@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/server/responses/core-combo.ts

@@ -1,6 +1,8 @@
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+import { recordAttemptRequestedEffort } from "../request-log";
 import {
   CODEX_TEXT_GUARDED_BUDGET_POLICY,
-  createRequestExecutionBudget,
+  deriveRequestExecutionBudget,
   isRequestExecutionBudget,
 } from "../../lib/request-execution-budget";
 import type {
@@ -44,6 +46,7 @@ import { isThreadSpawnRequest, supportedLadderFor } from "../effort-policy";
 import {
   clientCancelledResponse,
   comboUnavailable,
+  targetIncompatibleResponse,
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
 import {
@@ -51,7 +54,12 @@ import {
   createChildPassthroughCallbackGate,
   consumeComboFailure,
 } from "./core-combo-failure";
-import { linkRequestSessionLane, sessionLaneIdFromRequest } from "../request-log-conversation";
+import {
+  linkRequestSessionLane,
+  reasoningReplayConversationIdFromResponsesRequest,
+  sessionIdHeaderFromRequest,
+  sessionLaneIdFromRequest,
+} from "../request-log-conversation";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import { beginRequestAttempt, sealRequestAttemptIdentity, finishRequestAttempt } from "../request-log";
@@ -65,6 +73,7 @@ import {
 } from "../relay";
 import { preflightComboStreamResponse } from "./combo-stream-preflight";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
+import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 
 /**
  * Sends one combo target may run on its own before the ladder moves on. A target is a whole
@@ -105,25 +114,27 @@ export function comboExecutionBudgetPolicy(declaredTargets: number): RequestExec
 /**
  * A budget scope that keeps its own recovery ledgers but spends the SAME request-wide counter.
  *
- * `used` is redefined as an accessor onto the parent because the factory reads it back off this
- * object -- `remainingBaseSends` and the total check both do -- so a copied number would let a
- * combo target run its ladder against a stale total, which is precisely the per-layer counting
- * this work exists to remove. The reserve, alternate-target and transition ledgers stay
- * per-scope on purpose: a combo target's account failover is its own recovery decision, while
- * the request total still bounds every target together.
+ * The sharing has to happen inside the factory. Redefining `used` as an accessor onto the parent
+ * only shared what callers read from the outside: `remainingBaseSends`, the total check and the
+ * reserve test all consult the factory's own private counter, which an overridden property
+ * cannot reach. Each derived scope therefore admitted dispatches as though the request had spent
+ * nothing, and the per-target holdback below -- expressed against `maxTotalModelSends` -- had
+ * nothing to hold back from.
+ *
+ * `deriveRequestExecutionBudget` binds the scope to the parent's real ledger, including pending
+ * externally-counted bookings and the durable-spend observer, all of which must travel together.
+ * A pending booking is a send already counted in the total and waiting for its reporter, and the
+ * observer books by watching that same counter move (#4707) -- so a scope that spent the counter
+ * without carrying the observer would move it without booking, and this combo's child sends
+ * would go missing from the spend ledger. The reserve, alternate-target and transition ledgers
+ * stay per-scope on purpose: a combo target's account failover is its own recovery decision,
+ * while the request total still bounds every target together.
  */
 export function deriveSendBudgetScope(
   parent: RequestExecutionBudget,
   policy: RequestExecutionBudgetPolicy,
 ): RequestExecutionBudget {
-  const scope = createRequestExecutionBudget(policy, parent.logicalRequestId);
-  Object.defineProperty(scope, "used", {
-    get: () => parent.used,
-    set: (value: number) => { parent.used = value; },
-    enumerable: true,
-    configurable: true,
-  });
-  return scope;
+  return deriveRequestExecutionBudget(parent, policy);
 }
 
