@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/server/responses/passthrough-dispatch.ts

@@ -1,3 +1,7 @@
+import { createSteeringSettingsNormalizer } from "./native-steering-policy";
+import { nativeResponseControlEligible } from "./native-response-control";
+import { NativeInjectionReplay } from "./native-injection-replay";
+import { NativeSteeringReplay } from "./native-steering-replay";
 import type {
   ResponsesRequestContext,
   ResponsesAdmissionState,
@@ -7,10 +11,11 @@ import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
 import type { ResponsesEffects } from "./response-effects";
 import type { ResponsesSendBudget } from "./request-send-budget";
+import { transientSendCapFor } from "./request-send-budget";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { codexSafetyBufferingFilterOptions, terminalStatusFromParsed } from "../relay";
 import { imageGenToolCallAliases } from "../responses-image-gen-repair";
-import { rememberResponseState } from "../../responses/state";
+import { rememberResponseState, isBodyNonPersistable } from "../../responses/state";
 import {
   currentTurnWireToolCatalogBody,
   hasExplicitWireToolCatalog,
@@ -64,6 +69,7 @@ import {
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
+import { noteAttemptRecoveryWithheld } from "../request-log";
 import {
   upstreamHostHealthKey,
   normalizeUpstreamHostCircuitThreshold,
@@ -87,11 +93,15 @@ import {
   usesCodexForwardPoolAuth,
   codexWsQuotaObserver,
   isFixedCodexAccount,
-  shouldRetryCodexPoolAccountModel400,
+  codexPoolAccountModel400Denial,
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
   retryCodexPoolOnAlternateAccount,
 } from "./core-codex-account";
+import {
+  clearCodexModelDenialEvidence,
+  recordCodexModelDenialEvidence,
+} from "../../codex/model-entitlements";
 import { readCodexWsStage } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
@@ -101,9 +111,8 @@ import {
   SendBudgetExhaustedError,
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
-  TRANSIENT_RETRY_MAX_ATTEMPTS,
   isNonReplayableResponse,
-  prepareSameTarget429Wait,
+ prepareSameTarget429Wait,
   sleepWithAbort,
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
@@ -111,7 +120,11 @@ import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upst
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
-import { rateLimitRetryPolicyFor, rateLimitRetryDelayMs } from "../../providers/key-failover";
+import {
+  rateLimitRetryPolicyFor,
+  rateLimitRetryDelayMs,
+  transientRetryPolicyFor,
+} from "../../providers/key-failover";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { refreshPoolForwardAuth, refreshNativeMainForwardAuth, withClaudeNativeSession } from "./core-auth";
@@ -194,6 +207,7 @@ export async function preparePassthroughExchange(
     | "reserveCredentialHop"
     | "pendingHopPermit"
     | "workflowRootId"
+    | "sendsUsed"
   >,
 ) {
   const { config, logCtx, options, req } = requestContext;
@@ -251,6 +265,19 @@ export async function preparePassthroughExchange(
       ? (response: { id?: unknown; output?: unknown; status?: unknown }) =>
         rememberResponseState(parsed._rawBody, response, undefined, responseStateOptions(true))
       : undefined;
+    if (options.nativeControl && nativeResponseControlEligible(route.provider, options.nativeControl)
+      && options.inboundTransport === "websocket" && !options.comboAttempt) {
+      const body = parsed._rawBody as Record<string, unknown>;
+      if (options.nativeControl.kind === "steering") {
+        options.nativeControl.normalizeContinuation = createSteeringSettingsNormalizer(parsed, route, config, req.headers);
+      }
+      const Replay = options.nativeControl.kind === "injection" ? NativeInjectionReplay : NativeSteeringReplay;
+      options.nativeControl.replayFactory = () => new Replay(body.input, (input, response) => {
+        if (passthroughRecordEligible && !isBodyNonPersistable(body)) {
+          rememberResponseState({ ...body, input }, response, undefined, responseStateOptions(true));
+        }
+      });
+    }
     if (parsed.previousResponseId && !parsed._previousResponseInputExpanded) {
       console.warn(
         `[responses] previous_response_id ${parsed.previousResponseId} not found in local replay state `
@@ -648,6 +675,33 @@ export async function preparePassthroughExchange(
     linkAbortSignal(upstream, options.abortSignal);
     const connectMs = config.connectTimeoutMs ?? 200_000;
     let upstreamResponse: Response;
+    /**
+     * This leg's transient-5xx ladder cap, from the provider's own `transientRetryOn5xx`.
