codex-multi-auth 2.21.0 → 2.23.0

package/dist/lib/runtime-rotation-proxy.js

@@ -1,6 +1,8 @@
+import { createAutomaticApiCheck, startAutomaticApiChecks } from "./runtime/automatic-api-checks.js";
 import { startAutomaticAccountChecks } from "./runtime/automatic-account-checks.js";
 import { createAutomaticSubscriptionCheck } from "./runtime/automatic-subscription-checks.js";
 import { ClientCancellationError } from "./request/client-cancellation.js";
+import { fetchWithProxy } from "./request/proxy-fetch.js";
 import { createNativeAccountStorageReader } from "./runtime/native-account-storage.js";
 import { resetSnapshotQuota } from "./runtime/reset-credits.js";
 import { createResetCreditService, loadResetCreditState } from "./runtime/account-reset-credits.js";
@@ -14,6 +16,7 @@ import { modelScopeId, workspaceModelScopes } from "./runtime/workspace-model-sc
 import { RuntimeCapabilityFailures, classifyCapabilityFailure } from "./runtime/runtime-capability-failures.js";
 import { ResponseOutcome } from "./request/response-outcome.js";
 import { ResponsesWebSocketGateway } from "./runtime/responses-websocket.js";
+import { enrichPersistedApiCapabilities } from "./runtime/persisted-api-capabilities.js";
 import { ApiModelCapabilities } from "./runtime/api-model-capabilities.js";
 import { saveModelInventory } from "./runtime/model-discovery-status.js";
 import { loadApiRoutes, updateApiModelDiscovery } from "./api-route-store.js";
@@ -46,10 +49,10 @@ import { normalizeEmailKey } from "./storage/identity.js";
 import { buildPinnedUnavailableErrorBody, buildTokenInvalidationBody, extractErrorCodeFromBody, isTokenInvalidationError, normalizeExhaustionStatus, parseRetryAfterBodyMs, parseRetryAfterHeaderMs, } from "./request/rate-limit-decision.js";
 import { forwardStreamingResponse, HOP_BY_HOP_HEADERS, readErrorBody, responseHeadersForClient, withTimeout, } from "./request/stream-failover-runtime.js";
 import { getAccountRecoveryBoundsForFamily } from "./runtime/account-status.js";
-import { chooseAccount } from "./runtime/rotation-account-selection.js";
-import { createRotationProxyState, recoverStaleRuntimeState, } from "./runtime/rotation-proxy-state.js";
+import { chooseAccount, chooseTranscriptionAccount } from "./runtime/rotation-account-selection.js";
+import { createRotationProxyState, recoverStaleRuntimeState, reloadRuntimeCredentials, } from "./runtime/rotation-proxy-state.js";
 import { readStorageMetaFromDisk } from "./runtime/rotation-storage-meta.js";
-import { applyMonotonicAuthCooldown, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, ensureFreshAccessToken, } from "./runtime/rotation-token-refresh.js";
+import { applyMonotonicAuthCooldown, DEFAULT_AUTH_FAILURE_COOLDOWN_MS, ensureFreshAccessToken, redirectRuntimeRefreshCommits, resolveRuntimeRefreshTarget, } from "./runtime/rotation-token-refresh.js";
 import { SessionAffinityStore } from "./session-affinity.js";
 import { isRecord, sleep } from "./utils.js";
 export { buildPinnedUnavailableErrorBody, buildTokenInvalidationBody, } from "./request/rate-limit-decision.js";
@@ -294,9 +297,11 @@ const MODEL_CAPACITY_RETRY_ENV = "CODEX_MULTI_AUTH_MODEL_CAPACITY_RETRY_MS";
 function getApiModelRuntime(state) {
     if (state.apiModelRuntime)
         return state.apiModelRuntime;
-    const capabilities = state.apiModelCapabilities ??= new ApiModelCapabilities();
     const production = state.readApiRoutes === loadApiRoutes;
-    state.apiModelRuntime = new ApiModelRuntime(state.fetchImpl, state.now, production ? updateApiModelDiscovery : undefined, production ? (models, refresh, route, force) => capabilities.enrich(models, refresh, route, force) : undefined, () => {
+    // Public documentation survives refresh outages without retaining paid probe state.
+    if (production)
+        state.apiModelCapabilities ??= new ApiModelCapabilities(state.upstreamFetchImpl, state.now);
+    state.apiModelRuntime = new ApiModelRuntime(state.fetchImpl, state.now, production ? updateApiModelDiscovery : undefined, production ? (models, refresh, route, force) => enrichPersistedApiCapabilities(models, refresh, route, force, { fetchImpl: state.upstreamFetchImpl, now: state.now, metadata: state.apiModelCapabilities, requireStoredRoute: true }) : undefined, () => {
         const runtime = state.apiModelRuntime;
         if (!runtime)
             return;
@@ -362,6 +367,9 @@ const ALLOWED_IMAGE_PATHS = new Set([
     "/v1/images/generations",
     "/v1/images/edits",
 ]);
+const ALLOWED_TRANSCRIBE_PATHS = new Set([
+    URL_PATHS.TRANSCRIBE,
+]);
 const ALLOWED_THREAD_GOAL_PATHS = new Set([
     "/thread/goal/get",
     "/thread/goal/set",
@@ -737,6 +745,19 @@ function buildImageRequestContext(req, body, pathname) {
         family: "codex",
     };
 }
+function buildTranscribeRequestContext(req, body) {
+    return {
+        body,
+        headers: headersFromIncoming(req),
+        method: "POST",
+        upstreamPath: URL_PATHS.TRANSCRIBE,
+        model: null,
+        family: "codex",
+        stream: false,
+        sessionKey: null,
+        stableSessionKey: null,
+    };
+}
 function buildModelsRequestContext(req) {
     return {
         body: Buffer.alloc(0),
@@ -794,7 +815,7 @@ function writeJson(res, status, payload) {
 function writeMethodOrPathError(res) {
     writeJson(res, 404, {
         error: {
-            message: "Runtime rotation proxy only accepts Responses API, images, model discovery, and Codex thread goal requests.",
+            message: "Runtime rotation proxy only accepts Responses API, images, transcription, model discovery, and Codex thread goal requests.",
             code: "runtime_rotation_proxy_not_found",
         },
     });
@@ -809,7 +830,7 @@ function writeUnauthorized(res) {
 }
 function writePoolExhausted(params) {
     const { res, accountManager, family, model, reason } = params;
-    const waitMs = accountManager.getMinWaitTimeForFamily(family, model);
+    const waitMs = params.retryAfterMs ?? accountManager.getMinWaitTimeForFamily(family, model);
     const accountCount = accountManager.getAccountCount();
     const accountSkipReasons = params.accountSkipReasons ?? {};
     recordRuntimePoolExhaustion({
@@ -859,7 +880,7 @@ export async function startRuntimeRotationProxy(options) {
     const routingMutexMode = getRoutingMutexMode(pluginConfig);
     activeAccountManager.setRoutingMutexMode(routingMutexMode);
     const schedulingStrategy = getSchedulingStrategy(pluginConfig);
-    const fetchImpl = options.fetchImpl ?? fetch;
+    const fetchImpl = options.fetchImpl ?? fetchWithProxy;
     const host = options.host ?? DEFAULT_HOST;
     // Defense in depth (runtime-proxy-01): the proxy presents managed OAuth tokens
     // and must never be reachable off-box. It is loopback-only with NO opt-out —
@@ -959,6 +980,7 @@ export async function startRuntimeRotationProxy(options) {
         routingMutexMode,
         schedulingStrategy,
         fetchImpl,
+        upstreamFetchImpl: fetchImpl,
         upstreamBaseUrl,
         clientApiKey,
         now,
@@ -1015,12 +1037,13 @@ export async function startRuntimeRotationProxy(options) {
         websocketGateway.attach(server, `http://${urlHost}:${resolvedPort}`);
     // Embedded managers own their own lifecycle; ordinary CLI/app routers check opted-in accounts periodically.
