@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/adapters/run-turn-queue.ts

@@ -6,11 +6,107 @@ export const PREFLIGHT_HEARTBEAT_RETAIN_LIMIT = 16;
 
 /**
  * Coalescing threshold for adjacent text/thinking deltas buffered with no
- * waiting reader (UTF-16 code units). This is a merge-size ceiling, not a
- * byte-memory cap: a single oversized incoming event stays one item.
+ * waiting reader (UTF-16 code units). This is a merge-size ceiling; the two
+ * retention budgets below are what bound memory.
  */
 export const COALESCE_MAX_CHUNK_LENGTH = 64 * 1024;
 
+/**
+ * Retained-string budget for the WHOLE queue, in UTF-16 code units.
+ *
+ * This bounds what the queue is holding at one moment, not how much a turn
+ * streams: every dequeue gives its charge back, so a long healthy stream with a
+ * consumer attached never accumulates and is never capped by total length.
+ *
+ * 32 MiB is deliberately far above any single legitimate burst. A synchronous
+ * producer can legally fill the queue before its consumer is scheduled — the
+ * image loop does exactly that with over a million one-character deltas, which
+ * coalesce into roughly 1.2 MB of retained text — so a budget near that size
+ * aborts healthy turns rather than stalled ones. The previous effective bound
+ * was the 1024-event cap times the 64 KiB merge ceiling, so 64 MiB; this halves
+ * it while leaving that legitimate burst an order of magnitude of headroom.
+ */
+export const DEFAULT_MAX_BACKLOG_CODE_UNITS = 32 * 1024 * 1024;
+
+/**
+ * Retained-string budget for ONE queued event, in UTF-16 code units.
+ *
+ * Separate from the aggregate on purpose, because the two describe different
+ * failures. Passing the aggregate means the consumer is not keeping up. Passing
+ * this one means a single event is malformed or unbounded, which stays true
+ * however empty the queue is, so it must be refused even with the whole
+ * aggregate free. They also report different terminal messages, so an operator
+ * reading the turn's error learns which happened.
+ *
+ * Like the aggregate, this governs what the queue RETAINS. An event handed
+ * straight to a waiting consumer is never held here, so neither budget applies
+ * to it: refusing it would abort a turn over memory this queue does not own,
+ * and the consumer's own per-event bound governs that payload instead.
+ */
+export const DEFAULT_MAX_EVENT_CODE_UNITS = 8 * 1024 * 1024;
+
+const BACKLOG_EXCEEDED_MESSAGE = "consumer stalled: adapter event backlog exceeded — turn aborted";
+const EVENT_TOO_LARGE_MESSAGE = "adapter event exceeds the single-event retained-string budget — turn aborted";
+
+/**
+ * Bound on how far the retention measure walks into one event. AdapterEvent is
+ * a plain-data union, but two of its members carry open provider-shaped bags
+ * (`providerState`, `usage.rawUsage`) whose depth no type here controls. The
+ * ceilings keep a single push O(1)-ish rather than O(whatever an adapter
+ * attached), and under-counting a pathological object is the safe direction:
+ * the event-count cap still bounds how many of them can be retained.
+ */
+const RETENTION_MAX_DEPTH = 8;
+const RETENTION_MAX_NODES = 4096;
+
+/**
+ * Retained UTF-16 code units carried by one event's string payload.
+ *
+ * Measured by walking own enumerable properties rather than by naming each
+ * variant's string fields: a hand-written per-variant table is exhaustive over
+ * a union, so adding an event type on one branch while a consumer lands on
+ * another produces a measure that silently stops counting the new payload.
+ * The walk is the derived answer and needs no update when the union grows.
+ *
+ * `type` is skipped because it is the discriminant, identical for every event
+ * of a kind and not payload anyone is buffering.
+ */
+export function retainedEventCodeUnits(event: AdapterEvent): number {
+  // Defensive: this measures values an adapter produced. A malformed emission
+  // has to become a terminal event, not a TypeError thrown out of push() with
+  // the queue half-updated.
+  if (!event || typeof event !== "object") return 0;
+  let total = 0;
+  let nodes = 0;
+  const seen = new Set<object>();
+  const visit = (value: unknown, depth: number): void => {
+    if (typeof value === "string") {
+      total += value.length;
+      return;
+    }
+    if (!value || typeof value !== "object" || depth >= RETENTION_MAX_DEPTH || seen.has(value)) return;
+    seen.add(value);
+    for (const nested of Object.values(value)) {
+      if (nodes++ >= RETENTION_MAX_NODES) return;
+      visit(nested, depth + 1);
+    }
+  };
+  for (const [key, value] of Object.entries(event)) {
+    if (key === "type") continue;
+    if (nodes++ >= RETENTION_MAX_NODES) break;
+    visit(value, 1);
+  }
+  return total;
+}
+
+function positiveBudget(value: number | undefined, fallback: number, name: string): number {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+    throw new RangeError(`${name} must be a positive safe integer`);
+  }
+  return resolved;
+}
+
 export interface AdapterEventQueue {
   /**
    * Returns true when the event was merged into the buffered tail instead of
@@ -22,6 +118,13 @@ export interface AdapterEventQueue {
   close(): void;
   stream(): AsyncIterable<AdapterEvent>;
   collect(): Promise<AdapterEvent[]>;
+  /**
+   * Retained string payload the queue is currently holding, in UTF-16 code
+   * units. Exposed so a caller — and a regression — can assert the counter
+   * returns to zero on every terminal path instead of inferring it from an
+   * abort that happened to fire.
+   */
+  retainedCodeUnits(): number;
 }
 
