@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/server/responses/core-combo.ts

@@ -1,6 +1,7 @@
 import { effectiveAzureOutputBudget } from "../../adapters/azure";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
-import type { CodexAccountModelRefusal } from "../../combos/failover";
+import { comboCooldownRetryAfterSeconds, type CodexAccountModelRefusal } from "../../combos/failover";
+import { fallbackTriggerForStatus, guardFallbackHop } from "../../routing/fallback-policy";
 import {
   isCodexReasoningEffort,
   isDeclaredReasoningEffort,
@@ -32,6 +33,7 @@ import {
   isComboTargetInCooldown,
   snapshotComboQuotaCooldowns,
   comboExclusionReasons,
+  comboTargetSkipTrigger,
   noteComboSuccess,
   comboFailureDecision,
   advanceComboAfterFailure,
@@ -124,6 +126,20 @@ import { clientWireOf } from "../inference/client-wire";
  */
 export const COMBO_TARGET_BASE_SENDS = CODEX_TEXT_GUARDED_BUDGET_POLICY.baseSendAllowance;
 
+/**
+ * OCX-11: where a combo target physically dispatches, after provider aliases and
+ * blockedModelRedirects. A target that does not resolve keeps its configured selector; its
+ * dispatch fails on its own.
+ */
+function resolvedComboDestination(config: OcxConfig, target: { provider: string; model: string }): { provider: string; model: string } {
+  try {
+    const route = routeConcreteModel(config, `${target.provider}/${target.model}`);
+    return { provider: route.providerName, model: route.modelId };
+  } catch {
+    return { provider: target.provider, model: target.model };
+  }
+}
+
 function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId: string, label: string | undefined): string | undefined {
   if (!label) return undefined;
   const instance = configuredAnthropicInstance(config, providerName);
@@ -638,6 +654,30 @@ export async function executeComboResponses(
       ? clientCancelledResponse()
       : comboUnavailable(comboId, undefined, comboExclusionReasons(config, comboId, targetEligible));
   }
+  // OCX-11: an ordered failover combo that starts on a later target than its first one, for any
+  // reason (cooling down, provider disabled, cached quota spent, ineligible for this request),
+  // makes a proactive hop, so the fallback policy decides before anything is sent. Both ends are
+  // the resolved destinations, after provider aliases and blockedModelRedirects.
+  const primaryTarget = combo.targets[0];
+  // An allowed hop is recorded only once its dispatch is admitted below.
+  let pendingHopCommit: (() => void) | undefined;
+  if (!toolLoopPin && (combo.strategy ?? "failover") === "failover" && primaryTarget
+    && targetKey(primaryTarget) !== targetKey(pick.target)) {
+    const primaryCooling = isComboTargetInCooldown(comboId, primaryTarget, initialNow);
+    const proactive = guardFallbackHop(config, {
+      site: "combo",
+      route: `combo/${comboId}`,
+      aliases: [requestedModel],
+      from: resolvedComboDestination(config, primaryTarget),
+      to: resolvedComboDestination(config, pick.target),
+      trigger: primaryCooling ? "cooldown" : comboTargetSkipTrigger(config, primaryTarget, initialNow),
+      admission: options.admission,
+      retryAfter: primaryCooling ? comboCooldownRetryAfterSeconds(comboId, initialNow) ?? null : null,
+      now: initialNow,
+    });
+    if (!proactive.ok) return proactive.response;
+    pendingHopCommit = proactive.commit;
+  }
   let jevDecision: JevDecision | undefined;
   if (combo.strategy === "jev" && !toolLoopPin) {
     const choices = eligibleJevComboChoices(config, comboId, targetEligible, Date.now());
@@ -760,6 +800,9 @@ export async function executeComboResponses(
   // no-more-targets branch; a budget refusal ends the ladder one iteration later, where that
   // iteration's own `childLog` is already out of scope.
   let lastFailedChildLog: RequestLogContext | undefined;
+  // The target behind `lastFailure`, so the next dispatch can tell a hop from a same-target retry.
+  let lastFailedTarget: { provider: string; model: string } | undefined;
+  let lastFailedRetryAfter: string | undefined;
   // The exhausted-combo mapping below runs outside the loop, where `failure.upstreamCode`
   // is gone, so carry the loop's own classification decision instead of re-deriving a
   // weaker one from the status alone (#4149).
