@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/codex/routing/cooldown-math.ts

@@ -5,6 +5,7 @@ import {
 } from "../quota";
 import { isThirtyDayOnlyCodexPlan } from "../plan";
 import type { CodexQuotaScope } from "./health-store";
+import type { TransientProbeGrant } from "./thread-affinity";
 
 export const CODEX_DEFAULT_QUOTA_COOLDOWN_MS = 60_000;
 export const CODEX_MAX_QUOTA_COOLDOWN_MS = 24 * 60 * 60_000;
@@ -78,6 +79,15 @@ export type CodexUpstreamOutcomeMeta = {
   probeLeaseId?: string;
   /** Scope of `probeLeaseId` when it was granted against a model-scoped cooldown. */
   probeQuotaScope?: CodexQuotaScope;
+  /**
+   * The half-open TRANSIENT-HOLD probe this request was granted, when it was the one request
+   * admitted to test a held account (#4701). A different lease to `probeLeaseId` above, in a
+   * different domain: that one governs a quota cooldown, this one governs a 5xx hold. The two
+   * are mutually exclusive by construction -- `isTransientOnlyAffinityBlock` refuses to
+   * recognise a transient hold on an account that carries quota health -- so a request never
+   * holds both and never pays two recovery permits for one send.
+   */
+  transientProbe?: TransientProbeGrant;
   /**
    * Already-chosen alternate for same-request 429 retry. When set, promotion
    * reuses this account instead of calling {@link pickAlternateCodexAccount}

package/src/codex/routing/selection.ts

@@ -123,6 +123,39 @@ export function codexAccountBlockReason(
   return undefined;
 }
 
+/**
+ * Drop accounts a confirmed roster says cannot serve this model, unless that leaves nothing.
+ *
+ * The restore-on-empty is the whole safety argument, not a defensive afterthought. Roster
+ * evidence can be wrong in the direction that matters: a shard that has not caught up reports a
+ * denial for a model the account genuinely owns, and #3022 is what happens when absence is
+ * allowed to remove a model outright. Because this can only ever return a non-empty subset of a
+ * list the caller already computed, no pool that would have found a working account can be left
+ * without one — the worst case is the selection that ships today.
+ *
+ * It is an ordering rule rather than an eligibility one for the same reason. Nothing below
+ * reports `model_not_entitled`, nothing refuses before dispatch, and the existing bounded
+ * alternate-account retry on an exact unsupported-model 400 stays exactly where it is as the
+ * safety net. This only stops the pool from CHOOSING an account that has already told us it
+ * cannot serve the model (#4768).
+ *
+ * An operator's manual pin is never dropped. Roster evidence orders the pool's own discretion;
+ * it does not overrule an explicit human choice, and removing the pinned account here would do
+ * more than demote it -- `selectPriorityTier` reads the pin to lower the tier ceiling, so a pin
+ * filtered out beforehand stops acting as a ceiling at all and silently re-enables tiers the
+ * operator had excluded. An operator who pins an account upstream will refuse still gets the
+ * alternate-account retry; what they do not get is the pool quietly deciding they were wrong.
+ */
+export function withoutModelDeniedAccounts(
+  ids: readonly string[],
+  denied: ReadonlySet<string> | undefined,
+  pinned?: string,
+): readonly string[] {
+  if (denied === undefined || ids.length === 0) return ids;
+  const remaining = ids.filter(id => !denied.has(id) || id === pinned);
+  return remaining.length > 0 ? remaining : ids;
+}
+
 export function getEligiblePoolAccounts(
   config: OcxConfig,
   excludeId?: string,
@@ -168,11 +201,16 @@ export function getEligiblePoolAccounts(
   // Single choke point for selection order: every strategy, failover, and preview
   // reaches the pool through here, so tiering applies once rather than per picker.
   // Eligibility above is unchanged — this only narrows an already-eligible list.
+  //
+  // Model entitlement is applied BEFORE the priority tier, because a tier is a quota-ordering
+  // question and an account that cannot serve the model at all should not be the reason a tier
+  // is selected. Both steps narrow an already-eligible list and neither can empty it.
+  const pinned = pinnedCodexAccountId(config);
   return selectPriorityTier(
-    ids,
+    withoutModelDeniedAccounts(ids, selectionOptions?.deniedModelAccountIds, pinned),
     codexAccountPriorityLookup(config),
     id => hasCodexQuotaHeadroom(config, id, selectionOptions, now),
-    pinnedCodexAccountId(config),
+    pinned,
   );
 }
 
