codexLB-up 1.25.0b10__py3-none-any.whl

app/modules/proxy/_service/http_bridge/helpers.py

@@ -0,0 +1,3959 @@
+from __future__ import annotations
+
+import asyncio
+import inspect
+import json
+import logging
+import math
+import sys
+import time
+from collections.abc import Callable, Coroutine, Iterable, Sequence
+from dataclasses import dataclass, replace
+from hashlib import sha256
+from ipaddress import ip_address
+from typing import Any, Final, Literal, Mapping, TypeVar, cast
+from urllib.parse import urlparse
+
+from app.core import shutdown as shutdown_state
+from app.core.balancer.rendezvous_hash import select_node
+from app.core.clients.files import create_file as core_create_file  # noqa: F401
+from app.core.clients.files import finalize_file as core_finalize_file  # noqa: F401
+from app.core.clients.proxy import CodexControlResponse as CodexControlResponse
+from app.core.clients.proxy import (  # noqa: F401  # noqa: F401
+    ImageFetchSession,
+    ProxyResponseError,
+    UpstreamProxyRouteTrace,
+    _as_image_fetch_session,
+    _inline_content_images,
+    _inline_input_image_urls,
+    _ws_transport_payload_budget_bytes,
+    filter_inbound_headers,
+    pop_compact_timeout_overrides,
+    pop_stream_timeout_overrides,
+    pop_transcribe_timeout_overrides,
+    push_compact_timeout_overrides,
+    push_stream_timeout_overrides,
+    push_transcribe_timeout_overrides,
+)
+from app.core.clients.proxy import codex_control_request as core_codex_control_request  # noqa: F401
+from app.core.clients.proxy import compact_responses as core_compact_responses  # noqa: F401
+from app.core.clients.proxy import transcribe_audio as core_transcribe_audio  # noqa: F401
+from app.core.clock import REAL_SCHEDULER, Scheduler, clock_for, scheduler_for
+from app.core.config.settings import Settings, get_settings
+from app.core.config.settings_cache import get_settings_cache
+from app.core.errors import (
+    HTTP_BRIDGE_EVENTLESS_TIMEOUT_CODE,
+    HTTP_BRIDGE_LOCAL_RESET_MESSAGE,
+    OpenAIErrorDetail,
+    OpenAIErrorEnvelope,
+    OpenAIErrorParam,
+    coerce_error_param,
+    openai_error,
+    previous_response_stream_incomplete_error,
+    response_failed_event,
+)
+from app.core.metrics.prometheus import (
+    PROMETHEUS_AVAILABLE,
+    bridge_drain_recovery_allowed_total,
+    bridge_first_turn_timeout_total,
+    bridge_handoff_compatibility_rejection_total,
+    bridge_instance_mismatch_total,
+    bridge_reattach_total,
+    bridge_unanchored_handoff_recovery_total,
+    http_bridge_connections_total,
+    http_bridge_prewarm_total,
+    http_bridge_stuck_retire_total,
+)
+from app.core.openai.models import OpenAIEvent
+from app.core.openai.parsing import parse_sse_event
+from app.core.openai.requests import (
+    ResponsesRequest,
+)
+from app.core.resilience.overload import local_overload_error
+from app.core.types import JsonValue
+from app.core.utils.request_id import get_request_id
+from app.core.utils.shared_future import _await_task_deferring_cancellation, wait_on_shared_future
+from app.core.utils.sse import format_sse_event, parse_sse_data_json
+from app.core.utils.time import to_utc_naive, utcnow
+from app.db.models import (
+    AccountStatus,
+    DashboardSettings,
+    StickySessionKind,
+)
+from app.modules.api_keys.service import (
+    ApiKeyData,
+)
+from app.modules.proxy._service.api_key_usage import (
+    _API_KEY_RESERVATION_HEARTBEAT_SECONDS as _API_KEY_RESERVATION_HEARTBEAT_SECONDS,
+)
+from app.modules.proxy._service.compact import (
+    _service_tier_from_compact_payload as _service_tier_from_compact_payload,
+)
+from app.modules.proxy._service.compact import (
+    _sticky_key_for_compact_request as _sticky_key_for_compact_request,
+)
+from app.modules.proxy._service.compact import (
+    _sticky_key_from_compact_payload as _sticky_key_from_compact_payload,
+)
+from app.modules.proxy._service.http_bridge.protocol import _HTTPBridgeServiceProtocol
+from app.modules.proxy._service.observability import (
+    _hash_identifier as _hash_identifier,
+)
+from app.modules.proxy._service.observability import (
+    _hash_identifier_or_none as _hash_identifier_or_none,
+)
+from app.modules.proxy._service.observability import (
+    _interesting_header_keys as _interesting_header_keys,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_request_payload as _maybe_log_proxy_request_payload,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_request_shape as _maybe_log_proxy_request_shape,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_service_tier_trace as _maybe_log_proxy_service_tier_trace,
+)
+from app.modules.proxy._service.observability import (
+    _record_continuity_fail_closed as _record_continuity_fail_closed,
+)
+from app.modules.proxy._service.observability import (
+    _record_continuity_owner_resolution as _record_continuity_owner_resolution,
+)
+from app.modules.proxy._service.observability import (
+    _record_continuity_replay_rejected as _record_continuity_replay_rejected,
+)
+from app.modules.proxy._service.observability import (
+    _summarize_input as _summarize_input,
+)
+from app.modules.proxy._service.observability import (
+    _tools_hash as _tools_hash,
+)
+from app.modules.proxy._service.observability import (
+    _truncate_identifier as _truncate_identifier,
+)
+from app.modules.proxy._service.support import (
+    _HARD_HTTP_BRIDGE_AFFINITY_KINDS,  # noqa: F401
+    _REQUEST_TRANSPORT_HTTP,
+    _WEBSOCKET_FULL_REPLAY_WAIT_POLL_SECONDS,  # noqa: F401
+    _http_bridge_session_supports_service_tier,
+    _HTTPBridgeResponseCreateAttempt,
+    _HTTPBridgeRetryCircuitAttemptSelection,
+    _HTTPBridgeSession,
+    _HTTPBridgeSessionKey,
+    _WebSocketRequestState,
+)
+from app.modules.proxy._service.support import (
+    _websocket_route_log_kwargs as _websocket_route_log_kwargs,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupExecutionData as WarmupExecutionData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupFailedAccountData as WarmupFailedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupSkippedAccountData as WarmupSkippedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupSubmittedAccountData as WarmupSubmittedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    _is_warmup_usage_eligible as _is_warmup_usage_eligible,
+)
+from app.modules.proxy._service.warmup import (
+    _materialize_warmup_account as _materialize_warmup_account,
+)
+from app.modules.proxy._service.warmup import (
+    _snapshot_warmup_account as _snapshot_warmup_account,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupAccountSnapshot as _WarmupAccountSnapshot,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupSubmitResult as _WarmupSubmitResult,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupUsageSnapshot as _WarmupUsageSnapshot,
+)
+from app.modules.proxy.account_cache import is_account_routing_unavailable
+from app.modules.proxy.account_eligibility import reauth_access_token_is_expired
+from app.modules.proxy.affinity import (
+    _AffinityPolicy,
+    _codex_backend_identity,
+    _extract_model_class,
+    _sticky_key_from_session_header,
+    _sticky_key_from_turn_state_header,
+)
+from app.modules.proxy.continuity import (
+    is_http_bridge_account_neutral_replay,
+    make_http_bridge_account_neutral_replay_key,
+)
+from app.modules.proxy.durable_bridge_coordinator import (
+    DurableBridgeLookup,
+)
+from app.modules.proxy.durable_bridge_repository import (
+    DurableBridgeAliasRegistration,
+    DurableBridgeAliasRegistrationReceipt,
+)
+from app.modules.proxy.durable_bridge_runtime import http_bridge_owner_process_epoch
+from app.modules.proxy.helpers import (
+    _normalize_error_code,
+    _parse_openai_error,
+)
+from app.modules.proxy.http_continuation import inferred_http_bridge_key
+from app.modules.proxy.ring_membership import (
+    RING_STALE_THRESHOLD_SECONDS,
+    RingMembershipService,
+)
+from app.modules.proxy.selection_errors import selection_failure_response
+
+logger = logging.getLogger("app.modules.proxy.service")
+_TASK_CANCEL_TIMEOUT_SECONDS = 1.0
+_TaskResultT = TypeVar("_TaskResultT")
+_HTTP_BRIDGE_PENDING_COUNT_WARNING_INTERVAL_SECONDS = 60.0
+_http_bridge_pending_count_warning_last_logged: dict[tuple[str, str, str], float] = {}
+_HTTP_BRIDGE_BACKGROUND_CLOSE_TIMEOUT_SECONDS = 5.0
+# A healthy upstream acknowledges response.create promptly. Keep the
+# Keep the owner-side watchdog within the client-safe contract while honoring
+# the fixed stuck-gate threshold when it is shorter.
+_HTTP_BRIDGE_EVENTLESS_RESPONSE_CREATED_MAX_SECONDS = 60.0
+# Fixed bridge session lifecycle values (constantize-session-bridge-tunables).
+# These were never tuned in any deployment; tests monkeypatch the module
+# attribute, and every consumer reads it through this module at call time.
+HTTP_BRIDGE_IDLE_TTL_SECONDS: Final = 120.0
+HTTP_BRIDGE_CODEX_IDLE_TTL_SECONDS: Final = 900.0
+# Owner-side stuck handoff gate; anchored to the 300s wait Codex Desktop uses.
+HTTP_BRIDGE_STUCK_GATE_RETIRE_AFTER_SECONDS: Final = 300.0
+_HTTP_BRIDGE_MISSING_RESPONSE_CREATED_TIMEOUT_DETAIL = "missing_response_created_timeout"
+# Keep process-local *uncaptured* entries bounded. A denied entry is retained
+# until the matching durable anchor is confirmed cleared; evicting it would let
+# a stale durable row regain generation zero after enough unrelated denials.
+# This is intentionally a correctness bound, not an unconditional memory cap.
+_HTTP_BRIDGE_DENIED_ANCHOR_FENCE_MAX_IDS = 512
+
+
+@dataclass
+class _HTTPBridgeDeniedAnchorFence:
+    generation: int
+    active_request_ids: set[str]
+    owner_key: str | None = None
+    owner_epoch: int | None = None
+    superseded: bool = False
+    # A stale predecessor may not own the current durable slot, so its
+    # positive denial tombstone must survive request-pin release until a
+    # current owner confirms that durable anchor is gone.
+    retain_until_durable_clear: bool = False
+
+
+def _http_bridge_denied_anchor_fence_entry(
+    service: Any,
+    response_id: str,
+    *,
+    create: bool = False,
+) -> _HTTPBridgeDeniedAnchorFence | None:
+    """Read process-local denial state, tolerating older service doubles."""
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        if not create:
+            return None
+        fences = {}
+        setattr(service, "_http_bridge_denied_anchor_fences", fences)
+    entry = fences.get(response_id)
+    if isinstance(entry, _HTTPBridgeDeniedAnchorFence):
+        return entry
+    if isinstance(entry, int):
+        upgraded = _HTTPBridgeDeniedAnchorFence(entry, set())
+        fences[response_id] = upgraded
+        return upgraded
+    if not create:
+        return None
+    entry = _HTTPBridgeDeniedAnchorFence(0, set())
+    fences[response_id] = entry
+    return entry
+
+
+def _http_bridge_denied_anchor_fence_current_map(service: Any) -> dict[str, str]:
+    """Read/create the owner-to-current-denial map used to bound fence state."""
+    current = getattr(service, "_http_bridge_denied_anchor_fence_current", None)
+    if not isinstance(current, dict):
+        current = {}
+        setattr(service, "_http_bridge_denied_anchor_fence_current", current)
+    return current
+
+
+def _prune_http_bridge_denied_anchor_fences(service: Any) -> None:
+    """Drop idle, non-denied entries without evicting a live denial fence."""
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return
+    while len(fences) > _HTTP_BRIDGE_DENIED_ANCHOR_FENCE_MAX_IDS:
+        idle_entries = [
+            (response_id, entry)
+            for response_id, entry in fences.items()
+            if (
+                isinstance(entry, _HTTPBridgeDeniedAnchorFence)
+                and entry.generation == 0
+                and not entry.active_request_ids
+            )
+        ]
+        if not idle_entries:
+            return
+        oldest_response_id, _oldest_entry = min(idle_entries, key=lambda item: item[1].generation)
+        fences.pop(oldest_response_id, None)
+
+
+def _drop_older_unpinned_http_bridge_denial_predecessors(
+    service: Any,
+    owner_key: str,
+    *,
+    response_id: str,
+) -> None:
+    """Keep only the newest unpinned stale predecessor for one owner.
+
+    A detached predecessor can publish after a successor has taken the same
+    durable owner.  Its denial still needs a positive fence while a prepared
+    request pins that response id, but retaining every late predecessor would
+    make the process-local ledger grow once per owner epoch.  Older entries
+    without request pins are superseded by the newest predecessor and can be
+    dropped. Pinned entries are marked superseded and remain only until their
+    request releases the pin.
+    """
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return
+    for predecessor_response_id, entry in tuple(fences.items()):
+        if predecessor_response_id == response_id:
+            continue
+        if not isinstance(entry, _HTTPBridgeDeniedAnchorFence):
+            continue
+        if entry.owner_key != owner_key or not entry.retain_until_durable_clear:
+            continue
+        if entry.active_request_ids:
+            entry.superseded = True
+            entry.retain_until_durable_clear = False
+        else:
+            fences.pop(predecessor_response_id, None)
+
+
+def _retire_http_bridge_denied_anchor_predecessors_after_durable_clear(
+    service: Any,
+    owner_key: str,
+    *,
+    owner_epoch: int | None,
+    preserve_response_ids: Sequence[str] = (),
+) -> None:
+    """Retire stale predecessor fences after a newer owner clears its anchor.
+
+    A successful clear under the current owner proves that older response ids
+    are no longer the durable latest anchor.  Drop unpinned predecessor slots
+    and mark pinned slots superseded so their final release removes them.  The
+    explicit preserve set is used by session close while an unresolved cleanup
+    still needs its fence.
+    """
+    if owner_epoch is None:
+        return
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return
+    preserved = set(preserve_response_ids)
+    for response_id, entry in tuple(fences.items()):
+        if response_id in preserved or not isinstance(entry, _HTTPBridgeDeniedAnchorFence):
+            continue
+        if (
+            entry.owner_key != owner_key
+            or not entry.retain_until_durable_clear
+            or entry.owner_epoch is None
+            or entry.owner_epoch >= owner_epoch
+        ):
+            continue
+        if entry.active_request_ids:
+            entry.superseded = True
+            entry.retain_until_durable_clear = False
+        else:
+            fences.pop(response_id, None)
+    _prune_http_bridge_denied_anchor_fences(service)
+
+
+def _schedule_http_bridge_background_cleanup(
+    service: Any,
+    awaitable: Coroutine[Any, Any, Any],
+    *,
+    name: str,
+    error_message: str,
+    attribute: tuple[str, Any] | None = None,
+) -> asyncio.Task[Any] | None:
+    """Track one best-effort cleanup task until it settles.
+
+    Denied-anchor retries and recovery-settlement retries have the same
+    ownership contract: callers must retain the task in the service registry,
+    remove it exactly once on completion, and consume failures so a transient
+    bookkeeping error cannot become an unhandled task exception.
+    """
+    cleanup_tasks = getattr(service, "_background_cleanup_tasks", None)
+    if cleanup_tasks is None:
+        if inspect.iscoroutine(awaitable):
+            awaitable.close()
+        return None
+    task = scheduler_for(service).create_task(awaitable, name=name)
+    if attribute is not None:
+        setattr(task, attribute[0], attribute[1])
+    cleanup_tasks.add(task)
+
+    def _discard(done_task: asyncio.Task[Any]) -> None:
+        cleanup_tasks.discard(done_task)
+        try:
+            done_task.result()
+        except asyncio.CancelledError:
+            pass
+        except Exception:
+            logger.error(error_message, exc_info=True)
+
+    task.add_done_callback(_discard)
+    return task
+
+
+def _http_bridge_denied_anchor_fence_generation(service: Any, response_id: str) -> int:
+    entry = _http_bridge_denied_anchor_fence_entry(service, response_id)
+    return entry.generation if entry is not None else 0
+
+
+def _http_bridge_denied_anchor_fence_was_recorded(service: Any, response_id: str) -> bool:
+    """Return whether this process has already recorded a denial for an id."""
+    entry = _http_bridge_denied_anchor_fence_entry(service, response_id)
+    return bool(entry is not None and entry.generation > 0)
+
+
+def _retain_http_bridge_denied_anchor_fence(
+    service: Any,
+    response_id: str,
+    request_id: str,
+) -> int:
+    """Pin a response-id fence for the lifetime of one bridge request."""
+    entry = _http_bridge_denied_anchor_fence_entry(service, response_id, create=True)
+    assert entry is not None
+    entry.active_request_ids.add(request_id)
+    _prune_http_bridge_denied_anchor_fences(service)
+    return entry.generation
+
+
+def _capture_http_bridge_denied_anchor_fence(
+    service: Any,
+    response_id: str,
+    request_id: str,
+) -> tuple[int, bool]:
+    """Capture one anchor's generation and whether its denial is already known."""
+    generation = _retain_http_bridge_denied_anchor_fence(service, response_id, request_id)
+    return generation, _http_bridge_denied_anchor_fence_was_recorded(service, response_id)
+
+
+def _bind_http_bridge_proxy_injected_anchor(
+    service: Any,
+    request_state: _WebSocketRequestState,
+    *,
+    response_id: str | None,
+    proxy_injected: bool = True,
+    fence_request_id: str | None = None,
+) -> None:
+    """Bind denial provenance to the response id currently carried by a request."""
+    previous_fence_request_id = request_state.denied_proxy_injected_anchor_fence_request_id
+    _release_http_bridge_denied_anchor_fences(service, request_state.request_id)
+    if previous_fence_request_id is not None and previous_fence_request_id != request_state.request_id:
+        _release_http_bridge_denied_anchor_fences(service, previous_fence_request_id)
+    request_state.previous_response_id = response_id
+    request_state.proxy_injected_previous_response_id = proxy_injected and response_id is not None
+    request_state.denied_proxy_injected_anchor_fence_response_id = (
+        response_id if request_state.proxy_injected_previous_response_id else None
+    )
+    effective_fence_request_id = fence_request_id or previous_fence_request_id or request_state.request_id
+    request_state.denied_proxy_injected_anchor_fence_request_id = (
+        effective_fence_request_id if request_state.proxy_injected_previous_response_id else None
+    )
+    request_state.denied_proxy_injected_anchor_fence_generation_at_prepare = None
+    request_state.denied_proxy_injected_anchor_fence_was_already_denied = False
+    if request_state.proxy_injected_previous_response_id:
+        assert response_id is not None
+        (
+            request_state.denied_proxy_injected_anchor_fence_generation_at_prepare,
+            request_state.denied_proxy_injected_anchor_fence_was_already_denied,
+        ) = _capture_http_bridge_denied_anchor_fence(
+            service,
+            response_id,
+            effective_fence_request_id,
+        )
+
+
+def _forget_http_bridge_denied_anchor_fence(
+    service: Any,
+    response_id: str,
+    *,
+    owner_key: str | None = None,
+    owner_epoch: int | None = None,
+) -> bool:
+    """Release a denial tombstone once durable cleanup has been confirmed."""