+     *
+     * The lane used to pass `TRANSIENT_RETRY_MAX_ATTEMPTS` at every call site, so an operator who
+     * configured the option on a key-auth `openai-responses` provider changed nothing in either
+     * direction, while the same provider on `openai-chat` was tuned normally. That asymmetry is
+     * #4893. The gate in `transientRetryPolicyFor` returns null for OAuth and forward providers,
+     * so the ChatGPT pool keeps exactly the ladder it has always had.
+     *
+     * Read per call rather than captured once, for two reasons. `route.provider` is reassigned
+     * inside the recovery loop by credential rotation and transport resolution, so a hoisted
+     * policy could outlive the provider row it came from. And the configured value is a total for
+     * the whole request, so it has to be measured against what the request has already sent at
+     * the moment each leg asks.
+     *
+     * Still bounded by the request: every site feeds this to `remainingTransientSendBudget` or
+     * `recoverySendAllowance`, which intersect it with the request-wide base allowance. So a
+     * provider can narrow this request's sends exactly and cannot widen the bound that exists to
+     * stop per-request amplification (#4546).
+     */
+    const transientSendPolicy = () => transientRetryPolicyFor(route.provider);
+    const transientSendAttempts = (): number => transientSendCapFor(
+      transientSendPolicy()?.attempts,
+      sendBudgetState.sendsUsed,
+    );
+    const configuredTransientSendBudgetExhausted = (): boolean =>
+      transientSendPolicy() !== null && transientSendAttempts() === 0;
     /**
      * Refuse a built body that exceeds the operator's configured ceiling, before it is sent.
      *
@@ -772,6 +826,9 @@ export async function preparePassthroughExchange(
             body: request.body,
           }, recovery), upstream.signal, connectMs, parsed.stream,
             providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
               providerName: route.providerName,
               modelId: route.modelId,
@@ -784,7 +841,7 @@ export async function preparePassthroughExchange(
             // retry wrapper replaces — proves the host was reached (#914 review).
             .then(adoptObservedResponse);
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(TRANSIENT_RETRY_MAX_ATTEMPTS), onSendsConsumed: noteTransientSends },
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
       );
     } catch (err) {
       return transportFailureResponse(err);
@@ -844,14 +901,15 @@ export async function preparePassthroughExchange(
       recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, retryAdapter.name);
       const rebuiltBodyRefusal = refuseOversizedOutboundBody(request);
       if (rebuiltBodyRefusal) return { failed: rebuiltBodyRefusal };
-      // The base allowance is spent first; once it is gone this leg may still draw the one
-      // shared final-recovery reserve, which is what keeps a validated sanitized rebuild
-      // after a 5xx streak alive at four total sends instead of dying at three. Reserved
-      // outside the try so the finally can hand it back if the leg never reached its send.
+      // The base allowance is spent first. An unconfigured provider may then draw the one shared
+      // final-recovery reserve, which keeps a validated sanitized rebuild after a 5xx streak alive
+      // at four total sends instead of dying at three. An explicit provider total cannot widen.
+      // Reserve outside the try so the finally can hand it back if the leg never reaches its send.
       const allowance = recoverySendAllowance(
-        TRANSIENT_RETRY_MAX_ATTEMPTS,
+        transientSendAttempts(),
         recoveryClassFor(recovery),
         `${route.providerName}|${route.modelId}|${recovery}`,
+        { allowFinalRecoveryReserve: transientSendPolicy() === null },
       );
       try {
         return await fetchWithTransientRetry(
@@ -868,6 +926,9 @@ export async function preparePassthroughExchange(
               body: request.body,
             }, innerRecovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -974,6 +1035,9 @@ export async function preparePassthroughExchange(
           // here on is a genuine transport attempt.
           storedPoolReplayDispatchNotifier(
             providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
               providerName: route.providerName,
               modelId: route.modelId,
@@ -1007,7 +1071,7 @@ export async function preparePassthroughExchange(
       // Refused here, before the 401 body is cancelled: once it is gone the request can only
       // answer with a synthetic 502, which would report a proxy budget decision as an upstream
       // fault and throw away the credential evidence the client needs.
