@bitkyc08/opencodex 2.60.0 → 2.61.0

package/src/adapters/openai-chat/passthrough.ts

@@ -1,6 +1,7 @@
 import { openAIChatTransport, stripBracketedModelSuffix } from "./wire";
 import type { AdapterRequest } from "../base";
 import { frameAgentRouterMessages } from "../agentrouter";
+import { applyExplicitChatDeveloperRole } from "./developer-role";
 import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
 import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
 import { fastPolicyForModel } from "../../providers/service-tier";
@@ -9,6 +10,8 @@ import { debugProviderDiagnostic } from "../../lib/debug";
 import { isDebugEnabled } from "../../lib/debug-settings";
 import { modelRecordValue } from "../../reasoning-effort";
 import { modelInList, type OcxProviderConfig } from "../../types";
+import { chatParallelToolCallsWireValue } from "./parallel-tool-calls";
+import { applyExplicitChatReasoningWirePolicy } from "./reasoning-wire";
 
 const CHAT_PASSTHROUGH_FIELDS = [
   "audio",
@@ -54,16 +57,37 @@ export function buildOpenAIChatPassthroughRequest(
 
   const body: Record<string, unknown> = {
     model: provider.modelSuffixBracketStrip ? stripBracketedModelSuffix(modelId) : modelId,
-    messages: frameAgentRouterMessages(provider.baseUrl, rawBody.messages),
+    // The caller's messages are forwarded as they arrived, with one exception: an operator who
+    // recorded that this destination rejects the `developer` role gets that role converted in
+    // place. Verbatim was not neutral there — it sent the role anyway and the turn failed
+    // upstream with a 400 before the model saw it. An unrecorded destination is still verbatim,
+    // and the conversion changes the role of those messages and nothing else, so the position
+    // of every message and every other field survive unchanged.
+    messages: applyExplicitChatDeveloperRole(
+      frameAgentRouterMessages(provider.baseUrl, rawBody.messages),
+      provider,
+    ),
     stream,
   };
   for (const field of CHAT_PASSTHROUGH_FIELDS) {
     if (rawBody[field] !== undefined) body[field] = rawBody[field];
   }
   const rawEfforts = modelRecordValue(provider.modelReasoningEfforts, modelId) ?? provider.reasoningEfforts;
-  if (modelInList(provider.noReasoningModels, modelId) || rawEfforts?.length === 0) {
+  const reasoningDisabled = modelInList(provider.noReasoningModels, modelId) || rawEfforts?.length === 0;
+  if (reasoningDisabled) {
     delete body.reasoning_effort;
   }
+  const hasTools = Array.isArray(rawBody.tools) && rawBody.tools.length > 0;
+  const requestedEffort = typeof body.reasoning_effort === "string" ? body.reasoning_effort : undefined;
+  applyExplicitChatReasoningWirePolicy({
+    provider,
+    modelId,
+    hasTools,
+    requestedEffort,
+    wireEffort: requestedEffort,
+    reasoningDisabled,
+    body,
+  });
 
   const openRouterRouting = resolveOpenRouterRouting(provider, modelId);
   if (openRouterRouting) body.provider = openRouterProviderPayload(openRouterRouting);
@@ -107,13 +131,13 @@ export function buildOpenAIChatPassthroughRequest(
   if (provider.promptCacheKey && rawBody.prompt_cache_key !== undefined) {
     body.prompt_cache_key = rawBody.prompt_cache_key;
   }
-  if (Array.isArray(rawBody.tools) && rawBody.tools.length > 0) {
-    if (provider.parallelToolCalls === true) {
-      body.parallel_tool_calls = rawBody.parallel_tool_calls !== false;
-    } else if (provider.parallelToolCalls === false
-        && (provider.baseUrl === "https://integrate.api.nvidia.com/v1" || provider.pinParallelToolCallsFalse === true)) {
-      body.parallel_tool_calls = false;
-    }
+  if (hasTools) {
+    // Same three provider states as the translated path, and the same defect in the unset one:
+    // a caller's explicit false was dropped here too (#5211). The native route reads the bit off
+    // the raw request rather than the parsed options, since nothing projects this body.
+    const requested = typeof rawBody.parallel_tool_calls === "boolean" ? rawBody.parallel_tool_calls : undefined;
+    const parallelToolCalls = chatParallelToolCallsWireValue(provider, requested);
+    if (parallelToolCalls !== undefined) body.parallel_tool_calls = parallelToolCalls;
   }
   if (stream) {
     const callerOptions = rawBody.stream_options !== null

