@bitkyc08/opencodex 2.63.0 → 2.64.0

package/src/server/proxy-liveness.ts

@@ -12,6 +12,12 @@
 import { loadConfig } from "../config";
 import { isWildcardHostname } from "../codex/loopback-target";
 import { readAlivePid, readRuntimePort, verifyPidIdentity } from "../config/process-state";
+import {
+  LOCAL_ATTESTATION_CHALLENGE_HEADER,
+  LOCAL_ATTESTATION_PROOF_HEADER,
+  createLocalAttestationChallenge,
+  verifyLocalAttestationProof,
+} from "../lib/local-management-attestation";
 import { directLocalHttpFetch } from "./direct-local-http";
 
 export interface HealthzIdentity {
@@ -29,7 +35,11 @@ export interface HealthzIdentity {
   role?: unknown;
   restartCapability?: unknown;
   providerReloadCapability?: unknown;
+  asideSyncCapability?: unknown;
   guiPairCapability?: unknown;
+  /** Present on a package-tree-fenced 503: the version on disk an in-place respawn will run. */
+  installedVersion?: unknown;
+  error?: unknown;
 }
 
 export type EndpointLiveness = "live" | "dead" | "unknown";
@@ -60,6 +70,18 @@ export interface LivenessIo {
    */
   deadlineAt?: number;
   nowFn?: () => number;
+  /**
+   * Also accept a proxy whose `/healthz` is fenced by the package-tree guard (#5496).
+   *
+   * Opt-in, because such a proxy is ours but not healthy: `ocx restart` and the stop paths
+   * must find it, while ensure, update health waits and replacement waits must not count it.
+   * A fenced body is never trusted by itself. It is accepted only when this home's runtime
+   * record names the same pid and port and the listener proves possession of that record's
+   * attestation secret for a fresh challenge.
+   */
+  acceptPackageTreeFenced?: boolean;
+  /** Test seam for the fenced-identity challenge. */
+  createChallengeFn?: () => string;
 }
 
 /** Default per-probe fetch ceiling shared by liveness and readiness probes. */
@@ -117,6 +139,12 @@ export interface LiveProxy {
    * on. Absent for a proxy whose healthz body predates the field.
    */
   role?: string;
+  /**
+   * The proxy answered with an attested package-tree fence (#5496): it is this home's process,
+   * but it is refusing traffic until it restarts. Only set for callers that opted in through
+   * `LivenessIo.acceptPackageTreeFenced`.
+   */
+  packageTreeFenced?: true;
 }
 
 /**
@@ -155,6 +183,64 @@ export function isOpencodexHealthz(body: HealthzIdentity | null): boolean {
   return body.status === "ok" && typeof body.version === "string" && typeof body.uptime === "number";
 }
 