-      && !sendBudgetExhausted()
+      && !sendBudgetExhausted(transientSendAttempts())
     ) {
       oauth401ReplayAttempted = true;
       try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
@@ -1095,6 +1159,9 @@ export async function preparePassthroughExchange(
               body: request.body,
             }, recovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -1105,7 +1172,7 @@ export async function preparePassthroughExchange(
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(TRANSIENT_RETRY_MAX_ATTEMPTS), onSendsConsumed: noteTransientSends },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1116,13 +1183,13 @@ export async function preparePassthroughExchange(
 
     // Native Responses returns before the generic adapter's OAuth rotation loop. Keep
     // the same quorum, cooldown and request budget here, before any client bytes flow.
-    if (
-      upstreamResponse.status === 429
+   if (
+     upstreamResponse.status === 429
       // Not a provider rate limit when this proxy synthesized it for a refused reset
       // replay; rotating accounts on it would re-send an inference that may already
       // have run and would cool down an account that refused nothing.
       && !isNonReplayableResponse(upstreamResponse)
-      && transportState.genericFailoverAccountId
+     && transportState.genericFailoverAccountId
       && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
       && isGenericOAuthFailoverEnabled(config, route.providerName)
     ) {
@@ -1138,6 +1205,8 @@ export async function preparePassthroughExchange(
         const nextAccountId = rotateGenericOAuthAccountOn429(
           config, route.providerName, transportState.genericFailoverAccountId,
           upstreamResponse.headers.get("retry-after"),
+          Date.now(),
+          route.modelId,
         );
         let snapshot: OAuthAccessSnapshot | undefined;
         if (nextAccountId) {
@@ -1165,6 +1234,11 @@ export async function preparePassthroughExchange(
         }
         // No credential moved, so the reservation costs nothing.
         hop.permit?.release();
+      } else {
+        // Rotation was available -- the roster cap above admitted it -- and the shared request
+        // budget refused. Recorded so a one-send log is not read as "nothing was eligible",
+        // which is the ambiguity this attribution exists to remove (#5044).
+        noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
       }
     }
 
@@ -1174,15 +1248,15 @@ export async function preparePassthroughExchange(
     // immediately with no same-key replay. Pre-stream only — nothing has been relayed yet, so
     // the replay is lossless (same invariant as the recovery loop). Forward/OAuth providers
     // keep their pool logic below (rateLimitRetryPolicyFor returns null for them).
-    while (
-      upstreamResponse.status === 429
+   while (
+     upstreamResponse.status === 429
       && !isNonReplayableResponse(upstreamResponse)
-      && rateLimitPolicy !== null
+     && rateLimitPolicy !== null
       && rateLimitRetries < rateLimitPolicy.attempts
       // Checked here rather than inside the helper: prepareSameTarget429Wait releases the 429
       // body, so a refusal discovered after the wait can no longer return the real rate-limit
       // answer and would surface a synthetic 502 instead.
-      && !sendBudgetExhausted()
+      && !sendBudgetExhausted(transientSendAttempts())
     ) {
       rateLimitRetries += 1;
       // Release unread body + deliberate wait via the shared same-target helper.
