@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/router.ts

@@ -384,6 +384,10 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       && registryEntry.requiresAdjacentResponsesToolResults !== undefined
       ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
       : {}),
+    ...(provider.requiresPairedResponsesToolResults === undefined
+      && registryEntry.requiresPairedResponsesToolResults !== undefined
+      ? { requiresPairedResponsesToolResults: registryEntry.requiresPairedResponsesToolResults }
+      : {}),
     ...(provider.annotateEmptyToolOutputs === undefined
       && registryEntry.annotateEmptyToolOutputs !== undefined
       ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }

package/src/routing/identity-domains.ts

@@ -37,13 +37,16 @@ export type IdentityDomainProvenance = "operator-declared" | "provider-documente
  * What a domain key is evidence FOR, which is two facts rather than one.
  *
  * Proven SEPARATION and proven SHARING are different claims, and a provider routinely
- * gives the first without the second. OpenAI documents that prompt caches are not shared
- * across organizations or processing regions, and in the same breath documents that
- * changing keys inside one organization does not guarantee a hit. So a different
- * org-or-region key proves two domains, while an identical one proves nothing: a
- * positive cache inference needs the provider to actually promise the hit, and here the
- * provider declines to. Inferring "shared" from an equal key would be the same guess
- * this module exists to refuse, only pointed the other way.
+ * gives the first without the second. OpenAI's prompt-caching guide states the separating
+ * half outright -- "Caches are not shared across organizations and cannot be reused across
+ * regional processing boundaries" -- and never states a sharing half at all. The page does
+ * not discuss two API keys inside one organization, and what it does say about keys is that
+ * they "influence routing; they do not pin requests to a machine or guarantee a cache hit."
+ * So a different org-or-region key proves two domains, while an identical one proves
+ * nothing. A positive cache inference needs the provider to promise the hit, and no such
+ * promise exists here -- the silence is the evidence, not a documented denial. Inferring
+ * "shared" from an equal key would be the same guess this module exists to refuse, only
+ * pointed the other way.
  *
  * "separates" therefore means two different keys are two different domains while two
  * identical keys stay "unknown". "separates-and-shares" means the same source also
@@ -130,7 +133,9 @@ export interface DeclaredCredentialGroup {
  * then classifies "unknown" rather than extrapolating.
  *
  * - OpenAI: rate limits are per organization and project, with model groups sharing a
- *   limit; prompt caches are not shared across organizations or processing regions.
+ *   limit ("Rate limits are defined at the organization level and at the project level, not
+ *   user level", plus the documented shared limit across a model family); prompt caches are
+ *   not shared across organizations or regional processing boundaries.
  * - Anthropic: prompt cache is isolated per workspace even inside one organization.
  *   (Cache-read tokens are also excluded from input TPM there, which is quota
  *   accounting, not domain shape, so it does not appear here.)
@@ -158,12 +163,14 @@ const PROVIDER_DOCUMENTED_DOMAINS: Record<string, {
       evidence: "separates-and-shares",
     },
     cache: {
-      // Separation only. The documentation says caches are not shared across
-      // organizations or processing regions, and says in the same place that changing
-      // keys inside one organization does not guarantee a hit. So a different org or
-      // region is proven distinct, while same org and region is "unknown" -- claiming
-      // "shared" there would assert a warm prefix the provider explicitly refuses to
-      // promise, and the caller would pay for it by replaying a long prompt that misses.
+      // Separation only, and the asymmetry is in the source. The prompt-caching guide says
+      // "Caches are not shared across organizations and cannot be reused across regional
+      // processing boundaries", which settles a DIFFERENT org or region as distinct. It
+      // states no counterpart for an identical one: the guide never discusses two keys in
+      // one organization, and a key is documented to "influence routing" without
+      // guaranteeing a hit. Same org and region therefore stays "unknown" -- claiming
+      // "shared" would assert a warm prefix the provider never promised, and the caller
+      // would pay for the guess by replaying a long prompt that misses.
       key: (ref) => ref.organizationId !== undefined && ref.region !== undefined
         ? `openai:org:${ref.organizationId}:region:${ref.region}`
         : undefined,

