codexLB-up 1.25.0b10__py3-none-any.whl

app/modules/proxy/_service/websocket/helpers.py

@@ -0,0 +1,2360 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import sys
+import time
+from collections import deque
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import Any, cast
+
+import anyio
+
+from app.core.balancer.types import UpstreamError
+from app.core.clients.files import create_file as core_create_file  # noqa: F401
+from app.core.clients.files import finalize_file as core_finalize_file  # noqa: F401
+from app.core.clients.http import lease_http_session as lease_http_session  # noqa: F401
+from app.core.clients.native_egress import NativeWebSocketRoutingMetadata
+from app.core.clients.proxy import (  # noqa: F401  # noqa: F401
+    CODEX_LB_REQUIRED_CAPABILITY_HEADER,
+    ImageFetchSession,
+    ProxyResponseError,
+    UpstreamProxyRouteTrace,
+    _as_image_fetch_session,
+    _inline_content_images,
+    _inline_input_image_urls,
+    _ws_transport_payload_budget_bytes,
+    filter_inbound_headers,
+    pop_compact_timeout_overrides,
+    pop_stream_timeout_overrides,
+    pop_transcribe_timeout_overrides,
+    push_compact_timeout_overrides,
+    push_stream_timeout_overrides,
+    push_transcribe_timeout_overrides,
+)
+from app.core.clients.proxy import CodexControlResponse as CodexControlResponse
+from app.core.clients.proxy import codex_control_request as core_codex_control_request  # noqa: F401
+from app.core.clients.proxy import compact_responses as core_compact_responses  # noqa: F401
+from app.core.clients.proxy import transcribe_audio as core_transcribe_audio  # noqa: F401
+from app.core.clients.proxy_websocket import (
+    UpstreamWebSocketMessage,
+)
+from app.core.clock import Scheduler
+from app.core.errors import (
+    PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON,
+    PREVIOUS_RESPONSE_NOT_FOUND_CODE,
+    PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE,
+    PREVIOUS_RESPONSE_STREAM_INCOMPLETE_MESSAGE,
+    OpenAIErrorEnvelope,
+    OpenAIErrorParam,
+    coerce_error_param,
+    normalize_public_error_param,
+    openai_error,
+    previous_response_stream_incomplete_error,
+    response_failed_event,
+    sanitize_public_error_detail,
+)
+from app.core.exceptions import AppError
+from app.core.openai.models import OpenAIEvent
+from app.core.openai.parsing import parse_sse_event
+from app.core.openai.requests import (
+    ResponsesRequest,
+    extract_input_file_ids,
+)
+from app.core.types import JsonValue
+from app.core.utils.shared_future import (
+    _await_cleanup_deferring_cancellation as _await_cleanup_deferring_cancellation,
+)
+from app.core.utils.sse import CODEX_KEEPALIVE_FRAME as CODEX_KEEPALIVE_FRAME  # noqa: F401
+from app.core.utils.sse import format_sse_event, parse_sse_data_json
+from app.core.utils.time import to_utc_naive, utcnow
+from app.db.models import (
+    Account,
+    AccountStatus,  # noqa: F401
+)
+from app.modules.proxy._service.api_key_usage import (
+    _API_KEY_RESERVATION_HEARTBEAT_SECONDS as _API_KEY_RESERVATION_HEARTBEAT_SECONDS,
+)
+from app.modules.proxy._service.compact import (
+    _service_tier_from_compact_payload as _service_tier_from_compact_payload,
+)
+from app.modules.proxy._service.compact import (
+    _sticky_key_for_compact_request as _sticky_key_for_compact_request,
+)
+from app.modules.proxy._service.compact import (
+    _sticky_key_from_compact_payload as _sticky_key_from_compact_payload,
+)
+from app.modules.proxy._service.http_bridge.accepted_replay import (
+    _websocket_accepted_capacity_retry_error_code,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _active_http_bridge_instance_ring as _active_http_bridge_instance_ring,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _build_http_bridge_prewarm_text as _build_http_bridge_prewarm_text,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _durable_bridge_lookup_active_owner as _durable_bridge_lookup_active_owner,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _durable_bridge_lookup_allows_local_reuse as _durable_bridge_lookup_allows_local_reuse,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _effective_http_bridge_idle_ttl_seconds as _effective_http_bridge_idle_ttl_seconds,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _forwarded_http_bridge_session_key as _forwarded_http_bridge_session_key,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _has_http_bridge_response_output_marker as _has_http_bridge_response_output_marker,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_allow_durable_takeover as _http_bridge_allow_durable_takeover,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_can_local_recover_without_ring as _http_bridge_can_local_recover_without_ring,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_can_recover_during_drain as _http_bridge_can_recover_during_drain,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_continuity_lost_error_envelope as _http_bridge_continuity_lost_error_envelope,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_durable_lease_ttl_seconds as _http_bridge_durable_lease_ttl_seconds,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_endpoint_matches_current_instance as _http_bridge_endpoint_matches_current_instance,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_eviction_priority as _http_bridge_eviction_priority,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_has_durable_recovery_anchor as _http_bridge_has_durable_recovery_anchor,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_input_item_type as _http_bridge_input_item_type,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_is_context_overflow_error as _http_bridge_is_context_overflow_error,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_is_previous_response_owner_unavailable as _http_bridge_is_previous_response_owner_unavailable,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_key_strength as _http_bridge_key_strength,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_owner_check_required as _http_bridge_owner_check_required,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_owner_instance as _http_bridge_owner_instance,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_owner_lookup_unavailable_error_envelope as _http_bridge_owner_lookup_unavailable_error_envelope,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_payload_looks_like_full_resend as _http_bridge_payload_looks_like_full_resend,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_payload_without_previous_response_id as _http_bridge_payload_without_previous_response_id,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_precreated_retry_failure_error as _http_bridge_precreated_retry_failure_error,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_previous_response_alias_key as _http_bridge_previous_response_alias_key,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_previous_response_error_envelope as _http_bridge_previous_response_error_envelope,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_request_counts_against_queue as _http_bridge_request_counts_against_queue,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_request_stage as _http_bridge_request_stage,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_requires_cluster_registration as _http_bridge_requires_cluster_registration,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_runtime_config as _http_bridge_runtime_config,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_session_allows_api_key as _http_bridge_session_allows_api_key,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_session_has_visible_requests as _http_bridge_session_has_visible_requests,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_session_matches_preferred_account as _http_bridge_session_matches_preferred_account,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_session_retiring_with_visible_requests as _http_bridge_session_retiring_with_visible_requests,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_session_reusable_for_request as _http_bridge_session_reusable_for_request,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_should_attempt_local_bootstrap_rebind as _http_bridge_should_attempt_local_bootstrap_rebind,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_should_attempt_local_previous_response_recovery,  # noqa: F401
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_should_attempt_soft_affinity_reroute as _http_bridge_should_attempt_soft_affinity_reroute,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_should_rollover_after_context_overflow as _http_bridge_should_rollover_after_context_overflow,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_should_wait_for_registration as _http_bridge_should_wait_for_registration,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_startup_wait_timeout_error as _http_bridge_startup_wait_timeout_error,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _http_bridge_turn_state_alias_key as _http_bridge_turn_state_alias_key,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _is_http_bridge_previous_response_output_item as _is_http_bridge_previous_response_output_item,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _is_missing_durable_bridge_table_error as _is_missing_durable_bridge_table_error,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _log_http_bridge_event as _log_http_bridge_event,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _log_http_bridge_startup_wait_timeout as _log_http_bridge_startup_wait_timeout,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _make_http_bridge_session_key as _make_http_bridge_session_key,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _normalize_http_bridge_error_event as _normalize_http_bridge_error_event,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _normalized_http_bridge_instance_ring as _normalized_http_bridge_instance_ring,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _preferred_http_bridge_reconnect_turn_state as _preferred_http_bridge_reconnect_turn_state,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _record_bridge_drain_recovery_allowed as _record_bridge_drain_recovery_allowed,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _record_bridge_first_turn_timeout as _record_bridge_first_turn_timeout,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _record_bridge_reattach as _record_bridge_reattach,
