@bitkyc08/opencodex 2.56.0 → 2.58.0

package/src/server/responses/request-send-budget.ts

@@ -5,7 +5,13 @@ import { workflowRefusalResponse } from "../workflow-refusal";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { noteAttemptSend } from "../request-log";
 import { TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
-import type { SingleUseDispatchPermit, SendClass } from "../../lib/request-execution-budget";
+import type {
+  DispatchDecision,
+  DispatchIntent,
+  RequestExecutionBudget,
+  SendClass,
+  SingleUseDispatchPermit,
+} from "../../lib/request-execution-budget";
 
 /** Owns the shared request send counter and recovery permits. */
 export function createResponsesSendBudget(
@@ -52,7 +58,7 @@ export function createResponsesSendBudget(
   /**
    * Records an adapter's OWN inner retries against this attempt.
    *
-   * Ordinal 1 is the send each call site already recorded through `noteAttemptSend`, so only
+   * Ordinal 1 is the send each call site already recorded through `noteRoutedAttemptSend`, so only
    * the extra physical sends are added here and an adapter that does not retry internally
    * leaves its log byte-for-byte as it was. Kiro reaches roughly eighteen sends per call and
    * Cursor re-sends a whole turn, and both reported one; a count that cannot be observed
@@ -75,6 +81,32 @@ export function createResponsesSendBudget(
    * was recovering from.
    */
   let pendingHopPermit: SingleUseDispatchPermit | undefined;
+  /**
+   * The budget an adapter's OWN dispatch ladder reserves against.
+   *
+   * Kiro and Cursor reserve once per physical send, and that is right: their ladders are the
+   * layer that actually sends, and counting one adapter call as one send hid up to eighteen
+   * upstream requests. But a credential hop has already booked the replay it is about to make,
+   * and a reservation IS the charge, so an adapter that reserves again turns one physical send
+   * into two charges -- and once the base allowance is spent, into a refusal that answers with
+   * a synthetic error in place of the 429 the hop was recovering from (#4709).
+   *
+   * The hop hands its reservation down through `pendingHopPermit`, the same seam the
+   * passthrough ladder already uses, and this view spends it on the adapter's FIRST
+   * reservation. Every later send in that ladder is a new physical send and is charged
+   * normally. A permit the adapter takes but never sends under is released through the same
+   * call it would have used for a reservation of its own, so an abandoned replay is refunded
+   * rather than left charged.
+   */
+  const adapterDispatchBudget: RequestExecutionBudget | undefined = adapterSendBudget === undefined
+    ? undefined
+    : adapterDispatchBudgetView(adapterSendBudget, {
+      claimHopPermit: () => {
+        const permit = pendingHopPermit;
+        pendingHopPermit = undefined;
+        return permit;
+      },
+    });
   /**
    * How many sends a recovery leg may make, and the permit that authorises the last one.
    *
@@ -147,6 +179,7 @@ export function createResponsesSendBudget(
     noteTransientSends,
     remainingTransientSendBudget,
     adapterSendBudget,
+    adapterDispatchBudget,
     noteAdapterPhysicalSend,
     sendBudgetExhausted,
     get pendingHopPermit(): SingleUseDispatchPermit | undefined {
@@ -162,3 +195,65 @@ export function createResponsesSendBudget(
 }
 
