@bitkyc08/opencodex 2.87.0 → 2.89.0

package/src/codex/main-account-cache.ts

@@ -1,3 +1,5 @@
+import { getConfigDir } from "../config/paths";
+import { notifyMainRosterChanged, type MainDecisionRow } from "../lib/decision-quota-sink";
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { codexCredentialMutationEpoch } from "./credential-mutation-epoch";
 import type { StoredAccountQuota } from "./quota-types";
@@ -22,11 +24,33 @@ let observedMainQuotaIdentityKey: string | undefined;
 const mainQuotaCredentialKey = randomBytes(32);
 let mainQuotaCredential: { bearerHmac: Buffer; writer: MainQuotaWriter } | undefined;
 let mainQuotaCredentialGeneration = 0;
+let mainDecisionCredentialUsable = true;
+// Advisory-only generation for the decision row and its writers. It follows every core credential
+// generation change and additionally advances when physical presence is lost, so absence retires
+// advisory evidence without touching the core credential binding that policy checks rely on.
+let mainDecisionGeneration = 0;
+// Advisory-only: the retained credential was re-observed since presence was last lost. Absence and
+// presence-forgetting clear it, so the decision row stays unusable until a fresh owned observation.
+let mainDecisionCredentialFresh = false;
+// Config root that owns the observed main identity/credential for advisory decision evidence only.
+// Stamped at identity/credential observations while a sink is active; other transitions never claim a root.
+let mainDecisionRoot: string | undefined;
+/** Existing physical credential owner supplies terminal grant/usability observations. */
+export function observeMainDecisionCredentialUsable(usable: boolean): void {
+  mainDecisionCredentialUsable = usable;
+  publishMainDecisionRoster();
+}
 
 /** Process-local transition fence; no credential material or persisted identity. */
 export function getMainQuotaCredentialGeneration(): number { return mainQuotaCredentialGeneration; }
 
 export type MainQuotaWriter = Readonly<{ identityKey: string; identityGeneration: number }>;
+const decisionWriterGenerations = new WeakMap<MainQuotaWriter, number>();
+/** Return the credential generation a main quota writer was captured under, or undefined once that writer is stale or its credential generation has moved. */
+export function mainDecisionQuotaWriterGeneration(writer: MainQuotaWriter): number | undefined {
+  const generation = decisionWriterGenerations.get(writer);
+  return generation === mainDecisionGeneration && isMainQuotaWriterLive(writer) && mainDecisionRoot === getConfigDir() ? generation : undefined;
+}
 
 function mainQuotaIdentityKey(accountId: string): string {
   return createHash("sha256").update("opencodex-main-quota-v1\0").update(accountId).digest("hex");
@@ -38,16 +62,22 @@ export function observeMainQuotaIdentity(accountId: string): void {
   const identityKey = mainQuotaIdentityKey(accountId);
   if (identityKey === observedMainQuotaIdentityKey) return;
   observedMainQuotaIdentityKey = identityKey;
+  mainDecisionCredentialUsable = true;
   mainAccountIdentityGeneration += 1;
   mainQuotaCredential = undefined;
   mainQuotaCredentialGeneration += 1;
+  mainDecisionGeneration += 1;
+  publishMainDecisionRoster(true);
 }
 
+/** Capture a main quota writer for an account id only when it matches the observed physical identity, remembering the credential generation it was captured under. */
 export function captureMainQuotaWriter(accountId: string): MainQuotaWriter | undefined {
   if (!accountId) return undefined;
   const identityKey = mainQuotaIdentityKey(accountId);
   if (identityKey !== observedMainQuotaIdentityKey) return undefined;
-  return { identityKey, identityGeneration: mainAccountIdentityGeneration };
+  const writer = { identityKey, identityGeneration: mainAccountIdentityGeneration };
+  if (mainQuotaCredential) decisionWriterGenerations.set(writer, mainDecisionGeneration);
+  return writer;
 }
 
