@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/responses/adapter-delivery.ts

@@ -23,7 +23,11 @@ import { resolveStallTimeoutMs } from "../../stall-timeout";
 import { clientEncoderForDelivery, deliverClientEncodedResponse } from "../inference/client-encoder-delivery";
 import { noteKiroServedSuccess } from "../../providers/kiro-usage";
 import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
+import { readDisplaySafeErrorText, normalizeUpstreamErrorText } from "./core-errors";
+import { sanitizeNonReplayableUpstreamError } from "./non-replayable-error";
+import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { guardEmptyToolCatalogEvents, guardEmptyToolCatalogStream } from "../../lib/empty-tool-catalog";
 
 /** One responsibility of the Responses request pipeline; state owners are explicit. */
 export async function deliverAdapterResponse(
@@ -34,6 +38,7 @@ export async function deliverAdapterResponse(
     | "route"
     | "translatorBudget"
     | "toolBridgeMaps"
+    | "clientToolCatalogRestriction"
     | "rememberKiroDeliveredFinalAnswer"
     | "responseStateOptions"
   >,
@@ -47,7 +52,7 @@ export async function deliverAdapterResponse(
     | "notifyResponseComplete"
   >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
-  adapterExchange: Pick<AdapterExchange, "upstreamResponse" | "upstream" | "cleanupUpstreamAbort" | "localUpstream">,
+  adapterExchange: Pick<AdapterExchange, "upstreamResponse" | "upstream" | "cleanupUpstreamAbort" | "localUpstream" | "thinkingSignatureRecovery" | "refetchThinkingSignature">,
   continuationState: Pick<AdapterContinuations, "terminalGuardEnabled" | "fetchTerminalGuardContinuation" | "fetchGuardedEmptyCompletionRetry">,
 ): Promise<Response> {
   const { logCtx, options, config } = requestContext;
@@ -59,7 +64,7 @@ export async function deliverAdapterResponse(
     rememberKiroDeliveredFinalAnswer,
     responseStateOptions,
   } = requestState;
-  const { upstreamResponse, upstream, cleanupUpstreamAbort, localUpstream } = adapterExchange;
+  const { upstreamResponse, upstream, cleanupUpstreamAbort, localUpstream, thinkingSignatureRecovery, refetchThinkingSignature } = adapterExchange;
   const {
     terminalGuardEnabled,
     fetchTerminalGuardContinuation,
@@ -75,6 +80,47 @@ export async function deliverAdapterResponse(
   const { routedCompaction } = sidecarState;
   const bodyInactivityMs = resolveStallTimeoutMs(config.stallTimeoutSec, { localUpstream });
   const upstreamRequestsStream = parsed.stream || isCanonicalOpenAiForwardProvider(route.provider);
+  const recoverThinkingSignature = (events: AsyncIterable<AdapterEvent>): AsyncIterable<AdapterEvent> =>
+    thinkingSignatureRecovery.wrap(events, async function* () {
+      const result = await refetchThinkingSignature();
+      let response = "failed" in result ? result.failed : result;
+      // A replacement can be an HTTP/auth/budget refusal; never feed its JSON body to an SSE parser.
+      if (!response.ok) {
+        // A local refusal closes the upstream signal before returning its generated JSON.
+        // Reading that bounded local body still honors caller cancellation.