+/**
+ * True for the exact 503 body the package-tree guard serves on `/healthz`. Shape only: this is
+ * what the listener CLAIMS, and whoever holds the port can claim it. Callers must attest it.
+ */
+export function isPackageTreeFencedHealthz(body: HealthzIdentity | null | undefined): boolean {
+  if (!body || body.service !== "opencodex" || body.status !== "restart_required") return false;
+  const error = body.error as { code?: unknown } | null | undefined;
+  return typeof error === "object" && error !== null && error.code === "package_tree_changed"
+    && typeof body.pid === "number" && Number.isSafeInteger(body.pid) && body.pid > 0;
+}
+
+/**
+ * Prove that a fenced listener is the process this home's runtime record describes: the record
+ * must name the same pid and port and carry an attestation secret, and the listener must answer a
+ * fresh challenge with a proof bound to that secret, pid and port. The pid in the 503 body only
+ * selects which record to check; it is never accepted on its own.
+ */
+async function attestFencedIdentity(
+  url: string,
+  port: number,
+  pid: number,
+  io: LivenessIo,
+  fetchFn: LivenessFetch,
+  timeoutMs: number,
+): Promise<boolean> {
+  const readRuntimeFn = io.readRuntimeFn ?? readRuntimePort;
+  let record: ReturnType<NonNullable<LivenessIo["readRuntimeFn"]>>;
+  try {
+    record = readRuntimeFn(pid);
+  } catch {
+    return false;
+  }
+  // The typed seam omits the secret; the production record (readRuntimePort) carries it.
+  const secret: unknown = record ? Reflect.get(record, "attestationSecret") : undefined;
+  if (!record || record.pid !== pid || record.port !== port || typeof secret !== "string") return false;
+  const challenge = (io.createChallengeFn ?? createLocalAttestationChallenge)();
+  try {
+    const res = await fetchFn(url, {
+      headers: { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: challenge },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const body = (await res.json().catch(() => null)) as HealthzIdentity | null;
+    // The second answer must still be the same fenced (or by now healthy) process.
+    if (!isOpencodexHealthz(body) && !isPackageTreeFencedHealthz(body)) return false;
+    if (body?.pid !== pid) return false;
+    return verifyLocalAttestationProof(secret, challenge, pid, port, res.headers.get(LOCAL_ATTESTATION_PROOF_HEADER));
+  } catch {
+    return false;
+  }
+}
+
+/** A bounded version string safe to carry beyond the untrusted health response. */
+export function isHealthzVersion(value: unknown): value is string {
+  return typeof value === "string"
+    && value.length <= 64
+    && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value);
+}
+
 /**
  * "Nothing is listening" is narrower than "the probe failed". Only a connect-phase refusal
  * proves the endpoint is free; a timeout, reset, or other transport failure leaves the
@@ -228,7 +314,7 @@ export async function proxyIdentityAt(
   port: number,
   opts: { hostname?: string; expectedPid?: number } = {},
   io: LivenessIo = {},
-): Promise<{ pid: number | null; version?: string; role?: string } | null> {
+): Promise<{ pid: number | null; version?: string; role?: string; packageTreeFenced?: true } | null> {
   const fetchFn = io.fetchFn ?? directLocalHttpFetch;
   const sleepFn = io.sleepFn ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
   const nowFn = io.nowFn ?? Date.now;
@@ -243,16 +329,33 @@ export async function proxyIdentityAt(
     if (remainingMs <= 0) return null;
     const timeoutMs = Math.min(baseTimeoutMs, remainingMs);
     try {
-      const res = await fetchFn(`http://${probeHostname(opts.hostname)}:${port}/healthz`, {
+      const url = `http://${probeHostname(opts.hostname)}:${port}/healthz`;
+      const res = await fetchFn(url, {
         signal: AbortSignal.timeout(timeoutMs),
       });
+      if (!res.ok && io.acceptPackageTreeFenced && res.status === 503) {
+        const fenced = (await res.json().catch(() => null)) as HealthzIdentity | null;
+        if (!isPackageTreeFencedHealthz(fenced)) return null;
+        const fencedPid = fenced!.pid as number;
+        if (opts.expectedPid !== undefined && fencedPid !== opts.expectedPid) return null;
+        const attestMs = io.deadlineAt === undefined ? baseTimeoutMs : Math.min(baseTimeoutMs, io.deadlineAt - nowFn());
+        if (attestMs <= 0) return null;
+        if (!(await attestFencedIdentity(url, port, fencedPid, io, fetchFn, attestMs))) return null;
+        const fencedVersion = isHealthzVersion(fenced?.version) ? fenced!.version as string : undefined;
+        return {
+          pid: fencedPid,
+          ...(fencedVersion === undefined ? {} : { version: fencedVersion }),
+          packageTreeFenced: true,
+        };
+      }
       if (!res.ok) return null;
       const body = (await res.json().catch(() => null)) as HealthzIdentity | null;
       if (!isOpencodexHealthz(body)) return null;
       const pid = typeof body?.pid === "number" ? body.pid : null;
       if (opts.expectedPid !== undefined && pid !== null && pid !== opts.expectedPid) return null;
-      // Guarded the same way `pid` is: a non-string version is absent, not coerced.
-      const version = typeof body?.version === "string" ? body.version : undefined;
+      // Whoever holds the port controls this response. Only carry bounded semver text into
+      // diagnostics; dropping anything else prevents terminal controls reaching human output.
+      const version = isHealthzVersion(body?.version) ? body.version : undefined;
       // Same guard for the role, for the same reason: absent on a standalone/hub proxy and on
       // a legacy body, and never coerced from a non-string.
       const role = typeof body?.role === "string" ? body.role : undefined;
@@ -325,6 +428,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
           source: "runtime",
           ...(identity.version === undefined ? {} : { version: identity.version }),
           ...(identity.role === undefined ? {} : { role: identity.role }),
+          ...(identity.packageTreeFenced ? { packageTreeFenced: true as const } : {}),
         };
       }
     }
@@ -349,6 +453,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
         source: "runtime",
         ...(identity.version === undefined ? {} : { version: identity.version }),
         ...(identity.role === undefined ? {} : { role: identity.role }),
+        ...(identity.packageTreeFenced ? { packageTreeFenced: true as const } : {}),
       };
     }
   }
@@ -365,6 +470,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
       source: "config",
       ...(identity.version === undefined ? {} : { version: identity.version }),
       ...(identity.role === undefined ? {} : { role: identity.role }),
+      ...(identity.packageTreeFenced ? { packageTreeFenced: true as const } : {}),
     };
   }
   return null;