package/src/adapters/openai-chat/reasoning-wire.ts

@@ -0,0 +1,89 @@
+import { modelInList, type OcxProviderConfig } from "../../types";
+import type { AdapterRequest } from "../base";
+import { isNativeOpenAIChatTarget } from "./wire";
+
+export type ExplicitChatReasoningWireResult =
+  | { handled: false }
+  | { handled: true; reasoningLog?: AdapterRequest["reasoningLog"] };
+
+/**
+ * Apply provider-declared reasoning wire policy after the effective provider is resolved.
+ * Unset declarations are a no-op so native Chat keeps forwarding the caller's raw field.
+ */
+export function applyExplicitChatReasoningWirePolicy(options: {
+  provider: OcxProviderConfig;
+  modelId: string;
+  hasTools: boolean;
+  requestedEffort: string | undefined;
+  wireEffort: string | undefined;
+  reasoningDisabled: boolean;
+  body: Record<string, unknown>;
+}): ExplicitChatReasoningWireResult {
+  const {
+    provider,
+    modelId,
+    hasTools,
+    requestedEffort,
+    wireEffort,
+    reasoningDisabled,
+    body,
+  } = options;
+
+  if (reasoningDisabled) return { handled: false };
+  if (hasTools && modelInList(provider.omitReasoningEffortWithToolsModels, modelId)) {
+    delete body.reasoning_effort;
+    delete body.reasoning;
+    return { handled: true };
+  }
+  if (provider.reasoningWireFormat !== "gateway-object") return { handled: false };
+
+  const nativeOpenAI = isNativeOpenAIChatTarget(provider);
+  if (requestedEffort === "none") {
+    if (nativeOpenAI) {
+      delete body.reasoning;
+      body.reasoning_effort = "none";
+      return {
+        handled: true,
+        reasoningLog: {
+          effectiveEffort: "none",
+          wireField: "reasoning_effort",
+          wireValue: "none",
+        },
+      };
+    }
+    delete body.reasoning_effort;
+    body.reasoning = { enabled: false };
+    return {
+      handled: true,
+      reasoningLog: {
+        effectiveEffort: "none",
+        wireField: "reasoning.enabled",
+        wireValue: false,
+      },
+    };
+  }
+  if (wireEffort === undefined) return { handled: false };
+
+  if (nativeOpenAI) {
+    delete body.reasoning;
+    body.reasoning_effort = wireEffort;
+    return {
+      handled: true,
+      reasoningLog: {
+        effectiveEffort: wireEffort,
+        wireField: "reasoning_effort",
+        wireValue: wireEffort,
+      },
+    };
+  }
+  delete body.reasoning_effort;
+  body.reasoning = { enabled: true, effort: wireEffort };
+  return {
+    handled: true,
+    reasoningLog: {
+      effectiveEffort: wireEffort,
+      wireField: "reasoning.effort",
+      wireValue: wireEffort,
+    },
+  };
+}

package/src/adapters/openai-chat.ts

@@ -1,4 +1,6 @@
 import { hasShrinkableOpenAIChatImages, normalizeOpenAIChatImages } from "./openai-chat-images";
+import { chatParallelToolCallsWireValue } from "./openai-chat/parallel-tool-calls";
+import { applyExplicitChatReasoningWirePolicy } from "./openai-chat/reasoning-wire";
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "./base";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
 import { modelInList } from "../types";
@@ -40,7 +42,7 @@ import {
 } from "./openai-chat/errors";
 import { messagesToChatFormat } from "./openai-chat/messages";
 import { withOpenAIChatToolNames } from "./openai-chat/tool-name-registry";
-import { isNativeOpenAIChatTarget, openAIChatTransport, stripBracketedModelSuffix } from "./openai-chat/wire";
+import { openAIChatTransport, stripBracketedModelSuffix } from "./openai-chat/wire";
 import { toolChoiceToChatFormat, toolsToChatFormatForProvider } from "./openai-chat/tool-schema";
 