@@ -1217,6 +1291,9 @@ export async function preparePassthroughExchange(
               body: request.body,
             }, recovery), upstream.signal, connectMs, parsed.stream,
               providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              nativeControl: nativeResponseControlEligible(route.provider, options.nativeControl) && options.inboundTransport === "websocket" && !options.comboAttempt
+                && responseEffects.plaintextV2AgentMessageToolNames.size === 0
+                ? options.nativeControl : undefined,
               dispatchOverride: oauthDispatch(request),
                 providerName: route.providerName,
                 modelId: route.modelId,
@@ -1227,7 +1304,7 @@ export async function preparePassthroughExchange(
               route.provider.authMode === "forward")
               .then(adoptObservedResponse);
           },
-          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(TRANSIENT_RETRY_MAX_ATTEMPTS), onSendsConsumed: noteTransientSends },
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
         );
       } catch (err) {
         return transportFailureResponse(err);
@@ -1259,11 +1336,25 @@ export async function preparePassthroughExchange(
 
     if (usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)) {
       let poolRetryOutcome: number | undefined;
-      if (await shouldRetryCodexPoolAccountModel400(
+      // A success is the freshest evidence there is about this pair, and it outranks any earlier
+      // refusal: whatever the entitlement was when upstream declined, it is not that now. Both
+      // ids are cleared because the wire model can differ from the routed one.
+      if (upstreamResponse.ok) {
+        clearCodexModelDenialEvidence(admissionState.authCtx.accountId, route.modelId);
+        clearCodexModelDenialEvidence(admissionState.authCtx.accountId, parsed.modelId);
+      }
+      const model400Denial = await codexPoolAccountModel400Denial(
         upstreamResponse,
         route.modelId,
         options.abortSignal,
-      )) {
+        parsed.modelId,
+      );
+      if (model400Denial !== undefined) {
+        // Spend this refusal on more than one retry. It is the account's own authenticated
+        // answer about this model, and the roster cache that selection otherwise reads expires
+        // five minutes after a catalog sync fills it -- so without remembering this, the next
+        // request selects the same account on quota alone and takes the same 400 (#4906).
+        recordCodexModelDenialEvidence(admissionState.authCtx.accountId, model400Denial);
         poolRetryOutcome = 400;
       } else if (!admissionState.authCtx.fixedAccount && await shouldRetryCodexPoolAccountQuota(
         upstreamResponse,
@@ -1333,18 +1424,20 @@ export async function preparePassthroughExchange(
     // eviction, or an older transcript). Inspect only a bounded clone of a 4xx whose exact outbound
     // Responses body still carries opaque state, then rebuild once through the ordinary adapter
     // sanitation path. A second rejection falls through unchanged because the guard stays armed.
-    const opaqueBlobRecovery = await attemptOpaqueBlobRecovery({
-      response: upstreamResponse,
-      outboundBody: request.body,
-      adapterName: transportState.adapter.name,
-      parsed,
-      guard: opaqueBlobRecoveryGuard,
-      signal: upstream.signal,
-    }, rebuildAndRefetch);
-    if (opaqueBlobRecovery.kind === "failed") return opaqueBlobRecovery.response;
-    if (opaqueBlobRecovery.kind === "recovered") {
-      upstreamResponse = opaqueBlobRecovery.response;
-      continue passthroughRecovery;
+    if (!configuredTransientSendBudgetExhausted()) {
+      const opaqueBlobRecovery = await attemptOpaqueBlobRecovery({
+        response: upstreamResponse,
+        outboundBody: request.body,
+        adapterName: transportState.adapter.name,
+        parsed,
+        guard: opaqueBlobRecoveryGuard,
+        signal: upstream.signal,
+      }, rebuildAndRefetch);
+      if (opaqueBlobRecovery.kind === "failed") return opaqueBlobRecovery.response;
+      if (opaqueBlobRecovery.kind === "recovered") {
+        upstreamResponse = opaqueBlobRecovery.response;
+        continue passthroughRecovery;
+      }
     }
 
     const recoveryContentType = upstreamResponse.headers.get("content-type")?.toLowerCase() ?? "";