package/src/server/request-log.ts

@@ -43,6 +43,7 @@ import {
   normalizeRequestFailureAttribution,
   normalizeRequestSpend,
   readRecentUsageEntries,
+  modelIdentityLogFields, recordObservedServedModel,
   usageForFinalLog,
   usageStatusForFinalLog,
   usageTotalTokens,
@@ -168,8 +169,15 @@ export interface RequestLogContext {
   /** Final-attempt tier summary; attempt rows remain the accounting source of truth. */
   tierOutcome?: AttemptTierOutcome;
   resolvedModel?: string;
+  /** Upstream served model, retained beside resolvedModel so an upstream reroute stays visible. */
+  servedModel?: string;
+  /** The exact model id sent upstream; recorded when a route/virtual rewrite makes it differ
+   * from the client-facing `model`, so a served-model mismatch can be judged against the wire. */
+  wireModel?: string;
   /** Internal: client-facing response metadata must not replace the physical routed model. */
   preserveResolvedModelFromRoute?: boolean;
+  /** Internal: client-facing selector written into response.model; never an upstream observation. */
+  responseModelEcho?: string;
   usage?: OcxUsage;
   usageLogInputTokens?: number;
   /**
@@ -179,6 +187,8 @@ export interface RequestLogContext {
    * is reserved up front and settlement corrects it.
    */
   spendOutputCeilingTokens?: number;
+  /** Pre-send input estimate reserved for spend only; unlike usageLogInputTokens it never enters usage. */
+  spendInputEstimateTokens?: number;
   /** Settles this request's durable spend entries from `addFinalRequestLog`. */
   spendTracker?: RequestSpendSettlement;
   attempts?: PersistedUsageAttempt[];
@@ -295,6 +305,10 @@ export interface RequestLogEntry {
   responseServiceTier?: string;
   tierOutcome?: AttemptTierOutcome;
   resolvedModel?: string;
+  /** Model the upstream actually served (openai-model header or response body). */
+  servedModel?: string;
+  /** The exact model id sent upstream when it differs from the client-facing `model`. */
+  wireModel?: string;
   status: number;
   durationMs: number;
   errorCode?: string;
@@ -444,7 +458,7 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
       : {}),
     ...(entry.responseServiceTier ? { responseServiceTier: entry.responseServiceTier } : {}),
     ...(entry.tierOutcome ? { tierOutcome: entry.tierOutcome } : {}),
-    ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
+    ...modelIdentityLogFields(entry),
     status: entry.status,
     durationMs: entry.durationMs,
     ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
@@ -556,11 +570,17 @@ export function addRequestLog(entry: RequestLogEntry) {
   // line-oriented viewer — while `usage.jsonl` looked clean, which is the worst shape for a
   // sanitization bug because the safe surface is the one you check.
   const shadowCallRewrittenFrom = sanitizeLogMetadataString(entry.shadowCallRewrittenFrom);
+  const servedModel = modelIdentityLogFields(entry).servedModel;
   const claudeCompatibility = normalizeClaudeCompatibilityUsageLog(entry.claudeCompatibility);
-  const retained: RequestLogEntry = shadowCallRewrittenFrom === entry.shadowCallRewrittenFrom && entry.claudeCompatibility === undefined
+  const retained: RequestLogEntry = shadowCallRewrittenFrom === entry.shadowCallRewrittenFrom
+    && servedModel === entry.servedModel && entry.claudeCompatibility === undefined
     ? entry
     : { ...entry, ...(shadowCallRewrittenFrom ? { shadowCallRewrittenFrom } : {}) };
   if (!shadowCallRewrittenFrom && retained !== entry) delete retained.shadowCallRewrittenFrom;
+  if (!servedModel && retained !== entry) {
+    delete retained.servedModel;
+    if (retained.resolvedModel === entry.servedModel) delete retained.resolvedModel;
+  }
   if (claudeCompatibility) retained.claudeCompatibility = claudeCompatibility;
   else if (retained !== entry) delete retained.claudeCompatibility;
   entry = retained;
@@ -598,6 +618,8 @@ export function addRequestLog(entry: RequestLogEntry) {
         : {}),
       ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
       ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
+      ...(entry.servedModel ? { servedModel: entry.servedModel } : {}),
+      ...(entry.wireModel ? { wireModel: entry.wireModel } : {}),
       ...(entry.requestedModel ? { requestedModel: entry.requestedModel } : {}),
       ...(entry.requestedAlias ? { requestedAlias: entry.requestedAlias } : {}),
       ...(entry.shadowCallRewrittenFrom
@@ -881,12 +903,7 @@ export function applyResponseLogMetadata(logCtx: RequestLogContext, payload: unk
     ? (payload as { response?: unknown }).response
     : payload;
   if (!source || typeof source !== "object") return;
-  const model = (source as { model?: unknown }).model;
-  if (
-    !logCtx.preserveResolvedModelFromRoute
-    && typeof model === "string"
-    && model.trim()
-  ) logCtx.resolvedModel = model;
+  recordObservedServedModel(logCtx, (source as { model?: unknown }).model);
   const serviceTier = (source as { service_tier?: unknown }).service_tier;
   if (typeof serviceTier === "string" && serviceTier.trim()) {
     const sanitized = sanitizeLogMetadataString(serviceTier);
@@ -1519,7 +1536,7 @@ export function addFinalRequestLog(
     ...((attempts?.at(-1)?.tierOutcome ?? logCtx.tierOutcome)
       ? { tierOutcome: attempts?.at(-1)?.tierOutcome ?? { ...logCtx.tierOutcome! } }
       : {}),
-    ...(logCtx.resolvedModel ? { resolvedModel: logCtx.resolvedModel } : {}),
+    ...modelIdentityLogFields(logCtx),
     status: effectiveStatus,
     durationMs,
     ...(logCtx.firstOutputMs !== undefined ? { firstOutputMs: logCtx.firstOutputMs } : {}),

