@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/server/responses/codex-ws-pool.ts

@@ -1,4 +1,5 @@
 import { createHmac, randomBytes } from "node:crypto";
+import { codexWsReuseAcrossTurnsEnabled } from "../../config/codex-ws-reuse-setting";
 import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
 import { CODEX_RESPONSES_HTTP_URL, CODEX_WS_FRAME_HEADERS } from "./codex-ws-request";
 import { CODEX_WS_ID_MAX_BYTES } from "./codex-ws-correlation";
@@ -7,11 +8,15 @@ import { CodexWsSession } from "./codex-ws-session";
 export const CODEX_WS_POOL_MAX_SESSIONS = 32;
 export const CODEX_WS_POOL_IDLE_MS = 30_000;
 export const CODEX_WS_POOL_MAX_AGE_MS = 5 * 60_000;
+export const CODEX_WS_POOL_WAIT_MS = 750;
+/** Retained sockets per account+thread while cross-turn reuse is on. */
+export const CODEX_WS_POOL_SCOPE_LIMIT = 2;
+const CODEX_WS_POOL_WAIT_DEPTH = 2;
 const MUTABLE_HEADERS = new Set<string>(CODEX_WS_FRAME_HEADERS);
 let processKey: Buffer | undefined;
 let poolSequence = 0;
 
-export interface CodexWsReuseIdentity { key: string; scope: string }
+export interface CodexWsReuseIdentity { key: string; scope: string; routeTag: string }
 function value(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0
     && !/[\u0000-\u001f\u007f]/.test(value) && Buffer.byteLength(value) <= CODEX_WS_ID_MAX_BYTES;
@@ -49,19 +54,23 @@ export function codexWsReuseIdentity(url: string, headers: Record<string, string
   const immutable = Object.entries(headers).filter(([name]) => !MUTABLE_HEADERS.has(name)).sort(([a], [b]) => a.localeCompare(b));
   if (immutable.length > 128 || immutable.some(([, field]) => !value(field))
     || immutable.reduce((bytes, [name, field]) => bytes + Buffer.byteLength(name) + Buffer.byteLength(field), 0) > 32 * 1024) return null;
-  const scope = digest([url, account, thread, turn]);
+  const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+  const scope = digest(reuseAcrossTurns ? [url, account, thread] : [url, account, thread, turn]);
   const lite = metadata.ws_request_header_x_openai_internal_codex_responses_lite;
   if (lite !== undefined && lite !== "true" && lite !== "false") return null;
   // `dialUrl` is the socket destination after plugin rewrites; absent means the canonical one.
-  return { scope, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
+  const routeTag = digest(["route", authorization, proxy ?? null, dialUrl ?? null]);
+  return { scope, routeTag, key: digest([scope, authorization, body.model, body.service_tier ?? null, lite ?? null, immutable, proxy ?? null, dialUrl ?? null]) };
 }
 
 interface Entry { identity: CodexWsReuseIdentity; session: CodexWsSession; createdAt: number; idleAt: number; retired: boolean }
-interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number }
+interface Waiter { key: string; resolve: (session: CodexWsSession | null) => void; timer: ReturnType<typeof setTimeout>; onAbort: () => void; signal?: AbortSignal }
+interface PoolOptions { now?: () => number; maxSessions?: number; idleMs?: number; maxAgeMs?: number; waitMs?: number }
 
 /** Bounded retained sockets only. Busy/capacity misses keep the existing one-shot path. */
 export class CodexWsPool {
   private readonly entries = new Map<string, Entry>();
+  private readonly waiters: Waiter[] = [];
   private timer?: ReturnType<typeof setTimeout>;
   private detachShutdown?: () => void;
   private readonly hookKey = `codex-upstream-ws-pool-${++poolSequence}`;
@@ -69,29 +78,74 @@ export class CodexWsPool {
   private readonly maxSessions: number;
   private readonly idleMs: number;
   private readonly maxAgeMs: number;
+  private readonly waitMs: number;
   constructor(options: PoolOptions = {}) {
     this.now = options.now ?? Date.now;
     this.maxSessions = options.maxSessions ?? CODEX_WS_POOL_MAX_SESSIONS;
     this.idleMs = options.idleMs ?? CODEX_WS_POOL_IDLE_MS;
     this.maxAgeMs = options.maxAgeMs ?? CODEX_WS_POOL_MAX_AGE_MS;
+    this.waitMs = options.waitMs ?? CODEX_WS_POOL_WAIT_MS;
   }
 