@@ -1352,6 +1445,7 @@ export async function preparePassthroughExchange(
       && !!upstreamResponse.body
       && (recoveryContentType.includes("text/event-stream") || (!recoveryContentType && parsed.stream))
       && !opaqueBlobRecoveryGuard.attempted
+      && !configuredTransientSendBudgetExhausted()
       && outboundResponsesBodyCarriesEncryptedFunctionOutput(request.body);
     if (streamedFunctionOutputCandidate) {
       const preflightLog: RequestLogContext = { model: logCtx.model, provider: logCtx.provider };
@@ -1368,19 +1462,21 @@ export async function preparePassthroughExchange(
       if (options.abortSignal?.aborted) return transportFailureResponse(options.abortSignal.reason);
       upstreamResponse = preflight.response;
       if (preflight.kind === "failed") {
-        const streamedOpaqueRecovery = await attemptOpaqueBlobRecovery({
-          response: upstreamResponse,
-          outboundBody: request.body,
-          adapterName: transportState.adapter.name,
-          parsed,
-          guard: opaqueBlobRecoveryGuard,
-          signal: upstream.signal,
-        }, rebuildAndRefetch);
-        if (streamedOpaqueRecovery.kind === "failed") return streamedOpaqueRecovery.response;
-        if (streamedOpaqueRecovery.kind === "recovered") {
-          resetStreamedOpaqueBlobLogContext(logCtx);
-          upstreamResponse = streamedOpaqueRecovery.response;
-          continue passthroughRecovery;
+        if (!configuredTransientSendBudgetExhausted()) {
+          const streamedOpaqueRecovery = await attemptOpaqueBlobRecovery({
+            response: upstreamResponse,
+            outboundBody: request.body,
+            adapterName: transportState.adapter.name,
+            parsed,
+            guard: opaqueBlobRecoveryGuard,
+            signal: upstream.signal,
+          }, rebuildAndRefetch);
+          if (streamedOpaqueRecovery.kind === "failed") return streamedOpaqueRecovery.response;
+          if (streamedOpaqueRecovery.kind === "recovered") {
+            resetStreamedOpaqueBlobLogContext(logCtx);
+            upstreamResponse = streamedOpaqueRecovery.response;
+            continue passthroughRecovery;
+          }
         }
         logCtx.upstreamError = preflightLog.upstreamError;
         logCtx.terminalHttpStatus = preflightLog.terminalHttpStatus;
@@ -1399,6 +1495,7 @@ export async function preparePassthroughExchange(
         upstream.signal,
       );
       if (uploadRejectionBody !== undefined
+        && !configuredTransientSendBudgetExhausted()
         && isTransientConsoleGoUploadRejection({
           status: upstreamResponse.status,
           errorBody: uploadRejectionBody,
@@ -1437,7 +1534,7 @@ export async function preparePassthroughExchange(
             requested: parsed.options.reasoning,
             rejectionText,
           });
-      if (downgrade) {
+      if (downgrade && !configuredTransientSendBudgetExhausted()) {
         reasoningEffortDowngradeGuard.attempted = true;
         parsed.options.reasoning = downgrade.effort;
         try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }

package/src/server/responses/passthrough-execution.ts

@@ -10,6 +10,8 @@ import type { ResponsesEffects } from "./response-effects";
 import type { ResponsesSendBudget } from "./request-send-budget";
 import { preparePassthroughExchange } from "./passthrough-dispatch";
 import { deliverPassthroughResponse } from "./passthrough-delivery";
+import { guardDirectPassthroughBodyInactivity } from "../../lib/response-body-inactivity";
+import { resolveStallTimeoutSec } from "../../stall-timeout";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 
@@ -36,7 +38,7 @@ export async function executePassthroughResponse(
       sendBudgetState,
     );
     if (nativeExchange instanceof Response) return nativeExchange;
-    return await deliverPassthroughResponse(
+    const response = await deliverPassthroughResponse(
       requestContext,
       admissionState,
       requestState,
@@ -45,6 +47,14 @@ export async function executePassthroughResponse(
       responseEffects,
       nativeExchange,
     );
+    // Delivery has already classified SSE (including a missing upstream content type)
+    // and consumed bounded JSON/errors. Guard only its remaining direct body, outside
+    // the relay/lifetime wrappers so their prefetch cannot arm our inactivity clock.