 /** Credential material must come from an already-owned read, never an incoming request. */
@@ -56,9 +86,13 @@ export function observeMainQuotaCredential(accessToken: string, accountId: strin
   if (!accessToken || !writer) return undefined;
   const bearerHmac = createHmac("sha256", mainQuotaCredentialKey).update(accessToken).digest();
   if (!mainQuotaCredential || !isMainQuotaWriterLive(mainQuotaCredential.writer)
-    || !timingSafeEqual(bearerHmac, mainQuotaCredential.bearerHmac)) mainQuotaCredentialGeneration += 1;
+    || !timingSafeEqual(bearerHmac, mainQuotaCredential.bearerHmac)) { mainQuotaCredentialGeneration += 1; mainDecisionGeneration += 1; }
   mainQuotaCredential = { bearerHmac, writer };
-  return { ...writer };
+  mainDecisionCredentialFresh = true;
+  publishMainDecisionRoster(true);
+  const result = { ...writer };
+  decisionWriterGenerations.set(result, mainDecisionGeneration);
+  return result;
 }
 
 export function matchesMainQuotaCredential(accessToken: string, effectiveAccountId: string | undefined): boolean {
@@ -140,11 +174,14 @@ export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
   };
 }
 
+/** Drop the cached main-account info and invalidate the observed identity and credential generation, then republish the main decision roster as unusable. */
 export function clearMainAccountInfoCache(): void {
   cachedMainAccountInfo = null;
   mainAccountIdentityGeneration += 1;
   mainQuotaCredential = undefined;
   mainQuotaCredentialGeneration += 1;
+  mainDecisionGeneration += 1;
+  publishMainDecisionRoster();
 }
 
 /** Last physical credential presence observed while native-main ownership was held. */
@@ -152,10 +189,47 @@ export function getMainAccountCredentialPresence(): boolean | null {
   return cachedMainCredentialPresence;
 }
 
+/** Record whether the main credential is physically present. The core credential binding is left intact (a failed read must not change policy matching); losing presence only retires advisory decision evidence. */
 export function setMainAccountCredentialPresence(present: boolean): void {
+  if (!present && cachedMainCredentialPresence !== false) { mainDecisionGeneration += 1; mainDecisionCredentialFresh = false; }
   cachedMainCredentialPresence = present;
+  publishMainDecisionRoster();
 }
 
+/** Forget the last observed main credential presence; retires advisory decision evidence only, leaving the core credential binding intact. */
 export function clearMainAccountCredentialPresence(): void {
   cachedMainCredentialPresence = null;
+  mainDecisionGeneration += 1;
+  mainDecisionCredentialFresh = false;
+  publishMainDecisionRoster();
+}
+
+/**
+ * Build the single `__main__` decision row from in-memory fields. With no retained credential the
+ * row is a known-unusable main (nothing to misattribute), as before. A retained credential counts only
+ * for the config root that observed it: for any other root the row is undefined (unknown) and the
+ * claimed root is forgotten, so returning to the old root never resurrects it without a new owned
+ * observation.
+ */
+function mainDecisionRow(): MainDecisionRow | undefined {
+  if (mainQuotaCredential === undefined) return { generation: mainDecisionGeneration, usable: false };
+  if (mainDecisionRoot === undefined || mainDecisionRoot !== getConfigDir()) {
+    mainDecisionRoot = undefined;
+    return undefined;
+  }
+  return { generation: mainDecisionGeneration,
+    usable: mainDecisionCredentialFresh && mainDecisionCredentialUsable && cachedMainCredentialPresence !== false };
+}
+
+/** Hand the main decision row to the opt-in decision-quota slot (a no-op unless JEV quota signals are active); identity/credential observations claim the current root. */
+function publishMainDecisionRoster(claimsRoot = false): void {
+  notifyMainRosterChanged(() => {
+    if (claimsRoot) mainDecisionRoot = getConfigDir();
+    return mainDecisionRow();
+  });
+}
+
+/** Activation replay for the JEV quota owner: the current row, or undefined when the observed credential belongs to another config root. */
+export function peekMainDecisionRow(): MainDecisionRow | undefined {
+  return mainDecisionRow();
 }

package/src/codex/main-account.ts

@@ -1,3 +1,4 @@
+import { observeMainDecisionCredentialUsable } from "./main-account-cache";
 import { classifyChatgptRefreshFailure, noteChatgptRefreshFailure } from "./chatgpt-refresh-failure";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { createHash } from "node:crypto";
@@ -245,10 +246,12 @@ export function getMainAccountCredentialStatus(now = Date.now()): MainAccountCre
   const current = readMainAuthJsonCredential();
   const refreshGrantRejected = credentialRefreshGrantRejected(current);
   const hasRefreshGrant = !!current?.refreshToken && !refreshGrantRejected;
+  const usable = !refreshGrantRejected && (hasRefreshGrant || mainAccessTokenFresh(current?.accessToken, now, 0));
+  observeMainDecisionCredentialUsable(usable);
   return {
     refreshGrantRejected,
     hasRefreshGrant,
-    usable: !refreshGrantRejected && (hasRefreshGrant || mainAccessTokenFresh(current?.accessToken, now, 0)),
+    usable,
   };
 }
 