+)
+from app.modules.proxy._service.http_bridge.helpers import (
+    _trim_http_bridge_previous_response_input_items as _trim_http_bridge_previous_response_input_items,
+)
+from app.modules.proxy._service.observability import (
+    _hash_identifier as _hash_identifier,
+)
+from app.modules.proxy._service.observability import (
+    _hash_identifier_or_none as _hash_identifier_or_none,
+)
+from app.modules.proxy._service.observability import (
+    _interesting_header_keys as _interesting_header_keys,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_request_payload as _maybe_log_proxy_request_payload,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_request_shape as _maybe_log_proxy_request_shape,
+)
+from app.modules.proxy._service.observability import (
+    _maybe_log_proxy_service_tier_trace as _maybe_log_proxy_service_tier_trace,
+)
+from app.modules.proxy._service.observability import (
+    _record_continuity_fail_closed as _record_continuity_fail_closed,
+)
+from app.modules.proxy._service.observability import (
+    _record_continuity_owner_resolution as _record_continuity_owner_resolution,
+)
+from app.modules.proxy._service.observability import (
+    _summarize_input as _summarize_input,
+)
+from app.modules.proxy._service.observability import (
+    _tools_hash as _tools_hash,
+)
+from app.modules.proxy._service.observability import (
+    _truncate_identifier as _truncate_identifier,
+)
+from app.modules.proxy._service.support import (
+    _ACCOUNT_MODEL_UNSUPPORTED_ERROR_CODE,
+    _HARD_HTTP_BRIDGE_AFFINITY_KINDS,  # noqa: F401
+    _WEBSOCKET_FULL_REPLAY_WAIT_MIN_ITEMS,
+    _WEBSOCKET_FULL_REPLAY_WAIT_POLL_SECONDS,  # noqa: F401
+    _affinity_may_resolve_hard_owner,
+    _clear_websocket_request_error_overrides,
+    _DeferredKeyedStreamHealthPenalty,
+    _event_type_from_payload,
+    _websocket_request_can_replay_before_visible_output,
+    _WebSocketContinuityAnchor,
+    _WebSocketContinuityState,
+    _WebSocketReceiveTimeout,
+    _WebSocketRequestState,
+    _WebSocketUpstreamControl,
+)
+from app.modules.proxy._service.support import (
+    _HTTPBridgeOwnerForward as _HTTPBridgeOwnerForward,
+)
+from app.modules.proxy._service.support import (
+    _websocket_route_log_kwargs as _websocket_route_log_kwargs,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupExecutionData as WarmupExecutionData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupFailedAccountData as WarmupFailedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupSkippedAccountData as WarmupSkippedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    WarmupSubmittedAccountData as WarmupSubmittedAccountData,
+)
+from app.modules.proxy._service.warmup import (
+    _is_warmup_usage_eligible as _is_warmup_usage_eligible,
+)
+from app.modules.proxy._service.warmup import (
+    _materialize_warmup_account as _materialize_warmup_account,
+)
+from app.modules.proxy._service.warmup import (
+    _snapshot_warmup_account as _snapshot_warmup_account,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupAccountSnapshot as _WarmupAccountSnapshot,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupSubmitResult as _WarmupSubmitResult,
+)
+from app.modules.proxy._service.warmup import (
+    _WarmupUsageSnapshot as _WarmupUsageSnapshot,
+)
+from app.modules.proxy.affinity import (
+    _AffinityPolicy,
+    _sticky_key_from_session_header,  # noqa: F401
+)
+from app.modules.proxy.durable_bridge_coordinator import (
+    DurableBridgeLookup as DurableBridgeLookup,
+)
+from app.modules.proxy.helpers import (
+    _is_account_model_unsupported_error,
+    _normalize_error_code,
+    _parse_openai_error,
+    is_upstream_model_capacity_error,
+    is_upstream_usage_limit_rejection,
+)
+from app.modules.proxy.http_bridge_forwarding import (
+    HTTPBridgeForwardContext as HTTPBridgeForwardContext,
+)
+from app.modules.proxy.http_bridge_forwarding import (
+    OwnerForwardRelayFailure as OwnerForwardRelayFailure,
+)
+from app.modules.proxy.replay_safety import responses_payload_is_account_neutral_fresh_replay
+from app.modules.proxy.selection_errors import USAGE_LIMIT_REACHED
+
+
+def _facade() -> Any:
+    return sys.modules["app.modules.proxy.service"]
+
+
+# A confirmed stale previous-response anchor can otherwise cause every client
+# reconnect to repeat the same owner lookup and doomed upstream connection.
+# Keep this local and short-lived: an owner record may still be committed by a
+# concurrent request, so discovery always invalidates the negative entry.
+_WEBSOCKET_STALE_PREVIOUS_RESPONSE_CACHE_TTL_SECONDS = 60.0
+_WEBSOCKET_STALE_PREVIOUS_RESPONSE_CACHE_LIMIT = 4096
+# The index is process-global and shared by every turn, so its TTL stamps stay
+# on the real monotonic clock instead of a per-turn injected clock; the
+# simulation harness never reaches it (its fake turns carry no stale anchor).
+_websocket_stale_previous_response_index: dict[tuple[str, str | None], float] = {}
+
+
+def _clear_websocket_stale_previous_response_cache() -> None:
+    """Drop process-local negative entries when a proxy service is created.
+
+    The cache intentionally is not durable: it only suppresses repeated
+    lookups during a short recovery window. Clearing it with the service
+    lifecycle prevents entries from one app/test instance from affecting a
+    later instance that happens to receive the same synthetic response id.
+    """
+    _websocket_stale_previous_response_index.clear()
+
+
+def _prune_websocket_stale_previous_response_cache(now: float | None = None) -> None:
+    current_time = time.monotonic() if now is None else now
+    for cache_key, expires_at in tuple(_websocket_stale_previous_response_index.items()):
+        if expires_at <= current_time:
+            _websocket_stale_previous_response_index.pop(cache_key, None)
+    while len(_websocket_stale_previous_response_index) > _WEBSOCKET_STALE_PREVIOUS_RESPONSE_CACHE_LIMIT:
+        _websocket_stale_previous_response_index.pop(next(iter(_websocket_stale_previous_response_index)))
+
+
+def _remember_websocket_stale_previous_response(
+    *,
+    previous_response_id: str | None,
+    api_key_id: str | None,
+) -> None:
+    if previous_response_id is None:
+        return
+    response_id = previous_response_id.strip()
+    if not response_id:
+        return
+    now = time.monotonic()
+    _prune_websocket_stale_previous_response_cache(now)
+    cache_key = (response_id, api_key_id)
+    _websocket_stale_previous_response_index.pop(cache_key, None)
+    _websocket_stale_previous_response_index[cache_key] = now + _WEBSOCKET_STALE_PREVIOUS_RESPONSE_CACHE_TTL_SECONDS
+    _prune_websocket_stale_previous_response_cache(now)
+
+
+def _forget_websocket_stale_previous_response(
+    *,
+    previous_response_id: str | None,
+    api_key_id: str | None,
+) -> None:
+    if previous_response_id is None:
+        return
+    response_id = previous_response_id.strip()
+    if not response_id:
+        return
+    _websocket_stale_previous_response_index.pop((response_id, api_key_id), None)
+
+
+def _is_websocket_stale_previous_response(
+    *,
+    previous_response_id: str | None,
+    api_key_id: str | None,
+) -> bool:
+    if previous_response_id is None:
+        return False
+    response_id = previous_response_id.strip()
+    if not response_id:
+        return False
+    now = time.monotonic()
+    _prune_websocket_stale_previous_response_cache(now)
+    expires_at = _websocket_stale_previous_response_index.get((response_id, api_key_id))
+    if expires_at is None:
+        return False
+    if expires_at <= now:
+        _websocket_stale_previous_response_index.pop((response_id, api_key_id), None)
+        return False
+    return True
+
+
+def _prepare_websocket_request_state_for_visible_output_replay(
+    request_state: "_WebSocketRequestState",
+) -> str | None:
+    # An identity captured by an earlier replay (or staged by the terminal
+    # capacity path before ``response_id`` was cleared) outlives this call, so
+    # a bounded extra replay keeps rewriting to the id the client is reading.
+    downstream_response_id = request_state.replay_downstream_response_id
+    if (
+        downstream_response_id is None
+        and request_state.response_id is not None
+        and not request_state.awaiting_response_created
+    ):
+        downstream_response_id = request_state.response_id
+    suppress_in_progress = request_state.suppress_next_in_progress_downstream or (
+        downstream_response_id is not None and request_state.response_event_count >= 2
+    )
+    fresh_request_text = request_state.fresh_upstream_request_text
+    if request_state.fresh_upstream_request_is_retry_safe and fresh_request_text:
+        # Only a proxy-injected anchor is the proxy's to release: its pin was
+        # derived from an anchor the client never asked for. A client-supplied
+        # anchor is the client's own continuation, so its fresh body keeps the
+        # owner pin and reconnects there (the capacity path re-sends such a
+        # turn to its owner; ``_websocket_auth_request_can_switch_account``
+        # treats it as account-bound).
