@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/server/responses/passthrough-dispatch.ts

@@ -1,3 +1,7 @@
+import { createSteeringSettingsNormalizer } from "./native-steering-policy";
+import { nativeResponseControlEligible } from "./native-response-control";
+import { NativeInjectionReplay } from "./native-injection-replay";
+import { NativeSteeringReplay } from "./native-steering-replay";
 import type {
   ResponsesRequestContext,
   ResponsesAdmissionState,
@@ -10,7 +14,7 @@ import type { ResponsesSendBudget } from "./request-send-budget";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { codexSafetyBufferingFilterOptions, terminalStatusFromParsed } from "../relay";
 import { imageGenToolCallAliases } from "../responses-image-gen-repair";
-import { rememberResponseState } from "../../responses/state";
+import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
 import {
   currentTurnWireToolCatalogBody,
   hasExplicitWireToolCatalog,
@@ -29,6 +33,7 @@ import {
   unwrapUpstreamRetryEvidenceError,
   codexProbeLeaseId,
   codexProbeQuotaScope,
+  codexTransientProbeGrant,
   createCodexReserveDispatchGuard,
 } from "../../codex/auth-context";
 import {
@@ -60,7 +65,6 @@ import { restorePlaintextV2AgentMessageCalls } from "../../responses/plaintext-v
 import {
   recordAdapterReasoning,
   recordAdapterTier,
-  noteAttemptSend,
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
@@ -80,6 +84,7 @@ import {
   safeHostLabel,
   storedPoolReplayDispatchNotifier,
 } from "./fetch-helpers";
+import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { clientCancelledResponse } from "./core-errors";
 import {
   upstreamHostCircuitOpenResponse,
@@ -101,6 +106,7 @@ import {
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
   TRANSIENT_RETRY_MAX_ATTEMPTS,
+  isNonReplayableResponse,
   prepareSameTarget429Wait,
   sleepWithAbort,
 } from "../../lib/upstream-retry";
@@ -171,6 +177,7 @@ export async function preparePassthroughExchange(
     | "replayOAuthCredentialSnapshot"
     | "genericFailovers"
     | "applyFailoverSnapshot"
+    | "noteRoutedAttemptSend"
   >,
   responseEffects: Pick<
     ResponsesEffects,
@@ -248,6 +255,19 @@ export async function preparePassthroughExchange(
       ? (response: { id?: unknown; output?: unknown; status?: unknown }) =>
         rememberResponseState(parsed._rawBody, response, undefined, responseStateOptions(true))
       : undefined;
+    if (options.nativeControl && nativeResponseControlEligible(route.provider, options.nativeControl)
+      && options.inboundTransport === "websocket" && !options.comboAttempt) {
+      const body = parsed._rawBody as Record<string, unknown>;
+      if (options.nativeControl.kind === "steering") {
+        options.nativeControl.normalizeContinuation = createSteeringSettingsNormalizer(parsed, route, config, req.headers);
+      }
+      const Replay = options.nativeControl.kind === "injection" ? NativeInjectionReplay : NativeSteeringReplay;
+      options.nativeControl.replayFactory = () => new Replay(body.input, (input, response) => {
+        if (passthroughRecordEligible && !isBodyNonPersistable(body)) {
+          rememberResponseState({ ...body, input }, response, undefined, responseStateOptions(true));
+        }
+      });
+    }
     if (parsed.previousResponseId && !parsed._previousResponseInputExpanded) {
       console.warn(
         `[responses] previous_response_id ${parsed.previousResponseId} not found in local replay state `
@@ -346,10 +366,13 @@ export async function preparePassthroughExchange(
     const declaredWireToolNames = new Set<string>();
     const declaredBareWireToolNames = new Set<string>();
     const declaredNamelessClientCallTypes = new Set<string>();
-    // `buildToolBridgeMaps` creates a bare alias only when the caller selected exactly one
-    // namespaced tool through a bare tool_choice. Restore that request-bounded identity before
-    // authorization checks instead of admitting the bare name into the declared set: for `exec`,
-    // the latter would also authorize the unrelated code-mode helper names.