package/src/routing/probe-lease.ts

@@ -349,7 +349,14 @@ export function resolveHeldAccountDispatch(input: {
     kind: "withheld",
     boundAccountId: input.boundAccountId,
     ...(input.detourAccountId !== undefined ? { detourAccountId: input.detourAccountId } : {}),
-    retryAt: nextProbeAt(input.boundAccountId, now, input.minProbeIntervalMs),
+    // Both bounds, not just the probe pacing. A request refused by the RATIO has no probe state
+    // of its own yet, so `nextProbeAt` answered `now` and the refusal told the caller to try
+    // again immediately -- a withheld dispatch that busy-loops is the same load as the dispatch
+    // it refused. The limiter is the only thing that knows when its window moves.
+    retryAt: Math.max(
+      nextProbeAt(input.boundAccountId, now, input.minProbeIntervalMs),
+      limiter.nextRecoveryAt(now),
+    ),
   };
 }
 
@@ -408,6 +415,16 @@ export interface PoolBackpressureLimiter {
   tryPermitRetryDispatch(now?: number): boolean;
   /** Admit one probe dispatch under the same shared recovery budget. */
   tryPermitProbeDispatch(now?: number): boolean;
+  /**
+   * Earliest moment this limiter could admit another recovery dispatch.
+   *
+   * A refusal has to hand back a time, or the caller has nothing to wait on and busy-loops
+   * against a pool that is already failing -- which is the load this limiter exists to remove.
+   * `now` when the allowance is not spent; otherwise the moment the oldest bucket still inside
+   * the window falls out of it, which is strictly in the future and is a real change point
+   * rather than a guess.
+   */
+  nextRecoveryAt(now?: number): number;
   state(now?: number): PoolBackpressureState;
 }
 
@@ -461,6 +478,19 @@ export function createPoolBackpressureLimiter(
     return true;
   }
 
