@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/server/responses/core-auth.ts

@@ -138,6 +138,7 @@ export async function resolveResponsesCodexAuth(
   route: RouteResult,
   options: HandleResponsesOptions,
   credentialDomainWasRewritten = false,
+  retainAccountForUploadedFiles = false,
 ): Promise<ResponsesAuthResolution> {
   try {
     let authInputHeaders = codexRouteCredentialDomainHeaders(
@@ -232,6 +233,7 @@ export async function resolveResponsesCodexAuth(
         resolveCodexModelEntitlements: options.resolveCodexModelEntitlements,
         signal: options.abortSignal,
         nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
+        retainAccountForUploadedFiles,
       });
       options.onCodexAuthContextResolved?.(authCtx);
     } else {

package/src/server/responses/core-codex-account.ts

@@ -17,6 +17,7 @@ import {
   resetUpstreamHostHealth,
 } from "../../codex/upstream-host-health";
 import { safeOriginLabel, fetchWithHeaderTimeout, providerFetch } from "./fetch-helpers";
+import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { formatErrorResponse } from "../../bridge";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { upstreamErrorMessageFromPayload, isRateLimitOrQuotaFailureMessage } from "../../lib/errors";
@@ -40,6 +41,7 @@ import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import {
   codexProbeLeaseId,
+  codexTransientProbeGrant,
   codexProbeQuotaScope,
   releaseCodexAuthContextProbeLease,
   resolveCodexAuthContext,
@@ -60,13 +62,14 @@ import { bindRouteReasoningReplayScope } from "./core-replay";
 import {
   conversationStateBindingFromAuth,
   applyAccountChangeConversationStateScrub,
+  conversationCarriesUploadedFiles,
 } from "./account-change-state";
 import {
   recordAdapterReasoning,
   recordAdapterTier,
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
-  noteAttemptSend,
+  noteProviderAttemptSend,
 } from "../request-log";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import { chargeWorkflowSends } from "../../lib/workflow-budget";
@@ -221,7 +224,17 @@ export async function shouldRetryCodexPoolAccountQuota(
   // A post-send WebSocket gateway status must not become a second account's send; the
   // body carries no quota evidence either, but the marker is the contract, not the prose.
   if (isNonReplayableResponse(response)) return false;
-  if (response.status === 402 || response.status === 429) return true;
+  if (response.status === 402 || response.status === 429) {
+    // Status alone used to authorize the move, which is right for a limit the ACCOUNT owns and
+    // wrong for one it merely belongs to. An organization- or project-scoped exhaustion refuses
+    // every credential inside that organization, so the second account meets the same counter
+    // and the only thing the rotation buys is a second cold prompt prefix (#4546). Positive
+    // evidence is required to withhold it: the helper fails closed, so an unreadable or
+    // ambiguous body keeps the broad #584 behaviour unchanged, and `rate_limit_exceeded`,
+    // `slow_down` and plan-level exhaustion still rotate exactly as before.
+    const { codexScopedExhaustionCode } = await import("../../codex/quota-rejection");
+    return await codexScopedExhaustionCode(response, { signal }) === undefined;
+  }
   if (response.status < 500 || response.status >= 600) return false;
   try {
     // Reject malformed UTF-8 instead of matching quota words around replacement characters.
@@ -459,6 +472,7 @@ export async function retryCodexPoolOnAlternateAccount(
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
       probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
+      transientProbe: codexTransientProbeGrant(firstAuthCtx),
       writerGeneration: firstAuthCtx.writerGeneration,
     });
   };
@@ -489,6 +503,17 @@ export async function retryCodexPoolOnAlternateAccount(
     recordUnmovedTransientOutcome();
     return { kind: "no-alternate" };
   }
+  // An uploaded file is readable only by the account it was sent to, so NO alternate can serve
+  // this body. Which account would be chosen does not change that, which is why this asks before
+  // the resolution rather than after it: refusing here reserves no send, cancels no response, and
+  // leaves the caller holding the first account's rejection to return unchanged (#4710). The
+  // initial-dispatch sites answer with a 400 instead, because there is no earlier response there
