@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/server/responses/core-combo-native.ts

@@ -32,7 +32,7 @@ import {
   type RequestLogContext,
 } from "../request-log";
 import { captureRouteStaticPolicy, routeConcreteModel } from "../../router";
-import { comboDefaultEffort, concreteComboRequestBody, getCombo } from "../../combos";
+import { comboDefaultEffort, concreteComboRequestBody, getCombo, type JevDecision } from "../../combos";
 import { supportedLadderFor } from "../effort-policy";
 import { applyDroidReasoningDefault } from "../droid-reasoning-default";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
@@ -94,6 +94,7 @@ export interface ComboProtocolLanes {
     target: ComboTarget,
     targetRoute: RouteResult,
     targetSendBudget: TransientSendBudget | undefined,
+    initialDecision?: Pick<JevDecision, "effort">,
   ): NativeComboChildPlan | undefined;
 }
 
@@ -101,6 +102,7 @@ interface CandidateVerdict {
   skip?: ProtocolFeature[];
 }
 
+/** Build opt-in native eligibility and child plans; only the initial plan applies a JEV choice. */
 export function createComboProtocolLanes(input: {
   source: ComboProtocolSource | undefined;
   req: Request;
@@ -203,7 +205,7 @@ export function createComboProtocolLanes(input: {
         400, unrepresentableMessage(features), "invalid_request_error", "unsupported_feature",
       ), "chat");
     },
-    nativeChild: (target, targetRoute, targetSendBudget) => {
+    nativeChild: (target, targetRoute, targetSendBudget, initialDecision) => {
       // Without the request's execution budget a native child could not share its sends, so it
       // keeps the bridge rather than opening a tracker of its own.
       if (!isRequestExecutionBudget(targetSendBudget)) return undefined;
@@ -214,7 +216,22 @@ export function createComboProtocolLanes(input: {
         provider: targetRoute.provider,
         modelId: targetRoute.modelId,
       });
-      applyComboEffort(body, config, comboId, target, targetRoute);
+      if (initialDecision) {
+        // A validated JEV choice owns only this first dispatch, including explicit no-effort.
+        // Do not run ordinary force defaults for null: they require a non-null default.
+        delete body.service_tier;
+        delete body.thinking_budget;
+        delete body.thinking;
+        const reasoning = body.reasoning;
+        if (reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)) {
+          const preserved = { ...reasoning as Rec };
+          delete preserved.effort;
+          if (Object.keys(preserved).length > 0) body.reasoning = preserved;
+          else delete body.reasoning;
+        }
+        if (initialDecision.effort === null) delete body.reasoning_effort;
+        else body.reasoning_effort = initialDecision.effort;
+      } else applyComboEffort(body, config, comboId, target, targetRoute);
       return { route, body, sendBudget: targetSendBudget };
     },
   };