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return False
+    entry = fences.get(response_id)
+    if not isinstance(entry, _HTTPBridgeDeniedAnchorFence):
+        return False
+    if owner_key is not None and entry.owner_key != owner_key:
+        return False
+    if owner_epoch is not None and entry.owner_epoch != owner_epoch:
+        return False
+    current = _http_bridge_denied_anchor_fence_current_map(service)
+    if entry.owner_key is not None and current.get(entry.owner_key) == response_id:
+        current.pop(entry.owner_key, None)
+    # Durable cleanup is the confirmation that makes a positive tombstone
+    # dispensable.  Clear stale-predecessor retention before waiting for a
+    # pinned request's final release.
+    entry.retain_until_durable_clear = False
+    if entry.active_request_ids:
+        # A request prepared before the denial must remain fenced until its
+        # final pin is released, even after durable cleanup succeeds.
+        entry.superseded = True
+    else:
+        fences.pop(response_id, None)
+    if entry.owner_key is not None:
+        _retire_http_bridge_denied_anchor_predecessors_after_durable_clear(
+            service,
+            entry.owner_key,
+            owner_epoch=entry.owner_epoch,
+        )
+    _prune_http_bridge_denied_anchor_fences(service)
+    return True
+
+
+def _forget_http_bridge_denied_anchor_fence_owner(
+    service: Any,
+    owner_key: str,
+    *,
+    owner_epoch: int | None = None,
+    preserve_response_ids: Sequence[str] = (),
+) -> None:
+    """Drop unpinned fence slots for a closed or superseded owner epoch."""
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return
+    for response_id, entry in tuple(fences.items()):
+        if not isinstance(entry, _HTTPBridgeDeniedAnchorFence) or entry.owner_key != owner_key:
+            continue
+        if response_id in preserve_response_ids:
+            continue
+        if owner_epoch is not None and entry.owner_epoch not in (None, owner_epoch):
+            continue
+        _forget_http_bridge_denied_anchor_fence(
+            service,
+            response_id,
+            owner_key=owner_key,
+            owner_epoch=entry.owner_epoch,
+        )
+
+
+def _release_http_bridge_denied_anchor_fences(service: Any, request_id: str) -> None:
+    """Release all response-id fences captured by a completed bridge request."""
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    if not isinstance(fences, dict):
+        return
+    for response_id, entry in list(fences.items()):
+        if not isinstance(entry, _HTTPBridgeDeniedAnchorFence):
+            continue
+        entry.active_request_ids.discard(request_id)
+        if (
+            entry.generation == 0 or (entry.superseded and not entry.retain_until_durable_clear)
+        ) and not entry.active_request_ids:
+            fences.pop(response_id, None)
+    _prune_http_bridge_denied_anchor_fences(service)
+
+
+def _record_http_bridge_denied_anchor_fence(
+    service: Any,
+    response_id: str,
+    *,
+    owner_key: str | None = None,
+    owner_epoch: int | None = None,
+) -> int:
+    """Record a denial after a request may have captured the old generation."""
+    current: dict[str, str] | None = None
+    if owner_key is not None:
+        current = _http_bridge_denied_anchor_fence_current_map(service)
+    fences = getattr(service, "_http_bridge_denied_anchor_fences", None)
+    prior_response_id = current.get(owner_key) if owner_key is not None and current is not None else None
+    existing_entry = fences.get(response_id) if isinstance(fences, dict) else None
+    stale_owner_publication = False
+    if (
+        isinstance(existing_entry, _HTTPBridgeDeniedAnchorFence)
+        and existing_entry.owner_key is not None
+        and not existing_entry.owner_key.startswith("local:")
+        and existing_entry.owner_epoch is not None
+        and (owner_key is None or owner_key.startswith("local:"))
+        and owner_epoch is None
+        # A local/ownerless predecessor cannot replace a durable successor's
+        # denial for the same anchor.  Keep the successor's owner mapping and
+        # generation authoritative; the late predecessor has no durable lease
+        # that could justify rewriting it.
+    ):
+        return existing_entry.generation
+    if (
+        isinstance(existing_entry, _HTTPBridgeDeniedAnchorFence)
+        and existing_entry.owner_key == owner_key
+        and owner_epoch is not None
+        and existing_entry.owner_epoch is not None
+        and owner_epoch < existing_entry.owner_epoch
+    ):
+        # A detached predecessor can publish after a successor has already
+        # claimed the same durable owner at a newer epoch.  The stale
+        # publication for this response was already recorded by the newer
+        # epoch; return its generation without rolling that entry back.
+        return existing_entry.generation
+    if prior_response_id is not None and prior_response_id != response_id and isinstance(fences, dict):
+        prior_entry = fences.get(prior_response_id)
+        if (
+            isinstance(prior_entry, _HTTPBridgeDeniedAnchorFence)
+            and owner_epoch is not None
+            and prior_entry.owner_epoch is not None
+            and owner_epoch < prior_entry.owner_epoch
+        ):
+            # The current owner slot belongs to a newer epoch.  Ignore this
+            # stale publication rather than superseding the successor fence.
+            # A pinned predecessor capture still needs a positive generation,
+            # though, so a prepared request cannot resend its denied anchor.
+            # Keep the positive tombstone even when no request is pinned: a
+            # later recapture of a stale durable row must observe this denial.
+            stale_owner_publication = True
+    if stale_owner_publication and owner_key is not None and owner_epoch is not None:
+        _drop_older_unpinned_http_bridge_denial_predecessors(
+            service,
+            owner_key,
+            response_id=response_id,
+        )
+    if (
+        not stale_owner_publication
+        and isinstance(fences, dict)
+        and prior_response_id is not None
+        and prior_response_id != response_id
+    ):
+        prior_entry = fences.get(prior_response_id)
+        if isinstance(prior_entry, _HTTPBridgeDeniedAnchorFence):
+            prior_entry.superseded = True
+            if not prior_entry.active_request_ids:
+                fences.pop(prior_response_id, None)
+    if owner_key is not None and current is not None:
+        # A session can first deny an anchor while it has only a process-local
+        # owner and later rebind that same denial to its durable owner. The
+        # fence entry has one authoritative owner, so retire any stale alias
+        # for the same response before publishing the new owner mapping.
+        for prior_owner_key, prior_response_id_for_owner in tuple(current.items()):
+            if prior_owner_key != owner_key and prior_response_id_for_owner == response_id:
+                current.pop(prior_owner_key, None)
+    if owner_key is not None and current is not None and not stale_owner_publication:
+        current[owner_key] = response_id
+    entry = _http_bridge_denied_anchor_fence_entry(service, response_id, create=True)
+    assert entry is not None
+    generation = getattr(service, "_http_bridge_denied_anchor_fence_generation", 0)
+    if not isinstance(generation, int):
+        generation = 0
+    generation += 1
+    setattr(service, "_http_bridge_denied_anchor_fence_generation", generation)
+    entry.generation = generation
+    entry.owner_key = owner_key
+    entry.owner_epoch = owner_epoch
+    # Keep a stale predecessor generation until a current owner confirms the
+    # durable anchor is gone; finalization may release its request pin without
+    # dropping this non-current owner entry prematurely.
+    entry.superseded = stale_owner_publication
+    entry.retain_until_durable_clear = stale_owner_publication
+    _prune_http_bridge_denied_anchor_fences(service)
+    return generation
+
+
+def _http_bridge_denied_anchor_fence_advanced(
+    service: Any,
+    request_state: _WebSocketRequestState,
+) -> bool:
+    response_id = request_state.previous_response_id
+    captured_generation = request_state.denied_proxy_injected_anchor_fence_generation_at_prepare
+    return bool(
+        request_state.proxy_injected_previous_response_id
+        and response_id is not None
+        and request_state.denied_proxy_injected_anchor_fence_response_id == response_id
+        and (
+            request_state.denied_proxy_injected_anchor_fence_was_already_denied
+            or (
+                captured_generation is not None
+                and captured_generation < _http_bridge_denied_anchor_fence_generation(service, response_id)
+            )
+        )
+    )
+
+
+# Silence before ``response.created`` is a different failure class than a
+# stream that started and then went quiet. When no unmatched upstream liveness
+# was observed, nothing exists upstream yet, so the request is safe to retry and
+# the upstream is not proven at fault. Keep it out of ``stream_idle_timeout``,
+# whose budget is the post-start ``stream_idle_timeout_seconds``.
+_HTTP_BRIDGE_EVENTLESS_TIMEOUT_DETAIL = HTTP_BRIDGE_EVENTLESS_TIMEOUT_CODE
+_HTTP_BRIDGE_EVENTLESS_TIMEOUT_MESSAGE = (
+    "HTTP responses session bridge saw no response events before its pre-response budget expired; "
+    "no response was created upstream, so the request is safe to retry"
+)
+_HTTP_BRIDGE_EVENTLESS_TIMEOUT_UNMATCHED_LIVENESS_MESSAGE = (
+    "HTTP responses session bridge saw upstream liveness before its pre-response budget expired, "
+    "but no response events were matched; retry may duplicate upstream work"
+)
+_HTTP_BRIDGE_EVENTLESS_COOLDOWN_MESSAGE = (
+    "HTTP responses session bridge is cooling down after repeated upstream timeouts; retry shortly."
+)
+# Local bridge recovery closes and rebuilds our own upstream session. Reserve
+# upstream-close wording for frames the upstream actually sent.
+_HTTP_BRIDGE_LOCAL_RESET_MESSAGE = HTTP_BRIDGE_LOCAL_RESET_MESSAGE
+T = TypeVar("T")
+
+_HTTP_BRIDGE_INFLIGHT_STARTED_AT_ATTR = "_codex_lb_started_at"
+# Provenance marker for bridge failures raised strictly before the current
+# request dispatched upstream. Only exceptions carrying this attribute are
+# safe for the streaming wrapper's raw-HTTP replay.
+_HTTP_BRIDGE_PRE_SUBMIT_FAILURE_ATTR = "http_bridge_pre_submit_failure"
+# Provenance for a bridge failure whose prepared payload carried a continuity
+# anchor the incoming payload does not, making a raw-HTTP replay of the
+# incoming payload continuity-incomplete.
+_HTTP_BRIDGE_PREPARED_ANCHOR_ATTR = "http_bridge_prepared_continuity_anchor"
+# Provenance for a bridge retry-circuit cooldown suppression proved replay-safe
+# at the pre-dispatch submission gate. It cannot be inferred from the error
+# code: ``_raise_proxy_budget_exhausted`` emits the same
+# ``upstream_request_timeout`` for an ordinary pre-submit budget exhaustion,
+# which is overload or host-network evidence and must not be replayed.
+_HTTP_BRIDGE_COOLDOWN_SUPPRESSION_ATTR = "http_bridge_cooldown_suppression"
+_HTTP_BRIDGE_STALE_INFLIGHT_MIN_SECONDS = 120.0
+# Upper bound for the per-request fail-safe sweep's wait on a detached
+# session's ``pending_lock``. The sweep runs on every bridge request, so a
+# single detached generation whose lock never frees (2026-09-07: an anyio 4.13
+# Lock lost-wakeup left ~100 live request tasks queued behind one detached
+# session) must not park every request; a skipped pass is revisited by the
+# next request's sweep and by the session's own close/drain paths.
+_HTTP_BRIDGE_DETACHED_RETIRE_LOCK_WAIT_SECONDS = 5.0
+_HTTP_BRIDGE_STALE_INFLIGHT_TIMEOUT_MULTIPLIER = 6.0
+
+
+def _http_bridge_eventless_timeout_message(unmatched_upstream_liveness_count: int) -> str:
+    if unmatched_upstream_liveness_count > 0:
+        return _HTTP_BRIDGE_EVENTLESS_TIMEOUT_UNMATCHED_LIVENESS_MESSAGE
+    return _HTTP_BRIDGE_EVENTLESS_TIMEOUT_MESSAGE
+
+
+@dataclass(frozen=True, slots=True)
+class _HTTPBridgeRuntimeConfig:
+    enabled: bool
+    idle_ttl_seconds: float
+    codex_idle_ttl_seconds: float
+    max_sessions: int
+    queue_limit: int
+    prompt_cache_idle_ttl_seconds: float
+    gateway_safe_mode: bool
+
+
+def _service_module() -> Any:
+    service_module = sys.modules.get("app.modules.proxy.service")
+    if service_module is None:
+        raise RuntimeError("app.modules.proxy.service is not loaded")
+    return service_module
+
+
+def _service_global(name: str) -> Any:
+    return getattr(_service_module(), name)
+
+
+def _service_global_or(name: str, fallback: T) -> T:
+    service_module = sys.modules.get("app.modules.proxy.service")
+    if service_module is None:
+        return fallback
+    return cast(T, getattr(service_module, name, fallback))
+
+
+def _service_get_settings() -> Any:
+    return _service_global_or("get_settings", get_settings)()
+
+
+def _service_get_settings_cache() -> Any:
+    return _service_global_or("get_settings_cache", get_settings_cache)()
+
+
+def _http_bridge_client_full_history_recovery_error() -> OpenAIErrorEnvelope:
+    """Ask the client to drop the anchor and resend its full local history.
+
+    Only used where the durable ledger has *proved* the anchored turn was
+    abandoned, so the resend cannot duplicate an accepted upstream response.
+    """
+    payload = openai_error(
+        "previous_response_not_found",
+        "Previous response was not found; retry without previous_response_id.",
+        error_type="invalid_request_error",
+    )
+    payload["error"]["param"] = "previous_response_id"
+    return payload
+
+
+def _proxy_admission_wait_timeout_seconds() -> float:
+    return cast(Callable[[], float], _service_global("_proxy_admission_wait_timeout_seconds"))()
+
+
+def _http_bridge_stale_inflight_seconds() -> float:
+    try:
+        admission_timeout = _proxy_admission_wait_timeout_seconds()
+    except Exception:
+        admission_timeout = 10.0
+    return max(
+        _HTTP_BRIDGE_STALE_INFLIGHT_MIN_SECONDS,
+        admission_timeout * _HTTP_BRIDGE_STALE_INFLIGHT_TIMEOUT_MULTIPLIER,
+    )
+
+
+def _normalize_responses_request_payload_for_bridge(payload: ResponsesRequest) -> ResponsesRequest:
+    return cast(
+        Callable[[ResponsesRequest], ResponsesRequest],
+        _service_global("_normalize_responses_request_payload_for_bridge"),
+    )(payload)
+
+
+def _websocket_top_level_error_payload(*args: Any, **kwargs: Any) -> Any:
+    return _service_global("_websocket_top_level_error_payload")(*args, **kwargs)
+
+
+def _header_value_case_insensitive(*args: Any, **kwargs: Any) -> Any:
+    return _service_global("_header_value_case_insensitive")(*args, **kwargs)
+
+
+def _is_previous_response_not_found_error(*args: Any, **kwargs: Any) -> Any:
+    return _service_global("_is_previous_response_not_found_error")(*args, **kwargs)
+
+
+def _http_bridge_startup_wait_timeout_error(
+    stage: str,
+    *,
+    code: str = "global_admission_timeout",
+) -> ProxyResponseError:
+    message = f"codex-lb is temporarily overloaded during {stage}"
+    return ProxyResponseError(429, local_overload_error(message, code=code))
+
+
+def _http_bridge_pending_count_nowait(
+    session: "_HTTPBridgeSession",
+    *,
+    context: str,
+) -> int | None:
+    try:
+        session.pending_lock.acquire_nowait()
+    except Exception as exc:
+        if type(exc).__name__ not in {"WouldBlock", "RuntimeError"}:
+            raise
+        warning_key = (
+            context,
+            session.key.affinity_kind,
+            _hash_identifier(session.key.affinity_key),
+        )
+        now = time.monotonic()
+        last_logged = _http_bridge_pending_count_warning_last_logged.get(warning_key)
+        if last_logged is None or now - last_logged >= _HTTP_BRIDGE_PENDING_COUNT_WARNING_INTERVAL_SECONDS:
+            _http_bridge_pending_count_warning_last_logged[warning_key] = now
+            if len(_http_bridge_pending_count_warning_last_logged) > 2048:
+                cutoff = now - _HTTP_BRIDGE_PENDING_COUNT_WARNING_INTERVAL_SECONDS * 2
+                for key, timestamp in tuple(_http_bridge_pending_count_warning_last_logged.items()):
+                    if timestamp < cutoff:
+                        _http_bridge_pending_count_warning_last_logged.pop(key, None)
+            logger.warning(
+                "http_bridge_pending_count_unavailable context=%s bridge_kind=%s bridge_key=%s account_id=%s model=%s",
+                context,
+                session.key.affinity_kind,
+                warning_key[2],
+                session.account.id,
+                session.request_model,
+            )
+        return None
+    try:
+        request_counts_against_queue = _service_global("_http_bridge_request_counts_against_queue")
+        visible_pending_count = sum(
+            1 for request_state in session.pending_requests if request_counts_against_queue(request_state)
+        )
+        # A registered admission waiter is live work not yet counted into the
+        # queue — it may be suspended on the pre-lock fair-share resolve with
+        # pending_lock free (issue #1971). Counting it keeps capacity LRU
+        # eviction and shutdown drain from treating the session as idle and
+        # closing it under the admitting turn.