 export interface AdapterEventPreflight {
@@ -73,47 +176,74 @@ export async function preflightAdapterEvents(
 
 export function createAdapterEventQueue(opts?: {
   maxBacklog?: number;
+  maxBacklogCodeUnits?: number;
+  maxEventCodeUnits?: number;
   onBacklogExceeded?: () => void;
 }): AdapterEventQueue {
   const queued: AdapterEvent[] = [];
+  /**
+   * What each queued item was charged, in lockstep with `queued`. Releasing the
+   * recorded charge rather than re-measuring is what makes the accounting exact
+   * on every path: a merge, a terminal record admitted past the budget and a
+   * plain event all give back precisely what they took, so the counter cannot
+   * drift positive (a leak) or negative (a budget the next turn gets for free).
+   */
+  const charged: number[] = [];
   const readers: QueueReader[] = [];
   const maxBacklog = opts?.maxBacklog ?? 1_024;
+  const maxBacklogCodeUnits = positiveBudget(opts?.maxBacklogCodeUnits, DEFAULT_MAX_BACKLOG_CODE_UNITS, "maxBacklogCodeUnits");
+  const maxEventCodeUnits = positiveBudget(opts?.maxEventCodeUnits, DEFAULT_MAX_EVENT_CODE_UNITS, "maxEventCodeUnits");
+  let retained = 0;
   let closed = false;
 