 export type ResponsesSendBudget = Exclude<ReturnType<typeof createResponsesSendBudget>, Response>;
+
+/**
+ * A LIVE delegating view of one request's execution budget, with a credential hop's
+ * reservation spendable through it.
+ *
+ * Every member forwards rather than copying. A spread of the budget would freeze `used`,
+ * `reserveSpent` and the target counters at construction time, handing the adapter a budget
+ * that can never read as exhausted -- the same class of defect as the fresh per-layer
+ * allowances #4546 removed.
+ */
+function adapterDispatchBudgetView(
+  budget: RequestExecutionBudget,
+  hop: { claimHopPermit: () => SingleUseDispatchPermit | undefined },
+): RequestExecutionBudget {
+  return {
+    get used(): number { return budget.used; },
+    set used(next: number) { budget.used = next; },
+    logicalRequestId: budget.logicalRequestId,
+    policyVersion: budget.policyVersion,
+    policy: budget.policy,
+    get reserveSpent(): boolean { return budget.reserveSpent; },
+    get alternateTargetSends(): number { return budget.alternateTargetSends; },
+    get targetTransitions(): number { return budget.targetTransitions; },
+    get lastTargetKey(): string | undefined { return budget.lastTargetKey; },
+    remainingBaseSends: (cap: number): number => budget.remainingBaseSends(cap),
+    reserveDispatch(intent: DispatchIntent): DispatchDecision {
+      // A dispatch whose upstream state is unknown is refused on its own merits. A hop that
+      // already paid does not make an unsafe replay safe, so that check stays with the budget.
+      if (intent.replaySafe !== false) {
+        const hopPermit = hop.claimHopPermit();
+        // Confirmed here rather than in `use()`: the adapter reserves immediately before it
+        // opens the transport, which is the same boundary the hop's own confirmation uses.
+        // A permit some other leg already settled returns false, and this falls through to a
+        // real reservation rather than handing the adapter a dead permit -- an adapter whose
+        // `use()` fails treats the request as exhausted and stops sending entirely.
+        if (hopPermit !== undefined && hopPermit.assumeCharge()) {
+          let spent = false;
+          return {
+            allowed: true,
+            permit: {
+              sendClass: hopPermit.sendClass,
+              use: (): boolean => {
+                if (spent) return false;
+                spent = true;
+                return true;
+              },
+              assumeCharge: (): boolean => {
+                if (spent) return false;
+                spent = true;
+                return true;
+              },
+              // The hop's charge is already settled and belongs to the leg that asked for it,
+              // so there is nothing here to refund.
+              release: (): void => {},
+            },
+          };
+        }
+      }
+      return budget.reserveDispatch(intent);
+    },
+  };
+}

