@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/server/responses/compact.ts

@@ -200,6 +200,7 @@ import {
   usesCodexForwardPoolAuth,
 } from "./core";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel } from "./fetch-helpers";
+import { shouldRetryCodexPoolAccountQuota, shouldRetryCodexPoolAccountTransient } from "./core-codex-account";
 import { mapCodexAuthContextErrorToResponse, nativeMainRefreshFailureResponse } from "./codex-auth-error";
 import { linkRequestSessionLane, sessionLaneIdFromRequest } from "../request-log-conversation";
 import { recallComboForLane } from "./combo-session-recall";
@@ -1048,7 +1049,11 @@ export async function handleResponsesCompact(
         targetKey: compactTargetKey,
       });
       if (!decision.allowed) return Promise.reject(new SendBudgetExhaustedError(safeHostLabel(compactUrl)));
-      if (!decision.permit.use()) return Promise.reject(new SendBudgetExhaustedError(safeHostLabel(compactUrl)));
+      if (!decision.permit.use()) {
+        // Nothing was sent, so the reservation goes back rather than holding a send against the request.
+        decision.permit.release();
+        return Promise.reject(new SendBudgetExhaustedError(safeHostLabel(compactUrl)));
+      }
       return doFetch();
     };
     const sendCompactAttempt = (
@@ -1056,6 +1061,7 @@ export async function handleResponsesCompact(
       sendHeaders: Headers,
       recovery: "normal" | "single",
       sendAuthCtx: CodexAuthContext,
+      onPhysicalDispatch?: () => void,
     ): Promise<Response> => {
       const doFetch = (upstreamRecovery?: UpstreamSendRecovery) => fetchWithHeaderTimeout(
         compactUrl,
@@ -1072,6 +1078,7 @@ export async function handleResponsesCompact(
           modelId: route.modelId,
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
+          ...(onPhysicalDispatch ? { onPhysicalDispatch } : {}),
         }),
         // Every credential-bearing forward send gets manual redirects, not only
         // pool sends: direct mode carries the caller's credential too (#914).
@@ -1217,6 +1224,53 @@ export async function handleResponsesCompact(
       }
     }
 