+        const errorSignal = "failed" in result ? options.abortSignal ?? new AbortController().signal : upstream.signal;
+        const nonReplayable = isNonReplayableResponse(response);
+        if (nonReplayable) response = await sanitizeNonReplayableUpstreamError(response, errorSignal);
+        const body = await readDisplaySafeErrorText(response, errorSignal, "Upstream recovery failed");
+        const error = normalizeUpstreamErrorText(body, "Upstream recovery failed");
+        yield { type: "error", status: response.status, message: error.message ?? error.safeText,
+          errorType: error.type ?? "upstream_error", ...(error.code ? { code: error.code } : {}),
+          ...(nonReplayable ? { retryable: false } : {}) };
+        return;
+      }
+      try {
+        const retryEvents = upstreamRequestsStream
+          ? readResponseStreamWithInactivity(response, upstream.signal, bodyInactivityMs,
+            guarded => transportState.activeAdapter.parseStream(guarded, translatorBudget, logCtx.activeTierMetadata))
+          : (async function* () {
+              yield* await readResponseBodyWithInactivity(response, upstream.signal, bodyInactivityMs,
+                guarded => transportState.activeAdapter.parseResponse!(guarded, translatorBudget, logCtx.activeTierMetadata));
+            })();
+        for await (const event of retryEvents) {
+          options.onCompactionRecoveryAdapterEvent?.(event);
+          yield event;
+        }
+      } catch (error) {
+        if (!(error instanceof ResponseBodyInactivityError)) throw error;
+        yield { type: "error", message: "Upstream recovery response body stalled before completing",
+          status: 504, errorType: "upstream_error" };
+      }
+    }, () => transportState.activeAdapter.name, !isNonReplayableResponse(upstreamResponse), upstreamResponse);
+
+  const clientToolCatalog = requestState.clientToolCatalogRestriction && route.provider.authMode !== "forward"
+    ? requestState.clientToolCatalogRestriction : undefined;
+  const deliveryToolBridgeMaps = clientToolCatalog
+    ? { ...toolBridgeMaps, ...clientToolCatalog } : toolBridgeMaps;
 
 
   if (parsed.stream) {
@@ -104,15 +150,16 @@ export async function deliverAdapterResponse(
         throw error;
       }
     })();
+    const recoveredEvents = recoverThinkingSignature(initialEventStream);
     const eventStream = terminalGuardEnabled
       ? guardTerminalEventStream({
           parsed,
-          firstEvents: initialEventStream,
+          firstEvents: recoveredEvents,
           adapterName: transportState.activeAdapter.name,
           maxAutoContinuations: 1,
           continuation: next => fetchTerminalGuardContinuation(next, undefined, !parsed.stream),
         })
-      : initialEventStream;
+      : recoveredEvents;
     // Optional advisor guard (registered per request by the sidecar planner; absent unless the
     // user enabled the advisor): holds synthetic `advisor` tool calls, consults the configured
     // expert model, and re-dispatches the worker. Sits inside the empty-completion guard so an
@@ -121,6 +168,7 @@ export async function deliverAdapterResponse(
     const advisorStream = parsed._advisorGuard
       ? parsed._advisorGuard({
           parsed,
+          translatorBudget,
           firstEvents: eventStream,
           continuation: fetchTerminalGuardContinuation,
         })
@@ -129,16 +177,18 @@ export async function deliverAdapterResponse(
     // turn with no text and no tool call is retried with the IDENTICAL request
     // (fetchTerminalGuardContinuation(parsed) replays the cached byte-identical
     // request — same body, same headers, same signal).
-    const guardedEventStream = emptyCompletionGuardEnabled
+    const completionGuardedEventStream = emptyCompletionGuardEnabled
       ? guardEmptyCompletionEventStream({
           firstEvents: advisorStream,
           continuation: fetchGuardedEmptyCompletionRetry,
         })
       : advisorStream;
-    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = toolBridgeMaps;
+    const guardedEventStream = guardEmptyToolCatalogStream(completionGuardedEventStream, clientToolCatalog, translatorBudget);
+    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = deliveryToolBridgeMaps;
     // One completion owner for both deliveries: the bridge calls it from its terminal, the
     // direct client encoder from the fold of the same events.
     const onCompletedResponse = (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
+      if (!options.abortSignal?.aborted) thinkingSignatureRecovery.rememberSuccess(response);
       const served = transportState.sentOAuthSnapshot;
       if (transportState.activeAdapter.name === "kiro" && response.status === "completed" && served
         && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();
@@ -157,7 +207,9 @@ export async function deliverAdapterResponse(
       }
       notifyResponseComplete(response);
     };
-    const clientEncoder = clientEncoderForDelivery(options, logCtx, !!routedCompaction, transportState.activeAdapter.name);
+    // The Responses bridge owns code-mode helper compilation; the direct encoder only renames.