 
@@ -229,6 +240,29 @@ export async function executeComboResponses(
       : undefined,
     recoveredPlaintext: false,
   };
+  const reasoningReplayConversationId = reasoningReplayConversationIdFromResponsesRequest({
+    clientThreadId: inboundClientThreadId,
+    threadIdHeader: req.headers.get("thread-id"),
+    sessionIdHeader: sessionIdHeaderFromRequest(req.headers),
+  });
+  const reasoningReplayEligible = (target: (typeof combo.targets)[number]): boolean => {
+    try {
+      const route = routeConcreteModel(config, `${target.provider}/${target.model}`);
+      const unavailable = mandatoryResponsesReasoningReplayUnavailable({
+        body,
+        clientThreadId: reasoningReplayConversationId,
+        providerName: route.providerName,
+        provider: route.provider,
+        adapterName: route.provider.adapter,
+        modelId: route.modelId,
+      });
+      return !unavailable;
+    } catch {
+      // Routing failures are not evidence of replay incompatibility. Keep the target eligible so
+      // the existing selection and dispatch path preserves its original routing failure surface.
+      return true;
+    }
+  };
   const adoptFailedChildLog = (childLog: RequestLogContext): void => {
     // Attempts remain the complete physical history; the logical row mirrors the most recent
     // failed target so an exhausted combo still has useful top-level reasoning diagnostics.
@@ -260,6 +294,18 @@ export async function executeComboResponses(
   let comboPayloadReadable = false;
   const payloadEligible = (target: (typeof combo.targets)[number]): boolean =>
     comboPayloadReadable || !unreadableEncryptedAgentTask || canDecryptUnreadableAgentTask(target);
+  const targetEligible = (target: (typeof combo.targets)[number]): boolean =>
+    payloadEligible(target) && reasoningReplayEligible(target);
+  const onlyReplayIncompatibleTargetsRemain = (excluded: Iterable<string> = []): boolean => {
+    const excludedKeys = new Set(excluded);
+    const remaining = combo.targets.filter(target => {
+      const provider = config.providers[target.provider];
+      return provider?.disabled !== true
+        && !excludedKeys.has(targetKey(target))
+        && payloadEligible(target);
+    });
+    return remaining.length > 0 && remaining.every(target => !reasoningReplayEligible(target));
+  };
   let encryptedTaskRecoveryAttempted = false;
   let recoveryFailureReason: AgentTaskRecoveryFailureReason | undefined;
   let storedPool401ReplayDispatched = false;
@@ -324,7 +370,7 @@ export async function executeComboResponses(
     abortSignal: options.abortSignal,
   });
   let pick = await pickWithWait({
-    eligible: payloadEligible,
+    eligible: targetEligible,
     now: initialNow,
   });
 
@@ -349,6 +395,7 @@ export async function executeComboResponses(
   }
 
   if (!pick) {
+    if (onlyReplayIncompatibleTargetsRemain()) return targetIncompatibleResponse();
     return options.abortSignal?.aborted
       ? clientCancelledResponse()
       : comboUnavailable(comboId);
@@ -357,6 +404,26 @@ export async function executeComboResponses(
   // adoption below must never replace it with a concrete child route trace.
   logCtx.routeDecision = comboRouteDecisionTrace(config, comboId, pick, requestedModel);
 