+    // The settle for an alternate send that threw, shared by the quota and transient moves. By the
+    // time it runs the request already names the alternate (outcomeCtx), so health goes to it.
+    const failedAlternateCompactSend = (err: unknown): Response => {
+      if (req.signal.aborted) {
+        recordCompactPoolOutcome(outcomeCtx, 499);
+        return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      }
+      const localRefusal = localDispatchRefusal(err);
+      if (localRefusal) return localRefusal;
+      const outcome = classifyTransportFailureKind(err);
+      // Host-level evidence stands regardless of pool membership (#914 review).
+      if (outcome === "connect_neutral") {
+        if (compactHostCircuitEnabled) {
+          recordUpstreamHostFailure(actualCompactHostKey, {
+            code: transportErrorCode(err),
+            threshold: config.upstreamHostCircuitThreshold,
+            lease: compactHostAdmissionLease,
+          });
+        } else {
+          recordUpstreamHostFailure(actualCompactHostKey, { code: transportErrorCode(err) });
+        }
+      } else {
+        releaseUpstreamHostAdmission(compactHostAdmissionLease);
+      }
+      compactHostAdmissionLease = null;
+      recordCompactPoolOutcome(outcomeCtx, outcome);
+      return formatErrorResponse(502, "upstream_error", "Failed to connect to compact upstream");
+    };
+    const scrubCompactStateForAlternate = (alternateAuthCtx: CodexAuthContext): void => {
+      const binding = conversationStateBindingFromAuth(
+        alternateAuthCtx,
+        (authCtx.kind === "pool" || authCtx.kind === "main-pool")
+          ? authCtx.affinityKey
+          : codexPoolAffinityKey(req.headers),
+      );
+      if (!binding) return;
+      for (const body of [raw, compactBody]) {
+        applyAccountChangeConversationStateScrub({
+          body,
+          bindingKey: binding.bindingKey,
+          servingAccountId: binding.accountId,
+          priorAccountId: authCtx.accountId,
+          logCtx,
+        });
+      }
+    };
+
     // Bounded same-request alternate: the regular /v1/responses path already does this
     // (core.ts:319-423) and recognizes exactly 429/402. Without it a pool rejection
     // surfaces to the client, which retries the compact task OUTSIDE the logical request
@@ -1317,57 +1371,81 @@ export async function handleResponsesCompact(
         await upstream.body?.cancel().catch(() => undefined);
         outcomeCtx = alternate.authCtx;
         logCtx.accountLogLabel = codexAuthContextLogLabel(alternate.authCtx, config);
-        {
-          const binding = conversationStateBindingFromAuth(
-            alternate.authCtx,
-            (authCtx.kind === "pool" || authCtx.kind === "main-pool")
-              ? authCtx.affinityKey
-              : codexPoolAffinityKey(req.headers),
-          );
-          if (binding) {
-            applyAccountChangeConversationStateScrub({
-              body: raw,
-              bindingKey: binding.bindingKey,
-              servingAccountId: binding.accountId,
-              priorAccountId: authCtx.accountId,
-              logCtx,
-            });
-            applyAccountChangeConversationStateScrub({
-              body: compactBody,
-              bindingKey: binding.bindingKey,
-              servingAccountId: binding.accountId,
-              priorAccountId: authCtx.accountId,
-              logCtx,
-            });
-          }
-        }
+        scrubCompactStateForAlternate(alternate.authCtx);
         try {
           upstream = await sendCompactAttempt(alternate.provider, alternate.headers, "single", alternate.authCtx);
         } catch (err) {
-          if (req.signal.aborted) {
-            recordCompactPoolOutcome(outcomeCtx, 499);
-            return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
-          }
-          const localRefusal = localDispatchRefusal(err);
-          if (localRefusal) return localRefusal;
-          const outcome = classifyTransportFailureKind(err);
-          // Host-level evidence stands regardless of pool membership (#914 review).
-          if (outcome === "connect_neutral") {
-            if (compactHostCircuitEnabled) {
-              recordUpstreamHostFailure(actualCompactHostKey, {
-                code: transportErrorCode(err),
-                threshold: config.upstreamHostCircuitThreshold,
-                lease: compactHostAdmissionLease,
-              });
-            } else {
-              recordUpstreamHostFailure(actualCompactHostKey, { code: transportErrorCode(err) });
-            }
-          } else {
-            releaseUpstreamHostAdmission(compactHostAdmissionLease);
+          return failedAlternateCompactSend(err);
+        }
+      }
+    }
+    // A transient 5xx that survived the same-account ladder above (#6969). The regular path moves
+    // it to another Pool account; compact used to move only on 429/402, so the client retried the
+    // compact task outside this request while another account sat idle. One bounded alternate send,
+    // the same guards as the quota move, and a 5xx whose body confirms quota keeps today's path.
+    if (
+      shouldRetryCodexPoolAccountTransient(upstream)
+      && !storedPool401ReplayAttempted
+      && usesCodexForwardPoolAuth(authCtx, route.provider)
+      && !authCtx.fixedAccount
+      && route.codexAccountMode
+      && outcomeCtx === authCtx
+      && !req.signal.aborted
+      && !conversationCarriesUploadedFiles(raw)
+      && !await shouldRetryCodexPoolAccountQuota(upstream, req.signal)
+    ) {
+      const firstStatus = upstream.status;
+      const firstRetryAfter = upstream.headers.get("retry-after");
+      const firstResetAt = [
+        upstream.headers.get("x-codex-primary-reset-at"),
+        upstream.headers.get("x-codex-secondary-reset-at"),
+        upstream.headers.get("x-codex-tertiary-reset-at"),
+      ].filter(Boolean);
+      const alternate = await resolveAlternateCompactContext({
+        req,
+        admission,
+        config,
+        route,
+        selectedModelId,
+        excludeAccountId: authCtx.accountId,
+        turnAdmissionLease,
+      });
+      if (alternate && req.signal.aborted) {
+        releaseCodexAuthContextProbeLease(alternate.authCtx);
+        recordCompactPoolOutcome(outcomeCtx, 499);
+        void upstream.body?.cancel(req.signal.reason).catch(() => undefined);
+        return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      }
+      if (alternate) {
+        const firstLabel = logCtx.accountLogLabel;
+        // B's identity before B's admission, so every budget and spend check runs against B. A's
+        // response stays intact until B is actually sent.
+        logCtx.accountLogLabel = codexAuthContextLogLabel(alternate.authCtx, config);
+        scrubCompactStateForAlternate(alternate.authCtx);
+        const recordFirstMove = () => {
+          recordCompactPoolOutcome(authCtx, firstStatus, { retryAfter: firstRetryAfter, resetAt: firstResetAt });
+          void upstream.body?.cancel().catch(() => undefined);
+          outcomeCtx = alternate.authCtx;
+        };
+        let alternateResponse: Response | undefined;
+        // Whether B's send actually left this process. Every local refusal before that point -- a
+        // spent budget, a dispatch guard such as disabled credits, a pacing refusal -- keeps A.
+        let alternateDispatched = false;
+        try {
+          alternateResponse = await sendCompactAttempt(alternate.provider, alternate.headers, "single", alternate.authCtx,
+            () => { alternateDispatched = true; });
+        } catch (err) {
+          if (alternateDispatched) {
+            recordFirstMove();
+            return failedAlternateCompactSend(err);
           }
-          compactHostAdmissionLease = null;
-          recordCompactPoolOutcome(outcomeCtx, outcome);
-          return formatErrorResponse(502, "upstream_error", "Failed to connect to compact upstream");
+          // Refused before anything left: A's answer and identity stand, recorded once below.
+          logCtx.accountLogLabel = firstLabel;
+          releaseCodexAuthContextProbeLease(alternate.authCtx);
+        }
+        if (alternateResponse) {
+          recordFirstMove();
+          upstream = alternateResponse;
         }
       }
     }