   acquire(identity: CodexWsReuseIdentity, url: string, headers: Record<string, string>, proxy?: string): CodexWsSession | null {
-    this.sweep();
-    for (const entry of this.entries.values()) {
-      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
-      entry.retired = true;
-      if (!entry.session.busy) this.remove(entry);
+    return this.claim(identity, url, headers, proxy).session;
+  }
+
+  /**
+   * Before any frame is sent, wait for the matching busy socket instead of dialing a throwaway.
+   * The queue is FIFO and at most two deep. An abort or the deadline returns null.
+   */
+  acquireWaiting(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy: string | undefined,
+    signal?: AbortSignal,
+  ): Promise<CodexWsSession | null> {
+    const claimed = this.claim(identity, url, headers, proxy);
+    if (claimed.session || !claimed.busy) return Promise.resolve(claimed.session);
+    if (signal?.aborted) return Promise.resolve(null);
+    if (this.waiters.filter(waiter => waiter.key === identity.key).length >= CODEX_WS_POOL_WAIT_DEPTH) {
+      return Promise.resolve(null);
     }
+    return new Promise(resolve => {
+      const waiter: Waiter = {
+        key: identity.key,
+        resolve,
+        signal,
+        timer: setTimeout(() => this.finishWaiter(waiter, null), this.waitMs),
+        onAbort: () => this.finishWaiter(waiter, null),
+      };
+      waiter.timer.unref?.();
+      signal?.addEventListener("abort", waiter.onAbort, { once: true });
+      this.waiters.push(waiter);
+    });
+  }
+
+  private claim(
+    identity: CodexWsReuseIdentity,
+    url: string,
+    headers: Record<string, string>,
+    proxy?: string,
+  ): { session: CodexWsSession | null; busy: boolean } {
+    this.sweep();
+    this.retireSiblings(identity);
     const existing = this.entries.get(identity.key);
     if (existing) {
-      if (existing.retired || existing.session.busy) return null;
-      if (existing.session.reserve()) { this.arm(); return existing.session; }
+      if (existing.retired) return { session: null, busy: false };
+      if (existing.session.busy) return { session: null, busy: true };
+      if (existing.session.reserve()) { this.arm(); return { session: existing.session, busy: false }; }
       this.remove(existing);
+    } else if (codexWsReuseAcrossTurnsEnabled() && this.scopeCount(identity.scope) >= CODEX_WS_POOL_SCOPE_LIMIT) {
+      const oldest = [...this.entries.values()]
+        .filter(entry => entry.identity.scope === identity.scope && !entry.session.busy)
+        .sort((left, right) => left.idleAt - right.idleAt)[0];
+      if (!oldest) return { session: null, busy: false };
+      this.remove(oldest);
     }
     if (this.entries.size >= this.maxSessions) {
       const oldest = [...this.entries.values()].filter(entry => !entry.session.busy).sort((a, b) => a.idleAt - b.idleAt)[0];
-      if (!oldest) return null;
+      if (!oldest) return { session: null, busy: false };
       this.remove(oldest);
     }
     const createdAt = this.now();
@@ -100,13 +154,45 @@ export class CodexWsPool {
     session.reserve();
     this.entries.set(identity.key, entry);
     this.detachShutdown ??= registerOptionalShutdownHook(this.hookKey, () => this.dispose());
-    return session;
+    return { session, busy: false };
+  }
+
+  private retireSiblings(identity: CodexWsReuseIdentity): void {
+    const reuseAcrossTurns = codexWsReuseAcrossTurnsEnabled();
+    for (const entry of this.entries.values()) {
+      if (entry.identity.scope !== identity.scope || entry.identity.key === identity.key) continue;
+      const routeChanged = entry.identity.routeTag !== identity.routeTag;
+      if (reuseAcrossTurns && !routeChanged) continue;
+      entry.retired = true;
+      if (!entry.session.busy) this.remove(entry);
+    }
+  }
+
+  private scopeCount(scope: string): number {
+    let count = 0;
+    for (const entry of this.entries.values()) if (entry.identity.scope === scope && !entry.retired) count += 1;
+    return count;
+  }
+
+  private finishWaiter(waiter: Waiter, session: CodexWsSession | null): void {
+    const index = this.waiters.indexOf(waiter);
+    if (index < 0) return;
+    this.waiters.splice(index, 1);
+    clearTimeout(waiter.timer);
+    waiter.signal?.removeEventListener("abort", waiter.onAbort);
+    waiter.resolve(session);
   }
 
