@bitkyc08/opencodex 2.67.0-preview.20260926 → 2.68.0-preview.20260927

package/src/server/responses/adapter-delivery.ts

@@ -19,8 +19,10 @@ import {
   readResponseStreamWithInactivity,
   ResponseBodyInactivityError,
 } from "../../lib/response-body-inactivity";
-import { resolveStallTimeoutSec } from "../../stall-timeout";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { clientEncoderForDelivery, deliverClientEncodedResponse } from "../inference/client-encoder-delivery";
+import { noteKiroServedSuccess } from "../../providers/kiro-usage";
+import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function deliverAdapterResponse(
@@ -33,7 +35,7 @@ export async function deliverAdapterResponse(
     | "rememberKiroDeliveredFinalAnswer"
     | "responseStateOptions"
   >,
-  transportState: Pick<ResponsesTransport, "activeAdapter" | "bindKeyUsageFromBridge">,
+  transportState: Pick<ResponsesTransport, "activeAdapter" | "bindKeyUsageFromBridge" | "sentOAuthSnapshot">,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
   responseEffects: Pick<
     ResponsesEffects,
@@ -43,7 +45,7 @@ export async function deliverAdapterResponse(
     | "notifyResponseComplete"
   >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
-  adapterExchange: Pick<AdapterExchange, "upstreamResponse" | "upstream" | "cleanupUpstreamAbort">,
+  adapterExchange: Pick<AdapterExchange, "upstreamResponse" | "upstream" | "cleanupUpstreamAbort" | "localUpstream">,
   continuationState: Pick<AdapterContinuations, "terminalGuardEnabled" | "fetchTerminalGuardContinuation" | "fetchGuardedEmptyCompletionRetry">,
 ): Promise<Response> {
   const { logCtx, options, config } = requestContext;
@@ -54,7 +56,7 @@ export async function deliverAdapterResponse(
     rememberKiroDeliveredFinalAnswer,
     responseStateOptions,
   } = requestState;
-  const { upstreamResponse, upstream, cleanupUpstreamAbort } = adapterExchange;
+  const { upstreamResponse, upstream, cleanupUpstreamAbort, localUpstream } = adapterExchange;
   const {
     terminalGuardEnabled,
     fetchTerminalGuardContinuation,
@@ -68,7 +70,7 @@ export async function deliverAdapterResponse(
     notifyResponseComplete,
   } = responseEffects;
   const { routedCompaction } = sidecarState;
-  const bodyInactivityMs = resolveStallTimeoutSec(config.stallTimeoutSec) * 1000;
+  const bodyInactivityMs = resolveStallTimeoutMs(config.stallTimeoutSec, { localUpstream });
 