package/src/server/responses/context-overflow.ts

@@ -1,7 +1,19 @@
-import { bridgeToResponsesSSE } from "../../bridge";
+import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
+import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { AdapterEvent } from "../../types";
 
+/**
+ * The Ollama late-attribution refusal as a client response: the existing translator-budget
+ * wire shape (413 request_too_large) with only the proxy-owned constant as its message.
+ * It is deliberately not a context overflow: compacting on the same route cannot shrink it.
+ */
+export function lateAttributionLimitResponse(): Response {
+  return formatErrorResponse(413, "request_too_large", OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE, {
+    code: "translation_buffer_limit",
+  });
+}
+
 export const PROVIDER_INPUT_TOO_LARGE_MESSAGE =
   "The provider rejected this turn because its input exceeds the provider size or context limit. Reduce the current input or compact the conversation before retrying.";
 

package/src/server/responses/core-codex-account.ts

@@ -22,7 +22,15 @@ import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { formatErrorResponse } from "../../bridge";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { upstreamErrorMessageFromPayload, isRateLimitOrQuotaFailureMessage } from "../../lib/errors";
-import { isNonReplayableResponse, isTransientUpstreamStatus } from "../../lib/upstream-retry";
+import { isNonReplayableResponse, isTransientUpstreamStatus, SendBudgetExhaustedError } from "../../lib/upstream-retry";
+import {
+  codexWsPreOutputRefusalHold,
+  codexWsPreOutputRefusalOutcomeRecorded,
+  isCodexWsPreOutputRefusal,
+  noteCodexWsPreOutputRefusalOutcome,
+  restoreCodexWsPreOutputRefusal,
+  type CodexWsPreOutputRefusalHold,
+} from "./codex-ws-wire";
 import type { RequestLogContext } from "../request-log";
 import type { DataPlaneAdmission } from "../auth-cors";
 import type { InboundWire } from "../../providers/registry";
@@ -121,6 +129,90 @@ export function usesCodexForwardPoolAuth(
     && provider.authMode === "forward" && provider.adapter === "openai-responses";
 }
 