     const automaticChecks = options.accountManager ? undefined : startAutomaticAccountChecks(createAutomaticSubscriptionCheck());
+    const automaticApiChecks = options.accountManager || options.readApiRoutes ? undefined : startAutomaticApiChecks(createAutomaticApiCheck(fetchImpl));
     return {
         host: bindHost,
         port: resolvedPort,
         baseUrl: `http://${urlHost}:${resolvedPort}`,
         close: async () => {
-            await automaticChecks?.stop();
+            await Promise.all([automaticChecks?.stop(), automaticApiChecks?.stop()]);
             websocketGateway.close();
             await closeServer(server, sockets);
             await flushRuntimeInferenceActivity();
@@ -1032,8 +1055,13 @@ export async function startRuntimeRotationProxy(options) {
         getOpenConnectionCount: () => sockets.size,
         getStatus: () => ({
             ...state.status,
+            schedulingStrategy: state.schedulingStrategy,
             websocketConnections: websocketGateway.stats.connections,
             websocketUpstreamRequests: websocketGateway.stats.upstreamRequests,
+            websocketActiveConnections: websocketGateway.stats.activeConnections,
+            websocketCapacityReclaims: websocketGateway.stats.capacityReclaims,
+            lastWebsocketUpgradeRejection: websocketGateway.stats.lastUpgradeRejection,
+            lastWebsocketDisconnect: websocketGateway.stats.lastDisconnect,
             // Redact any email/token material that leaked into a raw upstream or
             // refresh error string before exposing it to status/report consumers
             // (errors-logging-08). maskString is a no-op for clean diagnostic text.
@@ -1100,8 +1128,10 @@ async function handleRequestInner(state, req, res, traceId) {
                 const accounts = accountManager.getAccountsSnapshot();
                 const sameInventory = accounts.length === disk.accounts.length && accounts.every((a, i) => isSameNativeAccount(a, disk.accounts[i]));
                 if (!sameInventory) {
+                    const previousManager = accountManager;
                     accountManager = new AccountManager(undefined, disk);
                     accountManager.setRoutingMutexMode(state.routingMutexMode);
+                    redirectRuntimeRefreshCommits(previousManager, accountManager);
                     // Preserve independently learned limits by identity, never by the old index.
                     // A record id survives an email change; the account identity survives a
                     // re-login that re-derives an unstored record id. Rows with neither an
@@ -1172,15 +1202,16 @@ async function handleRequestInner(state, req, res, traceId) {
         const isResponsesRequest = req.method === "POST" && isResponsesPath(incomingUrl.pathname);
         const isModelsRequest = req.method === "GET" && isModelsPath(incomingUrl.pathname);
         const isImageRequest = req.method === "POST" && ALLOWED_IMAGE_PATHS.has(incomingUrl.pathname);
+        const isTranscribeRequest = req.method === "POST" && ALLOWED_TRANSCRIBE_PATHS.has(incomingUrl.pathname);
         const isThreadGoalRequest = (req.method === "GET" || req.method === "POST") &&
             isThreadGoalPath(incomingUrl.pathname);
         if (!isResponsesRequest && !isModelsRequest &&
-            !isThreadGoalRequest && !isImageRequest) {
+            !isThreadGoalRequest && !isImageRequest && !isTranscribeRequest) {
             writeMethodOrPathError(res);
             return;
         }
         state.status.totalRequests += 1;
-        let requestBody = isResponsesRequest || isImageRequest ||
+        let requestBody = isResponsesRequest || isImageRequest || isTranscribeRequest ||
             (isThreadGoalRequest && req.method === "POST")
             ? await readRequestBody(req, state.maxRequestBodyBytes)
             : Buffer.alloc(0);
@@ -1211,7 +1242,9 @@ async function handleRequestInner(state, req, res, traceId) {
                 ? buildThreadGoalRequestContext(req, requestBody, incomingUrl.pathname)
                 : isImageRequest
                     ? buildImageRequestContext(req, requestBody, incomingUrl.pathname)
-                    : buildResponsesRequestContext(req, requestBody);
+                    : isTranscribeRequest
+                        ? buildTranscribeRequestContext(req, requestBody)
+                        : buildResponsesRequestContext(req, requestBody);
         if (isResponsesRequest) {
             context.headers.delete("content-encoding");
             context.headers.delete("content-length");
@@ -1263,7 +1296,9 @@ async function handleRequestInner(state, req, res, traceId) {
                     ? "thread-goal"
                     : isImageRequest
                         ? "images"
-                        : "responses",
+                        : isTranscribeRequest
+                            ? "transcribe"
+                            : "responses",
             model,
             projectKey,
             requestId: traceId,
@@ -1504,6 +1539,74 @@ async function handleRequestInner(state, req, res, traceId) {
         const readSubscriptionQuota = state.readSubscriptionQuota;
         const subscriptionQuotaCache = state.nativeOpenai && isResponsesRequest && readSubscriptionQuota ? await cachedRead(state, "subscription-quota", readSubscriptionQuota).catch(() => null) ?? null : null;
         const subscriptionQuotaByAccount = {};
+        const workspaceIds = (account) => new Set([
+            account.accountId?.trim(),
+            ...(account.workspaces ?? []).map((workspace) => workspace.id.trim()),
+        ].filter((value) => Boolean(value)));
+        const uniqueAccount = (candidates) => candidates.length === 1 ? candidates[0] ?? null : null;
+        const matchReplacementAccount = (previous, previousManager, replacementManager) => {
+            const replacementAccounts = replacementManager.getAccountsSnapshot();
+            // Only a persisted record id is stable across re-login; a derived
+            // in-memory id hashes the refresh token and changes on rotation.
+            if (previous.recordId && previousManager.hasPersistedRecordId(previous)) {
+                return uniqueAccount(replacementAccounts.filter((candidate) => candidate.recordId === previous.recordId));
+            }
+            const sourceIds = workspaceIds(previous);
+            const compatible = replacementAccounts.filter((candidate) => {
+                const candidateIds = workspaceIds(candidate);
+                return !(sourceIds.size > 0 &&
+                    candidateIds.size > 0 &&
+                    ![...sourceIds].some((id) => candidateIds.has(id)));
+            });
+            const sourceEmail = sanitizeEmail(previous.email);
+            return (uniqueAccount(compatible.filter((candidate) => candidate.refreshToken === previous.refreshToken)) ??
+                (previous.accountId && sourceEmail
+                    ? uniqueAccount(compatible.filter((candidate) => candidate.accountId === previous.accountId && sanitizeEmail(candidate.email) === sourceEmail))
+                    : null) ??
+                // accountId alone cannot merge logins: two members of one workspace
+                // share it. Known-but-different emails are different logins, so the
+                // remap must not adopt the sibling row for the removed account.
+                (previous.accountId
+                    ? uniqueAccount(compatible.filter((candidate) => candidate.accountId === previous.accountId &&
+                        (!sourceEmail ||
+                            !sanitizeEmail(candidate.email) ||
+                            sanitizeEmail(candidate.email) === sourceEmail)))
+                    : null) ??
+                (sourceEmail
+                    ? uniqueAccount(compatible.filter((candidate) => sanitizeEmail(candidate.email) === sourceEmail))
+                    : null));
+        };
+        const remapRequestWorkspaceState = (previousManager, replacementManager) => {
+            const previousAccounts = previousManager.getAccountsSnapshot();
+            const oldCandidates = [...workspaceCandidates.entries()];
+            const oldQuota = { ...subscriptionQuotaByAccount };
+            workspaceCandidates.clear();
+            for (const key of Object.keys(subscriptionQuotaByAccount)) {
+                delete subscriptionQuotaByAccount[Number(key)];
+            }
+            for (const [previousIndex, scopes] of oldCandidates) {
+                const previous = previousAccounts.find((account) => account.index === previousIndex);
+                if (!previous)
+                    continue;
+                const replacement = matchReplacementAccount(previous, previousManager, replacementManager);
+                if (!replacement)
+                    continue;
+                const live = replacementManager.getAccountByIndex(replacement.index);
+                if (!live)
+                    continue;
+                const currentScopes = new Map(workspaceModelScopes(live).map((scope) => [scope.accountId, scope]));
+                const remapped = scopes
+                    .map((scope) => currentScopes.get(scope.accountId))
+                    .filter((scope) => Boolean(scope?.routable));
+                // Keep an explicit empty candidate list: it is a request-local guard that
+                // prevents fallback to a stored workspace binding when every catalog-approved
+                // scope disappeared or became unroutable during the manager swap.
