@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/server/responses/codex-ws-exchange.ts

@@ -1,3 +1,6 @@
+import { mergeSteeringContinuation } from "./native-steering-settings";
+import { markNativeControlResponse } from "./native-response-control";
+import type { NativeResponseControl } from "./native-response-control";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 import { isSafeResponseHeader } from "../safe-response-headers";
 import { CodexWsMetadata, type CodexWsQuotaObserver } from "./codex-ws-metadata";
@@ -6,10 +9,12 @@ import { CodexWsCorrelation } from "./codex-ws-correlation";
 import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
   MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
-  codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
+  codexWsCreateFrameExceedsLimit, codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
   type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
 
 interface ExchangeOptions {
+  nativeControl?: NativeResponseControl;
+  beforeContinuation?: () => Promise<void>;
   session: CodexWsSession;
   url: string;
   init: RequestInit;
@@ -86,7 +91,7 @@ function wrappedRejectionResponse(payload: Record<string, unknown>, prelude: Hea
 
 /** The sole SSE exchange state machine for both one-shot and retained sockets. */
 export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
-  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion } = options;
+  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion, nativeControl, beforeContinuation } = options;
   const { frameText, headers } = prepared;
   const signal = init.signal ?? undefined;
   return new Promise<Response>((resolve, reject) => {
@@ -116,6 +121,8 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     const metadata = url === CODEX_RESPONSES_HTTP_URL ? new CodexWsMetadata(onQuota) : null;
     const correlation = session.retainable ? new CodexWsCorrelation(session.reused, id => session.hasCompleted(id)) : null;
     let detachOwner = () => {};
+    let detachSteering = () => {};
+    let continuationBase: Record<string, unknown> | undefined;
     // Liveness while waiting for the first response event (metadata path only): the
     // silence timer is re-armed by every inbound frame or pong; the pinger runs on a fixed
     // interval so a peer that answers pings can never trip the silence bound while alive.
@@ -142,6 +149,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       metadata?.finish();
       correlation?.finish();
       detachOwner();
+      detachSteering();
       ws.removeEventListener("open", onOpen);
       ws.removeEventListener("message", onMessage);
       ws.removeEventListener("close", onClose);
@@ -198,6 +206,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       const response = new Response(stream, { status: 200, headers: responseHeaders });
       metadata?.commit();
       markCodexWsResponse(response, Boolean(metadata && onQuota));
+      if (nativeControl) markNativeControlResponse(response);
       markCodexWsStage(response, stageRecord(null));
       committedResponse = response;
       resolve(response);
@@ -329,6 +338,54 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       }
       if (terminal || settledPreOpen || signal?.aborted) return;
       sent = true;
+      try {
+        if (nativeControl) {
+          // Parsed once: the base body is immutable for this exchange, and a
+          // full-replay frame runs to megabytes. It seeds continuationBase on
+          // the first create frame.
+          let base: Record<string, unknown> | undefined;
+          detachSteering = nativeControl.attach(frame => {
+            const sendControl = () => {
+              if (terminal || signal?.aborted || session.closed || ws.readyState !== WebSocket.OPEN) {
+                throw new Error("Native steering connection is no longer available");
+              }
+              beforeDispatch?.(new Headers(headers));
+              let outgoing = frame;
+              if (frame.type === "response.create") {
+                // Generation overrides have passed route policy; identity/tools remain pinned.
+                // Keep the last explicit wire settings for later explicit and automatic successors.
+                base ??= JSON.parse(frameText) as Record<string, unknown>;
+                continuationBase ??= base;
+                outgoing = nativeControl.kind === "steering"
+                  ? mergeSteeringContinuation(continuationBase, frame)
+                  : { ...continuationBase, input: frame.input, previous_response_id: frame.previous_response_id };
+              }
+              const text = JSON.stringify(outgoing);
+              if (codexWsCreateFrameExceedsLimit(text)) {
+                throw new Error("Native steering frame exceeds the transport byte limit");
+              }
+              if (frame.type === "response.create") continuationBase = outgoing;
+              try { ws.send(text); } catch {
+                // A send failure has unknown delivery. Never replay or fall back.
+                failStream("Native steering send failed; delivery is unknown");
+                throw new Error("Native steering send failed; delivery is unknown");
+              }
+            };
+            if (frame.type === "response.create" && beforeContinuation) {
+              // Explicit tool-result continuations are physical request starts;
+              // they keep provider pacing and revalidate auth AFTER the wait.
+              void beforeContinuation().then(sendControl).catch(() => failStream("Native steering continuation could not be dispatched; do not automatically replay queued input"));
+            } else sendControl();
+          }, error => failStream(error));
+        }
+      } catch (error) {
+        // An attach failure is an ownership conflict, not a failed send: no frame
+        // left the process, but the channel can never bind, so resolving the HTTP
+        // fallback here would silently degrade a multi-agent turn into an ordinary
+        // one. Fail the turn visibly instead.
+        failStream(error);
+        return;
+      }
       try {
         ws.send(frameText);
         sentAt = Date.now();
@@ -400,8 +457,12 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         return;
       }
       if (!controlFrame && !type.startsWith("response.") && type !== "error") return;
+      let steeringEnded = false;
       if (!controlFrame) {
-        try { correlation?.accept(normalized.payload); } catch (error) { failStream(error); return; }
+        try {
+          if (nativeControl) steeringEnded = nativeControl.observe(normalized.payload);
+          else correlation?.accept(normalized.payload);
+        } catch (error) { failStream(error); return; }
         // Correlation must run first: a reused socket's foreign-stream error settles as a
         // non-replayable 502 above, never as the refused-create 4xx projection below, which
         // is the one status family that could authorize an account replay.
@@ -443,7 +504,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         return;
       }
       if (!controlFrame) relayedEvents += 1;
-      if (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error") {
+      if (nativeControl ? steeringEnded : (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error")) {
         const completedId = correlation?.completed(normalized.payload) ?? null;
         terminal = true;
         cleanup();