+  // to fall back to. A same-account replay -- the gated-model 400 ladder above -- is unaffected,
+  // since it never leaves the issuing account.
+  if (!retryAuthCtx && conversationCarriesUploadedFiles(parsed._rawBody)) {
+    recordUnmovedTransientOutcome();
+    return { kind: "no-alternate" };
+  }
   // An account move is the guarded profile's fourth send and draws the single shared
   // final-recovery reserve. Nothing bounded it per request before: `excludeAccountId` excludes
   // only the account that just failed, and the caller's recovery loop can return here after the
@@ -557,6 +582,7 @@ export async function retryCodexPoolOnAlternateAccount(
         modelId: route.modelId,
         probeLeaseId: codexProbeLeaseId(firstAuthCtx),
         probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
+        transientProbe: codexTransientProbeGrant(firstAuthCtx),
         writerGeneration: firstAuthCtx.writerGeneration,
       });
     }
@@ -588,6 +614,7 @@ export async function retryCodexPoolOnAlternateAccount(
       modelId: route.modelId,
       probeLeaseId: codexProbeLeaseId(firstAuthCtx),
       probeQuotaScope: codexProbeQuotaScope(firstAuthCtx),
+      transientProbe: codexTransientProbeGrant(firstAuthCtx),
       writerGeneration: firstAuthCtx.writerGeneration,
       // Retry already advanced the RR ring via excludeAccountId — reuse for promotion.
       ...(retryAuthCtx.accountId ? { promoteAccountId: retryAuthCtx.accountId } : {}),
@@ -693,16 +720,35 @@ export async function retryCodexPoolOnAlternateAccount(
       // The same-account gated-model 400 ladder below keeps its own `maxRetrySends` bound and
       // does not take the reserve again; only the move itself does.
       if (accountMovePermit) {
+        // The pool-wide recovery window is consulted BEFORE the request-local permit is used.
+        // `reserveDispatch` charges at reservation time and `release()` is the only way back, so
+        // using the permit first and refusing afterwards would spend a send the request never
+        // made. An account move is recovery traffic like any other: one request's own budget
+        // cannot see that a thousand other requests are moving at the same moment, which is
+        // precisely the amplification this window exists to bound (#4701).
+        //
+        // A refusal here is not a new failure mode: "no alternate was available" is already the
+        // outcome when the pool has nowhere to move this request to, and it is handled.
+        if (!classifyPoolRecoveryDispatch("retry").admitted) {
+          accountMovePermit.release();
+          accountMovePermit = undefined;
+          // The alternate context was resolved and will not send. Hand back whatever recovery
+          // lease it is holding rather than leaving that account unprobeable.
+          releaseCodexAuthContextProbeLease(retryAuthCtx);
+          recordUnmovedTransientOutcome();
+          return { kind: "no-alternate" };
+        }
         const charged = accountMovePermit.use();
         accountMovePermit = undefined;
         if (!charged) {
+          releaseCodexAuthContextProbeLease(retryAuthCtx);
           recordUnmovedTransientOutcome();
           return { kind: "no-alternate" };
         }
         // The move is a physical send like any other, so the root workflow is charged too.
         chargeWorkflowSends(args.options.workflowRootId, 1);
       }
-      noteAttemptSend(logCtx.activeAttempt, passthroughEstimate);
+      noteProviderAttemptSend(logCtx, route.providerName, route.provider, passthroughEstimate);
       try {
         upstreamResponse = await fetchWithHeaderTimeout(
           request.url,
@@ -827,6 +873,7 @@ export function codexForwardTerminalOutcomeRecorder(
         modelId,
         probeLeaseId: codexProbeLeaseId(authCtx),
         probeQuotaScope: codexProbeQuotaScope(authCtx),
+        transientProbe: codexTransientProbeGrant(authCtx),
         writerGeneration: authCtx.writerGeneration,
       });
       return;
@@ -849,6 +896,7 @@ export function codexForwardTerminalOutcomeRecorder(
       modelId,
       probeLeaseId: codexProbeLeaseId(authCtx),
       probeQuotaScope: codexProbeQuotaScope(authCtx),
+      transientProbe: codexTransientProbeGrant(authCtx),
       writerGeneration: authCtx.writerGeneration,
       // A mid-stream terminal can carry a semantic 401 long after the credential was
       // replaced. It is never replayed — the client already saw output — but it must