 
   if (parsed.stream) {
@@ -76,12 +78,15 @@ export async function deliverAdapterResponse(
     // same mapping or the bridge catch reports this upstream timeout as a 500 proxy_error.
     const initialEventStream = (async function* (): AsyncGenerator<AdapterEvent> {
       try {
-        yield* readResponseStreamWithInactivity(
+        for await (const event of readResponseStreamWithInactivity(
           upstreamResponse,
           upstream.signal,
           bodyInactivityMs,
           response => transportState.activeAdapter.parseStream(response, translatorBudget, logCtx.activeTierMetadata),
-        );
+        )) {
+          options.onCompactionRecoveryAdapterEvent?.(event);
+          yield event;
+        }
       } catch (error) {
         if (error instanceof ResponseBodyInactivityError) {
           yield {
@@ -118,6 +123,9 @@ export async function deliverAdapterResponse(
     // One completion owner for both deliveries: the bridge calls it from its terminal, the
     // direct client encoder from the fold of the same events.
     const onCompletedResponse = (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
+      const served = transportState.sentOAuthSnapshot;
+      if (transportState.activeAdapter.name === "kiro" && response.status === "completed" && served
+        && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
       commitReasoningReplayServingRoute();
       rememberKiroDeliveredFinalAnswer(transportState.activeAdapter.name, response);
       // Compaction turns must NOT enter the continuation cache: _rawBody still holds the full
@@ -148,6 +156,7 @@ export async function deliverAdapterResponse(
           toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames,
         },
         stallTimeoutSec: config.stallTimeoutSec,
+        localUpstream,
         turnAdmissionLease: options.turnAdmissionLease,
         ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
         stopUpstream: () => { cancelResponseCompletion(); upstream.abort(); },
@@ -164,6 +173,7 @@ export async function deliverAdapterResponse(
         replayCacheScope: parsed._reasoningReplayScope,
         ...(options.forceEmptyResponseId ? { responseId: "" } : {}),
         stallTimeoutSec: config.stallTimeoutSec,
+        localUpstream,
         hideThinkingSummary: parsed.options.hideThinkingSummary,
         declaredToolNames,
         enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
@@ -195,6 +205,7 @@ export async function deliverAdapterResponse(
         bodyInactivityMs,
         response => transportState.activeAdapter.parseResponse!(response, translatorBudget, logCtx.activeTierMetadata),
       );
+      for (const event of initialEvents) options.onCompactionRecoveryAdapterEvent?.(event);
       let guardedEvents: AdapterEvent[];
       if (terminalGuardEnabled) {
         guardedEvents = [];
@@ -256,6 +267,9 @@ export async function deliverAdapterResponse(
     // #1926 gap 2: same buffered-path durability bound as the primary branch.
     await awaitThoughtSignatureDurability();
     if (adapterResponseReachedServingTerminal(events, json)) {
+      const served = transportState.sentOAuthSnapshot;
+      if (transportState.activeAdapter.name === "kiro" && json.status === "completed" && served
+        && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
       commitReasoningReplayServingRoute();
     }
     notifyResponseComplete(json);

package/src/server/responses/adapter-dispatch.ts

@@ -1,4 +1,5 @@
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { isLocalUpstream } from "../../lib/local-upstream";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -18,7 +19,7 @@ import {
 import { clientCancelledResponse, readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
 import { redactSecretString } from "../../lib/redact";
 import { rewriteUpstreamPolicyRefusal } from "./policy-refusal";
-import { waitForProviderRequestSlot } from "../../providers/request-pacing";
+import { withProviderRequestSlot } from "../../providers/request-pacing";
 import { providerFetch, fetchWithHeaderTimeout, safeHostLabel } from "./fetch-helpers";
 import {
   transientRetryPolicyFor,
@@ -41,7 +42,12 @@ import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
+import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
+import { normalizeFinalKiroHttpError } from "../../adapters/kiro-retry";
+import { noteKiroMonthlyRefusal } from "../../providers/kiro-usage";
+import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
 import { isXaiResponsesDestination, resolveProviderTransport } from "../../providers/xai-transport";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
@@ -53,9 +59,10 @@ import {
   formatAnthropicProviderForLog,
 } from "../../oauth/anthropic-routing";
 import {
-  GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
   isGenericOAuthFailoverEnabled,
   rotateGenericOAuthAccountOn429,
+  rotateGenericOAuthAccountOnRefusal,
+  quarantineKiroSuspendedAccount,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
 import {
@@ -123,6 +130,7 @@ export async function prepareAdapterExchange(
     | "commitResolvedOAuthSelection"
     | "genericFailoverAccountId"
     | "genericFailovers"
+    | "genericFailoverLimit"
     | "applyFailoverSnapshot"
     | "noteRoutedAttemptSend"
   >,
@@ -184,6 +192,10 @@ export async function prepareAdapterExchange(
   const stallTimeoutMs = typeof config.stallTimeoutSec === "number" && Number.isFinite(config.stallTimeoutSec) && config.stallTimeoutSec > 0
     ? Math.floor(config.stallTimeoutSec * 1000)
     : 300_000;
+  // Where this exchange dials. Local upstreams (loopback / private / `.local` / `.lan`) are
+  // operator-trusted and often CPU-bound, so an unset stall budget resolves to disabled for them.
+  // Key/OAuth rotation re-resolves credentials, never the origin, so the routed baseUrl is stable.
+  const localUpstream = isLocalUpstream(route.provider.baseUrl);
   transportState.activeAdapter = transportState.adapter;
 