+    const clientEncoder = clientToolCatalog?.bareCustomToolNames.has("exec") ? undefined
+      : clientEncoderForDelivery(options, logCtx, !!routedCompaction, transportState.activeAdapter.name);
     if (clientEncoder) {
       return deliverClientEncodedResponse({
         encoder: clientEncoder,
@@ -196,9 +248,10 @@ export async function deliverAdapterResponse(
         declaredToolNames,
         bareCustomToolNames,
         enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
+        terminalRefusalAsFailed: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
         toolParameterSchemas,
         ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
-        ...(routedCompaction ? { compaction: true } : {}),
+        ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
         // Same grok-surface split as the runTurn branch above.
         ...(logCtx.surface === "grok" ? { heartbeatStyle: "comment" as const } : {}),
         onUsage: usage => {
@@ -239,24 +292,29 @@ export async function deliverAdapterResponse(
         ));
       }
       for (const event of initialEvents) options.onCompactionRecoveryAdapterEvent?.(event);
+      const recoveredEvents: AdapterEvent[] = [];
+      for await (const event of recoverThinkingSignature((async function* () { yield* initialEvents; })())) {
+        recoveredEvents.push(event);
+      }
       let guardedEvents: AdapterEvent[];
       if (terminalGuardEnabled) {
         guardedEvents = [];
         for await (const event of guardTerminalEventStream({
           parsed,
-          firstEvents: (async function* () { yield* initialEvents; })(),
+          firstEvents: (async function* () { yield* recoveredEvents; })(),
           adapterName: transportState.activeAdapter.name,
           maxAutoContinuations: 1,
           continuation: next => fetchTerminalGuardContinuation(next, undefined, !parsed.stream),
         })) guardedEvents.push(event);
       } else {
-        guardedEvents = initialEvents;
+        guardedEvents = recoveredEvents;
       }
       // Optional advisor guard — same semantics as the streaming branch above.
       if (parsed._advisorGuard) {
         const advisorEvents: AdapterEvent[] = [];
         for await (const event of parsed._advisorGuard({
           parsed,
+          translatorBudget,
           firstEvents: (async function* () { yield* guardedEvents; })(),
           continuation: fetchTerminalGuardContinuation,
         })) advisorEvents.push(event);
@@ -279,8 +337,9 @@ export async function deliverAdapterResponse(
     } finally {
       cleanupUpstreamAbort();
     }
-    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = toolBridgeMaps;
+    const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, bareCustomToolNames, toolSearchToolNames } = deliveryToolBridgeMaps;
     let providerState: OcxProviderContinuationState | undefined;
+    events = guardEmptyToolCatalogEvents(events, clientToolCatalog, translatorBudget);
     const json = buildResponseJSON(events, parsed._responseModelId ?? parsed.modelId, {
       translatorBudget,
       replayCacheScope: parsed._reasoningReplayScope,
@@ -293,7 +352,7 @@ export async function deliverAdapterResponse(
       toolParameterSchemas,
       freeformToolNames,
       toolSearchToolNames,
-      ...(routedCompaction ? { compaction: true } : {}),
+      ...(routedCompaction ? { compaction: true, compactionRetention: parsed._compactionRetention } : {}),
       onProviderState: state => { providerState = state; },
       onUsage: usage => {
         transportState.bindKeyUsageFromBridge(usage);
@@ -312,6 +371,7 @@ export async function deliverAdapterResponse(
     // #1926 gap 2: same buffered-path durability bound as the primary branch.