+                workspaceCandidates.set(live.index, remapped);
+                if (oldQuota[previousIndex] !== undefined) {
+                    subscriptionQuotaByAccount[live.index] = oldQuota[previousIndex];
+                }
+            }
+        };
         const resetCreditState = state.nativeOpenai && isResponsesRequest ? await cachedRead(state, "reset-credits", loadResetCreditState).catch(() => null) : null;
         const quotaForScope = (account, scope) => {
             // Scoped observations belong to this credential and workspace; legacy entries only describe the binding.
@@ -1517,8 +1620,65 @@ async function handleRequestInner(state, req, res, traceId) {
         // A stored `switch` pin is a hard constraint in native mode too (#702), not a
         // preference: it fails with codex_pinned_account_unavailable rather than
         // silently serving from another account.
-        const pinnedIndex = state.forcedAccountIndex ?? storageMeta.pinnedAccountIndex;
+        let pinnedIndex = state.forcedAccountIndex ?? storageMeta.pinnedAccountIndex;
         const isPinned = typeof pinnedIndex === "number";
+        let pinnedIdentityAccount = isPinned && typeof pinnedIndex === "number"
+            ? accountManager.getAccountByIndex(pinnedIndex) ?? null
+            : null;
+        let pinnedIdentityMissing = false;
+        const matchPinnedReplacementAccount = (previousManager, previous, replacementManager) => {
+            const replacements = replacementManager.getAccountsSnapshot();
+            // A persisted record id is authoritative. Legacy rows receive a derived
+            // in-memory id whose hash includes the refresh token; an external re-login
+            // can therefore change that derived id for the same workspace. In that legacy
+            // case continue to the strict workspace/account fallback below.
+            if (previous.recordId && previousManager.hasPersistedRecordId(previous)) {
+                return uniqueAccount(replacements.filter((candidate) => candidate.recordId === previous.recordId));
+            }
+            const sourceIds = workspaceIds(previous);
+            const compatible = replacements.filter((candidate) => {
+                const candidateIds = workspaceIds(candidate);
+                return !(sourceIds.size > 0 &&
+                    candidateIds.size > 0 &&
+                    ![...sourceIds].some((id) => candidateIds.has(id)));
+            });
+            const sourceEmail = sanitizeEmail(previous.email);
+            // Hard pins deliberately omit the email-only fallback used by request-local
+            // workspace remapping. Same-email sibling logins are not interchangeable.
+            return (uniqueAccount(compatible.filter((candidate) => candidate.refreshToken === previous.refreshToken)) ??
+                (previous.accountId && sourceEmail
+                    ? uniqueAccount(compatible.filter((candidate) => candidate.accountId === previous.accountId && sanitizeEmail(candidate.email) === sourceEmail))
+                    : null) ??
+                (previous.accountId
+                    ? uniqueAccount(compatible.filter((candidate) => {
+                        if (candidate.accountId !== previous.accountId)
+                            return false;
+                        const candidateEmail = sanitizeEmail(candidate.email);
+                        return !sourceEmail || !candidateEmail || candidateEmail === sourceEmail;
+                    }))
+                    : null));
+        };
+        const remapPinnedAccount = (previousManager, replacementManager) => {
+            if (!isPinned || typeof pinnedIndex !== "number" || pinnedIdentityMissing)
+                return;
+            // If the pin resolved when this request began, bind the request to that
+            // account identity rather than to an index that can be reused after a
+            // concurrent inventory change. A pin that was already out of range keeps
+            // the legacy numeric behavior because there is no identity to preserve.
+            const source = pinnedIdentityAccount ?? previousManager.getAccountByIndex(pinnedIndex) ?? null;
+            if (!source)
+                return;
+            const replacement = matchPinnedReplacementAccount(previousManager, source, replacementManager);
+            const live = replacement ? replacementManager.getAccountByIndex(replacement.index) ?? null : null;
+            if (!live) {
+                pinnedIdentityMissing = true;
+                pinnedIdentityAccount = source;
+                accountSkipReasons.set(pinnedIndex, "missing");
+                return;
+            }
+            pinnedIndex = live.index;
+            pinnedIdentityAccount = live;
+        };
         let requestModelCatalog;
         /** Rebuild native routing scopes after Luna is rewritten to separately metered Reserve. */
         const rebuildReserveWorkspaceCandidates = async () => {
@@ -1719,13 +1879,23 @@ async function handleRequestInner(state, req, res, traceId) {
                     models = await refresh;
                 else {
                     const cached = pickerSnapshot();
-                    if (cached.length)
+                    // An API cache can be warm while this client-version's OAuth
+                    // catalog is still cold. Give subscription discovery the same
+                    // bounded opportunity as an entirely empty picker.
+                    const oauthReady = modelCatalog.cachedList(routableKeys).length > 0 ||
+                        routableKeys.every(key => modelCatalog.hasUsablePickerSnapshot(key));
+                    if (cached.length && oauthReady)
                         models = cached;
                     else {
                         let timer;
                         try {
                             models = await Promise.race([refresh, new Promise(resolve => {
-                                    timer = setTimeout(() => resolve(pickerSnapshot()), 2000);
+                                    timer = setTimeout(() => {
+                                        // Do not let an incomplete API-only success replace the
+                                        // native client's complete cached catalog for minutes.
+                                        const missingSubscription = routableKeys.length > 0 && !modelCatalog.cachedList(routableKeys).length;
+                                        resolve(missingSubscription && routableKeys.some(key => !modelCatalog.hasUsablePickerSnapshot(key)) ? [] : pickerSnapshot());
+                                    }, 2000);
                                 })]);
                         }
                         finally {
@@ -1734,6 +1904,12 @@ async function handleRequestInner(state, req, res, traceId) {
                         }
                     }
                 }
+                // A completed failed fetch is still unknown, not a successful
+                // empty catalog. Never replace native subscription entries with
+                // an API-only success while a routable catalog is unknown.
+                if (!forceCatalogRefresh && !models.some(model => !/^(api|zdr)\//.test(model.slug)) &&
+                    routableKeys.some(key => !modelCatalog.hasUsablePickerSnapshot(key)))
+                    models = [];
                 res.setHeader("etag", setCatalogEtag(state, models));
                 writeJson(res, models.length ? 200 : 503, models.length
                     ? { models }
@@ -1812,7 +1988,7 @@ async function handleRequestInner(state, req, res, traceId) {
         // so move the request to the independently metered Reserve model first.
         if (isPinned &&
             (context.model === "gpt-6-luna" || context.model === "gpt-5.6-luna")) {
-            const pinnedAccount = accountManager.getAccountByIndex(pinnedIndex);
+            const pinnedAccount = typeof pinnedIndex === "number" ? accountManager.getAccountByIndex(pinnedIndex) : null;
             const now = state.now();
             const familyResetAt = pinnedAccount?.rateLimitResetTimes[getQuotaKey(context.family)];
             const modelResetAt = pinnedAccount?.rateLimitResetTimes[getQuotaKey(context.family, context.model)];
@@ -1854,9 +2030,10 @@ async function handleRequestInner(state, req, res, traceId) {
         }
         // The token bucket spreads load across a selectable pool. A pin has no
         // alternative account, so exhausting that local heuristic can only reject a
-        // request that the pinned account could serve. Keep circuit-breaker admission
-        // inside consumeToken, but do not debit the pool-scoring bucket for a pin.
-        const bypassPoolTokenBucket = isPinned;
+        // request that the pinned account could serve. Transcription is not inference
+        // and must not debit the Codex model pool or claim its inference circuit probe.
+        // Transcription uses credential-only admission below.