 export { stripBracketedModelSuffix } from "./openai-chat/wire";
@@ -142,51 +144,21 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
         if (parsed.options.stopSequences !== undefined) body.stop = parsed.options.stopSequences;
         const reasoningDisabled = modelInList(provider.noReasoningModels, parsed.modelId);
-        // Some gateways accept a reasoning-effort field on a plain turn but reject the
-        // effort + tools combination. `noReasoningModels` would fix that only by
-        // stripping reasoning everywhere, costing the model its whole picker. This keeps
-        // the ladder advertised and drops the wire field for tool-bearing requests only.
-        const omitReasoningEffortWithTools = !!tools
-          && modelInList(provider.omitReasoningEffortWithToolsModels, parsed.modelId);
-        const reasoningEffort = omitReasoningEffortWithTools
-          ? undefined
-          : mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning);
-        const nativeOpenAI = isNativeOpenAIChatTarget(provider);
+        const reasoningEffort = mapReasoningEffort(provider, parsed.modelId, parsed.options.reasoning);
+        const explicitReasoning = applyExplicitChatReasoningWirePolicy({
+          provider,
+          modelId: parsed.modelId,
+          hasTools: !!tools,
+          requestedEffort: parsed.options.reasoning,
+          wireEffort: reasoningEffort,
+          reasoningDisabled,
+          body,
+        });
         let reasoningLog: AdapterRequest["reasoningLog"];
-        if (!reasoningDisabled && !omitReasoningEffortWithTools && provider.reasoningWireFormat === "gateway-object" && parsed.options.reasoning === "none") {
-          if (nativeOpenAI) {
-            body.reasoning_effort = "none";
-            reasoningLog = {
-              effectiveEffort: "none",
-              wireField: "reasoning_effort",
-              wireValue: "none",
-            };
-          } else {
-            body.reasoning = { enabled: false };
-            reasoningLog = {
-              effectiveEffort: "none",
-              wireField: "reasoning.enabled",
-              wireValue: false,
-            };
-          }
+        if (explicitReasoning.handled) {
+          reasoningLog = explicitReasoning.reasoningLog;
         } else if (reasoningEffort !== undefined) {
-          if (provider.reasoningWireFormat === "gateway-object") {
-            if (nativeOpenAI) {
-              body.reasoning_effort = reasoningEffort;
-              reasoningLog = {
-                effectiveEffort: reasoningEffort,
-                wireField: "reasoning_effort",
-                wireValue: reasoningEffort,
-              };
-            } else {
-              body.reasoning = { enabled: true, effort: reasoningEffort };
-              reasoningLog = {
-                effectiveEffort: reasoningEffort,
-                wireField: "reasoning.effort",
-                wireValue: reasoningEffort,
-              };
-            }
-          } else if (modelInList(provider.thinkingBudgetModels, parsed.modelId)) {
+          if (modelInList(provider.thinkingBudgetModels, parsed.modelId)) {
             const budget = thinkingBudgetForEffort(parsed, reasoningEffort, maxTokens);
             if (budget !== undefined) {
               body.thinking_budget = budget;
@@ -249,19 +221,8 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
 
         if (tools) {
-          if (provider.parallelToolCalls === false) {
-            // NIM documents the Boolean defaulting to false and kimi rejects true; pin the
-            // wire bit so Codex cannot opt in via request.options. Other opted-out providers
-            // omit the field by default so strict OpenAI-compatible hosts never see an
-            // unsupported knob, but a self-hosted gateway that DOES honor the field and keeps
-            // emitting parallel calls without it can opt in via pinParallelToolCallsFalse.
-            if (provider.baseUrl === "https://integrate.api.nvidia.com/v1"
-                || provider.pinParallelToolCallsFalse === true) {
-              body.parallel_tool_calls = false;
-            }
-          } else if (provider.parallelToolCalls === true) {
-            body.parallel_tool_calls = parsed.options.parallelToolCalls !== false;
-          }
+          const parallelToolCalls = chatParallelToolCallsWireValue(provider, parsed.options.parallelToolCalls);
+          if (parallelToolCalls !== undefined) body.parallel_tool_calls = parallelToolCalls;
         }
         if (parsed.stream) body.stream_options = { include_usage: true };
 