   // One immutable, body-safe outbound request per same-target sequence (URL, serialized body,
@@ -291,21 +303,23 @@ export async function prepareAdapterExchange(
   try {
     if (transportState.activeAdapter.fetchResponse) {
       transportState.noteRoutedAttemptSend(inputTokenEstimate);
-      await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal);
-      upstreamResponse = await transportState.activeAdapter.fetchResponse(builtInitialRequest, {
-        abortSignal: upstream.signal,
-        timeoutMs: connectMs,
-        sendBudget: adapterDispatchBudget,
-        onPhysicalSend: send => noteAdapterPhysicalSend(inputTokenEstimate, send),
-        onRecoveryWithheld: noteAdapterRecoveryWithheld,
-        stream: parsed.stream,
-        executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-              pacingSlotAcquired: true,
-              dispatchOverride: oauthDispatch(builtInitialRequest),
-          providerName: route.providerName,
-          modelId: route.modelId,
-        }),
-      });
+      upstreamResponse = await withProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal, pacingSlot =>
+        transportState.activeAdapter.fetchResponse!(builtInitialRequest, {
+          kiroPreferAccountFailover: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro"),
+          abortSignal: upstream.signal,
+          timeoutMs: connectMs,
+          sendBudget: adapterDispatchBudget,
+          onPhysicalSend: send => noteAdapterPhysicalSend(inputTokenEstimate, send),
+          onRecoveryWithheld: noteAdapterRecoveryWithheld,
+          stream: parsed.stream,
+          executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+            pacingSlotAcquired: true,
+            pacingSlot,
+            dispatchOverride: oauthDispatch(builtInitialRequest),
+            providerName: route.providerName,
+            modelId: route.modelId,
+          }),
+        }));
     } else {
       // #1851 scope guard: transient-5xx retry on this generic adapter path is opt-in for
       // direct Google AI Studio only (Vertex/Antigravity use fetchResponse above). Other
@@ -315,11 +329,18 @@ export async function prepareAdapterExchange(
       // legacy direct-Google exception is preserved exactly; every other adapter still keeps
       // reset-only semantics so combo failover hops on the first 5xx.
       const transientPolicy = transientRetryPolicyFor(route.provider);
+      const compactPrepaid = options.compactionRecoveryAttempted ? sendBudgetState.pendingHopPermit : undefined;
+      if (compactPrepaid) sendBudgetState.pendingHopPermit = undefined;
+      let compactPrepaidUsed = false;
       const fetchWithRetryPolicy = (route.provider.adapter === "google" || transientPolicy)
         ? fetchWithTransientRetry
         : fetchWithResetRetry;
       upstreamResponse = await fetchWithRetryPolicy(
         recovery => {
+          if (compactPrepaid && !compactPrepaidUsed) {
+            if (!compactPrepaid.use()) throw new SendBudgetExhaustedError(safeHostLabel(builtInitialRequest.url));
+            compactPrepaidUsed = true;
+          }
           transportState.noteRoutedAttemptSend(inputTokenEstimate, recovery);
           return fetchWithHeaderTimeout(builtInitialRequest.url, applyUpstreamRecoveryInit({
             method: builtInitialRequest.method,
@@ -335,12 +356,15 @@ export async function prepareAdapterExchange(
         {
           abortSignal: upstream.signal,
           label: safeHostLabel(builtInitialRequest.url),
-          ...(transientPolicy
+          ...(transientPolicy || compactPrepaid
             // Draws the remainder, not the raw policy. A combo child inherits the parent's
             // holder but used to take a fresh full allowance on its own first send, so the
             // shared counter was inherited without ever being read as a limit.
             ? {
-              attempts: remainingTransientSendBudget(transientPolicy.attempts),
+              // The first emergency send is already paid for. Only retries consume the
+              // remaining allowance; treating the booking as unavailable blocks a cap of two.
+              attempts: Math.min(transientPolicy?.attempts ?? 1,
+                remainingTransientSendBudget(transientPolicy?.attempts ?? 1) + (compactPrepaid ? 1 : 0)),
               onSendsConsumed: noteTransientSends,
             }
             : {}),
@@ -405,7 +429,9 @@ export async function prepareAdapterExchange(
        * a permit confirmed earlier would keep the charge for a send that never happened.
        */
       onDispatch?: () => void,
+      preserveFailureResponse?: Response,
     ): Promise<Response | { failed: Response }> => {
+      let replacementAdmitted = false;
       // The repair permit books the request ledger, but only the transient helper reports
       // that send to the root workflow. The other two dispatch paths confirm it here, at
       // their physical-send boundary, without booking the request ledger again.
@@ -430,6 +456,7 @@ export async function prepareAdapterExchange(
           recordAdapterReasoning(logCtx, retryRequest);
           recordAdapterTier(logCtx, retryRequest);
         } catch (err) {
+          if (preserveFailureResponse && !options.abortSignal?.aborted) return { failed: preserveFailureResponse };
           // A rotated/rebuilt adapter build failure is a request-shaping error, not an
           // upstream connect failure: tear the abort link down and map it as 400 (no 413