+/**
+ * Write a pre-output refusal projection's account outcome once (#6969), for an exit that no other
+ * owner records: a caller abort or a local send-budget refusal during the same-account backoff,
+ * where the transport-failure path writes no account health and the restored stream never reaches
+ * delivery. A projection already recorded by the alternate-account helper is left alone.
+ */
+export function recordCodexPreOutputRefusalOutcome(
+  config: OcxConfig,
+  authCtx: CodexAuthContext,
+  provider: OcxProviderConfig,
+  response: Response,
+  modelId: string,
+): void {
+  if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  noteCodexWsPreOutputRefusalOutcome(response);
+  recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
+    threadId: authCtx.affinityKey,
+    fixedAccount: authCtx.fixedAccount,
+    modelId,
+    probeLeaseId: codexProbeLeaseId(authCtx),
+    probeQuotaScope: codexProbeQuotaScope(authCtx),
+    transientProbe: codexTransientProbeGrant(authCtx),
+    writerGeneration: authCtx.writerGeneration,
+  });
+}
+
+/**
+ * The pre-output refusal hold for one Pool send starting now (#6969), or undefined. Pool forward
+ * sends only, and never a combo child, whose own stream preflight already advances on a zero-output
+ * terminal. Every projection a send produces must later pass through
+ * {@link PoolPreOutputRefusals.restore}.
+ */
+export function poolPreOutputRefusalHold(
+  authCtx: CodexAuthContext,
+  provider: OcxProviderConfig,
+  connectMs: number,
+  comboAttempt: boolean | undefined,
+): CodexWsPreOutputRefusalHold | undefined {
+  return !comboAttempt && usesCodexForwardPoolAuth(authCtx, provider) ? codexWsPreOutputRefusalHold(connectMs) : undefined;
+}
+
+/**
+ * One dispatch's view of its pre-output refusal projections (#6969): the last one the initial
+ * transient ladder observed, the single exit where the dispatch itself must record it, and the
+ * restore that hands the client the original stream.
+ */
+export class PoolPreOutputRefusals {
+  private last: Response | undefined;
+  /** True when the response handed to delivery is a restored projection already recorded. */
+  outcomeRecorded = false;
+
+  readonly observe = (response: Response): Response => {
+    if (isCodexWsPreOutputRefusal(response)) this.last = response;
+    return response;
+  };
+
+  /**
+   * One owner per exceptional exit of the initial ladder. A caller abort or a local budget refusal
+   * during the backoff leaves the transport-failure path writing no account health, so the refusal
+   * already observed is recorded here; any other exception keeps that path as its single writer.
+   */
+  recordOnLocalExit(
+    error: unknown,
+    aborted: boolean,
+    config: OcxConfig,
+    authCtx: CodexAuthContext,
+    provider: OcxProviderConfig,
+    modelId: string,
+  ): void {
+    if (!this.last || !(aborted || error instanceof SendBudgetExhaustedError)) return;
+    recordCodexPreOutputRefusalOutcome(config, authCtx, provider, this.last, modelId);
+  }
+
+  /**
+   * Called right after the Pool block on every recovery pass: a projection that survived the ladder
+   * and the account move becomes the original event stream before any later reader sees it.
+   */
+  restore(response: Response): Response {
+    this.outcomeRecorded = isCodexWsPreOutputRefusal(response) && codexWsPreOutputRefusalOutcomeRecorded(response);
+    return restoreCodexWsPreOutputRefusal(response);
+  }
+}
+
 
 /** Live proof that this plain-main response used the observed main credential. */
 export function liveMainQuotaDispatch(
@@ -368,6 +460,10 @@ export async function shouldRetryCodexScopedQuotaOnAlternate(
  * could duplicate a turn the origin may still be running. A 5xx whose body confirms quota is not
  * routed here either — {@link shouldRetryCodexPoolAccountQuota} classifies that one first and
  * carries the cooldown with it.
+ *
+ * A WebSocket refusal reaches this predicate only as the opt-in pre-output projection (#6969): the
+ * upstream itself ended the turn with a structured 5xx while nothing but empty lifecycle frames had
+ * been relayed. It carries no non-replayable marker because nothing could have been observed.
  */
 export function shouldRetryCodexPoolAccountTransient(response: Response): boolean {
   return !isNonReplayableResponse(response) && isTransientUpstreamStatus(response.status);
@@ -420,6 +516,8 @@ export interface CodexPoolAccountRetryArgs {
   stream: boolean;
   /** Keep a buffered canonical client on HTTP/SSE after moving to another Pool account. */
   httpOnly?: boolean;
+  /** Pre-output refusal hold for the alternate's WebSocket send (#6969); the caller restores. */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
   onResponse?: (
     response: Response,
     authCtx: CodexAuthContext,
@@ -571,6 +669,10 @@ export async function retryCodexPoolOnAlternateAccount(
   // keep handing it the next request.
   const recordUnmovedTransientOutcome = (): void => {
     if (!isTransientUpstreamStatus(outcomeStatus)) return;
+    // #6969: one write per projection. After recordFirstOutcome, a late window or permit denial
+    // must not record the same refusal again, and a recorded projection tells delivery to skip it.
+    if (codexWsPreOutputRefusalOutcomeRecorded(firstResponse)) return;
+    noteCodexWsPreOutputRefusalOutcome(firstResponse);
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       threadId: firstAuthCtx.affinityKey,
       fixedAccount: firstAuthCtx.fixedAccount,
@@ -763,6 +865,7 @@ export async function retryCodexPoolOnAlternateAccount(
       // Retry already advanced the RR ring via excludeAccountId — reuse for promotion.
       ...(retryAuthCtx.accountId ? { promoteAccountId: retryAuthCtx.accountId } : {}),
     });
+    noteCodexWsPreOutputRefusalOutcome(firstResponse);
   };
   // Only a combo reset-derived outcome is deferred. Retry-After, defaults, and
   // ordinary requests must block the first account before the alternate send.
@@ -918,6 +1021,7 @@ export async function retryCodexPoolOnAlternateAccount(
             httpOnly,
             providerName: route.providerName,
             modelId: route.modelId,
+            preOutputRefusalHold: args.preOutputRefusalHold,
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,