package/src/server/responses/core-combo.ts

@@ -1,6 +1,8 @@
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+import { recordAttemptRequestedEffort } from "../request-log";
 import {
   CODEX_TEXT_GUARDED_BUDGET_POLICY,
-  createRequestExecutionBudget,
+  deriveRequestExecutionBudget,
   isRequestExecutionBudget,
 } from "../../lib/request-execution-budget";
 import type {
@@ -44,6 +46,7 @@ import { isThreadSpawnRequest, supportedLadderFor } from "../effort-policy";
 import {
   clientCancelledResponse,
   comboUnavailable,
+  targetIncompatibleResponse,
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
 import {
@@ -51,7 +54,12 @@ import {
   createChildPassthroughCallbackGate,
   consumeComboFailure,
 } from "./core-combo-failure";
-import { linkRequestSessionLane, sessionLaneIdFromRequest } from "../request-log-conversation";
+import {
+  linkRequestSessionLane,
+  reasoningReplayConversationIdFromResponsesRequest,
+  sessionIdHeaderFromRequest,
+  sessionLaneIdFromRequest,
+} from "../request-log-conversation";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
@@ -65,6 +73,7 @@ import {
 } from "../relay";
 import { preflightComboStreamResponse } from "./combo-stream-preflight";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
+import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 
 /**
  * Sends one combo target may run on its own before the ladder moves on. A target is a whole
@@ -105,25 +114,27 @@ export function comboExecutionBudgetPolicy(declaredTargets: number): RequestExec
 /**
  * A budget scope that keeps its own recovery ledgers but spends the SAME request-wide counter.
  *
- * `used` is redefined as an accessor onto the parent because the factory reads it back off this
- * object -- `remainingBaseSends` and the total check both do -- so a copied number would let a
- * combo target run its ladder against a stale total, which is precisely the per-layer counting
- * this work exists to remove. The reserve, alternate-target and transition ledgers stay
- * per-scope on purpose: a combo target's account failover is its own recovery decision, while
- * the request total still bounds every target together.
+ * The sharing has to happen inside the factory. Redefining `used` as an accessor onto the parent
+ * only shared what callers read from the outside: `remainingBaseSends`, the total check and the
+ * reserve test all consult the factory's own private counter, which an overridden property
+ * cannot reach. Each derived scope therefore admitted dispatches as though the request had spent
+ * nothing, and the per-target holdback below -- expressed against `maxTotalModelSends` -- had
+ * nothing to hold back from.
+ *
+ * `deriveRequestExecutionBudget` binds the scope to the parent's real ledger, including pending
+ * externally-counted bookings and the durable-spend observer, all of which must travel together.
+ * A pending booking is a send already counted in the total and waiting for its reporter, and the
+ * observer books by watching that same counter move (#4707) -- so a scope that spent the counter
+ * without carrying the observer would move it without booking, and this combo's child sends
+ * would go missing from the spend ledger. The reserve, alternate-target and transition ledgers
+ * stay per-scope on purpose: a combo target's account failover is its own recovery decision,
+ * while the request total still bounds every target together.
  */
 export function deriveSendBudgetScope(
   parent: RequestExecutionBudget,
   policy: RequestExecutionBudgetPolicy,
 ): RequestExecutionBudget {
-  const scope = createRequestExecutionBudget(policy, parent.logicalRequestId);
-  Object.defineProperty(scope, "used", {
-    get: () => parent.used,
-    set: (value: number) => { parent.used = value; },
-    enumerable: true,
-    configurable: true,
-  });
-  return scope;
+  return deriveRequestExecutionBudget(parent, policy);
 }
 