package/src/server/responses/combo-stream-preflight.ts

@@ -1,4 +1,6 @@
 import type { ResponsesTerminalStatus } from "../../bridge";
+import { comboFailureDecision } from "../../combos";
+import { httpStatusFromTerminalError } from "../../lib/errors";
 import type { RequestLogContext } from "../request-log";
 import { createSseInspector } from "../relay";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
@@ -30,12 +32,67 @@ const RETRYABLE_ZERO_OUTPUT_INCOMPLETE_REASONS = new Set([
   "upstream_stall_timeout",
 ]);
 
+function bareErrorStatus(payload: unknown): number | undefined {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
+  const event = payload as Record<string, unknown>;
+  if (event.type !== "error") return undefined;
+  const nested = event.error;
+  const error = nested && typeof nested === "object" && !Array.isArray(nested)
+    ? nested as Record<string, unknown>
+    : event;
+  const explicitStatus = [
+    event.status,
+    event.status_code,
+    event.http_status,
+    error.status,
+    error.status_code,
+    error.http_status,
+  ]
+    .map(value => typeof value === "number" && Number.isInteger(value)
+      ? value
+      : typeof value === "string" && /^\d{3}$/.test(value.trim())
+        ? Number(value)
+        : undefined)
+    .find(value => value !== undefined && value >= 400 && value <= 599);
+  const code = typeof error.code === "string"
+    ? error.code
+    : typeof event.code === "string" ? event.code : null;
+  if (explicitStatus === undefined && code === "invalid_request_error") return 400;
+  return explicitStatus ?? httpStatusFromTerminalError({
+    type: typeof error.type === "string" && error.type !== "error" ? error.type : undefined,
+    code,
+    message: typeof error.message === "string"
+      ? error.message
+      : typeof event.message === "string" ? event.message : undefined,
+  });
+}
+
+function bareErrorIsRetryable(payload: unknown): boolean {
+  const status = bareErrorStatus(payload);
+  if (status === undefined || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return false;
+  }
+  const event = payload as Record<string, unknown>;
+  const nested = event.error;
+  const error = nested && typeof nested === "object" && !Array.isArray(nested)
+    ? nested as Record<string, unknown>
+    : event;
+  const code = typeof error.code === "string"
+    ? error.code
+    : typeof event.code === "string" ? event.code : null;
+  const message = typeof error.message === "string"
+    ? error.message
+    : typeof event.message === "string" ? event.message : "";
+  return comboFailureDecision(status, message, { code }) === "hop";
+}
+
 function retryableZeroOutputTerminal(payload: unknown): boolean {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
   const event = payload as {
     type?: unknown;
     response?: { incomplete_details?: { reason?: unknown } };
   };
+  if (bareErrorIsRetryable(event)) return true;
   if (event.type === "response.failed") return true;
   if (event.type !== "response.incomplete") return false;
   const reason = event.response?.incomplete_details?.reason;
@@ -95,12 +152,17 @@ function failedTerminalResponse(
     ? nested as Record<string, unknown>
     : {};
   const nestedError = terminalResponse.error;
+  const topLevelError = terminalPayload.error;
   const error = nestedError && typeof nestedError === "object" && !Array.isArray(nestedError)
     ? nestedError as Record<string, unknown>
+    : topLevelError && typeof topLevelError === "object" && !Array.isArray(topLevelError)
+      ? topLevelError as Record<string, unknown>
     : {
       type: "upstream_error",
       code: "upstream_server_error",
-      message: logCtx.upstreamError ?? "Provider stream failed before producing output",
+      message: typeof terminalPayload.message === "string"
+        ? terminalPayload.message
+        : logCtx.upstreamError ?? "Provider stream failed before producing output",
     };
   const headers = new Headers(response.headers);
   headers.set("content-type", "application/json");
@@ -117,7 +179,7 @@ function failedTerminalResponse(
       ...(usage && typeof usage === "object" && !Array.isArray(usage) ? { usage } : {}),
     },
   }), {
-    status: logCtx.terminalHttpStatus ?? 502,