+    // `buildToolBridgeMaps` adds each eligible bare alias to `declaredToolNames` and `toolNsMap`
+    // (one authorized identity claims the bare name). `refreshUndeclaredToolGuard` normally copies
+    // those entries into `declaredWireToolNames`, but passthrough restoration runs before the
+    // undeclared-tool guard, so restore that request-bounded identity here, before authorization
+    // checks. `exec` uses separate handling: its bridge alias is copied into the declared set only
+    // when the client itself declared bare `exec`, because otherwise code-mode normalization could
+    // authorize the unrelated code-mode helper names.
     const authorizedBareNamespaceToolAliases: RoutedNamespaceToolAliases = new Map(
       [...toolBridgeMaps.toolNsMap].flatMap(([alias, identity]) =>
         alias === identity.name
@@ -736,6 +759,7 @@ export async function preparePassthroughExchange(
           modelId: route.modelId,
           probeLeaseId: codexProbeLeaseId(admissionState.authCtx),
           probeQuotaScope: codexProbeQuotaScope(admissionState.authCtx),
+          transientProbe: codexTransientProbeGrant(admissionState.authCtx),
           writerGeneration: admissionState.authCtx.writerGeneration,
         });
       }
@@ -752,13 +776,22 @@ export async function preparePassthroughExchange(
       // Body is a replayable string; nothing has streamed to the client yet.
       upstreamResponse = await fetchWithTransientRetry(
         recovery => {
-          noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery);
+          // The pool-wide recovery window measures recovery traffic against observed demand,
+          // and this is where demand is observed: `recovery === undefined` is a new request's
+          // first send, everything after it is the same request trying again. Without this the
+          // ratio has no denominator and the window collapses to its quiet-pool floor, which
+          // would throttle recovery on a busy proxy exactly as hard as on an idle one (#4701).
+          if (recovery === undefined) classifyPoolRecoveryDispatch("initial");
+          transportState.noteRoutedAttemptSend(passthroughEstimate, recovery);
           return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
             method: request.method,
             headers: request.headers,
             body: request.body,
           }, recovery), upstream.signal, connectMs, parsed.stream,
             providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
               providerName: route.providerName,
               modelId: route.modelId,
@@ -848,13 +881,16 @@ export async function preparePassthroughExchange(
             if (allowance.permit && !allowance.permit.use()) {
               throw new SendBudgetExhaustedError(safeHostLabel(request.url));
             }
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, innerRecovery ?? recovery);
+            transportState.noteRoutedAttemptSend(passthroughEstimate, innerRecovery ?? recovery);
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,
               body: request.body,
             }, innerRecovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -946,7 +982,7 @@ export async function preparePassthroughExchange(
         // every other build site; a replay is exactly when a grown payload reappears.
         const replayBodyRefusal = refuseOversizedOutboundBody(request);
         if (replayBodyRefusal) return replayBodyRefusal;
-        noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, "oauth-401");
+        transportState.noteRoutedAttemptSend(passthroughEstimate, "oauth-401");
         upstreamResponse = await fetchWithHeaderTimeout(
           request.url,
           { method: request.method, headers: request.headers, body: request.body },
@@ -961,6 +997,9 @@ export async function preparePassthroughExchange(
           // here on is a genuine transport attempt.
           storedPoolReplayDispatchNotifier(
             providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
               providerName: route.providerName,
               modelId: route.modelId,
@@ -1075,13 +1114,16 @@ export async function preparePassthroughExchange(
       try {
         upstreamResponse = await fetchWithTransientRetry(
           recovery => {
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery ?? "oauth-401");
+            transportState.noteRoutedAttemptSend(passthroughEstimate, recovery ?? "oauth-401");
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,
               body: request.body,
             }, recovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -1105,6 +1147,10 @@ export async function preparePassthroughExchange(
     // the same quorum, cooldown and request budget here, before any client bytes flow.
     if (
       upstreamResponse.status === 429
+      // Not a provider rate limit when this proxy synthesized it for a refused reset
+      // replay; rotating accounts on it would re-send an inference that may already
+      // have run and would cool down an account that refused nothing.