@@ -563,6 +601,45 @@ export function isUnknownUsage(usage: number): boolean {
   return usage >= CODEX_UNKNOWN_USAGE_SCORE;
 }
 
+/**
+ * Correct a shared cursor that names an account this model's own roster denies (#4768).
+ *
+ * {@link getEligiblePoolAccounts} is not the only door into selection. An account that is already
+ * ACTIVE is served straight from {@link isCodexAccountSelectable} and never passes through the
+ * eligible list, so ordering that list alone left the exact case the issue reports: once the Free
+ * account becomes the cursor, every Sol/Astra request keeps going to it and keeps taking the
+ * upstream unsupported-model 400. {@link pickPriorityPreemption} does not cover it either -- it
+ * refuses to move toward a tier that does not strictly outrank the active one, which is the usual
+ * shape here.
+ *
+ * Three properties keep this inside "order the already-eligible set" rather than widening it.
+ * It admits nothing: the replacement comes from {@link getEligiblePoolAccounts}, so every
+ * eligibility guard has already passed on it. It cannot fail: with no entitled alternative the
+ * active account is returned unchanged, so this can never turn a served request into `none`.
+ * And it changes nothing without evidence: absent `deniedModelAccountIds`, or an active account
+ * nobody denied, it is the identity function.
+ *
+ * The caller must NOT persist the result. This is one request's correction for one model, in the
+ * same spirit as a model detour; the operator's cursor is theirs. A pinned active account is
+ * exempt outright, for the reason {@link withoutModelDeniedAccounts} gives.
+ */
+export function preferModelEntitledAccount(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string {
+  const denied = selectionOptions?.deniedModelAccountIds;
+  if (denied === undefined || !denied.has(active)) return active;
+  if (pinnedCodexAccountId(config) === active) return active;
+  // The eligible list restores denied members when filtering would empty it, so re-filter here:
+  // moving from one denied account to another buys nothing and costs the warm prefix.
+  const entitled = getEligiblePoolAccounts(config, active, now, quotaScope, selectionOptions)
+    .filter(id => !denied.has(id));
+  return pickLowestUsageAmong(config, entitled, selectionOptions, now) ?? active;
+}
+
 /**
  * Move an unbound request back up when a higher tier regains headroom — the
  * weekly-reset case. Returns null when nothing should change.

package/src/codex/routing/thread-affinity.ts

@@ -4,6 +4,8 @@ import { retainedUtf8Bytes } from "../../lib/admission";
 import { clearAllCodexPoolRefreshFailures } from "../pool-refresh-backoff";
 import type { CodexThreadLineage } from "../lineage";
 import type { CodexQuotaScope } from "./health-store";
+import type { TransientProbeLease } from "../../routing/probe-lease";
+import { clearPoolRecoveryState } from "../../routing/probe-lease";
 
 export type ThreadAffinityEntry = {
   accountId: string;
@@ -25,10 +27,51 @@ export type ThreadAffinityEntry = {
   transientDetourAccountId?: string;
 };
 