@@ -812,7 +855,29 @@ export async function executeComboResponses(
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
+    // The physical destination after provider aliases and blockedModelRedirects: hops are
+    // classified by where the request really goes, not by the selector the combo names.
     const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
+    // OCX-11: every later dispatch after a failure is a hop when the target changed. One check
+    // here covers the ordinary failover pick and the recovery picks alike.
+    if (!firstComboTarget && lastFailure && lastFailedTarget) {
+      const hop = guardFallbackHop(config, {
+        site: "combo",
+        route: `combo/${comboId}`,
+        aliases: [requestedModel],
+        from: lastFailedTarget,
+        to: { provider: targetRoute.providerName, model: targetRoute.modelId },
+        trigger: fallbackTriggerForStatus(lastFailure.status),
+        admission: options.admission,
+        failureStatus: lastFailure.status,
+        retryAfter: lastFailedRetryAfter ?? null,
+      });
+      if (!hop.ok) {
+        if (lastFailedChildLog) adoptFailedChildLog(lastFailedChildLog);
+        return hop.response;
+      }
+      pendingHopCommit = hop.commit;
+    }
     // The inherited spend tracker observes this parent log, before the child has its own label.
     logCtx.spendPoolId = targetRoute.providerName;
     // Combo prepays before its child normalizes the route; the parent tracker must
@@ -851,6 +916,9 @@ export async function executeComboResponses(
       // an earlier one already recorded one.
       return exhaustedFailure();
     }
+    // Admitted: only now is a guarded hop to this target recorded as taken.
+    pendingHopCommit?.();
+    pendingHopCommit = undefined;
     const initialSend = hopDecision?.allowed ? { permit: hopDecision.permit, producerOwned: false } : undefined;
     try {
     comboTargetsDispatched += 1;
@@ -1147,6 +1215,9 @@ export async function executeComboResponses(
       quotaFailedChildLog = childLog;
     }
     lastFailedChildLog = childLog;
+    // The failed child's resolved destination, so the next hop compares physical targets.
+    lastFailedTarget = { provider: targetRoute.providerName, model: targetRoute.modelId };
+    lastFailedRetryAfter = failure.retryAfter;
     // A replacement that answers 200 is unmarked, and its zero-output failure only exists once
     // preflight has rebuilt the stream as a fresh Response. A spent grant never hops: a status the
     // client would resend becomes the refusal, and anything else reaches the client as it is.
@@ -1165,6 +1236,9 @@ export async function executeComboResponses(
       : comboFailureDecision(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
         codexModelRefusal: failure.codexModelRefusal,
+        // The adapter the failed leg actually resolved: a configured `kiro` provider can route a
+        // model through another wire via `modelAdapters`, and an unresolved leg grants no hop.
+        failedAdapter: childLog.providerAdapter,
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.

package/src/server/responses/core-opaque-recovery.ts

@@ -259,8 +259,15 @@ export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
       }
     }
 
-    // The flat stream-error envelope carries type/message at the top level rather than under
-    // an error object; the same anchored identity applies there.
+    // Flat SSE error events carry their code/message beside type:error, without a nested
+    // error object. Match only the same dedicated code or exact verification identity.
+    if ((record.error === undefined || record.error === null)
+      && (record.type === "error" || record.type === "invalid_request_error")
+      && (record.code === "invalid_encrypted_content" || ((record.code === null || record.code === undefined)
+        && typeof record.message === "string" && record.message.startsWith("The encrypted content ")
+        && record.message.endsWith(" could not be verified. Reason: Encrypted content could not be decrypted or parsed.")))) return true;
+
+    // The caller-mismatch identity also arrives as a flat typed error.
     if (
       record.type === "invalid_request_error"
       && typeof record.message === "string"
@@ -277,14 +284,14 @@ export function isSelfIdentifiedOpaqueBlobRejection(bodyText: string): boolean {
 