+      && !isNonReplayableResponse(upstreamResponse)
       && transportState.genericFailoverAccountId
       && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
       && isGenericOAuthFailoverEnabled(config, route.providerName)
@@ -1159,6 +1205,7 @@ export async function preparePassthroughExchange(
     // keep their pool logic below (rateLimitRetryPolicyFor returns null for them).
     while (
       upstreamResponse.status === 429
+      && !isNonReplayableResponse(upstreamResponse)
       && rateLimitPolicy !== null
       && rateLimitRetries < rateLimitPolicy.attempts
       // Checked here rather than inside the helper: prepareSameTarget429Wait releases the 429
@@ -1192,13 +1239,16 @@ export async function preparePassthroughExchange(
           recovery => {
             // The first send of every replay is itself a rate-limit retry; inner transient-5xx
             // recoveries keep their own label (recovery is provided for those).
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery ?? "rate-limit-429");
+            transportState.noteRoutedAttemptSend(passthroughEstimate, recovery ?? "rate-limit-429");
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,
               body: request.body,
             }, recovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,

package/src/server/responses/passthrough-error.ts

@@ -1,5 +1,6 @@
 import { formatErrorResponse } from "../../bridge";
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../../lib/errors";
+import { isReplayRefusalCode, UPSTREAM_RESET_REPLAY_REFUSED_CODE } from "../../lib/upstream-retry";
 import {
   resolveClientRetryAfter,
   validateClientRetryAfterHeader,
@@ -24,6 +25,26 @@ function isCyberPolicyBody(body: string): boolean {
   return false;
 }
 
+/**
+ * True for a body this proxy wrote to refuse replaying an ambiguous pre-header reset.
+ *
+ * It is read off the body rather than a marker because this formatter is handed bytes, not
+ * the response they came from, and the refusal reaches it after the original body was read.
+ * The code is this proxy's own, so an upstream echoing it is not a case worth widening for.
+ */
+function isReplayRefusalBody(body: string): boolean {
+  if (!body.includes(UPSTREAM_RESET_REPLAY_REFUSED_CODE)) return false;
+  try {
+    const parsed = JSON.parse(body) as Record<string, unknown>;
+    const error = parsed.error && typeof parsed.error === "object" && !Array.isArray(parsed.error)
+      ? parsed.error as Record<string, unknown>
+      : undefined;
+    return isReplayRefusalCode(error?.code) || isReplayRefusalCode(parsed.code);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Passthrough adapters historically relayed upstream non-2xx bodies verbatim.
  * Codex maps an *empty* body to the literal client string "Unknown error"
@@ -38,6 +59,9 @@ function isCyberPolicyBody(body: string): boolean {
  * - missing/malformed values are replaced when resolveClientRetryAfter yields a value
  * - malformed/expired values are removed when the resolver returns undefined
  *   (e.g. quota-exhausted 429s must not keep junk headers or get the synthetic "2")
+ * - a replay refusal this proxy wrote gets none and keeps none: the whole point of the
+ *   refusal is that the turn may already be running, and the synthetic default for a
+ *   retryable 429 is a direct instruction to the client to send it a second time
  */
 export function formatPassthroughUpstreamError(
   status: number,
@@ -46,6 +70,13 @@ export function formatPassthroughUpstreamError(
     statusText?: string;
     headers?: Headers;
     now?: number;
+    /**
+     * Provenance from the caller that still holds the response: this body is a refusal this
+     * proxy synthesized. The body check below is the fallback for a re-wrapped body, and it
+     * cannot answer at all when the bounded read returned nothing display-safe -- which is
+     * precisely when the empty-body branch would invent the retryable-429 default.
+     */
+    replayRefusal?: boolean;
   },
 ): Response {
   const trimmed = bodyText.trim();
@@ -53,7 +84,12 @@ export function formatPassthroughUpstreamError(
   const upstreamRetryAfter = options?.headers?.get("retry-after")?.trim() || undefined;
   const originalValid = validateClientRetryAfterHeader(upstreamRetryAfter, now);
   const cyberPolicyFailure = isCyberPolicyBody(trimmed);
-  const resolved = cyberPolicyFailure
+  // Two different reasons to answer with no wait at all, handled the same way: a hard policy
+  // block will not become servable, and a refusal we made was never a rate limit.