@@ -444,6 +447,7 @@ export function beginNativeMainReauth(): {
   };
 }
 
+/** Resolve the main account access token from the owned auth.json read, refreshing through the token endpoint when needed, or return null when no usable credential exists. */
 async function resolveMainAccountToken(
   dependencies: NativeMainRefreshDependencies = {},
   rejectedAccessToken?: string,
@@ -546,7 +550,7 @@ async function resolveMainAccountToken(
           if (signal.aborted) throw signal.reason;
           if (reason === "reauth") {
             assertMainAuthJsonSnapshotUnchanged(locked);
-            markMainRefreshGrantRejected(mainRefreshGrantKey(locked)!);
+            markMainRefreshGrantRejected(mainRefreshGrantKey(locked)!); observeMainDecisionCredentialUsable(false);
           }
           throw new MainAccountTokenRefreshError(reason, { cause });
         }

package/src/codex/native-residue.ts

@@ -17,6 +17,7 @@ import { Database } from "bun:sqlite";
 
 import { getConfigDir } from "../config";
 import { catalogHasRoutedEntries, parseCatalogJson } from "./catalog/parsing";
+import { hasOcxRoutedAuthorship } from "./catalog/ownership";
 import { codexHistoryBackupId, legacyCodexHistoryBackupId, validateCodexHistoryBackupManifest } from "./history-manifest";
 import {
   hasInjectedCodexRouting,
@@ -79,7 +80,6 @@ const PROFILE_FILE_NAME = basename(CODEX_PROFILE_PATH);
 const CATALOG_FILE_NAME = basename(DEFAULT_CATALOG_PATH);
 const MODELS_CACHE_FILE_NAME = basename(CODEX_MODELS_CACHE_PATH);
 const JOURNAL_FILE_NAME = "opencodex-journal.json";
-const ROUTED_CATALOG_DESCRIPTION_PREFIX = "Routed via opencodex → ";
 const MAX_ROLLOUT_INSPECTION_BYTES = 64 * 1024 * 1024;
 const ROLLOUT_READ_CHUNK_BYTES = 64 * 1024;
 // Bound one observation across every referenced rollout, not just each file.
@@ -339,8 +339,7 @@ function classifyProfile(path: string): NativeRoutedResidueResult {
 }
 
 function isOcxRoutedCatalogEntry(entry: Record<string, unknown>): boolean {
-  return typeof entry.description === "string"
-    && entry.description.startsWith(ROUTED_CATALOG_DESCRIPTION_PREFIX);
+  return hasOcxRoutedAuthorship(entry);
 }
 
 function classifyCatalogLike(

package/src/codex/quota.ts

@@ -1,3 +1,5 @@
+import { bindRawCodexDecisionResets, publishCodexDecisionQuota } from "../providers/quota-decision-publication";
+import { clearDecisionAccountQuotas, decisionQuotaSinkActive } from "../lib/decision-quota-sink";
 import { parseCodexCredits } from "./credits";
 import { forgetMainAccountUsage, observeMainAccountUsage, type FreshWindow } from "./main-account-external-usage";
 import { closeSync, constants as fsConstants, existsSync, fstatSync, openSync, readSync, unlinkSync } from "node:fs";
@@ -8,7 +10,7 @@ import { isThirtyDayOnlyCodexPlan } from "./plan";
 import { stampCodexQuotaUsageObservation } from "./quota-observation-freshness";
 import { observeCodexLowQuota } from "./low-quota-observer";
 import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
-import { getObservedMainQuotaIdentityKey, isMainQuotaWriterLive, type MainQuotaWriter } from "./main-account-cache";
+import { getObservedMainQuotaIdentityKey, mainDecisionQuotaWriterGeneration, isMainQuotaWriterLive, type MainQuotaWriter } from "./main-account-cache";
 