 
@@ -229,6 +240,29 @@ export async function executeComboResponses(
       : undefined,
     recoveredPlaintext: false,
   };
+  const reasoningReplayConversationId = reasoningReplayConversationIdFromResponsesRequest({
+    clientThreadId: inboundClientThreadId,
+    threadIdHeader: req.headers.get("thread-id"),
+    sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
+  });
+  const reasoningReplayEligible = (target: (typeof combo.targets)[number]): boolean => {
+    try {
+      const route = routeConcreteModel(config, `${target.provider}/${target.model}`);
+      const unavailable = mandatoryResponsesReasoningReplayUnavailable({
+        body,
+        clientThreadId: reasoningReplayConversationId,
+        providerName: route.providerName,
+        provider: route.provider,
+        adapterName: route.provider.adapter,
+        modelId: route.modelId,
+      });
+      return !unavailable;
+    } catch {
+      // Routing failures are not evidence of replay incompatibility. Keep the target eligible so
+      // the existing selection and dispatch path preserves its original routing failure surface.
+      return true;
+    }
+  };
   const adoptFailedChildLog = (childLog: RequestLogContext): void => {
     // Attempts remain the complete physical history; the logical row mirrors the most recent
     // failed target so an exhausted combo still has useful top-level reasoning diagnostics.
@@ -260,6 +294,18 @@ export async function executeComboResponses(
   let comboPayloadReadable = false;
   const payloadEligible = (target: (typeof combo.targets)[number]): boolean =>
     comboPayloadReadable || !unreadableEncryptedAgentTask || canDecryptUnreadableAgentTask(target);
+  const targetEligible = (target: (typeof combo.targets)[number]): boolean =>
+    payloadEligible(target) && reasoningReplayEligible(target);
+  const onlyReplayIncompatibleTargetsRemain = (excluded: Iterable<string> = []): boolean => {
+    const excludedKeys = new Set(excluded);
+    const remaining = combo.targets.filter(target => {
+      const provider = config.providers[target.provider];
+      return provider?.disabled !== true
+        && !excludedKeys.has(targetKey(target))
+        && payloadEligible(target);
+    });
+    return remaining.length > 0 && remaining.every(target => !reasoningReplayEligible(target));
+  };
   let encryptedTaskRecoveryAttempted = false;
   let recoveryFailureReason: AgentTaskRecoveryFailureReason | undefined;
   let storedPool401ReplayDispatched = false;
@@ -324,7 +370,7 @@ export async function executeComboResponses(
     abortSignal: options.abortSignal,
   });
   let pick = await pickWithWait({
-    eligible: payloadEligible,
+    eligible: targetEligible,
     now: initialNow,
   });
 
@@ -349,6 +395,7 @@ export async function executeComboResponses(
   }
 
   if (!pick) {
+    if (onlyReplayIncompatibleTargetsRemain()) return targetIncompatibleResponse();
     return options.abortSignal?.aborted
       ? clientCancelledResponse()
       : comboUnavailable(comboId);
@@ -357,6 +404,26 @@ export async function executeComboResponses(
   // adoption below must never replace it with a concrete child route trace.
   logCtx.routeDecision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
 
+  const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
+    ? (body as { reasoning?: unknown }).reasoning
+    : undefined;
+  const originalRequestedEffortValue = originalReasoning && typeof originalReasoning === "object" && !Array.isArray(originalReasoning)
+    ? (originalReasoning as { effort?: unknown }).effort
+    : undefined;
+  const originalRequestedEffort = typeof originalRequestedEffortValue === "string"
+    && isDeclaredReasoningEffort(originalRequestedEffortValue)
+    ? originalRequestedEffortValue
+    : undefined;
+  const restoreOriginalRequestedEffort = (childLog: RequestLogContext): void => {
+    if (originalRequestedEffort === undefined) return;
+    const normalizedRequestedEffort = childLog.requestedEffort;
+    const transitionIndex = normalizedRequestedEffort?.indexOf("->") ?? -1;
+    childLog.requestedEffort = transitionIndex >= 0
+      ? `${originalRequestedEffort}${normalizedRequestedEffort!.slice(transitionIndex)}`
+      : originalRequestedEffort;
+    recordAttemptRequestedEffort(childLog);
+  };
+
   let lastFailure: Response | null = null;
   // Dispatched targets, not attempted picks: it indexes the declared target list so the clamp
   // below can tell how many targets are still entitled to a send.
@@ -407,6 +474,7 @@ export async function executeComboResponses(
       comboDefaultEffort(config, comboId),
       supportedLadderFor({ provider: targetRoute.provider, modelId: targetRoute.modelId }),
       combo.reasoningEffortMode,
+      combo.defaultEffortMode,
     );
     const childHeaders = buildComboChildHeaders(req.headers);
     const childRequest = new Request(req.url, {
@@ -425,6 +493,13 @@ export async function executeComboResponses(
       config.providers[pick.target.provider]!.adapter,
     );
     childLog.activeAttempt = attempt;
+    if (originalRequestedEffort !== undefined) {
+      childLog.requestedEffort = originalRequestedEffort;
+      recordAttemptRequestedEffort(childLog);
+    }
+    childLog.activeAttemptStartedAt = started;
+    childLog.attempts = logCtx.attempts ??= [];
+    childLog.attempts.push(attempt);
     let attemptRetained = false;
     const retainCancelledAttempt = (): void => {
       if (attemptRetained) return;
@@ -435,7 +510,6 @@ export async function executeComboResponses(
         childLog.accountLogLabel,
       );
       finishRequestAttempt(attempt, 499, Date.now() - started, childLog.usage);
-      (logCtx.attempts ??= []).push(attempt);
       attemptRetained = true;
     };
     const completedTarget = { provider: pick.target.provider, model: pick.target.model };
@@ -472,7 +546,7 @@ export async function executeComboResponses(
       const deferCodexResetDerivedCooldown = combo.strategy === "failover"
         && combo.targets.slice(pick.targetIndex + 1).some(target =>
           target.provider === currentTargetProvider
-          && payloadEligible(target)
+          && targetEligible(target)
           && !isComboTargetInCooldown(comboId, target),
         );
       response = await requestDispatchers.handleResponses(childRequest, config, childLog, {
@@ -499,12 +573,14 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
+      restoreOriginalRequestedEffort(childLog);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
 