+        const bypassPoolTokenBucket = isPinned || isTranscribeRequest;
         const refundConsumedPoolToken = (account) => {
             if (!bypassPoolTokenBucket) {
                 accountManager.refundToken(account, context.family, context.model);
@@ -1948,7 +2125,9 @@ async function handleRequestInner(state, req, res, traceId) {
             return "retry";
         };
         let runtimeSelectionIterations = 0;
-        while ((isPinned || attemptedIndexes.size < accountCount) &&
+        while ((isPinned ||
+            attemptedIndexes.size < accountCount ||
+            (isTranscribeRequest && !state.nativeOpenai && accountCount === 0 && !reloadedAfterNoAccount)) &&
             transientAttempts < transientAttemptLimit &&
             (!isPinned ||
                 runtimeSelectionIterations - capacityRetries <
@@ -1982,6 +2161,10 @@ async function handleRequestInner(state, req, res, traceId) {
             // calls inside `chooseAccount` are used unchanged and no lock is taken,
             // so default behavior and perf are identical to before.
             const selectAccount = () => {
+                if (pinnedIdentityMissing && typeof pinnedIndex === "number") {
+                    accountSkipReasons.set(pinnedIndex, "missing");
+                    return null;
+                }
                 if (context.model !== LUNA_RESERVE_MODEL) {
                     for (const [index, scopes] of workspaceCandidates) {
                         const account = accountManager.getAccountByIndex(index);
@@ -1993,13 +2176,34 @@ async function handleRequestInner(state, req, res, traceId) {
                             subscriptionQuotaByAccount[index] = subscriptionQuotaPreference(quotaForScope(account, scope), state.now());
                     }
                 }
+                const attemptedForSelection = new Set([...attemptedIndexes, ...catalogExcludedIndexes()]);
+                if (isTranscribeRequest) {
+                    const candidate = chooseTranscriptionAccount({
+                        accountManager,
+                        attemptedIndexes: attemptedForSelection,
+                        policy: policyDecision,
+                        pinnedIndex,
+                        now: state.now(),
+                        transcriptionRateLimitUntilByRecordId: state.transcriptionRateLimitUntilByRecordId,
+                        startIndex: state.transcriptionNextAccountIndex,
+                        // Native inference preference must not pin dictation to the current
+                        // Responses account; transcription owns an independent round-robin cursor.
+                        preferredIndex: null,
+                        fallbackPinnedIndex: state.nativeOpenai ? storageMeta.pinnedAccountIndex : null,
+                        skipReasons: accountSkipReasons,
+                    });
+                    if (candidate && pinnedIndex === null) {
+                        state.transcriptionNextAccountIndex = candidate.index + 1;
+                    }
+                    return candidate;
+                }
                 const result = chooseAccount({
                     accountManager,
                     sessionAffinityStore: state.sessionAffinityStore,
                     sessionKey: context.sessionKey,
                     family: context.family,
                     model: context.model,
-                    attemptedIndexes: new Set([...attemptedIndexes, ...catalogExcludedIndexes()]),
+                    attemptedIndexes: attemptedForSelection,
                     now: state.now(),
                     policy: policyDecision,
                     pinnedIndex,
@@ -2010,12 +2214,13 @@ async function handleRequestInner(state, req, res, traceId) {
                     stickyBoostByAccount: rotationStickyBoost,
                     pidOffsetEnabled: state.pidOffsetEnabled,
                     schedulingStrategy: state.schedulingStrategy,
-                    // Only on a RETRY pass. The first pass still honors a cooldown
-                    // another request left on the pin, so an already-cooling pinned
-                    // account 503s immediately as before; from the second pass on,
-                    // this request's own retry budget outranks the cooldown it just
-                    // created for itself.
-                    allowPinnedCooldown: isPinned && transientAttempts > 0,
+                    // A shared network cooldown is not evidence that the pinned
+                    // credentials cannot serve independent concurrent work. Let each
+                    // new request try; its own retries remain bounded and backed off.
+                    // Other initial cooldowns still block, as do quota/auth/policy
+                    // checks and the circuit admission immediately after selection.
+                    allowPinnedCooldown: isPinned && (transientAttempts > 0 ||
+                        (typeof pinnedIndex === "number" && accountManager.getAccountByIndex(pinnedIndex)?.cooldownReason === "network-error")),
                 });
                 return result;
             };
@@ -2023,6 +2228,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 ? await withRoutingMutex(state.routingMutexMode, async () => {
                     const candidate = selectAccount();
                     if (candidate &&
+                        !isTranscribeRequest &&
                         pinnedIndex === null &&
                         state.schedulingStrategy !== "sequential") {
                         // Re-commit the cursor under the held mutex. Skipped when a
@@ -2042,7 +2248,69 @@ async function handleRequestInner(state, req, res, traceId) {
             for (const index of catalogExcludedIndexes())
                 accountSkipReasons.set(index, "model-not-supported");
             if (!selected) {
-                if (!reloadedAfterNoAccount &&
+                if (isTranscribeRequest &&
+                    !state.nativeOpenai &&
+                    !reloadedAfterNoAccount) {
+                    reloadedAfterNoAccount = true;
+                    const reloadedManager = await reloadRuntimeCredentials(state);
+                    if (reloadedManager && reloadedManager !== accountManager) {
+                        const previousManager = accountManager;
+                        remapPinnedAccount(previousManager, reloadedManager);
+                        accountManager = reloadedManager;
+                        accountCount = accountManager.getAccountCount();
+                        transientAttemptLimit = Math.max(1, Math.min(accountCount, state.maxRuntimeAccountAttempts));
+                        if (runtimePolicyState) {
+                            try {
+                                const reloadedPolicyDecision = await evaluateRuntimePolicy({
+                                    state: runtimePolicyState,
+                                    accounts: accountManager.getAccountsSnapshot(),
+                                    model: context.model,
+                                    now: state.now(),
+                                });
+                                policyDecision = reloadedPolicyDecision;
+                                mutateRuntimeObservabilitySnapshot((snapshot) => {
+                                    snapshot.policyBlockedIndexes = [...reloadedPolicyDecision.blockedAccountIndexes];
+                                    snapshot.policyBlockedReasons = Object.fromEntries([...reloadedPolicyDecision.blockedAccountIndexes].map((index) => [String(index), "policy-blocked"]));
+                                });
+                                if (!reloadedPolicyDecision.allowed) {
+                                    await usageRecorder.record({
+                                        outcome: "blocked",
+                                        statusCode: reloadedPolicyDecision.statusCode,
+                                        errorCode: reloadedPolicyDecision.errorCode,
+                                    });
+                                    writeJson(res, reloadedPolicyDecision.statusCode, {
+                                        error: {
+                                            message: "Runtime policy blocked this local request.",
+                                            code: reloadedPolicyDecision.errorCode ?? "policy_blocked",
+                                            reasons: reloadedPolicyDecision.reasons,
+                                        },
+                                    });
+                                    return;
+                                }
+                            }
+                            catch (error) {
+                                state.status.lastError = error instanceof Error ? error.message : String(error);
+                                await usageRecorder.record({
+                                    outcome: "failure",
+                                    statusCode: HTTP_STATUS.SERVICE_UNAVAILABLE,
+                                    errorCode: "runtime_policy_unavailable",
+                                });
+                                writeJson(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                                    error: {
+                                        message: "Runtime policy could not be loaded for this local request.",
+                                        code: "runtime_policy_unavailable",
+                                    },
+                                });
+                                return;
+                            }
+                        }
+                        accountSkipReasons.clear();
+                        attemptedIndexes.clear();
+                        continue;
+                    }
+                }
+                if (!isTranscribeRequest &&
+                    !reloadedAfterNoAccount &&
                     !isPinned &&
                     accountCount > 0 &&
                     exhaustionReason === "no-account" &&
@@ -2080,7 +2348,8 @@ async function handleRequestInner(state, req, res, traceId) {
             attemptedIndexes.add(selected.index);
             const quotaScheduleKey = buildQuotaScheduleKey(selected, context.family, context.model);
             const preemptiveDeferral = state.preemptiveQuotaScheduler.getDeferral(quotaScheduleKey, state.now());
-            if (context.model !== LUNA_RESERVE_MODEL &&
+            if (!isTranscribeRequest &&
+                context.model !== LUNA_RESERVE_MODEL &&
                 preemptiveDeferral.defer &&
                 preemptiveDeferral.waitMs > 0) {
                 accountSkipReasons.set(selected.index, preemptiveDeferral.reason ?? "quota-near-exhaustion");
@@ -2092,12 +2361,13 @@ async function handleRequestInner(state, req, res, traceId) {
                 noteRotation();
                 continue;
             }
-            // consumeToken also takes the race-safe circuit admission slot, so it
-            // can reject for either gate. Take the reason from the call that
-            // rejected rather than re-deriving it: a second evaluation reports the
-            // first blocker it finds (a live cooldown would mask a drained bucket)
-            // and cannot see a half-open probe slot that was just claimed.