 import { CodexQuotaHistory, QUOTA_HISTORY_LIMITS, type QuotaHistoryWindow } from "./quota-history";
 import { isPoolQuotaWriterLive, poolQuotaHistoryIdentity } from "./account-store";
@@ -301,6 +303,9 @@ export function setAccountQuotaFromParsed(
   // writer: when capture failed before dispatch, an absent writer must fail closed instead
   // of reading as a writer-free legacy/login observation.
   poolRequest = false,
+  decisionObservationPartial = true,
+  // Advisory publication is explicit opt-in evidence: display or policy data never becomes it by default.
+  decisionRaw: Omit<StoredAccountQuota, "updatedAt"> | null = null,
 ): void {
   quota = withoutRetiredCodexQuota(quota);
   policyQuota = withoutRetiredCodexQuota(policyQuota);
@@ -315,12 +320,16 @@ export function setAccountQuotaFromParsed(
     ? historyEvidence.writer.accountId === accountId && isPoolQuotaWriterLive(historyEvidence.writer)
     : !poolRequest;
   if (historyEvidence && livePoolEvidence) {
+    publishCodexDecisionQuota(accountId, historyEvidence.writer.credentialGeneration, historyEvidence.raw, historyEvidence.observedAt, "codex", historyEvidence.source === "response-header");
     quotaHistory.append(historyEvidence.writer, { observedAt: historyEvidence.observedAt, source: historyEvidence.source,
       credentialGeneration: historyEvidence.writer.credentialGeneration, windows: historyWindows(historyEvidence.raw),
     }, updatedAt);
   }
   // Rotation shares validated main-window retirement, but never inherits policy-only
   // evidence that outlived its disk TTL. Policy has a separate, identity-checked base.
+  const mainDecisionGeneration = mainWriter && mainDecisionQuotaWriterGeneration(mainWriter);
+  if (isMain && mainDecisionGeneration !== undefined && decisionRaw)
+    publishCodexDecisionQuota(accountId, mainDecisionGeneration, decisionRaw, updatedAt, "codex-main", decisionObservationPartial);
   const displayQuota: MainPolicyQuotaObservation = isMain && mainWriter && policyQuota?.shortWindowAbsent === true
     ? { ...quota, shortWindowAbsent: true }
     : quota;
@@ -544,6 +553,7 @@ export function withoutRetiredCodexQuota<T extends Omit<StoredAccountQuota, "upd
   return snapshotHasUsage(next) || snapshotHasCredits(next) ? next as T : null;
 }
 
+/** Parse `x-codex-*` rate-limit headers into a quota observation, binding the raw reset values so decision evidence can keep invalid resets distinct from the display fields. */
 export function parseUpstreamQuotaHeaders(headers: Headers, options?: { modelId?: string }): Omit<StoredAccountQuota, "updatedAt"> | null {
   if (isRetiredCodexSparkModel(options?.modelId)) return null;
   const primaryRaw = headers.get("x-codex-primary-used-percent");
@@ -610,9 +620,15 @@ export function parseUpstreamQuotaHeaders(headers: Headers, options?: { modelId?
     if (tertiaryResetAt !== undefined) quota.monthlyResetAt = tertiaryResetAt;
   }
 
+  if (decisionQuotaSinkActive()) bindRawCodexDecisionResets(quota, {
+    short: primaryResetRaw,
+    weekly: primaryIsMonthly || primaryIsShort || primaryPercent === undefined ? secondaryResetRaw : primaryResetRaw,
+    monthly: primaryIsMonthly && primaryPercent !== undefined ? primaryResetRaw : tertiaryResetRaw,
+  }, Date.now());
   return hasKnownQuotaValue(quota) ? quota : null;
 }
 
+/** Apply upstream rate-limit headers for an account: publish display and policy quota and, only for a valid observation, the advisory decision evidence. */
 export function applyAccountQuotaFromUpstreamHeaders(
   accountId: string,
   headers: Headers,
@@ -629,7 +645,7 @@ export function applyAccountQuotaFromUpstreamHeaders(
     .some(name => isInvalidPolicyUsagePercent(headers.get(name)));
   setAccountQuotaFromParsed(accountId, quota, writerGeneration, mainWriter, policyQuota,
     options?.poolWriter && validHistory ? { writer: options.poolWriter, observedAt: Date.now(), source: "response-header", raw: quota } : undefined,
-    options?.poolResponse === true);
+    options?.poolResponse === true, true, validHistory ? quota : null);
 }
 
 export function updateAccountQuota(
@@ -822,7 +838,10 @@ function forgetCodexQuotaBaseline(accountId?: string): void {
     });
 }
 
+/** Clear stored quota, advisory decision evidence and history for one account, or for all accounts when no id is given. */
 export function clearAccountQuota(accountId?: string): void {
+  clearDecisionAccountQuotas("codex", accountId);
+  if (!accountId || accountId === MAIN_CODEX_ACCOUNT_ID) clearDecisionAccountQuotas("codex-main");
   if (!accountId || accountId === MAIN_CODEX_ACCOUNT_ID) forgetMainAccountUsage();
   if (accountId) hydrateAccountQuotasFromDisk();
   quotaHistory.clear(accountId);
@@ -1009,6 +1028,11 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
 
   if (resetCredits !== undefined) quota.resetCredits = resetCredits;
 
