@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/server/relay.ts

@@ -22,10 +22,11 @@ import {
 } from "./request-log";
 import {
   BoundedSseFrameBuffer,
+  EMPTY_BYTES,
   joinSseFrameBytes,
   MAX_CLIENT_SSE_FRAME_BYTES,
 } from "./sse-frame-buffer";
-import { replaceSseDataPayload } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
 import { createBoundedResponseLogBody } from "./response-log-body";
 
 const nativePassthroughSseResponses = new WeakSet<Response>();
@@ -200,7 +201,7 @@ export function createSseTerminalOutputBoundary(
   const processFrames = (
     frames: ReturnType<BoundedSseFrameBuffer["feed"]>,
   ): Uint8Array => {
-    if (disposed || terminal || frames.length === 0) return new Uint8Array(0);
+    if (disposed || terminal || frames.length === 0) return EMPTY_BYTES;
     const output: Uint8Array[] = [];
     let responsesTerminal = false;
     for (const frame of frames) {
@@ -259,13 +260,13 @@ export function createSseTerminalOutputBoundary(
 
   return {
     feed(chunk) {
-      if (disposed || terminal) return new Uint8Array(0);
+      if (disposed || terminal) return EMPTY_BYTES;
       return processFrames(framer.feed(chunk));
     },
     finish() {
-      if (disposed || terminal) return new Uint8Array(0);
+      if (disposed || terminal) return EMPTY_BYTES;
       const tail = framer.finish();
-      if (tail.byteLength === 0) return new Uint8Array(0);
+      if (tail.byteLength === 0) return EMPTY_BYTES;
       // EOF may cut off the final SSE block before its blank-line delimiter.
       // Feed it through the exact same parser/rewrite/terminal path as a
       // complete frame, using a synthetic delimiter so the client receives a
@@ -359,7 +360,7 @@ export function relaySseWithFailedTail(
           if (result !== "buffered") return;
         }
       } catch (err) {
-        let partial: Uint8Array = new Uint8Array(0);
+        let partial: Uint8Array = EMPTY_BYTES;
         let tailTerminal = false;
         try {
           partial = terminalBoundary.finish();
@@ -403,15 +404,7 @@ export function nextSseBlock(buffer: string): { block: string; delimiter: string
   };
 }
 
-export function sseDataPayload(block: string): string | null {
-  const data: string[] = [];
-  for (const line of block.split(/\r?\n/)) {
-    if (!line.startsWith("data:")) continue;
-    const value = line.slice(5);
-    data.push(value.startsWith(" ") ? value.slice(1) : value);
-  }
-  return data.length > 0 ? data.join("\n") : null;
-}
+export { sseDataPayload } from "./sse-payload-rewrite";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -943,8 +936,8 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
   let reported = false;
   let sawTerminal = false;
   let disposed = false;
-  let delimiterTail: Uint8Array = new Uint8Array(0);
-  let candidate: Uint8Array = new Uint8Array(0);
+  let delimiterTail: Uint8Array = EMPTY_BYTES;
+  let candidate: Uint8Array = EMPTY_BYTES;
   let candidateBytes = 0;
   let discardingOversizedFrame = false;
   const reportFirstOutput = createFirstOutputReporter(handlers.onFirstOutput);
@@ -957,8 +950,8 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
   let firstResponseId: string | undefined;
 
   const clearFrameState = (): void => {
-    delimiterTail = new Uint8Array(0);
-    candidate = new Uint8Array(0);
+    delimiterTail = EMPTY_BYTES;
+    candidate = EMPTY_BYTES;
     candidateBytes = 0;
     discardingOversizedFrame = false;
   };
@@ -995,9 +988,9 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
   };
 
   const takeCandidate = (): Uint8Array => {
-    if (candidateBytes === 0) return new Uint8Array(0);
+    if (candidateBytes === 0) return EMPTY_BYTES;
     const frame = candidate.slice(0, candidateBytes);
-    candidate = new Uint8Array(0);
+    candidate = EMPTY_BYTES;
     candidateBytes = 0;
     return frame;
   };
@@ -1010,7 +1003,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
       Math.min(nextBytes, MAX_INSPECTION_SSE_FRAME_BYTES),
     );
     if (nextBytes > MAX_INSPECTION_SSE_FRAME_BYTES) {
-      candidate = new Uint8Array(0);
+      candidate = EMPTY_BYTES;
       candidateBytes = 0;
       discardingOversizedFrame = true;
       inspectionCounters.frameCapOverflows += 1;
@@ -1173,7 +1166,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
 