+  const suppressRetryAfter = cyberPolicyFailure
+    || options?.replayRefusal === true
+    || isReplayRefusalBody(trimmed);
+  const resolved = suppressRetryAfter
     ? undefined
     : resolveClientRetryAfter({
       status,
@@ -64,7 +100,7 @@ export function formatPassthroughUpstreamError(
 
   if (trimmed) {
     const needsSet = resolved !== undefined && upstreamRetryAfter !== resolved;
-    const needsDelete = (cyberPolicyFailure && upstreamRetryAfter !== undefined)
+    const needsDelete = (suppressRetryAfter && upstreamRetryAfter !== undefined)
       || (resolved === undefined
         && upstreamRetryAfter !== undefined
         && originalValid === undefined);

package/src/server/responses/request-prepare.ts

@@ -35,6 +35,8 @@ import {
   codexPoolAffinityKey,
   previewCodexPoolLineage,
   applyCodexAuthContextToProvider,
+  hasCallerCodexBearer,
+  requestOwnedMainPinState,
 } from "../../codex/auth-context";
 import {
   copyPreviousResponseReplayProvenance,
@@ -84,7 +86,11 @@ import {
   canPassThroughEncryptedV2AgentTask,
   applyFinalRouteRequestNormalization,
 } from "./core-normalize";
-import { resolveCodexModelEntitlements } from "../../codex/model-entitlements";
+import {
+  cachedDeniedCodexAccountIdsForModel,
+  resolveCodexModelEntitlements,
+} from "../../codex/model-entitlements";
+import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import {
   previewCodexAccountForRequest,
   codexQuotaScopeForModel,
@@ -101,7 +107,7 @@ import {
   isCodexReserveHelperUnsupported,
   CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE,
 } from "../../codex/loopback-target";
-import { checkInputAdmission } from "./input-admission";
+import { checkComboTargetInputAdmission, checkInputAdmission } from "./input-admission";
 import { nativeContextLimits } from "../../codex/catalog";
 import { streamingContextOverflowResponse } from "./context-overflow";
 import {
@@ -115,6 +121,8 @@ import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
   applyAccountChangeConversationStateScrub,
+  accountChangeFileReferenceRefusal,
+  conversationCarriesUploadedFiles,
 } from "./account-change-state";
 
 /** Parses, selects, and admits one request without changing the dispatch policy. */
@@ -365,6 +373,14 @@ export async function prepareResponsesRequest(
   }
   logCtx.requestedModel = parsed.modelId;
   logCtx.requestedEffort = parsed.options.reasoning;
+  // What this request may spend beyond its input, for the durable spend reservation (#4707).
+  // Read from the caller rather than from the adapter's serialized body, because the
+  // reservation has to exist before the body does. A caller that omits it leaves the
+  // provider/model default in charge and reserves only the input estimate; settlement then
+  // books the real figure, so the gap is a looser bound up front, never a wrong one after.
+  if (typeof parsed.options.maxOutputTokens === "number" && parsed.options.maxOutputTokens > 0) {
+    logCtx.spendOutputCeilingTokens = Math.trunc(parsed.options.maxOutputTokens);
+  }
   logCtx.callerServiceTier = sanitizeLogMetadataString(parsed.options.serviceTier);
   logCtx.requestedServiceTier = parsed.options.serviceTier;
   logCtx.requestedSpeedLabel = requestLogSpeedLabel(parsed.options.serviceTier);
@@ -442,12 +458,67 @@ export async function prepareResponsesRequest(
     && (route.codexAccountId === undefined || initialSubagentFallbackChain !== null)
     ? codexAccountSelectionForTurn(options.turnAdmissionLease)?.()
     : undefined;
+  // The credential headers final authentication will be given, resolved once and reused by
+  // everything below that has to predict what final auth decides.
+  const previewAuthHeaders = codexRouteCredentialDomainHeaders(
+    req,
+    route,
+    options,
+    credentialDomainWasRewritten,
+  );
+  // Does the CALLER own the credential this request will authenticate with? Validated exactly
+  // the way final auth validates it: the route ownership predicate AND the caller-bearer check
+  // `resolveCodexAuthContext` re-applies to these same headers.