   // Merge an incoming delta into the buffered tail when no reader is waiting.
-  // The backlog cap counts events, not tokens, so a detached or briefly
-  // stalled consumer (e.g. a Codex app mid-reconnect whose disconnect Bun has
-  // not yet delivered) used to hit the cap within seconds of token-granular
-  // streaming and abort a healthy turn. Adjacent same-phase text deltas,
-  // adjacent thinking deltas, and consecutive heartbeats carry no ordering
-  // information between themselves, so merging them preserves every consumer
-  // contract while making the cap approximate buffered items again.
+  // The event cap counts events, not tokens, so a detached or briefly stalled
+  // consumer (e.g. a Codex app mid-reconnect whose disconnect Bun has not yet
+  // delivered) used to hit it within seconds of token-granular streaming and
+  // abort a healthy turn. Adjacent same-phase text deltas, adjacent thinking
+  // deltas, and consecutive heartbeats carry no ordering information between
+  // themselves, so merging them preserves every consumer contract while making
+  // the cap approximate buffered items again.
   // Pushed objects may be retained by adapters, so the tail is REPLACED with
-  // a fresh object — never mutated (alias safety).
-  const coalesceIntoTail = (event: AdapterEvent): boolean => {
-    const tail = queued[queued.length - 1];
-    if (!tail) return false;
+  // a fresh object — never mutated (alias safety). Returning the replacement
+  // instead of installing it lets push price the merge before committing to it.
+  const planTailMerge = (tail: AdapterEvent, event: AdapterEvent): AdapterEvent | null => {
     if (event.type === "heartbeat") {
-      if (tail.type !== "heartbeat") return false;
+      if (tail.type !== "heartbeat") return null;
       // Heartbeats carry no ordering between themselves, but the replay-unsafe
       // marker is not ordering — it is a latch. Dropping the incoming event
       // would discard the only record that Cursor already performed a local
       // side effect, and preflight would then permit an OAuth replay of it.
       if (event.replayUnsafe === true && tail.replayUnsafe !== true) {
-        queued[queued.length - 1] = { type: "heartbeat", replayUnsafe: true };
+        return { type: "heartbeat", replayUnsafe: true };
       }
-      return true;
+      return tail;
     }
     if (event.type === "text_delta" && tail.type === "text_delta" && tail.phase === event.phase) {
-      if (tail.text.length + event.text.length > COALESCE_MAX_CHUNK_LENGTH) return false;
-      queued[queued.length - 1] = { type: "text_delta", text: tail.text + event.text, phase: tail.phase };
-      return true;
+      if (tail.text.length + event.text.length > COALESCE_MAX_CHUNK_LENGTH) return null;
+      return { type: "text_delta", text: tail.text + event.text, phase: tail.phase };
     }
     if (event.type === "thinking_delta" && tail.type === "thinking_delta") {
-      if (tail.thinking.length + event.thinking.length > COALESCE_MAX_CHUNK_LENGTH) return false;
-      queued[queued.length - 1] = { type: "thinking_delta", thinking: tail.thinking + event.thinking };
-      return true;
+      if (tail.thinking.length + event.thinking.length > COALESCE_MAX_CHUNK_LENGTH) return null;
+      return { type: "thinking_delta", thinking: tail.thinking + event.thinking };
     }
+    return null;
+  };
+
+  /**
+   * Record why the turn is ending and close. The terminal error is admitted
+   * past both budgets — refusing to retain the explanation of a refusal would
+   * leave the consumer with a silent truncation — but it is charged like any
+   * other item so the counter stays exact through the final drain.
+   */
+  const abortWith = (message: string): false => {
+    opts?.onBacklogExceeded?.();
+    const terminal: AdapterEvent = { type: "error", message };
+    const cost = retainedEventCodeUnits(terminal);
+    queued.push(terminal);
+    charged.push(cost);
+    retained += cost;
+    close();
     return false;
   };
 
@@ -121,17 +251,35 @@ export function createAdapterEventQueue(opts?: {
     if (closed) return false;
     const reader = readers.shift();
     if (reader) {
+      // Handed straight to a waiting consumer, so the queue retains nothing and
+      // charges nothing. Neither budget applies to an event it never holds.
       reader({ done: false, value: event });
       return false;
     }
-    if (coalesceIntoTail(event)) return true;
-    if (queued.length >= maxBacklog) {
-      opts?.onBacklogExceeded?.();
-      queued.push({ type: "error", message: "consumer stalled: adapter event backlog exceeded — turn aborted" });
-      close();
-      return false;
+    const tail = queued[queued.length - 1];
+    const merged = tail ? planTailMerge(tail, event) : null;
+    if (merged && tail) {
+      const replacement = retainedEventCodeUnits(merged);
+      if (replacement > maxEventCodeUnits) return abortWith(EVENT_TOO_LARGE_MESSAGE);
+      // Charge only what the backlog actually gains. A merge keeps the tail's
+      // own fields, so the incoming event's duplicated phase is never retained
+      // twice and an unchanged tail costs nothing at all.
+      const delta = replacement - charged[charged.length - 1]!;
+      if (delta > maxBacklogCodeUnits - retained) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
+      queued[queued.length - 1] = merged;
+      charged[charged.length - 1] = replacement;
+      retained += delta;
+      return true;
     }
+    const cost = retainedEventCodeUnits(event);
+    if (cost > maxEventCodeUnits) return abortWith(EVENT_TOO_LARGE_MESSAGE);
+    // Both refusals are priced before anything is retained, so an event that is
+    // turned away is never charged for.
+    if (queued.length >= maxBacklog) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
+    if (cost > maxBacklogCodeUnits - retained) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
     queued.push(event);
+    charged.push(cost);
+    retained += cost;
     return false;
   };
 