package/src/server/responses/request-spend.ts

@@ -0,0 +1,147 @@
+import { randomUUID } from "node:crypto";
+import type { RequestSendObserver } from "../../lib/request-execution-budget";
+import { sharedSpendLedger, type SpendReservationLedger } from "../../lib/spend-reservation-ledger";
+import type { RequestLogContext } from "../request-log";
+
+/** The terminal usage a request reported, in the only two fields the ledger books. */
+export interface TerminalSpendUsage {
+  inputTokens?: number;
+  outputTokens?: number;
+}
+
+/** Settles one request's durable spend entries once its terminal usage is known. */
+export interface RequestSpendSettlement {
+  settle(usage: TerminalSpendUsage | undefined): void;
+}
+
+export interface RequestSpendTracker extends RequestSendObserver, RequestSpendSettlement {
+  /** Dispatches this request lost to a ledger ceiling. Zero on every ordinary request. */
+  readonly refusals: number;
+}
+
+/**
+ * One request's entries in the durable spend ledger (#4707).
+ *
+ * The ledger has had the whole reserve/dispatch/settle vocabulary since #4546 and no production
+ * caller: `spend-ledger.jsonl` was never created by ordinary traffic, and the ceilings the
+ * feature advertised stayed process-local and count-only, resetting on restart. This is the
+ * caller.
+ *
+ * It books one entry per physical send by observing the request's own send counter rather than
+ * by being called from each dispatch site. That counter moves exactly once per physical send,
+ * so one entry per increment is one entry per send -- and a dispatch path added later cannot
+ * forget to book, which is how the previous wiring attempt ended up with no caller at all.
+ *
+ * Settlement follows what the request actually learned. The terminal usage belongs to the LAST
+ * send that left, so that one settles with the real figure. Every earlier send failed without
+ * reporting usage of its own and may still have been billed, so it becomes unresolved spend
+ * rather than free. A request that ends with no usage at all -- a cancel, a lost stream --
+ * leaves all of them unresolved, which is the conservative answer this ledger exists to give.
+ */
+export function createRequestSpendTracker(
+  logCtx: Pick<
+    RequestLogContext,
+    "provider" | "accountLogLabel" | "usageLogInputTokens" | "spendOutputCeilingTokens"
+  >,
+  rootId: string | undefined,
+  injected?: SpendReservationLedger,
+): RequestSpendTracker {
+  // Resolved on the first CHARGE, not when the request is built. The shared ledger opens a
+  // journal under the OpenCodex home, and a request that never dispatches -- refused at
+  // admission, answered locally, cancelled before its first send -- has no business creating
+  // one. It also means the home in effect at dispatch is the one that gets written.
+  let ledgerRef: SpendReservationLedger | undefined = injected;
+  const ledger = (): SpendReservationLedger => (ledgerRef ??= sharedSpendLedger());
+  // Every send this request still owes the ledger an answer for, oldest first.
+  const live: string[] = [];
+  let refusals = 0;
+  let resolved = false;
+  /**
+   * Confirm the sends this request has already moved past.
+   *
+   * A booking is only marked dispatched once a LATER send exists, because that later send
+   * proves the earlier one left. The newest booking stays open until it is settled, so a
+   * reservation the budget hands back -- a rotation that found no alternate, a rebuild
+   * abandoned before the wire -- can still be released for free while this process is alive.
+   * A crash resolves every surviving reservation as unresolved spend regardless of this mark,
+   * because a journal that lost its tail cannot prove a send never left.
+   */
+  const confirmOlderSends = (): void => {
+    for (let index = 0; index < live.length - 1; index += 1) ledger().markDispatched(live[index] as string);
+  };
+  return {
+    charge(): boolean {
+      const sendId = randomUUID();
+      const decision = ledger().reserve({
+        sendId,
+        scopes: {
+          ...(rootId !== undefined ? { rootId } : {}),
+          // Already the privacy-safe label the request log uses, and the ledger aliases it
+          // again on the way to disk. A raw credential never reaches either.
+          ...(logCtx.accountLogLabel !== undefined ? { identityId: logCtx.accountLogLabel } : {}),
+          ...(logCtx.provider !== undefined ? { poolId: logCtx.provider } : {}),
+        },
+        inputTokens: logCtx.usageLogInputTokens ?? 0,
+        outputCeilingTokens: logCtx.spendOutputCeilingTokens ?? 0,
+      });
+      if (!decision.reserved) {
+        refusals += 1;
+        // Only an operator's configured ceiling refuses a dispatch. Every other denial --
+        // capacity, durability, a journal this process could not prove complete -- means the
+        // ledger cannot ACCOUNT for this send, which is not a reason to refuse one. An
+        // unconfigured install keeps the count caps it already had and is not newly refused,
+        // and a degraded ledger must not become an outage.
+        return decision.denial.reason !== "spend-limit-exceeded";
+      }
+      live.push(sendId);
+      confirmOlderSends();
+      return true;
+    },
+    refund(): void {
+      const sendId = live.pop();
+      if (sendId === undefined) return;
+      // Undispatched, so this returns the tokens. If the send was already confirmed by a later
+      // one, `abandon` refuses and unresolved is the only honest outcome left.
+      if (!ledger().abandon(sendId)) ledger().markLost(sendId);
+    },
+    settle(usage: TerminalSpendUsage | undefined): void {
+      if (resolved) return;
+      resolved = true;
+      const terminal = live.pop();
+      if (terminal !== undefined) {
+        const reported = typeof usage?.inputTokens === "number" || typeof usage?.outputTokens === "number";
+        if (reported) {
+          ledger().settle(terminal, {
+            inputTokens: usage?.inputTokens ?? 0,
+            outputTokens: usage?.outputTokens ?? 0,
+          });
+        } else {
+          // The response never reported usage. It may still have been billed.
+          ledger().markLost(terminal);
+        }
+      }
+      for (const sendId of live.splice(0)) ledger().markLost(sendId);
+    },
+    get refusals(): number { return refusals; },
+  };
+}
+
+/**
+ * Give a request a spend tracker and hand back the observer its budget reports through.
+ *
+ * The tracker is parked on the log context because `addFinalRequestLog` is the one seam every
+ * request passes exactly once, whatever transport served it and however it ended, and it is
+ * where the terminal usage is already known.
+ */
+export function attachRequestSpendTracker(
+  req: Pick<Request, "headers">,
+  logCtx: RequestLogContext,
+  ledger?: SpendReservationLedger,
+): RequestSendObserver {
+  const rootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+  const tracker = ledger === undefined
+    ? createRequestSpendTracker(logCtx, rootId)
+    : createRequestSpendTracker(logCtx, rootId, ledger);
+  logCtx.spendTracker = tracker;
+  return tracker;
+}