+        return max(visible_pending_count, session.queued_request_count, session.admission_waiter_count)
+    finally:
+        session.pending_lock.release()
+
+
+def _cleanup_http_bridge_inflight_sessions_nowait(service: Any) -> dict[str, int]:
+    now = clock_for(service).monotonic()
+    stale_after_seconds = _http_bridge_stale_inflight_seconds()
+    cleaned = 0
+    stale = 0
+    oldest_age_seconds = 0
+    try:
+        service._http_bridge_lock.acquire_nowait()
+    except Exception as exc:
+        if type(exc).__name__ not in {"WouldBlock", "RuntimeError"}:
+            raise
+        for future in service._http_bridge_inflight_sessions.values():
+            started_at = getattr(future, _HTTP_BRIDGE_INFLIGHT_STARTED_AT_ATTR, None)
+            age_seconds = max(0.0, now - started_at) if isinstance(started_at, (int, float)) else 0.0
+            oldest_age_seconds = max(oldest_age_seconds, int(age_seconds))
+            if isinstance(started_at, (int, float)) and age_seconds >= stale_after_seconds:
+                stale += 1
+        return {
+            "cleaned": 0,
+            "stale": stale,
+            "oldest_age_seconds": oldest_age_seconds,
+        }
+    try:
+        for key, future in list(service._http_bridge_inflight_sessions.items()):
+            current_future = service._http_bridge_inflight_sessions.get(key)
+            if current_future is not future:
+                continue
+            started_at = getattr(future, _HTTP_BRIDGE_INFLIGHT_STARTED_AT_ATTR, None)
+            age_seconds = max(0.0, now - started_at) if isinstance(started_at, (int, float)) else 0.0
+            oldest_age_seconds = max(oldest_age_seconds, int(age_seconds))
+            cleanup_reason: str | None = None
+            is_stale = isinstance(started_at, (int, float)) and age_seconds >= stale_after_seconds
+            if is_stale:
+                stale += 1
+            if future.done():
+                cleanup_reason = "done"
+            if cleanup_reason is None:
+                continue
+            service._http_bridge_inflight_sessions.pop(key, None)
+            cleaned += 1
+            if future.done() and not future.cancelled():
+                try:
+                    future.exception()
+                except Exception:
+                    pass
+            logger.warning(
+                "http_bridge_inflight_session_create_cleanup reason=%s bridge_kind=%s bridge_key=%s"
+                " age_seconds=%d stale_after_seconds=%d done=%s cancelled=%s",
+                cleanup_reason,
+                key.affinity_kind,
+                _hash_identifier(key.affinity_key),
+                int(age_seconds),
+                int(stale_after_seconds),
+                future.done(),
+                future.cancelled(),
+            )
+    finally:
+        service._http_bridge_lock.release()
+    return {
+        "cleaned": cleaned,
+        "stale": stale,
+        "oldest_age_seconds": oldest_age_seconds,
+    }
+
+
+def _http_bridge_inflight_creation_count(service: Any) -> int:
+    return sum(
+        1
+        for future in service._http_bridge_inflight_sessions.values()
+        if not getattr(future, "_http_bridge_handoff", False)
+    )
+
+
+def _http_bridge_session_generation_count(service: Any) -> int:
+    return len(service._http_bridge_sessions) + len(service._http_bridge_detached_sessions)
+
+
+def _http_bridge_capacity_generation_count(service: Any) -> int:
+    return _http_bridge_session_generation_count(service) + _http_bridge_inflight_creation_count(service)
+
+
+def _http_bridge_capacity_after_planned_closes(
+    service: Any,
+    sessions_to_close_before_create: Sequence["_HTTPBridgeSession"],
+) -> int:
+    return _http_bridge_capacity_generation_count(service) - len(sessions_to_close_before_create)
+
+
+def _plan_http_bridge_lru_capacity_closes(
+    service: Any,
+    *,
+    max_sessions: int,
+    model_transition_parent_key: "_HTTPBridgeSessionKey | None",
+    sessions_to_close_before_create: list["_HTTPBridgeSession"],
+) -> None:
+    while (
+        _http_bridge_capacity_after_planned_closes(service, sessions_to_close_before_create) >= max_sessions
+        and service._http_bridge_sessions
+    ):
+        evictable_sessions: list[tuple[_HTTPBridgeSessionKey, _HTTPBridgeSession]] = []
+        for candidate_key, candidate_session in service._http_bridge_sessions.items():
+            if candidate_key == model_transition_parent_key:
+                continue
+            if getattr(candidate_session, "unanchored_reservation_id", None) is not None:
+                continue
+            pending_count = service._http_bridge_pending_count_nowait(
+                candidate_session,
+                context="capacity_evict_scan",
+            )
+            if pending_count is None or pending_count:
+                continue
+            evictable_sessions.append((candidate_key, candidate_session))
+        if not evictable_sessions:
+            break
+        lru_key, lru_session = min(evictable_sessions, key=lambda item: _http_bridge_eviction_priority(item[1]))
+        _log_http_bridge_event(
+            "evict_lru",
+            lru_key,
+            account_id=lru_session.account.id,
+            model=lru_session.request_model,
+            cache_key_family=lru_key.affinity_kind,
+            model_class=_extract_model_class(lru_session.request_model) if lru_session.request_model else None,
+        )
+        detached = service._detach_http_bridge_session_locked(lru_key, expected_session=lru_session)
+        if detached is not None:
+            sessions_to_close_before_create.append(detached)
+
+
+def http_bridge_activity_snapshot_nowait(service: Any) -> dict[str, int | bool]:
+    inflight_cleanup = _cleanup_http_bridge_inflight_sessions_nowait(service)
+    live_sessions = 0
+    pending_or_queued_requests = 0
+    pending_unknown_sessions = 0
+
+    # A canonical key names only the newest generation. Detached predecessors
+    # remain live work and must still block restart until their requests settle.
+    for session in [
+        *service._http_bridge_sessions.values(),
+        *service._http_bridge_detached_sessions.values(),
+    ]:
+        if not session.closed:
+            live_sessions += 1
+        # `closed` fences new admission; it does not prove that a detached
+        # request has finished queue/pending settlement. Drain must observe
+        # that work even after the generation stops counting as a live socket.
+        pending_count = _http_bridge_pending_count_nowait(session, context="drain_status")
+        if pending_count is None:
+            pending_unknown_sessions += 1
+        else:
+            pending_or_queued_requests += max(0, pending_count)
+
+    inflight_session_creates = len(service._http_bridge_inflight_sessions)
+    active_cleanup_tasks = sum(
+        1
+        for task in service._background_cleanup_tasks
+        if not task.done()
+        and (
+            task.get_name().startswith("proxy-http_bridge_session_close-")
+            or task.get_name().startswith("http-bridge-close-")
+        )
+    )
+    bridge_active = (
+        live_sessions > 0
+        or pending_or_queued_requests > 0
+        or pending_unknown_sessions > 0
+        or inflight_session_creates > 0
+    )
+    restart_blocking = pending_or_queued_requests > 0 or pending_unknown_sessions > 0 or inflight_session_creates > 0
+    return {
+        "http_bridge_live_sessions": live_sessions,
+        "http_bridge_pending_or_queued_requests": pending_or_queued_requests,
+        "http_bridge_pending_unknown_sessions": pending_unknown_sessions,
+        "http_bridge_inflight_session_creates": inflight_session_creates,
+        "http_bridge_inflight_session_create_oldest_age_seconds": inflight_cleanup["oldest_age_seconds"],
+        "http_bridge_stale_inflight_session_creates": inflight_cleanup["stale"],
+        "http_bridge_cleaned_inflight_session_creates": inflight_cleanup["cleaned"],
+        "http_bridge_background_cleanup_tasks": active_cleanup_tasks,
+        "http_bridge_active": bridge_active,
+        "http_bridge_restart_blocking": restart_blocking,
+    }
+
+
+def _log_http_bridge_startup_wait_timeout(
+    *,
+    stage: str,
+    timeout_seconds: float,
+    key: "_HTTPBridgeSessionKey | None" = None,
+    request_id: str | None = None,
+    request_model: str | None = None,
+    pending_count: int | None = None,
+    inflight_count: int | None = None,
+    queued_count: int | None = None,
+    available: int | None = None,
+    pending_request_ids: Sequence[str] | None = None,
+    pending_request_ages_seconds: Sequence[float] | None = None,
+) -> None:
+    logger.warning(
+        "http_bridge_startup_wait_timeout request_id=%s stage=%s wait_timeout_seconds=%.1f "
+        "affinity_kind=%s bridge_key=%s model_class=%s pending_count=%s queued_count=%s "
+        "inflight_count=%s available=%s pending_request_ids=%s pending_request_ages_seconds=%s",
+        request_id or get_request_id() or "unknown",
+        stage,
+        timeout_seconds,
+        key.affinity_kind if key is not None else None,
+        _hash_identifier(key.affinity_key) if key is not None else None,
+        _extract_model_class(request_model) if request_model else None,
+        pending_count,
+        queued_count,
+        inflight_count,
+        available,
+        ",".join(pending_request_ids) if pending_request_ids else None,
+        ",".join(f"{age:.1f}" for age in pending_request_ages_seconds) if pending_request_ages_seconds else None,
+    )
+
+
+def _http_bridge_precreated_retry_failure_error(
+    exc: BaseException,
+) -> tuple[int, str, str, str, OpenAIErrorParam | None]:
+    if isinstance(exc, ProxyResponseError):
+        parsed = _parse_openai_error(exc.payload)
+        code = _normalize_error_code(parsed.code if parsed else None, parsed.type if parsed else None)
+        message = parsed.message if parsed and parsed.message else "HTTP bridge pre-created retry failed"
+        error_type = parsed.type if parsed and parsed.type else "server_error"
+        error_param = parsed.param_state if parsed else None
+        return exc.status_code, code, message, error_type, error_param
+    if isinstance(exc, TimeoutError):
+        return (
+            502,
+            "upstream_unavailable",
+            "HTTP bridge pre-created retry failed: upstream websocket reconnect timed out",
+            "server_error",
+            None,
+        )
+    message = str(exc).strip() or "HTTP bridge pre-created retry failed"
+    return 502, "upstream_unavailable", message, "server_error", None
+
+
+def _trim_http_bridge_previous_response_input_items(input_items: list[JsonValue]) -> list[JsonValue]:
+    first_output_index = next(
+        (
+            index
+            for index, item in enumerate(input_items)
+            if _http_bridge_input_item_type(item)
+            in {"function_call_output", "custom_tool_call_output", "apply_patch_call_output"}
+        ),
+        None,
+    )
+    if first_output_index is None or first_output_index == 0:
+        return input_items
+    prefix = input_items[:first_output_index]
+    if not all(_is_http_bridge_previous_response_output_item(item) for item in prefix):
+        return input_items
+    return input_items[first_output_index:]
+
+
+def _is_http_bridge_previous_response_output_item(item: JsonValue) -> bool:
+    item_type = _http_bridge_input_item_type(item)
+    if item_type in {"reasoning", "function_call", "custom_tool_call", "apply_patch_call"}:
+        return _has_http_bridge_response_output_marker(item)
+    if item_type != "message" or not isinstance(item, dict):
+        return False
+    role = item.get("role")
+    return role == "assistant" and _has_http_bridge_response_output_marker(item)
+
+
+def _has_http_bridge_response_output_marker(item: JsonValue) -> bool:
+    if not isinstance(item, dict):
+        return False
+    item_id = item.get("id")
+    if isinstance(item_id, str) and item_id.strip():
+        return True
+    status = item.get("status")
+    return status in {"completed", "in_progress"}
+
+
+def _http_bridge_input_item_type(item: JsonValue) -> str | None:
+    if not isinstance(item, dict):
+        return None
+    item_type = item.get("type")
+    return item_type if isinstance(item_type, str) else None
+
+
+def _normalize_http_bridge_error_event(
+    *,
+    event: OpenAIEvent | None,
+    payload: dict[str, JsonValue] | None,
+    request_state: _WebSocketRequestState | None,
+) -> tuple[str, dict[str, JsonValue] | None, OpenAIEvent | None, str]:
+    error_code_value: str | None = None
+    error_type_value: str | None = None
+    error_message_value: str | None = None
+    error_param_value: OpenAIErrorParam | None = None
+    explicit_error_code = False
+    rate_limit_metadata: OpenAIErrorDetail = {}
+
+    if event is not None and event.error is not None:
+        error_code_value = event.error.code
+        error_type_value = event.error.type
+        error_message_value = event.error.message
+        error_param_value = event.error.param_state
+        if isinstance(error_code_value, str) and error_code_value.strip():
+            explicit_error_code = True
+    elif isinstance(payload, dict):
+        payload_error = payload.get("error")
+        if not isinstance(payload_error, dict):
+            payload_error = _websocket_top_level_error_payload(payload)
+        if isinstance(payload_error, dict):
+            code_value = payload_error.get("code")
+            if isinstance(code_value, str):
+                stripped = code_value.strip()
+                if stripped:
+                    error_code_value = stripped
+                    explicit_error_code = True
+            type_value = payload_error.get("type")
+            if isinstance(type_value, str):
+                stripped = type_value.strip()
+                if stripped:
+                    error_type_value = stripped
+            message_value = payload_error.get("message")
+            if isinstance(message_value, str):
+                stripped = message_value.strip()
+                if stripped:
+                    error_message_value = stripped
+    if isinstance(payload, dict):
+        raw_error = payload.get("error")
+        if not isinstance(raw_error, dict):
+            raw_error = _websocket_top_level_error_payload(payload)
+        if isinstance(raw_error, dict):
+            if error_param_value is None and "param" in raw_error:
+                error_param_value = OpenAIErrorParam.from_mapping(cast(Mapping[str, JsonValue], raw_error))
+            plan_type = raw_error.get("plan_type")
+            if isinstance(plan_type, str):
+                rate_limit_metadata["plan_type"] = plan_type
+            resets_at = raw_error.get("resets_at")
+            if isinstance(resets_at, int | float):
+                rate_limit_metadata["resets_at"] = resets_at
+            resets_in = raw_error.get("resets_in_seconds")
+            if isinstance(resets_in, int | float):
+                rate_limit_metadata["resets_in_seconds"] = resets_in
+
+    if request_state is not None:
+        if request_state.error_code_override is not None:
+            error_code_value = request_state.error_code_override
+            explicit_error_code = True
+        if request_state.error_type_override is not None:
+            error_type_value = request_state.error_type_override
+        if request_state.error_message_override is not None:
+            error_message_value = request_state.error_message_override
+        if request_state.error_param_override is not None:
+            error_param_value = coerce_error_param(request_state.error_param_override)
+
+    normalized_error_code = _normalize_error_code(error_code_value, error_type_value) or "upstream_error"
+    if not explicit_error_code and normalized_error_code == "error":
+        normalized_error_code = "upstream_error"
+    normalized_error_type = error_type_value or "server_error"
+    normalized_error_message = error_message_value or "Upstream error"
+
+    normalized_response_id = None
+    if request_state is not None:
+        normalized_response_id = request_state.response_id or request_state.request_id
+
+    normalized_event = response_failed_event(
+        normalized_error_code,
+        normalized_error_message,
+        error_type=normalized_error_type,
+        response_id=normalized_response_id,
+        error_param=error_param_value,
+    )
+    if rate_limit_metadata:
+        normalized_event["response"]["error"].update(rate_limit_metadata)
+    normalized_event_block = format_sse_event(normalized_event)
+    normalized_payload = parse_sse_data_json(normalized_event_block)
+    parsed_event = parse_sse_event(normalized_event_block)
+    return normalized_event_block, normalized_payload, parsed_event, "response.failed"
+
+
+def _http_bridge_pending_state_is_stale(
+    request_state: _WebSocketRequestState,
+    *,
+    now: float,
+    threshold_seconds: float,
+    session_closed: bool = False,
+) -> bool:
+    """Identify pre-created bridge requests that never received upstream activity."""
+    if request_state.transport != _REQUEST_TRANSPORT_HTTP or request_state.skip_request_log:
+        return False
+    # Previous-response and turn-state identifiers preserve hard continuity
+    # while the socket is live. Once it closes, that continuity is already lost.
+    # A silent-but-open upstream must not preserve continuity forever: with
+    # zero upstream activity the anchored request wedges the create gate and
+    # every follow-up on the session, so cap the anchored wait at 2x the
+    # stuck-gate threshold before allowing retirement.
+    if not session_closed and (request_state.previous_response_id is not None or request_state.hard_continuity_anchor):
+        anchored_wait_started_at = (
+            request_state.response_create_gate_wait_started_at
+            if request_state.response_create_gate_wait_started_at is not None
+            else request_state.started_at
+        )
+        if max(0.0, now - anchored_wait_started_at) < threshold_seconds * 2.0:
+            return False
+    # Do not require the gate/awaiting flags: retry and reader re-enqueue
+    # paths re-register states whose admission flags were already cleared,
+    # and leaning on them starves the watchdog entirely (observed prod
+    # wedges 2026-07-20). A reattached stream can deliver events whose
+    # response.created was lost, so use the most recent upstream event as
+    # the silence clock instead of aging every active stream from its
+    # original gate wait.
+    if request_state.response_id is not None:
+        return False
+    if request_state.latency_response_created_ms is not None:
+        return False
+    wait_started_at = (
+        request_state.response_create_gate_wait_started_at
+        if request_state.response_create_gate_wait_started_at is not None
+        else request_state.started_at
+    )
+    has_response_lifecycle_activity = request_state.response_event_count > 0 or request_state.upstream_model_output_seen
+    if has_response_lifecycle_activity and request_state.last_upstream_activity_at is not None:
+        wait_started_at = request_state.last_upstream_activity_at
+    return max(0.0, now - wait_started_at) >= threshold_seconds
+
+
+def _http_bridge_request_counts_against_queue(request_state: _WebSocketRequestState) -> bool:
+    return not request_state.draining_until_terminal
+
+
+def _http_bridge_eventless_precreated_deadline(
+    request_state: _WebSocketRequestState,
+    *,
+    stuck_gate_retire_after_seconds: float,
+) -> float | None:
+    sent_at = request_state.response_create_sent_at
+    if (
+        request_state.transport != "http"
+        or request_state.skip_request_log
+        or not request_state.response_create_gate_acquired
+        or request_state.response_create_gate is None
+        or not request_state.awaiting_response_created
+        or sent_at is None
+        or request_state.response_id is not None
+        or request_state.latency_response_created_ms is not None
+        or request_state.downstream_visible
+        or request_state.last_downstream_sequence_number is not None
+    ):
+        return None
+    # Non-response telemetry (for example ``codex.rate_limits``) may update
+    # the generic activity marker, but it must not extend the response.create
+    # acknowledgement deadline. Keep the send-time anchor until a matched
+    # response-lifecycle event exists; then use the latest lifecycle activity
+    # so deferred reasoning is not retired from the original send time.
+    deadline_anchor = sent_at
+    has_response_lifecycle_activity = request_state.response_event_count > 0 or request_state.upstream_model_output_seen
+    if has_response_lifecycle_activity and request_state.last_upstream_activity_at is not None:
+        deadline_anchor = request_state.last_upstream_activity_at
+    return deadline_anchor + min(
+        float(stuck_gate_retire_after_seconds),
+        _HTTP_BRIDGE_EVENTLESS_RESPONSE_CREATED_MAX_SECONDS,
+    )
+
+
+def _http_bridge_retry_circuit_attempt_selection_for_pending_requests(
+    request_states: Sequence[_WebSocketRequestState],
+) -> _HTTPBridgeRetryCircuitAttemptSelection:
+    eligible_attempts: list[_HTTPBridgeResponseCreateAttempt] = []
+    recorded_attempts: list[_HTTPBridgeResponseCreateAttempt] = []
+    settled_attempts: list[_HTTPBridgeResponseCreateAttempt] = []
+    attempt_seen = False
+    for request_state in request_states:
+        attempt = getattr(request_state, "response_create_attempt", None)
+        if attempt is None:
+            continue
+        attempt_seen = True
+        # A request still holding a verified safe replay must not be charged
+        # anywhere: in a mixed batch its attempt would otherwise be the sole
+        # selectable one (charging the recoverable request) or make the
+        # stranded request's failure look ambiguous. It still counts as a
+        # seen attempt, so a safe-only batch classifies as ineligible rather
+        # than absent — absent is what authorizes an unscoped strike.
+        if _http_bridge_request_state_holds_safe_replay(request_state):
+            continue
+        if attempt.retry_circuit_failure_recorded:
+            recorded_attempts.append(attempt)
+            continue
+        if attempt.disarmed or attempt.response_observed:
+            settled_attempts.append(attempt)
+            continue
+        if (
+            request_state.transport != _REQUEST_TRANSPORT_HTTP
+            or request_state.skip_request_log
+            or request_state.response_id is not None
+            or request_state.latency_response_created_ms is not None
+            or request_state.response_event_count != 0
+            or request_state.downstream_visible
+        ):
+            continue
+        eligible_attempts.append(attempt)
+
+    for kind, attempts in (
+        ("eligible", eligible_attempts),
+        ("recorded", recorded_attempts),
+        ("settled", settled_attempts),
+    ):
+        unique_attempts: list[_HTTPBridgeResponseCreateAttempt] = []
+        for attempt in attempts:
+            if not any(candidate is attempt for candidate in unique_attempts):
+                unique_attempts.append(attempt)
+        if unique_attempts:
+            return _HTTPBridgeRetryCircuitAttemptSelection(
+                kind=kind,
+                attempts=tuple(unique_attempts),
+            )
+    return _HTTPBridgeRetryCircuitAttemptSelection(kind="ineligible" if attempt_seen else "absent")
+
+
+def _http_bridge_continuity_bound_without_safe_replay(request_state: _WebSocketRequestState) -> bool:
+    """Return whether retrying would require replaying an unsafe continuation."""