+  const originalReasoning = body && typeof body === "object" && !Array.isArray(body)
+    ? (body as { reasoning?: unknown }).reasoning
+    : undefined;
+  const originalRequestedEffortValue = originalReasoning && typeof originalReasoning === "object" && !Array.isArray(originalReasoning)
+    ? (originalReasoning as { effort?: unknown }).effort
+    : undefined;
+  const originalRequestedEffort = typeof originalRequestedEffortValue === "string"
+    && isDeclaredReasoningEffort(originalRequestedEffortValue)
+    ? originalRequestedEffortValue
+    : undefined;
+  const restoreOriginalRequestedEffort = (childLog: RequestLogContext): void => {
+    if (originalRequestedEffort === undefined) return;
+    const normalizedRequestedEffort = childLog.requestedEffort;
+    const transitionIndex = normalizedRequestedEffort?.indexOf("->") ?? -1;
+    childLog.requestedEffort = transitionIndex >= 0
+      ? `${originalRequestedEffort}${normalizedRequestedEffort!.slice(transitionIndex)}`
+      : originalRequestedEffort;
+    recordAttemptRequestedEffort(childLog);
+  };
+
   let lastFailure: Response | null = null;
   // Dispatched targets, not attempted picks: it indexes the declared target list so the clamp
   // below can tell how many targets are still entitled to a send.
@@ -407,6 +474,7 @@ export async function executeComboResponses(
       comboDefaultEffort(config, comboId),
       supportedLadderFor({ provider: targetRoute.provider, modelId: targetRoute.modelId }),
       combo.reasoningEffortMode,
+      combo.defaultEffortMode,
     );
     const childHeaders = buildComboChildHeaders(req.headers);
     const childRequest = new Request(req.url, {
@@ -425,6 +493,13 @@ export async function executeComboResponses(
       config.providers[pick.target.provider]!.adapter,
     );
     childLog.activeAttempt = attempt;
+    if (originalRequestedEffort !== undefined) {
+      childLog.requestedEffort = originalRequestedEffort;
+      recordAttemptRequestedEffort(childLog);
+    }
+    childLog.activeAttemptStartedAt = started;
+    childLog.attempts = logCtx.attempts ??= [];
+    childLog.attempts.push(attempt);
     let attemptRetained = false;
     const retainCancelledAttempt = (): void => {
       if (attemptRetained) return;
@@ -435,7 +510,6 @@ export async function executeComboResponses(
         childLog.accountLogLabel,
       );
       finishRequestAttempt(attempt, 499, Date.now() - started, childLog.usage);
-      (logCtx.attempts ??= []).push(attempt);
       attemptRetained = true;
     };
     const completedTarget = { provider: pick.target.provider, model: pick.target.model };
@@ -472,7 +546,7 @@ export async function executeComboResponses(
       const deferCodexResetDerivedCooldown = combo.strategy === "failover"
         && combo.targets.slice(pick.targetIndex + 1).some(target =>
           target.provider === currentTargetProvider
-          && payloadEligible(target)
+          && targetEligible(target)
           && !isComboTargetInCooldown(comboId, target),
         );
       response = await requestDispatchers.handleResponses(childRequest, config, childLog, {
@@ -499,12 +573,14 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
+      restoreOriginalRequestedEffort(childLog);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
 
@@ -526,6 +602,7 @@ export async function executeComboResponses(
           retainCancelledAttempt();
           return clientCancelledResponse();
         }
+        finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
         throw error;
       }
       if (preflight.kind === "failed") {
@@ -546,7 +623,6 @@ export async function executeComboResponses(
         childLog.providerAdapter ?? attempt.adapter,
         childLog.accountLogLabel,
       );
-      (logCtx.attempts ??= []).push(attempt);
       attemptRetained = true;
       noteComboSuccess(comboId, combo, pick.target, pick.writerGeneration);
       Object.assign(logCtx, childLog, {
@@ -580,6 +656,7 @@ export async function executeComboResponses(
         retainCancelledAttempt();
         return clientCancelledResponse();
       }
+      finishRequestAttempt(attempt, 502, Date.now() - started, childLog.usage);
       throw error;
     }
     if (options.abortSignal?.aborted) {
@@ -598,7 +675,6 @@ export async function executeComboResponses(
       Date.now() - started,
       failure.usage,
     );
-    (logCtx.attempts ??= []).push(attempt);
     attemptRetained = true;
     lastFailure = failure.response;
     lastFailedChildLog = childLog;
@@ -664,22 +740,52 @@ export async function executeComboResponses(
       cooldownScope: comboFailureCooldownScope(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
       }),
-      eligible: payloadEligible,
+      eligible: targetEligible,
       status: failure.response.status,
       code: failure.upstreamCode,
       message: failure.classificationText,
     });
+    // Same target selector as the exclusionary pick below, minus `exclude`: the only
+    // difference is deliberate and is the whole point of the single-target retry.
+    const retryAfterCooldown = () =>
+      pickWithWait({
+        eligible: targetEligible,
+        now: failureNow,
+      });
     if (nextPick) {
       pick = nextPick;
     } else {
       pick = await pickWithWait({
         exclude: pick.attempted,
-        eligible: payloadEligible,
+        eligible: targetEligible,
         now: failureNow,
       });
+      // A single-target combo with waitForCooldownMs has no alternate target to fail over to,
+      // but can recover if it waits for its brief cooldown. The initial attempt accumulated into
+      // pick.attempted, so the first pickWithWait above excluded it. retryAfterCooldown below is
+      // the same selector with `exclude` deliberately dropped, so the single cooled target
+      // becomes eligible again once its cooldown expires.
+      // Termination is double-guarded:
+      // 1) comboSendScope?.reserveDispatch refuses a second failover hop via comboExecutionBudgetPolicy
+      //    (maxAlternateTargetSends: 1 for a single declared target).
+      // 2) comboTargetsDispatched <= 1 bounds it locally so the retry never loops or waits unnecessarily
+      //    even if sendBudget scope is absent.
+      if (
+        !pick
+        && combo.targets.length === 1
+        && combo.waitForCooldownMs > 0
+        && comboTargetsDispatched <= 1
+        && !options.abortSignal?.aborted
+      ) {
+        pick = await retryAfterCooldown();
+      }
     }
     if (!pick) {
       if (options.abortSignal?.aborted) return clientCancelledResponse();
+      if (onlyReplayIncompatibleTargetsRemain(attemptedTargets)) {
+        adoptFailedChildLog(childLog);
+        return targetIncompatibleResponse();
+      }
       if (unreadableEncryptedAgentTask && !comboPayloadReadable) {
         const recoveredTarget = await pickWithWait({
           exclude: attemptedTargets,