package/src/adapters/openai-responses/passthrough.ts

@@ -42,6 +42,7 @@ import { bridgeSearchReplayScope } from "../../responses/bridge-search-replay-ca
 import { applyTierDecisionToResponsesBody, normalizeCanonicalForwardContinuationEnvelope, normalizeCanonicalForwardPromptEnvelope, stripCanonicalForwardSamplingParams, stripPreviousResponseId, stripStatefulResponsesParams, stripUnsupportedForwardParams } from "./canonical-forward";
 import { normalizeImageGenClientTools, preferConfiguredHostedTools } from "./image-gen";
 import { stripMuseSparkUnsupportedWebSearchFields, stripOpenAiOnlyWebSearchFields } from "./web-search";
+import { observeOutbound } from "../../usage/cache-diagnostic";
 
 /**
  * Identifies DeepSeek's strict Responses replay contract: tool-bearing continuations need
@@ -501,6 +502,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // here, on the serialized body, not on the parsed selector. One place covers both the
       // HTTP and the WebSocket outbound, because the WS path transports this same request
       // instead of rebuilding it.
+      observeOutbound(parsed._rawBody, finalBody, headers);
       const body = JSON.stringify(finalBody);
       const releaseBodyObservation = translatorBudget.observeExternallyCapped(
         "passthrough_serialization",

package/src/adapters/registry.ts

@@ -181,8 +181,9 @@ export function createRegisteredAdapter(
   const definition = getAdapterDefinition(provider.adapter);
   if (!definition) throw new Error(`Unknown adapter: ${provider.adapter}`);
   const adapter = definition.create(provider, context);
-  if (effectiveAdapterContract(provider.adapter).wire !== "openai-responses") {
-    withInputMediaGuard(adapter);
+  const wire = effectiveAdapterContract(provider.adapter).wire;
+  if (wire !== "openai-responses") {
+    withInputMediaGuard(adapter, wire);
   }
   const buildRequest = adapter.buildRequest.bind(adapter);
   adapter.buildRequest = (parsed, incoming) => {

package/src/adapters/run-turn-queue.ts

@@ -6,11 +6,107 @@ export const PREFLIGHT_HEARTBEAT_RETAIN_LIMIT = 16;
 
 /**
  * Coalescing threshold for adjacent text/thinking deltas buffered with no
- * waiting reader (UTF-16 code units). This is a merge-size ceiling, not a
- * byte-memory cap: a single oversized incoming event stays one item.
+ * waiting reader (UTF-16 code units). This is a merge-size ceiling; the two
+ * retention budgets below are what bound memory.
  */
 export const COALESCE_MAX_CHUNK_LENGTH = 64 * 1024;
 