@@ -147,6 +295,7 @@ export function createAdapterEventQueue(opts?: {
     while (true) {
       const next = queued.shift();
       if (next) {
+        retained -= charged.shift() ?? 0;
         yield next;
         continue;
       }
@@ -165,5 +314,5 @@ export function createAdapterEventQueue(opts?: {
     return events;
   };
 
-  return { push, close, stream, collect };
+  return { push, close, stream, collect, retainedCodeUnits: () => retained };
 }

package/src/adapters/xai-web-search.ts

@@ -1,4 +1,5 @@
 import type { OcxProviderConfig } from "../types";
+import { debugProviderDiagnostic } from "../lib/debug";
 import { isXaiResponsesDestination } from "../providers/xai-transport";
 
 const CODEX_WEB_SEARCH_TOOL = "web_search";
@@ -192,7 +193,21 @@ export function normalizeXaiResponsesWebSearch(
     if (inputChanged) next = { ...next, input };
   }
 
-  return normalizeToolChoice(next);
+  const normalized = normalizeToolChoice(next);
+  const choice = normalized.tool_choice;
+  if ((choice === "auto" || choice === "none") && !hasAnyDeclaredTool(normalized)) {
+    debugProviderDiagnostic("xai", "tool-choice-omitted", { choice });
+    const { tool_choice: _toolChoice, ...rest } = normalized;
+    // `auto` selects from the catalog, so a catalog with nothing in it makes it meaningless and
+    // the omission says nothing the request did not already say. `none` is the opposite: it is a
+    // prohibition, and on a request whose catalog this normalizer just emptied it is the only
+    // place the turn's client-call boundary is written down. Downstream repair reads that
+    // boundary off the final outbound body, so omitting the word alone would hand back a call the
+    // caller ruled out. Restate it as the explicit empty catalog, which carries the same deny-all
+    // and which this destination already receives whenever a caller sends one itself.
+    return choice === "none" && !Array.isArray(rest.tools) ? { ...rest, tools: [] } : rest;
+  }
+  return normalized;
 }
 
 function isLiveWebSearchTool(tool: unknown): boolean {

package/src/bridge/errors.ts

@@ -1,9 +1,10 @@
 import {
+  applyReplayRefusalClientHeaders,
   isNonReplayableUpstreamCode,
   isReplayRefusalCode,
-  markReplayRefusalResponse,
   markResponseNonReplayable,
   REPLAY_REFUSED_STATUS,
+  retainReplayRefusal,
 } from "../lib/upstream-retry";
 import {
   adapterFailureFromMessage,
@@ -45,6 +46,11 @@ export function formatErrorResponse(
     && retryAfter.length <= 128) {
     headers.set("Retry-After", retryAfter);
   }
+  // The refusal's client policy, restated here for the same reason its status is: this
+  // formatter is the last thing several adapter and combo paths touch before the client,
+  // and no wait of its own does not stop a client that retries every 429 by default.
+  const refusal = isReplayRefusalCode(error.code) && replayBlocked;
+  if (refusal) applyReplayRefusalClientHeaders(headers);
   const response = new Response(JSON.stringify({ error }), {
     status: finalStatus,
     headers,
@@ -53,6 +59,6 @@ export function formatErrorResponse(
   // Re-wrapping is where the refusal loses its provenance: combo failure consumption parses
   // the JSON and builds a new Response, and the code alone does not tell a later quota
   // recorder that no upstream produced this status. Carry the narrower marker across too.
-  if (replayBlocked && isReplayRefusalCode(error.code)) markReplayRefusalResponse(response);
+  if (refusal) retainReplayRefusal(response);
   return response;
 }