+  if (decisionQuotaSinkActive()) bindRawCodexDecisionResets(quota, {
+    short: primaryWindow?.reset_at,
+    weekly: primaryIsMonthly || weeklyCandidatePercent === undefined ? secondaryWindow?.reset_at : primaryWindow?.reset_at,
+    monthly: primaryIsMonthly && primaryPercent !== undefined ? primaryWindow?.reset_at : tertiaryWindow?.reset_at,
+  }, Date.now());
   return hasKnownQuotaValue(quota) || snapshotHasCredits(quota) ? quota : null;
 }
 

package/src/codex/websocket-activity.ts

@@ -0,0 +1,161 @@
+import { createHash } from "node:crypto";
+import { isAuthorizedProviderExecutedCall, type ProviderExecutedCallType } from "../server/responses-undeclared-tool-guard";
+
+// Logical recency avoids clock adjustments and ties between messages in one millisecond.
+let activityOrder = 0;
+const MAX_PENDING_RESULTS = 1024;
+const MAX_RESULT_ID_LENGTH = 1024;
+const resultTypes: Readonly<Record<string, string>> = {
+  function_call: "function_call_output",
+  custom_tool_call: "custom_tool_call_output",
+  local_shell_call: "function_call_output",
+  shell_call: "shell_call_output",
+  computer_call: "computer_call_output",
+  apply_patch_call: "apply_patch_call_output",
+  tool_search_call: "tool_search_output",
+  mcp_approval_request: "mcp_approval_response",
+};
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function resultKey(type: string, id: string): string {
+  return createHash("sha256").update(JSON.stringify([type, id])).digest("hex");
+}
+
+/** Content-free activity owned by one admitted incoming Responses socket. */
+export class CodexWebSocketActivity {
+  lastUsed = ++activityOrder;
+  closing = false;
+  private turns = 0;
+  private pendingResults = new Set<string>();
+  private returnedResults = new Set<string>();
+  // Hashed identities only; null marks a route-authorized provider-owned call.
+  private argumentCalls = new Map<string, { type: string; result: string | null }>();
+  // Unknown/oversized identities cannot safely prove that client work finished.
+  private untrackedResults = false;
+
+  get idle(): boolean {
+    return !this.closing && this.turns === 0 && this.pendingResults.size === 0 && !this.untrackedResults;
+  }
+
+  touch(): void {
+    this.lastUsed = ++activityOrder;
+  }
+
+  /** Each turn retains its own busy reference, including superseded async cleanup. */
+  beginTurn(input: unknown): () => void {
+    this.turns += 1;
+    this.touch();
+    this.acceptResults(input);
+    // Ordinary creates start a new response even when its upstream omits response.created.
+    // Prior results settle old waits, but cannot suppress new calls reusing their IDs.
+    this.returnedResults.clear();
+    this.argumentCalls.clear();
+    let finished = false;
+    return () => {
+      if (finished) return;
+      finished = true;
+      this.turns -= 1;
+      if (this.turns === 0) this.touch();
+    };
+  }
+
+  /** Called only after admission or native control accepts the client's results. */
+  acceptResults(input: unknown): void {
+    if (this.untrackedResults) return;
+    if (Array.isArray(input)) {
+      for (const item of input) {
+        if (!record(item) || typeof item.type !== "string") continue;
+        const id = item.type === "mcp_approval_response" ? item.approval_request_id : item.call_id;
+        if (typeof id === "string" && id.length <= MAX_RESULT_ID_LENGTH) {
+          // Ordinary Codex shell results use function_call_output; native steering
+          // also accepts its explicit local_shell_call_output continuation stub.
+          const type = item.type === "local_shell_call_output" ? "function_call_output" : item.type;
+          const key = resultKey(type, id);
+          if (this.pendingResults.delete(key)) {
+            if (this.returnedResults.size >= MAX_PENDING_RESULTS) { this.protectUntracked(); return; }
+            else this.returnedResults.add(key);
+          }
+        }
+      }
+    }
+  }
+
+  /** Preserve tool waits even when the response terminal omits its output array. */
+  observePayload(payload: string, providerExecuted?: ReadonlySet<ProviderExecutedCallType>): void {
+    if (this.untrackedResults) return;
+    let frame: unknown;
+    try { frame = JSON.parse(payload); } catch { return; }