+/**
+ * Retained-string budget for the WHOLE queue, in UTF-16 code units.
+ *
+ * This bounds what the queue is holding at one moment, not how much a turn
+ * streams: every dequeue gives its charge back, so a long healthy stream with a
+ * consumer attached never accumulates and is never capped by total length.
+ *
+ * 32 MiB is deliberately far above any single legitimate burst. A synchronous
+ * producer can legally fill the queue before its consumer is scheduled — the
+ * image loop does exactly that with over a million one-character deltas, which
+ * coalesce into roughly 1.2 MB of retained text — so a budget near that size
+ * aborts healthy turns rather than stalled ones. The previous effective bound
+ * was the 1024-event cap times the 64 KiB merge ceiling, so 64 MiB; this halves
+ * it while leaving that legitimate burst an order of magnitude of headroom.
+ */
+export const DEFAULT_MAX_BACKLOG_CODE_UNITS = 32 * 1024 * 1024;
+
+/**
+ * Retained-string budget for ONE queued event, in UTF-16 code units.
+ *
+ * Separate from the aggregate on purpose, because the two describe different
+ * failures. Passing the aggregate means the consumer is not keeping up. Passing
+ * this one means a single event is malformed or unbounded, which stays true
+ * however empty the queue is, so it must be refused even with the whole
+ * aggregate free. They also report different terminal messages, so an operator
+ * reading the turn's error learns which happened.
+ *
+ * Like the aggregate, this governs what the queue RETAINS. An event handed
+ * straight to a waiting consumer is never held here, so neither budget applies
+ * to it: refusing it would abort a turn over memory this queue does not own,
+ * and the consumer's own per-event bound governs that payload instead.
+ */
+export const DEFAULT_MAX_EVENT_CODE_UNITS = 8 * 1024 * 1024;
+
+const BACKLOG_EXCEEDED_MESSAGE = "consumer stalled: adapter event backlog exceeded — turn aborted";
+const EVENT_TOO_LARGE_MESSAGE = "adapter event exceeds the single-event retained-string budget — turn aborted";
+
+/**
+ * Bound on how far the retention measure walks into one event. AdapterEvent is
+ * a plain-data union, but two of its members carry open provider-shaped bags
+ * (`providerState`, `usage.rawUsage`) whose depth no type here controls. The
+ * ceilings keep a single push O(1)-ish rather than O(whatever an adapter
+ * attached), and under-counting a pathological object is the safe direction:
+ * the event-count cap still bounds how many of them can be retained.
+ */
+const RETENTION_MAX_DEPTH = 8;
+const RETENTION_MAX_NODES = 4096;
+
+/**
+ * Retained UTF-16 code units carried by one event's string payload.
+ *
+ * Measured by walking own enumerable properties rather than by naming each
+ * variant's string fields: a hand-written per-variant table is exhaustive over
+ * a union, so adding an event type on one branch while a consumer lands on
+ * another produces a measure that silently stops counting the new payload.
+ * The walk is the derived answer and needs no update when the union grows.
+ *
+ * `type` is skipped because it is the discriminant, identical for every event
+ * of a kind and not payload anyone is buffering.
+ */
+export function retainedEventCodeUnits(event: AdapterEvent): number {
+  // Defensive: this measures values an adapter produced. A malformed emission
+  // has to become a terminal event, not a TypeError thrown out of push() with
+  // the queue half-updated.
+  if (!event || typeof event !== "object") return 0;
+  let total = 0;
+  let nodes = 0;
+  const seen = new Set<object>();
+  const visit = (value: unknown, depth: number): void => {
+    if (typeof value === "string") {
+      total += value.length;
+      return;
+    }
+    if (!value || typeof value !== "object" || depth >= RETENTION_MAX_DEPTH || seen.has(value)) return;
+    seen.add(value);
+    for (const nested of Object.values(value)) {
+      if (nodes++ >= RETENTION_MAX_NODES) return;
+      visit(nested, depth + 1);
+    }
+  };
+  for (const [key, value] of Object.entries(event)) {
+    if (key === "type") continue;
+    if (nodes++ >= RETENTION_MAX_NODES) break;
+    visit(value, 1);
+  }
+  return total;
+}
+
+function positiveBudget(value: number | undefined, fallback: number, name: string): number {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
+    throw new RangeError(`${name} must be a positive safe integer`);
+  }
+  return resolved;
+}
+
 export interface AdapterEventQueue {
   /**
    * Returns true when the event was merged into the buffered tail instead of
@@ -22,6 +118,13 @@ export interface AdapterEventQueue {
   close(): void;
   stream(): AsyncIterable<AdapterEvent>;
   collect(): Promise<AdapterEvent[]>;
+  /**
+   * Retained string payload the queue is currently holding, in UTF-16 code
+   * units. Exposed so a caller — and a regression — can assert the counter
+   * returns to zero on every terminal path instead of inferring it from an
+   * abort that happened to fire.
+   */
+  retainedCodeUnits(): number;
 }
 