     await awaitThoughtSignatureDurability();
     if (adapterResponseReachedServingTerminal(events, json)) {
+      if (!options.abortSignal?.aborted) thinkingSignatureRecovery.rememberSuccess(json);
       const served = transportState.sentOAuthSnapshot;
       if (transportState.activeAdapter.name === "kiro" && json.status === "completed" && served
         && noteKiroServedSuccess(served.accountId, served.generation)) persistKiroAccountState();

package/src/server/responses/adapter-dispatch.ts

@@ -1,3 +1,4 @@
+import { bindAnthropicRejectionResponse } from "../../adapters/anthropic-rejection-memo";
 import { deferPhysicalSendReporter } from "./deferred-send-reporter";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
@@ -54,7 +55,7 @@ import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
-import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
+import { OAuthAccountPausedError, OAuthLoginRequiredError, OAuthTokenRefreshBusyError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
 import { getAccountSet, markAccountNeedsReauthIfGeneration } from "../../oauth/store";
 import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
@@ -87,6 +88,7 @@ import {
   reasoningEffortRejectionText,
   anthropicFastRefused,
 } from "./core-opaque-recovery";
+import { createAnthropicThinkingRecovery } from "./anthropic-thinking-recovery";
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import {
   isTransientConsoleGoUploadRejection,
@@ -591,7 +593,7 @@ export async function prepareAdapterExchange(
   let rateLimitRetries = 0;
   // Shared with the terminal-guard continuation below: an image-tier reduction that let the
   // main request clear a 413 must not be forgotten on the very next continuation build.
-  if (!upstreamResponse.ok) {
+  // Recovery helpers also serve initial HTTP-200 adapter errors during delivery.
     // Recovery loop: multi-key 429 failover + at most ONE opaque-state rebuild and ONE
     // anthropic 413 tightened retry
     // (devlog/260714_image_normalization_pipeline/030). One mutable activeAdapter serves
@@ -600,6 +602,9 @@ export async function prepareAdapterExchange(
     // 413→429 rotation cannot silently undo the tightening.
     let imageRetryAttempted = false;
     const opaqueBlobRecoveryGuard: OpaqueBlobRecoveryGuard = { attempted: false };
+    const thinkingSignatureRecovery = createAnthropicThinkingRecovery(
+      parsed, upstream.signal, opaqueBlobRecoveryGuard, () => !sendBudgetExhausted(),
+    );
     // Console Go answers a transient 400 "Invalid upload request." for bodies it accepts
     // moments later; at most one byte-identical replay is allowed per request.
     const consoleGoUploadRetryGuard: { attempted: boolean } = { attempted: false };
@@ -863,6 +868,11 @@ export async function prepareAdapterExchange(
         return { failed: formatErrorResponse(502, "upstream_error", msg) };
       }
     };
+    const refetchThinkingSignature = () => {
+      invalidateSameTargetRequest();
+      return rebuildAndRefetch("opaque-blob-rejection");
+    };
+  if (!upstreamResponse.ok) {
     const rotateAntigravityAuth = async (
       failedResponse: Response,
       recovery: AttemptRecoveryKind,
@@ -920,6 +930,17 @@ export async function prepareAdapterExchange(
           return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
         } finally { cleanupUpstreamAbort(); }
       }
+      bindAnthropicRejectionResponse(transportState.sameTargetRequest, upstreamResponse);
+      if (await thinkingSignatureRecovery.prepareHttp(
+        upstreamResponse, transportState.activeAdapter.name,
+      )) {
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        invalidateSameTargetRequest();
+        const result = await rebuildAndRefetch("opaque-blob-rejection");
+        if ("failed" in result) return result.failed;
+        upstreamResponse = result;
+        continue recovery;
+      }
      if (
        upstreamResponse.status === 401
        && isOAuth401ReplayProvider
@@ -932,6 +953,15 @@ export async function prepareAdapterExchange(
         try {
           refreshed = await refreshResolvedOAuthSelection(transportState.sentOAuthSnapshot);
         } catch (err) {