package/src/server/request-metrics.ts

@@ -38,6 +38,7 @@ export const REQUEST_METRICS_RECOVERY_CLASSES = Object.freeze([
   "payload",
   "empty_completion",
   "effort_downgrade",
+  "fast_downgrade",
   "other",
 ] as const);
 
@@ -143,6 +144,10 @@ const CAUSE_METRICS_CLASS = {
 } as const satisfies Record<RequestFailureCause, RequestMetricsRecoveryClass>;
 
 function recoveryClass(kind: AttemptRecoveryKind): RequestMetricsRecoveryClass {
+  // Both recoveries answer a rejected parameter, but an operator acts on them differently:
+  // an effort downgrade is a model/effort mismatch, a fast downgrade is a missing Anthropic
+  // fast-mode entitlement. Keep `effort_downgrade` meaning exactly what it always meant.
+  if (kind === "anthropic-fast-downgrade") return "fast_downgrade";
   return CAUSE_METRICS_CLASS[causeForRecoveryKind(kind)];
 }
 

package/src/server/responses/adapter-continuation.ts

@@ -40,6 +40,7 @@ import {
 } from "../../oauth/anthropic-routing";
 import {
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
+  hasEligibleGenericOAuthFailoverTarget,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
@@ -431,9 +432,11 @@ export function createAdapterContinuations(
             route.modelId,
           )
           : null;
-        // Eligible and refused by the shared budget, as opposed to eligible and finding no next
-        // account: the two produce the same response and need different follow-ups (#5044).
-        if (!hop.allowed) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
+        // A roster quorum ignores cooldowns, so only attribute a budget refusal when the
+        // non-mutating selector confirms that an alternate account could serve this model now.
+        if (!hop.allowed && hasEligibleGenericOAuthFailoverTarget(
+          route.providerName, transportState.genericFailoverAccountId, Date.now(), route.modelId,
+        )) noteAttemptRecoveryWithheld(logCtx.activeAttempt, "rotation-send-budget");
         if (!nextAccountId) hop.permit?.release();
         if (nextAccountId) {
           try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }

package/src/server/responses/adapter-dispatch.ts

@@ -62,6 +62,7 @@ import {
   consoleGoUploadRejectionBody,
   CONSOLE_GO_UPLOAD_RETRY_DELAY_MS,
   reasoningEffortRejectionText,
+  anthropicFastRefused,
 } from "./core-opaque-recovery";
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import {
@@ -81,6 +82,7 @@ import {
 } from "../../lib/errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { cancelBodyOnAbort } from "../../lib/abort";
+import { chargeWorkflowSends } from "../../lib/workflow-budget";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function prepareAdapterExchange(
@@ -136,6 +138,7 @@ export async function prepareAdapterExchange(
     | "sendBudgetExhausted"
     | "reserveCredentialHop"
     | "pendingHopPermit"
+    | "workflowRootId"
   >,
 ) {
   const { options, config, logCtx, req } = requestContext;
@@ -385,6 +388,8 @@ export async function prepareAdapterExchange(
     // below for the same reason the two guards above do: a guard declared inside it is reset by
     // every `continue recovery`, which would let one turn walk the whole ladder down.
     const reasoningEffortDowngradeGuard: { attempted: boolean } = { attempted: false };
+    // At most one Anthropic fast-mode downgrade per request, for the same reason.
+    const anthropicFastDowngradeGuard: { attempted: boolean } = { attempted: false };
     /**
      * Rebuild the request from the current parsed input (and any image-tier bias) and refetch
      * it once, tagging the attempt with the given recovery kind. Rebuilds are deterministic
@@ -400,6 +405,15 @@ export async function prepareAdapterExchange(
        */
       onDispatch?: () => void,
     ): Promise<Response | { failed: Response }> => {
+      // The repair permit books the request ledger, but only the transient helper reports
+      // that send to the root workflow. The other two dispatch paths confirm it here, at
+      // their physical-send boundary, without booking the request ledger again.
+      let fastDowngradeWorkflowCharged = false;
+      const chargeFastDowngradeWorkflowSend = (): void => {
+        if (recovery !== "anthropic-fast-downgrade" || fastDowngradeWorkflowCharged) return;
+        fastDowngradeWorkflowCharged = true;
+        chargeWorkflowSends(sendBudgetState.workflowRootId, 1);
+      };
       let retryRequest: AdapterRequest;
       if (transportState.sameTargetRequest !== undefined && transportState.sameTargetParsed === parsed && transportState.sameTargetToken === transportState.transportToken) {
         // Same target (key/adapter/parsed/tier unchanged): replay the exact cached request.
@@ -450,7 +464,10 @@ export async function prepareAdapterExchange(
               abortSignal: upstream.signal,
               timeoutMs: connectMs,
             sendBudget: adapterDispatchBudget,
-              onPhysicalSend: send => noteAdapterPhysicalSend(retryEstimate, send),
+              onPhysicalSend: send => {
+                noteAdapterPhysicalSend(retryEstimate, send);
+                chargeFastDowngradeWorkflowSend();
+              },
               onRecoveryWithheld: noteAdapterRecoveryWithheld,
               stream: parsed.stream,
               executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
@@ -491,6 +508,7 @@ export async function prepareAdapterExchange(
                 // Same boundary on the helper path: the thunk is what reaches the wire, and it
                 // can be refused above before it does. use() past the first attempt is a no-op.
                 onDispatch?.();
+                if (!refetchTransientPolicy) chargeFastDowngradeWorkflowSend();
                 return fetchWithHeaderTimeout(retryRequest.url,
                   applyUpstreamRecoveryInit({
                     method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
@@ -638,6 +656,52 @@ export async function prepareAdapterExchange(
         if (isNonReplayableResponse(upstreamResponse)) continue recovery;
      }
 