-            const admission = accountManager.consumeTokenWithReason(selected, context.family, context.model, { bypassTokenBucket: bypassPoolTokenBucket });
+            // Inference consumes both the pool token and the race-safe circuit probe.
+            // Transcription deliberately bypasses both: its credential-only selector
+            // already enforced disabled/workspace/auth/policy gates, and claiming the
+            // inference probe here could strand a half-open account after dictation.
+            const admission = isTranscribeRequest
+                ? { ok: true }
+                : accountManager.consumeTokenWithReason(selected, context.family, context.model, { bypassTokenBucket: bypassPoolTokenBucket });
             if (!admission.ok) {
                 accountSkipReasons.set(selected.index, admission.reason);
                 exhaustionReason = "rate-limit";
@@ -2122,8 +2392,75 @@ async function handleRequestInner(state, req, res, traceId) {
                 tokenRefreshSkewMs: state.tokenRefreshSkewMs,
                 tokenInvalidationCooldownMs: state.tokenInvalidationCooldownMs,
             });
+            // A credential reload may have published a replacement manager while this
+            // request was awaiting refresh. Keep the refreshed account and its owner
+            // together for every later mutation/persist; account indexes are local to
+            // one manager and can shift when rows are removed or reordered.
+            if (refreshed.accountManager !== accountManager) {
+                const previousManager = accountManager;
+                remapRequestWorkspaceState(previousManager, refreshed.accountManager);
+                remapPinnedAccount(previousManager, refreshed.accountManager);
+                accountManager = refreshed.accountManager;
+                accountCount = accountManager.getAccountCount();
+                transientAttemptLimit = Math.max(1, Math.min(accountCount, state.maxRuntimeAccountAttempts));
+                if (runtimePolicyState) {
+                    try {
+                        const refreshedPolicyDecision = await evaluateRuntimePolicy({
+                            state: runtimePolicyState,
+                            accounts: accountManager.getAccountsSnapshot(),
+                            model: context.model,
+                            now: state.now(),
+                        });
+                        policyDecision = refreshedPolicyDecision;
+                        mutateRuntimeObservabilitySnapshot((snapshot) => {
+                            snapshot.policyBlockedIndexes = [...refreshedPolicyDecision.blockedAccountIndexes];
+                            snapshot.policyBlockedReasons = Object.fromEntries([...refreshedPolicyDecision.blockedAccountIndexes].map((index) => [String(index), "policy-blocked"]));
+                        });
+                        if (!refreshedPolicyDecision.allowed) {
+                            await usageRecorder.record({
+                                outcome: "blocked",
+                                statusCode: refreshedPolicyDecision.statusCode,
+                                errorCode: refreshedPolicyDecision.errorCode,
+                            });
+                            writeJson(res, refreshedPolicyDecision.statusCode, {
+                                error: {
+                                    message: "Runtime policy blocked this local request.",
+                                    code: refreshedPolicyDecision.errorCode ?? "policy_blocked",
+                                    reasons: refreshedPolicyDecision.reasons,
+                                },
+                            });
+                            return;
+                        }
+                    }
+                    catch (error) {
+                        state.status.lastError = error instanceof Error ? error.message : String(error);
+                        await usageRecorder.record({
+                            outcome: "failure",
+                            statusCode: HTTP_STATUS.SERVICE_UNAVAILABLE,
+                            errorCode: "runtime_policy_unavailable",
+                        });
+                        writeJson(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                            error: {
+                                message: "Runtime policy could not be loaded for this local request.",
+                                code: "runtime_policy_unavailable",
+                            },
+                        });
+                        return;
+                    }
+                }
+                accountSkipReasons.clear();
+                attemptedIndexes.clear();
+            }
             if (!refreshed.ok) {
                 refundConsumedPoolToken(selected);
+                if (refreshed.selectionRestart) {
+                    // The credential row vanished while refresh was in flight. The manager
+                    // swap above already cleared request-local attempt state; restart selection
+                    // without charging a transient auth failure to the replacement pool.
+                    exhaustionReason = "no-account";
+                    capabilityRejectionIsLatest = false;
+                    continue;
+                }
                 // No accountSkipReasons write here: ensureFreshAccessToken always
                 // applies an auth cooldown before returning !ok, so the next
                 // selection pass overwrites whatever this set with
@@ -2157,7 +2494,12 @@ async function handleRequestInner(state, req, res, traceId) {
                 noteRotation();
                 continue;
             }
-            const pendingScopes = workspaceCandidates.get(refreshed.account.index);
+            let pendingScopes = workspaceCandidates.get(refreshed.account.index);
+            if (isTranscribeRequest) {
+                pendingScopes = workspaceModelScopes(refreshed.account)
+                    .filter((scope) => scope.routable)
+                    .sort((a, b) => Number(b.selected) - Number(a.selected) || Number(b.bound) - Number(a.bound));
+            }
             // Revalidate enabled scopes after token refresh; never write a per-request choice to the account.
             const enabledScopes = new Set(workspaceModelScopes(refreshed.account).filter(s => s.routable).map(s => s.id));
             while (pendingScopes?.length && !enabledScopes.has(pendingScopes[0]?.id ?? ""))
@@ -2225,6 +2567,26 @@ async function handleRequestInner(state, req, res, traceId) {
             }
             const accountIdentity = accountIdentityFromAccount(refreshed.account, state.now());
             recordLastRuntimeAccount(state.status, accountIdentity, accountId);
+            // A credential/inventory reload can publish while this request is waiting
+            // on upstream. Resolve response-derived health/auth mutations lazily onto
+            // the latest owner so late transport/429/401/5xx/success state cannot land
+            // only on a superseded manager. If the row vanished entirely, retain the
+            // captured object for this request; there is no replacement row to penalize.
+            const responseCredential = {
+                access: refreshed.accessToken,
+                refreshToken: refreshed.account.refreshToken,
+            };
+            const responseStateTarget = () => resolveRuntimeRefreshTarget(accountManager, refreshed.account) ?? {
+                accountManager,
+                account: refreshed.account,
+            };
+            const responseAuthStateTarget = () => {
+                const target = responseStateTarget();
+                return target.account.access === responseCredential.access &&
+                    target.account.refreshToken === responseCredential.refreshToken
+                    ? target
+                    : null;
+            };
             const outboundHeaders = createOutboundHeaders(context.headers, refreshed.account, refreshed.accessToken, accountId);
             let upstream;
             // Abort the in-flight upstream fetch when the client disconnects
@@ -2314,16 +2676,18 @@ async function handleRequestInner(state, req, res, traceId) {
                     return;
                 }
                 // A timeout may occur after generation; do not retry within this request.
-                if (isImageRequest) {
+                if (isImageRequest || isTranscribeRequest) {
+                    const operation = isImageRequest ? "image" : "transcribe";
+                    const errorCode = `${operation}_upstream_transport_error`;
                     writeJson(res, 502, {
                         error: {
-                            code: "image_upstream_transport_error",
-                            message: "Image upstream transport failed; not retried by the proxy.",
+                            code: errorCode,
+                            message: `${isImageRequest ? "Image" : "Transcription"} upstream transport failed; not retried by the proxy.`,
                         },
                     });
                     await usageRecorder.record({
                         outcome: "failure", statusCode: 502,
-                        errorCode: "image_upstream_transport_error", account: refreshed.account,
+                        errorCode, account: refreshed.account,
                     });
                     return;
                 }
@@ -2339,8 +2703,9 @@ async function handleRequestInner(state, req, res, traceId) {
                 // exhaustion 503 a non-zero `retry_after_ms` to back the client off
                 // with (`getMinWaitTimeForFamily` returns 0 while any account is
                 // still selectable).