package/src/server/responses/request-transport.ts

@@ -8,7 +8,7 @@ import {
   credentialGeneration,
 } from "../../oauth/store";
 import type { ProviderAdapter, AdapterRequest } from "../../adapters/base";
-import type { OcxParsedRequest, OcxProviderConfig } from "../../types";
+import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../../types";
 import type { AnthropicAccountSelectionReason } from "../../oauth/anthropic-routing";
 import {
   isAnthropicAccountPoolEnabled,
@@ -33,7 +33,7 @@ import {
   preferredInitialAccount,
   noteGenericPoolSelection,
 } from "../../oauth/generic-account-failover";
-import { stampOAuthAccountLabel } from "../../providers/label";
+import { stampOAuthAccountLabel, usesApiKeyAccount } from "../../providers/label";
 import { resolveProviderTransport } from "../../providers/xai-transport";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
@@ -59,7 +59,11 @@ import {
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
   recordAdapterTierMetadata,
+  noteProviderAttemptSend,
+  recordKeyAttemptFailure,
+  recordKeyAttemptUsage,
 } from "../request-log";
+import type { AttemptRecoveryKind } from "../../usage/log";
 import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
 
 /** Owns live credential selection and adapter bindings for one request. */
@@ -241,6 +245,30 @@ export async function prepareResponsesTransport(
     replayOAuthCredentialSnapshot = { accountId: snapshot.accountId, generation: snapshot.generation };
     return true;
   };
+  // Key sends may be rebuilt while queued. Keep metadata pending until the guarded
+  // physical dispatch binds it to the selection that actually reaches the upstream.
+  let pendingKeySend: { estimate: number | undefined; recovery?: AttemptRecoveryKind } | undefined;
+  const noteRoutedAttemptSend = (estimate: number | undefined, recovery?: AttemptRecoveryKind): void => {
+    if (usesApiKeyAccount(route.provider)) pendingKeySend = { estimate, recovery };
+    else noteProviderAttemptSend(logCtx, route.providerName, route.provider, estimate, recovery);
+  };
+  const commitKeyAttemptSend = (): void => {
+    if (!usesApiKeyAccount(route.provider)) return;
+    noteProviderAttemptSend(logCtx, route.providerName, route.provider,
+      pendingKeySend?.estimate ?? logCtx.usageLogInputTokens, pendingKeySend?.recovery);
+    pendingKeySend = undefined;
+  };
+  const bindKeyUsageFromBridge = (usage: OcxUsage | undefined): void => {
+    logCtx.usageFromBridge = true;
+    if (usesApiKeyAccount(route.provider)) {
+      logCtx.usage = logCtx.activeAttempt?.usage;
+      return;
+    }
+    if (usage) {
+      logCtx.usage = usage;
+      if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
+    }
+  };
   const selectionIsCurrent = (binding: DispatchBinding | undefined): boolean => {
     if (route.provider.authMode === "forward") return true;
     if (!binding) return false;
@@ -260,6 +288,27 @@ export async function prepareResponsesTransport(
         : undefined
       : { kind: "api-key", provider: { ...route.provider } };
     if (binding) adapterBindings.set(resolved, binding);
+    // Observe terminals before search/image loops or continuation guards hide earlier rounds.
+    // Each adapter parser is called once per physical response; bridge totals are client-only.
+    const observedResponses = new WeakSet<object>();
+    const observeUsage = (event: AdapterEvent, response: object): void => {
+      if (usesApiKeyAccount(provider) && "usage" in event && event.usage && !observedResponses.has(response)) {
+        observedResponses.add(response);
+        recordKeyAttemptUsage(logCtx, event.usage);
+      }
+    };
+    const parseStream = resolved.parseStream.bind(resolved);
+    resolved.parseStream = async function* (...args) {
+      for await (const event of parseStream(...args)) { observeUsage(event, args[0]); yield event; }
+    };
+    if (resolved.parseResponse) {
+      const parseResponse = resolved.parseResponse.bind(resolved);
+      resolved.parseResponse = async (...args) => {
+        const events = await parseResponse(...args);
+        events.forEach(event => observeUsage(event, args[0]));
+        return events;
+      };
+    }
     const build = resolved.buildRequest.bind(resolved);
     resolved.buildRequest = async (requestParsed, incoming) => {
       const request = await build(requestParsed, incoming);
@@ -268,7 +317,11 @@ export async function prepareResponsesTransport(
       return request;
     };
     if (resolved.runTurn) {
-      rawRunTurns.set(resolved, resolved.runTurn.bind(resolved));
+      const runTurn = resolved.runTurn.bind(resolved);
+      rawRunTurns.set(resolved, (requestParsed, incoming, emit) => {
+        const response = {};
+        return runTurn(requestParsed, incoming, event => { observeUsage(event, response); emit(event); });
+      });
       resolved.runTurn = (requestParsed, incoming, emit) => runSelectedTurn(resolved, requestParsed, incoming, emit);
     }
     return resolved;
@@ -319,6 +372,7 @@ export async function prepareResponsesTransport(
             refused = true;
             throw new Error("Account selection changed before the first turn dispatch");
           }
+          commitKeyAttemptSend();
           sent = true;
         },
       });
@@ -351,7 +405,9 @@ export async function prepareResponsesTransport(
             && sentHeaders?.get("authorization") === `Bearer ${snapshot.accessToken}`
             && !sentHeaders?.has("x-api-key");
           // Reselection can choose a provider override instead of the supplied executor.
+          commitKeyAttemptSend();
           const response = await fetchImpl(destination, { ...dispatchInit, redirect: "manual" });
+          if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           // Observe each physical response before retries replace it. The binding belongs to
           // this dispatch, so a manual switch cannot file A's headers against B. Header
           // overrides and credential replacement make ownership unprovable: skip those writes.
@@ -736,6 +792,9 @@ export async function prepareResponsesTransport(
     resolveSelectionAdapter,
     refreshRunTurnAdapter,
     oauthDispatch,
+    noteRoutedAttemptSend,
+    commitKeyAttemptSend,
+    bindKeyUsageFromBridge,
     anthropicSessionKey,
     isPassthrough,
   };