 
 /**
- * Opted-in native reasoning retention forwards ciphertext another model or account minted. ChatGPT
- * can refuse it inside a 200 stream -- a Codex WebSocket `error` frame or `response.failed` --
- * rather than as an HTTP 4xx, so the passthrough inspects the zero-output prelude of exactly these
- * requests. Ordinary turns keep the function-output-only inspection.
+ * Opaque state can be refused inside a 200 stream rather than as an HTTP 4xx. The passthrough
+ * inspects its bounded zero-output prelude even when a restored thread has no serving record;
+ * successful native ciphertext remains unchanged and blobless turns do not gain inspection.
  */
 export function retainedReasoningStreamCandidate(parsed: OcxParsedRequest, outboundBody: string | undefined): boolean {
-  return parsed._nativeReasoningRetainedAcrossRoute === true
-    && parsed._stripReasoningEncryptedContent !== true
+  // A restored thread has no process-local serving record. Inspect its actual outbound
+  // opaque state too; only an explicit zero-output rejection can authorize the rebuild.
+  return parsed._stripReasoningEncryptedContent !== true
     && outboundResponsesBodyCarriesOpaqueBlob(outboundBody);
 }
 
@@ -310,7 +317,7 @@ export function retainedReasoningStreamRejection(
 
 
 /**
- * Whether an upstream Responses 4xx authoritatively rejected opaque replay state.
+ * Whether an upstream Responses 4xx or explicitly identified 502 rejected opaque replay state.
  *
  * The outbound-body check is intentional: the inbound transcript may contain a proxy envelope or
  * compaction blob that the adapter already lowered, in which case a replay would be byte-identical.
@@ -329,8 +336,10 @@ export function shouldAttemptOpaqueBlobRecovery(args: {
   const acceptedStatus = (args.status >= 400 && args.status < 500)
     || (
       args.status === 502
-      && outboundResponsesBodyCarriesEncryptedFunctionOutput(args.outboundBody)
-      && isEncryptedFunctionOutputRejection(args.errorBody)
+      // Gateways can project a reasoning-only rejection as 502. The existing strict
+      // identity classifier below still excludes generic gateway/transport failures.
+      && (!isEncryptedFunctionOutputRejection(args.errorBody)
+        || outboundResponsesBodyCarriesEncryptedFunctionOutput(args.outboundBody))
     );
   return acceptedStatus
     && adapterSpeaksResponsesWire(args.adapterName)