+        _install_fresh_replay_body(
+            request_state,
+            fresh_request_text,
+            account_neutral=_websocket_request_text_is_account_neutral_fresh_replay(fresh_request_text),
+            release_owner_pin=(
+                request_state.previous_response_id is None or request_state.proxy_injected_previous_response_id
+            ),
+        )
+    request_text = request_state.request_text
+    if not isinstance(request_text, str):
+        return None
+    request_state.replay_count += 1
+    request_state.awaiting_response_created = True
+    request_state.response_id = None
+    request_state.response_event_count = 0
+    request_state.replay_downstream_response_id = downstream_response_id
+    request_state.suppress_next_created_downstream = downstream_response_id is not None
+    request_state.suppress_next_in_progress_downstream = suppress_in_progress
+    _clear_websocket_request_error_overrides(request_state)
+    return request_text
+
+
+def _websocket_owner_switch_has_other_pending_requests(
+    request_state: "_WebSocketRequestState",
+    pending_requests: deque["_WebSocketRequestState"],
+) -> bool:
+    return any(pending is not request_state for pending in pending_requests)
+
+
+def _websocket_request_text_is_account_neutral_fresh_replay(request_text: str | None) -> bool:
+    if not isinstance(request_text, str):
+        return False
+    try:
+        payload = json.loads(request_text)
+    except json.JSONDecodeError:
+        return False
+    if not isinstance(payload, dict):
+        return False
+    event_type = payload.get("type")
+    if event_type is not None and event_type != "response.create":
+        return False
+    payload.pop("type", None)
+    return responses_payload_is_account_neutral_fresh_replay(cast(dict[str, JsonValue], payload))
+
+
+def _bind_websocket_request_dispatch_owner(
+    request_state: "_WebSocketRequestState",
+    *,
+    account_id: str,
+    exact_request_text: str,
+) -> bool:
+    required_account_id = request_state.replay_required_account_id
+    if _websocket_request_text_is_account_neutral_fresh_replay(exact_request_text):
+        return required_account_id is None or required_account_id == account_id
+    if required_account_id is not None and required_account_id != account_id:
+        return False
+    request_state.preferred_account_id = account_id
+    request_state.replay_required_account_id = account_id
+    return True
+
+
+def _install_verified_fresh_replay(
+    request_state: "_WebSocketRequestState",
+    *,
+    require_proxy_injected_previous_response_id: bool = True,
+    require_account_neutral: bool = True,
+) -> str | None:
+    if not (request_state.fresh_upstream_request_is_retry_safe and request_state.fresh_upstream_request_text):
+        return None
+    if require_proxy_injected_previous_response_id and not request_state.proxy_injected_previous_response_id:
+        return None
+    fresh_request_text = request_state.fresh_upstream_request_text
+    account_neutral = _websocket_request_text_is_account_neutral_fresh_replay(fresh_request_text)
+    if require_account_neutral and not account_neutral:
+        return None
+    if not account_neutral and (request_state.replay_required_account_id or request_state.preferred_account_id) is None:
+        return None
+    return _install_fresh_replay_body(request_state, fresh_request_text, account_neutral=account_neutral)
+
+
+def _install_fresh_replay_body(
+    request_state: "_WebSocketRequestState",
+    fresh_request_text: str,
+    *,
+    account_neutral: bool,
+    release_owner_pin: bool = True,
+) -> str:
+    """Swap the retained fresh body in and re-derive the owner requirement from it.
+
+    The anchored body pinned the request to the anchor's owner
+    (``replay_required_account_id`` / ``preferred_account_id``, bound at
+    dispatch and on connect). The fresh body carries no anchor: an
+    account-neutral one is free to move, a non-neutral one stays with the
+    owner that was already required or preferred. Every path that installs
+    the fresh body must reconcile the pin with it; a stale pin under a body
+    that turned neutral is what let an accepted transport-close replay exclude
+    the very account its reconnect still required.
+
+    A turn-state owner is a session pin, not a body pin. The session loop
+    re-resolves it before every reconnect and ``_connect_proxy_websocket``
+    hard-requires it (``turn_state_owner_required``) whenever the session
+    carries an owner, so the fresh body cannot release it: clearing it here
+    only hid the requirement from the exclusion decision, and the replay then
+    excluded the account its reconnect was about to require.
+
+    ``release_owner_pin=False`` keeps both pins untouched for a replay whose
+    anchor the proxy is not entitled to release (a client-supplied
+    ``previous_response_id``): the fresh body is still what goes upstream,
+    but it stays with the owner the anchored body was bound to.
+    """
+    replay_required_account_id = request_state.replay_required_account_id or request_state.preferred_account_id
+    turn_state_owner_account_id = (
+        request_state.preferred_account_id
+        if request_state.affinity_policy.codex_session_source == "turn_state"
+        else None
+    )
+    request_state.request_text = fresh_request_text
+    request_state.previous_response_id = None
+    if release_owner_pin:
+        request_state.preferred_account_id = turn_state_owner_account_id
+        request_state.replay_required_account_id = None if account_neutral else replay_required_account_id
+    request_state.proxy_injected_previous_response_id = False
+    request_state.fresh_upstream_request_is_retry_safe = False
+    request_state.responses_lite_model = request_state.fresh_upstream_request_responses_lite_model
+    _refresh_websocket_request_input_fingerprint_from_text(request_state)
+    return fresh_request_text
+
+
+def _websocket_accepted_replay_can_switch_account(request_state: "_WebSocketRequestState") -> bool:
+    """Return whether an accepted replay may leave the account that accepted it.
+
+    Mirrors the owner requirements ``_connect_proxy_websocket`` enforces on
+    the reconnect: a bound replay owner, a file pin, an anchored owner, or a
+    turn-state owner keeps the replay on that account, so excluding it would
+    leave the reconnect no eligible account. Evaluate this after the replay
+    body has been prepared, once the anchor is stripped and the owner pin
+    reconciled with the body that will actually be sent; the turn-state owner
+    survives that reconciliation (``_install_fresh_replay_body``) because the
+    connect requires it regardless of the body. A turn-state session without
+    a resolved owner is free to move.
+    """
+    if request_state.replay_required_account_id is not None:
+        return False
+    if request_state.preferred_account_id is not None and (
+        request_state.previous_response_id is not None
+        or request_state.affinity_policy.codex_session_source == "turn_state"
+    ):
+        return False
+    return _websocket_auth_request_can_switch_account(request_state)
+
+
+def _websocket_affinity_may_resolve_hard_owner(affinity_policy: _AffinityPolicy) -> bool:
+    """Return whether sticky selection may bind this request to one owner account.
+
+    The predicate is shared with the HTTP bridge accepted replay
+    (``_affinity_may_resolve_hard_owner``): a resolved hard ``CODEX_SESSION``
+    row -- turn-state ownership or the raw compatibility row consulted through
+    ``legacy_selection_key`` -- narrows selection to an owner the request state
+    never carries, so excluding that owner would leave every re-selection at
+    ``hard_affinity_saturated`` until the connect budget runs out.
+    """
+    return _affinity_may_resolve_hard_owner(affinity_policy)
+
+
+def _websocket_accepted_replay_may_exclude_account(request_state: "_WebSocketRequestState") -> bool:
+    """Return whether an accepted replay may exclude the account that accepted it.
+
+    The exclusion is what moves an account-neutral accepted replay to another
+    account (bridge parity). It is refused when a request-state pin requires
+    the owner (``_websocket_accepted_replay_can_switch_account``) and when the
+    request's affinity may resolve to a hard owner the state does not carry
+    (``_websocket_affinity_may_resolve_hard_owner``). In both cases the replay
+    reconnects without an exclusion, as the created-only transport-close replay
+    did before accepted replays existed: sticky selection then re-resolves the
+    owner, or moves a soft row through the health penalty the failing account
+    receives. Only accepted lifecycles decide with this predicate; the
+    pre-created owner-switch branch keeps the pin-only predicate it already
+    used.
+    """
+    if _websocket_affinity_may_resolve_hard_owner(request_state.affinity_policy):
+        return False
+    return _websocket_accepted_replay_can_switch_account(request_state)
+
+
+async def _record_or_defer_websocket_accepted_replay_health(
+    proxy: Any,
+    request_state: "_WebSocketRequestState",
+    *,
+    account: Account,
+    error_message: str | None,
+    error_code: str,
+) -> None:
+    """Penalize the account an accepted replay leaves, now or after settlement.
+
+    The accepted request keeps its API-key reservation open across the
+    re-send, and account health must not be written while a reservation is
+    unsettled (api-keys spec settlement-ordering invariant; bridge parity with
+    ``_handle_or_defer_precreated_stream_health``). A keyed request queues the
+    classified penalty on its state; ``_finalize_websocket_request_state`` and
+    ``_release_websocket_request_state_reservation`` drain it once the
+    reservation settles or is released. Unkeyed requests write immediately.