package/src/bridge/response-json.ts

@@ -7,6 +7,7 @@ import type {
   OcxUsage,
 } from "../types";
 import { coerceIntegerToolArguments } from "../lib/tool-argument-integers";
+import { attemptDeliveryRecorder } from "../usage/attempt-delivery";
 import {
   adapterFailureFromMessage,
   classifyError,
@@ -51,7 +52,14 @@ export function buildResponseJSON(
 ): Record<string, unknown> {
   // Default-budget safety net: a caller that omits the budget gets a bounded
   // default (disposed with the call), never the unbounded append path.
-  if (options?.translatorBudget) return buildResponseJSONWithBudget(events, modelId, options);
+  if (options?.translatorBudget) {
+    const body = buildResponseJSONWithBudget(events, modelId, options);
+    // A buffered turn delivers its whole answer as one body, so nothing calls the per-frame
+    // recorder on the SSE bridge. Without this the attempt would persist adapter events with
+    // zero relayed ones, which is the loss signal -- raised on every non-streaming request.
+    attemptDeliveryRecorder(options.translatorBudget)?.noteBufferedDelivery(body);
+    return body;
+  }
   const budget = createTranslatorBudget();
   try {
     return buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });

package/src/bridge/sse.ts

@@ -16,12 +16,12 @@ import {
   type OcxErrorPayload,
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
+import { attemptDeliveryRecorder, classifyRelayedResponseEvent } from "../usage/attempt-delivery";
 import {
-  freeformFallbackKeys,
   mayBecomePatchEnvelope,
   repairFreeformToolInput,
-  unwrapFreeformToolInput,
 } from "../responses/apply-patch-envelope";
+import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { encodeCompactionSummary } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
@@ -153,153 +153,6 @@ export function bridgeToResponsesSSE(
       ? compileCodeModeHelperInput(args, helper, codeModeHelperName ?? toolName)
       : repairFreeformToolInput(args, toolName, namespace);
   };
-  // Best-effort unwrap of a PARTIAL freeform arg buffer for live input streaming
-  // (`response.custom_tool_call_input.delta` — codex-rs uses it for UI preview only;
-  // the completed custom_tool_call item stays authoritative). Compact `{"input":"...`
-  // buffers get their string value progressively unescaped; anything else streams raw.
-  const JSON_WHITESPACE = new Set([" ", "\t", "\n", "\r"]);
-  type WrapperOpening =
-    | { state: "none" }
-    | { state: "prefix" }
-    | { state: "open"; valueStart: number };
-  /**
-   * Where the string value of `{"<key>":"` begins, tolerating the insignificant whitespace
-   * `JSON.parse` accepts.
-   *
-   * The earlier form of this compared the buffer against the compact literal `{"key":"`, so a
-   * wrapper written with spaces or newlines matched no prefix at all, streamed as raw JSON
-   * deltas and then completed as the unwrapped body. That is the same delta/completion
-   * disagreement #5047 closed for compact wrappers, reached through a different spelling:
-   * `unwrapFreeformToolInput` reads the completed text with `JSON.parse`, which does not care
-   * how the object is laid out, so neither can the streaming side.
-   */
-  const wrapperOpening = (args: string, key: string): WrapperOpening => {
-    let index = 0;
-    for (const token of ["{", `"${key}"`, ":", '"']) {
-      while (index < args.length && JSON_WHITESPACE.has(args[index]!)) index++;
-      if (index >= args.length) return { state: "prefix" };
-      for (const expected of token) {
-        if (index >= args.length) return { state: "prefix" };
-        if (args[index] !== expected) return { state: "none" };
-        index++;
-      }
-    }
-    return { state: "open", valueStart: index };
-  };
-  /**
-   * Whether a body could still grow into one complete outer Markdown fence.
-   *
-   * `stripMarkdownCodeFence` removes such a fence at completion for exactly the two tools that
-   * own the grammar, so a fenced body's streamed bytes and its completed input disagree unless
-   * the stream holds. A buffer that does not open with a fence can never acquire one, so
-   * ordinary bodies are unaffected; a buffer that does keeps its preview suppressed for the