package/src/server/responses/core-combo.ts

@@ -717,30 +717,32 @@ export async function executeComboResponses(
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
-    // The first target seeds the ledger's target identity and charges nothing; every later one
-    // is a real transition, refused once the declared hops, the alternate-target ledger or the
-    // request total are spent. `countedExternally` is required: the child charges its own
-    // physical sends, and charging here as well would halve the cap without saying so.
+    // Derive the target's allowance before booking its initial send; the booking occupies it.
+    const targetSendBudget = comboSendScope
+      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
+      : options.sendBudget;
+    // Every target prepays one send. Only its child may consume that booking; later targets
+    // remain bounded by the shared total, transition ledger and per-target holdback.
+    // `countedExternally` is required: the child charges its own physical sends against this
+    // booking through the exact permit, and charging here as well would halve the cap.
     const hopDecision = comboSendScope?.reserveDispatch({
       sendClass: firstComboTarget ? "initial" : "combo-failover",
       targetKey: `${pick.target.provider}/${pick.target.model}`,
       countedExternally: true,
     });
-    if (hopDecision && hopDecision.allowed) hopDecision.permit.use();
-    else if (hopDecision && firstComboTarget) {
+    if (hopDecision && !hopDecision.allowed && firstComboTarget) {
       // A refused initial reservation authorizes no child send and has no upstream failure to return.
       return formatErrorResponse(429, SEND_BUDGET_EXHAUSTED_CODE, "request send budget exhausted before combo dispatch");
     }
-    else if (hopDecision) {
+    else if (hopDecision && !hopDecision.allowed) {
       // Out of budget is not this target's failure. The established exhaustion contract is to
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
       return exhaustedFailure();
     }
-    const targetSendBudget = comboSendScope
-      ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
-      : options.sendBudget;
+    const initialSend = hopDecision?.allowed ? { permit: hopDecision.permit, producerOwned: false } : undefined;
+    try {
     comboTargetsDispatched += 1;
     const childLog: RequestLogContext = {
       model: pick.target.model,
@@ -764,7 +766,7 @@ export async function executeComboResponses(
       initialJevDecision ? initialJevDecision.effort : comboDefaultEffort(config, comboId),
       initialJevDecision?.effort === null ? [] : targetReasoningEfforts,
       combo.reasoningEffortMode,
-      initialJevDecision !== undefined && initialJevDecision.effort !== null ? "force" : combo.defaultEffortMode,
+      initialJevDecision ? (initialJevDecision.effort === null ? "fallback" : "force") : combo.defaultEffortMode,
     );
     if (initialJevDecision) {
       delete childBody.service_tier;
@@ -860,7 +862,7 @@ export async function executeComboResponses(
           && targetEligible(target)
           && !isComboTargetInCooldown(comboId, target),
         );
-      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget);
+      const nativeChild = protocolLanes?.nativeChild(pick.target, targetRoute, targetSendBudget, initialJevDecision);
       response = nativeChild ? await dispatchNativeComboChild({
         source: options.protocolSource!,
         plan: nativeChild,
@@ -890,6 +892,7 @@ export async function executeComboResponses(
         // parent arrived with.
         sendBudget: targetSendBudget,
         comboAttempt: true,
+        comboInitialSend: initialSend,
         comboDispatchPermit: hopDecision?.allowed ? hopDecision.permit : undefined,
         comboReplaySnapshot,
         deferCodexResetDerivedCooldown,
@@ -909,8 +912,8 @@ export async function executeComboResponses(
         onNativePassthroughCancel: callbackGate.onCancel,
         onResponseComplete: callbackGate.onResponseComplete,
       });
-      // Native Chat rebuilds its own body and does not apply the initial JEV effort.
-      restoreOriginalRequestedEffort(childLog, nativeChild ? undefined : initialJevDecision?.effort);
+      // Both lanes applied the initial choice before provider pins/caps; retain those transitions.
+      restoreOriginalRequestedEffort(childLog, initialJevDecision?.effort);
     } catch (error) {
       callbackGate.discard();
       if (options.abortSignal?.aborted) {
@@ -1185,6 +1188,11 @@ export async function executeComboResponses(
       // Waiting or recovery may have observed cancellation after the check above.
       if (options.abortSignal?.aborted) return clientCancelledResponse();
     }
+    } finally {
+      // External receipts make release a no-op after real work. runTurn owns its asynchronous
+      // producer; core transfers cleanup there before returning a streaming response.
+      if (!initialSend?.producerOwned) initialSend?.permit.release();
+    }
   }
   const failure = exhaustedFailure();
   if (

package/src/server/responses/core-lifetime.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -37,42 +38,8 @@ export const UPSTREAM_JSON_BODY_READ_OPTIONS = {
 
 
 