+    if (!record(frame)) return;
+    // Native injection can return a result before the same terminal repeats its call.
+    if (frame.type === "response.created") {
+      this.returnedResults.clear();
+      this.argumentCalls.clear();
+    }
+    if (frame.type === "response.output_item.added") this.rememberArgumentCall(frame.item, providerExecuted);
+    if (frame.type === "response.function_call_arguments.done" || frame.type === "response.custom_tool_call_input.done") {
+      const type = frame.type === "response.function_call_arguments.done" ? "function_call" : "custom_tool_call";
+      const call = typeof frame.item_id === "string" && frame.item_id.length <= MAX_RESULT_ID_LENGTH
+        ? this.argumentCalls.get(resultKey("item", frame.item_id)) : undefined;
+      if (!call || call.type !== type) this.protectUntracked();
+      else if (call.result !== null) this.observeResultKey(call.result);
+    }
+    if (frame.type === "response.output_item.done") this.observeOutput(frame.item, providerExecuted);
+    if (["response.completed", "response.incomplete", "response.failed"].includes(String(frame.type))
+      && record(frame.response) && Array.isArray(frame.response.output)) {
+      for (const item of frame.response.output) this.observeOutput(item, providerExecuted);
+    }
+  }
+
+  private rememberArgumentCall(item: unknown, providerExecuted?: ReadonlySet<ProviderExecutedCallType>): void {
+    if (!record(item) || (item.type !== "function_call" && item.type !== "custom_tool_call")) return;
+    if (typeof item.id !== "string" || !item.id.length || item.id.length > MAX_RESULT_ID_LENGTH) return;
+    const key = resultKey("item", item.id);
+    const hosted = providerExecuted && isAuthorizedProviderExecutedCall(item, providerExecuted);
+    if (!hosted && (typeof item.call_id !== "string" || !item.call_id.length || item.call_id.length > MAX_RESULT_ID_LENGTH)) {
+      if (this.argumentCalls.has(key)) this.protectUntracked();
+      return;
+    }
+    const result = hosted ? null : resultKey(resultTypes[item.type]!, item.call_id as string);
+    const previous = this.argumentCalls.get(key);
+    if (previous) {
+      if (previous.type !== item.type || previous.result !== result) this.protectUntracked();
+      return;
+    }
+    if (this.argumentCalls.size >= MAX_PENDING_RESULTS) { this.protectUntracked(); return; }
+    // An unfinished argument stream alone does not prove the client started work.
+    this.argumentCalls.set(key, { type: item.type, result });
+  }
+
+  private observeOutput(item: unknown, providerExecuted?: ReadonlySet<ProviderExecutedCallType>): void {
+    if (this.untrackedResults) return;
+    if (!record(item) || typeof item.type !== "string") return;
+    // Hosted execution may publish both the call and its result in the output stream.
+    this.acceptResults([item]);
+    if (!Object.hasOwn(resultTypes, item.type)) return;
+    if (providerExecuted && isAuthorizedProviderExecutedCall(item, providerExecuted)) return;
+    if (item.type === "tool_search_call" && item.execution !== "client") return;
+    const id = item.type === "mcp_approval_request" ? item.id
+      : item.type === "local_shell_call" || item.type === "tool_search_call" ? item.call_id ?? item.id : item.call_id;
+    if (typeof id !== "string" || !id.length || id.length > MAX_RESULT_ID_LENGTH) {
+      this.protectUntracked();
+      return;
+    }
+    this.observeResultKey(resultKey(resultTypes[item.type]!, id));
+  }
+
+  private observeResultKey(key: string): void {
+    if (this.pendingResults.has(key) || this.returnedResults.has(key)) return;
+    if (this.pendingResults.size >= MAX_PENDING_RESULTS) this.protectUntracked();
+    else this.pendingResults.add(key);
+  }
+
+  private protectUntracked(): void {
+    this.untrackedResults = true;
+    this.pendingResults.clear();
+    this.returnedResults.clear();
+    this.argumentCalls.clear();
+  }
+}

package/src/codex/websocket-registry.ts

@@ -1,23 +1,47 @@
 import type { ServerWebSocket } from "bun";
 import type { WsData } from "../server/ws-bridge";
 import { createAdmissionGate, type AdmissionMetrics, type AdmissionReservation } from "../lib/admission";
+import { CodexWebSocketActivity } from "./websocket-activity";
 