+/**
+ * The half-open trial this request was granted against its own held account (#4701).
+ *
+ * The lease alone is not enough to settle safely. Its generation is an account-local PROBE
+ * epoch, while {@link ThreadAffinityEntry.generation} is the selected CREDENTIAL generation,
+ * and the two move independently: a credential replaced while the probe is in flight leaves
+ * the probe epoch untouched, so a settle that checked only the lease would write an answer
+ * about a credential that no longer exists. Capturing the affinity generation here is what
+ * lets the settle refuse that case.
+ */
+export interface TransientProbeGrant {
+  readonly lease: TransientProbeLease;
+  /** Credential generation the binding held when the probe was granted. */
+  readonly affinityGeneration: number;
+}
+
 export type CodexThreadResolution =
-  | { status: "selected"; accountId: string; affinity?: CodexAffinityDecision }
+  | {
+    status: "selected";
+    accountId: string;
+    affinity?: CodexAffinityDecision;
+    /**
+     * Present only when this request is the single admitted probe of a held account. The
+     * holder owes the lease a settle or a release; nothing else may act on it.
+     */
+    transientProbe?: TransientProbeGrant;
+  }
   | { status: "none"; affinity?: CodexAffinityDecision }
-  | { status: "expired"; accountId: string; affinity?: CodexAffinityDecision };
+  | { status: "expired"; accountId: string; affinity?: CodexAffinityDecision }
+  /**
+   * Every candidate for this binding is held and no detour is left, so there is no account
+   * this request may be sent to. Distinct from `none`: the binding is REMEMBERED and the
+   * caller is told when to come back, rather than being handed the account already known to
+   * be failing. Returning `selected` here is the "must not send, sends anyway" defect
+   * (#4701); the caller must refuse before any upstream I/O.
+   */
+  | {
+    status: "withheld";
+    accountId: string;
+    /** Earliest moment a recovery dispatch could be admitted. Always strictly in the future. */
+    retryAt: number;
+    /** The remembered detour, when one exists but is itself unusable right now. */
+    detourAccountId?: string;
+    affinity?: CodexAffinityDecision;
+  };
 
 /** What happened to this thread's binding on this request (#4546). */
 export type CodexAffinityMove =
@@ -163,6 +206,11 @@ export function clearThreadAccountMap(): void {
   // A refresh cooldown is per-account runtime state learned alongside these bindings. Leaving it
   // behind here keeps an account out of selection after the roster it belonged to is gone.
   clearAllCodexPoolRefreshFailures();
+  // Same argument for recovery state (#4701): probe pacing is keyed on account ids this reset
+  // may have just retired, and the recovery window counts sends made by the roster that is
+  // going away. A held account nobody may probe because of a lease issued against the previous
+  // roster is a recovery that never starts.
+  clearPoolRecoveryState();
   conversationStateIssuerMap.clear();
 }
 