   const scanChunk = (chunk: Uint8Array): void => {
     const previousTail = delimiterTail;
-    delimiterTail = new Uint8Array(0);
+    delimiterTail = EMPTY_BYTES;
     const tailLength = previousTail.byteLength;
     const totalLength = tailLength + chunk.byteLength;
     const byteAt = (index: number): number => index < tailLength
@@ -1219,7 +1212,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
       if (disposed) return;
       try {
         retainCandidateSlice(delimiterTail);
-        delimiterTail = new Uint8Array(0);
+        delimiterTail = EMPTY_BYTES;
         if (!discardingOversizedFrame && candidateBytes > 0 && !reported) {
           const sourceBytes = candidateBytes;
           const decoded = decoder!.decode(takeCandidate());

package/src/server/request-log.ts

@@ -44,6 +44,7 @@ import {
   usageStatusForFinalLog,
   usageTotalTokens,
   type AttemptRecoveryKind,
+  type AttemptRecoveryWithheld,
   type CacheTelemetryProvenance,
   type PersistedRequestSpend,
   type PersistedUsageAttempt,
@@ -854,7 +855,13 @@ export function usageFromResponsesPayload(usage: unknown): OcxUsage | undefined
  * Mark a refusal this proxy synthesized locally. Sets origin to `synthetic` and a
  * distinct local reason so the request log cannot be read as an upstream overload.
  */
-export function markLocalRequestLogRefusal(logCtx: RequestLogContext, reason: string): void {
+// Typed by the two fields it writes rather than by the whole context: the durable-spend tracker
+// has to mark a row from a narrow view of it, and widening that view to the full context there
+// would pull the entire log shape into a module that touches two of its fields.
+export function markLocalRequestLogRefusal(
+  logCtx: Pick<RequestLogContext, "localTerminalReason" | "terminalSource">,
+  reason: string,
+): void {
   logCtx.localTerminalReason = reason;
   logCtx.terminalSource = "synthetic";
 }
@@ -1300,6 +1307,7 @@ export function addFinalRequestLog(
   const attempts = logCtx.attempts?.map(attempt => ({
     ...attempt,
     recoveryKinds: [...attempt.recoveryKinds],
+    ...(attempt.recoveryWithheld?.length ? { recoveryWithheld: [...attempt.recoveryWithheld] } : {}),
     ...(attempt.usage ? { usage: { ...attempt.usage } } : {}),
     ...(attempt.tierOutcome ? { tierOutcome: { ...attempt.tierOutcome } } : {}),
   }));
@@ -1703,6 +1711,22 @@ export function noteAttemptSend(
   }
 }
 
+/**
+ * Record that a recovery this attempt was eligible for did not happen.
+ *
+ * Deliberately NOT `noteAttemptSend`: nothing was sent, so `sendCount` must not move. The two
+ * together are what make a one-send log readable — no kind and no withheld reason means nothing
+ * was eligible, a withheld reason means something was and the budget refused it (#5044).
+ */
+export function noteAttemptRecoveryWithheld(
+  attempt: PersistedUsageAttempt | undefined,
+  reason: AttemptRecoveryWithheld,
+): void {
+  if (!attempt) return;
+  if (!attempt.recoveryWithheld) attempt.recoveryWithheld = [];
+  if (!attempt.recoveryWithheld.includes(reason)) attempt.recoveryWithheld.push(reason);
+}
+
 export function finishRequestAttempt(
   attempt: PersistedUsageAttempt,
   status: number,