+    ``account_health_error_handled`` is deliberately not set: the staged
+    terminal is never finalized on this surface, so a later terminal belongs to
+    the replacement attempt and earns its own penalty.
+    """
+    error: UpstreamError = {"message": error_message or "Upstream error"}
+    if request_state.api_key_reservation is not None:
+        request_state.deferred_keyed_stream_health.append(
+            _DeferredKeyedStreamHealthPenalty(account=account, error=error, code=error_code)
+        )
+        return
+    await proxy._handle_stream_error(account, error, error_code)
+
+
+def _prepare_websocket_request_state_for_account_switch(
+    request_state: "_WebSocketRequestState",
+) -> str | None:
+    """Return an unsent request body only when moving accounts is proven safe."""
+    if request_state.previous_response_id is None:
+        if not _websocket_request_text_is_account_neutral_fresh_replay(request_state.request_text):
+            return None
+        return request_state.request_text
+    return _install_verified_fresh_replay(request_state)
+
+
+def _retire_websocket_continuity_anchor(continuity_state: _WebSocketContinuityState) -> None:
+    """Drop the completed-response anchor and the state that only exists for it."""
+    continuity_state.last_completed_response_id = None
+    continuity_state.last_completed_input_count = 0
+    continuity_state.last_completed_input_prefix_fingerprint = None
+    continuity_state.last_pending_function_call_ids = []
+    continuity_state.last_pending_tool_call_types = {}
+
+
+def _websocket_continuity_anchor_for_payload(
+    continuity_state: _WebSocketContinuityState | None,
+    *,
+    responses_payload: ResponsesRequest,
+    codex_session_affinity: bool,
+    api_key_id: str | None = None,
+) -> _WebSocketContinuityAnchor | None:
+    """Select a matching session anchor, retiring any known upstream rejection."""
+    if continuity_state is None or not codex_session_affinity:
+        return None
+    if responses_payload.previous_response_id is not None:
+        return None
+    previous_response_id = continuity_state.last_completed_response_id
+    if previous_response_id is None:
+        return None
+    if _is_websocket_stale_previous_response(previous_response_id=previous_response_id, api_key_id=api_key_id):
+        # Upstream already denied this anchor (``previous_response_not_found``)
+        # and the fail-closed path remembered it. Injecting it again would
+        # fail the client's retry identically (#1921): retire it from session
+        # continuity so the full-context resend goes unanchored, and so the
+        # same id cannot return once the negative cache entry expires.
+        _retire_websocket_continuity_anchor(continuity_state)
+        _facade().logger.info(
+            "websocket_session_anchor_retired response_id=%s reason=stale_previous_response",
+            previous_response_id,
+        )
+        return None
+    stored_count = continuity_state.last_completed_input_count
+    if not _facade()._input_prefix_matches_stored_context(
+        responses_payload.input,
+        stored_count=stored_count,
+        stored_fingerprint=continuity_state.last_completed_input_prefix_fingerprint,
+    ):
+        return None
+    return _WebSocketContinuityAnchor(
+        previous_response_id=previous_response_id,
+        stored_input_item_count=stored_count,
+    )
+
+
+_WEBSOCKET_TOOL_CALL_ITEM_TYPES_BY_OUTPUT_TYPE = {
+    "function_call_output": "function_call",
+    "custom_tool_call_output": "custom_tool_call",
+    "apply_patch_call_output": "apply_patch_call",
+}
+_WEBSOCKET_TOOL_CALL_ITEM_TYPES = frozenset(_WEBSOCKET_TOOL_CALL_ITEM_TYPES_BY_OUTPUT_TYPE.values())
+
+
+def _websocket_input_items_are_self_contained_fresh_replay(input_items: list[JsonValue]) -> bool:
+    seen_call_ids_by_type: dict[str, set[str]] = {item_type: set() for item_type in _WEBSOCKET_TOOL_CALL_ITEM_TYPES}
+    for item in input_items:
+        if not isinstance(item, dict):
+            continue
+        item_type = _websocket_input_item_type(item)
+        call_id_value = item.get("call_id")
+        call_id = call_id_value if isinstance(call_id_value, str) and call_id_value else None
+        if item_type in _WEBSOCKET_TOOL_CALL_ITEM_TYPES:
+            if call_id is not None:
+                seen_call_ids_by_type[item_type].add(call_id)
+            continue
+        call_item_type = _WEBSOCKET_TOOL_CALL_ITEM_TYPES_BY_OUTPUT_TYPE.get(item_type or "")
+        if call_item_type is None:
+            continue
+        if call_id is None or call_id not in seen_call_ids_by_type[call_item_type]:
+            return False
+    return True
+
+
+def _websocket_client_previous_response_full_resend_is_retry_safe(
+    *,
+    previous_response_id: str | None,
+    input_value: JsonValue,
+    continuity_state: _WebSocketContinuityState | None,
+) -> bool:
+    if previous_response_id is None or not isinstance(input_value, list):
+        return False
+    input_items = cast(list[JsonValue], input_value)
+    if len(input_items) <= 1:
+        return False
+    if not _websocket_input_items_are_self_contained_fresh_replay(input_items):
+        return False
+    if (
+        continuity_state is not None
+        and continuity_state.last_completed_response_id == previous_response_id
+        and (
+            continuity_state.last_completed_input_count > 0
+            or continuity_state.last_completed_input_prefix_fingerprint is not None
+        )
+    ):
+        return _facade()._input_prefix_matches_stored_context(
+            input_value,
+            stored_count=continuity_state.last_completed_input_count,
+            stored_fingerprint=continuity_state.last_completed_input_prefix_fingerprint,
+        )
+    return True
+
+
+def _record_websocket_continuity_completion(
+    continuity_state: _WebSocketContinuityState,
+    *,
+    request_state: _WebSocketRequestState,
+    response_id: str | None,
+) -> None:
+    """Record completed context and pending tools, or clear an absent response anchor."""
+    if response_id is None:
+        _retire_websocket_continuity_anchor(continuity_state)
+        return
+    # Record the completed response id and pending tool-call metadata
+    # regardless of input shape (string inputs leave ``input_item_count`` at
+    # 0), so an anchored follow-up can still match continuity and receive
+    # synthetic interrupted tool outputs. Prefix anchoring/trimming is only
+    # meaningful for fingerprinted list inputs, so the count/fingerprint pair
+    # is cleared rather than left stale when the completed turn cannot
+    # provide one.
+    continuity_state.last_completed_response_id = response_id
+    if request_state.input_item_count > 0 and request_state.input_full_fingerprint is not None:
+        continuity_state.last_completed_input_count = request_state.input_item_count
+        continuity_state.last_completed_input_prefix_fingerprint = request_state.input_full_fingerprint
+    else:
+        continuity_state.last_completed_input_count = 0
+        continuity_state.last_completed_input_prefix_fingerprint = None
+    continuity_state.last_pending_function_call_ids = list(request_state.pending_function_call_ids)
+    continuity_state.last_pending_tool_call_types = dict(request_state.pending_tool_call_types)
+
+
+def _record_websocket_responses_lite_acceptance(
+    continuity_state: _WebSocketContinuityState,
+    *,
+    request_state: _WebSocketRequestState,
+) -> None:
+    # Codex can reuse an accepted ``generate=false`` prewarm response and send
+    # only an empty or user-only input delta next. That frame no longer carries
+    # ``additional_tools``, so the accepted prewarm must seed Lite continuity.
+    # Only Lite acceptances may update the single-slot state: a non-Lite
+    # acceptance must not clobber a previously accepted Lite continuity with
+    # ``None``. The accepted response id is recorded so trusted incremental
+    # continuity can require ``previous_response_id`` to reference it.
+    if request_state.responses_lite_model is None:
+        return
+    continuity_state.responses_lite_model = request_state.responses_lite_model
+    # Prefer the downstream-visible id: a suppressed-created replay keeps
+    # exposing the original response id to the client (every downstream event
+    # is rewritten to it), so the next incremental frame can only reference
+    # that visible id, never the hidden upstream replay id.