-export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget): Response {
-  if (!response.body) {
-    budget.dispose();
-    return response;
-  }
-  const reader = response.body.getReader();
-  let finalized = false;
-  const finalize = () => {
-    if (finalized) return;
-    finalized = true;
-    budget.dispose();
-  };
-  const body = new ReadableStream<Uint8Array>({
-    async pull(controller) {
-      try {
-        const result = await reader.read();
-        if (result.done) {
-          finalize();
-          controller.close();
-        } else {
-          controller.enqueue(result.value);
-        }
-      } catch (error) {
-        finalize();
-        controller.error(error);
-      }
-    },
-    async cancel(reason) {
-      try { await reader.cancel(reason); } finally { finalize(); }
-    },
-  });
-  const finalizedResponse = new Response(body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers,
-  });
+export function finalizeOwnedTranslatorBudget(response: Response, budget: TranslatorBudget, signal?: AbortSignal): Response {
+  const finalizedResponse = finalizeTranslatorBudgetResponse(response, budget, signal);
   if (isNativePassthroughSseResponse(response)) {
     markNativePassthroughSseResponse(finalizedResponse);
   }

package/src/server/responses/core-opaque-recovery.ts

@@ -465,13 +465,13 @@ export function resetStreamedOpaqueBlobLogContext(logCtx: RequestLogContext): vo
 export type OpaqueBlobRecoveryGuard = { attempted: boolean };
 
 
-export type OpaqueBlobRecoveryResult =
+export type OpaqueBlobRecoveryResult<Failure = Response> =
   | { kind: "skipped" }
   | { kind: "recovered"; response: Response }
-  | { kind: "failed"; response: Response };
+  | { kind: "failed"; response: Failure };
 
 
-export async function attemptOpaqueBlobRecovery(
+export async function attemptOpaqueBlobRecovery<Failure = Response>(
   args: {
     response: Response;
     outboundBody?: string;
@@ -480,8 +480,8 @@ export async function attemptOpaqueBlobRecovery(
     guard: OpaqueBlobRecoveryGuard;
     signal: AbortSignal;
   },
-  rebuild: (kind: AttemptRecoveryKind) => Promise<Response | { failed: Response }>,
-): Promise<OpaqueBlobRecoveryResult> {
+  rebuild: (kind: AttemptRecoveryKind) => Promise<Response | { failed: Failure }>,
+): Promise<OpaqueBlobRecoveryResult<Failure>> {
   const errorBody = await opaqueBlobRejectionBodyForRecovery(
     args.response,
     args.outboundBody,

package/src/server/responses/core-options.ts

@@ -16,6 +16,7 @@ import type { ExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import type { CallerDirectAuth } from "../../providers/caller-authorization";
 import type { CompactionRoutingOverride } from "./compaction-routing";
 import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { NativeReasoningOwner } from "../../responses/reasoning-replay-cache";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
@@ -134,6 +135,8 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  nativeReasoningReplay?: ReadonlyMap<string, string>;
+  nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
   droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */
@@ -158,6 +161,8 @@ export interface HandleResponsesOptions {
   callerDirectAuth?: CallerDirectAuth | null;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
+  /** Child-owned prepaid initial send; capacity remains charged until dispatch or unsent release. */
+  comboInitialSend?: { permit: SingleUseDispatchPermit; producerOwned?: boolean };
   /** Exact externally booked combo hop, used for its child's spend preflight and send reports. */
   comboDispatchPermit?: SingleUseDispatchPermit;
   /** Internal handoff: this combo was selected by shadow-call interception. */

package/src/server/responses/core-replay.ts

@@ -19,6 +19,9 @@ import {
   reasoningReplayCodexCredentialIdentity,
   reasoningReplayKeyCredentialIdentity,
   durableReplayDestinationIdentity,
+  nativeReasoningTag,
+  nativeReasoningTagMatches,
+  type NativeReasoningOwner,
   bindReasoningReplayScope,
   reasoningReplayServingIdentityChanged,
   reasoningReplayItemStoreChanged,
@@ -118,6 +121,16 @@ export function bindRouteReasoningReplayScope(args: {
     ...args,
     modelId: parsed.modelId,
   });
+  const owner = nativeReasoningOwnerForRoute(args);
+  if (owner) parsed._nativeReasoningBoundOwner = owner;
+  else delete parsed._nativeReasoningBoundOwner;
+  if (parsed._nativeReasoningReplay?.size) {
+    for (const [blob, tag] of parsed._nativeReasoningReplay) {
+      if (!nativeReasoningTagMatches(nativeReasoningTag(owner, blob), tag)) {
+        stripNativeReasoningBlob(parsed, blob);
+      }
+    }
+  }
   const continuationDestinationIdentity = providerContinuationDestinationIdentity(parsed, provider);
   const continuationOwner = providerContinuationOwnerFromReplayIdentity(
     replayIdentity && continuationDestinationIdentity
@@ -156,6 +169,66 @@ export function bindRouteReasoningReplayScope(args: {
   bindProviderContinuationForRoute(parsed, continuationOwner);
 }
 