   private changed(entry: Entry): void {
     if (this.entries.get(entry.identity.key) !== entry) return;
     if (entry.session.closed) this.entries.delete(entry.identity.key);
     else if (!entry.session.busy) {
+      const waiter = this.waiters.find(candidate => candidate.key === entry.identity.key);
+      if (waiter && !entry.retired && entry.session.reserve()) {
+        this.finishWaiter(waiter, entry.session);
+        this.arm();
+        return;
+      }
       entry.idleAt = this.now();
       if (entry.retired || entry.idleAt - entry.createdAt >= this.maxAgeMs) this.remove(entry);
     }
@@ -152,6 +238,7 @@ export class CodexWsPool {
     this.detachShutdown = undefined;
     const entries = [...this.entries.values()];
     this.entries.clear();
+    for (const waiter of [...this.waiters]) this.finishWaiter(waiter, null);
     for (const entry of entries) entry.session.dispose(new DOMException("codex websocket pool shutdown", "AbortError"));
   }
 

package/src/server/responses/codex-ws-wire.ts

@@ -49,6 +49,7 @@ const WS_CLOSE_MESSAGE_TOO_BIG = 1009;
 
 const codexWsUpstreamResponses = new WeakSet<Response>();
 const quotaObservedResponses = new WeakSet<Response>();
+const codexWsPreludeProjections = new WeakSet<Response>();
 
 /** Quota arrived directly at its captured account; do not replay old HTTP prelude headers. */
 export function isCodexWsQuotaObservedResponse(response: Response): boolean {
@@ -60,6 +61,14 @@ export function isCodexWsUpstreamResponse(response: Response): boolean {
   return codexWsUpstreamResponses.has(response);
 }
 
+/** Pre-response projection; its headers retain the exchange's prelude snapshot. */
+export function markCodexWsPreludeProjection(response: Response): void {
+  codexWsPreludeProjections.add(response);
+}
+
+export function isCodexWsPreludeProjection(response: Response): boolean {
+  return codexWsPreludeProjections.has(response);
+}
 
 export function markCodexWsResponse(response: Response, observed: boolean): void {
   codexWsUpstreamResponses.add(response);

package/src/server/responses/combo-requested-effort.ts

@@ -10,5 +10,7 @@ export function comboRequestedEffortLabel(
   const forcedTransition = forcedEffort != null && forcedEffort !== originalRequestedEffort
     ? `->${forcedEffort}`
     : "";
-  return `${originalRequestedEffort}${forcedTransition}${laterTransitions}`;
+  const segments = `${originalRequestedEffort}${forcedTransition}${laterTransitions}`.split("->");
+  // A pin that kept the effort it was given is not a transition; drop the repeated segment.
+  return segments.filter((segment, index) => index === 0 || segment !== segments[index - 1]).join("->");
 }