+    continuity_state.responses_lite_response_id = (
+        request_state.replay_downstream_response_id or request_state.response_id
+    )
+
+
+def _websocket_response_id(
+    event: OpenAIEvent | None,
+    payload: dict[str, JsonValue] | None,
+    *,
+    routing: NativeWebSocketRoutingMetadata | None = None,
+) -> str | None:
+    if event is not None and event.response is not None and event.response.id:
+        return event.response.id
+    if routing is not None:
+        return routing.payload_response_id
+    if not isinstance(payload, dict):
+        return None
+    direct_response_id = payload.get("response_id")
+    if isinstance(direct_response_id, str):
+        stripped_direct_response_id = direct_response_id.strip()
+        if stripped_direct_response_id:
+            return stripped_direct_response_id
+    response = payload.get("response")
+    if not isinstance(response, dict):
+        return None
+    response_id = response.get("id")
+    if not isinstance(response_id, str):
+        return None
+    stripped = response_id.strip()
+    return stripped or None
+
+
+def _websocket_downstream_response_id(request_state: "_WebSocketRequestState") -> str:
+    return request_state.replay_downstream_response_id or request_state.response_id or request_state.request_id
+
+
+def _websocket_continuity_response_ids(
+    request_state: "_WebSocketRequestState",
+    upstream_response_id: str | None,
+) -> tuple[str, ...]:
+    response_ids: list[str] = []
+    for response_id in (upstream_response_id, request_state.replay_downstream_response_id):
+        if not isinstance(response_id, str):
+            continue
+        stripped = response_id.strip()
+        if stripped and stripped not in response_ids:
+            response_ids.append(stripped)
+    return tuple(response_ids)
+
+
+def _rewrite_websocket_downstream_response_id(
+    payload: dict[str, JsonValue],
+    request_state: "_WebSocketRequestState",
+) -> dict[str, JsonValue]:
+    downstream_response_id = request_state.replay_downstream_response_id
+    if downstream_response_id is None:
+        return payload
+
+    direct_response_id = payload.get("response_id")
+    rewrite_direct = isinstance(direct_response_id, str) and direct_response_id != downstream_response_id
+    response = payload.get("response")
+    nested_response_id = response.get("id") if isinstance(response, dict) else None
+    rewrite_nested = isinstance(nested_response_id, str) and nested_response_id != downstream_response_id
+    if not rewrite_direct and not rewrite_nested:
+        # Identity fast-path contract: callers skip re-serialization when the
+        # original payload object comes back, so an already-aligned frame must
+        # not be copied into an equal-but-new dict.
+        return payload
+
+    rewritten = dict(payload)
+    if rewrite_direct:
+        rewritten["response_id"] = downstream_response_id
+    if rewrite_nested and isinstance(response, dict):
+        rewritten["response"] = {**response, "id": downstream_response_id}
+    return rewritten
+
+
+def _websocket_event_error_code(event_type: str | None, payload: dict[str, JsonValue] | None) -> str | None:
+    error = _websocket_event_error_payload(event_type, payload)
+    if not isinstance(error, dict):
+        return None
+    code_value = error.get("code")
+    if not isinstance(code_value, str):
+        return None
+    stripped = code_value.strip()
+    return stripped or None
+
+
+def _websocket_event_error_type(event_type: str | None, payload: dict[str, JsonValue] | None) -> str | None:
+    error = _websocket_event_error_payload(event_type, payload)
+    if not isinstance(error, dict):
+        return None
+    type_value = error.get("type")
+    if not isinstance(type_value, str):
+        return None
+    stripped = type_value.strip()
+    return stripped or None
+
+
+def _websocket_event_error_param(
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+) -> OpenAIErrorParam | None:
+    error = _websocket_event_error_payload(event_type, payload)
+    if not isinstance(error, dict):
+        return None
+    return OpenAIErrorParam.from_mapping(cast(Mapping[str, JsonValue], error))
+
+
+def _websocket_event_error_message(event_type: str | None, payload: dict[str, JsonValue] | None) -> str | None:
+    error = _websocket_event_error_payload(event_type, payload)
+    if not isinstance(error, dict):
+        return None
+    message_value = error.get("message")
+    if not isinstance(message_value, str):
+        return None
+    stripped = message_value.strip()
+    return stripped or None
+
+
+def _websocket_precreated_retry_error_code(
+    request_state: _WebSocketRequestState | None,
+    *,
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+    has_other_pending_requests: bool,
+) -> str | None:
+    if request_state is None:
+        return None
+    if request_state.response_id is not None and not request_state.awaiting_response_created:
+        # An accepted response is only replayable under the output-free
+        # capacity rule; every pre-created classifier below refuses it.
+        return _websocket_accepted_capacity_retry_error_code(
+            request_state,
+            event_type=event_type,
+            error_code=_normalize_error_code(
+                _websocket_event_error_code(event_type, payload),
+                _websocket_event_error_type(event_type, payload),
+            ),
+            error_message=_websocket_event_error_message(event_type, payload),
+            payload_response_id=_websocket_response_id(None, payload),
+            payload=payload,
+            has_other_pending_requests=has_other_pending_requests,
+        )
+    if request_state.last_downstream_sequence_number is not None:
+        return None
+    if request_state.downstream_visible:
+        return None
+    if has_other_pending_requests:
+        return None
+    if request_state.response_id is not None:
+        return None
+    if request_state.response_event_count > 0:
+        return None
+    if not request_state.awaiting_response_created:
+        return None
+    if not request_state.request_text:
+        return None
+    if request_state.replay_count >= 1:
+        return None
+    if event_type not in {"error", "response.failed"}:
+        return None
+
+    error_code = _normalize_error_code(
+        _websocket_event_error_code(event_type, payload),
+        _websocket_event_error_type(event_type, payload),
+    )
+    error_param = _websocket_event_error_param(event_type, payload)
+    error_message = _websocket_event_error_message(event_type, payload)
+    if _facade()._is_previous_response_not_found_error(
+        code=error_code,
+        param=error_param,
+        message=error_message,
+    ):
+        return "stream_incomplete"
+    if _facade()._is_missing_tool_output_error(
+        code=error_code,
+        param=error_param,
+        message=error_message,
+    ):
+        return None
+    if _is_account_model_unsupported_error(
+        code=error_code,
+        message=error_message,
+        model=request_state.model,
+    ):
+        # Any recognized response id means upstream has accepted this request,
+        # even when response.created was not observed on this socket.  Do not
+        # account-switch an error event that carries either response.id or a
+        # top-level response_id as though it were still pre-created.
+        if _websocket_response_id(None, payload) is not None:
+            return None
+        return _ACCOUNT_MODEL_UNSUPPORTED_ERROR_CODE
+    if is_upstream_model_capacity_error(error_message):
+        if error_code in {
+            "rate_limit_exceeded",
+            "usage_limit_reached",
+            "insufficient_quota",
+            "usage_not_included",
+            "quota_exceeded",
+        }:
+            return error_code
+        if _websocket_response_id(None, payload) is not None:
+            return None
+        return "server_is_overloaded"
+    return _websocket_transparent_replay_error_code(error_code, error_message)
+
+
+def _websocket_precreated_replay_fallback_error(
+    request_state: _WebSocketRequestState,
+) -> tuple[int, OpenAIErrorEnvelope, str, str, str | None] | None:
+    if request_state.precreated_replay_reason != _ACCOUNT_MODEL_UNSUPPORTED_ERROR_CODE:
+        return None
+    error_code = request_state.error_code_override or "invalid_request_error"
+    error_message = request_state.error_message_override or "Upstream rejected the requested model for this account"
+    error_type = request_state.error_type_override or "invalid_request_error"
+    payload = openai_error(error_code, error_message, error_type=error_type)
+    error_param_override = coerce_error_param(request_state.error_param_override)
+    if error_param_override.present:
+        public_param = normalize_public_error_param(error_param_override)
+        if public_param is not None:
+            payload["error"]["param"] = public_param
+    return (
+        request_state.error_http_status_override or 400,
+        payload,
+        error_code,
+        error_message,
+        request_state.precreated_replay_account_id,
+    )
+
+
+def _websocket_precreated_auth_error_code(
+    request_state: _WebSocketRequestState | None,
+    *,
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+    has_other_pending_requests: bool,
+) -> str | None:
+    if request_state is None:
+        return None
+    if request_state.last_downstream_sequence_number is not None:
+        return None
+    if has_other_pending_requests:
+        return None
+    if request_state.response_id is not None:
+        return None
+    if request_state.response_event_count > 0:
+        return None
+    if not request_state.awaiting_response_created:
+        return None
+    if not request_state.request_text:
+        return None
+    if request_state.downstream_visible:
+        return None
+    if event_type not in {"error", "response.failed"}:
+        return None
+    if _websocket_response_id(None, payload) is not None:
+        return None
+
+    error_code = _normalize_error_code(
+        _websocket_event_error_code(event_type, payload),
+        _websocket_event_error_type(event_type, payload),
+    )
+    error_type = _websocket_event_error_type(event_type, payload)