+function stripNativeReasoningBlob(parsed: OcxParsedRequest, blob: string): void {
+  const input = (parsed._rawBody as { input?: unknown } | undefined)?.input;
+  if (Array.isArray(input)) {
+    for (const item of input) {
+      if (item && typeof item === "object" && item.type === "reasoning" && item.encrypted_content === blob) {
+        delete item.encrypted_content;
+        delete item.id;
+      }
+    }
+  }
+  for (const message of parsed.context.messages) {
+    if (message.role !== "assistant" || !Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (part.type !== "thinking" || typeof part.signature !== "string") continue;
+      try {
+        const item: unknown = JSON.parse(part.signature);
+        if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+        const reasoning = item as Record<string, unknown>;
+        if (reasoning.type !== "reasoning" || reasoning.encrypted_content !== blob) continue;
+        delete reasoning.encrypted_content;
+        delete reasoning.id;
+        part.signature = JSON.stringify(reasoning);
+        delete part.itemId;
+      } catch { /* A provider signature is not the parser's JSON carrier. */ }
+    }
+  }
+}
+
+export function nativeReasoningOwnerForRoute(args: {
+  provider: OcxProviderConfig;
+  oauthCredentialSnapshot?: Pick<OAuthAccessSnapshot, "accountId" | "generation">;
+  codexAuthContext?: CodexAuthContext;
+}): NativeReasoningOwner | undefined {
+  const { provider } = args;
+  const salt = thoughtSignatureReplaySalt();
+  if (!salt || salt.length < 16) return undefined;
+  const destination = durableReplayDestinationIdentity(JSON.stringify([
+    provider.baseUrl.trim().replace(/\/+$/, ""), provider.responsesPath ?? "",
+  ]));
+  let credential: string | undefined;
+  if (provider.authMode === "oauth") {
+    const snapshot = args.oauthCredentialSnapshot;
+    if (snapshot?.accountId && snapshot.generation !== undefined) credential = durableReplayCredentialIdentity(
+      "oauth", `${snapshot.accountId}\0${snapshot.generation}`, provider.headers, salt,
+    );
+  } else if (provider.authMode === "forward") {
+    const context = args.codexAuthContext;
+    if (context && (context.kind === "pool" || context.kind === "main-pool")
+      && context.accountId && context.writerGeneration !== undefined
+      && (context.kind !== "pool" || context.generation !== undefined)) {
+      credential = durableReplayCredentialIdentity("codex", JSON.stringify([
+        context.accountId, context.kind === "pool" ? context.generation : null, context.writerGeneration,
+      ]), provider.headers, salt);
+    }
+  } else if (provider.authMode !== "local") {
+    credential = durableReplayCredentialIdentity("key", nonEmptyProviderApiKey(provider), provider.headers, salt);
+  }
+  return destination && credential ? { destination, credential } : undefined;
+}
+
 
 function routeReasoningReplayIdentity(args: {
   providerName: string;