+    if request_state.previous_response_id is not None:
+        return not _http_bridge_request_state_holds_safe_replay(request_state)
+    return request_state.hard_continuity_anchor and not _http_bridge_request_state_holds_safe_replay(request_state)
+
+
+def _http_bridge_request_state_holds_safe_replay(request_state: Any) -> bool:
+    """Whether the request still holds a verified safe replay to protect.
+
+    Holding one means the proof fields are set AND the one permitted replay is
+    still available. ``_retry_http_bridge_request_on_fresh_upstream`` leaves
+    the proof fields in place after consuming the replay, so a request whose
+    permitted replay already failed is stranded like any other: it must strike
+    the circuit and must not keep an abandonment from settling it. The same
+    retry path also refuses a request that has observed a response event, so a
+    started response holds no replay either — counting it would leave the
+    circuit cooling for its full backoff after a successful abandonment, for a
+    replay that can never dispatch.
+    """
+    return bool(
+        getattr(request_state, "fresh_upstream_request_is_retry_safe", False)
+        and getattr(request_state, "fresh_upstream_request_text", None)
+        and getattr(request_state, "replay_count", 0) == 0
+        and getattr(request_state, "response_event_count", 0) == 0
+        # A deferred-reasoning prelude marks the response started without
+        # counting a response event, and a started response cannot replay.
+        and not getattr(request_state, "upstream_model_output_seen", False)
+    )
+
+
+def _http_bridge_abandonment_may_settle_circuit(request_states: Iterable[Any]) -> bool:
+    """Return whether this abandonment may settle the retry circuit with it.
+
+    The circuit must survive exactly one thing: a request that still holds a
+    safe replay. That replay claims the circuit's generation at dispatch
+    (#1863), so clearing the circuit under it removes the fence it depends on.
+    Every other case is a cooldown backing off a cause this abandonment just
+    removed — anchored or not. Requiring every state to also be
+    continuity-bound let an unanchored full-resend request, which has no
+    replay to protect, block the settle and keep the key cooling for its full
+    backoff after the anchor was already gone.
+
+    An empty set therefore settles. Terminal notification drains
+    ``pending_requests`` before retirement, so the funnels routinely reach here
+    with a pre-drain count and no states at all; nothing is holding the
+    generation.
+    """
+    return not any(_http_bridge_request_state_holds_safe_replay(state) for state in request_states if state is not None)
+
+
+def _http_bridge_session_has_admission_waiter(session: object | None) -> bool:
+    """Keep a closed bridge registered while an unsent request owns its handoff."""
+    return session is not None and bool(getattr(session, "admission_waiter_count", 0))
+
+
+def _http_bridge_session_has_visible_requests(session: "_HTTPBridgeSession") -> bool:
+    return session.queued_request_count > 0 or any(
+        _http_bridge_request_counts_against_queue(request_state) for request_state in session.pending_requests
+    )
+
+
+async def _raise_if_http_bridge_creation_superseded(
+    service: Any,
+    key: "_HTTPBridgeSessionKey",
+    *,
+    inflight_future: Any,
+) -> None:
+    """Abort a creation whose inflight slot another creator already took.
+
+    An evicted creator has lost the registry slot, so claiming would only
+    advance the durable epoch past the session that won — fencing that
+    winner's own renewals out of a row it legitimately owns (issue #1695).
+    Failing here leaves the row untouched; the caller's failure path then
+    closes this session without releasing the winner's row.
+    """
+    async with service._http_bridge_lock:
+        superseded = service._http_bridge_inflight_sessions.get(key) is not inflight_future
+    if superseded:
+        raise _http_bridge_startup_wait_timeout_error(
+            "http_bridge_session_registration",
+            code="capacity_exhausted_active_sessions",
+        )
+
+
+async def _settle_failed_http_bridge_creation(
+    service: Any,
+    key: "_HTTPBridgeSessionKey",
+    *,
+    inflight_future: Any,
+    created_session: "_HTTPBridgeSession | None",
+    exc: BaseException,
+) -> bool:
+    """Retire a failed creation and report whether another session replaced it.
+
+    A rejected creator claimed the durable row last, so its epoch is the
+    current one and its fenced release WOULD succeed — closing the row out
+    from under the session that actually won the registry slot (issue #1695).
+    The caller uses the return value to skip the durable release in that case.
+    """
+    async with service._http_bridge_lock:
+        current_future = service._http_bridge_inflight_sessions.get(key)
+        replacement_in_flight = current_future is not None and current_future is not inflight_future
+        if current_future is inflight_future:
+            service._http_bridge_inflight_sessions.pop(key, None)
+            if inflight_future is not None and not inflight_future.done():
+                if isinstance(exc, asyncio.CancelledError):
+                    inflight_future.cancel()
+                else:
+                    inflight_future.set_exception(exc)
+                    inflight_future.exception()
+        registered_session = service._http_bridge_sessions.get(key)
+        # A replacement that has claimed but not yet published its session is
+        # just as much the winner as a registered one: releasing here would
+        # close the row beneath it, and it would then register with an older
+        # epoch and be fenced out on its first renewal (issue #1695).
+        registered_winner = (
+            registered_session if registered_session is not None and registered_session is not created_session else None
+        )
+        # A registered winner on a DIFFERENT account no longer shares this row:
+        # our claim already rewrote its account binding and cleared its
+        # continuity aliases, so preserving the row would leave it bound to our
+        # account while that session keeps dispatching. Release it instead —
+        # the winner is then fenced promptly and retries cleanly.
+        winner_shares_row = registered_winner is not None and (
+            created_session is None or registered_winner.account.id == created_session.account.id
+        )
+        superseded = replacement_in_flight or winner_shares_row
+        if superseded and registered_session is not None and created_session is not None:
+            # Eviction can still land DURING the claim, so this creator may
+            # have advanced the shared row's epoch past the session that won
+            # the slot, fencing the winner's own renewals. Both sessions are
+            # this instance's and point at the same row, so hand the epoch we
+            # won over to the winner rather than leaving it stranded.
+            assert registered_session is not None
+            claimed_id = created_session.durable_session_id
+            claimed_epoch = created_session.durable_owner_epoch
+            registered_epoch = registered_session.durable_owner_epoch
+            if (
+                claimed_id is not None
+                and claimed_epoch is not None
+                and registered_session.durable_session_id == claimed_id
+                and (registered_epoch is None or claimed_epoch > registered_epoch)
+                # Only when both sessions selected the same account: a claim
+                # rewrites the row's account_id and clears continuity aliases,
+                # so handing the epoch across an account change would leave the
+                # winner renewing and dispatching on a row bound to a different
+                # account. Fail closed there instead — the winner's renewal is
+                # fenced, it is evicted, and the request retries cleanly.
+                and created_session.account.id == registered_session.account.id
+            ):
+                registered_session.durable_owner_epoch = claimed_epoch
+        return superseded
+
+
+async def _close_http_bridge_session_resources(
+    service: Any,
+    session: "_HTTPBridgeSession",
+    *,
+    turn_state_lock_held: bool = False,
+    release_durable_session: bool = True,
+) -> None:
+    session.closed = True
+    durable_session_id = getattr(session, "durable_session_id", None)
+    durable_owner_epoch = getattr(session, "durable_owner_epoch", None)
+    durable_release_allowed = release_durable_session and _http_bridge_durable_release_allowed(service, session)
+    if turn_state_lock_held:
+        service._unregister_http_bridge_turn_states_locked(session)
+        service._unregister_http_bridge_previous_response_ids_locked(session)
+    else:
+        await service._unregister_http_bridge_turn_states(session)
+        await service._unregister_http_bridge_previous_response_ids(session)
+    account_lease = getattr(session, "account_lease", None)
+    try:
+        await service._load_balancer.release_account_lease(account_lease)
+    except Exception:
+        logger.warning("Failed to release HTTP bridge account lease during close", exc_info=True)
+    finally:
+        session.account_lease = None
+    durable_release_succeeded = durable_owner_epoch is None
+    if durable_release_allowed:
+        try:
+            released = await service._durable_bridge.release_live_session(
+                session_id=durable_session_id,
+                instance_id=_service_get_settings().http_responses_session_bridge_instance_id,
+                owner_epoch=durable_owner_epoch,
+                draining=shutdown_state.is_bridge_drain_active(),
+            )
+            # Fenced releases return the current owner snapshot, while a
+            # missing row returns None. Only an ownerless snapshot (or a
+            # missing row) means this generation no longer owns a durable lease.
+            durable_release_succeeded = released is None or getattr(released, "owner_instance_id", None) is None
+        except Exception:
+            logger.warning("Failed to release durable HTTP bridge session", exc_info=True)
+    # Closing a generation retires its process-local denial slot as well as
+    # its routing aliases. Keep pinned requests fenced; the owner helper marks
+    # those entries superseded and lets their final pin release remove them.
+    # A deliberately retained lease or a failed/fenced release still belongs
+    # to a live durable owner, so its fence must remain for a successor.
+    if durable_release_succeeded:
+        owner_key = durable_session_id if durable_session_id is not None else f"local:{id(session)}"
+        pending_denied_response_ids = tuple(getattr(session, "denied_proxy_injected_anchor_cleanup_pending", ()))
+        _forget_http_bridge_denied_anchor_fence_owner(
+            service,
+            owner_key,
+            owner_epoch=durable_owner_epoch,
+            preserve_response_ids=pending_denied_response_ids,
+        )
+        _retire_http_bridge_denied_anchor_predecessors_after_durable_clear(
+            service,
+            owner_key,
+            owner_epoch=durable_owner_epoch,
+            preserve_response_ids=pending_denied_response_ids,
+        )
+    upstream_reader = session.upstream_reader
+    if upstream_reader is not None:
+        if upstream_reader is asyncio.current_task():
+            session.upstream_reader = None
+        else:
+            await _await_cancelled_task(
+                upstream_reader,
+                label="http bridge upstream reader",
+                cleanup_tasks=service._background_cleanup_tasks,
+                scheduler=scheduler_for(service),
+            )
+            if session.upstream_reader is upstream_reader:
+                session.upstream_reader = None
+    try:
+        await session.upstream.close()
+    except Exception:
+        logger.debug("Failed to close HTTP bridge upstream websocket", exc_info=True)
+    pending_requests = getattr(session, "pending_requests", None)
+    pending_lock = getattr(session, "pending_lock", None)
+    response_create_gate = getattr(session, "response_create_gate", None)
+    if pending_requests is not None and pending_lock is not None:
+        async with pending_lock:
+            session.queued_request_count = 0
+        await service._fail_pending_websocket_requests(
+            account=session.account,
+            account_id_value=session.account.id,
+            pending_requests=pending_requests,
+            pending_lock=pending_lock,
+            error_code="stream_incomplete",
+            error_message="HTTP bridge session closed before response.completed",
+            api_key=None,
+            response_create_gate=response_create_gate,
+        )
+    _log_http_bridge_event(
+        "close",
+        session.key,
+        account_id=session.account.id,
+        model=session.request_model,
+        cache_key_family=session.key.affinity_kind,
+        model_class=_extract_model_class(session.request_model) if session.request_model else None,
+    )
+
+
+async def _close_http_bridge_session(
+    service: Any,
+    session: "_HTTPBridgeSession",
+    *,
+    turn_state_lock_held: bool = False,
+    release_durable_session: bool = True,
+) -> None:
+    # Direct close callers can be cancelled just like the bounded background
+    # wrapper. Keep the resource owner alive until its reader, socket, and
+    # leases are actually finalized; only then may detached-capacity tracking
+    # disappear. Otherwise cancellation can turn a live predecessor into an
+    # unowned generation that neither shutdown nor capacity accounting sees.
+    def resource_close_task() -> asyncio.Task[None]:
+        existing = session.resource_close_task
+        if existing is not None and (
+            not existing.done() or (not existing.cancelled() and existing.exception() is None)
+        ):
+            return existing
+        created = scheduler_for(service).create_task(
+            _close_http_bridge_session_resources(
+                service,
+                session,
+                turn_state_lock_held=turn_state_lock_held,
+                release_durable_session=release_durable_session,
+            ),
+            name=f"http-bridge-resource-close-{_hash_identifier(session.key.affinity_key)}",
+        )
+        session.resource_close_task = created
+        return created
+
+    # Close callers can race (reader retirement, account invalidation, and
+    # shutdown). Install one resource owner under the registry lock so leases
+    # and pending settlement are finalized exactly once.
+    if turn_state_lock_held:
+        close_task = resource_close_task()
+    else:
+        async with service._http_bridge_lock:
+            close_task = resource_close_task()
+    _, cancellation = await _await_task_deferring_cancellation(close_task)
+
+    # Detached generations remain capacity owners until resource closure ends.
+    # Finalize that ownership here so direct error-recovery closes and bounded
+    # background closes cannot drift into different lifecycles. This update is
+    # independently owned because cancellation can begin while its lock waits.
+    async def finalize_detached_ownership() -> None:
+        if turn_state_lock_held:
+            if service._http_bridge_detached_sessions.get(id(session)) is session:
+                service._http_bridge_detached_sessions.pop(id(session), None)
+        else:
+            async with service._http_bridge_lock:
+                if service._http_bridge_detached_sessions.get(id(session)) is session:
+                    service._http_bridge_detached_sessions.pop(id(session), None)
+
+    ownership_task = scheduler_for(service).create_task(
+        finalize_detached_ownership(),
+        name=f"http-bridge-detached-finalize-{_hash_identifier(session.key.affinity_key)}",
+    )
+    _, ownership_cancellation = await _await_task_deferring_cancellation(ownership_task)
+    cancellation = cancellation or ownership_cancellation
+    if cancellation is not None:
+        raise cancellation
+
+
+async def _close_http_bridge_session_bounded(
+    service: Any,
+    session: "_HTTPBridgeSession",
+    *,
+    reason: str,
+) -> None:
+    if session.upstream_reader is asyncio.current_task():
+        session.upstream_reader = None
+
+    close_task = scheduler_for(service).create_task(
+        service._close_http_bridge_session(session),
+        name=f"http-bridge-close-{_hash_identifier(session.key.affinity_key)}",
+    )
+
+    def track_after_interruption(*, interruption: str) -> None:
+        def close_done(done_task: asyncio.Task[None]) -> None:
+            try:
+                done_task.result()
+            except asyncio.CancelledError:
+                service._http_bridge_background_cleanup_failed = True
+                logger.warning(
+                    "http_bridge_session_close_cancelled_after_%s reason=%s bridge_kind=%s "
+                    "bridge_key=%s account_id=%s model=%s",
+                    interruption,
+                    reason,
+                    session.key.affinity_kind,
+                    _hash_identifier(session.key.affinity_key),
+                    session.account.id,
+                    session.request_model,
+                )
+            except BaseException:
+                service._http_bridge_background_cleanup_failed = True
+                logger.warning(
+                    "http_bridge_session_close_failed_after_%s reason=%s bridge_kind=%s "
+                    "bridge_key=%s account_id=%s model=%s",
+                    interruption,
+                    reason,
+                    session.key.affinity_kind,
+                    _hash_identifier(session.key.affinity_key),
+                    session.account.id,
+                    session.request_model,
+                    exc_info=True,
+                )
+            finally:
+                service._background_cleanup_tasks.discard(done_task)
+
+        if close_task.done():
+            close_done(close_task)
+            return
+        service._background_cleanup_tasks.add(close_task)
+        close_task.add_done_callback(close_done)
+
+    try:
+        # Not ``wait_for(shield(...))``: ``close_task`` is the shared
+        # per-session resource owner, and 3.14's shield leaks a done-callback
+        # onto it for every waiter that times out or is cancelled.
+        await wait_on_shared_future(
+            close_task,
+            timeout=_HTTP_BRIDGE_BACKGROUND_CLOSE_TIMEOUT_SECONDS,
+            scheduler=scheduler_for(service),
+        )
+    except TimeoutError:
+        track_after_interruption(interruption="timeout")
+        logger.warning(
+            "http_bridge_session_close_timeout reason=%s bridge_kind=%s bridge_key=%s "
+            "account_id=%s model=%s timeout_seconds=%.1f background_cleanup_tasks=%d",
+            reason,
+            session.key.affinity_kind,
+            _hash_identifier(session.key.affinity_key),
+            session.account.id,
+            session.request_model,
+            _HTTP_BRIDGE_BACKGROUND_CLOSE_TIMEOUT_SECONDS,
+            len(service._background_cleanup_tasks),
+        )
+    except asyncio.CancelledError:
+        track_after_interruption(interruption="cancellation")
+        raise
+    except Exception:
+        logger.warning(
+            "http_bridge_session_close_failed reason=%s bridge_kind=%s bridge_key=%s account_id=%s model=%s",
+            reason,
+            session.key.affinity_kind,
+            _hash_identifier(session.key.affinity_key),
+            session.account.id,
+            session.request_model,
+            exc_info=True,
+        )
+
+
+def _http_bridge_models_compatible(existing_model: str | None, request_model: str | None) -> bool:
+    """Never reuse a bridge across two explicitly different model slugs."""
+
+    if existing_model is None or request_model is None:
+        return True
+    return existing_model.strip().lower() == request_model.strip().lower()
+
+
+def _http_bridge_compatible(
+    session: _HTTPBridgeSession,
+    request_model: str | None,
+    request_service_tier: str | None,
+    same_model_required: bool = False,
+) -> bool:
+    """Check catalog compatibility while preserving stricter legacy reuse paths."""
+
+    model_compatible = not same_model_required or _http_bridge_models_compatible(
+        session.request_model,
+        request_model,
+    )
+    return model_compatible and _http_bridge_session_supports_service_tier(
+        session,
+        request_model=request_model,
+        request_service_tier=request_service_tier,
+    )
+
+
+def _http_bridge_alias_target_is_stale(session: _HTTPBridgeSession | None) -> bool:
+    return (
+        session is None
+        or (session.closed and not session.handoff_in_progress)
+        or not _http_bridge_session_account_active(session)
+    )
+
+
+def _http_bridge_incompatible_model_fork_key(
+    *,
+    key: "_HTTPBridgeSessionKey",
+    existing_model: str | None,
+    request_model: str | None,
+    request_scope_id: str,
+) -> "_HTTPBridgeSessionKey | None":
+    if key.affinity_kind not in {
+        "session_header",
+        "thread_header",
+        "turn_state_header",
+        "internal_unanchored_parallel",
+        "internal_model_parallel",
+    }:
+        return None
+    if _http_bridge_models_compatible(existing_model, request_model):
+        return None
+    if key.affinity_kind == "internal_model_parallel":
+        return None
+    recovery_fork = is_http_bridge_account_neutral_replay(
+        kind=key.affinity_kind,
+        key=key.affinity_key,
+    )
+    fork_value = sha256(
+        f"{key.affinity_kind}\0{key.affinity_key}\0{request_model or ''}\0{request_scope_id}".encode()
+    ).hexdigest()
+    if recovery_fork:
+        fork_kind, fork_value = make_http_bridge_account_neutral_replay_key(fork_value)
+    else:
+        fork_kind = "internal_model_parallel"
+    fork_key = _HTTPBridgeSessionKey(
+        fork_kind,
+        fork_value,
+        key.api_key_id,
+    )
+    _log_http_bridge_event(
+        "model_transition_fork",
+        fork_key,
+        account_id=None,
+        model=request_model,
+        detail=f"previous_model={existing_model}",
+        cache_key_family=key.affinity_kind,
+        model_class=_extract_model_class(request_model) if request_model else None,
+        owner_check_applied=False,
+    )
+    return fork_key
+
+
+def _http_bridge_locally_owned_fork_key(
+    fork_key: "_HTTPBridgeSessionKey",
+    forwarded_request: bool,
+    forwarded_original_request_unanchored: bool,
+) -> "_HTTPBridgeSessionKey | None":
+    if not forwarded_request:
+        return None
+    if fork_key.affinity_kind == "internal_request_parallel":
+        return fork_key
+    if forwarded_original_request_unanchored and fork_key.affinity_kind == "internal_unanchored_parallel":
+        return fork_key
+    return None
+
+
+def _http_bridge_parallel_fork_key(
+    *,
+    key: "_HTTPBridgeSessionKey",
+    session: "_HTTPBridgeSession | None",
+    inflight_creation: bool,
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+    request_model: str | None,
+    request_service_tier: str | None,
+    request_scope_id: str,
+    allow_model_fork: bool = True,
+    same_model_required: bool = False,
+    force_canonical_replacement: bool = False,
+) -> "_HTTPBridgeSessionKey | None":
+    """Give incompatible or concurrent requests an independent websocket lane."""