package/src/server/responses/core-errors.ts

@@ -150,3 +150,21 @@ export function unreadableEncryptedAgentTaskResponse(reason?: AgentTaskRecoveryF
     { status: 400, headers: { "Content-Type": "application/json" } },
   );
 }
+
+
+export const TARGET_INCOMPATIBLE_MESSAGE =
+  "No remaining combo target can continue this tool-bearing history because the reasoning required for replay is unavailable after the serving route changed. Start a new conversation or configure a combo target that can consume the available reasoning.";
+
+
+export function targetIncompatibleResponse(): Response {
+  return new Response(
+    JSON.stringify({
+      error: {
+        message: TARGET_INCOMPATIBLE_MESSAGE,
+        type: "invalid_request_error",
+        code: "target_incompatible",
+      },
+    }),
+    { status: 400, headers: { "Content-Type": "application/json" } },
+  );
+}

package/src/server/responses/core-options.ts

@@ -1,3 +1,4 @@
+import type { NativeResponseControl } from "./native-response-control";
 import type { OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
 import type { CodexAuthPolicyConfig, CodexAuthContext } from "../../codex/auth-context";
 import type { AdmissionLease } from "../../lib/admission";
@@ -51,6 +52,8 @@ export interface HandleResponsesOptions {
   /** Called at most once after the complete client body is read and accepted for dispatch. */
   onRequestBodyRead?: () => void;
   forceEmptyResponseId?: boolean;
+  /** Internal, connection-owned control channel; never reconstructed from headers. */
+  nativeControl?: NativeResponseControl;
   abortSignal?: AbortSignal;
   /** One-shot TTFT callback: first non-empty model output observed (WP4). */
   onFirstOutput?: () => void;

package/src/server/responses/core-replay.ts

@@ -27,6 +27,7 @@ import type { OAuthAccessSnapshot } from "../../oauth";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { thoughtSignatureReplaySalt } from "../../responses/thought-signature-replay";
 import { randomUUID } from "node:crypto";
+import { requiresPlaintextReasoningReplay } from "../../adapters/openai-responses/passthrough";
 