package/src/server/responses/core.ts

@@ -28,9 +28,6 @@ import { deliverAdapterResponse } from "./adapter-delivery";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 import { runWithCompactionRecovery } from "./compaction-recovery";
-
-/** Public Responses entry and compatibility exports. Implementations live with their owners. */
-
 /**
  * Route one `/v1/responses` request through the adapter pipeline: recovery loop, passthrough
  * wire, image/web-search bridges, and the terminal-guard continuation.
@@ -66,16 +63,17 @@ export async function handleResponses(
       // Once at ingress, spend observer included: a combo child inherits the parent's holder.
       sendBudget: options.sendBudget ?? createInferenceSendBudget(req, logCtx),
     }, handleResponsesInner);
-    const finalResponse = ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
+    const finalResponse = ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget, abortSignal) : response;
     if (!accountLoad.lease) { release(); return finalResponse; }
     return finalizeAccountLease(finalResponse, release);
   } catch (error) {
     release();
     if (ownsBudget) translatorBudget.dispose();
     throw error;
+  } finally {
+    if (!options.comboInitialSend?.producerOwned) options.comboInitialSend?.permit.release();
   }
 }
-
 export async function handleComboResponses(
   req: Request,
   rawBody: unknown,
@@ -94,7 +92,6 @@ export async function handleComboResponses(
     requestDispatchers,
   );
 }
-
 /** Compose request phases while retaining the original admission-finally ownership. */
 async function handleResponsesInner(
   req: Request,
@@ -107,6 +104,7 @@ async function handleResponsesInner(
     pendingHostAdmissionLease: null,
     authCtx: { kind: "main", accountId: null },
   };
+  let releasePendingSend = () => {};
   try {
     const requestState = await prepareResponsesRequest(requestContext, admissionState, requestDispatchers);
     if (requestState instanceof Response) return requestState;
@@ -124,7 +122,7 @@ async function handleResponsesInner(
     const sendBudgetState = createResponsesSendBudget(requestContext);
     if (sendBudgetState instanceof Response) return sendBudgetState;
     if ("passthrough" in transportState.adapter && transportState.adapter.passthrough && !sidecarState.routedCompaction) {
-      return await executePassthroughResponse(
+      const passthroughResult = await executePassthroughResponse(
         requestContext,
         admissionState,
         requestState,
@@ -133,6 +131,9 @@ async function handleResponsesInner(
         responseEffects,
         sendBudgetState,
       );
+      if (passthroughResult instanceof Response) return passthroughResult;
+      const unclaimedHop = sendBudgetState.pendingHopPermit;
+      releasePendingSend = () => { if (sendBudgetState.pendingHopPermit === unclaimedHop) { unclaimedHop?.release(); sendBudgetState.pendingHopPermit = undefined; } };
     }
     const sidecarPlans = await executeResponsesSidecars(
       requestContext,
@@ -182,15 +183,14 @@ async function handleResponsesInner(
       continuationState,
     );
   } finally {
+    releasePendingSend();
     if (admissionState.pendingHostAdmissionLease) {
       releaseUpstreamHostAdmission(admissionState.pendingHostAdmissionLease);
       releaseCodexAuthContextProbeLease(admissionState.authCtx);
     }
   }
 }
-
 const requestDispatchers: ResponsesDispatchers = { handleResponses, handleComboResponses };
-
 export { adapterNeedsForcedContinuation } from "./core-replay";
 export {
   sidecarOutcomeRecorder, codexLogAccountId, usesCodexForwardPoolAuth, preAuthUpstreamHostCircuitKey,

package/src/server/responses/empty-completion-guard.ts

@@ -293,11 +293,27 @@ export async function* guardEmptyCompletionEventStream(
         return;
       }
       if (event.type === "error") {
-        if (retries > 0 && event.status !== 499) {
+        if (event.replaySafeBeforeOutput === true && retries < maxRetries) {
+          // The upstream failed the turn before any text or tool call (#6876: Vertex dropped a
+          // malformed function call). Nothing actionable reached the client, so this is the same
+          // replay-safe shape as an empty completion: retry the identical turn once.
+          usage = mergeUsage(usage, event.usage);
+          retries += 1;
+          try {
+            source = await options.continuation();
+          } catch {
+            yield emptyCompletionRetryFailedEvent(usage, true);
+            return;
+          }
+          terminalSeen = true;
+          break;
+        }
+        if (retries > 0 && event.status !== 499 && event.replaySafeBeforeOutput !== true) {
           // The retry failed upstream. Its body cannot reach the client (the
           // 200 head went out with the first attempt), so state the failure in
           // the stream's own error framing — same move as the router's
-          // empty_completion_retry_failed. Client cancels (499) pass through.
+          // empty_completion_retry_failed. Client cancels (499) pass through, and a
+          // replay-safe failure that repeats keeps its own, more specific message.
           yield emptyCompletionRetryFailedEvent(mergeUsage(usage, event.usage), true);
           return;
         }