@@ -526,6 +602,7 @@ export async function executeComboResponses(
           retainCancelledAttempt();
           return clientCancelledResponse();
         }
+        finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
         throw error;
       }
       if (preflight.kind === "failed") {
@@ -546,7 +623,6 @@ export async function executeComboResponses(
         childLog.providerAdapter ?? attempt.adapter,
         childLog.accountLogLabel,
       );
-      (logCtx.attempts ??= []).push(attempt);
       attemptRetained = true;
       noteComboSuccess(comboId, combo, pick.target, pick.writerGeneration);
       Object.assign(logCtx, childLog, {
@@ -580,6 +656,7 @@ export async function executeComboResponses(
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
     if (options.abortSignal?.aborted) {
@@ -598,7 +675,6 @@ export async function executeComboResponses(
       Date.now() - started,
       failure.usage,
     );
-    (logCtx.attempts ??= []).push(attempt);
     attemptRetained = true;
     lastFailure = failure.response;
     lastFailedChildLog = childLog;
@@ -664,7 +740,7 @@ export async function executeComboResponses(
       cooldownScope: comboFailureCooldownScope(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
       }),
-      eligible: payloadEligible,
+      eligible: targetEligible,
       status: failure.response.status,
       code: failure.upstreamCode,
       message: failure.classificationText,
@@ -674,12 +750,16 @@ export async function executeComboResponses(
     } else {
       pick = await pickWithWait({
         exclude: pick.attempted,
-        eligible: payloadEligible,
+        eligible: targetEligible,
         now: failureNow,
       });
     }
     if (!pick) {
       if (options.abortSignal?.aborted) return clientCancelledResponse();
+      if (onlyReplayIncompatibleTargetsRemain(attemptedTargets)) {
+        adoptFailedChildLog(childLog);
+        return targetIncompatibleResponse();
+      }
       if (unreadableEncryptedAgentTask && !comboPayloadReadable) {
         const recoveredTarget = await pickWithWait({
           exclude: attemptedTargets,

package/src/server/responses/core-errors.ts

@@ -150,3 +150,21 @@ export function unreadableEncryptedAgentTaskResponse(reason?: AgentTaskRecoveryF
     { status: 400, headers: { "Content-Type": "application/json" } },
   );
 }
+
+
+export const TARGET_INCOMPATIBLE_MESSAGE =
+  "No remaining combo target can continue this tool-bearing history because the reasoning required for replay is unavailable after the serving route changed. Start a new conversation or configure a combo target that can consume the available reasoning.";
+
+
+export function targetIncompatibleResponse(): Response {
+  return new Response(
+    JSON.stringify({
+      error: {
+        message: TARGET_INCOMPATIBLE_MESSAGE,
+        type: "invalid_request_error",
+        code: "target_incompatible",
+      },
+    }),
+    { status: 400, headers: { "Content-Type": "application/json" } },
+  );
+}

package/src/server/responses/core-replay.ts

@@ -27,6 +27,7 @@ import type { OAuthAccessSnapshot } from "../../oauth";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { thoughtSignatureReplaySalt } from "../../responses/thought-signature-replay";
 import { randomUUID } from "node:crypto";
+import { requiresPlaintextReasoningReplay } from "../../adapters/openai-responses/passthrough";
 