+  function nextRecoveryAt(now: number): number {
+    const { initials, recoveries } = totals(now);
+    if (recoveries + 1 <= allowanceFor(initials)) return now;
+    // The window has to move before another recovery fits. The earliest that can happen is the
+    // moment the oldest bucket still inside it leaves, and every such bucket started after
+    // `now - windowMs`, so the answer is always strictly in the future.
+    for (const bucket of buckets) {
+      if (bucket.start <= now - policy.windowMs) continue;
+      return bucket.start + policy.windowMs;
+    }
+    return now + policy.windowMs;
+  }
+
   return {
     recordInitialSend(now = Date.now()): void {
       bucketFor(now).initials += 1;
@@ -471,6 +501,9 @@ export function createPoolBackpressureLimiter(
     tryPermitProbeDispatch(now = Date.now()): boolean {
       return tryPermit(now);
     },
+    nextRecoveryAt(now = Date.now()): number {
+      return nextRecoveryAt(now);
+    },
     state(now = Date.now()): PoolBackpressureState {
       const { initials, recoveries } = totals(now);
       return {
@@ -509,3 +542,72 @@ export function configureSharedPoolBackpressure(policy: PoolBackpressurePolicy):
 export function resetSharedPoolBackpressureForTests(): void {
   sharedLimiter = undefined;
 }
+
+/**
+ * Forget every account's probe pacing AND the shared recovery window.
+ *
+ * Called when the pool's routing state is reset wholesale -- a roster change, a config reload,
+ * an account removal. Both halves describe a pool that no longer exists: pacing is keyed on
+ * account ids that may be gone, and the window's buckets count sends made by a roster that
+ * changed underneath them. Keeping either across such a reset lets one context's recovery
+ * decisions govern the next one, which is also how it leaks between test files.
+ *
+ * This is the production reset. The two `ForTests` seams above stay separate because a test
+ * frequently wants exactly one half of it.
+ */
+export function clearPoolRecoveryState(): void {
+  probeStates.clear();
+  sharedLimiter = undefined;
+}
+
+/**
+ * What one physical send IS, as far as the recovery window is concerned.
+ *
+ * The window measures recovery traffic against observed demand, so it needs the distinction
+ * made where the send happens -- and the transport wrapper cannot make it. That layer sees a
+ * URL and an init; whether this is a conversation's first attempt, its third retry, or the one
+ * trial admitted against a held account is knowledge only the caller has. So the caller names
+ * it, and the classification lives here with the window rather than in the transport, which
+ * owns no routing policy and has an enforced import boundary saying so.
+ *
+ * - `initial`: a new request's first send. Recorded, never refused -- it is the denominator,
+ *   and refusing it would make this a throughput cap rather than a recovery bound.
+ * - `retry`: a re-send of a request that already reached upstream once. Admitted only while
+ *   recovery traffic stays under its ratio of observed demand.
+ * - `probe`: the half-open trial against a held account. It ALREADY paid at selection, inside
+ *   {@link resolveHeldAccountDispatch}; charging it again would bill one send twice and shrink
+ *   the very budget it was admitted from.
+ */
+export type PoolRecoveryDispatchClass = "initial" | "retry" | "probe";
+
+export interface PoolRecoveryDispatchDecision {
+  readonly admitted: boolean;
+  /**
+   * Earliest moment another recovery dispatch could be admitted. `now` when the send was
+   * admitted; otherwise a real change point strictly in the future, so a refused caller has
+   * something to wait on instead of busy-looping against a pool that is already failing.
+   */
+  readonly retryAt: number;
+}
+
+/**
+ * Admit one physical send against the process-wide recovery window.
+ *
+ * Per-request send budgets cannot see a storm: thousands of requests each staying inside their
+ * own allowance still compose into an unbounded rate against one failing upstream. This is the
+ * layer above them, and it is shared by construction.
+ */
+export function classifyPoolRecoveryDispatch(
+  dispatchClass: PoolRecoveryDispatchClass,
+  now = Date.now(),
+  limiter: PoolBackpressureLimiter = sharedPoolBackpressure(),
+): PoolRecoveryDispatchDecision {
+  if (dispatchClass === "initial") {
+    limiter.recordInitialSend(now);
+    return { admitted: true, retryAt: now };
+  }
+  if (dispatchClass === "probe") return { admitted: true, retryAt: now };
+  return limiter.tryPermitRetryDispatch(now)
+    ? { admitted: true, retryAt: now }
+    : { admitted: false, retryAt: limiter.nextRecoveryAt(now) };
+}

package/src/server/auth-cors.ts

@@ -913,6 +913,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   commandCodeVersion: "editor",
   statelessResponses: "editor",
   requiresAdjacentResponsesToolResults: "editor",
+  requiresPairedResponsesToolResults: "editor",
   annotateEmptyToolOutputs: "editor",
   supportsServiceTier: "editor",
   modelSupportsServiceTier: "editor",

package/src/server/chat-completions.ts

@@ -170,7 +170,9 @@ async function handleChatCompletionsWithBudget(
       if (chatBody.tools !== undefined) parts.push(JSON.stringify(chatBody.tools));
       logCtx.usageLogInputTokens = Math.max(1, estimateTokens(parts.join("\n"), requestedModel));
     }
-    if (!effortRow && isNativeChatRouteEligible(route, chatBody, config)) chatNativeRoute = route;
+    // Combos must enter the Responses routing path so child selection, forced default
+    // effort, failover, and per-attempt telemetry run before any native Chat send.
+    if (!route.combo && !effortRow && isNativeChatRouteEligible(route, chatBody, config)) chatNativeRoute = route;
   } catch (err) {
     if (err instanceof UnknownRoutingPolicyError) {
       logCtx.requestedModel = requestedModel;