package/src/server/responses/core-combo-failure.ts

@@ -14,7 +14,9 @@ import {
 import { normalizeUpstreamErrorText } from "./core-errors";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
 import { formatErrorResponse } from "../../bridge";
+import { OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE } from "../../adapters/ollama-native";
 import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
+import { MODEL_NOT_ALLOWED_FOR_KEY } from "../admission-model-scope";
 import { usageFromResponsesPayload } from "../request-log";
 import type { ResponsesTerminalStatus } from "../../bridge";
 
@@ -48,6 +50,9 @@ export async function consumeComboFailure(
   // display-safe body carries a recognized quota message.
   let quotaConfirmedByBody = false;
   const serverError = response.status >= 500 && response.status < 600;
+  // A local key-scope refusal is already the client's answer: rebuilding it as an upstream_error
+  // would hide the stable model_not_allowed_for_key type clients branch on.
+  let scopeRefusalBody: string | undefined;
   try {
     const body = await readBoundedResponseBody(response, { signal, reportUtf8Validity: serverError });
     // A 5xx body counts as quota or classification evidence only when it decoded as valid
@@ -70,6 +75,9 @@ export async function consumeComboFailure(
         upstreamMessage = normalized.message;
         upstreamType = normalized.type;
       }
+      if (nonReplayable && response.status === 403 && upstreamType === MODEL_NOT_ALLOWED_FOR_KEY) {
+        scopeRefusalBody = body.text;
+      }
     }
   } catch (error) {
     if (signal?.aborted) throw error;
@@ -105,7 +113,9 @@ export async function consumeComboFailure(
     now,
     includeDefault: false,
   });
-  const failureResponse = formatErrorResponse(
+  const failureResponse = scopeRefusalBody !== undefined
+    ? new Response(scopeRefusalBody, { status: 403, headers: { "Content-Type": "application/json" } })
+    : formatErrorResponse(
     response.status,
     cyberFailure ? (upstreamType ?? CYBER_POLICY_ERROR_CODE) : "upstream_error",
     message,
@@ -121,6 +131,7 @@ export async function consumeComboFailure(
     classificationText,
     ...(codexModelRefusal !== undefined ? { codexModelRefusal } : {}),
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
+    ...(upstreamMessage !== undefined ? { upstreamMessage } : {}),
     ...(upstreamType !== undefined ? { upstreamType } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),
     // The EFFECTIVE classification decides, not the raw status. An upstream that wraps a quota
@@ -221,3 +232,15 @@ export function buildComboChildHeaders(parentHeaders: HeadersInit): Headers {
   childHeaders.delete("content-encoding");
   return childHeaders;
 }
+
+/**
+ * A member's local Ollama late-attribution refusal: the exact proxy-owned constant on the exact
+ * local wire shape, from a replayable attempt. The caller replaces only the client response with
+ * the literal constant envelope; classification inputs are never rewritten.
+ */
+export function isLateAttributionRefusal(failure: ConsumedComboFailure): boolean {
+  return !failure.nonReplayable
+    && failure.response.status === 413
+    && failure.upstreamCode === "request_too_large"
+    && failure.upstreamMessage === OLLAMA_LATE_ATTRIBUTION_LIMIT_MESSAGE;
+}