package/src/server/responses/adapter-continuation.ts

@@ -13,6 +13,7 @@ import {
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
+import { noteAttemptRecoveryWithheld } from "../request-log";
 import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
@@ -46,7 +47,12 @@ import {
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import { readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
 import { isCyberPolicyCode, CYBER_POLICY_FALLBACK_MESSAGE, CYBER_POLICY_ERROR_CODE } from "../../lib/errors";
-import { cancelBodyOnAbort } from "../../lib/abort";
+import {
+  readResponseBodyWithInactivity,
+  readResponseStreamWithInactivity,
+  ResponseBodyInactivityError,
+} from "../../lib/response-body-inactivity";
+import { resolveStallTimeoutSec } from "../../stall-timeout";
 import { guardTerminalEventStream } from "./terminal-guard";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
@@ -78,6 +84,7 @@ export function createAdapterContinuations(
     | "genericFailoverAccountId"
     | "genericFailovers"
     | "applyFailoverSnapshot"
+    | "replayOAuthCredentialSnapshot"
     | "noteRoutedAttemptSend"
   >,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
@@ -85,6 +92,7 @@ export function createAdapterContinuations(
     ResponsesSendBudget,
     | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
+    | "noteAdapterRecoveryWithheld"
     | "remainingTransientSendBudget"
     | "noteTransientSends"
     | "reserveCredentialHop"
@@ -112,9 +120,11 @@ export function createAdapterContinuations(
   const { route, translatorBudget, inboundWire, parsed } = requestState;
   const { routedCompaction } = sidecarState;
   const { upstream, connectMs, rateLimitPolicy, stallTimeoutMs } = adapterExchange;
+  const bodyInactivityMs = resolveStallTimeoutSec(config.stallTimeoutSec) * 1000;
   const {
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
     remainingTransientSendBudget,
     noteTransientSends,
     reserveCredentialHop,
@@ -193,6 +203,7 @@ export function createAdapterContinuations(
             timeoutMs: connectMs,
               sendBudget: adapterDispatchBudget,
             onPhysicalSend: send => noteAdapterPhysicalSend(continuationEstimate, send),
+            onRecoveryWithheld: noteAdapterRecoveryWithheld,
             stream: nextParsed.stream,
             executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
               pacingSlotAcquired: true,
@@ -263,12 +274,12 @@ export function createAdapterContinuations(
       // Same-target 429 wait-and-retry (opt-in `retryOn429`) before key/account failover:
       // a primary-key rate-limit blip replays on the SAME key, matching the main recovery
       // loop; only after the attempts are exhausted does the continuation fail over.
-      while (
-        response.status === 429
+     while (
+       response.status === 429
         // A synthesized replay refusal is not a rate limit; replaying the continuation on
         // it would re-send a turn whose first send may already have been processed.
         && !isNonReplayableResponse(response)
-        && rateLimitPolicy !== null
+       && rateLimitPolicy !== null
         && adapterExchange.rateLimitRetries < rateLimitPolicy.attempts
         // The main recovery loop and the passthrough ladder both consult the shared remainder
         // here; this loop did not, so a request whose budget was already spent could still
@@ -348,11 +359,11 @@ export function createAdapterContinuations(
           continue;
         }
       }
-      if (
-        response.status === 429
+     if (
+       response.status === 429
+       && transportState.anthropicPoolAccountId
         && !isNonReplayableResponse(response)
-        && transportState.anthropicPoolAccountId
-        && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST
+       && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST
       ) {
         const nextAccountId = rotateAnthropicAccountOn429(
           config,
@@ -390,11 +401,11 @@ export function createAdapterContinuations(
       // 429 stayed terminal even with failover fully active -- the same class of divergence the
       // two sidecars already produced once. Request-local state is shared with the other arms so
       // the per-request bound cannot be silently re-armed by reaching a different loop.
-      if (
-        response.status === 429
+     if (
+       response.status === 429
+       && transportState.genericFailoverAccountId
         && !isNonReplayableResponse(response)
-        && transportState.genericFailoverAccountId
-        && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+       && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
         && isGenericOAuthFailoverEnabled(config, route.providerName)
       ) {
         // Intersection with the shared request budget. The continuation loop re-sends the
@@ -416,8 +427,13 @@ export function createAdapterContinuations(
             route.providerName,
             transportState.genericFailoverAccountId,
             response.headers.get("retry-after"),
+            Date.now(),
+            route.modelId,
           )
           : null;
+        // Eligible and refused by the shared budget, as opposed to eligible and finding no next
+        // account: the two produce the same response and need different follow-ups (#5044).
+        if (!hop.allowed) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
         if (!nextAccountId) hop.permit?.release();
         if (nextAccountId) {
           try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
@@ -436,6 +452,22 @@ export function createAdapterContinuations(
                 resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
                 config.cacheRetention,
               );
+              bindRouteReasoningReplayScope({
+                parsed: nextParsed,
+                providerName: route.providerName,
+                provider: route.provider,
+                adapterName: transportState.activeAdapter.name,
+                oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+              });
+              // Response persistence closes over the outer parsed request; keep its owner binding in
+              // sync with the terminal-guard clone that builds the rotated continuation request.
+              bindRouteReasoningReplayScope({
+                parsed,
+                providerName: route.providerName,
+                provider: route.provider,
+                adapterName: transportState.activeAdapter.name,
+                oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+              });
               sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
               recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
               // The replay goes out on the next iteration. An adapter that owns its ladder
@@ -493,23 +525,35 @@ export function createAdapterContinuations(
     }
 