+  const previewRequestScopedMainCredential = codexRouteCredentialOwnership(
+    previewAuthHeaders,
+    config,
+    route,
+    options,
+  ).requestScopedMainCredential && hasCallerCodexBearer(previewAuthHeaders);
   const nativeMainRecoveryBlocked = isNativeMainTrafficBlocked();
-  const nativeMainReadsForbidden = nativeMainRecoveryBlocked
+  // The same three inputs final auth ORs together (src/codex/auth-context.ts). Request-owned
+  // ownership is first there and has to be first here: computing the preview fence from
+  // recovery and drain state alone let a `thread_spawn` carrying a forwardable caller bearer
+  // read the physical main token it is forbidden to touch, and score main differently than the
+  // resolution this preview exists to predict.
+  const nativeMainReadsForbidden = previewRequestScopedMainCredential
+    || nativeMainRecoveryBlocked
     || previewSelectionAdmission?.mainProfileDraining === true;
+  // The liveness answer final authentication gives its own selection options, computed from the
+  // same shared predicate so the two cannot drift apart again (#4850). `fixedAccountId` is
+  // mirrored through `route.codexAccountId` because that is literally what core-auth.ts passes
+  // as `accountId`. A reserve-authorized request is the one input where the two can differ, and
+  // it differs harmlessly: reserve plus a caller bearer is served as main either way, which is
+  // the answer this produces.
+  const previewRequestOwnedMainPin = requestOwnedMainPinState(
+    previewAuthHeaders,
+    config,
+    options.codexAuthPolicy ?? config,
+    previewRequestScopedMainCredential,
+    route.codexAccountId,
+  ).preserve;
+  // Deliberately NOT fenced on ownership: final auth derives `nativeMainSelectionOnly` from the
+  // drain alone, and adding a term here would diverge from it in the other direction.
   const previewSelectionOptions = {
     nativeMainSelectionOnly: !nativeMainRecoveryBlocked
       && previewSelectionAdmission?.mainProfileDraining === true,
+    // Pool eligibility was the last part of preview still outside the fence (#4850). Without
+    // this seam `codexAccountUnusableReason` takes its default branch into
+    // `isMainAccountCredentialUsable()`, which opens the physical `auth.json` -- twice per
+    // spawn, because subagent fallback re-enters the preview through the callback below.
+    //
+    // Scoped to ownership, and carrying final auth's value rather than a constant, because
+    // preview exists to predict final auth. Under an effective main pin the request really is
+    // served by its own main credential, so main must stay eligible; without the pin final auth
+    // scores main `main_credential_unavailable` and drops it, so preview has to drop it too. A
+    // hardcoded `true` would be wrong in the second case and `false` in the first.
+    isMainAccountTokenLive: previewRequestScopedMainCredential
+      ? () => previewRequestOwnedMainPin
+      : undefined,
+    // Preview must reach the same answer as the final resolution, including the uploaded-file
+    // retention (#4778): a preview that reported a quota move the request will not make would
+    // hand subagent fallback a different account than the one that actually serves.
+    retainAccountForUploadedFiles: conversationCarriesUploadedFiles(parsed._rawBody),
   };
   let selectedForwardHeaders = req.headers;
   let subagentFallbackAccountId = config.activeCodexAccountId ?? null;
@@ -466,22 +537,11 @@ export async function prepareResponsesRequest(
   // deliberately create no affinity at all -- previewing a family binding for one of those would
   // hand model fallback an account this request can never authenticate as. Read-only: the record
   // is written by the resolution that binds, never by a preview that may own no Pool state.
-  const previewAuthHeaders = codexRouteCredentialDomainHeaders(
-    req,
-    route,
-    options,
-    credentialDomainWasRewritten,
-  );
   const poolLineage = previewCodexPoolLineage(previewAuthHeaders, options.codexAuthPolicy ?? config, {
     accountId: route.codexAccountId,
     modelId: route.modelId,
     admission: options.admission,
-    requestScopedMainCredential: codexRouteCredentialOwnership(
-      previewAuthHeaders,
-      config,
-      route,
-      options,
-    ).requestScopedMainCredential,
+    requestScopedMainCredential: previewRequestScopedMainCredential,
   });
 
   try {
@@ -519,7 +579,20 @@ export async function prepareResponsesRequest(
       config,
       previewNow,
       codexQuotaScopeForModel(modelId),
-      { ...previewSelectionOptions, modelEligibleAccountIds },
+      {
+        ...previewSelectionOptions,
+        modelEligibleAccountIds,
+        // Per CANDIDATE model, like the scope and the eligible set above: the preference is
+        // model-specific, so hoisting it out of the closure would score every fallback
+        // candidate against the requested model's evidence and diverge from final auth (#4768).