-   * whole call, because a closing fence can still be followed by more text that withdraws it.
-   */
-  const mayBecomeFencedBody = (text: string, toolName: string): boolean => {
-    if (toolName !== "exec" && toolName !== "apply_patch") return false;
-    const head = text.trimStart();
-    if (head === "") return true;
-    return head.startsWith("```") || "```".startsWith(head);
-  };
-  /** The two-character escapes JSON defines, and nothing else. */
-  const JSON_ESCAPES = new Map<string, string>([
-    ['"', '"'], ["\\", "\\"], ["/", "/"],
-    ["b", "\b"], ["f", "\f"], ["n", "\n"], ["r", "\r"], ["t", "\t"],
-  ]);
-  const LOW_SURROGATE_ESCAPE = /^\\u[dD][c-fC-F][0-9a-fA-F]{2}$/;
-  /**
-   * The decoded prefix of a JSON string body, stopping at the first byte it cannot resolve.
-   *
-   * Every stop is a hold rather than a guess, because `JSON.parse` decides the completed value
-   * and anything invented here would be retracted. Three of them are not obvious:
-   *
-   * An escape JSON does not define makes the whole wrapper unparseable no matter what arrives
-   * next, so completion falls back to the raw text. Returning `null` for that case stops the
-   * preview rather than continuing to decode a value the completed item will never carry.
-   * `\\b` and `\\f` are defined, and were previously decoded to the letters b and f.
-   *
-   * A lone high surrogate is not a character. Emitting one alone puts an unpaired code unit in a
-   * delta the client has to decode by itself, so the pair is emitted together or not at all.
-   */
-  const decodeJsonStringPrefix = (body: string): string | null => {
-    let out = "";
-    for (let i = 0; i < body.length; i++) {
-      const c = body[i];
-      if (c === '"') break; // unescaped closing quote: value complete
-      if (c !== "\\") { out += c; continue; }
-      const n = body[i + 1];
-      if (n === undefined) break; // escape split across chunks: wait for more
-      if (n === "u") {
-        const hex = body.slice(i + 2, i + 6);
-        if (hex.length < 4) break; // split across chunks: wait for more
-        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return null; // never parses
-        const code = parseInt(hex, 16);
-        if (code >= 0xd800 && code <= 0xdbff) {
-          const low = body.slice(i + 6, i + 12);
-          if (!LOW_SURROGATE_ESCAPE.test(low)) break;
-          out += String.fromCharCode(code, parseInt(low.slice(2), 16));
-          i += 11;
-          continue;
-        }
-        out += String.fromCharCode(code);
-        i += 5;
-        continue;
-      }
-      const escaped = JSON_ESCAPES.get(n);
-      if (escaped === undefined) return null; // never parses
-      out += escaped;
-      i += 1;
-    }
-    return out;
-  };
-  /**
-   * The value to stream so far, or `null` to HOLD because nothing can be decided yet.
-   *
-   * `input` is decidable from its prefix: `unwrapFreeformToolInput` returns it whenever the
-   * key is present, whatever else the object carries, so its value can be unescaped
-   * progressively and never retracted.
-   *
-   * One case escapes that claim and is accepted rather than fixed: a duplicate `input` key.
-   * `JSON.parse` keeps the last one, so `{"input":"a","input":"b"}` streams a and completes with
-   * b. Closing it means holding every canonical wrapper until its object parses, which is the
-   * progressive streaming this path exists to provide. The completed item stays authoritative,
-   * and no model emits a duplicate key in practice.
-   *
-   * A wrapper that turns invalid AFTER streaming has committed has the same shape and the same
-   * answer. `{"input":"a` followed by `\\qb"}` has already published a when the undefined escape
-   * arrives, and completion returns the raw text because nothing parses. The preview stops
-   * there: no rewind, and no decoded text the completed item does not contain. Bounding the
-   * damage is what is available without giving up progressive streaming, and the args are
-   * unusable in that case whichever representation wins.
-   *
-   * A fallback key is not. It only unwraps when it is the SINGLE string field, and a second