package/src/server/responses/compact.ts

@@ -1,3 +1,6 @@
+import { createPhysicalSendReporter } from "../../lib/request-execution-budget";
+import { createInferenceSendBudget } from "../inference/context";
+import { unboundPoolSpendRefusalResponse } from "../workflow-refusal";
 import { capturePoolQuotaWriter } from "../../codex/account-store";
 import { previewXaiOauthWireModel } from "./core-normalize";
 import {
@@ -722,6 +725,7 @@ export async function handleResponsesCompact(
   logCtx.provider = route.codexAccountNamespace
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : route.providerName;
+  logCtx.spendPoolId = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   // #4940, and the same refusal the ordinary Responses path makes in request-prepare.ts. Compact has
   // to repeat it rather than inherit it: the native branch below dispatches straight to
@@ -804,7 +808,7 @@ export async function handleResponsesCompact(
   // failure that hands off, continues here. The routed turn used to call handleResponses with
   // no budget at all, so `handleResponsesInner` minted a fresh four after the native attempt
   // had already spent some of the first one.
-  const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
+  const sendBudget: RequestExecutionBudget = options.sendBudget ?? createInferenceSendBudget(req, logCtx);
   // A manual override onto another backend must not mint ciphertext the conversation model cannot replay.
   const manualOverrideCrossesProvider = options.compactionRoutingOverride
     ? !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)
@@ -1022,12 +1026,21 @@ export async function handleResponsesCompact(
     // `kind === "pool"` and a main-pool credential left it false -- so 401 then 429 really did
     // reach five. The single sends spend the base allowance first and then the one shared
     // final-recovery reserve, which is the same rule the Responses path follows.
-    const sendSingleCompactAttempt = (
+    const sendSingleCompactAttempt = async (
       doFetch: () => Promise<Response>,
     ): Promise<Response> => {
       if (sendBudget.remainingBaseSends(TRANSIENT_RETRY_MAX_ATTEMPTS) > 0) {
-        sendBudget.used += 1;
-        return doFetch();
+        const report = createPhysicalSendReporter(sendBudget, () => ({ poolId: logCtx.spendPoolId ?? route.providerName,
+          identityId: logCtx.accountLogLabel }));
+        let started = false;
+        try {
+          if (report.beforeSend?.() === false) throw new SendBudgetExhaustedError(safeHostLabel(compactUrl));
+          started = true;
+          return await doFetch();
+        } finally {
+          try { if (started) report(1); }
+          finally { report.close?.(); }
+        }
       }
       const decision = sendBudget.reserveDispatch({
         sendClass: "auth-recovery",
@@ -1076,7 +1089,8 @@ export async function handleResponsesCompact(
           // Draws the shared remainder instead of a fresh three. Compact is a native endpoint
           // of the same logical turn, so its sends belong to the same cap.
           attempts: sendBudget.remainingBaseSends(TRANSIENT_RETRY_MAX_ATTEMPTS),
-          onSendsConsumed: (used: number) => { sendBudget.used += Math.max(0, used); },
+          onSendsConsumed: createPhysicalSendReporter(sendBudget, () => ({ poolId: logCtx.spendPoolId ?? route.providerName,
+            identityId: logCtx.accountLogLabel })),
         });
     };
 
@@ -1084,9 +1098,12 @@ export async function handleResponsesCompact(
     // actually happens, so every recorder call names the context that produced it.
     let outcomeCtx = authCtx;
     const localDispatchRefusal = (error: unknown): Response | undefined => {
-      const response = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(error), {
-        now: Date.now(), accountSelector: route.codexAccountNamespace,
-      });
+      const cause = unwrapUpstreamRetryEvidenceError(error);
+      const response = cause instanceof SendBudgetExhaustedError
+        ? unboundPoolSpendRefusalResponse(logCtx) ?? formatErrorResponse(429, "request_send_budget_exhausted", cause.message)
+        : mapCodexAuthContextErrorToResponse(cause, {
+          now: Date.now(), accountSelector: route.codexAccountNamespace,
+        });
       if (response) {
         releaseUpstreamHostAdmission(compactHostAdmissionLease);
         compactHostAdmissionLease = null;

package/src/server/responses/compaction-recovery.ts

@@ -47,7 +47,7 @@ function settlePhysicalSends(log: RequestLogContext, budget: RequestExecutionBud
   // An external report may settle a prepaid booking without changing used. Its explicit
   // receipt outranks the numeric delta, or the same source send would be charged twice.
   const unreported = Math.max(0, sent - Math.max(reported, Math.max(0, budget.used - beforeUsed)));
-  if (unreported > 0) budget.used += unreported;
+  if (unreported > 0 && !budget.spendEnforced) budget.used += unreported;
   return sent;
 }
 