package/src/server/responses/deepseek-image-files.ts

@@ -0,0 +1,121 @@
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { AdapterRequest } from "../../adapters/base";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+
+// DeepSeek's image-token accounting does not include the inline base64 wire cost.
+// https://api-docs.deepseek.com/guides/vision/ documents a separate 48 MiB body cap.
+const INLINE_THRESHOLD = 40 * 1024 * 1024;
+const TARGET_BYTES = 32 * 1024 * 1024;
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_REPAIR_BYTES = 128 * 1024 * 1024;
+const MAX_CACHE_ENTRIES = 512;
+const CACHE_MS = 50 * 60 * 1000;
+let activeRepairs = 0;
+const files = new Map<string, { id: string; until: number }>();
+
+/** Narrow parsed JSON objects without treating arrays as image or message records. */
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Only the first-party Responses image contract, never a similarly named gateway. */
+export function needsDeepSeekImageFiles(request: AdapterRequest): boolean {
+  const url = new URL(request.url);
+  return url.origin === "https://api.deepseek.com"
+    && (url.pathname === "/responses" || url.pathname === "/v1/responses")
+    && request.method === "POST"
+    && Buffer.byteLength(request.body, "utf8") > INLINE_THRESHOLD;
+}
+
+/**
+ * Replace older inline images with same-account, expiring file references. The client history
+ * and images stay intact; provider token usage and Codex's compaction policy remain truthful.
+ * The caller owns the provider's transport, cancellation and credential-selection fence.
+ */
+export async function deepSeekImageFileBody(
+  request: AdapterRequest,
+  execute: typeof globalThis.fetch,
+  abortSignal?: AbortSignal,
+  options?: { allowedModels: readonly string[]; budget?: TranslatorBudget },
+): Promise<string | undefined> {
+  if (!options?.allowedModels.length || !needsDeepSeekImageFiles(request)) return undefined;
+  const requestBytes = Buffer.byteLength(request.body, "utf8");
+  if (requestBytes > MAX_REPAIR_BYTES) throw new Error("DeepSeek image replay exceeds the 128 MiB repair limit; compact the request.");
+  if (activeRepairs >= 2) throw new Error("DeepSeek image replay preparation is busy; retry after an active request completes.");
+  activeRepairs++;
+  const releaseCopy = options.budget?.observeAcceptedRequestCopy(requestBytes * 2);
+  try {
+    abortSignal?.throwIfAborted();
+    const body: unknown = JSON.parse(request.body);
+    if (!record(body) || !options.allowedModels.includes(String(body.model))
+      || !Array.isArray(body.input)) return undefined;
+    const auth = new Headers(request.headers).get("authorization");
+    if (!auth) return undefined;
+    const scope = new Bun.CryptoHasher("sha256").update(auth).digest("hex");
+    const signal = AbortSignal.any([...(abortSignal ? [abortSignal] : []), AbortSignal.timeout(60_000)]);
+    let bytes = Buffer.byteLength(request.body, "utf8");
+    let changed = false;
+    for (const item of body.input) {
+      if (!record(item)) continue;
+      const parts = item.type === "function_call_output" || item.type === "custom_tool_call_output"
+        ? item.output : item.role === "user" || item.role === "developer" ? item.content : undefined; // DeepSeek rejects other roles' images.
+      if (!Array.isArray(parts)) continue;
+      for (const part of parts) {
+        if (bytes <= TARGET_BYTES) break;
+        // file_id ignores detail; keep explicit low-resolution requests inline.
+        if (!record(part) || part.type !== "input_image" || part.file_id !== undefined
+          || part.detail === "low" || typeof part.image_url !== "string") continue;
+        const match = /^data:(image\/(?:png|jpeg|webp|gif));base64,/.exec(part.image_url);
+        if (!match) continue;
+        signal.throwIfAborted();
+        const data = part.image_url.slice(match[0].length);
+        if (data.length > Math.ceil(MAX_FILE_BYTES / 3) * 4) continue;
+        const hash = new Bun.CryptoHasher("sha256").update(part.image_url).digest("hex");
+        const key = `${scope}:${hash}`;
+        let entry = files.get(key);
+        if (entry && entry.until <= Date.now()) { files.delete(key); entry = undefined; }
+        if (!entry) {
+          // Conservative peak: UTF-16 base64 slice/re-encoding, decoded buffer, Blob and multipart.
+          const releaseUpload = options.budget?.observeExternallyCapped("provider_image_upload", data.length * 4 + Math.ceil(data.length * 3 / 4) * 3 + 65_536);
+          try {
+            const image = Buffer.from(data, "base64");
+            if (image.length > MAX_FILE_BYTES || image.toString("base64") !== data) continue;
+            const form = new FormData();
+            form.set("purpose", "user_data");
+            form.set("expires_after[anchor]", "created_at");
+            form.set("expires_after[seconds]", "3600");
+            form.set("file", new Blob([image], { type: match[1] }), "image");
+            // Never follow a redirect with credentials or copy request-specific Content-Length.
+            const response = await execute("https://api.deepseek.com/files", {
+              method: "POST", headers: { authorization: auth }, body: form, signal, redirect: "manual",
+            });
+            if (!response.ok) {
+              await response.body?.cancel();
+              throw new Error(`DeepSeek image upload failed (HTTP ${response.status}); conversation images were preserved.`);
+            }
+            const result = await readBoundedResponseBody(response, { signal, maxBytes: 65_536 });
+            let uploaded: unknown;
+            try { uploaded = JSON.parse(result.text); } catch { /* Safe, fixed error below. */ }
+            if (result.truncated || !record(uploaded) || typeof uploaded.id !== "string"
+              || !/^file-api-[A-Za-z0-9_-]{1,200}$/.test(uploaded.id)) {
+              throw new Error("DeepSeek image upload returned an invalid file reference; conversation images were preserved.");
+            }
+            // Cache only opaque ids and hashes, not image bytes or plaintext credentials.
+            entry = { id: uploaded.id, until: Date.now() + CACHE_MS };
+            if (typeof uploaded.expires_at === "number") entry.until = Math.min(entry.until, uploaded.expires_at * 1000 - 60_000);
+            while (files.size >= MAX_CACHE_ENTRIES) files.delete(files.keys().next().value!);
+            files.set(key, entry);
+          } finally { releaseUpload?.(); }
+        }
+        const removedBytes = part.image_url.length + "image_url".length;
+        delete part.image_url;
+        part.file_id = entry.id;
+        bytes += entry.id.length + "file_id".length - removedBytes;
+        changed = true;
+      }
+    }
+    if (!changed) return undefined;
+    const releaseSerialization = options.budget?.observeExternallyCapped("passthrough_serialization", requestBytes * 2);
+    try { return JSON.stringify(body); } finally { releaseSerialization?.(); }
+  } finally { releaseCopy?.(); activeRepairs--; }
+}