+
+    if force_canonical_replacement:
+        if session is not None:
+            # A restart must replace the canonical session-header lane. Forking
+            # would leave the old owner reusable after the restart moved affinity.
+            session.upstream_control.reconnect_requested = True
+            session.upstream_control.retire_after_drain = True
+        return None
+
+    reason: str | None = None
+    if (
+        key.affinity_kind in {"session_header", "thread_header"}
+        and incoming_turn_state is None
+        and previous_response_id is None
+    ):
+        if inflight_creation:
+            reason = "session_creation_inflight"
+        elif session is not None and not session.closed:
+            if _http_bridge_session_has_visible_requests(session):
+                reason = "active_request"
+            elif (
+                reservation_id := getattr(session, "unanchored_reservation_id", None)
+            ) is not None and reservation_id != request_scope_id:
+                reason = "session_reserved"
+            elif not _http_bridge_models_compatible(session.request_model, request_model):
+                reason = "model_change"
+    if reason is not None:
+        fork_key = _HTTPBridgeSessionKey(
+            "internal_unanchored_parallel",
+            sha256(f"{key.affinity_key}\0{request_scope_id}".encode()).hexdigest(),
+            key.api_key_id,
+        )
+        _log_http_bridge_event(
+            "unanchored_parallel_fork",
+            fork_key,
+            account_id=None,
+            model=request_model,
+            detail=f"reason={reason}",
+            cache_key_family=key.affinity_kind,
+            model_class=_extract_model_class(request_model) if request_model else None,
+            owner_check_applied=False,
+        )
+        return fork_key
+
+    if session is None or session.closed or not _http_bridge_session_account_active(session):
+        return None
+    if allow_model_fork:
+        model_fork_key = _http_bridge_incompatible_model_fork_key(
+            key=key,
+            existing_model=session.request_model,
+            request_model=request_model,
+            request_scope_id=request_scope_id,
+        )
+        if model_fork_key is not None:
+            return model_fork_key
+    if _http_bridge_compatible(
+        session,
+        request_model,
+        request_service_tier,
+        same_model_required,
+    ):
+        return None
+    if incoming_turn_state is not None or previous_response_id is not None:
+        raise ProxyResponseError(502, _http_bridge_continuity_lost_error_envelope())
+
+    fork_key = _HTTPBridgeSessionKey(
+        "internal_request_parallel",
+        sha256(f"{key.affinity_kind}\0{key.affinity_key}\0{request_scope_id}".encode()).hexdigest(),
+        key.api_key_id,
+    )
+    _log_http_bridge_event(
+        "request_compatibility_fork",
+        fork_key,
+        account_id=session.account.id,
+        model=request_model,
+        detail=f"source_kind={key.affinity_kind}",
+        cache_key_family=key.affinity_kind,
+        model_class=_extract_model_class(request_model) if request_model else None,
+        owner_check_applied=False,
+    )
+    return fork_key
+
+
+def _http_bridge_request_needs_unanchored_handoff(
+    key: "_HTTPBridgeSessionKey",
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+    forwarded_request: bool,
+    forwarded_original_request_unanchored: bool,
+) -> bool:
+    if forwarded_request:
+        return forwarded_original_request_unanchored
+    return (
+        key.affinity_kind in {"session_header", "thread_header"}
+        and incoming_turn_state is None
+        and previous_response_id is None
+    )
+
+
+def _reserve_http_bridge_unanchored_handoff(
+    session: "_HTTPBridgeSession",
+    *,
+    request_scope_id: str,
+) -> None:
+    current_reservation = getattr(session, "unanchored_reservation_id", None)
+    if current_reservation is not None and current_reservation != request_scope_id:
+        raise ProxyResponseError(
+            409,
+            openai_error(
+                "bridge_session_reserved",
+                "HTTP responses session bridge is reserved by another request",
+                error_type="server_error",
+            ),
+        )
+    session.unanchored_reservation_id = request_scope_id
+
+
+def _release_http_bridge_unanchored_handoff(
+    session: "_HTTPBridgeSession",
+    *,
+    request_scope_id: str,
+) -> None:
+    if session.unanchored_reservation_id == request_scope_id:
+        session.unanchored_reservation_id = None
+
+
+async def _refresh_reused_http_bridge_session_with_handoff(
+    service: "_HTTPBridgeServiceProtocol",
+    session: "_HTTPBridgeSession",
+    *,
+    key: "_HTTPBridgeSessionKey",
+    request_scope_id: str,
+    reserve_handoff: bool,
+) -> None:
+    if reserve_handoff:
+        _reserve_http_bridge_unanchored_handoff(session, request_scope_id=request_scope_id)
+    try:
+        await service._refresh_durable_http_bridge_session(session)
+        _log_http_bridge_event(
+            "reuse",
+            key,
+            account_id=session.account.id,
+            model=session.request_model,
+            pending_count=service._http_bridge_pending_count_nowait(session, context="reuse_log"),
+            cache_key_family=key.affinity_kind,
+            model_class=_extract_model_class(session.request_model) if session.request_model else None,
+        )
+    except BaseException:
+        if reserve_handoff:
+            _release_http_bridge_unanchored_handoff(session, request_scope_id=request_scope_id)
+        raise
+
+
+def _http_bridge_session_retiring_with_visible_requests(session: "_HTTPBridgeSession") -> bool:
+    # A reserved handoff is not queued yet, but it owns the lane just as a
+    # visible request does and must be allowed to submit before retirement.
+    return session.upstream_control.retire_after_drain and (
+        _http_bridge_session_has_visible_requests(session) or session.unanchored_reservation_id is not None
+    )
+
+
+def _http_bridge_payload_looks_like_full_resend(payload: ResponsesRequest) -> bool:
+    input_value = payload.input
+    if isinstance(input_value, str):
+        return len(input_value) >= 4096
+    if isinstance(input_value, Sequence) and not isinstance(input_value, (str, bytes, bytearray)):
+        if len(input_value) > 1:
+            return True
+        if len(input_value) == 1:
+            try:
+                return len(json.dumps(input_value[0], ensure_ascii=True, separators=(",", ":"))) >= 4096
+            except TypeError:
+                return False
+    return False
+
+
+def _preferred_http_bridge_reconnect_turn_state(session: "_HTTPBridgeSession") -> str | None:
+    if (
+        session.codex_session
+        and session.downstream_turn_state is not None
+        and session.affinity.kind == StickySessionKind.CODEX_SESSION
+        and session.affinity.key == session.downstream_turn_state
+    ):
+        return session.downstream_turn_state
+    return session.upstream_turn_state
+
+
+def _http_bridge_reconnect_turn_state(
+    session: "_HTTPBridgeSession",
+    account_id: str,
+    owner_rebind_affinity: _AffinityPolicy | None,
+) -> str | None:
+    """Return the turn state the replacement handshake for ``account_id`` may carry.
+
+    The turn state was learned from the retired socket and belongs to the
+    account that issued it. Only a reconnect to that same account offers it
+    again; a replacement account (or an owner rebind) opens its socket with no
+    turn state -- the same condition under which the reconnect clears the
+    session's turn state once the replacement socket is open, so the handshake
+    cannot leak what the session-side cleanup is about to drop
+    (``responses-api-compat``: "Cross-account bridge retries clear turn-state").
+    """
+    if owner_rebind_affinity is not None or account_id != session.account.id:
+        return None
+    return _preferred_http_bridge_reconnect_turn_state(session)
+
+
+def _http_bridge_turn_state_alias_key(turn_state: str, api_key_id: str | None) -> tuple[str, str | None]:
+    return (turn_state, api_key_id)
+
+
+def _http_bridge_live_turn_state_alias_owner(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    turn_state: str,
+) -> _HTTPBridgeSession | None:
+    alias_key = _http_bridge_turn_state_alias_key(turn_state, session.key.api_key_id)
+    existing_key = service._http_bridge_turn_state_index.get(alias_key)
+    if existing_key is None or existing_key == session.key:
+        return None
+    existing_session = service._http_bridge_sessions.get(existing_key)
+    if _http_bridge_alias_target_is_stale(existing_session):
+        return None
+    return existing_session
+
+
+def _register_http_bridge_turn_state_aliases_locked(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+) -> None:
+    for alias in session.downstream_turn_state_aliases:
+        alias_key = _http_bridge_turn_state_alias_key(alias, session.key.api_key_id)
+        existing_key = service._http_bridge_turn_state_index.get(alias_key)
+        if existing_key is not None and existing_key != session.key:
+            existing_session = service._http_bridge_sessions.get(existing_key)
+            if not _http_bridge_alias_target_is_stale(existing_session):
+                continue
+        service._http_bridge_turn_state_index[alias_key] = session.key
+
+
+def _http_bridge_previous_response_alias_key(response_id: str, api_key_id: str | None) -> tuple[str, str | None]:
+    return (response_id.strip(), api_key_id)
+
+
+def _http_bridge_live_previous_response_alias_owner(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    response_id: str,
+) -> _HTTPBridgeSession | None:
+    alias_key = _http_bridge_previous_response_alias_key(response_id, session.key.api_key_id)
+    existing_key = service._http_bridge_previous_response_index.get(alias_key)
+    if existing_key is None or existing_key == session.key:
+        return None
+    existing_session = service._http_bridge_sessions.get(existing_key)
+    if _http_bridge_alias_target_is_stale(existing_session):
+        return None
+    return existing_session
+
+
+def _http_bridge_session_allows_api_key(session: "_HTTPBridgeSession", api_key: ApiKeyData | None) -> bool:
+    if api_key is None or not api_key.account_assignment_scope_enabled:
+        return True
+    return session.account.id in api_key.assigned_account_ids
+
+
+def _http_bridge_session_account_active(session: "_HTTPBridgeSession") -> bool:
+    # Hot-path invariant: this reuse check MUST stay a pure in-memory lookup (no
+    # per-request database reads). Cross-replica freshness comes from the
+    # `account_routing` cache-invalidation namespace refreshing the routing
+    # availability snapshot behind is_account_routing_unavailable().
+    return (
+        session.account.status in (AccountStatus.ACTIVE, AccountStatus.REAUTH_REQUIRED)
+        and not reauth_access_token_is_expired(
+            session.account.status,
+            session.access_token_expires_at,
+        )
+        and not is_account_routing_unavailable(session.account.id)
+    )
+
+
+def _http_bridge_session_reusable_for_request(
+    *,
+    session: "_HTTPBridgeSession",
+    key: "_HTTPBridgeSessionKey",
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+) -> bool:
+    if session.upstream_control.retire_after_drain:
+        return False
+    if key.affinity_kind != "prompt_cache":
+        return True
+    if incoming_turn_state is not None:
+        return True
+    if previous_response_id is not None:
+        return True
+    return not session.codex_session
+
+
+def _http_bridge_session_matches_preferred_account(
+    *,
+    session: "_HTTPBridgeSession",
+    previous_response_id: str | None,
+    preferred_account_id: str | None,
+    require_preferred_account: bool = False,
+) -> bool:
+    if preferred_account_id is None:
+        return True
+    if previous_response_id is None and not require_preferred_account:
+        return True
+    return session.account.id == preferred_account_id
+
+
+def _http_bridge_session_reusable_for_lookup(
+    *,
+    session: "_HTTPBridgeSession",
+    key: "_HTTPBridgeSessionKey",
+    api_key: ApiKeyData | None,
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+    preferred_account_id: str | None,
+    require_preferred_account: bool,
+    service_tier_supported: bool,
+    allow_closed_admission_handoff: bool,
+    session_key_quarantined: bool,
+) -> bool:
+    if session.quarantined and not session_key_quarantined:
+        # The quarantine registry TTL is the source of truth
+        # (``_http_bridge_session_key_quarantined``): pruning drops the
+        # registry entry without touching the per-session flag, so a live
+        # session that outlives its quarantine window must become reusable
+        # again instead of staying rejected forever. Reset the stale flag so
+        # session state agrees with the registry.
+        session.quarantined = False
+    live_or_retained = _http_bridge_session_account_active(session) and (
+        not session.closed or (allow_closed_admission_handoff and _http_bridge_session_has_admission_waiter(session))
+    )
+    return (
+        live_or_retained
+        # A quarantined key has proven silent/wedged; a new request must take
+        # the fresh session path instead of re-attaching. The registry verdict
+        # is authoritative for the key in both directions: a freshly created
+        # replacement session (flag still False) under a still-quarantined key
+        # is not reusable either, so a concurrent full-resend cannot restore
+        # the suppressed durable anchor through session hydration.
+        and not session_key_quarantined
+        and _http_bridge_session_allows_api_key(session, api_key)
+        and _http_bridge_session_reusable_for_request(
+            session=session,
+            key=key,
+            incoming_turn_state=incoming_turn_state,
+            previous_response_id=previous_response_id,
+        )
+        and _http_bridge_session_matches_preferred_account(
+            session=session,
+            previous_response_id=previous_response_id,
+            preferred_account_id=preferred_account_id,
+            require_preferred_account=require_preferred_account,
+        )
+        and service_tier_supported
+    )
+
+
+def _require_http_bridge_bound_account_not_excluded(
+    hard_account_bound: bool,
+    account_id: str,
+    excluded_account_ids: set[str],
+) -> None:
+    if hard_account_bound and account_id in excluded_account_ids:
+        raise ProxyResponseError(
+            502,
+            openai_error(
+                "upstream_unavailable",
+                "HTTP responses session bridge continuity account is excluded",
+            ),
+        )
+
+
+def _record_http_bridge_handoff_compatibility_rejection(
+    *,
+    session: "_HTTPBridgeSession",
+    key: "_HTTPBridgeSessionKey",
+    api_key: ApiKeyData | None,
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+    preferred_account_id: str | None,
+    require_preferred_account: bool,
+    request_service_tier: str | None,
+    service_tier_supported: bool,
+) -> None:
+    continuity_anchor = (
+        "previous_response_id"
+        if previous_response_id is not None
+        else "turn_state"
+        if incoming_turn_state is not None
+        else "none"
+    )
+    preferred_account = (
+        "required" if require_preferred_account else "preferred" if preferred_account_id is not None else "none"
+    )
+    service_tier = (
+        "not_requested" if request_service_tier is None else "supported" if service_tier_supported else "unsupported"
+    )
+    api_key_scope = "scoped" if api_key is not None and api_key.id is not None else "unscoped"
+    if PROMETHEUS_AVAILABLE and bridge_handoff_compatibility_rejection_total is not None:
+        bridge_handoff_compatibility_rejection_total.labels(
+            continuity_anchor=continuity_anchor,
+            preferred_account=preferred_account,
+            service_tier=service_tier,
+            api_key_scope=api_key_scope,
+        ).inc()
+    logger.warning(
+        "http_bridge_handoff_compatibility_rejected bridge_kind=%s bridge_key=%s key_strength=%s "
+        "continuity_anchor=%s preferred_account=%s preferred_account_id=%s require_preferred=%s "
+        "service_tier=%s api_key_scope=%s existing_closed=%s admission_waiters=%s pending_count=%s",
+        key.affinity_kind,
+        _hash_identifier(key.affinity_key),
+        _http_bridge_key_strength(key),
+        continuity_anchor,
+        preferred_account,
+        _hash_identifier_or_none(preferred_account_id),
+        require_preferred_account,
+        service_tier,
+        api_key_scope,
+        session.closed,
+        getattr(session, "admission_waiter_count", 0),
+        len(session.pending_requests),
+    )
+
+
+def _record_http_bridge_unanchored_handoff_recovery(*, reason: str) -> None:
+    if PROMETHEUS_AVAILABLE and bridge_unanchored_handoff_recovery_total is not None:
+        bridge_unanchored_handoff_recovery_total.labels(reason=reason).inc()
+
+
+def _raise_http_bridge_incompatible_admission_handoff(
+    *,
+    session: "_HTTPBridgeSession",
+    key: "_HTTPBridgeSessionKey",
+    api_key: ApiKeyData | None,
+    incoming_turn_state: str | None,
+    previous_response_id: str | None,
+    preferred_account_id: str | None,
+    require_preferred_account: bool,
+    request_service_tier: str | None,
+    service_tier_supported: bool,
+) -> None:
+    _record_http_bridge_handoff_compatibility_rejection(
+        session=session,
+        key=key,
+        api_key=api_key,
+        incoming_turn_state=incoming_turn_state,
+        previous_response_id=previous_response_id,
+        preferred_account_id=preferred_account_id,
+        require_preferred_account=require_preferred_account,
+        request_service_tier=request_service_tier,
+        service_tier_supported=service_tier_supported,
+    )
+    raise ProxyResponseError(
+        503,
+        openai_error(
+            "upstream_unavailable",
+            "HTTP responses session bridge is preserving an incompatible admission handoff",
+        ),
+    )
+
+
+def _make_http_bridge_session_key(
+    payload: ResponsesRequest,
+    *,
+    headers: Mapping[str, str],
+    affinity: _AffinityPolicy,
+    api_key: ApiKeyData | None,
+    request_id: str,
+    explicit_prompt_cache_key: str | None = None,
+    allow_forwarded_affinity_headers: bool = False,
+    forwarded_affinity_kind: str | None = None,
+    forwarded_affinity_key: str | None = None,
+) -> _HTTPBridgeSessionKey:
+    forwarded_key = (
+        _forwarded_http_bridge_session_key(
+            headers,
+            api_key,
+            forwarded_affinity_kind=forwarded_affinity_kind,
+            forwarded_affinity_key=forwarded_affinity_key,
+        )
+        if allow_forwarded_affinity_headers
+        else None
+    )
+    if forwarded_key is not None:
+        return forwarded_key
+    turn_state_key = _sticky_key_from_turn_state_header(headers)
+    if turn_state_key is not None:
+        affinity_key = turn_state_key
+        affinity_kind = "turn_state_header"
+        strength: Literal["hard", "soft"] = "hard"
+    elif (thread_key := _codex_backend_identity(headers).thread_selection_key) is not None:
+        # prompt_cache_key is intentionally shared by current Codex root trees.