+    status: logCtx.terminalHttpStatus ?? bareErrorStatus(terminalPayload) ?? 502,
     headers,
   });
 }
@@ -154,11 +216,12 @@ export async function preflightComboStreamResponse(
   const inspector = createSseInspector({
     logCtx,
     onParsedPayload: payload => {
+      if (terminalStatus !== undefined || outputCommitted || retryableTerminalPayload) return;
       const retryable = retryableTerminal(payload);
       const matchedBareError = retryable && payload !== null && typeof payload === "object"
         && !Array.isArray(payload) && (payload as { type?: unknown }).type === "error";
-      // Only an explicit caller predicate may opt a known bare error into replay.
-      // Default combo classification still commits unknown/error events.
+      // A zero-output bare error is terminal evidence. Explicit client errors stay
+      // committed; unknown and retryable upstream failures may advance the combo.
       if (comboStreamPayloadCommitsOutput(payload) && !matchedBareError) outputCommitted = true;
       if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;
       if (retryable) retryableTerminalPayload = payload as Record<string, unknown>;
@@ -197,7 +260,7 @@ export async function preflightComboStreamResponse(
       }
 
       // A bare error event is not a protocol terminal (terminalStatus stays undefined),
-      // so its exact-message retryable match doubles as the terminal evidence.
+      // so its retryable classification doubles as the terminal evidence.
       if ((terminalStatus === "failed" || terminalStatus === "incomplete"
         || retryableTerminalPayload?.type === "error")
         && !outputCommitted && retryableTerminalPayload) {

package/src/server/responses/compact.ts

@@ -107,6 +107,7 @@ import {
 } from "../../codex/upstream-host-health";
 import {
   ForwardAdmissionCredentialError,
+  contextPrincipalIdOf,
   hasForwardableCodexBearer,
   validateForwardAdmissionCredential,
 } from "../auth-cors";
@@ -114,7 +115,11 @@ import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
-import { isCodexReserveRequestEligible } from "../../codex/loopback-target";
+import {
+  isCodexReserveOptInMissing,
+  isCodexReserveRequestEligible,
+  CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE,
+} from "../../codex/loopback-target";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
 import { fastPolicyForModel } from "../../providers/service-tier";
@@ -210,8 +215,33 @@ function pruneCompactHandoffRoutes(now: number): void {
   }
 }
 
-function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now()): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+/**
+ * The handoff map is process-global, so a caller-controlled lane header alone
+ * cannot be the key: two authenticated clients sending the same lane header
+ * would share one fallback route. Namespace the lane by the admitted principal.
+ * A loopback or missing admission has no authenticated identity to bind this
+ * cross-request state to, so it is ineligible rather than trusted.
+ */
+function compactHandoffRouteKey(req: Request, admission: DataPlaneAdmission | undefined): string | null {
+  const lane = sessionLaneIdFromRequest(req.headers);
+  if (!lane || !admission || admission.kind === "loopback") return null;
+  // Fail closed rather than substituting a weaker identity. `keyId` survives a
+  // rotation and every identity-less environment admission would collapse into
+  // one bucket, which is the collision this key exists to prevent. Production
+  // admission always mints `contextPrincipalId` for configured and environment
+  // holders, so no real authenticated caller loses the route.
+  const principal = contextPrincipalIdOf(admission);
+  if (!principal) return null;
+  return `${principal}\u0000${lane}`;
+}
+
+function rememberCompactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  model: string,
+  now = Date.now(),
+): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key || model.length > COMPACT_HANDOFF_MODEL_MAX_LENGTH) return;
   pruneCompactHandoffRoutes(now);
   compactHandoffRoutes.delete(key);
@@ -219,13 +249,18 @@ function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now
   pruneCompactHandoffRoutes(now);
 }
 