package/src/server/responses/empty-completion-guard.ts

@@ -243,6 +243,11 @@ export async function* guardEmptyCompletionEventStream(
     heldBytes = 0;
     return released;
   };
+  // Held events from a discarded attempt are released with the retry's output, so a boundary
+  // keeps the retry's reasoning from being appended to the discarded attempt's reasoning item.
+  const markRetryBoundary = () => {
+    if (held.length > 0 && held.at(-1)?.type !== "assistant_boundary") held.push({ type: "assistant_boundary" });
+  };
 
   while (true) {
     let terminalSeen = false;
@@ -279,6 +284,7 @@ export async function* guardEmptyCompletionEventStream(
         if (retries < maxRetries) {
           // Suppress the terminal: the client must never see a completed event
           // for a turn that produced nothing. Retry the identical turn.
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -300,6 +306,7 @@ export async function* guardEmptyCompletionEventStream(
           // malformed function call). Nothing actionable reached the client, so this is the same
           // replay-safe shape as an empty completion: retry the identical turn once.
           usage = mergeUsage(usage, event.usage);
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -351,6 +358,7 @@ export async function* guardEmptyCompletionEventStream(
       // actionable reached the client. Retry once, then surface a stated error
       // instead of letting the bridge reduce the turn to adapter_eof.
       if (!sawContent && !passthrough && retries < maxRetries) {
+        markRetryBoundary();
         retries += 1;
         try {
           source = await options.continuation();

package/src/server/responses/encrypted-payload.ts

@@ -265,13 +265,13 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   // codex-rs appends one agent_message (any of the four codex-rs message types) at the
   // current input tail. Historical
   // agent messages may be adjacent in full-history bodies; they must not poison the
-  // later task. compaction_trigger/additional_tools are trailing metadata rather than
-  // a newer user turn.
+  // later task. compaction_trigger/additional_tools/configuration_update are trailing
+  // metadata rather than a newer user turn; Codex may record an effort update after the task.
   let index = input.length - 1;
   while (index >= 0) {
     const item = input[index];
     const type = item && typeof item === "object" ? (item as { type?: unknown }).type : undefined;
-    if (type !== "compaction_trigger" && type !== "additional_tools") break;
+    if (type !== "compaction_trigger" && type !== "additional_tools" && type !== "configuration_update") break;
     index -= 1;
   }
   const item = input[index];

package/src/server/responses/fetch-helpers.ts

@@ -1,4 +1,5 @@
 import type { NativeResponseControl } from "./native-response-control";
+import { PROVIDER_HEADER_DEADLINE as HEADER_DEADLINE, type ProviderHeaderDeadline as HeaderDeadline } from "../../lib/provider-admission-wait";
 import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
 import {
@@ -62,9 +63,6 @@ export function physicalSendObserverInit(observer: AccountAutoPauseObserver | un
 }
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
-// Replacement admission waits on the client signal, outside the response-header deadline.
-const HEADER_DEADLINE = Symbol("header-deadline");
-type HeaderDeadline = { clientSignal: AbortSignal; pause(): void; resume(): void };
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -248,6 +246,20 @@ export function sendWithConnectionPolicy(
   });
 }
 