+    return guardDirectPassthroughBodyInactivity(
+      response,
+      nativeExchange.upstream.signal,
+      resolveStallTimeoutSec(requestContext.config.stallTimeoutSec) * 1000,
+    );
   } finally {
     if (nativeHostState.lease) {
       releaseUpstreamHostAdmission(nativeHostState.lease);

package/src/server/responses/request-prepare.ts

@@ -36,6 +36,7 @@ import {
   previewCodexPoolLineage,
   applyCodexAuthContextToProvider,
   hasCallerCodexBearer,
+  requestOwnedMainPinState,
 } from "../../codex/auth-context";
 import {
   copyPreviousResponseReplayProvenance,
@@ -104,7 +105,9 @@ import { hasUnmappedRoutedCustomToolOutput } from "../../responses/custom-tool-c
 import { PROVIDER_OWNED_CONTINUATION_WIRES, resolvedAdapterWire } from "../../responses/continuation-ownership";
 import {
   isCodexReserveHelperUnsupported,
+  isCodexReserveOptInMissing,
   CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE,
+  CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE,
 } from "../../codex/loopback-target";
 import { checkComboTargetInputAdmission, checkInputAdmission } from "./input-admission";
 import { nativeContextLimits } from "../../codex/catalog";
@@ -230,6 +233,10 @@ export async function prepareResponsesRequest(
     (body as { input?: unknown } | undefined)?.input,
   );
   const inboundClientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+  // The request's OWN thread, which `x-codex-parent-thread-id` is not: parallel children of one
+  // parent all present the same parent id. `codexConversationIdentity` already reads this header
+  // for the same reason, and a surface that must tell siblings apart needs it too (#5033).
+  const inboundOwnThreadId = req.headers.get("thread-id")?.trim() || undefined;
   const cursorClientThreadId = codexPoolAffinityKey(req.headers);
   const originalBody = body;
   if (options.comboReplaySnapshot) {
@@ -302,6 +309,7 @@ export async function prepareResponsesRequest(
       ? options.comboReplaySnapshot.providerContinuation
       : previousResponseProviderState(parsed.previousResponseId);
     if (providerContinuationCandidate) parsed._providerContinuationCandidate = providerContinuationCandidate;
+    if (inboundOwnThreadId) parsed._codexOwnThreadId = inboundOwnThreadId;
     if (inboundClientThreadId) {
       parsed._clientThreadId = inboundClientThreadId;
     } else if (
@@ -483,11 +491,37 @@ export async function prepareResponsesRequest(
   const nativeMainReadsForbidden = previewRequestScopedMainCredential
     || nativeMainRecoveryBlocked
     || previewSelectionAdmission?.mainProfileDraining === true;
+  // The liveness answer final authentication gives its own selection options, computed from the
+  // same shared predicate so the two cannot drift apart again (#4850). `fixedAccountId` is
+  // mirrored through `route.codexAccountId` because that is literally what core-auth.ts passes
+  // as `accountId`. A reserve-authorized request is the one input where the two can differ, and
+  // it differs harmlessly: reserve plus a caller bearer is served as main either way, which is
+  // the answer this produces.
+  const previewRequestOwnedMainPin = requestOwnedMainPinState(
+    previewAuthHeaders,
+    config,
+    options.codexAuthPolicy ?? config,
+    previewRequestScopedMainCredential,
+    route.codexAccountId,
+  ).preserve;
   // Deliberately NOT fenced on ownership: final auth derives `nativeMainSelectionOnly` from the
   // drain alone, and adding a term here would diverge from it in the other direction.
   const previewSelectionOptions = {
     nativeMainSelectionOnly: !nativeMainRecoveryBlocked
       && previewSelectionAdmission?.mainProfileDraining === true,
+    // Pool eligibility was the last part of preview still outside the fence (#4850). Without
+    // this seam `codexAccountUnusableReason` takes its default branch into
+    // `isMainAccountCredentialUsable()`, which opens the physical `auth.json` -- twice per
+    // spawn, because subagent fallback re-enters the preview through the callback below.