 /**
  * Adapters whose continuation state must survive Codex's store:false requests.
@@ -107,6 +108,53 @@ export function bindRouteReasoningReplayScope(args: {
   forwardHeaders?: Headers;
 }): void {
   const { parsed, providerName, provider, adapterName } = args;
+  const replayIdentity = routeReasoningReplayIdentity({
+    ...args,
+    modelId: parsed.modelId,
+  });
+  const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
+  const continuationOwner = providerContinuationOwnerFromReplayIdentity(
+    replayIdentity && continuationDestinationIdentity
+      ? { ...replayIdentity, providerDestinationIdentity: continuationDestinationIdentity }
+      : undefined,
+  );
+  if (adapterName === "cursor") {
+    // The final route owner is authoritative for Cursor and supersedes the account-derived
+    // seed assigned before route binding. A Cursor conversation must be scoped to the exact
+    // provider/destination/adapter/model/credential that serves it.
+    if (continuationOwner) parsed._cursorIdentityScope = providerContinuationRouteScope(continuationOwner);
+    else if (!parsed._cursorIdentityScope?.startsWith("cursor-unowned:")) {
+      // Prevent the adapter's token-only fallback from recreating a provider-private id after the
+      // route owner failed closed. The sentinel is per parsed request and contains no credential.
+      parsed._cursorIdentityScope = `cursor-unowned:${randomUUID()}`;
+    }
+  }
+  bindReasoningReplayScope(
+    parsed._reasoningReplayScope,
+    replayIdentity,
+  );
+  // Keep this sticky for the whole outbound request: a later auth/key rebind may compare equal
+  // after the first mismatch, but it cannot make history minted by the prior route decodable.
+  if (reasoningReplayServingIdentityChanged(parsed._reasoningReplayScope)) {
+    parsed._stripReasoningEncryptedContent = true;
+  }
+  if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
+    parsed._stripReasoningEncryptedContent = true;
+  }
+  bindProviderContinuationForRoute(parsed, continuationOwner);
+}
+
+
+function routeReasoningReplayIdentity(args: {
+  providerName: string;
+  provider: OcxProviderConfig;
+  adapterName: string;
+  modelId: string;
+  oauthCredentialSnapshot?: Pick<OAuthAccessSnapshot, "accountId" | "generation">;
+  codexAuthContext?: CodexAuthContext;
+  forwardHeaders?: Headers;
+}): OcxReasoningReplayIdentity | undefined {
+  const { providerName, provider, adapterName, modelId } = args;
   let credentialIdentity: string | undefined;
   let credentialDurableIdentity: string | undefined;
   const durableSalt = thoughtSignatureReplaySalt();
@@ -165,47 +213,72 @@ export function bindRouteReasoningReplayScope(args: {
     );
   }
   const providerDestinationIdentity = reasoningReplayDestinationIdentity(provider.baseUrl);
-  const replayIdentity: OcxReasoningReplayIdentity | undefined = credentialIdentity && providerDestinationIdentity
+  return credentialIdentity && providerDestinationIdentity
     ? {
         providerName,
         providerDestinationIdentity,
         providerDestinationDurableIdentity: durableReplayDestinationIdentity(provider.baseUrl),
         adapterName,
-        modelId: parsed.modelId,
+        modelId,
         credentialIdentity,
         ...(credentialDurableIdentity ? { credentialDurableIdentity } : {}),
       }
     : undefined;
-  const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
-  const continuationOwner = providerContinuationOwnerFromReplayIdentity(
-    replayIdentity && continuationDestinationIdentity
-      ? { ...replayIdentity, providerDestinationIdentity: continuationDestinationIdentity }
-      : undefined,
-  );
-  if (adapterName === "cursor") {
-    // The final route owner is authoritative for Cursor and supersedes the account-derived
-    // seed assigned before route binding. A Cursor conversation must be scoped to the exact
-    // provider/destination/adapter/model/credential that serves it.
-    if (continuationOwner) parsed._cursorIdentityScope = providerContinuationRouteScope(continuationOwner);
-    else if (!parsed._cursorIdentityScope?.startsWith("cursor-unowned:")) {
-      // Prevent the adapter's token-only fallback from recreating a provider-private id after the