package/src/server/responses/core-combo.ts

@@ -1,3 +1,5 @@
+import { effectiveAzureOutputBudget } from "../../adapters/azure";
+import { resolveWireProtocolOverride } from "../adapter-resolve";
 import type { CodexAccountModelRefusal } from "../../combos/failover";
 import {
   isCodexReasoningEffort,
@@ -80,6 +82,7 @@ import {
   buildComboChildHeaders,
   createChildPassthroughCallbackGate,
   consumeComboFailure,
+  isLateAttributionRefusal,
 } from "./core-combo-failure";
 import {
   linkRequestSessionLane,
@@ -100,7 +103,7 @@ import {
   markEagerRelaySseResponse,
 } from "../relay";
 import { preflightComboStreamResponse } from "./combo-stream-preflight";
-import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
+import { streamingContextOverflowResponse, jsonContextOverflowResponse, lateAttributionLimitResponse } from "./context-overflow";
 import { mandatoryResponsesReasoningReplayUnavailable } from "./core-replay";
 import { settleOperatorReplacement } from "../../lib/upstream-retry";
 import { createComboProtocolLanes, dispatchNativeComboChild } from "./core-combo-native";
@@ -711,12 +714,31 @@ export async function executeComboResponses(
         retryAfter: String(Math.max(1, Math.ceil(remainingQuotaCooldownMs / 1000))),
       }) : lastFailure;
   };
+  // The caller's output ceiling, captured once so a floor applied to one target never
+  // leaks into the next. An established parent estimate wins; otherwise (combo dispatch
+  // precedes request preparation) the caller's own positive cap is reserved.
+  const callerBudget = isPlainObject(body) ? body.max_output_tokens : undefined;
+  const callerOutputCeilingTokens = logCtx.spendOutputCeilingTokens
+    ?? (typeof callerBudget === "number" && Number.isFinite(callerBudget) && callerBudget > 0
+      ? Math.trunc(callerBudget) : undefined);
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
+    // Combo prepays before its child normalizes the route; the parent tracker must
+    // already see this target's effective cap rather than a previous target's cap.
+    const spendProvider = resolveWireProtocolOverride(targetRoute.providerName, targetRoute.modelId,
+      targetRoute.provider, options.inboundWire ?? "responses", targetRoute.staticPolicy);
+    const outputBudget = effectiveAzureOutputBudget(spendProvider, callerBudget);
+    if (outputBudget !== callerBudget && typeof outputBudget === "number" && outputBudget > 0) {
+      logCtx.spendOutputCeilingTokens = Math.trunc(outputBudget);
+    } else if (callerOutputCeilingTokens === undefined) {
+      delete logCtx.spendOutputCeilingTokens;
+    } else {
+      logCtx.spendOutputCeilingTokens = callerOutputCeilingTokens;
+    }
     // Derive the target's allowance before booking its initial send; the booking occupies it.
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
@@ -1007,6 +1029,10 @@ export async function executeComboResponses(
       retainCancelledAttempt();
       return clientCancelledResponse();
     }
+    // A member's local late-attribution refusal reaches the client only as the literal constant
+    // envelope: swap the response, keep every classification input, and skip the overflow rewrite.
+    const lateAttributionRefusal = isLateAttributionRefusal(failure);
+    if (lateAttributionRefusal) failure = { ...failure, response: lateAttributionLimitResponse() };
     sealRequestAttemptIdentity(
       attempt,
       childLog.provider,
@@ -1047,7 +1073,7 @@ export async function executeComboResponses(
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.
-    const classifyOverflow = failure.response.status === 413
+    const classifyOverflow = failure.response.status === 413 && !lateAttributionRefusal
       && (wantsStream || (failure.upstreamCode !== "outbound_body_too_large"
         && failure.upstreamCode !== "translation_buffer_limit"));
     lastFailureClassifiesOverflow = classifyOverflow;

package/src/server/responses/core-errors.ts

@@ -2,7 +2,7 @@ import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { redactSecretString } from "../../lib/redact";
 import { isCyberPolicyMessage, isCyberPolicyCode } from "../../lib/errors";
 import { isTranslatorBudgetExceededError } from "../../lib/translator-budget";
-import { formatErrorResponse } from "../../bridge";
+import { formatErrorResponse, formatUsageLimitReachedResponse } from "../../bridge";
 import {
   UnsupportedContentEncodingError,
   DecompressedBodyTooLargeError,
@@ -132,6 +132,34 @@ export function clientCancelledResponse(): Response {
   return formatErrorResponse(499, "client_cancelled", "Client cancelled request");
 }
 