-function forgetCompactHandoffRoute(req: Request): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+function forgetCompactHandoffRoute(req: Request, admission?: DataPlaneAdmission): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (key) compactHandoffRoutes.delete(key);
 }
 
-function compactHandoffRoute(req: Request, previousModel: string, now = Date.now()): string | null {
-  const key = sessionLaneIdFromRequest(req.headers);
+function compactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  previousModel: string,
+  now = Date.now(),
+): string | null {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key) return null;
   pruneCompactHandoffRoutes(now);
   const entry = compactHandoffRoutes.get(key);
@@ -632,6 +667,20 @@ export async function handleResponsesCompact(
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
+  // #4940, and the same refusal the ordinary Responses path makes in request-prepare.ts. Compact has
+  // to repeat it rather than inherit it: the native branch below dispatches straight to
+  // `/responses/compact` and only the routed fallback replays through handleResponses, so relying on
+  // that one seam would leave the native compact turn forwarding a Reserve model the opt-in has made
+  // unservable. Composed from the same three facts, in the same order, as `customReserveForward`
+  // further down, and placed before the virtual-model rewrite so it reads the model the caller
+  // actually selected -- and before auth, host-circuit admission, or any upstream byte.
+  //
+  // No terminal-helper or inbound-wire qualifier is needed here the way it is on the ordinary path:
+  // this endpoint is the native Codex compaction wire, and a vision/search helper never reaches it.
+  if (isCodexReserveOptInMissing(config, selectedModelId, admission)
+    && isCanonicalOpenAiForwardProvider(route.provider)) {
+    return formatErrorResponse(400, "invalid_request_error", CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE);
+  }
   const virtual = resolveOpenAiCompactModel(route.providerName, selectedModelId);
   if (virtual) {
     route.modelId = virtual.wireModelId;
@@ -1254,10 +1303,10 @@ export async function handleResponsesCompact(
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
-      forgetCompactHandoffRoute(req);
+      forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
     } else if (quotaFailure && !storedPool401ReplayAttempted) {
-      const fallbackModel = compactHandoffRoute(req, raw.model);
+      const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
           method: "POST",
@@ -1389,7 +1438,7 @@ export async function handleResponsesCompact(
     const result = new Response(JSON.stringify({ output: compactionItems }), {
       headers: { "Content-Type": "application/json" },
     });
-    rememberCompactHandoffRoute(req, raw.model);
+    rememberCompactHandoffRoute(req, admission, raw.model);
     return result;
   }
   const encrypted = compactionItems[0]!.encrypted_content;
@@ -1400,6 +1449,6 @@ export async function handleResponsesCompact(
   }
   const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
-  rememberCompactHandoffRoute(req, raw.model);
+  rememberCompactHandoffRoute(req, admission, raw.model);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }

package/src/server/responses/core-codex-account.ts

@@ -32,6 +32,7 @@ import {
   resolveCodexModelEntitlements,
   invalidateCodexModelEntitlementsForAccount,
   entitledCodexAccountIdsForModel,
+  recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
@@ -161,43 +162,93 @@ export function normalizeCodexUnsupportedModelDetail(value: string): string {
 }
 