     try {
-      // Protect the continuation body against a client abort landing between fetch resolution and
-      // reader attach, exactly as the initial response is guarded above (#390/366e3053). Without
-      // this, a client cancel during the continuation reopens the Bun fetch-to-reader abort race.
-      const detachContinuationBodyGuard = cancelBodyOnAbort(response.body, upstream.signal);
-      try {
-        if (nextParsed.stream) {
-          yield* transportState.activeAdapter.parseStream(response, translatorBudget, logCtx.activeTierMetadata);
-        } else if (transportState.activeAdapter.parseResponse) {
-          yield* await transportState.activeAdapter.parseResponse(response, translatorBudget, logCtx.activeTierMetadata);
-        } else {
-          yield { type: "error", message: "Provider continuation does not support response parsing" };
-        }
-      } finally {
-        detachContinuationBodyGuard();
+      // Each successful continuation owns a fresh pending-read deadline and an abort
+      // listener that can cancel its reader even while the parser holds the body lock.
+      // The shared signal is not aborted on timeout: this generator must still emit
+      // the error that the already-live Responses bridge turns into a terminal.
+      if (nextParsed.stream) {
+        yield* readResponseStreamWithInactivity(
+          response,
+          upstream.signal,
+          bodyInactivityMs,
+          guarded => transportState.activeAdapter.parseStream(guarded, translatorBudget, logCtx.activeTierMetadata),
+        );
+      } else if (transportState.activeAdapter.parseResponse) {
+        yield* await readResponseBodyWithInactivity(
+          response,
+          upstream.signal,
+          bodyInactivityMs,
+          guarded => transportState.activeAdapter.parseResponse!(guarded, translatorBudget, logCtx.activeTierMetadata),
+        );
+      } else {
+        try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        yield { type: "error", message: "Provider continuation does not support response parsing" };
       }
     } catch (error) {
-      if (options.abortSignal?.aborted) {
+      // Classify the thrown error before reading signal state: cancelling the stalled
+      // source can synchronously abort the shared signal, which would otherwise report
+      // this timeout as a client cancellation.
+      if (error instanceof ResponseBodyInactivityError) {
+        yield { type: "error", message: "Provider continuation response body stalled before completing", status: 504 };
+      } else if (options.abortSignal?.aborted || upstream.signal.aborted) {
         yield { type: "error", message: "client closed request during terminal continuation", status: 499 };
       } else {
         yield { type: "error", message: `Provider continuation parse failed: ${redactSecretString(error instanceof Error ? error.message : String(error))}` };

package/src/server/responses/adapter-delivery.ts

@@ -14,6 +14,12 @@ import { rememberResponseState } from "../../responses/state";
 import { trackStreamLifetime } from "../lifecycle";
 import { awaitThoughtSignatureDurability } from "../../responses/thought-signature-replay";
 import { adapterResponseReachedServingTerminal } from "./core-replay";
+import {
+  readResponseBodyWithInactivity,
+  readResponseStreamWithInactivity,
+  ResponseBodyInactivityError,
+} from "../../lib/response-body-inactivity";
+import { resolveStallTimeoutSec } from "../../stall-timeout";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function deliverAdapterResponse(
@@ -61,14 +67,33 @@ export async function deliverAdapterResponse(
     notifyResponseComplete,
   } = responseEffects;
   const { routedCompaction } = sidecarState;
+  const bodyInactivityMs = resolveStallTimeoutSec(config.stallTimeoutSec) * 1000;
 