           // translator-budget mapping here — that stays with parseRequest/buildToolBridgeMaps).
@@ -455,28 +482,32 @@ export async function prepareAdapterExchange(
         try {
           if (transportState.activeAdapter.fetchResponse) {
             transportState.noteRoutedAttemptSend(retryEstimate, recovery);
-            await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal);
-            // The dispatch boundary is HERE, not before the pacing wait: that wait can reject for
-            // an abort, a saturated queue, an expired slot or a removed provider, and none of
-            // those reach the wire. Confirming earlier would hold the charge for a send that the
-            // pacer refused.
-            onDispatch?.();
-            return await transportState.activeAdapter.fetchResponse(retryRequest, {
-              abortSignal: upstream.signal,
-              timeoutMs: connectMs,
-            sendBudget: adapterDispatchBudget,
-              onPhysicalSend: send => {
-                noteAdapterPhysicalSend(retryEstimate, send);
-                chargeFastDowngradeWorkflowSend();
-              },
-              onRecoveryWithheld: noteAdapterRecoveryWithheld,
-              stream: parsed.stream,
-              executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
-                pacingSlotAcquired: true,
-              dispatchOverride: oauthDispatch(retryRequest),
-                providerName: route.providerName,
-                modelId: route.modelId,
-              }),
+            return await withProviderRequestSlot(route.providerName, route.provider, route.modelId, upstream.signal, pacingSlot => {
+              // The dispatch boundary is HERE, not before the pacing wait: that wait can reject for
+              // an abort, a saturated queue, an expired slot or a removed provider, and none of
+              // those reach the wire. Confirming earlier would hold the charge for a send that the
+              // pacer refused.
+              onDispatch?.();
+              return transportState.activeAdapter.fetchResponse!(retryRequest, {
+                kiroPreferAccountFailover: route.providerName === "kiro" && isGenericOAuthFailoverEnabled(config, "kiro"),
+                abortSignal: upstream.signal,
+                timeoutMs: connectMs,
+                sendBudget: adapterDispatchBudget,
+                onPhysicalSend: send => {
+                  if (preserveFailureResponse) replacementAdmitted = true;
+                  noteAdapterPhysicalSend(retryEstimate, send);
+                  chargeFastDowngradeWorkflowSend();
+                },
+                onRecoveryWithheld: noteAdapterRecoveryWithheld,
+                stream: parsed.stream,
+                executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+                  pacingSlotAcquired: true,
+                  pacingSlot,
+                  dispatchOverride: oauthDispatch(retryRequest),
+                  providerName: route.providerName,
+                  modelId: route.modelId,
+                }),
+              });
             });
           }
           // #2643 review: this leg used to call fetchWithHeaderTimeout directly, so an
@@ -509,6 +540,7 @@ export async function prepareAdapterExchange(
                 // Same boundary on the helper path: the thunk is what reaches the wire, and it
                 // can be refused above before it does. use() past the first attempt is a no-op.
                 onDispatch?.();
+                if (preserveFailureResponse) replacementAdmitted = true;
                 if (!refetchTransientPolicy) chargeFastDowngradeWorkflowSend();
                 return fetchWithHeaderTimeout(retryRequest.url,
                   applyUpstreamRecoveryInit({
@@ -540,6 +572,8 @@ export async function prepareAdapterExchange(
           retryRequest.releaseBodyObservation?.();
         }
       } catch (err) {
+        if (preserveFailureResponse && !replacementAdmitted && !options.abortSignal?.aborted)
+          return { failed: preserveFailureResponse };
         cleanupUpstreamAbort();
         upstream.abort();
         if (options.abortSignal?.aborted) {
@@ -575,6 +609,46 @@ export async function prepareAdapterExchange(
         try {
           refreshed = await refreshResolvedOAuthSelection(transportState.sentOAuthSnapshot);
         } catch (err) {
+          const failed = transportState.sentOAuthSnapshot;
+          if (route.providerName === "kiro" && err instanceof OAuthLoginRequiredError && failed
+            && transportState.genericFailovers < transportState.genericFailoverLimit) {
+            const alternate = await tryKiroAlternateAfterTerminalRefresh(config, failed.accountId, failed.generation);
+            if (alternate) {
+              const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+              const hop = reserveCredentialHop("auth-recovery",
+                `${route.providerName}|${route.modelId}|terminal-refresh-account`,
+                !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null);
+              if (hop.allowed) {
+                try {
+                  const admitted = await applyFailoverSnapshot(alternate);
+                  if (admitted?.accountId === alternate.accountId) {
+                    transportState.genericFailovers += 1;
+                    invalidateSameTargetRequest();
+                    transportState.activeAdapter = resolveSelectionAdapter(
+                      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+                      config.cacheRetention);