package/src/server/responses/core-codex-account.ts

@@ -6,6 +6,7 @@ import {
   computeQuotaCooldown,
   formatCodexProviderForLog,
 } from "../../codex/routing";
+import { claimMainQuotaDispatchForWs, isMainQuotaDispatchLive, renewMainQuotaDispatchForAttempt, type MainQuotaDispatch } from "../../codex/main-account-cache";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { isCodexAccountGenerationLive } from "../../codex/account-store";
@@ -121,8 +122,28 @@ export function usesCodexForwardPoolAuth(
 }
 
 
+/** Live proof that this plain-main response used the observed main credential. */
+export function liveMainQuotaDispatch(
+  authCtx: CodexAuthContext, provider: OcxProviderConfig,
+): MainQuotaDispatch | undefined {
+  if (authCtx.kind !== "main" || !authCtx.mainQuotaDispatch) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)
+    || provider.authMode !== "forward" || provider.adapter !== "openai-responses") return undefined;
+  return isMainQuotaDispatchLive(authCtx.mainQuotaDispatch) ? authCtx.mainQuotaDispatch : undefined;
+}
+
 export function codexWsQuotaObserver(authCtx: CodexAuthContext, provider: OcxProviderConfig, modelId?: string): CodexWsQuotaObserver | undefined {
-  if (!isCanonicalOpenAiForwardProvider(provider) || !usesCodexForwardPoolAuth(authCtx, provider)) return undefined;
+  if (!isCanonicalOpenAiForwardProvider(provider)) return undefined;
+  if (!usesCodexForwardPoolAuth(authCtx, provider)) {
+    const captured = liveMainQuotaDispatch(authCtx, provider);
+    if (!captured || authCtx.kind !== "main") return undefined;
+    const dispatch = authCtx.mainQuotaDispatch = renewMainQuotaDispatchForAttempt(captured);
+    return headers => {
+      claimMainQuotaDispatchForWs(dispatch);
+      if (!isMainQuotaDispatchLive(dispatch)) return;
+      applyCapturedCodexQuota(MAIN_CODEX_ACCOUNT_ID, headers, dispatch.configGeneration, dispatch.writer, { modelId });
+    };
+  }
   const { accountId, writerGeneration } = authCtx;
   const credentialGeneration = authCtx.kind === "pool" ? authCtx.generation : undefined;
   const mainWriter = authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined;

package/src/server/responses/core-combo-native.ts

@@ -18,7 +18,7 @@ import type { OcxConfig } from "../../types";
 import type { RouteResult } from "../../router";
 import type { DataPlaneAdmission } from "../auth-cors";
 import type { AdmissionLease } from "../../lib/admission";
-import type { RequestExecutionBudget } from "../../lib/request-execution-budget";
+import type { RequestExecutionBudget, SingleUseDispatchPermit } from "../../lib/request-execution-budget";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { ResponsesTerminalStatus } from "../../bridge";
 import type { NativeChatFinishLog } from "../chat-native";
@@ -32,7 +32,7 @@ import {
   type RequestLogContext,
 } from "../request-log";
 import { captureRouteStaticPolicy, routeConcreteModel } from "../../router";
-import { comboDefaultEffort, concreteComboRequestBody, getCombo } from "../../combos";
+import { comboDefaultEffort, concreteComboRequestBody, getCombo, type JevDecision } from "../../combos";
 import { supportedLadderFor } from "../effort-policy";
 import { applyDroidReasoningDefault } from "../droid-reasoning-default";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
@@ -62,6 +62,7 @@ export interface NativeComboChildRun {
   childLog: RequestLogContext;
   attemptHandle: InferenceAttempt;
   sendBudget: RequestExecutionBudget;
+  comboDispatchPermit?: SingleUseDispatchPermit;
   turnAdmissionLease?: AdmissionLease;
   onFirstOutput: () => void;
   /** Reports to the combo's child callbacks; it never writes the parent's final row itself. */
@@ -93,6 +94,7 @@ export interface ComboProtocolLanes {
     target: ComboTarget,
     targetRoute: RouteResult,
     targetSendBudget: TransientSendBudget | undefined,
+    initialDecision?: Pick<JevDecision, "effort">,
   ): NativeComboChildPlan | undefined;
 }
 