 
   if (parsed.stream) {
-    const initialEventStream = transportState.activeAdapter.parseStream(
-      upstreamResponse,
-      translatorBudget,
-      logCtx.activeTierMetadata,
-    );
+    // The continuation legs classify a stalled body themselves; the initial stream needs the
+    // same mapping or the bridge catch reports this upstream timeout as a 500 proxy_error.
+    const initialEventStream = (async function* (): AsyncGenerator<AdapterEvent> {
+      try {
+        yield* readResponseStreamWithInactivity(
+          upstreamResponse,
+          upstream.signal,
+          bodyInactivityMs,
+          response => transportState.activeAdapter.parseStream(response, translatorBudget, logCtx.activeTierMetadata),
+        );
+      } catch (error) {
+        if (error instanceof ResponseBodyInactivityError) {
+          yield {
+            type: "error",
+            message: "Upstream response body stalled before completing",
+            status: 504,
+            errorType: "upstream_error",
+          };
+          return;
+        }
+        throw error;
+      }
+    })();
     const eventStream = terminalGuardEnabled
       ? guardTerminalEventStream({
           parsed,
@@ -137,10 +162,11 @@ export async function deliverAdapterResponse(
   if (transportState.activeAdapter.parseResponse) {
     let events: AdapterEvent[];
     try {
-      const initialEvents = await transportState.activeAdapter.parseResponse(
+      const initialEvents = await readResponseBodyWithInactivity(
         upstreamResponse,
-        translatorBudget,
-        logCtx.activeTierMetadata,
+        upstream.signal,
+        bodyInactivityMs,
+        response => transportState.activeAdapter.parseResponse!(response, translatorBudget, logCtx.activeTierMetadata),
       );
       let guardedEvents: AdapterEvent[];
       if (terminalGuardEnabled) {
@@ -164,6 +190,11 @@ export async function deliverAdapterResponse(
       } else {
         events = guardedEvents;
       }
+    } catch (error) {
+      if (error instanceof ResponseBodyInactivityError) {
+        return formatErrorResponse(504, "upstream_error", "Upstream response body stalled before completing");
+      }
+      throw error;
     } finally {
       cleanupUpstreamAbort();
     }