-                accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
-                accountManager.saveToDiskDebounced();
+                const transportState = responseStateTarget();
+                transportState.accountManager.markAccountCoolingDown(transportState.account, state.networkErrorCooldownMs, "network-error");
+                transportState.accountManager.saveToDiskDebounced();
                 accountSkipReasons.set(refreshed.account.index, "network-error");
                 exhaustionReason = "network-error";
                 capabilityRejectionIsLatest = false;
@@ -2371,7 +2736,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 }
             };
             const quotaSnapshot = readQuotaSchedulerSnapshot(upstream.headers, upstream.status, state.now());
-            if (quotaSnapshot && context.model !== LUNA_RESERVE_MODEL) {
+            if (quotaSnapshot && !isTranscribeRequest && context.model !== LUNA_RESERVE_MODEL) {
                 observeQuota(quotaSnapshot, upstream.headers.get("x-codex-plan-type") ?? undefined);
             }
             if (isResponsesRequest && context.model && [400, 403, 404].includes(upstream.status)) {
@@ -2416,6 +2781,30 @@ async function handleRequestInner(state, req, res, traceId) {
             }
             if (upstream.status === HTTP_STATUS.TOO_MANY_REQUESTS) {
                 const bodyText = await readErrorBody(upstream, state.streamStallTimeoutMs);
+                if (isTranscribeRequest) {
+                    const now = state.now();
+                    const retryAfterMs = parseRetryAfterHeaderMs(upstream.headers, now) ??
+                        parseRetryAfterBodyMs(bodyText, now) ??
+                        60_000;
+                    for (const [recordId, until] of state.transcriptionRateLimitUntilByRecordId) {
+                        if (until <= now)
+                            state.transcriptionRateLimitUntilByRecordId.delete(recordId);
+                    }
+                    if (refreshed.account.recordId) {
+                        const boundedDelayMs = Math.min(MAX_RATE_LIMIT_DELAY_MS, Math.max(1_000, Math.floor(retryAfterMs)));
+                        const existingUntil = state.transcriptionRateLimitUntilByRecordId.get(refreshed.account.recordId) ?? 0;
+                        state.transcriptionRateLimitUntilByRecordId.set(refreshed.account.recordId, Math.max(existingUntil, now + boundedDelayMs));
+                    }
+                    res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
+                    res.end(bodyText);
+                    await usageRecorder.record({
+                        outcome: "failure",
+                        statusCode: upstream.status,
+                        errorCode: extractErrorCodeFromBody(bodyText) ?? "transcribe_rate_limited",
+                        account: refreshed.account,
+                    });
+                    return;
+                }
                 // Keep the upstream HINT separate from the 60s fallback. Passing the
                 // synthesized default into the capacity wait would make every
                 // hint-less capacity 429 sleep a full minute and leave the 2s/5s/15s
@@ -2449,16 +2838,17 @@ async function handleRequestInner(state, req, res, traceId) {
                 }
                 // Every 429 still drains this account for its retry window, but only an
                 // explicit subscription-usage signal is persisted as quota exhaustion.
-                accountManager.recordRateLimit(refreshed.account, context.family, context.model);
-                accountManager.markRateLimitedWithReason(refreshed.account, retryAfterMs, context.family, subscriptionQuotaExceeded ? "quota" : "unknown", context.model);
+                const rateLimitState = responseStateTarget();
+                rateLimitState.accountManager.recordRateLimit(rateLimitState.account, context.family, context.model);
+                rateLimitState.accountManager.markRateLimitedWithReason(rateLimitState.account, retryAfterMs, context.family, subscriptionQuotaExceeded ? "quota" : "unknown", context.model);
                 if (subscriptionQuotaExceeded &&
                     (context.model === "gpt-6-luna" || context.model === "gpt-5.6-luna")) {
                     const confirmedKey = confirmedQuotaExhaustionKey(context.family, context.model);
                     const confirmedResetAt = state.now() +
                         Math.min(Math.max(0, Math.floor(retryAfterMs)), MAX_RATE_LIMIT_DELAY_MS);
-                    refreshed.account.rateLimitResetTimes[confirmedKey] = Math.max(refreshed.account.rateLimitResetTimes[confirmedKey] ?? 0, confirmedResetAt);
+                    rateLimitState.account.rateLimitResetTimes[confirmedKey] = Math.max(rateLimitState.account.rateLimitResetTimes[confirmedKey] ?? 0, confirmedResetAt);
                 }
-                accountManager.saveToDiskDebounced();
+                rateLimitState.accountManager.saveToDiskDebounced();
                 if (!modelAtCapacity && subscriptionQuotaExceeded && switchRequestToLunaReserve(context)) {
                     usageRecorder = createUsageRecorderForModel(context.model);
                     if (runtimePolicyState) {
@@ -2506,8 +2896,9 @@ async function handleRequestInner(state, req, res, traceId) {
                 const errorCode = extractErrorCodeFromBody(bodyText);
                 if (isWorkspaceDisabledError(upstream.status, errorCode, bodyText)) {
                     if (requestScope && refreshed.account.workspaces?.length) {
-                        if (accountManager.disableWorkspace(refreshed.account, requestScope.accountId))
-                            accountManager.saveToDiskDebounced();
+                        const workspaceState = responseStateTarget();
+                        if (workspaceState.accountManager.disableWorkspace(workspaceState.account, requestScope.accountId))
+                            workspaceState.accountManager.saveToDiskDebounced();
                         pendingScopes?.shift();
                         refundConsumedPoolToken(refreshed.account);
                         if (pendingScopes?.length)
@@ -2518,13 +2909,13 @@ async function handleRequestInner(state, req, res, traceId) {
                         noteRotation();
                         continue;
                     }
-                    const accountWasEnabled = accountManager.getAccountByIndex(refreshed.account.index)?.enabled !==
-                        false;
+                    const disabledState = responseStateTarget();
+                    const accountWasEnabled = disabledState.account.enabled !== false;
                     refundConsumedPoolToken(refreshed.account);
                     if (accountWasEnabled) {
-                        accountManager.recordFailure(refreshed.account, context.family, context.model);
-                        accountManager.setAccountEnabled(refreshed.account.index, false);
-                        accountManager.saveToDiskDebounced();
+                        disabledState.accountManager.recordFailure(disabledState.account, context.family, context.model);
+                        disabledState.accountManager.setAccountEnabled(disabledState.account.index, false);
+                        disabledState.accountManager.saveToDiskDebounced();
                     }
                     state.sessionAffinityStore?.forgetSession(context.sessionKey);
                     exhaustionReason = "deactivated";
@@ -2601,20 +2992,25 @@ async function handleRequestInner(state, req, res, traceId) {
             if (upstream.status === HTTP_STATUS.UNAUTHORIZED) {
                 const bodyText = await readErrorBody(upstream, state.streamStallTimeoutMs);
                 refundConsumedPoolToken(refreshed.account);
-                accountManager.recordFailure(refreshed.account, context.family, context.model);
+                const authState = responseAuthStateTarget();
+                if (authState && !isTranscribeRequest) {
+                    authState.accountManager.recordFailure(authState.account, context.family, context.model);
+                }
                 if (isTokenInvalidationError(bodyText)) {
                     // The upstream explicitly revoked this OAuth token. Applying a long
                     // cooldown prevents cascade invalidation: rapidly presenting each
                     // account's token from the same IP triggers OpenAI's anti-abuse
                     // detection and invalidates them in sequence. Return the 401 directly
                     // rather than rotating so the client can prompt for re-login.
-                    accountManager.markAuthInvalidated(refreshed.account, extractErrorCodeFromBody(bodyText) ?? "token_invalidated");
-                    applyMonotonicAuthCooldown(accountManager, refreshed.account, state.tokenInvalidationCooldownMs);
+                    if (authState) {
+                        authState.accountManager.markAuthInvalidated(authState.account, extractErrorCodeFromBody(bodyText) ?? "token_invalidated");
+                        applyMonotonicAuthCooldown(authState.accountManager, authState.account, state.tokenInvalidationCooldownMs);
+                        // The invalidation marker must be durable before returning the 401.
+                        // A delayed save would allow a proxy restart to reload and route the
+                        // revoked account again.
+                        await authState.accountManager.saveToDisk();
+                    }
                     state.sessionAffinityStore?.forgetSession(context.sessionKey);
-                    // The invalidation marker must be durable before returning the 401.
-                    // A delayed save would allow a proxy restart to reload and route the
-                    // revoked account again.