+        // Under the same native-main read fence final auth applies: the reader validates each
+        // cached roster against the account's current credential, and for main that is a
+        // synchronous read of the stored token. A preview that read it would both cross the
+        // fence and score main differently than the resolution it is supposed to predict.
+        deniedModelAccountIds: cachedDeniedCodexAccountIdsForModel(modelId, previewNow, {
+          excludeAccountIds: nativeMainReadsForbidden ? new Set([MAIN_CODEX_ACCOUNT_ID]) : undefined,
+        }),
+      },
       modelId,
       poolLineage,
     );
@@ -650,9 +723,45 @@ export async function prepareResponsesRequest(
           const fallback = (() => {
             try {
               const recoveryNativeMainBlocked = isNativeMainTrafficBlocked();
+              // Recompute ownership here rather than reusing the pre-decryption value: a
+              // subagent fallback above may have re-routed, and `requestScopedMainCredential`
+              // is a function of the route as well as the headers.
+              const recoveryAuthHeaders = codexRouteCredentialDomainHeaders(
+                req,
+                route,
+                options,
+                credentialDomainWasRewritten,
+              );
+              const recoveryRequestScopedMainCredential = codexRouteCredentialOwnership(
+                recoveryAuthHeaders,
+                config,
+                route,
+                options,
+              ).requestScopedMainCredential && hasCallerCodexBearer(recoveryAuthHeaders);
+              // Recovery's own answer to the same question, against the route it may have moved
+              // to. Reconstructing the options without it is what left pool eligibility outside
+              // the fence on the first preview (#4850); recovery re-previews, so it would leave
+              // the same two reads on the one path that runs after decryption.
+              const recoveryRequestOwnedMainPin = requestOwnedMainPinState(
+                recoveryAuthHeaders,
+                config,
+                options.codexAuthPolicy ?? config,
+                recoveryRequestScopedMainCredential,
+                route.codexAccountId,
+              ).preserve;
               const recoverySelectionOptions = {
                 nativeMainSelectionOnly: !recoveryNativeMainBlocked
                   && recoverySelectionAdmission?.mainProfileDraining === true,
+                isMainAccountTokenLive: recoveryRequestScopedMainCredential
+                  ? () => recoveryRequestOwnedMainPin
+                  : undefined,
+                // #4778, same reason as `previewSelectionOptions` above: this preview decides
+                // which account subagent fallback scores against, and final auth passes the
+                // retention. Recovery is exactly where the two could diverge -- it re-previews
+                // against the DECRYPTED body, which is the first point at which a file reference
+                // that was ciphertext-only becomes readable, so reconstructing the options
+                // without the bit lets preview report a quota move the request will not make.
+                retainAccountForUploadedFiles: conversationCarriesUploadedFiles(parsed._rawBody),
               };
               const recoveryNow = Date.now();
               // Carry the entitlement filter through recovery too (#2509/#2623). The scope was
@@ -665,7 +774,21 @@ export async function prepareResponsesRequest(
                 config,
                 previewNow,
                 codexQuotaScopeForModel(modelId),
-                { ...recoverySelectionOptions, modelEligibleAccountIds },
+                {
+                  ...recoverySelectionOptions,
+                  modelEligibleAccountIds,
+                  // Same read fence as the first preview, evaluated against recovery's own view
+                  // of the drain AND of credential ownership, rather than the one captured before
+                  // decryption. Omitting ownership here would reopen the fence the first preview
+                  // closes, on the one path that re-previews after the route may have moved.