+        # The thread key is canonical identity; once a bridge exists it is hard
+        # transport continuity even though pre-bridge account locality is soft.
+        affinity_key = thread_key
+        affinity_kind = "thread_header"
+        strength = "hard"
+    else:
+        session_key = _sticky_key_from_session_header(headers)
+        if session_key is not None:
+            # Compatibility path for clients that do not expose thread-id.
+            # Current Codex reaches the thread_header branch above; do not
+            # reintroduce prompt_cache_key as thread identity here.
+            session_header_key = _make_http_bridge_session_header_fallback_key(
+                headers=headers,
+                api_key=api_key,
+                explicit_prompt_cache_key=explicit_prompt_cache_key,
+            )
+            assert session_header_key is not None
+            affinity_key = session_header_key.affinity_key
+            affinity_kind = "session_header"
+            strength = "hard"
+        else:
+            inferred_key = (
+                inferred_http_bridge_key(payload) if payload.conversation or explicit_prompt_cache_key is None else None
+            )
+            affinity_key = inferred_key or affinity.key or request_id
+            affinity_kind = (
+                "prompt_cache" if inferred_key else affinity.kind.value if affinity.kind is not None else "request"
+            )
+            strength = "soft"
+    return _HTTPBridgeSessionKey(
+        affinity_kind=affinity_kind,
+        affinity_key=affinity_key,
+        api_key_id=api_key.id if api_key is not None else None,
+        strength=strength,
+    )
+
+
+def _make_http_bridge_session_header_fallback_key(
+    *,
+    headers: Mapping[str, str],
+    api_key: ApiKeyData | None,
+    explicit_prompt_cache_key: str | None,
+) -> _HTTPBridgeSessionKey | None:
+    if _codex_backend_identity(headers).thread_id is not None:
+        # Never let a current thread attach to the legacy
+        # (session-id, prompt_cache_key) lane: both values are shared across
+        # siblings. Exact turn-state/previous-response aliases are handled by
+        # durable lookup independently and remain the only safe migration path.
+        return None
+    session_key = _sticky_key_from_session_header(headers)
+    if session_key is None:
+        return None
+    affinity_key = (
+        sha256(f"{session_key}\0{explicit_prompt_cache_key.strip()}".encode()).hexdigest()
+        if isinstance(explicit_prompt_cache_key, str) and explicit_prompt_cache_key.strip()
+        else session_key
+    )
+    return _HTTPBridgeSessionKey(
+        "session_header",
+        affinity_key,
+        api_key.id if api_key is not None else None,
+    )
+
+
+def _turn_keys(
+    headers: Mapping[str, str],
+    api_key: ApiKeyData | None,
+    requested_key: _HTTPBridgeSessionKey,
+    fallback_key: _HTTPBridgeSessionKey | None,
+) -> tuple[str | None, _HTTPBridgeSessionKey | None]:
+    thread_key = _codex_backend_identity(headers).thread_selection_key
+    thread_fallback_key = (
+        _HTTPBridgeSessionKey("thread_header", thread_key, api_key.id if api_key is not None else None)
+        if thread_key is not None
+        else None
+    )
+    incoming_session_key = None if thread_fallback_key is not None else _sticky_key_from_session_header(headers)
+    initial_session_key = (
+        fallback_key
+        or thread_fallback_key
+        or (requested_key if requested_key.affinity_kind == "session_header" else None)
+    )
+    return incoming_session_key, initial_session_key
+
+
+def _alias_fallback_key(
+    incoming_session_key: str | None,
+    initial_session_key: _HTTPBridgeSessionKey | None,
+    api_key_id: str | None,
+) -> _HTTPBridgeSessionKey | None:
+    if initial_session_key is not None:
+        return initial_session_key
+    if incoming_session_key is None:
+        return None
+    return _HTTPBridgeSessionKey("session_header", incoming_session_key, api_key_id)
+
+
+async def _http_bridge_should_wait_for_registration(
+    self,
+    key: _HTTPBridgeSessionKey,
+    settings: Settings,
+) -> bool:
+    import app.core.startup as startup_module
+
+    if startup_module._bridge_registration_complete:
+        return False
+    if key.strength != "hard":
+        return False
+    if _http_bridge_requires_cluster_registration(settings):
+        return True
+    if self._ring_membership is None:
+        return False
+    try:
+        active_members = await self._ring_membership.list_active()
+    except Exception:
+        logger.debug("Skipping bridge registration gate because active ring lookup failed", exc_info=True)
+        return False
+    current_instance = settings.http_responses_session_bridge_instance_id
+    return any(member != current_instance for member in active_members)
+
+
+def _durable_bridge_lookup_active_owner(lookup: DurableBridgeLookup | None) -> str | None:
+    if lookup is None:
+        return None
+    if lookup.state == "closed":
+        return None
+    if lookup.owner_instance_id is None or lookup.lease_expires_at is None:
+        return None
+    lease_expires_at = to_utc_naive(lookup.lease_expires_at)
+    if lease_expires_at <= utcnow():
+        return None
+    return lookup.owner_instance_id
+
+
+def _durable_bridge_lookup_allows_local_reuse(
+    lookup: DurableBridgeLookup | None,
+    *,
+    current_instance: str,
+) -> bool:
+    if lookup is None:
+        return True
+    owner_instance = _durable_bridge_lookup_active_owner(lookup)
+    if owner_instance is None:
+        return True
+    return owner_instance == current_instance
+
+
+def _http_bridge_allow_durable_takeover(lookup: DurableBridgeLookup | None) -> bool:
+    return _http_bridge_durable_lookup_allows_turn_state_takeover(lookup)
+
+
+def _http_bridge_claim_allows_takeover(
+    lookup: DurableBridgeLookup | None,
+    *,
+    force: bool,
+) -> bool:
+    if _http_bridge_allow_durable_takeover(lookup):
+        return True
+    if not force:
+        return False
+    return lookup is None or lookup.state != "draining"
+
+
+def _http_bridge_has_durable_recovery_anchor(
+    *,
+    previous_response_id: str | None,
+    durable_lookup: DurableBridgeLookup | None,
+) -> bool:
+    if previous_response_id is not None:
+        return True
+    if durable_lookup is None or durable_lookup.latest_response_id is None:
+        return False
+    return durable_lookup.canonical_kind in _HARD_HTTP_BRIDGE_AFFINITY_KINDS
+
+
+def _http_bridge_can_local_recover_without_ring(
+    *,
+    key: _HTTPBridgeSessionKey,
+    headers: Mapping[str, str],
+    previous_response_id: str | None,
+    durable_lookup: DurableBridgeLookup | None,
+) -> bool:
+    if _http_bridge_has_durable_recovery_anchor(
+        previous_response_id=previous_response_id,
+        durable_lookup=durable_lookup,
+    ):
+        return True
+    return (
+        key.affinity_kind in {"session_header", "thread_header"}
+        and previous_response_id is None
+        and _sticky_key_from_turn_state_header(headers) is None
+    )
+
+
+def _http_bridge_can_single_instance_owner_takeover_without_anchor(
+    *,
+    key: _HTTPBridgeSessionKey,
+    owner_instance: str | None,
+    current_instance: str,
+    ring: tuple[str, ...],
+) -> bool:
+    if key.strength != "hard":
+        return False
+    if owner_instance is None or owner_instance == current_instance:
+        return False
+    if len(ring) != 1:
+        return False
+    if ring[0] != current_instance:
+        return False
+    return owner_instance not in ring
+
+
+def _http_bridge_can_single_instance_prompt_cache_takeover_without_anchor(
+    *,
+    key: _HTTPBridgeSessionKey,
+    owner_instance: str | None,
+    current_instance: str,
+    ring: tuple[str, ...],
+) -> bool:
+    if key.affinity_kind != "prompt_cache":
+        return False
+    if owner_instance is None or owner_instance == current_instance:
+        return False
+    if len(ring) != 1:
+        return False
+    if ring[0] != current_instance:
+        return False
+    return owner_instance not in ring
+
+
+def _http_bridge_endpoint_matches_current_instance(owner_endpoint: str, settings: Settings) -> bool:
+    current_endpoint = settings.http_responses_session_bridge_advertise_base_url
+    if current_endpoint is None:
+        return False
+    return owner_endpoint.strip().rstrip("/") == current_endpoint.strip().rstrip("/")
+
+
+def _http_bridge_can_recover_during_drain(
+    *,
+    key: _HTTPBridgeSessionKey,
+    headers: Mapping[str, str],
+    previous_response_id: str | None,
+    durable_lookup: DurableBridgeLookup | None,
+) -> bool:
+    return _http_bridge_has_durable_recovery_anchor(
+        previous_response_id=previous_response_id,
+        durable_lookup=durable_lookup,
+    )
+
+
+def _http_bridge_request_stage(
+    *,
+    headers: Mapping[str, str],
+    payload: ResponsesRequest,
+    durable_lookup: DurableBridgeLookup | None,
+) -> str:
+    del durable_lookup
+    if (
+        payload.previous_response_id is not None
+        or _sticky_key_from_turn_state_header(headers) is not None
+        or _sticky_key_from_session_header(headers) is not None
+    ):
+        return "follow_up"
+    return "first_turn"
+
+
+def _record_bridge_reattach(*, path: str, outcome: str) -> None:
+    if PROMETHEUS_AVAILABLE and bridge_reattach_total is not None:
+        bridge_reattach_total.labels(path=path, outcome=outcome).inc()
+
+
+def _record_bridge_first_turn_timeout() -> None:
+    if PROMETHEUS_AVAILABLE and bridge_first_turn_timeout_total is not None:
+        bridge_first_turn_timeout_total.inc()
+
+
+def _record_bridge_drain_recovery_allowed() -> None:
+    if PROMETHEUS_AVAILABLE and bridge_drain_recovery_allowed_total is not None:
+        bridge_drain_recovery_allowed_total.inc()
+
+
+def _is_missing_durable_bridge_table_error(exc: Exception) -> bool:
+    message = str(exc).lower()
+    if "http_bridge_sessions" not in message and "http_bridge_session_aliases" not in message:
+        return False
+    return "no such table" in message or "does not exist" in message or "undefinedtable" in message
+
+
+def _http_bridge_durable_lease_ttl_seconds() -> float:
+    return float(RING_STALE_THRESHOLD_SECONDS)
+
+
+def _http_bridge_durable_release_allowed(service: Any, session: Any) -> bool:
+    session_id = getattr(session, "durable_session_id", None)
+    owner_epoch = getattr(session, "durable_owner_epoch", None)
+    if session_id is None or owner_epoch is None:
+        return False
+    return not any(
+        not task.done() and getattr(task, "_http_bridge_recovery_session_id", None) == session_id
+        for task in service._background_cleanup_tasks
+    )
+
+
+async def _drain_cancelled_task(task: asyncio.Task[Any]) -> None:
+    await asyncio.gather(task, return_exceptions=True)
+
+
+def _cancel_and_track_cancelled_task(
+    task: asyncio.Task[Any],
+    *,
+    label: str,
+    cleanup_tasks: set[asyncio.Task[None]] | None,
+    cancel_task: bool = True,
+    scheduler: Scheduler = REAL_SCHEDULER,
+) -> None:
+    if cancel_task:
+        task.cancel()
+    cleanup_task = scheduler.create_task(_drain_cancelled_task(task), name=f"cancelled-task-cleanup-{label}")
+    if cleanup_tasks is not None:
+        cleanup_tasks.add(cleanup_task)
+        cleanup_task.add_done_callback(cleanup_tasks.discard)
+
+
+async def _await_cancelled_task(
+    task: asyncio.Task[_TaskResultT],
+    *,
+    timeout_seconds: float = _TASK_CANCEL_TIMEOUT_SECONDS,
+    label: str,
+    cancel: bool = True,
+    cleanup_tasks: set[asyncio.Task[None]] | None = None,
+    scheduler: Scheduler = REAL_SCHEDULER,
+) -> bool:
+    effective_timeout = max(float(timeout_seconds), 0.0)
+    remaining_drain_timeout = shutdown_state.remaining_drain_timeout_seconds()
+    if remaining_drain_timeout is not None:
+        effective_timeout = min(effective_timeout, remaining_drain_timeout)
+
+    # Give a new child one scheduling turn before cancellation so
+    # cancellation-resistant tasks enter the deferred-drain path.
+    if cancel and not task.done():
+        try:
+            await asyncio.sleep(0)
+        except asyncio.CancelledError:
+            _cancel_and_track_cancelled_task(task, label=label, cleanup_tasks=cleanup_tasks, scheduler=scheduler)
+            raise
+    if cancel:
+        task.cancel()
+    try:
+        done, _ = await scheduler.wait({task}, timeout=effective_timeout)
+    except asyncio.CancelledError:
+        if not task.done():
+            _cancel_and_track_cancelled_task(
+                task,
+                label=label,
+                cleanup_tasks=cleanup_tasks,
+                cancel_task=False,
+                scheduler=scheduler,
+            )
+        raise
+    if task not in done:
+        logger.warning("Timed out waiting for %s cancellation", label)
+        _cancel_and_track_cancelled_task(
+            task,
+            label=label,
+            cleanup_tasks=cleanup_tasks,
+            cancel_task=False,
+            scheduler=scheduler,
+        )
+        return False
+    try:
+        task.result()
+    except asyncio.CancelledError:
+        return True
+    return True
+
+
+async def _persist_http_bridge_replacement_account(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    account_id: str,
+) -> None:
+    if account_id == session.account.id or session.durable_session_id is None or session.durable_owner_epoch is None:
+        return
+    try:
+        rebound = await service._durable_bridge.rebind_session_account(
+            session_id=session.durable_session_id,
+            api_key_id=session.key.api_key_id,
+            instance_id=_service_get_settings().http_responses_session_bridge_instance_id,
+            owner_epoch=session.durable_owner_epoch,
+            account_id=account_id,
+            clear_continuity=True,
+        )
+    except Exception as exc:
+        raise ProxyResponseError(
+            502,
+            openai_error(
+                "bridge_continuity_persistence_failed",
+                "HTTP responses session account could not be persisted; retry the request.",
+            ),
+        ) from exc
+    if not rebound:
+        raise ProxyResponseError(
+            502,
+            openai_error(
+                "bridge_continuity_persistence_failed",
+                "HTTP responses session ownership changed during account recovery; retry the request.",
+            ),
+        )
+
+
+async def _release_http_bridge_unanchored_handoffs_for_request(
+    service: _HTTPBridgeServiceProtocol,
+    *,
+    request_scope_id: str,
+) -> None:
+    """Fail-safe cleanup for reservations published before request submission."""
+
+    async with service._http_bridge_lock:
+        for session in (*service._http_bridge_sessions.values(), *service._http_bridge_detached_sessions.values()):
+            _release_http_bridge_unanchored_handoff(session, request_scope_id=request_scope_id)
+        # Nested stream finalizers can clear their marker before this fail-safe
+        # sweep runs. Reconsider every detached generation so marker ordering
+        # cannot leave a fully drained predecessor owning a socket and cap slot.
+        detached_sessions = tuple(service._http_bridge_detached_sessions.values())
+    deadline = clock_for(service).monotonic() + _HTTP_BRIDGE_DETACHED_RETIRE_LOCK_WAIT_SECONDS
+    for index, session in enumerate(detached_sessions):
+        remaining = deadline - clock_for(service).monotonic()
+        if remaining <= 0:
+            logger.warning(
+                "Detached HTTP bridge retire sweep deadline exhausted: skipped_sessions=%d",
+                len(detached_sessions) - index,
+            )
+            break
+        await service._retire_http_bridge_after_drain_if_ready(
+            session,
+            lock_wait_timeout_seconds=remaining,
+        )
+
+
+def _track_alias_registration(session: _HTTPBridgeSession, alias: str, *, turn_state: bool) -> int:
+    session.alias_registration_generation += 1
+    generation = session.alias_registration_generation
+    registrations = (
+        session.turn_state_alias_registration_generations
+        if turn_state
+        else session.previous_response_alias_registration_generations
+    )
+    registrations[alias] = generation
+    return generation
+
+
+async def _persist_http_bridge_turn_state_alias(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    *,
+    turn_state: str,
+    registration_generation: int,
+    instance_id: str,
+    lease_ttl_seconds: float,
+    local_alias_was_published: bool = True,
+    reversible: bool = False,
+) -> tuple[DurableBridgeAliasRegistration | None, DurableBridgeAliasRegistrationReceipt | None]:
+    owner_epoch = session.durable_owner_epoch
+    try:
+        receipt = None
+        if reversible:
+            receipt = await service._durable_bridge.register_recovery_turn_state(
+                session_id=session.durable_session_id,
+                api_key_id=session.key.api_key_id,
+                instance_id=instance_id,
+                owner_epoch=owner_epoch,
+                turn_state=turn_state,
+                lease_ttl_seconds=lease_ttl_seconds,
+            )
+            registered = receipt.status
+        else:
+            registered = await service._durable_bridge.register_turn_state(
+                session_id=session.durable_session_id,
+                api_key_id=session.key.api_key_id,
+                instance_id=instance_id,
+                owner_epoch=owner_epoch,
+                turn_state=turn_state,
+                lease_ttl_seconds=lease_ttl_seconds,
+            )
+    except Exception:
+        logger.warning("Failed to persist durable HTTP bridge turn-state alias", exc_info=True)
+        if not local_alias_was_published:
+            async with service._http_bridge_lock:
+                if session.turn_state_alias_registration_generations.get(turn_state) == registration_generation:
+                    session.turn_state_alias_registration_generations.pop(turn_state, None)
+        return None, None
+    if registered == DurableBridgeAliasRegistration.REGISTERED:
+        return registered, receipt
+
+    fenced_out_session: _HTTPBridgeSession | None = None
+    async with service._http_bridge_lock:
+        if session.turn_state_alias_registration_generations.get(turn_state) != registration_generation:
+            return None, receipt
+        session.turn_state_alias_registration_generations.pop(turn_state, None)
+        if local_alias_was_published:
+            session.downstream_turn_state_aliases.discard(turn_state)
+            if session.downstream_turn_state == turn_state:
+                session.downstream_turn_state = None
+            alias_key = _http_bridge_turn_state_alias_key(turn_state, session.key.api_key_id)
+            current_session = service._http_bridge_sessions.get(session.key)
+            current_generation_owns_alias = (
+                current_session is not None
+                and current_session is not session
+                and turn_state in current_session.downstream_turn_state_aliases
+            )
+            if (
+                not current_generation_owns_alias
+                and service._http_bridge_turn_state_index.get(alias_key) == session.key
+            ):
+                service._http_bridge_turn_state_index.pop(alias_key, None)
+        if registered == DurableBridgeAliasRegistration.OWNER_FENCED:
+            fenced_out_session = _evict_fenced_out_http_bridge_session_locked(
+                service,
+                session,
+                owner_epoch_at_write=owner_epoch,
+            )
+    _schedule_fenced_out_http_bridge_session_close(service, fenced_out_session, detail="turn_state_alias_fenced_out")
+    return registered, receipt
+
+
+async def _persist_http_bridge_previous_response_alias(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    *,
+    response_id: str,
+    registration_generation: int,
+    input_item_count: int | None,
+    input_full_fingerprint: str | None,
+    pending_tool_calls: Mapping[str, str] | None,
+    instance_id: str,
+    lease_ttl_seconds: float,
+    local_alias_was_published: bool = True,
+) -> DurableBridgeAliasRegistration | None:
+    owner_epoch = session.durable_owner_epoch
+    try:
+        registered = await service._durable_bridge.register_previous_response_id(
+            session_id=session.durable_session_id,
+            api_key_id=session.key.api_key_id,
+            instance_id=instance_id,
+            owner_epoch=owner_epoch,
+            response_id=response_id,
+            lease_ttl_seconds=lease_ttl_seconds,
+            input_item_count=input_item_count,
+            input_full_fingerprint=input_full_fingerprint,
+            pending_tool_calls=pending_tool_calls,
+        )
+    except Exception:
+        logger.warning("Failed to persist durable HTTP bridge previous_response_id alias", exc_info=True)
+        if not local_alias_was_published:
+            async with service._http_bridge_lock:
+                if session.previous_response_alias_registration_generations.get(response_id) == registration_generation:
+                    session.previous_response_alias_registration_generations.pop(response_id, None)
+        return None
+    if registered == DurableBridgeAliasRegistration.REGISTERED:
+        return registered
+
+    fenced_out_session: _HTTPBridgeSession | None = None
+    async with service._http_bridge_lock:
+        if session.previous_response_alias_registration_generations.get(response_id) != registration_generation:
+            return
+        session.previous_response_alias_registration_generations.pop(response_id, None)
+        if local_alias_was_published:
+            session.previous_response_ids.discard(response_id)
+            alias_key = _http_bridge_previous_response_alias_key(response_id, session.key.api_key_id)
+            current_session = service._http_bridge_sessions.get(session.key)
+            current_generation_owns_alias = (
+                current_session is not None
+                and current_session is not session
+                and response_id in current_session.previous_response_ids
+            )
+            if (
+                not current_generation_owns_alias
+                and service._http_bridge_previous_response_index.get(alias_key) == session.key
+            ):
+                service._http_bridge_previous_response_index.pop(alias_key, None)
+        if registered == DurableBridgeAliasRegistration.OWNER_FENCED:
+            fenced_out_session = _evict_fenced_out_http_bridge_session_locked(
+                service,
+                session,
+                owner_epoch_at_write=owner_epoch,
+            )
+    _schedule_fenced_out_http_bridge_session_close(
+        service, fenced_out_session, detail="previous_response_alias_fenced_out"
+    )
+    return registered
+
+
+def _evict_fenced_out_http_bridge_session_locked(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    *,
+    owner_epoch_at_write: int | None,
+) -> _HTTPBridgeSession | None:
+    """Detach a session whose fenced durable write proved lost ownership.