package/src/codex/routing/transient-hold-dispatch.ts

@@ -0,0 +1,141 @@
+import { isCodexAccountGenerationLive } from "../account-store";
+// From `../account-id`, which declares the constant and imports nothing, rather than from
+// `../main-account`, which re-exports it and sits inside the routing/account-lifecycle import
+// cycle. Neither reference here runs at module load, but a leaf import keeps this module out of
+// that cycle entirely instead of relying on that staying true.
+import { MAIN_CODEX_ACCOUNT_ID } from "../account-id";
+import {
+  invalidateTransientProbe,
+  releaseTransientProbe,
+  resolveHeldAccountDispatch,
+  settleTransientProbe,
+} from "../../routing/probe-lease";
+import {
+  CODEX_TRANSIENT_AFFINITY_HOLD_MS,
+  type CodexThreadResolution,
+  type ThreadAffinityEntry,
+  type TransientProbeGrant,
+} from "./thread-affinity";
+import type { CodexUpstreamOutcomeClass, CodexUpstreamOutcomeMeta } from "./cooldown-math";
+
+/**
+ * What a request bound to a HELD account may actually do, and how its trial ends (#4701).
+ *
+ * The transient hold (#4546) keeps a thread's binding while its own account serves a 5xx
+ * streak and detours the request to a healthy sibling. Both of the selector's hold branches
+ * used to end the same way when no sibling could take it: they returned the held account as
+ * `selected`, and the caller sent at an account already known to be failing. Under a
+ * provider-wide 503 that is every bound request at once -- the amplification the hold exists
+ * to prevent rather than cause.
+ *
+ * This module is the seam between the selector and the bounded answer in
+ * `src/routing/probe-lease.ts`. It is separate from `./probe-lease` in this same directory,
+ * which is the unrelated QUOTA-COOLDOWN lease; the two govern different domains and must never
+ * settle each other's probe.
+ */
+
+/** Has a held binding waited longer than a transient failure can reasonably explain? */
+export function isTransientHoldExpired(entry: ThreadAffinityEntry, now: number): boolean {
+  return entry.transientHoldSince !== undefined
+    && now - entry.transientHoldSince > CODEX_TRANSIENT_AFFINITY_HOLD_MS;
+}
+
+/**
+ * Where a request bound to a held account goes this turn.
+ *
+ * {@link resolveHeldAccountDispatch} bounds the answer: one probe tests the held account, and a
+ * caller with nowhere else to go is WITHHELD and told when to come back rather than sent at the
+ * failure.
+ *
+ * A usable detour is taken BEFORE that resolver is consulted, which inverts its own probe-first
+ * ordering. Deliberately: a healthy sibling is always a better answer for a live request than an
+ * account carrying a failure streak, and turning the first request after a hold into the trial
+ * would spend a real user's turn on it. The ordering is not what #4701 bounds -- the defect is
+ * the third answer the selector used to give, "send at the failing account anyway", and that is
+ * reached only when no detour exists. Recovery is still discovered there, because that is
+ * exactly the case where nothing else can find out.
+ *
+ * The caller has already committed `transientHoldSince`/`lastUsedAt`; this decides only where
+ * the request goes. A withheld answer deliberately leaves `transientDetourAccountId` alone:
+ * being unable to send right now says nothing about which sibling was serving this thread.
+ */
+export function resolveTransientHoldDispatch(
+  entry: ThreadAffinityEntry,
+  detour: string | null,
+  now: number,
+): CodexThreadResolution {
+  if (detour !== null && detour !== entry.accountId) {
+    entry.transientDetourAccountId = detour;
+    // Deliberately no promotion and no rebind: this is one request routing around a blip, not
+    // the pool deciding where the conversation now lives.
+    return { status: "selected", accountId: detour, affinity: { move: "detour", reason: "transient" } };
+  }
+  const dispatch = resolveHeldAccountDispatch({ boundAccountId: entry.accountId, now });
+  if (dispatch.kind === "probe") {
+    return {
+      status: "selected",
+      accountId: entry.accountId,
+      affinity: { move: "held", reason: "transient" },
+      // The credential generation travels with the lease so a settle can refuse an answer about
+      // a credential this binding no longer has. See {@link TransientProbeGrant}.
+      transientProbe: { lease: dispatch.lease, affinityGeneration: entry.generation },
+    };
+  }
+  if (dispatch.kind === "withheld") {
+    return {
+      status: "withheld",
+      accountId: dispatch.boundAccountId,
+      retryAt: dispatch.retryAt,
+      // The remembered sibling, when there is one. It is unusable right now -- that is why this
+      // request is refused -- but it is what has been serving this thread, and a refusal that
+      // dropped it would make the next resolve re-pick cold.
+      ...(entry.transientDetourAccountId !== undefined
+        ? { detourAccountId: entry.transientDetourAccountId }
+        : {}),
+      affinity: { move: "held", reason: "transient" },
+    };
+  }
+  // Unreachable: no detour was handed in, so the resolver has none to hand back. Kept total
+  // rather than cast away, because the cost of being wrong here is a send at a failing account.
+  entry.transientDetourAccountId = dispatch.accountId;
+  return { status: "selected", accountId: dispatch.accountId, affinity: { move: "detour", reason: "transient" } };
+}
+
+/** Does the credential a probe was granted against still exist at that generation? */
+function transientProbeCredentialLive(accountId: string, generation: number): boolean {
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) return generation === 0;
+  return isCodexAccountGenerationLive(accountId, generation);
+}
+
+/**
+ * Conclude the half-open recovery probe this request was holding.
+ *
+ * Three answers, because three things can be true of a probe that just ended:
+ *
+ * - The credential moved under it. Its result describes an identity the binding no longer has,
+ *   so the epoch is BURNED instead of settled -- invalidating makes every outstanding lease on
+ *   this account stale at once, which is what stops a late answer from reviving a dead account.
+ * - The answer says nothing about the account. A 3xx, a 400, or an unclassifiable status is the
+ *   request's problem, not the account's, so the lease is handed back unspent and the next
+ *   request may run a real trial instead of waiting out a recovery nobody observed.
+ * - Otherwise it is evidence: success means recovered, everything else means still failing.
+ *
+ * A no-op when this request held no trial, so the outcome recorder calls it unconditionally.
+ */
+export function settleTransientProbeForOutcome(
+  accountId: string,
+  meta: Pick<CodexUpstreamOutcomeMeta, "transientProbe" | "now">,
+  outcomeClass: CodexUpstreamOutcomeClass,
+): void {
+  const grant: TransientProbeGrant | undefined = meta.transientProbe;
+  if (!grant) return;
+  if (!transientProbeCredentialLive(accountId, grant.affinityGeneration)) {
+    invalidateTransientProbe(accountId);
+    return;
+  }
+  if (outcomeClass === "neutral" || outcomeClass === "caller" || outcomeClass === "unknown") {
+    releaseTransientProbe(grant.lease);
+    return;
+  }
+  settleTransientProbe(grant.lease, outcomeClass === "success" ? "recovered" : "failed", meta.now ?? Date.now());
+}