 /**
  * Adapters whose continuation state must survive Codex's store:false requests.
@@ -107,6 +108,53 @@ export function bindRouteReasoningReplayScope(args: {
   forwardHeaders?: Headers;
 }): void {
   const { parsed, providerName, provider, adapterName } = args;
+  const replayIdentity = routeReasoningReplayIdentity({
+    ...args,
+    modelId: parsed.modelId,
+  });
+  const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
+  const continuationOwner = providerContinuationOwnerFromReplayIdentity(
+    replayIdentity && continuationDestinationIdentity
+      ? { ...replayIdentity, providerDestinationIdentity: continuationDestinationIdentity }
+      : undefined,
+  );
+  if (adapterName === "cursor") {
+    // The final route owner is authoritative for Cursor and supersedes the account-derived
+    // seed assigned before route binding. A Cursor conversation must be scoped to the exact
+    // provider/destination/adapter/model/credential that serves it.
+    if (continuationOwner) parsed._cursorIdentityScope = providerContinuationRouteScope(continuationOwner);
+    else if (!parsed._cursorIdentityScope?.startsWith("cursor-unowned:")) {
+      // Prevent the adapter's token-only fallback from recreating a provider-private id after the
+      // route owner failed closed. The sentinel is per parsed request and contains no credential.
+      parsed._cursorIdentityScope = `cursor-unowned:${randomUUID()}`;
+    }
+  }
+  bindReasoningReplayScope(
+    parsed._reasoningReplayScope,
+    replayIdentity,
+  );
+  // Keep this sticky for the whole outbound request: a later auth/key rebind may compare equal
+  // after the first mismatch, but it cannot make history minted by the prior route decodable.
+  if (reasoningReplayServingIdentityChanged(parsed._reasoningReplayScope)) {
+    parsed._stripReasoningEncryptedContent = true;
+  }
+  if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
+    parsed._stripReasoningEncryptedContent = true;
+  }
+  bindProviderContinuationForRoute(parsed, continuationOwner);
+}
+
+
+function routeReasoningReplayIdentity(args: {
+  providerName: string;
+  provider: OcxProviderConfig;
+  adapterName: string;
+  modelId: string;
+  oauthCredentialSnapshot?: Pick<OAuthAccessSnapshot, "accountId" | "generation">;
+  codexAuthContext?: CodexAuthContext;
+  forwardHeaders?: Headers;
+}): OcxReasoningReplayIdentity | undefined {
+  const { providerName, provider, adapterName, modelId } = args;
   let credentialIdentity: string | undefined;
   let credentialDurableIdentity: string | undefined;
   const durableSalt = thoughtSignatureReplaySalt();
@@ -165,47 +213,72 @@ export function bindRouteReasoningReplayScope(args: {
     );
   }
   const providerDestinationIdentity = reasoningReplayDestinationIdentity(provider.baseUrl);
-  const replayIdentity: OcxReasoningReplayIdentity | undefined = credentialIdentity && providerDestinationIdentity
+  return credentialIdentity && providerDestinationIdentity
     ? {
         providerName,
         providerDestinationIdentity,
         providerDestinationDurableIdentity: durableReplayDestinationIdentity(provider.baseUrl),
         adapterName,
-        modelId: parsed.modelId,
+        modelId,
         credentialIdentity,
         ...(credentialDurableIdentity ? { credentialDurableIdentity } : {}),
       }
     : undefined;
-  const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
-  const continuationOwner = providerContinuationOwnerFromReplayIdentity(
-    replayIdentity && continuationDestinationIdentity
-      ? { ...replayIdentity, providerDestinationIdentity: continuationDestinationIdentity }
-      : undefined,
-  );
-  if (adapterName === "cursor") {
-    // The final route owner is authoritative for Cursor and supersedes the account-derived
-    // seed assigned before route binding. A Cursor conversation must be scoped to the exact
-    // provider/destination/adapter/model/credential that serves it.
-    if (continuationOwner) parsed._cursorIdentityScope = providerContinuationRouteScope(continuationOwner);
-    else if (!parsed._cursorIdentityScope?.startsWith("cursor-unowned:")) {
-      // Prevent the adapter's token-only fallback from recreating a provider-private id after the
-      // route owner failed closed. The sentinel is per parsed request and contains no credential.
-      parsed._cursorIdentityScope = `cursor-unowned:${randomUUID()}`;
-    }
-  }
-  bindReasoningReplayScope(
-    parsed._reasoningReplayScope,
-    replayIdentity,
-  );
-  // Keep this sticky for the whole outbound request: a later auth/key rebind may compare equal
-  // after the first mismatch, but it cannot make history minted by the prior route decodable.
-  if (reasoningReplayServingIdentityChanged(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
-  }
-  if (reasoningReplayOpaqueBlobRejectionMemoized(parsed._reasoningReplayScope)) {
-    parsed._stripReasoningEncryptedContent = true;
-  }
-  bindProviderContinuationForRoute(parsed, continuationOwner);
+}
+
+
+/**
+ * Whether this exact route cannot satisfy its documented plaintext reasoning replay contract.
+ *
+ * A generic plaintext-preserving gateway is not made ineligible. Unknown serving provenance also
+ * stays eligible; only a proven route mismatch may suppress a combo candidate.
+ */
+export function mandatoryResponsesReasoningReplayUnavailable(args: {
+  body: unknown;
+  clientThreadId: string | undefined;
+  providerName: string;
+  provider: OcxProviderConfig;
+  adapterName: string;
+  modelId: string;
+}): boolean {
+  const { body, clientThreadId, provider, adapterName } = args;
+  if (
+    adapterName !== "openai-responses"
+    || !requiresPlaintextReasoningReplay(provider)
+    || !clientThreadId
+    || !requestCarriesTools(body)
+    || !hasOpaqueOnlyReasoningItem(body)
+  ) return false;
+
+  const current = routeReasoningReplayIdentity(args);
+  return reasoningReplayServingIdentityChanged({ clientThreadId, current });
+}
+
+
+function requestCarriesTools(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  return Array.isArray((body as { tools?: unknown }).tools)
+    && (body as { tools: unknown[] }).tools.length > 0;
+}
+
+
+function hasOpaqueOnlyReasoningItem(body: unknown): boolean {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const input = (body as { input?: unknown }).input;
+  if (!Array.isArray(input)) return false;
+  return input.some(item => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+    const reasoning = item as Record<string, unknown>;
+    if (reasoning.type !== "reasoning" || typeof reasoning.encrypted_content !== "string") return false;
+    const content = reasoning.content;
+    const hasPlaintext = Array.isArray(content) && content.some(part =>
+      !!part && typeof part === "object" && !Array.isArray(part)
+      && (part as Record<string, unknown>).type === "reasoning_text"
+      && typeof (part as Record<string, unknown>).text === "string"
+      && ((part as Record<string, unknown>).text as string).length > 0
+    );
+    return !hasPlaintext;
+  });
 }
 