+                  deniedModelAccountIds: cachedDeniedCodexAccountIdsForModel(modelId, previewNow, {
+                    excludeAccountIds: recoveryRequestScopedMainCredential
+                      || recoveryNativeMainBlocked
+                      || recoverySelectionAdmission?.mainProfileDraining === true
+                      ? new Set([MAIN_CODEX_ACCOUNT_ID])
+                      : undefined,
+                  }),
+                },
                 modelId,
                 poolLineage,
               );
@@ -860,7 +983,12 @@ export async function prepareResponsesRequest(
   // refusing the turn that shrinks the context would deadlock the client against the very
   // limit this gate reports — it would be told to compact and then denied the compaction.
   if (parsed._compactionRequest !== true) {
-    const inputAdmission = checkInputAdmission(parsed, route.provider, route.providerName, parsed.modelId, nativeContextLimits(config));
+    // A combo child is the one caller that can afford a strict gate: skipping a target it
+    // cannot fit is safe before any upstream bytes are sent, and the ladder continues. A
+    // direct request has nowhere to go, so it keeps the loose pathological-input gate.
+    const inputAdmission = options.comboAttempt
+      ? checkComboTargetInputAdmission(parsed, route.provider, route.providerName, parsed.modelId, nativeContextLimits(config))
+      : checkInputAdmission(parsed, route.provider, route.providerName, parsed.modelId, nativeContextLimits(config));
     if (!inputAdmission.admitted) {
       // #1524: this is a LOCAL preflight refusal, not an upstream verdict. A policy or combo
       // fallback must be able to skip this candidate and try one whose context window fits,
@@ -876,9 +1004,13 @@ export async function prepareResponsesRequest(
       return formatErrorResponse(
         413,
         "input_admission_refused",
-        `Estimated input (~${inputAdmission.estimatedTokens} tokens) is far past the context window `
-          + `of ${parsed.modelId} (${inputAdmission.ceiling} tokens). Start a new session or choose a `
-          + `model with a larger context window.`,
+        inputAdmission.requiredOutputHeadroom !== undefined
+          ? `Estimated input (~${inputAdmission.estimatedTokens} tokens) plus ${inputAdmission.requiredOutputHeadroom} `
+            + `tokens of requested output headroom cannot fit the context window of ${parsed.modelId} `
+            + `(${inputAdmission.ceiling} tokens).`
+          : `Estimated input (~${inputAdmission.estimatedTokens} tokens) is far past the context window `
+            + `of ${parsed.modelId} (${inputAdmission.ceiling} tokens). Start a new session or choose a `
+            + `model with a larger context window.`,
       );
     }
   }
@@ -897,7 +1029,18 @@ export async function prepareResponsesRequest(
   let substituteMainCredential = false;
   let callerAuthHeaders: Headers;
   {
-    const finalAuth = await resolveResponsesCodexAuth(req, config, route, options, credentialDomainWasRewritten);
+    // #4778: uploaded files are scoped to the account that issued them, so a conversation
+    // carrying live references must retain its binding across a voluntary quota move. Answered
+    // from the body alone, by the same predicate the refusal guard uses, so the two can never
+    // disagree about which conversations are in scope.
+    const finalAuth = await resolveResponsesCodexAuth(
+      req,
+      config,
+      route,
+      options,
+      credentialDomainWasRewritten,
+      conversationCarriesUploadedFiles(parsed._rawBody),
+    );
     if (!finalAuth.ok) return finalAuth.response;
     admissionState.authCtx = finalAuth.authCtx;
     selectedForwardHeaders = withClaudeNativeSession(finalAuth.headers, route.provider, options.claudeNativeSessionId);
@@ -921,6 +1064,14 @@ export async function prepareResponsesRequest(
   {
     const binding = conversationStateBindingFromAuth(admissionState.authCtx, poolAffinityKey);
     if (binding) {
+      // Before the scrub, because a file reference is refused rather than removed and the
+      // refusal has to happen while there is still no dispatch to undo.
+      const refusal = accountChangeFileReferenceRefusal({
+        body: parsed._rawBody,
+        bindingKey: binding.bindingKey,
+        servingAccountId: binding.accountId,
+      });
+      if (refusal) return refusal;
       applyAccountChangeConversationStateScrub({
         body: parsed._rawBody,
         parsed,