+                    bindRouteReasoningReplayScope({
+                      parsed, providerName: route.providerName, provider: route.provider,
+                      adapterName: transportState.activeAdapter.name,
+                      oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+                    });
+                    sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider,
+                      transportState.activeAdapter.name, logCtx.accountLogLabel);
+                    recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName,
+                      route.provider, transportState.activeAdapter.name);
+                    sendBudgetState.pendingHopPermit = hop.permit;
+                    const result = await rebuildAndRefetch("oauth-account-429", () => {
+                      if (!adapterOwnsDispatch) hop.permit?.use();
+                    });
+                    if ("failed" in result) return result.failed;
+                    upstreamResponse = result;
+                    continue recovery;
+                  }
+                } catch { /* Keep the original public authentication error. */ }
+                finally { sendBudgetState.pendingHopPermit = undefined; hop.permit?.release(); }
+              }
+            }
+          }
           cleanupUpstreamAbort();
           return formatErrorResponse(401, "authentication_error", publicOAuthAuthenticationErrorMessage(err));
         }
@@ -840,18 +914,123 @@ export async function prepareAdapterExchange(
           break;
         }
       }
-      // Generic OAuth account failover (#2568) for providers with no pool of their own.
-      // Presence is consent since #2568d: rotation is ON by default once two or more eligible
-      // accounts are stored for the provider, because a second deliberate login is read as the
-      // operator asking for it. A single-account install is still a strict no-op, and an
-      // explicit `oauthAccountFailover.enabled: false` (global or per provider) still wins --
-      // see isGenericOAuthFailoverEnabled in src/oauth/generic-account-failover.ts. Codex and
-      // Anthropic are excluded by isGenericFailoverProvider: their pools own quota scopes,
-      // probe leases and affinity that this must not reimplement.
+      // Generic OAuth account failover (#2568) rotates reactively after a refusal when
+      // two accounts are stored. Kiro additionally classifies bounded 400/403 refusals;
+      // all other providers retain the original 429 loop below.
+      if (route.providerName === "kiro") {
+      while (
+        (upstreamResponse.status === 429 || upstreamResponse.status === 400 || upstreamResponse.status === 403)
+        && transportState.genericFailoverAccountId
+      ) {
+        const refusal = classifyKiroRefusal(upstreamResponse.status,
+          await readDisplaySafeErrorText(upstreamResponse.clone(), upstream.signal, ""));
+        if (refusal.kind === "other") break;
+        const sent = transportState.sentOAuthSnapshot;
+        const monthlyCooldownMs = refusal.kind === "monthly_quota" && sent
+          ? noteKiroMonthlyRefusal(sent.accountId, sent.generation, Date.now()) : undefined;
+        if (monthlyCooldownMs !== undefined) persistKiroAccountState();
+        if (refusal.kind === "suspended")
+          quarantineKiroSuspendedAccount(transportState.genericFailoverAccountId, sent?.generation);
+        if (transportState.genericFailovers >= transportState.genericFailoverLimit
+          || !isGenericOAuthFailoverEnabled(config, "kiro")) break;
+        // Intersection with the shared request budget. This arm re-sends through
+        // rebuildAndRefetch, so the roster cap alone would let one request walk the roster on
+        // an allowance the rest of the request cannot see. A refusal ends the ladder with the
+        // original HTTP response already in hand.
+        //
+        // Who settles this reservation depends on who dispatches the replay (#4709). An
+        // adapter that owns its ladder -- Kiro's reset loop, Cursor's transport loop --
+        // reserves once per physical send and would charge the same replay again; the helper
+        // path reports it again through `onSendsConsumed`. Both turned one physical send into
+        // two charges, and once the allowance was spent, into a synthetic error in place of
+        // the refusal this hop was recovering from. The wire protocol is resolved from the
+        // provider and model, not from the account, so an account rotation cannot move the
+        // replay between these two shapes.
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+        const hop = reserveCredentialHop(
+          "auth-recovery",
+          `${route.providerName}|${route.modelId}|adapter-recovery-oauth-429`,
+          // Only a helper-routed replay reports this send back. A reset-only refetch reports
+          // nothing and an adapter ladder settles the booking itself, so promising an external
+          // report on either would leave a booking pending until it swallowed a later charge.
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+        );
+        if (!hop.allowed) break;
+        const nextAccountId = rotateGenericOAuthAccountOnRefusal(
+          config,
+          route.providerName,
+          transportState.genericFailoverAccountId,
+          refusal.kind,
+          upstreamResponse.headers.get("retry-after"),
+          Date.now(),
+          route.modelId,