package/src/server/responses/fetch-helpers.ts

@@ -43,6 +43,10 @@ const pacingWebsocketDowngradeWarned = new Set<string>();
  */
 const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
+// Survives queued credential rebuilds and executor replacement without importing budget owners.
+const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// One WS attempt and its HTTP fallback are one logical physical-send receipt.
+const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -200,6 +204,7 @@ export function sendWithConnectionPolicy(
   const largeCodexBody = typeof body === "string"
     && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
+  (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
   return physicalFetch(input, {
     ...init,
     ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
@@ -233,10 +238,13 @@ export interface ProviderFetchOptions {
   onCodexWsQuota?: CodexWsQuotaObserver;
   /** Synchronous admission at actual credential dispatch, after pacing/backoff. */
   beforeDispatch?: (headers: Headers) => void;
+  /** One-shot receipt after final local HTTP admission, immediately before executor entry. */
+  onPhysicalDispatch?: () => void;
   /** Revalidate/rebuild a queued request at its physical send boundary, after pacing. */
   dispatchOverride?: (input: Parameters<typeof globalThis.fetch>[0], init: RequestInit, execute: typeof globalThis.fetch) => Promise<Response>;
 }
 
+/** Compose provider pacing and transport admission; receipts run only at executor entry. */
 export function providerFetch(
   provider: OcxProviderConfig,
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
@@ -301,7 +309,14 @@ export function providerFetch(
       options.beforeDispatch?.(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
       // No proxy option is attached here: a `dispatchOverride` may rebuild this request against
       // a different destination, so the route is decided at the physical send instead.
-      const dispatchInit = { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 };
+      const sharedReceipt = (init as Record<symbol, (() => void) | undefined> | undefined)?.[WS_FALLBACK_RECEIPT];
+      let notified = false;
+      const dispatchInit = { ...withUpstreamHttpVersion(input, init, provider), timeout: 0,
+        ...(options.onPhysicalDispatch ? { [PHYSICAL_DISPATCH]: () => {
+          if (sharedReceipt) sharedReceipt();
+          else if (!notified) { options.onPhysicalDispatch!(); notified = true; }
+        } } : {}),
+      };
       return options.dispatchOverride
         ? options.dispatchOverride(input, dispatchInit, dispatch)
         : dispatch(input, dispatchInit);
@@ -332,8 +347,16 @@ export function providerFetch(
       // used, protocol pin included: a WS turn that falls back is serving the
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
       // there would silently negotiate a transport the operator ruled out.
-      return codexWsUpstreamFetch(input, init, httpFetch, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); });
+      let notified = false;
+      const notifyOnce = (): void => {
+        if (notified) return;
+        notified = true;
+        options.onPhysicalDispatch?.();
+      };
+      const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
+        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit)) as typeof globalThis.fetch;
+      return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce);
     }
     return httpFetch(input, init);
   };

package/src/server/responses/jev-model-invoke.ts

@@ -136,7 +136,7 @@ export function createJevModelInvoker(context: JevModelInvokerContext): JevModel
     if (new TextEncoder().encode(body).byteLength > JEV_MAX_REQUEST_BYTES) {
       throw new JevModelInvokeError("malformed", "decision request too large");
     }
-    const lease = tryAdmitTurn();
+    const lease = tryAdmitTurn(undefined, signal);
     if (!lease) throw new JevModelInvokeError("network", "decision turn not admitted");
     const childLog: RequestLogContext = { model, provider: "unknown", inboundProtocol: "responses" };
     let usage: Record<string, number> | undefined;