+interface CodexWsExecutor { provider: OcxProviderConfig; http: typeof globalThis.fetch }
+const codexWsExecutors = new WeakMap<object, CodexWsExecutor>();
+const codexWsExecutor = (send: (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => Promise<Response>, binding: CodexWsExecutor) => {
+  codexWsExecutors.set(send, binding);
+  return send as typeof globalThis.fetch;
+};
+/**
+ * Set for the executor a `dispatchOverride` receives on the WS branch: it must not get HTTP-only
+ * send policy. `provider` is the one WS eligibility was checked against; a dispatch-time
+ * replacement was not, so it sends through `http` (the same fallback) instead.
+ */
+export const codexWsExecutorBinding = (execute: unknown): CodexWsExecutor | undefined =>
+  typeof execute === "function" ? codexWsExecutors.get(execute) : undefined;
+
 export interface ProviderFetchOptions {
   accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
@@ -330,7 +342,9 @@ export function providerFetch(
   ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
-      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>,
+      // False only for the HTTP fallback of a WS send the override already wrapped: one logical send.
+      override: ProviderFetchOptions["dispatchOverride"] | null = options.dispatchOverride) => {
       // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
       // attempt accounting and consumes admission state, so a refusal firing after it would
       // charge an attempt for a send that never happens, and a throwing hook would mask the
@@ -340,7 +354,7 @@ export function providerFetch(
       // full decision can be made now. With an override, only the configured value is checked:
       // the override may rebuild against a different host and select a different transport, and
       // refusing on this destination would reject a request whose real route is fine.
-      if (options.dispatchOverride) egressFor(input);
+      if (override) egressFor(input);
       else providerEgressSendInit(egressBinding, transport, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
@@ -357,8 +371,8 @@ export function providerFetch(
           else if (!notified) { options.onPhysicalDispatch!(); notified = true; }
         } } : {}),
       };
-      return options.dispatchOverride
-        ? options.dispatchOverride(input, dispatchInit, dispatch, reacquirePacing)
+      return override
+        ? override(input, dispatchInit, dispatch, reacquirePacing)
         : dispatch(input, dispatchInit);
     },
     { preconnect },
@@ -397,9 +411,15 @@ export function providerFetch(
         options.onPhysicalDispatch?.();
       };
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
-        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing)) as typeof globalThis.fetch;
-      return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
+        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing, null)) as typeof globalThis.fetch;
+      const wsSend = codexWsExecutor((url: Parameters<typeof globalThis.fetch>[0], wsInit?: RequestInit) => codexWsUpstreamFetch(String(url), wsInit ?? init,
+        fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold),
+        { provider, http: markEgressTransparentExecutor(fallback) });
+      // A WS frame is a physical send like any other, so it runs the same override: that is where a
+      // key-auth send is committed to its attempt row and the send budget is rebound to the
+      // credential that left. Without it a key-auth WS turn logged `sendCount: 0`.
+      return options.dispatchOverride ? options.dispatchOverride(input, init, wsSend, reacquirePacing) : wsSend(input, init);
     }
     return httpFetch(input, init, reacquirePacing);
   };

package/src/server/responses/input-admission.ts

@@ -55,6 +55,9 @@ const REMOTE_IMAGE_TOKENS = 850;
 /** Decoded image bytes per token. Coarse tile-count proxy, not a provider formula. */
 const IMAGE_BYTES_PER_TOKEN = 750;
 