+          const cancelled = options.abortSignal?.aborted || req.signal.aborted;
+          if (cancelled || err instanceof OAuthTokenRefreshBusyError) {
+            cleanupUpstreamAbort();
+            upstream.abort();
+            try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+            releaseCodexAuthContextProbeLease(admissionState.authCtx);
+            return cancelled ? clientCancelledResponse()
+              : formatErrorResponse(503, "server_error", publicOAuthAuthenticationErrorMessage(err), { retryAfter: "1" });
+          }
           const failed = transportState.sentOAuthSnapshot;
           if (route.providerName === "google-antigravity" && !antigravityAuthRotationAttempted
             && err instanceof OAuthLoginRequiredError && failed
@@ -1337,9 +1367,17 @@ export async function prepareAdapterExchange(
             resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+            oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+          });
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
           recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
-         const result = await rebuildAndRefetch(upstreamResponse.status === 401 ? "oauth-401" : "anthropic-oauth-429");
+         const result = await rebuildAndRefetch(upstreamResponse.status === 401 ? "oauth-401"
+           : upstreamResponse.status === 403 ? "oauth-account-403" : "anthropic-oauth-429");
          if ("failed" in result) return result.failed;
          upstreamResponse = result;
           if (isNonReplayableResponse(upstreamResponse)) continue recovery;
@@ -1860,6 +1898,8 @@ export async function prepareAdapterExchange(
             authMode: route.provider.authMode,
             hasApiKey: Boolean(route.provider.apiKey?.trim()),
             upstreamRetryAfter,
+            upstreamErrorType: normalized.type,
+            upstreamErrorCode: normalized.code,
             // This recovery path is the HTTP Responses wire; custom runTurn transports
             // never reach enrichOpenCodeZenUpstreamMessage here.
             supportsHttpSameKeyRetry: true,
@@ -1885,6 +1925,7 @@ export async function prepareAdapterExchange(
     }
   }
 
+  bindAnthropicRejectionResponse(transportState.sameTargetRequest, upstreamResponse);
   cancelBodyOnAbort(upstreamResponse.body, upstream.signal);
 
   return {
@@ -1894,6 +1935,8 @@ export async function prepareAdapterExchange(
     stallTimeoutMs,
     localUpstream,
     upstreamResponse,
+    thinkingSignatureRecovery,
+    refetchThinkingSignature,
     rateLimitPolicy,
     get rateLimitRetries(): typeof rateLimitRetries {
       return rateLimitRetries;

package/src/server/responses/advisor-retention.ts

@@ -0,0 +1,117 @@
+import { jsonUtf8Bytes } from "../../lib/json-byte-size";
+import {
+  TRANSLATOR_MAX_TURN_BYTES,
+  TranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../../lib/translator-budget";
+import type { AdapterEvent, OcxMessage, OcxUsage } from "../../types";
+import { mergeUsage } from "./terminal-guard";
+
+export const MAX_ADVISOR_RETAINED_EVENTS = 4_096;
+export const MAX_ADVISOR_RETAINED_CALLS = 1_024;
+
+/** Independent ownership: never borrow the bridge's event or tool-call leases. */
+export class AdvisorRetention {
+  private legBytes = 0;
+  private historyBytes = 0;
+  private copyBytes = 0;
+  private usageBytes = 0;
+  private events = 0;
+  private calls = 0;
+
+  constructor(private readonly shared?: TranslatorBudget) {}
+
+  private charge(bytes: number, kind: "retained_collectors" | "request_copies"): void {
+    if (bytes > TRANSLATOR_MAX_TURN_BYTES - this.legBytes - this.historyBytes - this.copyBytes - this.usageBytes) {
+      throw new TranslatorBudgetExceededError(kind, TRANSLATOR_MAX_TURN_BYTES);
+    }
+    this.shared?.chargeRetained(bytes, { kind });
+  }
+
+  /** Usage can alias a terminal payload. Keep its own owner after the raw leg ends. */
+  usage(first: OcxUsage | undefined, second: OcxUsage | undefined): OcxUsage | undefined {
+    if (!second) return first;
+    // Two-input merge materializes a new object. Reserve before merging, including
+    // a conservative bound for concatenation if a provider supplied malformed scalars.