+          monthlyCooldownMs,
+        );
+        if (!nextAccountId) {
+          hop.permit?.release();
+          break;
+        }
+        try {
+          // The FULL snapshot, not just the bearer: Antigravity pairs an account-matched
+          // projectId with its token and Kiro carries routing metadata, so a token-only swap
+          // would mix one account's credential with another's routing data.
+          const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
+          if (!await applyFailoverSnapshot(snapshot)) {
+            hop.permit?.release();
+            break;
+          }
+          transportState.genericFailovers += 1;
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+            config.cacheRetention,
+          );
+          sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
+          recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
+          // The replay IS this hop's send, so hand the reservation down and let the layer that
+          // dispatches settle it: `adapterDispatchBudget` spends it on the adapter's first
+          // reservation, and the retry helper's reporter settles the external booking.
+          sendBudgetState.pendingHopPermit = hop.permit;
+          let result: Response | { failed: Response };
+          try {
+            // Confirm at the dispatch boundary, not here: a rebuild can fail while shaping the
+            // request and return `{ failed }` without reaching the wire, and a permit confirmed
+            // before that would hold the charge for a send that never happened. An
+            // adapter-owned ladder is the exception -- its own reservation is the confirmation,
+            // and settling here first would hand it a dead permit, which it reads as an
+            // exhausted request and stops sending on.
+            result = await rebuildAndRefetch("oauth-account-429", () => {
+              if (!adapterOwnsDispatch) hop.permit?.use();
+            }, upstreamResponse);
+          } finally {
+            sendBudgetState.pendingHopPermit = undefined;
+          }
+          if ("failed" in result) {
+            // A no-op if the boundary was reached; a refund if the rebuild died before it.
+            hop.permit?.release();
+            if (result.failed !== upstreamResponse) return result.failed;
+            break;
+          }
+          try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+         upstreamResponse = result;
+          // The hop's permit is already settled by the dispatch boundary above; continuing
+          // only skips the remaining arms, it does not abandon a reservation.
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
+       } catch {
+         // A throw before the send — snapshot fetch, credential application, adapter
+          // resolution — must hand the reservation back. Without this the ladder charges the
+          // request for a send it never made, and a later recovery in the same request is
+          // refused on an allowance nothing spent. release() is idempotent and a no-op once
+          // used, so a throw from the rebuild keeps its charge.
+          hop.permit?.release();
+          break;
+        }
+      }
+      } else {
       while (
         upstreamResponse.status === 429
         && transportState.genericFailoverAccountId
-        && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
+        && transportState.genericFailovers < transportState.genericFailoverLimit
         && isGenericOAuthFailoverEnabled(config, route.providerName)
       ) {
         // Intersection with the shared request budget. This arm re-sends through
@@ -944,6 +1123,7 @@ export async function prepareAdapterExchange(
           break;
         }
       }
+      }
       // Unknown provenance is deliberately fail-soft in pre-flight: after a restart, TTL expiry,
       // or LRU eviction, a valid same-backend blob must survive. A decoder's own 4xx identity is
       // the missing authoritative signal. Rebuild once through the same sanitation path used by a
@@ -1042,6 +1222,8 @@ export async function prepareAdapterExchange(
       break;
     }
     if (!upstreamResponse.ok) {
+      if (route.providerName === "kiro")
+        upstreamResponse = await normalizeFinalKiroHttpError(upstreamResponse, upstream.signal);
       if (options.comboAttempt) {
         // No pre-read guard: `consumeComboFailure` -> `readBoundedResponseBody` reads
         // `response.body` itself with the abort signal threaded through, and the combo
@@ -1097,6 +1279,11 @@ export async function prepareAdapterExchange(
       // material before it reaches the client-facing error surface.
       const upstreamRetryAfter = upstreamResponse.headers.get("retry-after");
       const normalized = normalizeUpstreamErrorText(errorText, "unknown error");
+      options.onCompactionRecoveryAdapterEvent?.({
+        type: "error", status: upstreamResponse.status,
+        errorType: normalized.type, code: normalized.code,
+        message: "Structured upstream failure observed before client formatting",
+      });
       const message = normalized.cyberPolicy
         ? normalized.message
           ?? (isCyberPolicyCode(normalized.code) ? CYBER_POLICY_FALLBACK_MESSAGE : normalized.safeText)
@@ -1141,6 +1328,7 @@ export async function prepareAdapterExchange(
     cleanupUpstreamAbort,
     connectMs,
     stallTimeoutMs,
+    localUpstream,
     upstreamResponse,
     rateLimitPolicy,
     get rateLimitRetries(): typeof rateLimitRetries {