+/** Compressed-audio bytes per token. More conservative than the image proxy. */
+const AUDIO_BYTES_PER_TOKEN = 256;
+
 export interface InputAdmissionResult {
   admitted: boolean;
   estimatedTokens: number;
@@ -85,6 +88,7 @@ function imageTokens(imageUrl: string): number {
 function contentPartTokens(part: OcxContentPart, modelId: string): number {
   if (part.type === "image") return imageTokens(part.imageUrl);
   if (part.type === "video") return imageTokens(part.videoUrl);
+  if (part.type === "audio") return base64PayloadTokens(part.data, AUDIO_BYTES_PER_TOKEN);
   // An inline document is a base64 payload, not a sentence: estimating it from its marker would
   // admit a request whose real input is orders of magnitude larger. Counted arithmetically —
   // rebuilding the data URL here would materialize a second request-sized string just to measure it.
@@ -92,10 +96,10 @@ function contentPartTokens(part: OcxContentPart, modelId: string): number {
   return estimateTokens(part.text, modelId);
 }
 
-function base64PayloadTokens(base64: string): number {
+function base64PayloadTokens(base64: string, bytesPerToken = IMAGE_BYTES_PER_TOKEN): number {
   if (base64.length === 0) return 0;
   const decoded = Math.floor((base64.length * 3) / 4);
-  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+  return Math.max(1, Math.ceil(decoded / bytesPerToken));
 }
 
 function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {

package/src/server/responses/main-hard-lock-routing.ts

@@ -1,6 +1,8 @@
 import type { OcxConfig } from "../../types";
 import { resolveComboId } from "../../combos";
-import { isBareOpenAiFamilyModel } from "../../router";
+import { isBareOpenAiFamilyModel, previewRouteModel, routeConcreteModel } from "../../router";
+import { resolveChosenTarget } from "./shadow-target-availability";
+import { getRoutingProfile, resolvePolicyProfileId, type NormalizedRoutingProfile } from "../../routing/profile";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
 import {
   getMainAccountHardLockStatus,
@@ -10,6 +12,9 @@ import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
 import { getEligiblePoolAccounts } from "../../codex/routing/selection";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
+import { FallbackRefusedError, guardFallbackHop, type FallbackAdmission, type FallbackTarget } from "../../routing/fallback-policy";
+/** Resolves to a synchronous ownership proof, or null when the caller does not own the locked main. */
+export type MainHardLockCallerCheck = (sourceModel: string) => Promise<(() => boolean) | null>;
 
 function isConfiguredComboSelector(config: OcxConfig, modelId: string): boolean {
   const comboId = resolveComboId(config, modelId);
@@ -72,11 +77,13 @@ function rawModelOf(body: unknown): { raw: Record<string, unknown>; model: strin
  * - Luna Reserve keeps its own admission policy (`assertReserveAdmission`); its helper
  *   traffic is not operator chat and must not silently change models.
  */
-export function applyMainHardLockFallbackOverride(
+export async function applyMainHardLockFallbackOverride(
   body: unknown,
   config: OcxConfig,
-  now = Date.now(),
-): MainHardLockFallbackOverride | null {
+  now?: number,
+  callerCheck?: MainHardLockCallerCheck,
+  admission?: FallbackAdmission,
+): Promise<MainHardLockFallbackOverride | null> {
   const parsed = rawModelOf(body);
   if (!parsed) return null;
   const fallback = resolveMainAccountHardLockFallback(config);
@@ -85,16 +92,51 @@ export function applyMainHardLockFallbackOverride(
   if (!isBareOpenAiFamilyModel(parsed.model)
     || parsed.model === NATIVE_RESERVE_MODEL
     || isConfiguredComboSelector(config, parsed.model)) return null;
-  if (getMainAccountHardLockStatus(config, now).state !== "blocked") return null;
   const accountMode = providerCodexAccountMode(
     OPENAI_CODEX_PROVIDER_ID,
     config.providers?.[OPENAI_CODEX_PROVIDER_ID],
   );
-  if (accountMode !== "direct"
-    && getEligiblePoolAccounts(config, undefined, now, codexQuotaScopeForModel(parsed.model)).length > 0) {
-    return null;
+  if (accountMode === "direct") {
+    // Direct may forward a different caller's healthy credential. Only stored-main substitution
+    // or an observed-main match owes this lock. Recheck usage after the startup binding wait.
+    const stillOwnsLockedMain = callerCheck ? await callerCheck(parsed.model) : null;
+    // Everything from here to the rewrite is synchronous, so this proof cannot go stale before it.
+    if (!stillOwnsLockedMain?.()) return null;
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+  } else {
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+    if (getEligiblePoolAccounts(config, undefined, now ?? Date.now(), codexQuotaScopeForModel(parsed.model)).length > 0) return null;
   }
 