package/src/server/responses/passthrough-delivery.ts

@@ -24,13 +24,16 @@ import { teeWithBoundedInspection } from "../inspection-tee";
 import {
   codexForwardTerminalOutcomeRecorder,
   usesCodexForwardPoolAuth,
+  liveMainQuotaDispatch,
   codexQuotaOutcomeMeta,
   codexDenialOutcomeMeta,
   isFixedCodexAccount,
   shouldDeferCodexResetDerivedCooldown,
 } from "./core-codex-account";
+import { isMainQuotaDispatchLive, isMainQuotaDispatchWsClaimed } from "../../codex/main-account-cache";
+import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/account-id";
 import type { ResponsesTerminalStatus } from "../../bridge";
-import { isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse } from "./ws-upstream";
+import { isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse, isCodexWsPreludeProjection } from "./ws-upstream";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant, releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
@@ -139,6 +142,7 @@ import {
   httpStatusFromTerminalError,
   inspectResponseLogJson,
   inspectResponseLogSsePayloadParsed,
+  noteUpstreamRequestId,
 } from "../request-log";
 import { restoreRoutedCustomCallsInJson } from "../../responses/custom-tool-compat";
 import { restoreRoutedToolSearchCallsInJson } from "../../responses/tool-search-compat";
@@ -406,6 +410,9 @@ export async function deliverPassthroughResponse(
     | "localUpstream"
   >,
 ): Promise<Response> {
+  const { route } = requestState;
+  // The proof must belong to the response whose headers are published.
+  const arrivalMainDispatch = liveMainQuotaDispatch(admissionState.authCtx, route.provider);
   const { logCtx, config, options, req } = requestContext;
   const {
     codexSafetyBufferingOptions,
@@ -429,7 +436,7 @@ export async function deliverPassthroughResponse(
     normalizeFunctionCompletionJson,
   } = nativeExchange;
   const { commitReasoningReplayServingRoute, recordTerminalOutcomes } = responseEffects;
-  const { parsed, route, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
+  const { parsed, subagentQuotaFailureModel, clientRequestedStream, translatorBudget, inboundWire } = requestState;
   const enforceDeclaredToolNames = inboundWire !== "chat" && inboundWire !== "anthropic";
   const { openAiSidecar } = sidecarState;
   const { requestBindings } = transportState;
@@ -452,6 +459,7 @@ export async function deliverPassthroughResponse(
   }
 
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers, codexSafetyBufferingOptions);
+    if (!upstreamResponse.ok) noteUpstreamRequestId(logCtx, headers);
     const resolvedModel = headers.get("openai-model")?.trim();
     if (resolvedModel) {
       logCtx.servedModel = resolvedModel;
@@ -535,6 +543,20 @@ export async function deliverPassthroughResponse(
           ...(admissionState.authCtx.kind === "pool" ? { credentialGeneration: admissionState.authCtx.generation } : {}),
         });
       }
+    } else {
+      // The WS observer is the only plain-main publisher for a WebSocket exchange;
+      // a prelude projection carries the prelude snapshot, not fresh evidence.
+      // The dispatch claim is authoritative because downstream wrappers can replace the Response.
+      if (arrivalMainDispatch && !isMainQuotaDispatchWsClaimed(arrivalMainDispatch)
+        && !(isCodexWsUpstreamResponse(upstreamResponse) || isCodexWsPreludeProjection(upstreamResponse))) {
+        const { applyAccountQuotaFromUpstreamHeaders } = await import("../../codex/auth-api");
+        // Import yields; same-account token replacement leaves the identity writer live.
+        // Re-check the credential fence with no await before publication.
+        if (isMainQuotaDispatchLive(arrivalMainDispatch)) {
+          applyAccountQuotaFromUpstreamHeaders(MAIN_CODEX_ACCOUNT_ID, upstreamResponse.headers,
+            arrivalMainDispatch.configGeneration, arrivalMainDispatch.writer, { modelId: route.modelId });
+        }
+      }
     }
 
     // Non-2xx passthrough failures must never reach Codex as an empty body —