@@ -100,6 +102,7 @@ interface CandidateVerdict {
   skip?: ProtocolFeature[];
 }
 
+/** Build opt-in native eligibility and child plans; only the initial plan applies a JEV choice. */
 export function createComboProtocolLanes(input: {
   source: ComboProtocolSource | undefined;
   req: Request;
@@ -202,7 +205,7 @@ export function createComboProtocolLanes(input: {
         400, unrepresentableMessage(features), "invalid_request_error", "unsupported_feature",
       ), "chat");
     },
-    nativeChild: (target, targetRoute, targetSendBudget) => {
+    nativeChild: (target, targetRoute, targetSendBudget, initialDecision) => {
       // Without the request's execution budget a native child could not share its sends, so it
       // keeps the bridge rather than opening a tracker of its own.
       if (!isRequestExecutionBudget(targetSendBudget)) return undefined;
@@ -213,7 +216,22 @@ export function createComboProtocolLanes(input: {
         provider: targetRoute.provider,
         modelId: targetRoute.modelId,
       });
-      applyComboEffort(body, config, comboId, target, targetRoute);
+      if (initialDecision) {
+        // A validated JEV choice owns only this first dispatch, including explicit no-effort.
+        // Do not run ordinary force defaults for null: they require a non-null default.
+        delete body.service_tier;
+        delete body.thinking_budget;
+        delete body.thinking;
+        const reasoning = body.reasoning;
+        if (reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)) {
+          const preserved = { ...reasoning as Rec };
+          delete preserved.effort;
+          if (Object.keys(preserved).length > 0) body.reasoning = preserved;
+          else delete body.reasoning;
+        }
+        if (initialDecision.effort === null) delete body.reasoning_effort;
+        else body.reasoning_effort = initialDecision.effort;
+      } else applyComboEffort(body, config, comboId, target, targetRoute);
       return { route, body, sendBudget: targetSendBudget };
     },
   };
@@ -272,6 +290,7 @@ export interface ComboChildCallbacks {
 export async function dispatchNativeComboChild(input: {
   source: ComboProtocolSource;
   plan: NativeComboChildPlan;
+  comboDispatchPermit?: SingleUseDispatchPermit;
   logCtx: RequestLogContext;
   childLog: RequestLogContext;
   attempt: PersistedUsageAttempt;
@@ -317,6 +336,7 @@ export async function dispatchNativeComboChild(input: {
     childLog,
     attemptHandle,
     sendBudget: plan.sendBudget,
+    comboDispatchPermit: input.comboDispatchPermit,
     ...(input.turnAdmissionLease ? { turnAdmissionLease: input.turnAdmissionLease } : {}),
     onFirstOutput: () => {
       outputSeen = true;

package/src/server/responses/core-combo.ts

@@ -52,11 +52,10 @@ import { routeConcreteModel, comboRouteDecisionTrace } from "../../router";
 import { memoryModelRouteReason } from "./memory-models";
 import { poolAccountProviderLabel } from "../../providers/label";
 import { getAccountSet } from "../../oauth/store";
+import { configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import {
+  anthropicRoutingFor,
   formatAnthropicProviderForLog,
-  getAnthropicAccountHealthSnapshot,
-  getAnthropicPoolRetryAfterSeconds,
-  getEligibleAnthropicAccounts,
 } from "../../oauth/anthropic-routing";
 import { codexAccountLogLabel } from "../../codex/account-label";
 import { codexQuotaScopeForModel, getCodexQuotaHealthSnapshot } from "../../codex/routing";
@@ -118,10 +117,11 @@ export const COMBO_TARGET_BASE_SENDS = CODEX_TEXT_GUARDED_BUDGET_POLICY.baseSend
 