package/src/codex/routing.ts

@@ -54,6 +54,13 @@ import {
   type CodexUpstreamHealth,
 } from "./routing/health-store";
 import { ownsProbeLease, probeMayClearCooldown, withProbeLeaseReleased } from "./routing/probe-lease";
+// `./routing/probe-lease` above is the QUOTA-COOLDOWN lease; the module below owns the
+// unrelated TRANSIENT-HOLD trial and the pool-wide recovery bound above it (#4701).
+import {
+  isTransientHoldExpired,
+  resolveTransientHoldDispatch,
+  settleTransientProbeForOutcome,
+} from "./routing/transient-hold-dispatch";
 import {
   adoptLegacyLineageAffinity,
   affinityAfterRelease,
@@ -85,7 +92,6 @@ import {
   getPoolAccountPlanForSelection,
   hasCodexQuotaHeadroom,
   isCodexAccountPlanExcluded,
-  isCacheAffinityEnabled,
   isCodexAccountSelectable,
   isHealthySharedCodexSelection,
   isUnknownUsage,
@@ -96,11 +102,13 @@ import {
   pickPriorityPreemption,
   pickResetFirstCodexAccount,
   pickUnboundStrategyAccount,
+  preferModelEntitledAccount,
   sharedStateSelectionOptions,
   strategySelectionOptionsForModelDetour,
   shouldFailover,
   peekAlternateCodexAccount,
 } from "./routing/selection";
+import { mayRebindAffinityForQuota } from "./routing/cache-affinity";
 import {
   clearAllManualPreferences,
   consumeManualPreference,
@@ -181,6 +189,7 @@ export type {
   CodexAffinityMove,
   CodexAffinityReason,
   CodexAffinityDecision,
+  TransientProbeGrant,
 } from "./routing/thread-affinity";
 export {
   isCodexAccountPlanExcluded,
@@ -276,12 +285,6 @@ function isTransientOnlyAffinityBlock(
     || isCodexPoolRefreshCooling(entry.accountId, now);
 }
 
-/** Has a held binding waited longer than a transient failure can reasonably explain? */
-function isTransientHoldExpired(entry: ThreadAffinityEntry, now: number): boolean {
-  return entry.transientHoldSince !== undefined
-    && now - entry.transientHoldSince > CODEX_TRANSIENT_AFFINITY_HOLD_MS;
-}
-
 /**
  * Is every pin this thread holds on the failing account past its hold window?
  *
@@ -477,6 +480,8 @@ export function resolveCodexAccountForThread(
   lineage?: CodexThreadLineage,
 ): string | null {
   const resolution = resolveCodexAccountForThreadDetailed(threadId, config, now, quotaScope, undefined, undefined, lineage);
+  // A WITHHELD dispatch is deliberately not an account here: this wrapper cannot carry a retry
+  // time, and answering with the held account is the send the hold prevents. Fails closed.
   return resolution.status === "selected" ? resolution.accountId : null;
 }
 
@@ -583,34 +588,6 @@ function previewReusableAffinityAccount(
   return entry.accountId;
 }
 