+    //
+    // Scoped to ownership, and carrying final auth's value rather than a constant, because
+    // preview exists to predict final auth. Under an effective main pin the request really is
+    // served by its own main credential, so main must stay eligible; without the pin final auth
+    // scores main `main_credential_unavailable` and drops it, so preview has to drop it too. A
+    // hardcoded `true` would be wrong in the second case and `false` in the first.
+    isMainAccountTokenLive: previewRequestScopedMainCredential
+      ? () => previewRequestOwnedMainPin
+      : undefined,
     // Preview must reach the same answer as the final resolution, including the uploaded-file
     // retention (#4778): a preview that reported a quota move the request will not make would
     // hand subagent fallback a different account than the one that actually serves.
@@ -672,6 +706,7 @@ export async function prepareResponsesRequest(
             "_providerContinuationOwner",
             "_cursorConversationId",
             "_clientThreadId",
+            "_codexOwnThreadId",
             "_promptCacheKeyIsSharedCohort",
             "_cursorClientThreadId",
             "_reasoningReplayScope",
@@ -711,9 +746,23 @@ export async function prepareResponsesRequest(
                 route,
                 options,
               ).requestScopedMainCredential && hasCallerCodexBearer(recoveryAuthHeaders);
+              // Recovery's own answer to the same question, against the route it may have moved
+              // to. Reconstructing the options without it is what left pool eligibility outside
+              // the fence on the first preview (#4850); recovery re-previews, so it would leave
+              // the same two reads on the one path that runs after decryption.
+              const recoveryRequestOwnedMainPin = requestOwnedMainPinState(
+                recoveryAuthHeaders,
+                config,
+                options.codexAuthPolicy ?? config,
+                recoveryRequestScopedMainCredential,
+                route.codexAccountId,
+              ).preserve;
               const recoverySelectionOptions = {
                 nativeMainSelectionOnly: !recoveryNativeMainBlocked
                   && recoverySelectionAdmission?.mainProfileDraining === true,
+                isMainAccountTokenLive: recoveryRequestScopedMainCredential
+                  ? () => recoveryRequestOwnedMainPin
+                  : undefined,
                 // #4778, same reason as `previewSelectionOptions` above: this preview decides
                 // which account subagent fallback scores against, and final auth passes the
                 // retention. Recovery is exactly where the two could diverge -- it re-previews
@@ -935,6 +984,27 @@ export async function prepareResponsesRequest(
       options.admission, options.visionDescribeTerminal === true)) {
     return formatErrorResponse(400, "invalid_request_error", CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE);
   }
+  // #4940: the opt-in is off, so every Reserve affordance in this process is inert -- no catalog
+  // row, no main-credential substitution, no authorization handshake, and no `luna-reserve` header
+  // on the send. Forwarding `gpt-reserve` as an ordinary native model therefore buys nothing but a
+  // 429 "The usage limit has been reached", which names neither the real cause nor the setting the
+  // operator would have to change. Refuse here instead, on the same terms and in the same place as
+  // the helper refusal above: after alias/combo resolution, before auth, host-circuit budget or any
+  // upstream byte.
+  //
+  // Two narrowings beyond the predicate, both about not answering a question this refusal cannot
+  // answer correctly. A terminal vision/search helper is excluded because enabling the opt-in would
+  // not make it work -- it would produce the helper refusal above instead, so telling that caller to
+  // enable the flag is advice that does not hold. Non-native inbound wires are excluded because a
+  // `gpt-reserve` selector reaching us over Chat or Anthropic Messages is an operator-authored
+  // route (a `claudeCode.modelMap` entry, say), not a Codex client that was forced onto Reserve by
+  // its own usage snapshot, and that route keeps whatever behavior it has today.
+  if (inboundWire === "responses"
+    && options.visionDescribeTerminal !== true
+    && isCanonicalOpenAiForwardProvider(route.provider)
+    && isCodexReserveOptInMissing(options.codexAuthPolicy ?? config, route.modelId, options.admission)) {
+    return formatErrorResponse(400, "invalid_request_error", CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE);
+  }
   // Refuse an input that cannot plausibly fit the model context window before spending auth,
   // circuit budget, or upstream bandwidth on a turn the provider will reject anyway (#1412).
   //