-      // route owner failed closed. The sentinel is per parsed request and contains no credential.
-      parsed._cursorIdentityScope = `cursor-unowned:${randomUUID()}`;
-    }
-  }
-  bindReasoningReplayScope(
-    parsed._reasoningReplayScope,
-    replayIdentity,
-  );
-  // Keep this sticky for the whole outbound request: a later auth/key rebind may compare equal
-  // after the first mismatch, but it cannot make history minted by the prior route decodable.
-  if (reasoningReplayServingIdentityChanged(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
-  }
-  if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
-  }
-  bindProviderContinuationForRoute(parsed, continuationOwner);
+}
+
+
+/**
+ * Whether this exact route cannot satisfy its documented plaintext reasoning replay contract.
+ *
+ * A generic plaintext-preserving gateway is not made ineligible. Unknown serving provenance also
+ * stays eligible; only a proven route mismatch may suppress a combo candidate.
+ */
+export function mandatoryResponsesReasoningReplayUnavailable(args: {
+  body: unknown;
+  clientThreadId: string | undefined;
+  providerName: string;
+  provider: OcxProviderConfig;
+  adapterName: string;
+  modelId: string;
+}): boolean {
+  const { body, clientThreadId, provider, adapterName } = args;
+  if (
+    adapterName !== "openai-responses"
+    || !requiresPlaintextReasoningReplay(provider)
+    || !clientThreadId
+    || !requestCarriesTools(body)
+    || !hasOpaqueOnlyReasoningItem(body)
+  ) return false;
+
+  const current = routeReasoningReplayIdentity(args);
+  return reasoningReplayServingIdentityChanged({ clientThreadId, current });
+}
+
+
+function requestCarriesTools(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  return Array.isArray((body as { tools?: unknown }).tools)
+    && (body as { tools: unknown[] }).tools.length > 0;
+}
+
+
+function hasOpaqueOnlyReasoningItem(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const input = (body as { input?: unknown }).input;
+  if (!Array.isArray(input)) return false;
+  return input.some(item => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+    const reasoning = item as Record<string, unknown>;
+    if (reasoning.type !== "reasoning" || typeof reasoning.encrypted_content !== "string") return false;
+    const content = reasoning.content;
+    const hasPlaintext = Array.isArray(content) && content.some(part =>
+      !!part && typeof part === "object" && !Array.isArray(part)
+      && (part as Record<string, unknown>).type === "reasoning_text"
+      && typeof (part as Record<string, unknown>).text === "string"
+      && ((part as Record<string, unknown>).text as string).length > 0
+    );
+    return !hasPlaintext;
+  });
 }
 
 

package/src/server/responses/core.ts

@@ -10,6 +10,7 @@ import { createTranslatorBudget } from "../../lib/translator-budget";
 import { captureExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import { captureCallerDirectAuth } from "../../providers/caller-authorization";
 import { createRequestExecutionBudget } from "../../lib/request-execution-budget";
+import { attachRequestSpendTracker } from "./request-spend";
 import { finalizeOwnedTranslatorBudget } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
@@ -56,9 +57,8 @@ export async function handleResponses(
       visionDescribeTerminal: options.visionDescribeTerminal === true
         || req.headers.get("x-opencodex-vision-describe") === "1",
       translatorBudget,
-      // Created once at genuine ingress; a combo child arrives with the parent's holder already
-      // in options and must not start a fresh allowance.
-      sendBudget: options.sendBudget ?? createRequestExecutionBudget(),
+      // Once at ingress, spend observer included: a combo child inherits the parent's holder.
+      sendBudget: options.sendBudget ?? createRequestExecutionBudget(undefined, undefined, attachRequestSpendTracker(req, logCtx)),
     });
     return ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
   } catch (error) {

package/src/server/responses/encrypted-payload.ts

@@ -78,7 +78,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,