-/**
- * May a LIVE binding be moved for quota reasons?
- *
- * Default: no. The bar is genuine exhaustion, because moving a bound conversation discards
- * the prompt cache warmed on its account and a threshold crossing is a hint that the account
- * is getting busy rather than evidence it cannot serve (#4546). Deliberately NOT
- * `hasCodexQuotaHeadroom`, which reads `usage < autoSwitchThreshold` and would reproduce the
- * old rule under a new name.
- *
- * With `pool.cacheAffinity: false` the historical rule comes back: a crossing of
- * `autoSwitchThreshold` is enough. That is capacity-first routing, and an operator who wants
- * it keeps it -- but it is no longer what an install gets by never having heard of the flag.
- */
-function mayRebindAffinityForQuota(
-  config: OcxConfig,
-  accountId: string,
-  usage: number,
-  threshold: number,
-  selectionOptions?: CodexAccountUsabilityOptions,
-): boolean {
-  const overThreshold = threshold > 0 && !isUnknownUsage(usage) && usage >= threshold;
-  if (!isCacheAffinityEnabled(config)) return overThreshold;
-  // The usable half is already guaranteed by both callers, which gate on
-  // isCodexAccountSelectable; kept explicit so the predicate reads correctly on its own.
-  return !isCodexAccountUsable(config, accountId, selectionOptions)
-    || (!isUnknownUsage(usage) && usage >= 100);
-}
-
 /** Reset ordering may move a binding only under the existing cache-affinity release policy. */
 function resetFirstAffinityReplacement(
   entry: ThreadAffinityEntry,
@@ -843,6 +820,9 @@ export function previewCodexAccountForRequest(
     const best = pickLowestUsageCodexAccount(config, active, now, quotaScope, selectionOptions);
     if (best) active = best;
   }
+  // Same correction resolve applies, for the same reason: preview must name the account the
+  // request will actually use, or subagent fallback scores a model against the wrong one.
+  active = preferModelEntitledAccount(config, active, now, quotaScope, selectionOptions);
   if (!isCodexAccountUsable(config, active, selectionOptions)) {
     return hasConfiguredPoolAccount(config, active, selectionOptions) ? active : null;
   }
@@ -936,15 +916,12 @@ export function resolveCodexAccountForThreadDetailed(
         const lane = transientDetourAccount(config, detourEntry, now, quotaScope, selectionOptions);
         detourEntry.transientHoldSince ??= now;
         detourEntry.lastUsedAt = now;
-        if (lane !== null && lane !== detourEntry.accountId) {
-          detourEntry.transientDetourAccountId = lane;
-          return { status: "selected", accountId: lane, affinity: { move: "detour", reason: "transient" } };
-        }
         // A provider-wide outage soft-avoids every sibling, so there is nowhere to detour.
         // That is a statement about where this request can go, not about who owns the
         // conversation: dropping the pin here would rebuild the cold prefix elsewhere for
-        // exactly the failure mode the hold exists to survive.
-        return { status: "selected", accountId: detourEntry.accountId, affinity: { move: "held", reason: "transient" } };
+        // exactly the failure the hold exists to survive -- nor a licence to send at the
+        // failing account, which is what the dispatch resolver bounds (#4701).
+        return resolveTransientHoldDispatch(detourEntry, lane, now);
       }
       // Detour expiry or invalidation must not expire the ordinary task. Drop only
       // this model lane and select from ordinary/shared state below.
@@ -1018,16 +995,11 @@ export function resolveCodexAccountForThreadDetailed(
       const detour = transientDetourAccount(config, entry, now, quotaScope, selectionOptions);
       entry.transientHoldSince ??= now;
       entry.lastUsedAt = now;
-      if (detour !== null && detour !== entry.accountId) {
-        entry.transientDetourAccountId = detour;
-        // Deliberately no promoteActiveCodexAccount and no rebind: this is one request routing
-        // around a blip, not the pool deciding where the conversation now lives.
-        return { status: "selected", accountId: detour, affinity: { move: "detour", reason: "transient" } };
-      }
       // No sibling can take it either -- the usual shape of a provider-wide 503. The binding
       // survives: "cannot send right now" and "forget which account owns this conversation"
-      // are different answers, and conflating them is what the hold was added to stop.
-      return { status: "selected", accountId: entry.accountId, affinity: { move: "held", reason: "transient" } };
+      // are different answers. So is the third answer this used to give -- "send at the
+      // failing account" -- now a bounded probe or a typed refusal (#4701).
+      return resolveTransientHoldDispatch(entry, detour, now);
     }
     // A model-only exclusion does not invalidate the shared task binding. Health,
     // generation, pause, cooldown, and failure evidence still retire it normally.
@@ -1241,6 +1213,10 @@ export function resolveCodexAccountForThreadDetailed(
     selectionOptions,
     !preserveSharedSelectionForModelDetour,
   );
+  // The shared cursor can name an account whose own roster denies this model, and an active
+  // account never passes through the eligible list. Correct it for THIS request only -- nothing
+  // is persisted -- and only toward an account eligibility already admitted (#4768).
+  active = preferModelEntitledAccount(config, active, now, quotaScope, selectionOptions);
   if (!isCodexAccountUsable(config, active, selectionOptions)) {
     return hasConfiguredPoolAccount(config, active, selectionOptions)
       ? { status: "selected", accountId: active, affinity: affinityAfterRelease(threadId, releaseReason) }
@@ -1277,6 +1253,10 @@ export function recordCodexUpstreamOutcome(
     recordUpstreamHostFailure(meta.hostKey, { code: meta.lastFailureCode, now: meta.now ?? Date.now() });
   }
   if (!accountId) return;
+  // Conclude the half-open recovery trial BEFORE the admissibility gate below (#4701): an
+  // outcome that gate drops still ended this request, and a lease nobody hands back leaves the
+  // next trial waiting out its deadline. The settle carries its own fences, so this is safe here.
+  settleTransientProbeForOutcome(accountId, meta, classifyCodexUpstreamOutcome(outcome, meta.denial));
   const writerGeneration = meta.writerGeneration ?? captureConfigGeneration();
   if (!isHealthAccountAdmissible(accountId, writerGeneration)) return;
   const now = meta.now ?? Date.now();