package/src/server/responses/codex-ws-pool.ts

@@ -1,13 +1,13 @@
 import { createHmac, randomBytes } from "node:crypto";
 import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
-import { CODEX_RESPONSES_HTTP_URL } from "./codex-ws-request";
+import { CODEX_RESPONSES_HTTP_URL, CODEX_WS_FRAME_HEADERS } from "./codex-ws-request";
 import { CODEX_WS_ID_MAX_BYTES } from "./codex-ws-correlation";
 import { CodexWsSession } from "./codex-ws-session";
 
 export const CODEX_WS_POOL_MAX_SESSIONS = 32;
 export const CODEX_WS_POOL_IDLE_MS = 30_000;
 export const CODEX_WS_POOL_MAX_AGE_MS = 5 * 60_000;
-const MUTABLE_HEADERS = new Set(["x-codex-turn-state", "x-codex-turn-metadata"]);
+const MUTABLE_HEADERS = new Set<string>(CODEX_WS_FRAME_HEADERS);
 let processKey: Buffer | undefined;
 let poolSequence = 0;
 
@@ -25,7 +25,7 @@ function digest(input: unknown): string {
 }
 
 /** Identity comes from the selected outgoing request, never a model label or caller hint. */
-export function codexWsReuseIdentity(url: string, headers: Record<string, string>, frameText: string, proxy?: string): CodexWsReuseIdentity | null {
+export function codexWsReuseIdentity(url: string, headers: Record<string, string>, frameText: string, proxy?: string, dialUrl?: string): CodexWsReuseIdentity | null {
   if (url !== CODEX_RESPONSES_HTTP_URL) return null;
   let body: unknown;
   try { body = JSON.parse(frameText); } catch { return null; }
@@ -52,7 +52,8 @@ export function codexWsReuseIdentity(url: string, headers: Record<string, string
   const scope = digest([url, account, thread, turn]);
   const lite = metadata.ws_request_header_x_openai_internal_codex_responses_lite;
   if (lite !== undefined && lite !== "true" && lite !== "false") return null;
-  return { scope, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null]) };
+  // `dialUrl` is the socket destination after plugin rewrites; absent means the canonical one.
+  return { scope, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
 }
 
 interface Entry { identity: CodexWsReuseIdentity; session: CodexWsSession; createdAt: number; idleAt: number; retired: boolean }

package/src/server/responses/codex-ws-request.ts

@@ -4,6 +4,9 @@ import {
   CODEX_RESPONSES_LITE_METADATA_KEY,
 } from "../../codex/forward-transport-headers";
 