 export const MAX_TRACKED_CODEX_WEBSOCKETS = 128;
 const websocketGate = createAdmissionGate("codex_websockets", MAX_TRACKED_CODEX_WEBSOCKETS);
+const admittedSockets = new Set<ServerWebSocket<WsData>>();
+
+function reclaimOldestIdleSocket(): void {
+  let oldest: ServerWebSocket<WsData> | undefined;
+  for (const ws of admittedSockets) {
+    const activity = ws.data.responsesActivity;
+    if (!activity?.idle || ws.data.nativeControl || ws.readyState !== 1 || ws.getBufferedAmount() !== 0) continue;
+    if (!oldest || activity.lastUsed < oldest.data.responsesActivity!.lastUsed) oldest = ws;
+  }
+  if (!oldest) return;
+  // Fence late frames before closing. Only the actual close callback releases admission.
+  oldest.data.responsesActivity!.closing = true;
+  try {
+    oldest.close(1001, "Idle Responses connection reclaimed");
+  } catch {
+    // A failed/delayed close never manufactures a free slot or retries another victim.
+    if (oldest.readyState === 1) oldest.data.responsesActivity!.closing = false;
+  }
+}
 
 export function tryReserveCodexWebSocket(): AdmissionReservation<ServerWebSocket<WsData>> | null {
+  if (websocketGate.metrics().active >= MAX_TRACKED_CODEX_WEBSOCKETS) reclaimOldestIdleSocket();
   const gateLease = websocketGate.tryAcquire();
   if (!gateLease) return null;
   let socket: ServerWebSocket<WsData> | undefined;
   let active = true;
   return {
     bind(value) {
-      if (!active) return;
+      if (!active || socket) return;
       socket = value;
+      socket.data.responsesActivity = new CodexWebSocketActivity();
+      admittedSockets.add(socket);
     },
     release() {
       if (!active) return;
       active = false;
+      if (socket) admittedSockets.delete(socket);
       socket = undefined;
       gateLease.release();
     },

package/src/combos/failover.ts

@@ -666,8 +666,9 @@ function isDefiniteContextOverflowMessage(text: string): boolean {
  * arbitrary field that happens to sit in the first 500 bytes authorize a hop, so it fails closed.
  *
  * Only the exact proxy wrapper is unwrapped, within a fixed envelope budget and 16,384 characters.
+ * Exported for the sidecar loops, which classify their own provider failures with the same rule.
  */
-function isDefiniteContextOverflow(status: number, message: string): boolean {
+export function isDefiniteContextOverflow(status: number, message: string): boolean {
   if (!CONTEXT_VERDICT_STATUSES.has(status) && status < 500) return false;
   if (message.length > 16_384) return false;
   let text = message.trim();

package/src/combos/jev-model-backend.ts

@@ -1,3 +1,6 @@
+import { boundedJevQuotaPayload, jevQuotaCandidates, withJevQuotaSummary } from "./jev-quota-route";
+import { JEV_QUOTA_INSTRUCTION } from "./jev-quota";
+import { serializeJevModelRequest, type JevModelRequestBody } from "./jev-model-request";
 import {
   buildJevState,
   candidatesFitRequestBounds,
@@ -25,11 +28,14 @@ export interface JevModelInvokeRequest {
   instructions: string;
   input: string;
   signal: AbortSignal;
+  /** Budget-only fallback, selected by the detached invoker before admission or dispatch. */
+  withoutQuota?: Pick<JevModelRequestBody, "instructions" | "input">;
 }
 
 export interface JevModelInvokeResult {
   text: string;
   usage?: Record<string, number>;
+  quotaOmitted?: true;
 }
 
 export type JevModelInvoke = (request: JevModelInvokeRequest) => Promise<JevModelInvokeResult>;
@@ -69,29 +75,45 @@ export function parseJevModelChoice(text: string, allowed: ReadonlySet<string>):
   return choice;
 }
 
+/** Resolve a JEV decision through the decision model, falling back with a gate reason on any failure; quota tiers are advisory input only and never widen the allowlist. */
 export async function resolveJevModelDecision(
   options: ResolveJevDecisionOptions & { decisionModel: string; invokeModel: JevModelInvoke },
 ): Promise<JevDecision> {
   const now = options.now ?? Date.now;
   const startedAt = now();
+  let candidates = options.candidates;
+  /** Build the fallback decision for a failure gate, attaching the quota summary for the candidates in scope. */
   const failed = (gate: Exclude<JevDecision["gate"], "apply">): JevDecision =>
-    fallbackDecision(options.fallback, gate, Math.max(0, now() - startedAt), "model");
+    withJevQuotaSummary(fallbackDecision(options.fallback, gate, Math.max(0, now() - startedAt), "model"), candidates);
 