package/src/codex/warmup.ts

@@ -44,7 +44,7 @@ async function drainErrorBody(res: Response, signal: AbortSignal): Promise<void>
       fatalUtf8: true,
     });
   } catch (error) {
-    if (signal.aborted) {
+    if (signal.aborted && res.status !== 429) {
       throw new CodexWarmupError("transport", "Codex warmup request failed", {
         cause: error,
       });

package/src/combos/failover.ts

@@ -401,11 +401,15 @@ export function comboFailureCooldownScope(
 ): ComboFailureCooldownScope {
   const code = normalizedFailureCode(options?.code);
   // Request-shape refusals first: an oversized request must not cool a healthy target.
+  // A native transport can surface a zero-output model overflow as a generic
+  // upstream_server_error carrying precise context-window prose, so consult the bounded
+  // message classifier too: that target is healthy, the turn was simply too large for it.
   if (
     status === 413
     || REQUEST_SHAPE_FAILURE_CODES.has(code)
     || isRequestLocalFreePromptCap(status, message, options?.code)
     || isProviderTargetContextOverflow(status, message, options?.code)
+    || isDefiniteContextOverflow(status, message)
     || isRequestLocalTargetIncompatibility(status, message, options?.code)
   ) return "none";
   if (isProviderScopedQuotaCap(status, message, options?.code)) return "provider";
@@ -451,6 +455,74 @@ function isProviderTargetContextOverflow(
     && /\bprompt\s+\d+\s*>\s*\d+\s+maximum context length\b/i.test(message);
 }
 