+    const bytes = first
+      ? (jsonUtf8Bytes(first) + jsonUtf8Bytes(second)) * 2 + 256
+      : jsonUtf8Bytes(second) + 1;
+    this.charge(bytes, "request_copies");
+    this.copyBytes += bytes;
+    let retained = 0;
+    try {
+      const merged = mergeUsage(first, second);
+      const measured = jsonUtf8Bytes(merged, bytes) + 1;
+      if (measured > bytes) throw new TranslatorBudgetExceededError("request_copies", TRANSLATOR_MAX_TURN_BYTES);
+      retained = measured;
+      const previous = this.usageBytes;
+      this.usageBytes = retained;
+      this.shared?.releaseRetained(previous, { kind: "request_copies" });
+      return merged;
+    } finally {
+      this.copyBytes -= bytes;
+      this.shared?.releaseRetained(bytes - retained, { kind: "request_copies" });
+    }
+  }
+
+  /**
+   * `counted: false` is only for non-empty text/thinking deltas: the leg's 16 KiB character
+   * caps already bound how many of those can be held, and an ordinary long answer streams
+   * thousands of them. They still consume bytes.
+   */
+  retain(event: AdapterEvent, call = false, counted = true): void {
+    if ((counted && this.events >= MAX_ADVISOR_RETAINED_EVENTS) || (call && this.calls >= MAX_ADVISOR_RETAINED_CALLS)) {
+      throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
+    }
+    const bytes = jsonUtf8Bytes(event) + 1;
+    this.charge(bytes, "retained_collectors");
+    this.legBytes += bytes;
+    if (counted) this.events++;
+    if (call) this.calls++;
+  }
+
+  /** Hold a bounded materialization while its raw sources are still retained. */
+  copy<T>(bytes: number, build: () => T): T {
+    this.charge(bytes, "request_copies");
+    this.copyBytes += bytes;
+    try { return build(); }
+    finally {
+      this.copyBytes -= bytes;
+      this.shared?.releaseRetained(bytes, { kind: "request_copies" });
+    }
+  }
+
+  /** Reserve before constructing replay JSON; transfer the reservation to history. */
+  history<T extends OcxMessage | undefined>(bytes: number, build: () => T): T {
+    this.charge(bytes, "request_copies");
+    this.copyBytes += bytes;
+    let retained = 0;
+    try {
+      const message = build();
+      const measured = message ? jsonUtf8Bytes(message, bytes) + 1 : 0;
+      if (measured > bytes) throw new TranslatorBudgetExceededError("request_copies", TRANSLATOR_MAX_TURN_BYTES);
+      retained = measured;
+      this.historyBytes += retained;
+      return message;
+    } finally {
+      this.copyBytes -= bytes;
+      this.shared?.releaseRetained(bytes - retained, { kind: "request_copies" });
+    }
+  }
+
+  /** Event envelopes dominate the replay content; allow new message/call framing too. */
+  replayReservation(): number { return this.legBytes + (this.calls + 1) * 256; }
+
+  releaseLeg(): void {
+    this.shared?.releaseRetained(this.legBytes, { kind: "retained_collectors" });
+    this.legBytes = this.events = this.calls = 0;
+  }
+
+  release(): void {
+    this.releaseLeg();
+    this.shared?.releaseRetained(this.historyBytes, { kind: "request_copies" });
+    this.historyBytes = 0;
+    this.shared?.releaseRetained(this.usageBytes, { kind: "request_copies" });
+    this.usageBytes = 0;
+  }
+}