 export interface AdapterEventPreflight {
@@ -73,47 +176,74 @@ export async function preflightAdapterEvents(
 
 export function createAdapterEventQueue(opts?: {
   maxBacklog?: number;
+  maxBacklogCodeUnits?: number;
+  maxEventCodeUnits?: number;
   onBacklogExceeded?: () => void;
 }): AdapterEventQueue {
   const queued: AdapterEvent[] = [];
+  /**
+   * What each queued item was charged, in lockstep with `queued`. Releasing the
+   * recorded charge rather than re-measuring is what makes the accounting exact
+   * on every path: a merge, a terminal record admitted past the budget and a
+   * plain event all give back precisely what they took, so the counter cannot
+   * drift positive (a leak) or negative (a budget the next turn gets for free).
+   */
+  const charged: number[] = [];
   const readers: QueueReader[] = [];
   const maxBacklog = opts?.maxBacklog ?? 1_024;
+  const maxBacklogCodeUnits = positiveBudget(opts?.maxBacklogCodeUnits, DEFAULT_MAX_BACKLOG_CODE_UNITS, "maxBacklogCodeUnits");
+  const maxEventCodeUnits = positiveBudget(opts?.maxEventCodeUnits, DEFAULT_MAX_EVENT_CODE_UNITS, "maxEventCodeUnits");
+  let retained = 0;
   let closed = false;
 
   // Merge an incoming delta into the buffered tail when no reader is waiting.
-  // The backlog cap counts events, not tokens, so a detached or briefly
-  // stalled consumer (e.g. a Codex app mid-reconnect whose disconnect Bun has
-  // not yet delivered) used to hit the cap within seconds of token-granular
-  // streaming and abort a healthy turn. Adjacent same-phase text deltas,
-  // adjacent thinking deltas, and consecutive heartbeats carry no ordering
-  // information between themselves, so merging them preserves every consumer
-  // contract while making the cap approximate buffered items again.
+  // The event cap counts events, not tokens, so a detached or briefly stalled
+  // consumer (e.g. a Codex app mid-reconnect whose disconnect Bun has not yet
+  // delivered) used to hit it within seconds of token-granular streaming and
+  // abort a healthy turn. Adjacent same-phase text deltas, adjacent thinking
+  // deltas, and consecutive heartbeats carry no ordering information between
+  // themselves, so merging them preserves every consumer contract while making
+  // the cap approximate buffered items again.
   // Pushed objects may be retained by adapters, so the tail is REPLACED with
-  // a fresh object — never mutated (alias safety).
-  const coalesceIntoTail = (event: AdapterEvent): boolean => {
-    const tail = queued[queued.length - 1];
-    if (!tail) return false;
+  // a fresh object — never mutated (alias safety). Returning the replacement
+  // instead of installing it lets push price the merge before committing to it.
+  const planTailMerge = (tail: AdapterEvent, event: AdapterEvent): AdapterEvent | null => {
     if (event.type === "heartbeat") {
-      if (tail.type !== "heartbeat") return false;
+      if (tail.type !== "heartbeat") return null;
       // Heartbeats carry no ordering between themselves, but the replay-unsafe
       // marker is not ordering — it is a latch. Dropping the incoming event
       // would discard the only record that Cursor already performed a local
       // side effect, and preflight would then permit an OAuth replay of it.
       if (event.replayUnsafe === true && tail.replayUnsafe !== true) {
-        queued[queued.length - 1] = { type: "heartbeat", replayUnsafe: true };
+        return { type: "heartbeat", replayUnsafe: true };
       }
-      return true;
+      return tail;
     }
     if (event.type === "text_delta" && tail.type === "text_delta" && tail.phase === event.phase) {
-      if (tail.text.length + event.text.length > COALESCE_MAX_CHUNK_LENGTH) return false;
-      queued[queued.length - 1] = { type: "text_delta", text: tail.text + event.text, phase: tail.phase };
-      return true;
+      if (tail.text.length + event.text.length > COALESCE_MAX_CHUNK_LENGTH) return null;
+      return { type: "text_delta", text: tail.text + event.text, phase: tail.phase };
     }
     if (event.type === "thinking_delta" && tail.type === "thinking_delta") {
-      if (tail.thinking.length + event.thinking.length > COALESCE_MAX_CHUNK_LENGTH) return false;
-      queued[queued.length - 1] = { type: "thinking_delta", thinking: tail.thinking + event.thinking };
-      return true;
+      if (tail.thinking.length + event.thinking.length > COALESCE_MAX_CHUNK_LENGTH) return null;
+      return { type: "thinking_delta", thinking: tail.thinking + event.thinking };
     }
+    return null;
+  };
+
+  /**
+   * Record why the turn is ending and close. The terminal error is admitted
+   * past both budgets — refusing to retain the explanation of a refusal would
+   * leave the consumer with a silent truncation — but it is charged like any
+   * other item so the counter stays exact through the final drain.
+   */
+  const abortWith = (message: string): false => {
+    opts?.onBacklogExceeded?.();
+    const terminal: AdapterEvent = { type: "error", message };
+    const cost = retainedEventCodeUnits(terminal);
+    queued.push(terminal);
+    charged.push(cost);
+    retained += cost;
+    close();
     return false;
   };
 