package/src/server/chat-native.ts

@@ -25,8 +25,12 @@ import {
   applyUpstreamRecoveryInit,
   fetchWithResetRetry,
   fetchWithTransientRetry,
+  isNonReplayableResponse,
+  isReplayRefusalCode,
+  isReplayRefusalResponse,
   prepareSameTarget429Wait,
   type UpstreamSendRecovery,
+  UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
 import {
   isTranslatorBudgetExceededError,
@@ -51,7 +55,9 @@ import { linkAbortSignal } from "./responses";
 import {
   addFinalRequestLog,
   beginRequestAttempt,
-  noteAttemptSend,
+  noteProviderAttemptSend,
+  recordKeyAttemptFailure,
+  recordKeyWireAttemptUsage,
   recordFirstOutput,
   recordAttemptCredentialSource,
   sealRequestAttemptIdentity,
@@ -344,10 +350,12 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 const encoding = new Headers(init.headers).get("accept-encoding");
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
-                noteAttemptSend(attempt, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-                return ((activeProvider as OcxProviderTransport).fetch ?? execute)(request.url, applyUpstreamRecoveryInit({
+                noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+                const dispatched = await ((activeProvider as OcxProviderTransport).fetch ?? execute)(request.url, applyUpstreamRecoveryInit({
                   ...init, method: request.method, headers, body: request.body,
                 }, transportRecovery));
+                if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
+                return dispatched;
               },
             }),
           );
@@ -375,6 +383,11 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     let retries = 0;
     while (
       response.status === 429
+      // A 429 this proxy synthesized for a refused reset replay is not a provider rate
+      // limit: waiting and re-sending here is exactly the duplicate inference the refusal
+      // exists to stop. It kept the same shape under the old 502 only because 502 never
+      // matched this branch.
+      && !isNonReplayableResponse(response)
       && retryPolicy
       && retries < retryPolicy.attempts
       && transientSendAvailable()
@@ -388,7 +401,9 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       if (upstream.signal.aborted) throw upstream.signal.reason;
       response = await send(activeRequest, "rate-limit-429");
     }
-    while (response.status === 429 && hasKeyPoolFailover(activeProvider)) {
+    // Same reason as above, plus a second one: rotating here would write a cooldown against
+    // a key that rate-limited nothing, and that false signal outlives the request.
+    while (response.status === 429 && !isNonReplayableResponse(response) && hasKeyPoolFailover(activeProvider)) {
       const rotated = rotateProviderTransportOn429(config, route.providerName, activeProvider, {
         retryAfter: response.headers.get("retry-after"),
         now: Date.now(),
@@ -474,6 +489,12 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     if (isCyberPolicyCode(upstreamCode) || classified.code === CYBER_POLICY_ERROR_CODE) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = cyberPolicyErrorType(upstreamType);
+    } else if (isReplayRefusalResponse(response) || isReplayRefusalCode(upstreamCode)) {
+      // 429 classifies as a rate limit and a rate limit already carries a code, so the branch
+      // below -- which only fills an EMPTY code -- could never restore this one. Without it the
+      // client is told the provider throttled the turn, when what happened is that this proxy
+      // declined to send it a second time.
+      classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
     } else if (upstreamCode === "model_not_found") {
       classified.code = "model_not_found";
       classified.type = "invalid_request_error";
@@ -481,7 +502,10 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       classified.code = upstreamCode;
     }
     const status = isCyberPolicyCode(classified.code) ? 400 : response.status;
-    const retryAfter = isCyberPolicyCode(classified.code)
+    // A refusal this proxy made has no wait to report. Synthesizing one here would hand the
+    // client the default two-second retry for a rate limit that never happened, which is the
+    // duplicate send the refusal exists to prevent.
+    const retryAfter = isCyberPolicyCode(classified.code) || isReplayRefusalCode(classified.code)
       ? undefined
       : resolveClientRetryAfter({
         status: response.status,
@@ -509,8 +533,10 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       stallTimeoutSec: config.stallTimeoutSec,
       onFirstOutput: logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined,
       onUsage: usage => {
-        logCtx.usage = usage;
-        attempt.usage = usage;
+        if (!recordKeyWireAttemptUsage(logCtx, usage)) {
+          logCtx.usage = usage;
+          attempt.usage = usage;
+        }
       },
       onTerminal: (status: number, message?: string) => {
         terminalStatus = status;
@@ -600,8 +626,10 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   if (!completion) return fail(502, "upstream response contained no choices", "upstream_error");
   const usage = usageFromChat(completion.usage);
   if (usage) {
-    logCtx.usage = usage;
-    attempt.usage = usage;
+    if (!recordKeyWireAttemptUsage(logCtx, usage)) {
+      logCtx.usage = usage;
+      attempt.usage = usage;
+    }
   }
   if (logIds) recordFirstOutput(logCtx, logIds.start);
   try {