+    if error_code in _facade()._WEBSOCKET_AUTH_FAILURE_CODES or error_type == "authentication_error":
+        return "invalid_api_key"
+    return None
+
+
+def _websocket_auth_failure_requires_reauth(message: str | None) -> bool:
+    if not isinstance(message, str):
+        return False
+    lowered = message.lower()
+    return any(marker in lowered for marker in _facade()._WEBSOCKET_REAUTH_REQUIRED_MESSAGE_MARKERS)
+
+
+def _websocket_auth_failure_permanent_code(message: str | None) -> str:
+    if _websocket_auth_failure_requires_reauth(message):
+        return _facade()._WEBSOCKET_SESSION_EXPIRED_FAILURE_CODE
+    return _facade()._WEBSOCKET_AUTH_INVALIDATED_FAILURE_CODE
+
+
+def _websocket_fresh_request_blocks_account_switch(request_state: _WebSocketRequestState) -> bool:
+    try:
+        fresh_payload = json.loads(request_state.fresh_upstream_request_text or "null")
+    except (TypeError, json.JSONDecodeError):
+        return True
+    if not isinstance(fresh_payload, dict):
+        return True
+    fresh_input = fresh_payload.get("input") if isinstance(fresh_payload, dict) else None
+    return bool(extract_input_file_ids(fresh_input))
+
+
+def _websocket_auth_request_can_switch_account(request_state: _WebSocketRequestState) -> bool:
+    if request_state.file_required_preferred_account:
+        return False
+    if request_state.previous_response_id is None:
+        return request_state.request_text is None or _websocket_request_text_is_account_neutral_fresh_replay(
+            request_state.request_text
+        )
+    if not (
+        request_state.proxy_injected_previous_response_id
+        and request_state.fresh_upstream_request_is_retry_safe
+        and request_state.fresh_upstream_request_text
+    ):
+        return False
+    return _websocket_request_text_is_account_neutral_fresh_replay(
+        request_state.fresh_upstream_request_text
+    ) and not _websocket_fresh_request_blocks_account_switch(request_state)
+
+
+def _prepare_websocket_request_state_for_auth_replay(
+    request_state: _WebSocketRequestState,
+    *,
+    current_account_id: str | None = None,
+) -> str | None:
+    if request_state.verified_stale_anchor_replay:
+        return None
+    if request_state.last_downstream_sequence_number is not None:
+        return None
+    can_switch_account = _websocket_auth_request_can_switch_account(request_state)
+    can_retry_bound_owner = (
+        request_state.auth_replay_count == 0
+        and current_account_id is not None
+        and request_state.replay_required_account_id == current_account_id
+        and isinstance(request_state.request_text, str)
+    )
+    if not can_switch_account and not can_retry_bound_owner:
+        return None
+    if can_switch_account and (
+        request_state.proxy_injected_previous_response_id
+        and request_state.fresh_upstream_request_is_retry_safe
+        and request_state.fresh_upstream_request_text
+    ):
+        if _install_verified_fresh_replay(request_state) is None:
+            return None
+    request_text = request_state.request_text
+    if not isinstance(request_text, str):
+        return None
+    request_state.replay_count += 1
+    request_state.auth_replay_count += 1
+    request_state.awaiting_response_created = True
+    request_state.response_id = None
+    request_state.response_event_count = 0
+    _clear_websocket_request_error_overrides(request_state)
+    return request_text
+
+
+def _websocket_owner_pinned_quota_error_code(
+    request_state: _WebSocketRequestState | None,
+    *,
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+) -> str | None:
+    if request_state is None:
+        return None
+    if request_state.previous_response_id is None or request_state.preferred_account_id is None:
+        return None
+    if request_state.response_id is not None:
+        return None
+    if not request_state.awaiting_response_created:
+        return None
+    if not request_state.request_text:
+        return None
+    if event_type not in {"error", "response.failed"}:
+        return None
+
+    error_code = _normalize_error_code(
+        _websocket_event_error_code(event_type, payload),
+        _websocket_event_error_type(event_type, payload),
+    )
+    error_message = _websocket_event_error_message(event_type, payload)
+    if is_upstream_model_capacity_error(error_message):
+        if error_code in {
+            "rate_limit_exceeded",
+            "usage_limit_reached",
+            "insufficient_quota",
+            "usage_not_included",
+            "quota_exceeded",
+        }:
+            return error_code
+        if _websocket_response_id(None, payload) is not None:
+            return None
+        return "server_is_overloaded"
+    return _websocket_transparent_replay_error_code(error_code, error_message)
+
+
+def _websocket_transparent_replay_error_code(error_code: str, error_message: str | None) -> str | None:
+    """The code this terminal frame may be replayed under, or ``None`` to surface it.
+
+    The code set cannot answer for the serialized usage-limit rejection, which
+    upstream sends with no error code at all: that frame normalizes to
+    ``upstream_error``, which the set does not contain, so the turn is surfaced
+    on a spent account while the identical coded frame is replayed elsewhere.
+    A frame whose sentence proves the usage limit answers under the usage-limit
+    code, so every later question -- whether an owner-pinned turn may move, what
+    the account's health write records -- gets the same answer for both forms
+    upstream chooses between.
+    """
+    if error_code in _facade()._WEBSOCKET_TRANSPARENT_REPLAY_ERROR_CODES:
+        return error_code
+    if is_upstream_usage_limit_rejection(error_code=error_code, message=error_message):
+        return USAGE_LIMIT_REACHED
+    return None
+
+
+async def _pop_replayable_precreated_websocket_request_state(
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    pending_lock: anyio.Lock,
+    replay_refusal_reasons: list[str] | None = None,
+) -> _WebSocketRequestState | None:
+    async with pending_lock:
+        pending_count = len(pending_requests)
+        if pending_count != 1:
+            if replay_refusal_reasons is not None:
+                replay_refusal_reasons.append(
+                    "multiple_pending_requests" if pending_count > 1 else "no_pending_requests"
+                )
+                if any(request_state.last_downstream_sequence_number is not None for request_state in pending_requests):
+                    replay_refusal_reasons.append("sequenced_downstream_frame")
+            return None
+        request_state = pending_requests[0]
+        if not _websocket_request_can_replay_before_visible_output(request_state):
+            if replay_refusal_reasons is not None and request_state.last_downstream_sequence_number is not None:
+                replay_refusal_reasons.append("sequenced_downstream_frame")
+            return None
+        pending_requests.popleft()
+    if _prepare_websocket_request_state_for_visible_output_replay(request_state) is None:
+        return None
+    return request_state
+
+
+async def _websocket_full_resend_conflicts_with_visible_pending(
+    request_state: _WebSocketRequestState,
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    pending_lock: anyio.Lock,
+    codex_session_affinity: bool,
+) -> bool:
+    if (
+        not codex_session_affinity
+        or request_state.previous_response_id is not None
+        or request_state.input_item_count < _WEBSOCKET_FULL_REPLAY_WAIT_MIN_ITEMS
+    ):
+        return False
+    async with pending_lock:
+        return any(pending is not request_state and pending.downstream_visible for pending in pending_requests)
+
+
+def _refresh_websocket_request_input_fingerprint_from_text(request_state: _WebSocketRequestState) -> None:
+    if not request_state.request_text:
+        request_state.input_item_count = 0
+        request_state.input_full_fingerprint = None
+        return
+    try:
+        payload = json.loads(request_state.request_text)
+    except json.JSONDecodeError:
+        request_state.input_item_count = 0
+        request_state.input_full_fingerprint = None
+        return
+    if not isinstance(payload, dict):
+        request_state.input_item_count = 0
+        request_state.input_full_fingerprint = None
+        return
+    input_items = payload.get("input")
+    if not isinstance(input_items, list):
+        request_state.input_item_count = 0
+        request_state.input_full_fingerprint = None
+        return
+    request_state.input_item_count = len(input_items)
+    request_state.input_full_fingerprint = _facade()._fingerprint_input_items(cast(list[JsonValue], input_items))
+
+
+def _websocket_top_level_error_payload(payload: dict[str, JsonValue]) -> dict[str, JsonValue] | None:
+    if payload.get("type") != "error":
+        return None
+    error: dict[str, JsonValue] = {}
+    for error_field in ("code", "message"):
+        value = payload.get(error_field)
+        if isinstance(value, str) and value.strip():
+            error[error_field] = value.strip()
+    if "param" in payload:
+        error["param"] = payload["param"]
+    error_type = payload.get("error_type")
+    if isinstance(error_type, str) and error_type.strip():
+        error["type"] = error_type.strip()
+    for metadata_field in ("plan_type", "resets_at", "resets_in_seconds"):
+        value = payload.get(metadata_field)
+        if isinstance(value, str | int | float) and not isinstance(value, bool):
+            error[metadata_field] = value
+    return error or None
+
+
+def _websocket_event_error_payload(
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+) -> dict[str, JsonValue] | None:
+    if not isinstance(payload, dict):
+        return None
+    if event_type == "error":
+        error = payload.get("error")
+        if isinstance(error, dict):
+            return error
+        # The ChatGPT-backed Codex websocket can emit OpenAI-style error
+        # details directly on the event frame instead of under an ``error``
+        # envelope. Normalize those fields into an error-detail object so the
+        # event discriminator ``type: error`` is not mistaken for the upstream
+        # error type.