-                    await accountManager.saveToDisk();
                     // Emit the same machine-readable shape as the refresh-failure path
                     // (code: "token_invalidated") instead of forwarding the raw upstream
                     // body, so the client contract is consistent across both vectors.
@@ -2630,8 +3026,21 @@ async function handleRequestInner(state, req, res, traceId) {
                     });
                     return;
                 }
-                applyMonotonicAuthCooldown(accountManager, refreshed.account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS);
-                accountManager.saveToDiskDebounced();
+                if (isTranscribeRequest) {
+                    res.writeHead(upstream.status, responseHeadersForClient(upstream.headers));
+                    res.end(bodyText);
+                    await usageRecorder.record({
+                        outcome: "failure",
+                        statusCode: upstream.status,
+                        errorCode: extractErrorCodeFromBody(bodyText) ?? "transcribe_unauthorized",
+                        account: refreshed.account,
+                    });
+                    return;
+                }
+                if (authState) {
+                    applyMonotonicAuthCooldown(authState.accountManager, authState.account, DEFAULT_AUTH_FAILURE_COOLDOWN_MS);
+                    authState.accountManager.saveToDiskDebounced();
+                }
                 exhaustionReason = "auth-failure";
                 capabilityRejectionIsLatest = false;
                 transientAttempts += 1;
@@ -2640,6 +3049,19 @@ async function handleRequestInner(state, req, res, traceId) {
                 noteRotation();
                 continue;
             }
+            // Dictation audio may already have been accepted before any error response.
+            // Do not replay it across accounts or let its endpoint-specific status
+            // mutate Codex inference health/quota state. Explicit token invalidation
+            // and workspace-disable handling above remain account-wide signals.
+            if (isTranscribeRequest && upstream.status >= 400) {
+                const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => undefined, state.streamStallTimeoutMs);
+                await usageRecorder.record({
+                    outcome: "failure", statusCode: upstream.status,
+                    errorCode: forwarded ? "transcribe_upstream_error" : "stream_forward_failed",
+                    account: refreshed.account,
+                });
+                return;
+            }
             // Forward image validation/moderation/5xx errors without cross-account replay.
             // Explicit 429 quota and 401 auth handling above still use the existing pool.
             if (isImageRequest && upstream.status >= 400) {
@@ -2670,9 +3092,10 @@ async function handleRequestInner(state, req, res, traceId) {
                         continue;
                 }
                 refundConsumedPoolToken(refreshed.account);
-                accountManager.recordFailure(refreshed.account, context.family, context.model);
-                accountManager.markAccountCoolingDown(refreshed.account, state.serverErrorCooldownMs, "server-error");
-                accountManager.saveToDiskDebounced();
+                const serverState = responseStateTarget();
+                serverState.accountManager.recordFailure(serverState.account, context.family, context.model);
+                serverState.accountManager.markAccountCoolingDown(serverState.account, state.serverErrorCooldownMs, "server-error");
+                serverState.accountManager.saveToDiskDebounced();
                 exhaustionReason = "server-error";
                 capabilityRejectionIsLatest = false;
                 transientAttempts += 1;
@@ -2707,25 +3130,28 @@ async function handleRequestInner(state, req, res, traceId) {
             // "rate-limited") lingers on disk until an explicit runtime reset and
             // the forecast keeps reporting this working account as unavailable.
             // No-op when no reason is recorded, so the hot path stays write-free.
-            const quotaDeferral = state.preemptiveQuotaScheduler.getDeferral(quotaScheduleKey, state.now());
-            const nearExhaustionWaitMs = context.model === LUNA_RESERVE_MODEL
-                ? 0
-                : quotaDeferral.defer
-                    ? quotaDeferral.waitMs
-                    : 0;
-            if (nearExhaustionWaitMs > 0) {
-                accountManager.markRateLimitedWithReason(refreshed.account, nearExhaustionWaitMs, context.family, "quota", context.model);
-                state.sessionAffinityStore?.forgetSession(context.sessionKey);
-                accountManager.saveToDiskDebounced();
-            }
-            else {
-                state.sessionAffinityStore?.remember(context.sessionKey, refreshed.account.index, state.now());
-                if (refreshed.account.index !== state.lastGlobalAccountIndex) {
-                    state.lastGlobalAccountIndex = refreshed.account.index;
+            if (!isTranscribeRequest) {
+                const quotaDeferral = state.preemptiveQuotaScheduler.getDeferral(quotaScheduleKey, state.now());
+                const nearExhaustionWaitMs = context.model === LUNA_RESERVE_MODEL
+                    ? 0
+                    : quotaDeferral.defer
+                        ? quotaDeferral.waitMs
+                        : 0;
+                if (nearExhaustionWaitMs > 0) {
+                    const quotaState = responseStateTarget();
+                    quotaState.accountManager.markRateLimitedWithReason(quotaState.account, nearExhaustionWaitMs, context.family, "quota", context.model);
+                    state.sessionAffinityStore?.forgetSession(context.sessionKey);
+                    quotaState.accountManager.saveToDiskDebounced();
                 }
-                state.lastGlobalSwitchAt = state.now();
+                else {
+                    state.sessionAffinityStore?.remember(context.sessionKey, refreshed.account.index, state.now());
+                    if (refreshed.account.index !== state.lastGlobalAccountIndex) {
+                        state.lastGlobalAccountIndex = refreshed.account.index;
+                    }
+                    state.lastGlobalSwitchAt = state.now();
+                }
+                await persistRuntimeActiveAccount(accountManager, refreshed.account, context.family, isPinned && refreshed.account.index === pinnedIndex, state.schedulingStrategy, state.nativeOpenai);
             }
-            await persistRuntimeActiveAccount(accountManager, refreshed.account, context.family, isPinned && refreshed.account.index === pinnedIndex, state.schedulingStrategy, state.nativeOpenai);
             // Recover the upstream token counts as the body streams past. Without
             // them every ledger row lands with all-zero tokens and a zero cost, so
             // evaluateBudgetGuard compares `0 >= limit` for maxTokens/maxCostUsd
@@ -2735,7 +3161,7 @@ async function handleRequestInner(state, req, res, traceId) {
                 contentType: upstream.headers.get("content-type"),
                 onEvent: (event) => {
                     responseOutcome.observe(event);
-                    if (context.model === LUNA_RESERVE_MODEL)
+                    if (isTranscribeRequest || context.model === LUNA_RESERVE_MODEL)
                         return;
                     const snapshot = readSubscriptionQuotaEvent(event, state.now());
                     if (!snapshot)
@@ -2749,23 +3175,35 @@ async function handleRequestInner(state, req, res, traceId) {
             let streamErrored = false;
             const forwarded = await forwardStreamingResponse(upstream, res, state.status, () => {
                 streamErrored = true;
+                if (isTranscribeRequest)
+                    return;
                 // Deliberately NOT the pre-header transport policy above,
                 // which skips recordFailure (#677). By this point the
                 // upstream accepted the request and began responding, so a
                 // broken stream is a signal about THIS account's session
                 // (upstream tearing it down) rather than about the shared
                 // network path, and it should still credit the breaker.
-                accountManager.recordFailure(refreshed.account, context.family, context.model);
-                accountManager.markAccountCoolingDown(refreshed.account, state.networkErrorCooldownMs, "network-error");
+                const streamState = responseStateTarget();
+                streamState.accountManager.recordFailure(streamState.account, context.family, context.model);
+                streamState.accountManager.markAccountCoolingDown(streamState.account, state.networkErrorCooldownMs, "network-error");
                 state.sessionAffinityStore?.forgetSession(context.sessionKey);
-                accountManager.saveToDiskDebounced();
+                streamState.accountManager.saveToDiskDebounced();
             }, state.streamStallTimeoutMs, usageScanner.push, { ...(budgetAdvisory.level === "soft" ? buildContextBudgetHeaders(budgetAdvisory) : {}), ...(state.catalogEtag ? { "x-models-etag": state.catalogEtag } : {}) }, () => { usageScanner.result(); return responseOutcome.finish(); });
             // The client went away mid-stream: no upstream error, and the response was
             // neither completed nor failed. That says nothing about the account.
             const clientDisconnected = !forwarded && !streamErrored && !res.writableEnded;
             if (forwarded && upstream.ok) {
-                accountManager.recordSuccess(refreshed.account, context.family, context.model);
-                recordRuntimeAccountRecovery(refreshed.account.index);
+                if (isTranscribeRequest && refreshed.account.recordId) {
+                    const until = state.transcriptionRateLimitUntilByRecordId.get(refreshed.account.recordId);
+                    if (typeof until === "number" && until <= state.now()) {
+                        state.transcriptionRateLimitUntilByRecordId.delete(refreshed.account.recordId);
+                    }
+                }
+                if (!isTranscribeRequest) {
+                    const successState = responseStateTarget();
+                    successState.accountManager.recordSuccess(successState.account, context.family, context.model);
+                    recordRuntimeAccountRecovery(successState.account.index);
+                }
             }
             else if (!clientDisconnected) {
                 state.sessionAffinityStore?.forgetSession(context.sessionKey);
@@ -2793,7 +3231,7 @@ async function handleRequestInner(state, req, res, traceId) {
             // it here inflates the measurement by this turn's thinking budget
             // against a deliberately tight threshold. `outputTokens` is already
             // reasoning-stripped (lib/usage/usage-extraction.ts).