-   * key can still arrive — so a value emitted early would have to be taken back. That is the
-   * rewind this holds instead: stream nothing until the object closes, then publish the one
-   * repaired body. The routed passthrough in `responses-custom-tool-repair.ts` already holds
-   * any object prefix for the same reason (#5047).
-   */
-  const freeformPartialInput = (args: string, toolName: string): string | null => {
-    const openings = ["input", ...freeformFallbackKeys(toolName)]
-      .map(key => ({ key, opening: wrapperOpening(args, key) }));
-    const canonical = openings[0]!.opening;
-    if (canonical.state === "open") {
-      const decoded = decodeJsonStringPrefix(args.slice(canonical.valueStart));
-      if (decoded === null) return null;
-      return mayBecomeFencedBody(decoded, toolName) ? null : decoded;
-    }
-    if (openings.some(entry => entry.opening.state === "open")) {
-      // Committed to a fallback wrapper. Undecidable until the object is complete.
-      try {
-        JSON.parse(args);
-      } catch {
-        return null;
-      }
-      return unwrapFreeformToolInput(args, toolName);
-    }
-    // Still an ambiguous prefix of some wrapper: which wrapper, if any, is not known yet.
-    if (openings.some(entry => entry.opening.state === "prefix")) return null;
-    return mayBecomeFencedBody(args, toolName) ? null : args;
-  };
   // tool_search_call carries arguments as a JSON object ({query, limit}); parse the model's arg string.
   const parseArgsObj = (args: string): Record<string, unknown> => {
     try { const o = JSON.parse(args); return o && typeof o === "object" ? o : {}; } catch { return {}; }
@@ -310,6 +163,10 @@ export function bridgeToResponsesSSE(
   // at terminal/cancel below.
   const ownsBudget = !options?.translatorBudget;
   const budget = options?.translatorBudget ?? createTranslatorBudget();
+  // Resolved from the CALLER's budget only. A bridge that owns its budget is not serving a
+  // logged request -- there is no attempt to count against, and a locally created scope would
+  // never have had a recorder bound to it.
+  const delivery = attemptDeliveryRecorder(options?.translatorBudget);
   // Idempotent: safe to call at every stream-death path; disposal must come
   // AFTER the final charges (emitDone), never inside reportTerminal.
   const disposeOwnedBudget = () => { if (ownsBudget) budget.dispose(); };
@@ -426,6 +283,11 @@ export function bridgeToResponsesSSE(
           controller.enqueue(frame);
           budget?.releaseRetained(frameBytes, { kind: "live_transient" });
           emittedFrames++;
+          // After a SUCCESSFUL enqueue, never before it. A frame that threw on the way to the
+          // transport did not reach the caller, and counting it here would make the relayed
+          // total equal the adapter total by construction -- erasing the one discrepancy these
+          // counters exist to expose (#3983).
+          delivery?.noteRelayedEvent(classifyRelayedResponseEvent(name, data));
         } catch (error) {
           if (isTranslatorBudgetExceededError(error)) {
             terminateForTranslatorOverflow?.(error);
@@ -1199,7 +1061,7 @@ export function bridgeToResponsesSSE(
                   });
                 }
                 if (currentToolCall.freeform && !currentToolCall.codeModeHelperName) {
-                  // `freeformPartialInput` holds while the buffer is still an ambiguous prefix
+                  // `progressiveFreeformInput` holds while the buffer is still an ambiguous prefix
                   // of a JSON wrapper; otherwise stream only the unwrapped input suffix, never
                   // rewinding on a mode flip.
                   //
@@ -1209,7 +1071,7 @@ export function bridgeToResponsesSSE(
                   // is the same disagreement in the other direction.
                   const ownsFreeformGrammar = currentToolCall.namespace === undefined
                     || currentToolCall.namespace === "functions";
-                  const full = freeformPartialInput(
+                  const full = progressiveFreeformInput(
                     currentToolCall.args,
                     ownsFreeformGrammar ? currentToolCall.name : "",
                   );