+        return _websocket_top_level_error_payload(payload)
+    if event_type == "response.failed":
+        response = payload.get("response")
+        error = response.get("error") if isinstance(response, dict) else None
+        return error if isinstance(error, dict) else None
+    return None
+
+
+def _sanitize_public_websocket_event_payload(
+    payload: dict[str, JsonValue],
+    *,
+    event_type: str | None,
+) -> dict[str, JsonValue]:
+    """Copy a terminal event with only a client-safe ``error.param``."""
+
+    normalized = payload
+    if event_type in {"error", "response.failed"}:
+        error_value = payload.get("error")
+        if isinstance(error_value, dict):
+            sanitized_error = sanitize_public_error_detail(error_value)
+            if sanitized_error != error_value:
+                normalized = dict(normalized)
+                normalized["error"] = sanitized_error
+        if "param" in payload:
+            sanitized = dict(normalized)
+            public_param = normalize_public_error_param(OpenAIErrorParam(True, payload["param"]))
+            if public_param is None:
+                sanitized.pop("param", None)
+            else:
+                sanitized["param"] = public_param
+            if sanitized != normalized:
+                normalized = sanitized
+
+    response_value = payload.get("response")
+    if isinstance(response_value, dict):
+        error_value = response_value.get("error")
+        if isinstance(error_value, dict):
+            sanitized_error = sanitize_public_error_detail(error_value)
+            if sanitized_error != error_value:
+                normalized_response = dict(response_value)
+                normalized_response["error"] = sanitized_error
+                normalized = dict(normalized)
+                normalized["response"] = normalized_response
+    return normalized
+
+
+def _websocket_event_incomplete_reason(
+    event_type: str | None,
+    payload: dict[str, JsonValue] | None,
+) -> str | None:
+    if event_type != "response.incomplete" or not isinstance(payload, dict):
+        return None
+    response = payload.get("response")
+    if not isinstance(response, dict):
+        return None
+    incomplete_details = response.get("incomplete_details")
+    if not isinstance(incomplete_details, dict):
+        return None
+    reason = incomplete_details.get("reason")
+    if not isinstance(reason, str):
+        return None
+    stripped = reason.strip()
+    return stripped or None
+
+
+def _maybe_rewrite_websocket_previous_response_not_found_event(
+    *,
+    request_state: _WebSocketRequestState,
+    event: OpenAIEvent | None,
+    payload: dict[str, JsonValue] | None,
+    event_type: str | None,
+    upstream_control: _WebSocketUpstreamControl,
+    original_text: str,
+) -> tuple[OpenAIEvent | None, dict[str, JsonValue] | None, str | None, str]:
+    error_code = _normalize_error_code(
+        _websocket_event_error_code(event_type, payload),
+        _websocket_event_error_type(event_type, payload),
+    )
+    error_param = _websocket_event_error_param(event_type, payload)
+    error_message = _websocket_event_error_message(event_type, payload)
+    should_rewrite = _facade()._is_previous_response_not_found_error(
+        code=error_code,
+        param=error_param,
+        message=error_message,
+    )
+    reason = "previous_response_not_found"
+    if not should_rewrite and _facade()._is_previous_response_not_found_public_shape(
+        code=error_code,
+        param=error_param,
+        message=error_message,
+    ):
+        # Mask malformed stale-anchor metadata without allowing replay.
+        should_rewrite = True
+        reason = PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON
+        request_state.previous_response_not_found_recovery_blocked = True
+    if not should_rewrite:
+        if request_state.previous_response_id is None:
+            return event, payload, event_type, original_text
+        should_rewrite = _facade()._is_missing_tool_output_error(
+            code=error_code,
+            param=error_param,
+            message=error_message,
+        )
+        reason = "missing_tool_output"
+    if not should_rewrite:
+        return event, payload, event_type, original_text
+
+    reconnect_requested = reason != PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON and (
+        reason == "missing_tool_output" or request_state.preferred_account_id is not None
+    )
+    return _rewrite_websocket_continuity_corruption_event(
+        request_state=request_state,
+        upstream_control=upstream_control,
+        reason=reason,
+        reconnect_requested=reconnect_requested,
+        original_text=original_text,
+    )
+
+
+def _websocket_continuity_error_fields(
+    *,
+    reason: str,
+    expose_stale_previous_response_classifier: bool,
+) -> tuple[str, str]:
+    if reason == "previous_response_not_found" and expose_stale_previous_response_classifier:
+        return PREVIOUS_RESPONSE_NOT_FOUND_CODE, PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE
+    return "stream_incomplete", PREVIOUS_RESPONSE_STREAM_INCOMPLETE_MESSAGE
+
+
+@dataclass(frozen=True, slots=True)
+class _WebSocketStaleAnchorDiagnostics:
+    previous_response_source: str
+    fresh_replay_available: bool
+    owner_lookup_source: str | None
+    owner_lookup_outcome: str | None
+    previous_response_age_seconds: int | None
+    same_session: bool | None
+
+
+def _websocket_previous_response_source(request_state: _WebSocketRequestState) -> str:
+    if request_state.previous_response_id is None:
+        return "unknown"
+    if request_state.proxy_injected_previous_response_id:
+        return "proxy_injected"
+    return "client_supplied"
+
+
+def _websocket_same_session_for_previous_response(
+    request_state: _WebSocketRequestState,
+) -> bool | None:
+    request_session_id = request_state.session_id.strip() if isinstance(request_state.session_id, str) else ""
+    owner_session_id = (
+        request_state.previous_response_owner_session_id.strip()
+        if isinstance(request_state.previous_response_owner_session_id, str)
+        else ""
+    )
+    if not request_session_id or not owner_session_id:
+        return None
+    return request_session_id == owner_session_id
+
+
+def _websocket_previous_response_age_seconds(request_state: _WebSocketRequestState) -> int | None:
+    requested_at = request_state.previous_response_owner_requested_at
+    if requested_at is None:
+        return None
+    return max(0, int((utcnow() - to_utc_naive(requested_at)).total_seconds()))
+
+
+def _websocket_stale_anchor_diagnostics(
+    request_state: _WebSocketRequestState,
+) -> _WebSocketStaleAnchorDiagnostics:
+    return _WebSocketStaleAnchorDiagnostics(
+        previous_response_source=_websocket_previous_response_source(request_state),
+        fresh_replay_available=bool(
+            request_state.fresh_upstream_request_is_retry_safe and request_state.fresh_upstream_request_text is not None
+        ),
+        owner_lookup_source=request_state.previous_response_owner_lookup_source,
+        owner_lookup_outcome=request_state.previous_response_owner_lookup_outcome,
+        previous_response_age_seconds=_websocket_previous_response_age_seconds(request_state),
+        same_session=_websocket_same_session_for_previous_response(request_state),
+    )
+
+
+def _websocket_stale_anchor_failure_detail(
+    diagnostics: _WebSocketStaleAnchorDiagnostics,
+) -> str:
+    owner_lookup_source = diagnostics.owner_lookup_source or "unknown"
+    owner_lookup_outcome = diagnostics.owner_lookup_outcome or "unknown"
+    previous_response_age_seconds = (
+        str(diagnostics.previous_response_age_seconds)
+        if diagnostics.previous_response_age_seconds is not None
+        else "unknown"
+    )
+    same_session = str(diagnostics.same_session).lower() if diagnostics.same_session is not None else "unknown"
+    return (
+        "previous_response_not_found "
+        f"previous_response_source={diagnostics.previous_response_source} "
+        f"fresh_replay_available={str(diagnostics.fresh_replay_available).lower()} "
+        f"owner_lookup_source={owner_lookup_source} "
+        f"owner_lookup_outcome={owner_lookup_outcome} "
+        f"previous_response_age_seconds={previous_response_age_seconds} "
+        f"same_session={same_session}"
+    )
+
+
+def _record_websocket_stale_anchor_failure(
+    request_state: _WebSocketRequestState,
+    *,
+    surface: str,
+    upstream_error_code: str,
+) -> None:
+    diagnostics = _websocket_stale_anchor_diagnostics(request_state)
+    request_state.failure_phase_override = "upstream"
+    request_state.failure_detail_override = _websocket_stale_anchor_failure_detail(diagnostics)
+    request_state.upstream_error_code_override = upstream_error_code
+    if not diagnostics.fresh_replay_available:
+        _remember_websocket_stale_previous_response(
+            previous_response_id=request_state.previous_response_id,