-            if (usageTokens && context.stableSessionKey && context.model) {
+            if (!isTranscribeRequest && usageTokens && context.stableSessionKey && context.model) {
                 state.contextBudgetGuard.update(context.stableSessionKey, {
                     model: context.model,
                     contextTokens: usageTokens.inputTokens + usageTokens.outputTokens,
@@ -2841,9 +3279,11 @@ async function handleRequestInner(state, req, res, traceId) {
         // null reason indicates a forecast/runtime state desync (the pinned
         // account was selected but no skip reason was recorded) — see #486.
         if (isPinned) {
-            const pinnedAccount = typeof pinnedIndex === "number"
-                ? accountManager.getAccountByIndex(pinnedIndex)
-                : null;
+            const pinnedAccount = pinnedIdentityMissing
+                ? null
+                : typeof pinnedIndex === "number"
+                    ? accountManager.getAccountByIndex(pinnedIndex)
+                    : null;
             const pinnedSkipReason = typeof pinnedIndex === "number"
                 ? accountSkipReasons.get(pinnedIndex) ?? null
                 : null;
@@ -2877,23 +3317,44 @@ async function handleRequestInner(state, req, res, traceId) {
             // them and report a rate-limited pin as bounded by something else.
             const evaluatedAtMs = state.now();
             // Both bounds come from a single pass over the account's records.
-            const pinnedRecoveryBounds = pinnedAccount === null
-                ? null
-                : getAccountRecoveryBoundsForFamily(pinnedAccount, evaluatedAtMs, context.family, context.model);
+            const pinnedRecoveryBounds = !isTranscribeRequest && pinnedAccount !== null
+                ? getAccountRecoveryBoundsForFamily(pinnedAccount, evaluatedAtMs, context.family, context.model)
+                : null;
             const pinnedStateRecoveryAtMs = pinnedRecoveryBounds?.recoveryAtMs ?? null;
             // An open circuit outlives the short failure cooldowns that tripped
             // it; its deadline lives in the breaker, not the account record.
-            const pinnedCircuitRecoveryAtMs = pinnedAccount === null
-                ? null
-                : accountManager.getCircuitRecoveryTime(pinnedAccount, evaluatedAtMs);
-            const pinnedResetAtMs = pinnedBlockedPermanently ||
-                (pinnedStateRecoveryAtMs === null && pinnedCircuitRecoveryAtMs === null)
+            // Transcription intentionally ignores the inference circuit entirely.
+            const pinnedCircuitRecoveryAtMs = !isTranscribeRequest && pinnedAccount !== null
+                ? accountManager.getCircuitRecoveryTime(pinnedAccount, evaluatedAtMs)
+                : null;
+            const pinnedTranscriptionRateLimitAtMs = isTranscribeRequest && pinnedAccount?.recordId
+                ? state.transcriptionRateLimitUntilByRecordId.get(pinnedAccount.recordId) ?? null
+                : null;
+            const livePinnedTranscriptionRateLimitAtMs = typeof pinnedTranscriptionRateLimitAtMs === "number" &&
+                pinnedTranscriptionRateLimitAtMs > evaluatedAtMs
+                ? pinnedTranscriptionRateLimitAtMs
+                : null;
+            const pinnedAuthCooldownAtMs = isTranscribeRequest &&
+                pinnedAccount?.cooldownReason === "auth-failure" &&
+                typeof pinnedAccount.coolingDownUntil === "number" &&
+                pinnedAccount.coolingDownUntil > evaluatedAtMs
+                ? pinnedAccount.coolingDownUntil
+                : null;
+            const pinnedResetAtMs = pinnedBlockedPermanently
                 ? null
-                : Math.max(pinnedStateRecoveryAtMs ?? 0, pinnedCircuitRecoveryAtMs ?? 0);
+                : isTranscribeRequest
+                    ? livePinnedTranscriptionRateLimitAtMs === null && pinnedAuthCooldownAtMs === null
+                        ? null
+                        : Math.max(livePinnedTranscriptionRateLimitAtMs ?? 0, pinnedAuthCooldownAtMs ?? 0)
+                    : pinnedStateRecoveryAtMs === null && pinnedCircuitRecoveryAtMs === null
+                        ? null
+                        : Math.max(pinnedStateRecoveryAtMs ?? 0, pinnedCircuitRecoveryAtMs ?? 0);
             // The message only words the recovery deadline as a rate-limit reset
-            // when the rate-limit records are in fact what supplies it — a
+            // when the rate-limit records are in fact what supplies it - a
             // breaker or cooldown can end later and then bounds it instead.
-            const pinnedRateLimitResetAtMs = pinnedRecoveryBounds?.rateLimitAtMs ?? null;
+            const pinnedRateLimitResetAtMs = isTranscribeRequest
+                ? livePinnedTranscriptionRateLimitAtMs
+                : pinnedRecoveryBounds?.rateLimitAtMs ?? null;
             const recoveryBound = pinnedResetAtMs !== null &&
                 pinnedRateLimitResetAtMs !== null &&
                 pinnedRateLimitResetAtMs >= pinnedResetAtMs
@@ -2935,12 +3396,47 @@ async function handleRequestInner(state, req, res, traceId) {
             writeJson(res, HTTP_STATUS.OK, { goal: null });
         }
         else {
+            const transcriptionRetryAfterMs = isTranscribeRequest
+                ? (() => {
+                    const now = state.now();
+                    let minWaitMs = null;
+                    // Read live account state, not only selection skip reasons. The final
+                    // refresh attempt can install an auth cooldown after the last selection
+                    // pass, so that blocker may never have been written to accountSkipReasons.
+                    for (const account of accountManager.getAccountsSnapshot()) {
+                        if (policyDecision?.blockedAccountIndexes.has(account.index))
+                            continue;
+                        if (account.enabled === false)
+                            continue;
+                        if (!accountManager.hasEnabledWorkspaces(account))
+                            continue;
+                        if (accountManager.isAccountAuthInvalidated(account))
+                            continue;
+                        const transcriptionUntil = account.recordId
+                            ? state.transcriptionRateLimitUntilByRecordId.get(account.recordId)
+                            : undefined;
+                        const authUntil = account.cooldownReason === "auth-failure" &&
+                            typeof account.coolingDownUntil === "number"
+                            ? account.coolingDownUntil
+                            : undefined;
+                        const readyAt = Math.max(typeof transcriptionUntil === "number" && transcriptionUntil > now
+                            ? transcriptionUntil
+                            : 0, typeof authUntil === "number" && authUntil > now ? authUntil : 0);
+                        if (readyAt <= now)
+                            return 0;
+                        const waitMs = readyAt - now;
+                        minWaitMs = minWaitMs === null ? waitMs : Math.min(minWaitMs, waitMs);
+                    }
+                    return minWaitMs ?? 0;
+                })()
+                : undefined;
             writePoolExhausted({
                 res,
                 accountManager,
                 family: context.family,
                 model: context.model,
                 reason: exhaustionReason,
+                retryAfterMs: transcriptionRetryAfterMs,
                 accountSkipReasons: Object.fromEntries([...accountSkipReasons.entries()].map(([index, reason]) => [
                     String(index),
                     reason,