+/** Per-turn headers the WebSocket carries in `client_metadata` of each frame, not in the upgrade. */
+export const CODEX_WS_FRAME_HEADERS = ["x-codex-turn-state", "x-codex-turn-metadata"] as const;
+
 export const CODEX_RESPONSES_HTTP_URL = "https://chatgpt.com/backend-api/codex/responses";
 export const CODEX_RESPONSES_WS_URL = "wss://chatgpt.com/backend-api/codex/responses";
 export const WS_BETA = "responses_websockets=2026-02-06";
@@ -32,7 +35,7 @@ function applyLiteMetadata(body: Record<string, unknown>, headers: Headers): boo
     body.client_metadata = { ...(metadata as Record<string, string> | undefined),
       [CODEX_RESPONSES_LITE_METADATA_KEY]: lite };
   }
-  for (const name of ["x-codex-turn-state", "x-codex-turn-metadata"]) {
+  for (const name of CODEX_WS_FRAME_HEADERS) {
     const value = headers.get(name);
     const current = body.client_metadata as Record<string, string> | undefined;
     if (value !== null && !Object.hasOwn(current ?? {}, name)) {

package/src/server/responses/compact.ts

@@ -154,7 +154,8 @@ import { codexAccountSelectionForTurn, registerTurn, trackStreamLifetime, unregi
 import type { AdmissionLease } from "../../lib/admission";
 import { redactSecretString } from "../../lib/redact";
 import { readBoundedResponseBytes } from "../../lib/bounded-body";
-import { resolveStallTimeoutSec } from "../../stall-timeout";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
+import { isLocalUpstream } from "../../lib/local-upstream";
 import { isRateLimitOrQuotaFailureMessage } from "../../lib/errors";
 import { supportedLadderFor } from "../effort-policy";
 import {
@@ -562,6 +563,7 @@ export async function bufferCompactResponse(
   upstream: Response,
   signal: AbortSignal,
   stallTimeoutSec?: number,
+  localUpstream?: boolean,
 ): Promise<Response> {
   const headers = compactResponseHeaders(upstream);
   try {
@@ -581,7 +583,9 @@ export async function bufferCompactResponse(
     const result = await readBoundedResponseBytes(upstream, {
       signal,
       maxBytes: COMPACT_RESPONSE_MAX_BYTES,
-      inactivityTimeoutMs: resolveStallTimeoutSec(stallTimeoutSec) * 1_000,
+      // Compaction buffers the complete body while holding an active-turn lease. Keep its
+      // default bounded even for local destinations so silent bodies cannot exhaust that gate.
+      inactivityTimeoutMs: resolveStallTimeoutMs(stallTimeoutSec),
     });
     if (signal.aborted) return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
     if (result.oversized) return compactResponseTooLargeError();
@@ -1332,7 +1336,7 @@ export async function handleResponsesCompact(
       upstream.headers.get("x-codex-secondary-reset-at"),
       upstream.headers.get("x-codex-tertiary-reset-at"),
     ].filter(Boolean);
-    const buffered = await bufferCompactResponse(upstream, req.signal, config.stallTimeoutSec);
+    const buffered = await bufferCompactResponse(upstream, req.signal, config.stallTimeoutSec, isLocalUpstream(compactUrl));
     const bufferedErrorText = buffered.ok
       ? ""
       : await buffered.clone().text().catch(() => "");
@@ -1431,7 +1435,7 @@ export async function handleResponsesCompact(
   // The routed compaction turn is a handoff inside the same logical request, so it draws the
   // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
   // fallback spend four more.
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRecoveryKind: "compaction-v1", compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {