a measured zero prices the request
+    // as an uncached send that nothing observed.
+    entry.usage && cacheObservationFromUsage(entry.usage, entry.cacheProvenance).provenance !== "observed"
+      ? "cache_detail_missing" as const : undefined,
     estimate.price?.source === "expected" || estimate.attempts?.some(a => a.price.source === "expected")
       ? "expected_price_overlay" as const : undefined,
     estimate.price?.source === "user" || estimate.attempts?.some(a => a.price.source === "user")

package/src/server/management/workflow-budget-routes.ts

@@ -0,0 +1,133 @@
+/**
+ * Operator view of the in-memory workflow-budget ledger, plus a targeted clear.
+ *
+ * Loaded on demand from src/server/management-api.ts, which is the FOURTH entry in the protected
+ * set of tests/core-lab-boundary.test.ts — added precisely because eagerly importing handlers
+ * there put ~70 modules on every dashboard request. A static import here would make this
+ * subsystem the next instance of that bug.
+ *
+ * Authentication is inherited: every /api route passes through requireManagementAuth before the
+ * chain runs, so these handlers add no auth code of their own. The GET spends no user identity.
+ * The POST clears one root's windowed count ceilings; it does not spend identity, and the
+ * underlying ledger leaves in-flight concurrency and the token spend record untouched.
+ */
+
+import { jsonResponse } from "../auth-cors";
+import type { OcxConfig } from "../../types";
+import type { ManagementContext } from "./context";
+import { readManagementJsonBodyOr } from "./body";
+import {
+  clearWorkflowBudgetForRoot,
+  listTrackedWorkflowRoots,
+  listWorkflowBudgetEvents,
+  workflowBudgetSnapshot,
+  WORKFLOW_EVENT_CAPACITY,
+} from "../../lib/workflow-budget";
+
+const DEFAULT_LIMIT = 20;
+const MAX_LIMIT = WORKFLOW_EVENT_CAPACITY;
+const MAX_ROOT_ID_LENGTH = 200;
+
+/**
+ * A root id is an opaque caller-thread token, not a path. Without a length cap a client
+ * could POST a multi-megabyte string that we would then store as a map key and echo back
+ * in events; 200 is well above any thread id we have seen and small enough to put in a URL.
+ */
+function parseRootId(raw: unknown): string | null {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.length > MAX_ROOT_ID_LENGTH) return null;
+  return trimmed;
+}
+
+function invalidRootResponse(req: Request, config: OcxConfig): Response {
+  return jsonResponse(
+    { error: { code: "invalid_root", message: "root must be a non-empty string of at most 200 characters" } },
+    400,
+    req,
+    config,
+  );
+}
+
+function parseLimitParam(rawLimit: string | null): { ok: true; limit: number } | { ok: false } {
+  if (rawLimit !== null && !/^\d+$/.test(rawLimit)) return { ok: false };
+  return {
+    ok: true,
+    limit: rawLimit === null ? DEFAULT_LIMIT : Math.min(MAX_LIMIT, Number.parseInt(rawLimit, 10)),
+  };
+}
+
+export async function handleWorkflowBudgetRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+
+  if (url.pathname === "/api/workflow-budget") {
+    if (req.method !== "GET") return null;
+
+    const parsedLimit = parseLimitParam(url.searchParams.get("limit"));
+    if (!parsedLimit.ok) {
+      return jsonResponse(
+        { error: { code: "invalid_limit", message: "limit must be a non-negative integer" } },
+        400,
+        req,
+        config,
+      );
+    }
+    const { limit } = parsedLimit;
+
+    const rawRoot = url.searchParams.get("root");
+    if (rawRoot !== null) {
+      const rootId = parseRootId(rawRoot);
+      if (rootId === null) return invalidRootResponse(req, config);
+      const snapshot = workflowBudgetSnapshot(rootId);
+      // An unknown id is a 200 with `root: null`, not a 404: the operator asked what this
+      // process currently holds for that token, and "nothing" is a legitimate answer. POST
+      // /clear is the opposite — claiming to forgive a ceiling that was never tracked would
+      // report a success that did not happen.
+      return jsonResponse(
+        {
+          root: snapshot ? { rootId, ...snapshot } : null,
+          events: listWorkflowBudgetEvents(WORKFLOW_EVENT_CAPACITY)
+            .filter((event) => event.rootId === rootId)
+            .slice(0, limit),
+        },
+        200,
+        req,
+        config,
+      );
+    }
+
+    return jsonResponse(
+      {
+        roots: listTrackedWorkflowRoots(limit),
+        events: listWorkflowBudgetEvents(limit),
+      },
+      200,
+      req,
+      config,
+    );
+  }
+
+  if (url.pathname === "/api/workflow-budget/clear") {
+    if (req.method !== "POST") return null;
+
+    const body = await readManagementJsonBodyOr(req, {});
+    const rawRoot = body && typeof body === "object" && !Array.isArray(body)
+      ? (body as { root?: unknown }).root
+      : undefined;
+    const rootId = parseRootId(rawRoot);
+    if (rootId === null) return invalidRootResponse(req, config);
+
+    const before = clearWorkflowBudgetForRoot(rootId);
+    if (!before) {
+      return jsonResponse(
+        { error: { code: "unknown_root", message: "root is not currently tracked" } },
+        404,
+        req,
+        config,
+      );
+    }
+    return jsonResponse({ cleared: true, root: rootId, before }, 200, req, config);
+  }
+
+  return null;
+}

package/src/server/management-api.ts

@@ -144,6 +144,17 @@ async function handleQuotaResetRoutesOnDemand(ctx: ManagementContext): Promise<R
   return handleQuotaResetRoutes(ctx);
 }
 
+/**
+ * Lazy like the Lab and routing-profile handlers, and for the same recorded reason: this file is
+ * mounted for every dashboard request, so a static import would put the workflow-budget ledger
+ * on all of them.
+ */
+async function handleWorkflowBudgetRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/workflow-budget", true)) return null;
+  const { handleWorkflowBudgetRoutes } = await import("./management/workflow-budget-routes");
+  return handleWorkflowBudgetRoutes(ctx);
+}
+
 async function handleGrokCouponRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
   if (!pathInManagementNamespace(ctx.url.pathname, "/api/grok/reset-coupons", true)) return null;
   const { handleGrokCouponRoutes } = await import("./management/grok-coupon-routes");
@@ -263,6 +274,7 @@ export async function handleManagementAPI(
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
+    ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
     ??     (await handleGrokCouponRoutesOnDemand(ctx))
     ??     (await handleRoutingAnalyticsRoutes(ctx))
     ??     (await handleRoutingProfileRoutesOnDemand(ctx))

package/src/server/relay-eager.ts

@@ -466,6 +466,8 @@ export function relaySseEagerBounded(
         else hooks.onSynthetic(syntheticKind, syntheticReason);
       }
       if (cancelled && !hooks.sawTerminal()) {
+        // Finalize transport telemetry before the cancellation hook persists its usage row.
+        upstream.abort();
         hooks.onClientCancel();
       }
       if (cancelled || upstream.signal.aborted || syntheticKind === "failed" || deliveryFallbackSent) {

package/src/server/relay.ts

@@ -26,6 +26,7 @@ import {
   MAX_CLIENT_SSE_FRAME_BYTES,
 } from "./sse-frame-buffer";
 import { replaceSseDataPayload } from "./sse-payload-rewrite";
+import { createBoundedResponseLogBody } from "./response-log-body";
 
 const nativePassthroughSseResponses = new WeakSet<Response>();
 const eagerRelaySseResponses = new WeakSet<Response>();
@@ -718,25 +719,16 @@ export function responseWithDeferredRequestLog(
   }
   if (!response.body || !contentType.includes("text/event-stream")) {
     if (response.body && (contentType.includes("application/json") || response.status >= 400)) {
-      const finalizeJsonLog = async () => {
-        const text = await response.text();
-        // Non-JSON error bodies: inspect/log only a bounded prefix (the stored
-        // upstreamError is 500 chars anyway); the FULL text is still forwarded to the
-        // client below, unchanged. JSON bodies keep full inspection (usage parsing).
-        const isJson = contentType.includes("application/json");
-        inspectResponseLogJson(logCtx, isJson ? text : text.slice(0, 8192));
-        addFinalRequestLog(requestId, start, logCtx, response.status, { closeReason: "non_stream" }, addLog);
-        return text;
-      };
-      const body = new ReadableStream<Uint8Array>({
-        async start(controller) {
-          try {
-            controller.enqueue(new TextEncoder().encode(await finalizeJsonLog()));
-            controller.close();
-          } catch (err) {
-            addFinalRequestLog(requestId, start, logCtx, 502, { closeReason: "non_stream" }, addLog);
-            try { controller.error(err); } catch { /* already torn down */ }
-          }
+      const body = createBoundedResponseLogBody(response.body, {
+        json: contentType.includes("application/json"),
+        inspect: text => inspectResponseLogJson(logCtx, text),
+        finalize: reason => {
+          // Preserve wire status; request history follows the adjacent SSE
+          // convention for a client cancellation or upstream read failure.
+          const status = reason === "cancel" ? 499 : reason === "read_error" ? 502 : response.status;
+          addFinalRequestLog(requestId, start, logCtx, status, {
+            closeReason: reason === "cancel" ? "client_cancel" : "non_stream",
+          }, addLog);
         },
       });
       return new Response(body, {
@@ -1338,6 +1330,9 @@ function startBoundedInspectionPump(options: InspectionPumpOptions): void {
     try {
       for (;;) {
         const { done, value } = await reader.read();
+        // Hard cancellation settles a pending read as EOF. Do not flush a
+        // partial terminal after the owner already finalized cancellation.
+        if (cancelled) break;
         if (clientGoneSignal?.aborted) markClientGone();
         if (drainStopped) {
           // stopDrain() cancelled the reader; the settled read is the wake-up.

package/src/server/request-log-conversation.ts

@@ -64,13 +64,16 @@ export function sessionIdHeaderFromRequest(headers: Headers): string | null {
 /**
  * Fixed-size logical turn lane (#820).
  *
- * A lane must be as SPECIFIC as the identity available, which is the opposite of what
- * `codexPoolAffinityKey` wants. Affinity deliberately prefers the parent thread so a whole
- * subagent fan-out pins to one account; a lane keyed that way would put every parallel
- * subagent of one parent into a single lane and reject all but the first with 503 — the
- * fan-out is the normal case, not an abuse.
+ * A lane must be as SPECIFIC as the identity available. `codexPoolAffinityKey` used to be the
+ * opposite: it preferred the parent thread, so a whole subagent fan-out shared one entry, and a
+ * lane keyed that way would have put every parallel subagent of one parent into a single lane
+ * and rejected all but the first with 503 — the fan-out is the normal case, not an abuse.
+ * Since #4546 affinity keys every thread as ITSELF and reads the parent only as a first-placement
+ * hint, so the two now agree on the unit. They still derive it differently: a lane is a digest an
+ * operator can match against what the client sent, while an affinity key is an opaque HMAC
+ * precisely so no caller-supplied identifier ends up in Pool state.
  *
- * So the parent is a QUALIFIER, never the lane on its own when a child thread exists: the
+ * The parent stays a QUALIFIER here, never the lane on its own when a child thread exists: the
  * pair separates siblings while still keeping one conversation's overlapping turns together.
  */
 export function sessionLaneIdFromRequest(headers: Headers): string | undefined {
@@ -256,4 +259,3 @@ export function getOrAllocateRequestSessionLane(req: Request): string {
 export function linkRequestSessionLane(sourceReq: Request, targetReq: Request): void {
   requestAllocatedSessionLanes.set(targetReq, getOrAllocateRequestSessionLane(sourceReq));
 }
-