package/src/server/index/live-sideband.ts

@@ -11,7 +11,13 @@ import {
   type WsData,
 } from "../ws-bridge";
 import type { Server, ServerWebSocket } from "bun";
-import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "../live";
+import {
+  handleLive,
+  logLiveSidebandFrame,
+  logLiveSidebandStage,
+  parseLiveSidebandTarget,
+  resolveLiveSidebandUpgrade,
+} from "../live";
 import { RESPONSE_TTL_MS } from "../../responses/state";
 
 export const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
@@ -125,8 +131,33 @@ export function sendUpstreamFrame(upstream: WebSocket, frame: string | Buffer):
   upstream.send(Uint8Array.from(frame));
 }
 
+/**
+ * Translate the close a downstream client sent into one the upstream socket can carry.
+ *
+ * The client's code is the only evidence of WHY the call ended, and the upstream needs it:
+ * a user hanging up (1001) and a protocol fault (1002/1011) are different events on the
+ * account, and collapsing both into a bare 1000 erases that at the proxy. Two bounds make
+ * the relay safe anyway. Codes a WebSocket endpoint may never send — 1005 and 1006 are
+ * status codes the local runtime synthesizes for "no status" and "abnormal", 1015 is
+ * TLS-reserved, and anything outside the registered and private ranges is undefined — become
+ * 1000, because `upstream.close` throws on them and a throw here would strand the upstream
+ * socket. The reason is truncated to the 123-byte control-frame payload limit by bytes, not
+ * characters, so a multibyte reason cannot overrun the frame.
+ */
+export function clientCloseForUpstream(code: number, reason?: string): { code: number; reason: string } {
+  const sendable = code === 1000
+    || code === 1001
+    || code === 1003
+    || (code >= 1007 && code <= 1011)
+    || (code >= 3000 && code <= 4999);
+  let text = reason ?? "";
+  while (Buffer.byteLength(text) > 123) text = text.slice(0, -1);
+  return { code: sendable ? code : 1000, reason: text };
+}
+
 function finalizeLiveSideband(ws: ServerWebSocket<WsData>, upstream?: WebSocket): void {
   if (upstream && ws.data.liveUpstream !== upstream) return;
+  logLiveSidebandStage("relay-closed");
   if (ws.data.liveCloseFallback !== undefined) {
     clearTimeout(ws.data.liveCloseFallback);
     ws.data.liveCloseFallback = undefined;
@@ -281,6 +312,7 @@ export function openLiveSidebandUpstream(
     try {
       socket = createWebSocket(url, headers);
     } catch {
+      logLiveSidebandStage("upstream-failed", { status: 502, code: "upstream_error" });
       resolve({ ok: false, status: 502, code: "upstream_error", message: "voice upstream connect failed" });
       return;
     }
@@ -297,6 +329,8 @@ export function openLiveSidebandUpstream(
       settled = true;
       clearTimeout(timer);
       removeAbortListener();
+      if (result.ok) logLiveSidebandStage("upstream-open");
+      else logLiveSidebandStage("upstream-failed", { status: result.status, code: result.code });
       resolve(result);
     };
     const timer = setTimeout(() => {
@@ -505,6 +539,7 @@ export function attachLiveSidebandUpstream(
     // session, not the connect phase.
     if (ws.data.liveConnectTimer !== undefined) clearTimeout(ws.data.liveConnectTimer);
     ws.data.liveConnectTimer = undefined;
+    logLiveSidebandStage("relay-attached");
     for (const frame of takeover.frames) {
       try {
         // Mirror the live message listener exactly: same ceiling, same diagnostic
@@ -527,6 +562,7 @@ export function attachLiveSidebandUpstream(
     ws.data.liveOpened = true;
     if (ws.data.liveConnectTimer !== undefined) clearTimeout(ws.data.liveConnectTimer);
     ws.data.liveConnectTimer = undefined;
+    logLiveSidebandStage("relay-attached");
     // An accepted transport alone does not prove inference/quota recovery.
     // Keep healthy closes neutral; explicit transport failures are recorded below.
     const pending = ws.data.livePending ?? [];