+      // Anthropic fast mode refused (no usage credits, organization not enabled, model outside
+      // the lane, fast pool empty): resend once at standard speed, as Claude Code does. This
+      // sits before every 429 arm because the refusal says nothing about the account's standard
+      // lane; waiting, cooling, or rotating on it would punish a healthy credential. The
+      // resend is reserved and confirmed exactly like the generic OAuth hop below, and the
+      // decision lives on this request, so every later rebuild of it stays standard.
+      if (await anthropicFastRefused(
+        upstreamResponse,
+        transportState.sameTargetRequest,
+        transportState.activeAdapter.name,
+        anthropicFastDowngradeGuard.attempted,
+        upstream.signal,
+      )) {
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+        const hop = reserveCredentialHop(
+          "repair",
+          `${route.providerName}|${route.modelId}|anthropic-fast-downgrade`,
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+        );
+        if (hop.allowed) {
+          anthropicFastDowngradeGuard.attempted = true;
+          parsed.options.tierDecision = { kind: "drop" };
+          parsed.options.serviceTier = undefined;
+          if (parsed.options.tierObservation) {
+            parsed.options.tierObservation = { ...parsed.options.tierObservation, upstreamDeclinedFast: true };
+          }
+          invalidateSameTargetRequest();
+          try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          sendBudgetState.pendingHopPermit = hop.permit;
+          let result: Response | { failed: Response };
+          try {
+            result = await rebuildAndRefetch("anthropic-fast-downgrade", () => {
+              if (!adapterOwnsDispatch) hop.permit?.use();
+            });
+          } finally {
+            sendBudgetState.pendingHopPermit = undefined;
+          }
+          if ("failed" in result) {
+            hop.permit?.release();
+            return result.failed;
+          }
+          upstreamResponse = result;
+          continue recovery;
+        }
+      }
+
       // Same-target 429 wait-and-retry (opt-in `retryOn429`, issue #487). Codex never retries
       // 429 itself (it retries 5xx only), and single-key pools cannot use the failover below,
       // so wait (Retry-After or the fixed interval) and replay the IDENTICAL request on the

package/src/server/responses/compact.ts

@@ -51,6 +51,7 @@ import { describeImagesInPlace, planVisionSidecar, shouldResolveOpenAiVisionSide
 import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
 import {
   applyCodexAuthContextToProvider,
+  callerCodexWorkspaceAccountId,
   createCodexReserveDispatchGuard,
   unwrapUpstreamRetryEvidenceError,
   CodexMainProfileDrainingError,
@@ -186,6 +187,7 @@ import {
   handleResponses,
   preAuthUpstreamHostCircuitKey,
   poolCredentialRefreshIncompleteResponse,
+  shouldRetryCodexScopedQuotaOnAlternate,
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
 } from "./core";
@@ -709,6 +711,7 @@ export async function handleResponsesCompact(
     captureOpenAiVirtualWirePolicy(route, virtual);
     logCtx.model = virtual.selectedModelId;
     logCtx.resolvedModel = virtual.wireModelId;
+    logCtx.wireModel = virtual.wireModelId;
   } else {
     logCtx.resolvedModel = route.modelId;
   }
@@ -1211,9 +1214,36 @@ export async function handleResponsesCompact(
       if (alternate && req.signal.aborted) {
         releaseCodexAuthContextProbeLease(alternate.authCtx);
         recordCompactPoolOutcome(outcomeCtx, 499);
+        void upstream.body?.cancel(req.signal.reason).catch(() => undefined);
         return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
       }
-      if (alternate) {
+      // The same scope binding the regular path applies: an organization-scoped
+      // exhaustion refuses every credential in that workspace, so a proven
+      // same-workspace alternate pays a cold prompt prefix for no new capacity.
+      // Suppression is not silence — the buffered recorder below still attributes
+      // the 429/402 to the account that produced it.
+      const sharedWorkspaceScope = alternate != null
+        && !await shouldRetryCodexScopedQuotaOnAlternate(
+          upstream,
+          authCtx.chatgptAccountId,
+          alternate.authCtx.kind === "pool" || alternate.authCtx.kind === "main-pool"
+            ? alternate.authCtx.chatgptAccountId
+            : callerCodexWorkspaceAccountId(req.headers),
+          req.signal,
+        );
+      // The scope check reads the rejection body asynchronously — the same window the
+      // comment above covers. Re-check before the branch below records A, cancels its
+      // body, and sends B for a caller that is gone.
+      if (alternate && req.signal.aborted) {
+        releaseCodexAuthContextProbeLease(alternate.authCtx);
+        recordCompactPoolOutcome(outcomeCtx, 499);
+        void upstream.body?.cancel(req.signal.reason).catch(() => undefined);
+        return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      }
+      if (alternate && sharedWorkspaceScope) {
+        releaseCodexAuthContextProbeLease(alternate.authCtx);
+      }
+      if (alternate && !sharedWorkspaceScope) {
         // Same order the regular path uses (core.ts:349-357): a 429/402 carries the
         // quota snapshot that produced it, so refresh A's cache before recording its
         // rejection. Skipping this leaves quota-strategy routing and the dashboard