+
+    Callers must hold ``service._http_bridge_lock``. When the session's local
+    epoch advanced concurrently (same-session re-claim), the fenced rejection
+    is stale rather than a lost-ownership signal and no eviction happens.
+    """
+
+    if session.closed:
+        return None
+    if owner_epoch_at_write is None or session.durable_owner_epoch != owner_epoch_at_write:
+        return None
+    detached = service._detach_http_bridge_session_locked(session.key, expected_session=session)
+    if detached is None:
+        session.closed = True
+    return detached or session
+
+
+def _schedule_fenced_out_http_bridge_session_close(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession | None,
+    *,
+    detail: str,
+) -> None:
+    if session is None:
+        return
+    _log_http_bridge_event(
+        "fenced_out_evict",
+        session.key,
+        account_id=session.account.id,
+        model=session.request_model,
+        detail=f"outcome={detail}",
+        cache_key_family=session.key.affinity_kind,
+        model_class=_extract_model_class(session.request_model) if session.request_model else None,
+        owner_check_applied=True,
+    )
+    service._schedule_http_bridge_session_closes([session], reason="durable_fenced_out")
+
+
+def _fail_closed_http_bridge_recovery_lease(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+    *,
+    detail: str,
+) -> ProxyResponseError:
+    detached = service._detach_http_bridge_session_locked(session.key, expected_session=session)
+    session.closed = True
+    service._schedule_http_bridge_session_closes([detached or session], reason="durable_recovery_unavailable")
+    _log_http_bridge_event(
+        "recovery_lease_unavailable",
+        session.key,
+        account_id=session.account.id,
+        model=session.request_model,
+        detail=detail,
+        cache_key_family=session.key.affinity_kind,
+        model_class=_extract_model_class(session.request_model) if session.request_model else None,
+        owner_check_applied=True,
+    )
+    return ProxyResponseError(
+        502,
+        _http_bridge_owner_lookup_unavailable_error_envelope(),
+    )
+
+
+async def _renew_durable_http_bridge_lease(
+    service: _HTTPBridgeServiceProtocol,
+    session: _HTTPBridgeSession,
+) -> None:
+    """Renew the durable lease; callers must hold ``service._http_bridge_lock``.
+
+    Raises the retryable instance-mismatch error after evicting the local
+    session when the renewal reveals the durable row is owned by another
+    instance/epoch (fenced out).
+    """
+
+    account_neutral_recovery = is_http_bridge_account_neutral_replay(
+        kind=session.key.affinity_kind,
+        key=session.key.affinity_key,
+    )
+    if session.durable_session_id is None or session.durable_owner_epoch is None:
+        if account_neutral_recovery:
+            raise _fail_closed_http_bridge_recovery_lease(
+                service,
+                session,
+                detail="outcome=missing_durable_identity",
+            )
+        return
+    current_instance = _service_get_settings().http_responses_session_bridge_instance_id
+    try:
+        lookup = await service._durable_bridge.renew_live_session(
+            session_id=session.durable_session_id,
+            api_key_id=session.key.api_key_id,
+            instance_id=current_instance,
+            owner_epoch=session.durable_owner_epoch,
+            lease_ttl_seconds=_http_bridge_durable_lease_ttl_seconds(),
+            latest_turn_state=session.downstream_turn_state,
+            latest_response_id=None,
+        )
+    except Exception as exc:
+        if account_neutral_recovery:
+            raise _fail_closed_http_bridge_recovery_lease(
+                service,
+                session,
+                detail="outcome=renew_error",
+            ) from exc
+        logger.warning("Failed to renew durable HTTP bridge session lease", exc_info=True)
+        return
+    if lookup is None:
+        if account_neutral_recovery:
+            raise _fail_closed_http_bridge_recovery_lease(
+                service,
+                session,
+                detail="outcome=durable_row_missing",
+            )
+        return
+    if lookup.owner_instance_id == current_instance and lookup.owner_epoch == session.durable_owner_epoch:
+        return
+    if (
+        lookup.owner_instance_id == current_instance
+        and lookup.owner_process_epoch == http_bridge_owner_process_epoch()
+        and lookup.owner_epoch > session.durable_owner_epoch
+        # A claim rewrites the row's account_id, so an advance that moved the
+        # row to another account is a real ownership change for this session,
+        # not a superseded creator: never adopt across it.
+        and lookup.account_id == session.account.id
+        and service._http_bridge_sessions.get(session.key) is session
+    ):
+        # THIS process advanced the epoch while this session still holds the
+        # registry slot for its key — a creator that was superseded mid claim,
+        # not a real ownership loss (issue #1695). Evicting here would 409 the
+        # session that legitimately owns the key, so adopt the epoch and keep
+        # renewing. The process-epoch check matters because two incarnations
+        # can share a configured instance ID across a graceful restart: the
+        # successor's claim must still fence the predecessor out. A DIFFERENT
+        # local session holding the slot also falls through: that one won, and
+        # this session must be evicted.
+        session.durable_owner_epoch = lookup.owner_epoch
+        return
+    # Fenced out: another instance/epoch owns the durable session. Never adopt
+    # the foreign epoch — evict the local session so its upstream websocket and
+    # account lease are released, and fail the request with the retryable
+    # instance-mismatch contract used by rejected claims.
+    detached = service._detach_http_bridge_session_locked(session.key, expected_session=session)
+    session.closed = True
+    service._schedule_http_bridge_session_closes([detached or session], reason="durable_fenced_out")
+    _log_http_bridge_event(
+        "fenced_out_evict",
+        session.key,
+        account_id=session.account.id,
+        model=session.request_model,
+        detail=(
+            f"owner_instance={lookup.owner_instance_id}, owner_epoch={lookup.owner_epoch}, "
+            f"current_instance={current_instance}, local_epoch={session.durable_owner_epoch}, "
+            "outcome=renew_fenced_out"
+        ),
+        cache_key_family=session.key.affinity_kind,
+        model_class=_extract_model_class(session.request_model) if session.request_model else None,
+        owner_check_applied=True,
+    )
+    if PROMETHEUS_AVAILABLE and bridge_instance_mismatch_total is not None:
+        bridge_instance_mismatch_total.labels(outcome="renew_fenced_out").inc()
+    raise ProxyResponseError(
+        409,
+        openai_error(
+            "bridge_instance_mismatch",
+            "HTTP bridge session is owned by a different instance; retry to reach the correct replica",
+            error_type="server_error",
+        ),
+    )
+
+
+async def _reconcile_durable_http_bridge_ownership(service: _HTTPBridgeServiceProtocol) -> int:
+    """Close local sessions whose durable row is owned by another instance/epoch.
+
+    Piggybacked on the ring-heartbeat cadence so a replica that lost
+    ownership releases its orphaned upstream websocket and account lease
+    within roughly the durable lease TTL instead of the idle TTL.
+    """
+
+    current_instance = _service_get_settings().http_responses_session_bridge_instance_id
+    lease_ttl_seconds = _http_bridge_durable_lease_ttl_seconds()
+    now = clock_for(service).monotonic()
+    async with service._http_bridge_lock:
+        candidates = [
+            (key, session)
+            for key, session in service._http_bridge_sessions.items()
+            if not session.closed
+            and session.durable_session_id is not None
+            and session.durable_owner_epoch is not None
+            and now - session.last_used_at >= lease_ttl_seconds
+        ]
+    if not candidates:
+        return 0
+    lookups = await service._durable_bridge.lookup_sessions(
+        session_ids=[session.durable_session_id for _, session in candidates if session.durable_session_id]
+    )
+    lookup_by_id = {lookup.session_id: lookup for lookup in lookups}
+    fenced_sessions: list[_HTTPBridgeSession] = []
+    async with service._http_bridge_lock:
+        for key, session in candidates:
+            lookup = lookup_by_id.get(session.durable_session_id or "")
+            if lookup is None or lookup.owner_instance_id is None:
+                continue
+            if lookup.owner_instance_id == current_instance and lookup.owner_epoch == session.durable_owner_epoch:
+                continue
+            detached = service._detach_http_bridge_session_locked(key, expected_session=session)
+            if detached is None:
+                continue
+            fenced_sessions.append(detached)
+            _log_http_bridge_event(
+                "fenced_out_evict",
+                key,
+                account_id=session.account.id,
+                model=session.request_model,
+                detail=(
+                    f"owner_instance={lookup.owner_instance_id}, owner_epoch={lookup.owner_epoch}, "
+                    f"current_instance={current_instance}, local_epoch={session.durable_owner_epoch}, "
+                    "outcome=reconcile_sweep"
+                ),
+                cache_key_family=key.affinity_kind,
+                model_class=_extract_model_class(session.request_model) if session.request_model else None,
+                owner_check_applied=True,
+            )
+    if fenced_sessions:
+        service._schedule_http_bridge_session_closes(fenced_sessions, reason="durable_fenced_out")
+    return len(fenced_sessions)
+
+
+def _http_bridge_turn_state_anchor_for_owner_failure(
+    exc: ProxyResponseError,
+    *,
+    headers: Mapping[str, str],
+    previous_response_id: str | None,
+) -> str | None:
+    """Return the turn-state anchor when an owner forward failed unreachable."""
+
+    if previous_response_id is not None:
+        return None
+    turn_state = _sticky_key_from_turn_state_header(headers)
+    if turn_state is None:
+        return None
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return None
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return None
+    if error.get("code") != "bridge_owner_unreachable":
+        return None
+    return turn_state
+
+
+def _http_bridge_durable_lookup_allows_turn_state_takeover(lookup: DurableBridgeLookup | None) -> bool:
+    """Allow local takeover only when the durable lease is not actively held.
+
+    Released (owner ``None``), expired-lease, CLOSED, and missing rows allow
+    takeover. A live lease keeps failing closed even for DRAINING rows:
+    shutdown marks rows DRAINING before releasing them, so a draining owner
+    may still be finishing an in-flight turn until its lease is released or
+    lapses.
+    """
+
+    return _durable_bridge_lookup_active_owner(lookup) is None
+
+
+def _forwarded_http_bridge_session_key(
+    headers: Mapping[str, str],
+    api_key: ApiKeyData | None,
+    *,
+    forwarded_affinity_kind: str | None = None,
+    forwarded_affinity_key: str | None = None,
+) -> _HTTPBridgeSessionKey | None:
+    affinity_kind = forwarded_affinity_kind or _header_value_case_insensitive(headers, "x-codex-bridge-affinity-kind")
+    affinity_key = forwarded_affinity_key or _header_value_case_insensitive(headers, "x-codex-bridge-affinity-key")
+    if affinity_kind is None or affinity_key is None:
+        return None
+    strength: Literal["hard", "soft"]
+    if affinity_kind in _HARD_HTTP_BRIDGE_AFFINITY_KINDS:
+        strength = "hard"
+    else:
+        strength = "soft"
+    return _HTTPBridgeSessionKey(
+        affinity_kind=affinity_kind,
+        affinity_key=affinity_key,
+        api_key_id=api_key.id if api_key is not None else None,
+        strength=strength,
+    )
+
+
+def _http_bridge_requires_cluster_registration(settings: Settings) -> bool:
+    if len(settings.http_responses_session_bridge_instance_ring) > 1:
+        return True
+    advertise_base_url = settings.http_responses_session_bridge_advertise_base_url
+    if advertise_base_url is None:
+        return False
+    hostname = urlparse(advertise_base_url).hostname
+    if hostname is None:
+        return False
+    try:
+        parsed_ip = ip_address(hostname)
+    except ValueError:
+        return True
+    return not parsed_ip.is_loopback
+
+
+def _effective_http_bridge_idle_ttl_seconds(
+    *,
+    affinity: _AffinityPolicy,
+    idle_ttl_seconds: float,
+    codex_idle_ttl_seconds: float,
+    prompt_cache_idle_ttl_seconds: float | None = None,
+) -> float:
+    if affinity.kind == StickySessionKind.CODEX_SESSION or affinity.codex_session_source == "thread_header":
+        # The DB row is bounded soft locality, but a live thread bridge owns
+        # upstream socket history and therefore receives the Codex continuity
+        # lifetime once created.
+        return max(idle_ttl_seconds, codex_idle_ttl_seconds)
+    if affinity.kind == StickySessionKind.PROMPT_CACHE and prompt_cache_idle_ttl_seconds is not None:
+        return prompt_cache_idle_ttl_seconds
+    return idle_ttl_seconds
+
+
+def _http_bridge_eviction_priority(session: _HTTPBridgeSession) -> tuple[int, float]:
+    return (0 if not session.codex_session else 1, session.last_used_at)
+
+
+def _build_http_bridge_prewarm_text(text_data: str) -> str | None:
+    try:
+        payload = json.loads(text_data)
+    except json.JSONDecodeError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    if payload.get("generate") is False:
+        return None
+    previous_response_id = payload.get("previous_response_id")
+    if isinstance(previous_response_id, str) and previous_response_id.strip():
+        return None
+    warmup_payload = dict(payload)
+    warmup_payload["generate"] = False
+    return json.dumps(warmup_payload, ensure_ascii=True, separators=(",", ":"))
+
+
+def _http_bridge_prewarm_enabled(settings: Any) -> bool:
+    """Prewarm eligibility is the ``prewarm_enabled`` switch alone.
+
+    M3 codex prewarm: the switch is dashboard-managed, and it is folded into
+    ``settings`` before this is called. ``settings`` is the proxy service facade
+    value (``_service_get_settings()``), which applies the request-bound
+    dashboard overlay: the field is in ``DASHBOARD_OVERRIDE_SETTINGS``, so a
+    non-NULL ``dashboard_settings`` column has already won over the deprecated
+    ``CODEX_LB_*`` env alias by the time this reads it. Outside a bound request
+    context (startup, schedulers, unit tests) the env alias applies, and then
+    the code default (off) -- the same precedence ``resolve_inheritable``
+    applies for the settings API's provenance.
+
+    The canary percent and allow/deny cohort scaffolding was one-time
+    rollout tooling retired by ``reduce-settings-surface-phase-4``.
+    """
+    return bool(getattr(settings, "http_responses_session_bridge_codex_prewarm_enabled", False))
+
+
+def _record_http_bridge_prewarm_outcome(*, outcome: str) -> None:
+    if not PROMETHEUS_AVAILABLE or http_bridge_prewarm_total is None:
+        return
+    http_bridge_prewarm_total.labels(outcome=outcome).inc()
+
+
+def _record_http_bridge_stuck_retire(
+    *,
+    reason: str,
+    session: _HTTPBridgeSession,
+) -> None:
+    if not PROMETHEUS_AVAILABLE or http_bridge_stuck_retire_total is None:
+        return
+    http_bridge_stuck_retire_total.labels(
+        reason=reason,
+        affinity_kind=session.key.affinity_kind,
+        model_class=_extract_model_class(session.request_model) if session.request_model else "unknown",
+    ).inc()
+
+
+def _http_bridge_payload_without_previous_response_id(payload: ResponsesRequest) -> ResponsesRequest:
+    if payload.previous_response_id is None:
+        return payload
+    return payload.model_copy(update={"previous_response_id": None})
+
+
+def _http_bridge_previous_response_error_envelope(
+    previous_response_id: str,
+    detail: str,
+) -> OpenAIErrorEnvelope:
+    payload = openai_error(
+        "previous_response_not_found",
+        f"Previous response with id '{previous_response_id}' not found. {detail}",
+        error_type="invalid_request_error",
+    )
+    payload["error"]["param"] = "previous_response_id"
+    return payload
+
+
+def _http_bridge_continuity_lost_error_envelope() -> OpenAIErrorEnvelope:
+    return previous_response_stream_incomplete_error()
+
+
+def _http_bridge_owner_lookup_unavailable_error_envelope() -> OpenAIErrorEnvelope:
+    return openai_error(
+        "upstream_unavailable",
+        "HTTP bridge owner metadata unavailable; retry later.",
+        error_type="server_error",
+    )
+
+
+def _mark_http_bridge_reader_handoff_reconnect_failed(session: Any, old_reader: Any) -> None:
+    if old_reader is not None:
+        session.closed = True
+
+
+def _http_bridge_previous_response_owner_unavailable_error() -> ProxyResponseError:
+    return ProxyResponseError(
+        502,
+        openai_error(
+            "previous_response_owner_unavailable",
+            "Previous response owner account is unavailable; retry later.",
+            error_type="server_error",
+        ),
+    )
+
+
+def _http_bridge_reconnect_selection_failure(
+    selection: Any,
+    required_preferred_account_id: str | None,
+) -> ProxyResponseError:
+    if required_preferred_account_id is not None:
+        return _http_bridge_previous_response_owner_unavailable_error()
+    status_code, error_payload = selection_failure_response(selection)
+    return ProxyResponseError(status_code, error_payload)
+
+
+def _http_bridge_reconnect_connect_failure(
+    exc: BaseException,
+    required_preferred_account_id: str | None,
+) -> ProxyResponseError:
+    if required_preferred_account_id is not None:
+        return _http_bridge_previous_response_owner_unavailable_error()
+    if isinstance(exc, ProxyResponseError):
+        return exc
+    raise exc
+
+
+def _http_bridge_should_attempt_local_previous_response_recovery(exc: ProxyResponseError) -> bool:
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    code_value = error.get("code")
+    raw_code = code_value.strip() if isinstance(code_value, str) and code_value.strip() else None
+    type_value = error.get("type")
+    error_type = type_value.strip() if isinstance(type_value, str) and type_value.strip() else None
+    param_state = OpenAIErrorParam.from_mapping(cast(Mapping[str, JsonValue], error))
+    if param_state.malformed:
+        return False
+    # Normalize like the websocket rewrite path (#1818): upstream frames may
+    # carry the classifiable code only in ``type`` (or omit both code and
+    # param on the terse previous-response rejection), and a raw read would
+    # misclassify them into the ambiguous transport class below (issue #1830).