+  // Combos and policies keep their own dispatch admission and declared failover/evidence.
+  // Other chosen targets must resolve now; a removed qualifier cannot become a default send.
+  const policyId = resolvePolicyProfileId(config, fallback.model);
+  if (!isConfiguredComboSelector(config, fallback.model)
+    && !(policyId && getRoutingProfile(config, policyId))) {
+    try {
+      const target = resolveChosenTarget(fallback.model, model => previewRouteModel(config, model));
+      if ("unavailable" in target) return null;
+    } catch {
+      // An unavailable target keeps the source lock's refusal without touching the body.
+      return null;
+    }
+  }
+
+  // OCX-11: the reroute is a proactive model hop; refused, the request is answered with the
+  // fallback refusal and the body is left untouched.
+  const hop = guardFallbackHop(config, {
+    site: "hard-lock",
+    route: parsed.model,
+    from: { provider: OPENAI_CODEX_PROVIDER_ID, model: parsed.model },
+    to: hardLockTargetOf(config, parsed.model, fallback.model),
+    trigger: "hard_lock",
+    admission,
+    ...(now !== undefined ? { now } : {}),
+  });
+  if (!hop.ok) throw new FallbackRefusedError(hop.response);
+  // The rewrite is this site's admission: the body now names the fallback model.
+  hop.commit();
+
   parsed.raw.model = fallback.model;
   if (fallback.reasoningEffort !== undefined) {
     const reasoning = parsed.raw.reasoning;
@@ -107,3 +149,38 @@ export function applyMainHardLockFallbackOverride(
   }
   return { sourceModel: parsed.model, targetModel: fallback.model };
 }
+
+/**
+ * The hop's destination for the fallback policy, read from config only. A routing profile picks
+ * its candidate from request-history evidence, and evaluating it here would open that index under
+ * OPENCODEX_HOME just to classify the hop (on Windows the open handle then outlives the request's
+ * home); the profile's own dispatch still evaluates it. Its declared candidates are classified
+ * instead, as the hop the profile could take: a candidate on another provider makes it a provider
+ * hop. Combos, account namespaces and concrete targets resolve from config alone.
+ */
+function hardLockTargetOf(config: OcxConfig, sourceModel: string, model: string): FallbackTarget {
+  const policyId = resolvePolicyProfileId(config, model);
+  const profile = policyId ? getRoutingProfile(config, policyId) : undefined;
+  if (profile) return profileHopTarget(config, sourceModel, profile);
+  try {
+    const route = previewRouteModel(config, model);
+    return { provider: route.providerName, model: route.modelId };
+  } catch {
+    const slash = model.indexOf("/");
+    return slash > 0 ? { provider: model.slice(0, slash), model: model.slice(slash + 1) } : { provider: "", model };
+  }
+}
+
+function profileHopTarget(config: OcxConfig, sourceModel: string, profile: NormalizedRoutingProfile): FallbackTarget {
+  const targets = profile.candidates.map((candidate): FallbackTarget => {
+    try {
+      const route = routeConcreteModel(config, candidate.provider + "/" + candidate.model);
+      return { provider: route.providerName, model: route.modelId };
+    } catch {
+      return { provider: candidate.provider, model: candidate.model };
+    }
+  });
+  return targets.find(target => target.provider !== OPENAI_CODEX_PROVIDER_ID)
+    ?? targets.find(target => target.model !== sourceModel)
+    ?? { provider: OPENAI_CODEX_PROVIDER_ID, model: sourceModel };
+}