@@ -121,17 +251,35 @@ export function createAdapterEventQueue(opts?: {
     if (closed) return false;
     const reader = readers.shift();
     if (reader) {
+      // Handed straight to a waiting consumer, so the queue retains nothing and
+      // charges nothing. Neither budget applies to an event it never holds.
       reader({ done: false, value: event });
       return false;
     }
-    if (coalesceIntoTail(event)) return true;
-    if (queued.length >= maxBacklog) {
-      opts?.onBacklogExceeded?.();
-      queued.push({ type: "error", message: "consumer stalled: adapter event backlog exceeded — turn aborted" });
-      close();
-      return false;
+    const tail = queued[queued.length - 1];
+    const merged = tail ? planTailMerge(tail, event) : null;
+    if (merged && tail) {
+      const replacement = retainedEventCodeUnits(merged);
+      if (replacement > maxEventCodeUnits) return abortWith(EVENT_TOO_LARGE_MESSAGE);
+      // Charge only what the backlog actually gains. A merge keeps the tail's
+      // own fields, so the incoming event's duplicated phase is never retained
+      // twice and an unchanged tail costs nothing at all.
+      const delta = replacement - charged[charged.length - 1]!;
+      if (delta > maxBacklogCodeUnits - retained) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
+      queued[queued.length - 1] = merged;
+      charged[charged.length - 1] = replacement;
+      retained += delta;
+      return true;
     }
+    const cost = retainedEventCodeUnits(event);
+    if (cost > maxEventCodeUnits) return abortWith(EVENT_TOO_LARGE_MESSAGE);
+    // Both refusals are priced before anything is retained, so an event that is
+    // turned away is never charged for.
+    if (queued.length >= maxBacklog) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
+    if (cost > maxBacklogCodeUnits - retained) return abortWith(BACKLOG_EXCEEDED_MESSAGE);
     queued.push(event);
+    charged.push(cost);
+    retained += cost;
     return false;
   };
 
@@ -147,6 +295,7 @@ export function createAdapterEventQueue(opts?: {
     while (true) {
       const next = queued.shift();
       if (next) {
+        retained -= charged.shift() ?? 0;
         yield next;
         continue;
       }
@@ -165,5 +314,5 @@ export function createAdapterEventQueue(opts?: {
     return events;
   };
 
-  return { push, close, stream, collect };
+  return { push, close, stream, collect, retainedCodeUnits: () => retained };
 }

package/src/adapters/xai-web-search.ts

@@ -1,4 +1,5 @@
 import type { OcxProviderConfig } from "../types";
+import { debugProviderDiagnostic } from "../lib/debug";
 import { isXaiResponsesDestination } from "../providers/xai-transport";
 
 const CODEX_WEB_SEARCH_TOOL = "web_search";
@@ -192,7 +193,21 @@ export function normalizeXaiResponsesWebSearch(
     if (inputChanged) next = { ...next, input };
   }
 