+    code = _normalize_error_code(raw_code, error_type)
+    if code in {
+        "bridge_owner_unreachable",
+        "bridge_previous_response_not_found",
+        "previous_response_not_found",
+        "bridge_instance_mismatch",
+    }:
+        return True
+    if code in {"stream_incomplete", "stream_idle_timeout", "upstream_request_timeout"}:
+        # An ambiguous transport failure is never locally recoverable: upstream
+        # may already have accepted the anchored request, and there is no
+        # idempotency or status endpoint to prove otherwise. Fail closed.
+        return False
+    message_value = error.get("message")
+    message = message_value.strip() if isinstance(message_value, str) and message_value.strip() else None
+    return _is_previous_response_not_found_error(code=code, param=param_state, message=message)
+
+
+def _http_bridge_is_explicit_previous_response_rejection(exc: ProxyResponseError) -> bool:
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    code_value = error.get("code")
+    raw_code = code_value.strip() if isinstance(code_value, str) and code_value.strip() else None
+    type_value = error.get("type")
+    error_type = type_value.strip() if isinstance(type_value, str) and type_value.strip() else None
+    param_state = OpenAIErrorParam.from_mapping(cast(Mapping[str, JsonValue], error))
+    if param_state.malformed:
+        return False
+    code = _normalize_error_code(raw_code, error_type)
+    if code == "bridge_previous_response_not_found":
+        return True
+    message_value = error.get("message")
+    message = message_value.strip() if isinstance(message_value, str) and message_value.strip() else None
+    return _is_previous_response_not_found_error(code=code, param=param_state, message=message)
+
+
+def _http_bridge_is_previous_response_owner_unavailable(exc: ProxyResponseError) -> bool:
+    if exc.status_code != 502:
+        return False
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    return error.get("code") == "previous_response_owner_unavailable"
+
+
+def _http_bridge_should_attempt_soft_affinity_reroute(
+    exc: ProxyResponseError,
+    *,
+    key: "_HTTPBridgeSessionKey",
+    previous_response_id: str | None,
+) -> bool:
+    if exc.status_code != 429:
+        return False
+    if key.strength == "hard" or previous_response_id is not None:
+        return False
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    # api_key_stream_fair_share is deliberately absent: the fair-share gate
+    # is per-key and pool-wide, so rerouting to another account cannot help.
+    return error.get("code") in {
+        "bridge_queue_full",
+        "response_create_gate_timeout",
+        "account_response_create_cap",
+        "account_stream_cap",
+    }
+
+
+def _persistent_http_bridge_affinity(affinity: _AffinityPolicy) -> _AffinityPolicy:
+    if not affinity.abandon_unavailable_legacy_owner:
+        return affinity
+    # Restart authority is proof attached to one canonical request body, not a
+    # property of the longer-lived process session. Never let a reused bridge
+    # grant a later ordinary request permission to retire hard ownership.
+    return replace(affinity, abandon_unavailable_legacy_owner=False)
+
+
+def _http_bridge_is_context_overflow_error(exc: ProxyResponseError) -> bool:
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    code_value = error.get("code")
+    code = code_value.strip() if isinstance(code_value, str) and code_value.strip() else None
+    type_value = error.get("type")
+    error_type = type_value.strip() if isinstance(type_value, str) and type_value.strip() else None
+    normalized_code = _normalize_error_code(code, error_type)
+    return normalized_code == "context_length_exceeded"
+
+
+def _http_bridge_should_rollover_after_context_overflow(
+    exc: ProxyResponseError,
+    *,
+    key: _HTTPBridgeSessionKey | None = None,
+) -> bool:
+    if not _http_bridge_is_context_overflow_error(exc):
+        return False
+    if key is not None and key.strength == "hard":
+        return False
+    return True
+
+
+def _http_bridge_should_attempt_local_bootstrap_rebind(
+    exc: ProxyResponseError,
+    *,
+    key: _HTTPBridgeSessionKey,
+    headers: Mapping[str, str],
+    previous_response_id: str | None,
+) -> bool:
+    if key.affinity_kind not in {"session_header", "thread_header"}:
+        return False
+    if previous_response_id is not None:
+        return False
+    if _sticky_key_from_turn_state_header(headers) is not None:
+        return False
+    payload = exc.payload
+    if not isinstance(payload, dict):
+        return False
+    error = payload.get("error")
+    if not isinstance(error, dict):
+        return False
+    code = error.get("code")
+    return code in {
+        "bridge_owner_unreachable",
+        "bridge_instance_mismatch",
+    }
+
+
+def _normalized_http_bridge_instance_ring(settings: Settings) -> tuple[str, tuple[str, ...]]:
+    instance_id = settings.http_responses_session_bridge_instance_id.strip()
+    if not instance_id:
+        instance_id = "codex-lb"
+    ring_entries: list[str] = []
+    for entry in settings.http_responses_session_bridge_instance_ring:
+        stripped = entry.strip()
+        if stripped:
+            ring_entries.append(stripped)
+    if not ring_entries:
+        ring_entries.append(instance_id)
+    return instance_id, tuple(sorted(set(ring_entries)))
+
+
+async def _active_http_bridge_instance_ring(
+    settings: Settings,
+    ring_membership: RingMembershipService | None,
+) -> tuple[str, tuple[str, ...]]:
+    instance_id, static_ring = _normalized_http_bridge_instance_ring(settings)
+    if ring_membership is None:
+        return instance_id, static_ring
+    try:
+        active_members = await ring_membership.list_active(require_endpoint=True)
+    except Exception:
+        logger.warning("Bridge ring lookup failed — refusing to fall back to static ring", exc_info=True)
+        raise
+    if not active_members:
+        return instance_id, (instance_id,)
+    normalized_members = tuple(
+        sorted({member.strip() for member in active_members if isinstance(member, str) and member.strip()})
+    )
+    if not normalized_members:
+        return instance_id, static_ring
+    return instance_id, normalized_members
+
+
+async def _http_bridge_owner_instance(
+    key: _HTTPBridgeSessionKey,
+    settings: Settings,
+    ring_membership: RingMembershipService | None = None,
+) -> str | None:
+    instance_id, ring = await _active_http_bridge_instance_ring(settings, ring_membership)
+    if len(ring) <= 1:
+        return instance_id
+    hash_input = f"{key.affinity_kind}:{key.affinity_key}:{key.api_key_id or ''}"
+    return select_node(hash_input, ring)
+
+
+def _http_bridge_runtime_config(
+    dashboard_settings: DashboardSettings,
+    app_settings: Settings,
+) -> _HTTPBridgeRuntimeConfig:
+    return _HTTPBridgeRuntimeConfig(
+        enabled=app_settings.http_responses_session_bridge_enabled,
+        idle_ttl_seconds=HTTP_BRIDGE_IDLE_TTL_SECONDS,
+        codex_idle_ttl_seconds=HTTP_BRIDGE_CODEX_IDLE_TTL_SECONDS,
+        max_sessions=app_settings.http_responses_session_bridge_max_sessions,
+        queue_limit=app_settings.http_responses_session_bridge_queue_limit,
+        prompt_cache_idle_ttl_seconds=float(
+            dashboard_settings.http_responses_session_bridge_prompt_cache_idle_ttl_seconds,
+        ),
+        gateway_safe_mode=dashboard_settings.http_responses_session_bridge_gateway_safe_mode,
+    )
+
+
+def _http_bridge_request_budget_seconds(settings: object) -> float:
+    return float(
+        getattr(
+            settings,
+            "http_responses_session_bridge_request_budget_seconds",
+            getattr(settings, "proxy_request_budget_seconds", 600.0),
+        )
+    )
+
+
+def _http_bridge_eventless_budget_seconds(settings: object, *, fallback_seconds: float) -> float:
+    """Named pre-response-start silence budget for the downstream bridge stream.
+
+    Before ``response.created`` the downstream event queue is silent by design,
+    so ``stream_idle_timeout_seconds`` (a *post-start* inter-event budget) does
+    not describe this phase at all. The honest bound is the owner-side stuck
+    gate: once ``HTTP_BRIDGE_STUCK_GATE_RETIRE_AFTER_SECONDS`` retires the
+    pending handoff there is nothing left for the client to wait for. Clamp to
+    the stream-idle and bridge-request budgets so the pre-response watchdog can
+    never outlive the request it guards.
+
+    ``fallback_seconds`` is used when a caller's settings object does not carry
+    ``stream_idle_timeout_seconds`` at all.
+    """
+
+    stuck_gate_seconds = float(HTTP_BRIDGE_STUCK_GATE_RETIRE_AFTER_SECONDS)
+    stream_idle_timeout_seconds = float(getattr(settings, "stream_idle_timeout_seconds", fallback_seconds))
+    return max(
+        0.001,
+        min(
+            stuck_gate_seconds,
+            stream_idle_timeout_seconds,
+            _http_bridge_request_budget_seconds(settings),
+        ),
+    )
+
+
+def _http_bridge_eventless_max_keepalive_count(
+    settings: object,
+    *,
+    keepalive_interval_seconds: float,
+    floor_count: int,
+) -> int:
+    """Keepalive ticks the downstream stream waits before ``response.created``.
+
+    Derived from :func:`_http_bridge_eventless_budget_seconds` instead of the
+    implicit ``_STREAM_KEEPALIVE_MAX_COUNT * sse_keepalive_interval_seconds``
+    product, which silently encoded a ~60s pre-response deadline that had no
+    relationship to any configured timeout.
+    """
+
+    interval_seconds = max(0.001, keepalive_interval_seconds)
+    minimum_count = max(1, floor_count)
+    budget_seconds = _http_bridge_eventless_budget_seconds(
+        settings,
+        fallback_seconds=interval_seconds * minimum_count,
+    )
+    derived_count = max(1, math.ceil(budget_seconds / interval_seconds))
+    if minimum_count * interval_seconds <= budget_seconds:
+        return max(minimum_count, derived_count)
+    return derived_count
+
+
+def _http_bridge_admission_timeout_seconds(
+    request_state: _WebSocketRequestState,
+    admission_timeout_seconds: float,
+    settings: object,
+    *,
+    now: float,
+) -> float:
+    # Bridged requests may retry response-create gate acquisition within one
+    # bridge request budget, so every wait must be clamped to the remaining
+    # time. Re-prepared retry states reset started_at but deliberately retain
+    # the original deadline; using started_at alone would extend the budget.
+    # ``now`` comes from the owner's clock so the deadline (also owner-clock
+    # based) and the sample share one time domain.
+    deadline = request_state.bridge_request_deadline
+    if deadline is None:
+        deadline = request_state.started_at + _http_bridge_request_budget_seconds(settings)
+    remaining_budget_seconds = deadline - now
+    return max(0.0, min(admission_timeout_seconds, remaining_budget_seconds))
+
+
+def _http_bridge_owner_check_required(
+    key: _HTTPBridgeSessionKey,
+    *,
+    gateway_safe_mode: bool,
+) -> bool:
+    if key.strength == "hard":
+        return True
+    return gateway_safe_mode and key.affinity_kind == "sticky_thread"
+
+
+def _http_bridge_key_strength(key: _HTTPBridgeSessionKey) -> str:
+    return key.strength or "soft"
+
+
+# Frames the bridge injects into its own downstream streams. They prove the
+# proxy is alive, never that the upstream is.
+_HTTP_BRIDGE_LOCALLY_INJECTED_EVENT_TYPES = frozenset({"codex.keepalive"})
+
+
+def _http_bridge_event_proves_upstream_liveness(event_type: str | None) -> bool:
+    """Return whether an event type is upstream traffic rather than our own."""
+
+    if not event_type:
+        return False
+    return event_type not in _HTTP_BRIDGE_LOCALLY_INJECTED_EVENT_TYPES
+
+
+def _record_http_bridge_unmatched_upstream_liveness(
+    session: "_HTTPBridgeSession",
+    *,
+    event_type: str | None,
+) -> int:
+    """Count an upstream frame that proved liveness but matched no request."""
+
+    if not _http_bridge_event_proves_upstream_liveness(event_type):
+        return session.unmatched_upstream_liveness_count
+    session.unmatched_upstream_liveness_count += 1
+    return session.unmatched_upstream_liveness_count
+
+
+def _log_http_bridge_event(
+    event: str,
+    key: _HTTPBridgeSessionKey,
+    *,
+    account_id: str | None,
+    model: str | None,
+    pending_count: int | None = None,
+    detail: str | None = None,
+    cache_key_family: str | None = None,
+    model_class: str | None = None,
+    owner_check_applied: bool | None = None,
+    error_message: str | None = None,
+    upstream_close_code: int | None = None,
+    response_events_seen: int | None = None,
+    transport_classification: str | None = None,
+) -> None:
+    if event in {"create", "reuse", "reconnect", "close", "evict_idle"} and http_bridge_connections_total is not None:
+        http_bridge_connections_total.labels(event=event).inc()
+    level = logging.INFO
+    if event in {
+        "queue_full",
+        "submit_on_closed",
+        "send_failure",
+        "retry_fresh_upstream",
+        "retry_precreated",
+        "retry_precreated_clean_close",
+        "reconnect",
+        "terminal_error",
+        "capacity_exhausted_active_sessions",
+        "owner_mismatch",
+        "owner_forward_fail",
+        "owner_unavailable_replay_rejected",
+        "missing_response_created_timeout",
+        "prompt_cache_locality_miss",
+        "reallocation_orphan",
+        "context_overflow_rollover",
+        "reader_failure",
+    }:
+        level = logging.WARNING
+    logger.log(
+        level,
+        "http_bridge_event event=%s bridge_kind=%s bridge_key=%s account_id=%s"
+        " model=%s pending=%s detail=%s cache_key_family=%s model_class=%s"
+        " key_strength=%s owner_check_applied=%s error_message=%s upstream_close_code=%s"
+        " response_events_seen=%s transport_classification=%s",
+        event,
+        key.affinity_kind,
+        _hash_identifier(key.affinity_key),
+        account_id,
+        model,
+        pending_count,
+        detail,
+        cache_key_family,
+        model_class,
+        _http_bridge_key_strength(key),
+        owner_check_applied,
+        error_message,
+        upstream_close_code,
+        response_events_seen,
+        transport_classification,
+    )
+
+
+def _patchable_helper(name: str, original: Callable[..., Any]) -> Callable[..., Any]:
+    def _wrapper(*args: Any, **kwargs: Any) -> Any:
+        service_module = sys.modules.get("app.modules.proxy.service")
+        target = getattr(service_module, name, original) if service_module is not None else original
+        if target is _wrapper:
+            target = original
+        return target(*args, **kwargs)
+
+    return _wrapper
+
+
+for _helper_name in (
+    "_http_bridge_startup_wait_timeout_error",
+    "_log_http_bridge_startup_wait_timeout",
+    "_http_bridge_precreated_retry_failure_error",
+    "_trim_http_bridge_previous_response_input_items",
+    "_is_http_bridge_previous_response_output_item",
+    "_has_http_bridge_response_output_marker",
+    "_http_bridge_input_item_type",
+    "_normalize_http_bridge_error_event",
+    "_http_bridge_request_counts_against_queue",
+    "_http_bridge_session_has_visible_requests",
+    "_http_bridge_session_retiring_with_visible_requests",
+    "_http_bridge_payload_looks_like_full_resend",
+    "_preferred_http_bridge_reconnect_turn_state",
+    "_http_bridge_reconnect_turn_state",
+    "_http_bridge_turn_state_alias_key",
+    "_http_bridge_previous_response_alias_key",
+    "_http_bridge_session_allows_api_key",
+    "_http_bridge_session_account_active",
+    "_http_bridge_session_reusable_for_request",
+    "_http_bridge_session_matches_preferred_account",
+    "_make_http_bridge_session_key",
+    "_http_bridge_should_wait_for_registration",
+    "_durable_bridge_lookup_active_owner",
+    "_durable_bridge_lookup_allows_local_reuse",
+    "_http_bridge_allow_durable_takeover",
+    "_http_bridge_claim_allows_takeover",
+    "_http_bridge_has_durable_recovery_anchor",
+    "_http_bridge_can_local_recover_without_ring",
+    "_http_bridge_can_single_instance_owner_takeover_without_anchor",
+    "_http_bridge_can_single_instance_prompt_cache_takeover_without_anchor",
+    "_http_bridge_endpoint_matches_current_instance",
+    "_http_bridge_can_recover_during_drain",
+    "_http_bridge_request_stage",
+    "_record_bridge_reattach",
+    "_record_bridge_first_turn_timeout",
+    "_record_bridge_drain_recovery_allowed",
+    "_is_missing_durable_bridge_table_error",
+    "_http_bridge_durable_lease_ttl_seconds",
+    "_persist_http_bridge_replacement_account",
+    "_forwarded_http_bridge_session_key",
+    "_http_bridge_requires_cluster_registration",
+    "_effective_http_bridge_idle_ttl_seconds",
+    "_http_bridge_eviction_priority",
+    "_http_bridge_capacity_after_planned_closes",
+    "_plan_http_bridge_lru_capacity_closes",
+    "_build_http_bridge_prewarm_text",
+    "_http_bridge_prewarm_enabled",
+    "_record_http_bridge_prewarm_outcome",
+    "_record_http_bridge_stuck_retire",
+    "_http_bridge_payload_without_previous_response_id",
+    "_http_bridge_previous_response_error_envelope",
+    "_http_bridge_continuity_lost_error_envelope",
+    "_http_bridge_owner_lookup_unavailable_error_envelope",
+    "_http_bridge_should_attempt_local_previous_response_recovery",
+    "_http_bridge_is_explicit_previous_response_rejection",
+    "_http_bridge_is_previous_response_owner_unavailable",
+    "_http_bridge_should_attempt_soft_affinity_reroute",
+    "_http_bridge_is_context_overflow_error",
+    "_http_bridge_should_rollover_after_context_overflow",
+    "_http_bridge_should_attempt_local_bootstrap_rebind",
+    "_http_bridge_turn_state_anchor_for_owner_failure",
+    "_http_bridge_durable_lookup_allows_turn_state_takeover",
+    "_normalized_http_bridge_instance_ring",
+    "_active_http_bridge_instance_ring",
+    "_http_bridge_owner_instance",
+    "_http_bridge_runtime_config",
+    "_http_bridge_owner_check_required",
+    "_http_bridge_key_strength",
+    "_log_http_bridge_event",
+):
+    globals()[_helper_name] = _patchable_helper(_helper_name, globals()[_helper_name])
+
+del _helper_name