package/src/server/responses/compaction-routing.ts

@@ -3,6 +3,8 @@ import { isDeclaredReasoningEffort } from "../../reasoning-effort";
 import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
 import { routeConcreteModel, type RouteResult } from "../../router";
 import { resolveComboId } from "../../combos/identifiers";
+import { resolvePolicyProfileId } from "../../routing/profile";
+import { parseSyntheticRowId } from "../fast-row";
 import { recallComboForLane } from "./combo-session-recall";
 import { sessionLaneIdFromRequest } from "../request-log-conversation";
 
@@ -83,7 +85,7 @@ export function applyCompactionRoutingOverride(
   if (trigger === undefined) return null;
 
   const sourceModel = raw.model;
-  const sourceCombo = recallComboForLane(config, sessionLaneIdFromRequest(headers), sourceModel);
+  const sourceCombo = recallComboForLane(config, sessionLaneIdFromRequest(headers), sourceSelectorOf(config, sourceModel));
   const targetCombo = resolveComboId(config, override.model.trim()) ?? undefined;
   raw.model = override.model.trim();
   if (override.reasoningEffort !== undefined) {
@@ -92,19 +94,42 @@ export function applyCompactionRoutingOverride(
   return { sourceModel, ...(sourceCombo ? { sourceCombo } : {}), ...(targetCombo ? { targetCombo } : {}) };
 }
 
+/**
+ * The selector a synthetic-row grammar actually routed on. `--fast`/`--effort` suffixes are
+ * decoration applied at ingress; identity checks must see the base id or a decorated
+ * virtual selector (`alias--fast`) slips past them.
+ */
+function sourceSelectorOf(config: OcxConfig, sourceModel: string): string {
+  const { fastRow, effortRow } = parseSyntheticRowId(sourceModel, config);
+  return fastRow?.baseId ?? effortRow?.baseId ?? sourceModel;
+}
+
 /** Same provider identity keeps caller auth and may use native compact; its ciphertext replays only there. */
 export function compactionRoutingKeepsProviderIdentity(
   config: OcxConfig,
   override: CompactionRoutingOverride,
   route: RouteResult,
 ): boolean {
-  if (route.combo || override.sourceCombo || override.targetCombo || resolveComboId(config, override.sourceModel)) return false;
+  // `sourceModel` is the selector as the client sent it, so a synthetic `--fast` or
+  // effort suffix can still be attached. The base id is what the conversation routed on,
+  // and only the base can match the combo/policy guards below.
+  const sourceSelector = sourceSelectorOf(config, override.sourceModel);
+  if (route.combo || override.sourceCombo || override.targetCombo || resolveComboId(config, sourceSelector)) return false;
+  // A policy selector does not identify one stable serving backend: its route depends on
+  // request evidence and live candidate state that this post-rewrite check no longer has.
+  // Treat it as crossing identity rather than reconstructing it through concrete routing,
+  // which deliberately bypasses policy evaluation and may fall through to defaultProvider.
+  if (resolvePolicyProfileId(config, sourceSelector) !== null) return false;
   let source: RouteResult;
   try {
-    source = routeConcreteModel(config, override.sourceModel);
+    source = routeConcreteModel(config, sourceSelector);
   } catch {
     return false;
   }
+  // The default-provider branch is where every unrecognized selector lands — including a
+  // policy/combo alias that was renamed or deleted since the conversation began. Such a
+  // selector cannot prove which backend served it, so it can never match an identity.
+  if (source.routeReason === "default-provider") return false;
   return source.providerName === route.providerName
     && source.codexAccountMode === route.codexAccountMode
     && source.codexAccountNamespace === route.codexAccountNamespace;