package/src/server/responses/run-turn-execution.ts

@@ -12,14 +12,15 @@ import {
   adapterNeedsForcedContinuation,
   adapterResponseReachedServingTerminal,
 } from "./core-replay";
-import { sealRequestAttemptIdentity, noteAttemptSend, recordAttemptCredentialSource } from "../request-log";
+import { sealRequestAttemptIdentity, recordAttemptCredentialSource } from "../request-log";
 import { waitForProviderRequestSlot, RequestPacingQueueOverloadError } from "../../providers/request-pacing";
 import type { AdapterEventQueue } from "../../adapters/run-turn-queue";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { providerFetch } from "./fetch-helpers";
 import { normalizeLogConversationId } from "../request-log-conversation";
 import type { AdapterEvent, OcxProviderContinuationState } from "../../types";
-import { adapterFailureFromMessage } from "../../lib/errors";
+import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { SendBudgetExhaustedError } from "../../lib/upstream-retry";
 import {
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   isGenericOAuthFailoverEnabled,
@@ -65,6 +66,8 @@ export async function executeResponsesRunTurn(
     | "applyFailoverSnapshot"
     | "resolveSelectionAdapter"
     | "adapter"
+    | "noteRoutedAttemptSend"
+    | "bindKeyUsageFromBridge"
   >,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
   responseEffects: Pick<
@@ -74,7 +77,10 @@ export async function executeResponsesRunTurn(
     | "continuationStateForResponse"
     | "notifyResponseComplete"
   >,
-  sendBudgetState: Pick<ResponsesSendBudget, "adapterSendBudget" | "reserveCredentialHop">,
+  sendBudgetState: Pick<
+    ResponsesSendBudget,
+    "adapterDispatchBudget" | "reserveCredentialHop" | "pendingHopPermit"
+  >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
 ): Promise<Response> {
   const { options, logCtx, config } = requestContext;
@@ -94,7 +100,7 @@ export async function executeResponsesRunTurn(
     rememberKiroDeliveredFinalAnswer,
     responseStateOptions,
   } = requestState;
-  const { adapterSendBudget, reserveCredentialHop } = sendBudgetState;
+  const { adapterDispatchBudget, reserveCredentialHop } = sendBudgetState;
   const { emptyCompletionGuardEnabled } = completionPolicy;
   const {
     cancelResponseCompletion,
@@ -140,7 +146,7 @@ export async function executeResponsesRunTurn(
           await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
         await refreshRunTurnSelection();
-        noteAttemptSend(logCtx.activeAttempt, logCtx.usageLogInputTokens, recovery);
+        transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery);
         const runTurnProviderFetch = providerFetch(
           route.provider,
           options.codexWsRuntimeIdentity,
@@ -162,7 +168,7 @@ export async function executeResponsesRunTurn(
             providerFetch: runTurnProviderFetch,
             // The only way the request budget reaches a transport the adapter owns. Without it
             // a Cursor turn's inner ladder was three physical sends the cap read as one.
-            ...(adapterSendBudget ? { sendBudget: adapterSendBudget } : {}),
+            ...(adapterDispatchBudget ? { sendBudget: adapterDispatchBudget } : {}),
           },
           targetQueue.push,
         );
@@ -175,10 +181,22 @@ export async function executeResponsesRunTurn(
               retryable: true,
               message: err.message,
             }
-          : {
-              type: "error",
-              message: err instanceof Error ? err.message : String(err),
-            });
+          : err instanceof SendBudgetExhaustedError
+            // A structured terminal, not a bare message. The turn is already committed to an
+            // SSE response by the time most of these arrive, so the only way to carry "this
+            // proxy refused" to the client is on the event itself -- an unstructured message
+            // is inferred back to 502, which the Codex client retries.
+            ? {
+                type: "error",
+                status: 429,
+                errorType: "rate_limit_error",
+                code: SEND_BUDGET_EXHAUSTED_CODE,
+                message: err.message,
+              }
+            : {
+                type: "error",
+                message: err instanceof Error ? err.message : String(err),
+              });
       } finally {
         // Cursor assigns a stable conversation id inside runTurn on the first headerless
         // turn; backfill so Logs can filter/total that opening request (#330 / #522).
@@ -192,6 +210,11 @@ export async function executeResponsesRunTurn(
     const rotateRunTurnAdapterOnPreflight429 = async (
       error: Extract<AdapterEvent, { type: "error" }>,
     ): Promise<boolean> => {
+      // Our own refusal wears a 429 now, and rotating on it would record a cooldown against an