package/src/server/index/websocket-handler.ts

@@ -1,9 +1,14 @@
+import { nativeSteeringUnavailableReason, nativeResponseControlMode, type NativeResponseControl } from "../responses/native-response-control";
+import { NativeInjectionChannel } from "../responses/native-injection";
+import { NativeSteeringChannel, NativeSteeringError } from "../responses/native-steering";
+import { createNativeSteeringLogObserver } from "../responses/native-steering-log";
 import type { Server, ServerWebSocket } from "bun";
 import {
   LIVE_SIDEBAND_UPSTREAM_OPEN_TIMEOUT_MS,
   MAX_WS_FRAME_BYTES,
   WEBSOCKET_IDLE_TIMEOUT_SECONDS,
   attachLiveSidebandUpstream,
+  clientCloseForUpstream,
   closeLiveSideband,
   closeLiveSidebandBeforeUpgrade,
   enqueueLiveSidebandPendingFrame,
@@ -187,11 +192,47 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
         } catch {
           return; // text-only contract; ignore unparseable frames
         }
+        if (frame.type === "response.inject" || frame.type === "response.steer" || (frame.type === "response.create" && ws.data.nativeControl)) {
+          try {
+            if (frame.type === "response.inject") {
+              if (!ws.data.nativeControl?.inject) throw new NativeSteeringError("injection_not_supported", "Native injection is disabled or unavailable on this route.");
+              ws.data.nativeControl.inject(frame);
+              return;
+            }
+            if (frame.type === "response.steer") {
+              if (!ws.data.nativeControl) throw new NativeSteeringError("steering_not_supported", ws.data.nativeSteeringUnavailable ?? "Native steering transport is unavailable; the route may be unsupported or using HTTP fallback.");
+              ws.data.nativeControl.steer(frame);
+              return;
+            }
+            if (ws.data.nativeControl?.continue(frame)) return;
+          } catch (error) {
+            sendJsonFrame(ws, buildWsErrorFrame(400, {
+              type: "invalid_request_error",
+              code: error instanceof NativeSteeringError ? error.code : "native_steering_error",
+              message: error instanceof NativeSteeringError ? error.message : "Native steering transport failed; delivery may be unknown. Do not automatically replay input.",
+            }));
+            return;
+          }
+        }
         if (frame.type === "response.processed") return; // ack — no-op
         if (frame.type !== "response.create") return;
         markActivity("ws response.create");
 