package/src/server/responses/adapter-dispatch.ts

@@ -25,6 +25,7 @@ import {
   hasKeyPoolFailover,
   rotateProviderTransportOn401,
   rateLimitRetryDelayMs,
+  readQuotaResetAt,
   rotateProviderTransportOn429,
 } from "../../providers/key-failover";
 import {
@@ -127,6 +128,7 @@ export async function prepareAdapterExchange(
     ResponsesSendBudget,
     | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
+    | "noteAdapterRecoveryWithheld"
     | "remainingTransientSendBudget"
     | "noteTransientSends"
     | "recoverySendAllowance"
@@ -160,6 +162,7 @@ export async function prepareAdapterExchange(
   const {
     adapterDispatchBudget,
     noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
     remainingTransientSendBudget,
     noteTransientSends,
     recoverySendAllowance,
@@ -286,6 +289,7 @@ export async function prepareAdapterExchange(
         timeoutMs: connectMs,
         sendBudget: adapterDispatchBudget,
         onPhysicalSend: send => noteAdapterPhysicalSend(inputTokenEstimate, send),
+        onRecoveryWithheld: noteAdapterRecoveryWithheld,
         stream: parsed.stream,
         executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
               pacingSlotAcquired: true,
@@ -442,6 +446,7 @@ export async function prepareAdapterExchange(
               timeoutMs: connectMs,
             sendBudget: adapterDispatchBudget,
               onPhysicalSend: send => noteAdapterPhysicalSend(retryEstimate, send),
+              onRecoveryWithheld: noteAdapterRecoveryWithheld,
               stream: parsed.stream,
               executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
                 pacingSlotAcquired: true,
@@ -525,17 +530,17 @@ export async function prepareAdapterExchange(
         return { failed: formatErrorResponse(502, "upstream_error", msg) };
       }
     };
-    // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
-    recovery: for (;;) {
+   // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
+   recovery: for (;;) {
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
         cleanupUpstreamAbort();
         return upstreamResponse;
       }
-      if (
-        upstreamResponse.status === 401
-        && isOAuth401ReplayProvider
+     if (
+       upstreamResponse.status === 401
+       && isOAuth401ReplayProvider
         && transportState.sentOAuthSnapshot
         && !oauth401ReplayAttempted
         && !sendBudgetExhausted()
@@ -618,15 +623,15 @@ export async function prepareAdapterExchange(
           provider: route.provider,
           adapterName: transportState.activeAdapter.name,
         });
-        const result = await rebuildAndRefetch("key-401");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("key-401");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // A recovery refetch can itself die on an ambiguous pre-header reset, and the refusal
         // that answers it is a 429. Every arm below keys on 429, so letting it fall through
         // hands the marked refusal to the next waiting arm and replays the send it exists to
         // stop. Re-enter the loop guard instead, which returns it unchanged.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Same-target 429 wait-and-retry (opt-in `retryOn429`, issue #487). Codex never retries
       // 429 itself (it retries 5xx only), and single-key pools cannot use the failover below,
@@ -663,23 +668,44 @@ export async function prepareAdapterExchange(
           upstream.abort();
           return clientCancelledResponse();
         }
-        const result = await rebuildAndRefetch("rate-limit-429");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("rate-limit-429");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // The refusal is a 429 too: without this the while condition is still true and the
         // next configured attempt replays it on the same target.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
       // SAME request once per remaining key. OAuth/forward providers and single-key pools
       // return null immediately, so this stays a no-op for them (src/providers/key-failover.ts).
       while (upstreamResponse.status === 429 && hasKeyPoolFailover(route.provider)) {
+        // A quota exhaustion is dated in the BODY, not in `Retry-After` — OpenRouter
+        // sends no header for it (#4024). Read a bounded prefix before the socket is
+        // released below; a failed or slow read just leaves the header path in charge.
+        // Peeks a bounded prefix and hands back a Response still carrying the whole
+        // body, so the cancel below still releases the socket.
+        let peeked: Awaited<ReturnType<typeof readQuotaResetAt>>;
+        try {
+          peeked = await readQuotaResetAt(upstreamResponse, { signal: options.abortSignal });
+        } catch {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          return clientCancelledResponse();
+        }
+        if (options.abortSignal?.aborted) {
+          cleanupUpstreamAbort();
+          upstream.abort();
+          return clientCancelledResponse();
+        }
+        upstreamResponse = peeked.response;
+        const quotaResetAt = peeked.at;
         const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
           retryAfter: upstreamResponse.headers.get("retry-after"),
           now: Date.now(),
           attemptedKey: route.provider.apiKey,
           promptCacheKey: parsed.options.promptCacheKey,
+          quotaResetAt,
         });
         if (!rotated) break;
         // Release the failed response's socket before retrying; unread bodies otherwise linger
@@ -697,13 +723,13 @@ export async function prepareAdapterExchange(
           provider: route.provider,
           adapterName: transportState.activeAdapter.name,
         });
-        const result = await rebuildAndRefetch("key-429");
-        if ("failed" in result) return result.failed;
-        upstreamResponse = result;
+       const result = await rebuildAndRefetch("key-429");
+       if ("failed" in result) return result.failed;
+       upstreamResponse = result;
         // Rotating on the refusal would also write a cooldown against a key that rate-limited
         // nothing, which outlives the request.
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-      }
+     }
 
       // Opt-in Anthropic OAuth account pool (#294): cool the failed account and retry
       // with another eligible OAuth account (bounded per request). Disabled by default.
@@ -736,11 +762,11 @@ export async function prepareAdapterExchange(
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-          const result = await rebuildAndRefetch("anthropic-oauth-429");
-          if ("failed" in result) return result.failed;
-          upstreamResponse = result;
+         const result = await rebuildAndRefetch("anthropic-oauth-429");
+         if ("failed" in result) return result.failed;
+         upstreamResponse = result;
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-        } catch {
+       } catch {
           break;
         }
       }
@@ -786,6 +812,8 @@ export async function prepareAdapterExchange(
           route.providerName,
           transportState.genericFailoverAccountId,
           upstreamResponse.headers.get("retry-after"),
+          Date.now(),
+          route.modelId,
         );
         if (!nextAccountId) {
           hop.permit?.release();
@@ -832,12 +860,12 @@ export async function prepareAdapterExchange(
             hop.permit?.release();
             return result.failed;
           }
-          upstreamResponse = result;
+         upstreamResponse = result;
           // The hop's permit is already settled by the dispatch boundary above; continuing
           // only skips the remaining arms, it does not abandon a reservation.
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
-        } catch {
-          // A throw before the send — snapshot fetch, credential application, adapter
+       } catch {
+         // A throw before the send — snapshot fetch, credential application, adapter
           // resolution — must hand the reservation back. Without this the ladder charges the
           // request for a send it never made, and a later recovery in the same request is
           // refused on an allowance nothing spent. release() is idempotent and a no-op once