+/** A status can carry a verdict about the REQUEST; 401/403/429 speak about the credential. */
+const CONTEXT_VERDICT_STATUSES: ReadonlySet<number> = new Set([400, 413, 422]);
+
+/**
+ * Phrases a provider emits when the INPUT does not fit this model's context window. Matched
+ * against the innermost provider message only, so an unrelated refusal that merely quotes one
+ * of these tokens in a code field cannot authorize a replay.
+ */
+const DEFINITE_CONTEXT_OVERFLOW_PHRASES = [
+  "exceeds the context window",
+  "exceed the context window",
+  "context window exceeded",
+  "context length exceeded",
+  "maximum context length",
+  "maximum context window",
+  "too many tokens",
+];
+
+/** Wrapper envelopes unwrapped before the leaf message is read. */
+const MAX_CONTEXT_OVERFLOW_ENVELOPES = 4;
+
+function isDefiniteContextOverflowMessage(text: string): boolean {
+  const normalized = text.toLowerCase();
+  return normalized === "context_length_exceeded"
+    || DEFINITE_CONTEXT_OVERFLOW_PHRASES.some(phrase => normalized.includes(phrase));
+}
+
+/**
+ * Confirm a context overflow from the provider MESSAGE rather than from a code token that
+ * merely appears somewhere in the envelope. An upstream controls both fields and can emit a
+ * contradictory pair -- `context_length_exceeded` beside `Unsupported parameter: user` -- and
+ * that is not evidence the turn is too large for this model. `classifyError` reads the whole
+ * blob, which is exactly the looseness this must not inherit.
+ *
+ * A JSON-shaped body that fails to parse is truncated or corrupt, not prose: `classificationText`
+ * is capped at 500 characters by `normalizeUpstreamErrorText` before it reaches this function, so
+ * a long envelope arrives here as a JSON prefix. Reading that prefix as plain text would let an
+ * arbitrary field that happens to sit in the first 500 bytes authorize a hop, so it fails closed.
+ *
+ * Only the exact proxy wrapper is unwrapped, within a fixed envelope budget and 16,384 characters.
+ */
+function isDefiniteContextOverflow(status: number, message: string): boolean {
+  if (!CONTEXT_VERDICT_STATUSES.has(status) && status < 500) return false;
+  if (message.length > 16_384) return false;
+  let text = message.trim();
+  // One pass per unwrapped envelope, plus one for the leaf the last envelope yields.
+  for (let unwrapped = 0; unwrapped <= MAX_CONTEXT_OVERFLOW_ENVELOPES; unwrapped += 1) {
+    const providerPrefix = /^Provider error \d{3}:\s*/.exec(text);
+    if (providerPrefix) text = text.slice(providerPrefix[0].length).trim();
+    if (!text.startsWith("{")) return isDefiniteContextOverflowMessage(text);
+    if (unwrapped === MAX_CONTEXT_OVERFLOW_ENVELOPES) return false;
+    let payload: unknown;
+    try { payload = JSON.parse(text); } catch { return false; }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    const record = payload as Record<string, unknown>;
+    const response = record.response && typeof record.response === "object" && !Array.isArray(record.response)
+      ? record.response as Record<string, unknown>
+      : undefined;
+    const source = [record.error, response?.error, response?.last_error, record.last_error, record]
+      .find((candidate): candidate is Record<string, unknown> =>
+        !!candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        && typeof (candidate as Record<string, unknown>).message === "string");
+    if (!source) return false;
+    text = (source.message as string).trim();
+  }
+  return false;
+}
+
 export function comboFailureDecision(
   status: number,
   message: string,
@@ -458,6 +530,10 @@ export function comboFailureDecision(
 ): ComboFailureDecision {
   if (status === 499) return "stop";
   if (message.toLowerCase().includes("origin_rejected")) return "stop";
+  // Structured form of the same hard refusal. The prose test above misses it when the origin
+  // reports the code out of band, and every hop rule below -- including the context-overflow
+  // one -- must stay subordinate to it.
+  if (normalizedFailureCode(options?.code) === "origin_rejected") return "stop";
   // The origin may already be executing this turn (the Codex WebSocket relay sent the create
   // frame and never saw a response event). Hopping would send the same request to a second
   // target while the first may still be generating; the honest status goes to the client.
@@ -476,6 +552,15 @@ export function comboFailureDecision(
   // (for example 5059 + invalid_request_prompt_too_long). That is evidence that this
   // target is too small, not that every later combo target is incapable of serving it.
   if (isProviderTargetContextOverflow(status, message, options?.code)) return "hop";
+  // A definite context-window refusal is target-local inside a heterogeneous combo: this model
+  // cannot hold the turn, but a later target may have a larger window. Two boundaries keep this
+  // safe. It is reached only after cancellation, structured origin/cyber refusals and
+  // non-replayable post-send codes have already stopped. And it only ever classifies a failure
+  // the combo stream preflight already proved emitted no output: `comboStreamPayloadCommitsOutput`
+  // commits the child on any text, tool call or unknown event, and only a zero-output terminal
+  // becomes a failure response at all, so a turn whose text the client already saw is never
+  // reclassified here.
+  if (isDefiniteContextOverflow(status, message)) return "hop";
   // A local input-admission refusal (#1524) says "this candidate cannot fit the request",
   // not "the request is impossible": the next candidate may have a larger context window.
   //