 function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId: string, label: string | undefined): string | undefined {
   if (!label) return undefined;
-  if (providerName === "anthropic") {
-    const matches = getAccountSet("anthropic")?.accounts.filter(account =>
-      formatAnthropicProviderForLog("anthropic", account.id) === label) ?? [];
-    return matches.length === 1 && getAnthropicAccountHealthSnapshot(matches[0]!.id) ? label : undefined;
+  const instance = configuredAnthropicInstance(config, providerName);
+  if (instance && config.providers[providerName]?.authMode === "oauth") {
+    const matches = getAccountSet(instance)?.accounts.filter(account =>
+      formatAnthropicProviderForLog(instance, account.id) === label) ?? [];
+    return matches.length === 1 && anthropicRoutingFor(instance).getAnthropicAccountHealthSnapshot(matches[0]!.id) ? label : undefined;
   }
   const provider = config.providers[providerName];
   if (!provider || !isCanonicalOpenAiForwardProvider(provider)) return undefined;
@@ -152,12 +152,13 @@ export function isAnthropicPoolLocalRefusal(
   failedAccount: string | undefined,
   now = Date.now(),
 ): boolean {
-  return providerName === "anthropic"
+  const instance = configuredAnthropicInstance(config, providerName);
+  return instance !== undefined
     && config.providers[providerName]?.authMode === "oauth"
     && status === 429
     && failedAccount === undefined
-    && getEligibleAnthropicAccounts(now).length === 0
-    && getAnthropicPoolRetryAfterSeconds(now) !== null;
+    && anthropicRoutingFor(instance).getEligibleAnthropicAccounts(now).length === 0
+    && anthropicRoutingFor(instance).getAnthropicPoolRetryAfterSeconds(now) !== null;
 }
 