+/**
+ * The Responses answer to a local Anthropic pool refusal (`AnthropicAccountCooldownError`).
+ *
+ * When every held account is out on spent quota the refusal is a usage limit (#6991), which the
+ * Codex client stops on and renders with its reset time; anything else stays the retryable
+ * `rate_limit_error` it always was. A combo child keeps the retryable form and wording: the combo
+ * hops on any 429 and rebuilds the body anyway, and `isAnthropicPoolLocalRefusal` in
+ * `core-combo.ts` deliberately cools the target for the short local fallback, which a usage-limit
+ * code or usage-limit prose would stretch to the ten-minute exhaustion fallback in
+ * `combos/failover.ts`.
+ */
+export function anthropicPoolCooldownResponse(
+  refusal: {
+    message: string;
+    retryableMessage: string;
+    retryAfterSeconds: number | null;
+    usageLimit: { readonly resetsAt: number | null } | null;
+  },
+  options: { comboAttempt?: boolean; logCtx?: { errorCode?: string } } = {},
+): Response {
+  if (refusal.usageLimit !== null && !options.comboAttempt) {
+    if (options.logCtx) options.logCtx.errorCode = "usage_limit_reached";
+    return formatUsageLimitReachedResponse(refusal.message, refusal.usageLimit.resetsAt, refusal.retryAfterSeconds);
+  }
+  return formatErrorResponse(429, "rate_limit_error", refusal.retryableMessage,
+    refusal.retryAfterSeconds === null ? undefined : { retryAfter: String(refusal.retryAfterSeconds) });
+}
+
 
 export const UNREADABLE_ENCRYPTED_AGENT_TASK_MESSAGE =
   "Routed V2 worker task is encrypted for the native ChatGPT backend and cannot be read by the selected provider. Use plaintext V2 agent-message delivery or select a native ChatGPT model.";

package/src/server/responses/core-lifetime.ts

@@ -1,5 +1,6 @@
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { finalizeTranslatorBudgetResponse } from "../../lib/translator-budget";
+import { isNonReplayableResponse, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
   isNativePassthroughSseResponse,
   markNativePassthroughSseResponse,
@@ -67,6 +68,7 @@ export function finalizeAccountLease(response: Response, release: () => void): R
     async cancel(reason) { try { await reader.cancel(reason); } finally { finish(); } },
   });
   const wrapped = new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  if (isNonReplayableResponse(response)) markResponseNonReplayable(wrapped);
   if (isNativePassthroughSseResponse(response)) markNativePassthroughSseResponse(wrapped);
   if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
   if (isPreinspectedJsonResponse(response)) markPreinspectedJsonResponse(wrapped);

package/src/server/responses/core-normalize.ts

@@ -1,3 +1,4 @@
+import { effectiveAzureOutputBudget } from "../../adapters/azure";
 import { sanitizeLogMetadataString } from "../../lib/redact";
 import type { RouteResult } from "../../router";
 import type { InboundWire } from "../../providers/registry";
@@ -211,6 +212,16 @@ export async function applyFinalRouteRequestNormalization(args: {
   logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;
   logCtx.spendPoolId = route.providerName;
+  // Admission precedes adapter serialization. Reserve the same explicit output cap
+  // the final destination will send, and recompute from the caller on every fallback.
+  const rawBudget = parsed._rawBody && typeof parsed._rawBody === "object"
+    ? (parsed._rawBody as { max_output_tokens?: unknown }).max_output_tokens : undefined;
+  const outputBudget = effectiveAzureOutputBudget(route.provider,
+    route.provider.adapter === "azure" || route.provider.adapter === "azure-openai"
+      ? rawBudget : parsed.options.maxOutputTokens);
+  if (typeof outputBudget === "number" && outputBudget > 0) {
+    logCtx.spendOutputCeilingTokens = Math.trunc(outputBudget);
+  }
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
   logCtx.policyEligibility = route.policyEligibility;