 
-export function isAllowListedCodexAccountModel400(
+/**
+ * The model id an authenticated Codex refusal names, or `undefined` when the body is not that
+ * refusal.
+ *
+ * Extracted rather than string-compared so the caller can learn WHICH model was refused. The
+ * route and the wire can legitimately disagree: `applyCodexAccountGatedWireNormalization`
+ * rewrites `gpt-daybreak-blue-latest` to `gpt-5.6-sol` before dispatch, so upstream names the
+ * model it was actually sent. Building the expected sentence from `route.modelId` alone made
+ * that comparison fail for the one model that is still account-gated, which silently disabled
+ * both the alternate-account retry and the same-account ladder built for exactly that case.
+ *
+ * The envelope is unchanged and stays exact: a top-level `detail` string, whitespace-collapsed
+ * and case-folded, matching the whole sentence with nothing before or after it. No prose is
+ * inferred and no other 400 shape is admitted, because a 400 is also what a malformed request
+ * earns and that must never read as an entitlement fact.
+ */
+export function codexUnsupportedModelFromDetail(
   status: number,
   bodyText: string,
-  modelId: string,
-): boolean {
-  if (status !== 400) return false;
+): string | undefined {
+  if (status !== 400) return undefined;
   try {
     const payload = JSON.parse(bodyText) as unknown;
-    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
     const detail = (payload as { detail?: unknown }).detail;
-    if (typeof detail !== "string") return false;
-    const expected = `The '${modelId}' model is not supported when using Codex with a ChatGPT account.`;
-    return normalizeCodexUnsupportedModelDetail(detail)
-      === normalizeCodexUnsupportedModelDetail(expected);
+    if (typeof detail !== "string") return undefined;
+    const matched = /^the '([^']{1,256})' model is not supported when using codex with a chatgpt account\.$/u
+      .exec(normalizeCodexUnsupportedModelDetail(detail));
+    return matched?.[1];
   } catch {
-    return false;
+    return undefined;
   }
 }
 
 
-export async function shouldRetryCodexPoolAccountModel400(
+/**
+ * The refused model id when this response is the exact unsupported-model refusal for this
+ * request, read from a bounded clone.
+ *
+ * Same admission rules {@link shouldRetryCodexPoolAccountModel400} always applied, which is now
+ * a predicate over this: a truncated or non-display-safe body proves nothing and is refused.
+ * Returning the id lets the caller record the denial against the model upstream actually named.
+ */
+export async function codexPoolAccountModel400Denial(
   response: Response,
   modelId: string,
   signal?: AbortSignal,
-): Promise<boolean> {
-  if (response.status !== 400) return false;
+  wireModelId?: string,
+): Promise<string | undefined> {
+  if (response.status !== 400) return undefined;
   try {
     const body = await readBoundedResponseBody(response.clone(), { signal });
-    return body.displaySafe
-      && !body.truncated
-      && isAllowListedCodexAccountModel400(response.status, body.text, modelId);
+    if (!body.displaySafe || body.truncated) return undefined;
+    return isAllowListedCodexAccountModel400(response.status, body.text, modelId, wireModelId)
+      ? codexUnsupportedModelFromDetail(response.status, body.text)
+      : undefined;
   } catch {
-    return false;
+    return undefined;
   }
 }
 
 
+export function isAllowListedCodexAccountModel400(
+  status: number,
+  bodyText: string,
+  modelId: string,
+  wireModelId?: string,
+): boolean {
+  const refused = codexUnsupportedModelFromDetail(status, bodyText);
+  if (refused === undefined) return false;
+  return [modelId, wireModelId].some(candidate => (
+    candidate !== undefined
+    && refused === normalizeCodexUnsupportedModelDetail(candidate)
+  ));
+}
+
+
+export async function shouldRetryCodexPoolAccountModel400(
+  response: Response,
+  modelId: string,
+  signal?: AbortSignal,
+  wireModelId?: string,
+): Promise<boolean> {
+  return await codexPoolAccountModel400Denial(response, modelId, signal, wireModelId) !== undefined;
+}
+
+
 /** Pre-stream quota/billing rejections that warrant one alternate-account attempt (#584). */
 export function codexQuotaFailureMessage(body: string): string | undefined {
   try {
@@ -778,15 +829,25 @@ export async function retryCodexPoolOnAlternateAccount(
       }
       retrySendCount += 1;
       args.onResponse?.(upstreamResponse, retryAuthCtx, request);
+      // The alternate account can refuse the same model, and that refusal is evidence about the
+      // account that produced it. Read BEFORE the ladder's own break, so the ordinary
+      // single-retry path -- every flagship model, which is the #4906 case -- records it too
+      // rather than only the gated ladder below. Without this the pool learns nothing from a
+      // refusal and the next request repeats the same selection.
+      const retryModelDenial = await codexPoolAccountModel400Denial(
+        upstreamResponse,
+        route.modelId,
+        options.abortSignal,
+        parsed.modelId,
+      );
+      if (retryModelDenial !== undefined) {
+        recordCodexModelDenialEvidence(retryAuthCtx.accountId, retryModelDenial);
+      }
       if (!retrySameConfirmedAccount || retrySendCount >= maxRetrySends) break;
       // Caller-owned main is an alternate-account replay and can never enter the bounded
       // same-stored-account 400 loop above. Keep that invariant explicit for the account-id reads.
       if (retryAuthCtx.kind === "main") break;
-      if (!await shouldRetryCodexPoolAccountModel400(
-        upstreamResponse,
-        route.modelId,
-        options.abortSignal,
-      )) break;
+      if (retryModelDenial === undefined) break;
       invalidateCodexModelEntitlementsForAccount(retryAuthCtx.accountId);
       let refreshed: Awaited<ReturnType<typeof resolveCodexModelEntitlements>>;
       try {