 /**
@@ -713,30 +714,35 @@ export async function executeComboResponses(
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
-    // The first target seeds the ledger's target identity and charges nothing; every later one
-    // is a real transition, refused once the declared hops, the alternate-target ledger or the
-    // request total are spent. `countedExternally` is required: the child charges its own
-    // physical sends, and charging here as well would halve the cap without saying so.
+    const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+    // The inherited spend tracker observes this parent log, before the child has its own label.
+    logCtx.spendPoolId = targetRoute.providerName;
+    // Derive the target's allowance before booking its initial send; the booking occupies it.
+    const targetSendBudget = comboSendScope
+      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
+      : options.sendBudget;
+    // Every target prepays one send. Only its child may consume that booking; later targets
+    // remain bounded by the shared total, transition ledger and per-target holdback.
+    // `countedExternally` is required: the child charges its own physical sends against this
+    // booking through the exact permit, and charging here as well would halve the cap.
     const hopDecision = comboSendScope?.reserveDispatch({
       sendClass: firstComboTarget ? "initial" : "combo-failover",
       targetKey: `${pick.target.provider}/${pick.target.model}`,
       countedExternally: true,
     });
-    if (hopDecision && hopDecision.allowed) hopDecision.permit.use();
-    else if (hopDecision && firstComboTarget) {
+    if (hopDecision && !hopDecision.allowed && firstComboTarget) {
       // A refused initial reservation authorizes no child send and has no upstream failure to return.
       return formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, "request send budget exhausted before combo dispatch");
     }
-    else if (hopDecision) {
+    else if (hopDecision && !hopDecision.allowed) {
       // Out of budget is not this target's failure. The established exhaustion contract is to
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
       return exhaustedFailure();
     }
-    const targetSendBudget = comboSendScope
-      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
-      : options.sendBudget;
+    const initialSend = hopDecision?.allowed ? { permit: hopDecision.permit, producerOwned: false } : undefined;
+    try {
     comboTargetsDispatched += 1;
     const childLog: RequestLogContext = {
       model: pick.target.model,
@@ -744,7 +750,6 @@ export async function executeComboResponses(
       ...(logCtx.conversationId ? { conversationId: logCtx.conversationId } : {}),
       ...(logCtx.surface ? { surface: logCtx.surface } : {}),
     };
-    const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     const targetReasoningEfforts = supportedLadderFor({
       provider: targetRoute.provider,
       modelId: targetRoute.modelId,
@@ -761,7 +766,7 @@ export async function executeComboResponses(
       initialJevDecision ? initialJevDecision.effort : comboDefaultEffort(config, comboId),
       initialJevDecision?.effort === null ? [] : targetReasoningEfforts,
       combo.reasoningEffortMode,
-      initialJevDecision !== undefined && initialJevDecision.effort !== null ? "force" : combo.defaultEffortMode,
+      initialJevDecision ? (initialJevDecision.effort === null ? "fallback" : "force") : combo.defaultEffortMode,
     );
     if (initialJevDecision) {
       delete childBody.service_tier;
@@ -857,10 +862,11 @@ export async function executeComboResponses(
           && targetEligible(target)
           && !isComboTargetInCooldown(comboId, target),
         );
-      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget);
+      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget, initialJevDecision);
       response = nativeChild ? await dispatchNativeComboChild({
         source: options.protocolSource!,
         plan: nativeChild,
+        comboDispatchPermit: hopDecision?.allowed ? hopDecision.permit : undefined,
         logCtx,
         childLog,
         attempt,
@@ -886,6 +892,8 @@ export async function executeComboResponses(
         // parent arrived with.
         sendBudget: targetSendBudget,
         comboAttempt: true,
+        comboInitialSend: initialSend,
+        comboDispatchPermit: hopDecision?.allowed ? hopDecision.permit : undefined,
         comboReplaySnapshot,
         deferCodexResetDerivedCooldown,
         // Attempt-relative TTFT is recorded HERE (not via childLog.firstOutputMs — a later
@@ -904,8 +912,8 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
-      // Native Chat rebuilds its own body and does not apply the initial JEV effort.
-      restoreOriginalRequestedEffort(childLog, nativeChild ? undefined : initialJevDecision?.effort);
+      // Both lanes applied the initial choice before provider pins/caps; retain those transitions.
+      restoreOriginalRequestedEffort(childLog, initialJevDecision?.effort);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {
@@ -1180,6 +1188,11 @@ export async function executeComboResponses(
       // Waiting or recovery may have observed cancellation after the check above.
       if (options.abortSignal?.aborted) return clientCancelledResponse();
     }
+    } finally {
+      // External receipts make release a no-op after real work. runTurn owns its asynchronous
+      // producer; core transfers cleanup there before returning a streaming response.
+      if (!initialSend?.producerOwned) initialSend?.permit.release();
+    }
   }
   const failure = exhaustedFailure();
   if (

package/src/server/responses/core-lifetime.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -37,42 +38,8 @@ export const UPSTREAM_JSON_BODY_READ_OPTIONS = {
 
 
 
-export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget): Response {
-  if (!response.body) {
-    budget.dispose();
-    return response;
-  }
-  const reader = response.body.getReader();
-  let finalized = false;
-  const finalize = () => {
-    if (finalized) return;
-    finalized = true;
-    budget.dispose();
-  };
-  const body = new ReadableStream<Uint8Array>({
-    async pull(controller) {
-      try {
-        const result = await reader.read();
-        if (result.done) {
-          finalize();
-          controller.close();
-        } else {
-          controller.enqueue(result.value);
-        }
-      } catch (error) {
-        finalize();
-        controller.error(error);
-      }
-    },
-    async cancel(reason) {
-      try { await reader.cancel(reason); } finally { finalize(); }
-    },
-  });
-  const finalizedResponse = new Response(body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers,
-  });
+export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget, signal?: AbortSignal): Response {
+  const finalizedResponse = finalizeTranslatorBudgetResponse(response, budget, signal);
   if (isNativePassthroughSseResponse(response)) {
     markNativePassthroughSseResponse(finalizedResponse);
   }

package/src/server/responses/core-normalize.ts

@@ -210,6 +210,7 @@ export async function applyFinalRouteRequestNormalization(args: {
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
   logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;
+  logCtx.spendPoolId = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
   logCtx.policyEligibility = route.policyEligibility;