+      // account that never rate-limited anything -- a fake quota signal that outlives the
+      // request and misroutes later ones. The passthrough path has never had this problem
+      // because it answers before any rotation arm is reached.
+      if (error.code === SEND_BUDGET_EXHAUSTED_CODE) return false;
       const status = error.status ?? adapterFailureFromMessage(error.message).httpStatus;
       if (
         status !== 429
@@ -258,8 +281,11 @@ export async function executeResponsesRunTurn(
         });
         sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, rotatedAdapter.name, logCtx.accountLogLabel);
         recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, rotatedAdapter.name);
-        // The caller replays the turn on this rotation, so the reservation is now confirmed.
-        hop.permit?.use();
+        // The caller replays the turn on this rotation, and a runTurn adapter dispatches through
+        // its own reservation ladder -- Cursor reserves once per physical send. Confirming here
+        // would leave that ladder to charge the same replay a second time (#4709), so hand the
+        // reservation down and let the send that actually happens spend it.
+        sendBudgetState.pendingHopPermit = hop.permit;
         return true;
       } catch {
         hop.permit?.release();
@@ -270,16 +296,24 @@ export async function executeResponsesRunTurn(
       firstSource: AsyncIterable<AdapterEvent>,
     ): Promise<AsyncIterable<AdapterEvent>> => {
       let source = firstSource;
-      while (true) {
-        const preflight = await preflightAdapterEvents(source);
-        if (!preflight.error || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
-          return preflight.stream;
+      try {
+        while (true) {
+          const preflight = await preflightAdapterEvents(source);
+          if (!preflight.error || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
+            return preflight.stream;
+          }
+          const retryQueue = createAdapterEventQueue({
+            onBacklogExceeded: () => runTurnAbort.abort(),
+          });
+          void runTurnAttempt(retryQueue, "oauth-account-429");
+          source = retryQueue.stream();
         }
-        const retryQueue = createAdapterEventQueue({
-          onBacklogExceeded: () => runTurnAbort.abort(),
-        });
-        void runTurnAttempt(retryQueue, "oauth-account-429");
-        source = retryQueue.stream();
+      } finally {
+        // A handed-down hop reservation belongs to the replay this loop dispatched, and the
+        // loop only leaves after that replay's first event has arrived -- so the adapter has
+        // already reserved if it was ever going to. Dropping the reference here keeps an
+        // adapter that reserves nothing from leaving a free send for an unrelated later leg.
+        sendBudgetState.pendingHopPermit = undefined;
       }
     };
     // The empty-completion retry re-runs the turn against a fresh queue: the
@@ -340,6 +374,7 @@ export async function executeResponsesRunTurn(
           stallTimeoutSec: config.stallTimeoutSec,
           hideThinkingSummary: parsed.options.hideThinkingSummary,
           declaredToolNames,
+          enforceDeclaredToolNames: inboundWire !== "chat" && inboundWire !== "anthropic",
           toolParameterSchemas,
           ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
           ...(routedCompaction ? { compaction: true } : {}),
@@ -349,11 +384,7 @@ export async function executeResponsesRunTurn(
           onUsage: usage => {
             // Raw adapter usage, pre wire-normalization: the bridged SSE now always carries
             // zero-default detail objects, so provenance must come from here (cache_detail_missing).
-            logCtx.usageFromBridge = true;
-            if (usage) {
-              logCtx.usage = usage;
-              if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-            }
+            transportState.bindKeyUsageFromBridge(usage);
           },
           onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
             commitReasoningReplayServingRoute();
@@ -414,17 +445,14 @@ export async function executeResponsesRunTurn(
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       toolNsMap,
       declaredToolNames,
+      enforceDeclaredToolNames: inboundWire !== "chat" && inboundWire !== "anthropic",
       toolParameterSchemas,
       freeformToolNames,
       toolSearchToolNames,
       ...(routedCompaction ? { compaction: true } : {}),
       onProviderState: state => { providerState = state; },
       onUsage: usage => {
-        logCtx.usageFromBridge = true;
-        if (usage) {
-          logCtx.usage = usage;
-          if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-        }
+        transportState.bindKeyUsageFromBridge(usage);
       },
     });
     if (!routedCompaction) {

package/src/server/responses/sidecar-execution.ts

@@ -35,7 +35,7 @@ import { bindRouteReasoningReplayScope, adapterNeedsForcedContinuation } from ".
 import { namespacedToolName } from "../../types";
 import { providerFetch } from "./fetch-helpers";
 import type { AttemptRecoveryKind } from "../../usage/log";
-import { noteAttemptSend, recordAdapterReasoning, recordAdapterTier } from "../request-log";
+import { recordAdapterReasoning, recordAdapterTier } from "../request-log";
 import { normalizeLogConversationId } from "../request-log-conversation";
 import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
@@ -65,6 +65,8 @@ export async function executeResponsesSidecars(
     | "commitResolvedOAuthSelection"
     | "resolveSelectionAdapter"
     | "oauthDispatch"
+    | "noteRoutedAttemptSend"
+    | "bindKeyUsageFromBridge"
   >,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction" | "openAiSidecar">,
   responseEffects: Pick<
@@ -322,7 +324,7 @@ export async function executeResponsesSidecars(
       ...(vidPlan ? { videoPlan: vidPlan } : {}),
       forwardHeaders: requestState.selectedForwardHeaders,
       onAttemptSend: (recovery?: AttemptRecoveryKind) =>
-        noteAttemptSend(logCtx.activeAttempt, logCtx.usageLogInputTokens, recovery),
+        transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery),
       abortSignal: options.abortSignal,
       maxRounds: imgPlan && vidPlan
         ? clampImageMaxRounds(Math.min(config.images?.maxRounds ?? 3, config.images?.videoMaxRounds ?? 2))
@@ -352,11 +354,7 @@ export async function executeResponsesSidecars(
         if (!logCtx.conversationId && parsed._cursorConversationId) {
           logCtx.conversationId = normalizeLogConversationId(parsed._cursorConversationId);
         }
-        logCtx.usageFromBridge = true;
-        if (usage) {
-          logCtx.usage = usage;
-          if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-        }
+        transportState.bindKeyUsageFromBridge(usage);
       },
       on429: rotateSidecarProviderOn429,
       retryOn429Policy: rateLimitRetryPolicyFor(route.provider),
@@ -432,13 +430,9 @@ export async function executeResponsesSidecars(
         recordAdapterTier(logCtx, request);
       },
       onAttemptSend: (recovery?: AttemptRecoveryKind) =>
-        noteAttemptSend(logCtx.activeAttempt, logCtx.usageLogInputTokens, recovery),
+        transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery),
       onUsage: usage => {
-        logCtx.usageFromBridge = true;
-        if (usage) {
-          logCtx.usage = usage;
-          if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-        }
+        transportState.bindKeyUsageFromBridge(usage);
       },
       recordSidecarOutcome: wsPlan.forwardSidecar?.recordOutcome,
       connectTimeoutMs: config.connectTimeoutMs ?? 200_000,