   if (options.signal?.aborted) throw options.signal.reason;
   if (options.candidates.length === 0) return failed("no_choices");
   if (!candidatesFitRequestBounds(options.candidates)) return failed("invalid");
 
   let routeOptions: JevRouteOptionDescriptor[];
-  let input: string;
+  let input = "";
+  let instructions = JEV_MODEL_INSTRUCTIONS;
+  let withoutQuota: JevModelInvokeRequest["withoutQuota"];
   try {
     routeOptions = jevRouteOptions(options.candidates);
     if (routeOptions.length > JEV_MODEL_MAX_OPTIONS) return failed("invalid");
     const state = buildJevState(options.body, options.candidates);
     if (!hasJevDecisionState(state)) return failed("no_state");
-    input = buildJevModelPrompt(state, options.candidates);
-    if (new TextEncoder().encode(JEV_MODEL_INSTRUCTIONS + input).byteLength > JEV_MAX_REQUEST_BYTES) {
+    const payload = boundedJevQuotaPayload(jevQuotaCandidates(options), rows => {
+      instructions = JEV_MODEL_INSTRUCTIONS + (rows.some(row => row.quota) ? " " + JEV_QUOTA_INSTRUCTION : "");
+      input = buildJevModelPrompt(state, rows);
+      if (options.decisionQuotaSignals !== true) return instructions + input;
+      const request = { model: options.decisionModel, instructions, input };
+      return serializeJevModelRequest(request);
+    }, JEV_MAX_REQUEST_BYTES);
+    candidates = payload.candidates;
+    if (new TextEncoder().encode(payload.body).byteLength > JEV_MAX_REQUEST_BYTES) {
       return failed("invalid");
     }
+    if (candidates.some(row => row.quota)) {
+      withoutQuota = { instructions: JEV_MODEL_INSTRUCTIONS,
+        input: buildJevModelPrompt(state, candidates.map(({ quota: _quota, ...row }) => row)) };
+    }
   } catch {
     return failed("invalid");
   }
@@ -99,7 +121,8 @@ export async function resolveJevModelDecision(
   const timeoutSignal = AbortSignal.timeout(jevDecisionTimeoutMs(options.timeoutMs));
   const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
   try {
-    const result = await options.invokeModel({ model: options.decisionModel, instructions: JEV_MODEL_INSTRUCTIONS, input, signal });
+    const result = await options.invokeModel({ model: options.decisionModel, instructions, input, signal, ...(withoutQuota ? { withoutQuota } : {}) });
+    if (result.quotaOmitted) candidates = candidates.map(({ quota: _quota, ...row }) => row);
     if (options.signal?.aborted) throw options.signal.reason;
     if (timeoutSignal.aborted) return failed("timeout");
     let choice: string;
@@ -111,14 +134,14 @@ export async function resolveJevModelDecision(
     const selected = routeOptions.find(option => option.key === choice)!;
     const usage = jevUsage({ usage: result.usage });
     if (options.signal?.aborted) throw options.signal.reason;
-    return {
+    return withJevQuotaSummary({
       backend: "model",
       targetKey: selected.targetKey,
       effort: selected.effort,
       gate: "apply",
       latencyMs: Math.max(0, now() - startedAt),
       ...(usage ? { usage } : {}),
-    };
+    }, candidates);
   } catch (error) {
     if (options.signal?.aborted) throw options.signal.reason;
     if (timeoutSignal.aborted || (error instanceof Error && error.name === "TimeoutError")) return failed("timeout");

package/src/combos/jev-model-request.ts

@@ -0,0 +1,20 @@
+/** The exact detached Responses envelope, shared by quota sizing and the invoker. */
+export const JEV_MODEL_MAX_OUTPUT_TOKENS = 1024;
+export interface JevModelRequestBody {
+  model: string;
+  instructions: string;
+  input: string;
+}
+/** Serialize the streaming decision-model request body, adding the reasoning effort only when one is given. */
+export function serializeJevModelRequest(request: JevModelRequestBody, effort?: string): string {
+  return JSON.stringify({
+    model: request.model,
+    stream: true,
+    store: false,
+    instructions: request.instructions,
+    input: [{ role: "user", content: [{ type: "input_text", text: request.input }] }],
+    tools: [],
+    max_output_tokens: JEV_MODEL_MAX_OUTPUT_TOKENS,
+    ...(effort ? { reasoning: { effort } } : {}),
+  });
+}