package/src/server/responses/core-combo.ts

@@ -745,6 +745,13 @@ export async function executeComboResponses(
       code: failure.upstreamCode,
       message: failure.classificationText,
     });
+    // Same target selector as the exclusionary pick below, minus `exclude`: the only
+    // difference is deliberate and is the whole point of the single-target retry.
+    const retryAfterCooldown = () =>
+      pickWithWait({
+        eligible: targetEligible,
+        now: failureNow,
+      });
     if (nextPick) {
       pick = nextPick;
     } else {
@@ -753,6 +760,25 @@ export async function executeComboResponses(
         eligible: targetEligible,
         now: failureNow,
       });
+      // A single-target combo with waitForCooldownMs has no alternate target to fail over to,
+      // but can recover if it waits for its brief cooldown. The initial attempt accumulated into
+      // pick.attempted, so the first pickWithWait above excluded it. retryAfterCooldown below is
+      // the same selector with `exclude` deliberately dropped, so the single cooled target
+      // becomes eligible again once its cooldown expires.
+      // Termination is double-guarded:
+      // 1) comboSendScope?.reserveDispatch refuses a second failover hop via comboExecutionBudgetPolicy
+      //    (maxAlternateTargetSends: 1 for a single declared target).
+      // 2) comboTargetsDispatched <= 1 bounds it locally so the retry never loops or waits unnecessarily
+      //    even if sendBudget scope is absent.
+      if (
+        !pick
+        && combo.targets.length === 1
+        && combo.waitForCooldownMs > 0
+        && comboTargetsDispatched <= 1
+        && !options.abortSignal?.aborted
+      ) {
+        pick = await retryAfterCooldown();
+      }
     }
     if (!pick) {
       if (options.abortSignal?.aborted) return clientCancelledResponse();

package/src/server/responses/core-normalize.ts

@@ -142,11 +142,18 @@ export async function applyFinalRouteRequestNormalization(args: {
     route.modelId,
   );
 
-  // Settle the wire once so logging, fast-mode, auth, and sidecars read the adapter
-  // this request will actually use (#404).
-  route.provider = resolveOpenCodeGoTransport(route.provider,
-    args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req));
-  route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+  // Preserve the routed destination for Go recognition, then settle the wire before
+  // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
+  const routedProvider = route.provider;
+  const wireProvider = resolveWireProtocolOverride(
+    route.providerName,
+    route.modelId,
+    routedProvider,
+    inboundWire,
+  );
+  route.provider = resolveOpenCodeGoTransport(wireProvider,
+    args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req),
+    routedProvider);
   parsed._plaintextV2AgentMessages = shouldPreparePlaintextV2AgentMessages({
     enabled: config.plaintextV2AgentMessages === true,
     inboundWire,

package/src/server/responses/core-options.ts

@@ -1,3 +1,4 @@
+import type { NativeResponseControl } from "./native-response-control";
 import type { OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
 import type { CodexAuthPolicyConfig, CodexAuthContext } from "../../codex/auth-context";
 import type { AdmissionLease } from "../../lib/admission";
@@ -51,6 +52,8 @@ export interface HandleResponsesOptions {
   /** Called at most once after the complete client body is read and accepted for dispatch. */
   onRequestBodyRead?: () => void;
   forceEmptyResponseId?: boolean;
+  /** Internal, connection-owned control channel; never reconstructed from headers. */
+  nativeControl?: NativeResponseControl;
   abortSignal?: AbortSignal;
   /** One-shot TTFT callback: first non-empty model output observed (WP4). */
   onFirstOutput?: () => void;