 

package/src/server/responses/core.ts

@@ -10,6 +10,7 @@ import { createTranslatorBudget } from "../../lib/translator-budget";
 import { captureExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import { captureCallerDirectAuth } from "../../providers/caller-authorization";
 import { createRequestExecutionBudget } from "../../lib/request-execution-budget";
+import { attachRequestSpendTracker } from "./request-spend";
 import { finalizeOwnedTranslatorBudget } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
@@ -56,9 +57,8 @@ export async function handleResponses(
       visionDescribeTerminal: options.visionDescribeTerminal === true
         || req.headers.get("x-opencodex-vision-describe") === "1",
       translatorBudget,
-      // Created once at genuine ingress; a combo child arrives with the parent's holder already
-      // in options and must not start a fresh allowance.
-      sendBudget: options.sendBudget ?? createRequestExecutionBudget(),
+      // Once at ingress, spend observer included: a combo child inherits the parent's holder.
+      sendBudget: options.sendBudget ?? createRequestExecutionBudget(undefined, undefined, attachRequestSpendTracker(req, logCtx)),
     });
     return ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
   } catch (error) {

package/src/server/responses/encrypted-payload.ts

@@ -78,7 +78,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,

package/src/server/responses/fetch-helpers.ts

@@ -1,3 +1,4 @@
+import type { NativeResponseControl } from "./native-response-control";
 import type { Server } from "bun";
 import {
   codexWsUpstreamFetch,
@@ -53,6 +54,7 @@ export interface PaceAwareFetch {
 export type ProviderFetch = typeof globalThis.fetch & PaceAwareFetch;
 
 export interface ProviderFetchOptions {
+  nativeControl?: NativeResponseControl;
   providerName?: string;
   modelId?: string;
   /** One pacing slot was acquired immediately before this fetch wrapper was created. */
@@ -101,7 +103,8 @@ export function providerFetch(
       // used, protocol pin included: a WS turn that falls back is serving the
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
       // there would silently negotiate a transport the operator ruled out.
-      return codexWsUpstreamFetch(input, init, httpFetch, runtime, options.onCodexWsQuota, options.beforeDispatch);
+      return codexWsUpstreamFetch(input, init, httpFetch, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
+        () => waitForPacing(init.signal ?? undefined));
     }
     return httpFetch(input, init);
   };