-  return normalizeToolChoice(next);
+  const normalized = normalizeToolChoice(next);
+  const choice = normalized.tool_choice;
+  if ((choice === "auto" || choice === "none") && !hasAnyDeclaredTool(normalized)) {
+    debugProviderDiagnostic("xai", "tool-choice-omitted", { choice });
+    const { tool_choice: _toolChoice, ...rest } = normalized;
+    // `auto` selects from the catalog, so a catalog with nothing in it makes it meaningless and
+    // the omission says nothing the request did not already say. `none` is the opposite: it is a
+    // prohibition, and on a request whose catalog this normalizer just emptied it is the only
+    // place the turn's client-call boundary is written down. Downstream repair reads that
+    // boundary off the final outbound body, so omitting the word alone would hand back a call the
+    // caller ruled out. Restate it as the explicit empty catalog, which carries the same deny-all
+    // and which this destination already receives whenever a caller sends one itself.
+    return choice === "none" && !Array.isArray(rest.tools) ? { ...rest, tools: [] } : rest;
+  }
+  return normalized;
 }
 
 function isLiveWebSearchTool(tool: unknown): boolean {

package/src/bridge/errors.ts

@@ -1,9 +1,10 @@
 import {
+  applyReplayRefusalClientHeaders,
   isNonReplayableUpstreamCode,
   isReplayRefusalCode,
-  markReplayRefusalResponse,
   markResponseNonReplayable,
   REPLAY_REFUSED_STATUS,
+  retainReplayRefusal,
 } from "../lib/upstream-retry";
 import {
   adapterFailureFromMessage,
@@ -45,6 +46,11 @@ export function formatErrorResponse(
     && retryAfter.length <= 128) {
     headers.set("Retry-After", retryAfter);
   }
+  // The refusal's client policy, restated here for the same reason its status is: this
+  // formatter is the last thing several adapter and combo paths touch before the client,
+  // and no wait of its own does not stop a client that retries every 429 by default.
+  const refusal = isReplayRefusalCode(error.code) && replayBlocked;
+  if (refusal) applyReplayRefusalClientHeaders(headers);
   const response = new Response(JSON.stringify({ error }), {
     status: finalStatus,
     headers,
@@ -53,6 +59,6 @@ export function formatErrorResponse(
   // Re-wrapping is where the refusal loses its provenance: combo failure consumption parses
   // the JSON and builds a new Response, and the code alone does not tell a later quota
   // recorder that no upstream produced this status. Carry the narrower marker across too.
-  if (replayBlocked && isReplayRefusalCode(error.code)) markReplayRefusalResponse(response);
+  if (refusal) retainReplayRefusal(response);
   return response;
 }

package/src/bridge/response-json.ts

@@ -7,6 +7,7 @@ import type {
   OcxUsage,
 } from "../types";
 import { coerceIntegerToolArguments } from "../lib/tool-argument-integers";
+import { attemptDeliveryRecorder } from "../usage/attempt-delivery";
 import {
   adapterFailureFromMessage,
   classifyError,
@@ -51,7 +52,14 @@ export function buildResponseJSON(
 ): Record<string, unknown> {
   // Default-budget safety net: a caller that omits the budget gets a bounded
   // default (disposed with the call), never the unbounded append path.
-  if (options?.translatorBudget) return buildResponseJSONWithBudget(events, modelId, options);
+  if (options?.translatorBudget) {
+    const body = buildResponseJSONWithBudget(events, modelId, options);
+    // A buffered turn delivers its whole answer as one body, so nothing calls the per-frame
+    // recorder on the SSE bridge. Without this the attempt would persist adapter events with
+    // zero relayed ones, which is the loss signal -- raised on every non-streaming request.
+    attemptDeliveryRecorder(options.translatorBudget)?.noteBufferedDelivery(body);
+    return body;
+  }
   const budget = createTranslatorBudget();
   try {
     return buildResponseJSONWithBudget(events, modelId, { ...options, translatorBudget: budget });