+        let nativeControl: NativeResponseControl | undefined;
+        try {
+          const idleMs = typeof config.stallTimeoutSec === "number" && Number.isFinite(config.stallTimeoutSec)
+            ? Math.max(1, config.stallTimeoutSec) * 1000 : 300_000;
+          const mode = nativeResponseControlMode(frame, config);
+          nativeControl = mode === "injection" ? new NativeInjectionChannel(frame, idleMs)
+            : mode === "steering" ? new NativeSteeringChannel(frame, idleMs) : undefined;
+        } catch {
+          sendJsonFrame(ws, buildWsErrorFrame(400, { type: "invalid_request_error", message: "Invalid native steering request settings" }));
+          return;
+        }
         ws.data.cancel?.();
+        // A superseded turn must not keep ownership during warmup or refusal.
+        ws.data.nativeControl = undefined;
+        ws.data.nativeSteeringUnavailable = nativeSteeringUnavailableReason(frame, config.codexNativeSteering);
         const turnId = (ws.data.turnId ?? 0) + 1;
         ws.data.turnId = turnId;
         const isCurrent = () => ws.data.turnId === turnId;
@@ -226,6 +267,8 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
           return;
         }
 
+        // Only a genuinely admitted turn may receive steering or continuations.
+        ws.data.nativeControl = nativeControl;
         const payload: Record<string, unknown> = { ...frame };
         delete payload.type;
         turnAdmissionLease.bindAbortController(turnAbort);
@@ -266,6 +309,7 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
               ...(wsAdmission ? { admission: wsAdmission } : {}),
               forceEmptyResponseId: true,
               inboundTransport: "websocket",
+              nativeControl,
               abortSignal: turnAbort.signal,
               turnAdmissionLease,
               onFirstOutput: () => recordFirstOutput(logCtx, start),
@@ -276,7 +320,10 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
               },
             });
             await sendResponseToWebSocket(ws, response, isCurrent, {
-              onSsePayload: payload => inspectResponseLogSsePayload(logCtx, payload),
+              untilEof: nativeControl?.relayActive === true,
+              onSsePayload: nativeControl?.relayActive
+                ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
+                : payload => inspectResponseLogSsePayload(logCtx, payload),
               onTerminal: status => {
                 terminalRecorder?.(status, logCtx.terminalHttpStatus);
                 finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
@@ -312,18 +359,22 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
             }
           } finally {
             turnAdmissionLease.release();
+            if (ws.data.nativeControl === nativeControl) ws.data.nativeControl = undefined;
             if (!logged && turnAbort.signal.aborted) finalizeLog(499);
             if (ws.data.cancel === cancelTurn) ws.data.cancel = undefined;
           }
         })();
       },
-      close(ws: ServerWebSocket<WsData>) {
+      close(ws: ServerWebSocket<WsData>, code: number, reason: string) {
         if (ws.data.kind === "remote-workspace-agent") {
           ws.data.remoteWorkspaceClose?.();
           return;
         }
         if (ws.data.kind === "live-sideband") {
-          closeLiveSideband(ws);
+          // Carry the client's own close through to the upstream instead of reporting every
+          // hang-up as a plain 1000.
+          const forwarded = clientCloseForUpstream(code, reason);
+          closeLiveSideband(ws, forwarded.code, forwarded.reason);
           return;
         }
         unregisterCodexWebSocket(ws);

package/src/server/index.ts

@@ -268,11 +268,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     startupOwnershipStatePaths,
     startupWindowsTaskListingCache,
   );
-  // Startup cache invalidation is best-effort and must never block the server from
-  // serving. It now takes K so it cannot race a convergence commit. Use the home
-  // paired with the ownership inspection; re-reading ambient CODEX_HOME here could
-  // invalidate a different installation after an environment or mount change.
-  if (startupCacheOwnership.ownership === "owned" && startupOwnershipHomes !== null) {
+  // Startup cache invalidation is best-effort and applies only when startup sync is enabled.
+  // Check OFF before taking K: on Windows K resolves SID + LocalAppData through PowerShell,
+  // and run 35093667426 exceeded healthy controls by 33.8 s against that 30 s child budget.
+  // The permit callback still re-reads intent under K to close a concurrent disable race.
+  if (shouldSyncCodexOnStart(config) && startupCacheOwnership.ownership === "owned" && startupOwnershipHomes !== null) {
     try {
       const startupCodexHome = startupOwnershipHomes.codexHome;
       // #1046: record whether this actually rewrote the cache. `handleStart` ORs this