+            api_key_id=request_state.api_key.id if request_state.api_key is not None else None,
+        )
+    _record_continuity_fail_closed(
+        surface=surface,
+        reason="previous_response_not_found",
+        previous_response_id=request_state.previous_response_id,
+        session_id=request_state.session_id,
+        upstream_error_code=upstream_error_code,
+        previous_response_source=diagnostics.previous_response_source,
+        fresh_replay_available=diagnostics.fresh_replay_available,
+        owner_lookup_source=diagnostics.owner_lookup_source,
+        owner_lookup_outcome=diagnostics.owner_lookup_outcome,
+        previous_response_age_seconds=diagnostics.previous_response_age_seconds,
+        same_session=diagnostics.same_session,
+    )
+
+
+def _rewrite_websocket_continuity_corruption_event(
+    *,
+    request_state: _WebSocketRequestState,
+    upstream_control: _WebSocketUpstreamControl,
+    reason: str,
+    reconnect_requested: bool,
+    original_text: str,
+) -> tuple[OpenAIEvent | None, dict[str, JsonValue] | None, str | None, str]:
+    del original_text
+    if reconnect_requested:
+        upstream_control.reconnect_requested = True
+    if reason == "previous_response_not_found":
+        _record_websocket_stale_anchor_failure(
+            request_state,
+            surface="websocket_stream",
+            upstream_error_code="previous_response_not_found",
+        )
+    else:
+        _record_continuity_fail_closed(
+            surface="websocket_stream",
+            reason=reason,
+            previous_response_id=request_state.previous_response_id,
+            session_id=request_state.session_id,
+            upstream_error_code=(
+                PREVIOUS_RESPONSE_NOT_FOUND_CODE if reason == PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON else None
+            ),
+        )
+    rewritten_code, rewritten_message = _websocket_continuity_error_fields(
+        reason=reason,
+        expose_stale_previous_response_classifier=request_state.expose_stale_previous_response_classifier,
+    )
+    rewritten_event_payload = response_failed_event(
+        rewritten_code,
+        rewritten_message,
+        error_type="server_error",
+        response_id=_websocket_downstream_response_id(request_state),
+    )
+    rewritten_text = json.dumps(rewritten_event_payload, ensure_ascii=True, separators=(",", ":"))
+    rewritten_event_block = format_sse_event(rewritten_event_payload)
+    rewritten_payload = parse_sse_data_json(rewritten_event_block)
+    rewritten_event = parse_sse_event(rewritten_event_block)
+    rewritten_event_type = _event_type_from_payload(rewritten_event, rewritten_payload)
+    return rewritten_event, rewritten_payload, rewritten_event_type, rewritten_text
+
+
+def _rewrite_websocket_previous_response_owner_unavailable_event(
+    *,
+    request_state: _WebSocketRequestState,
+) -> tuple[OpenAIEvent | None, dict[str, JsonValue] | None, str | None, str]:
+    _record_continuity_fail_closed(
+        surface="websocket_stream",
+        reason="owner_account_unavailable",
+        previous_response_id=request_state.previous_response_id,
+        session_id=request_state.session_id,
+    )
+    rewritten_event_payload = response_failed_event(
+        "upstream_unavailable",
+        "Previous response owner account is unavailable; retry later.",
+        error_type="server_error",
+        response_id=_websocket_downstream_response_id(request_state),
+    )
+    rewritten_text = json.dumps(rewritten_event_payload, ensure_ascii=True, separators=(",", ":"))
+    rewritten_event_block = format_sse_event(rewritten_event_payload)
+    rewritten_payload = parse_sse_data_json(rewritten_event_block)
+    rewritten_event = parse_sse_event(rewritten_event_block)
+    rewritten_event_type = _event_type_from_payload(rewritten_event, rewritten_payload)
+    return rewritten_event, rewritten_payload, rewritten_event_type, rewritten_text
+
+
+def _rewrite_websocket_suppressed_duplicate_tool_call_completion_event(
+    *,
+    request_state: _WebSocketRequestState,
+) -> tuple[OpenAIEvent | None, dict[str, JsonValue] | None, str | None, str]:
+    rewritten_event_payload = response_failed_event(
+        _facade()._SUPPRESSED_DUPLICATE_TOOL_CALL_ERROR_CODE,
+        _facade()._SUPPRESSED_DUPLICATE_TOOL_CALL_MESSAGE,
+        error_type="server_error",
+        response_id=_websocket_downstream_response_id(request_state),
+    )
+    rewritten_text = json.dumps(rewritten_event_payload, ensure_ascii=True, separators=(",", ":"))
+    rewritten_event_block = format_sse_event(rewritten_event_payload)
+    rewritten_payload = parse_sse_data_json(rewritten_event_block)
+    rewritten_event = parse_sse_event(rewritten_event_block)
+    rewritten_event_type = _event_type_from_payload(rewritten_event, rewritten_payload)
+    return rewritten_event, rewritten_payload, rewritten_event_type, rewritten_text
+
+
+def _sanitize_websocket_connect_failure(
+    *,
+    request_state: _WebSocketRequestState,
+    status_code: int,
+    payload: OpenAIErrorEnvelope,
+    error_code: str,
+    error_message: str,
+) -> tuple[int, OpenAIErrorEnvelope, str, str]:
+    return _sanitize_websocket_previous_response_error(
+        previous_response_id=request_state.previous_response_id,
+        session_id=request_state.session_id,
+        status_code=status_code,
+        payload=payload,
+        error_code=error_code,
+        error_message=error_message,
+        surface="websocket_connect",
+        expose_stale_previous_response_classifier=request_state.expose_stale_previous_response_classifier,
+        request_state=request_state,
+    )
+
+
+def _sanitize_websocket_previous_response_error(
+    *,
+    previous_response_id: str | None,
+    session_id: str | None,
+    status_code: int,
+    payload: OpenAIErrorEnvelope,
+    error_code: str,
+    error_message: str,
+    surface: str,
+    expose_stale_previous_response_classifier: bool = False,
+    request_state: _WebSocketRequestState | None = None,
+) -> tuple[int, OpenAIErrorEnvelope, str, str]:
+    if previous_response_id is None:
+        return status_code, payload, error_code, error_message
+    parsed_error = _parse_openai_error(payload)
+    normalized_code = _normalize_error_code(
+        parsed_error.code if parsed_error else error_code,
+        parsed_error.type if parsed_error else None,
+    )
+    normalized_message = parsed_error.message if parsed_error and parsed_error.message else error_message
+    reason = "previous_response_not_found"
+    should_rewrite = _facade()._is_previous_response_not_found_error(
+        code=normalized_code,
+        param=parsed_error.param_state if parsed_error else OpenAIErrorParam.absent(),
+        message=normalized_message,
+    )
+    if not should_rewrite:
+        should_rewrite = _facade()._is_missing_tool_output_error(
+            code=normalized_code,
+            param=parsed_error.param_state if parsed_error else OpenAIErrorParam.absent(),
+            message=normalized_message,
+        )
+        reason = "missing_tool_output"
+    if not should_rewrite and _facade()._is_previous_response_not_found_public_shape(
+        code=normalized_code,
+        param=parsed_error.param_state if parsed_error else OpenAIErrorParam.absent(),
+        message=normalized_message,
+    ):
+        should_rewrite = True
+        reason = PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON
+        if request_state is not None:
+            request_state.previous_response_not_found_recovery_blocked = True
+    if not should_rewrite:
+        return status_code, payload, error_code, error_message
+
+    rewritten_code, rewritten_message = _websocket_continuity_error_fields(
+        reason=reason,
+        expose_stale_previous_response_classifier=expose_stale_previous_response_classifier,
+    )
+    if request_state is not None and reason == "previous_response_not_found":
+        _record_websocket_stale_anchor_failure(
+            request_state,
+            surface=surface,
+            upstream_error_code=normalized_code,
+        )
+    else:
+        _record_continuity_fail_closed(
+            surface=surface,
+            reason=reason,
+            previous_response_id=previous_response_id,
+            session_id=session_id,
+            upstream_error_code=normalized_code,
+        )
+    return (
+        502,
+        openai_error(
+            rewritten_code,
+            rewritten_message,
+            error_type="server_error",
+        ),
+        rewritten_code,
+        rewritten_message,
+    )
+
+
+def _sanitize_websocket_terminal_error_fields(
+    *,
+    request_state: _WebSocketRequestState,
+    error_code: str,
+    error_message: str,
+    error_type: str,
+    error_param: OpenAIErrorParam | JsonValue | None,
+) -> tuple[str, str, str, OpenAIErrorParam | None]:
+    error_param_state = coerce_error_param(error_param)
+    if request_state.websocket_terminal_error_fields_sanitized:
+        return (
+            error_code,
+            error_message,
+            error_type,
+            error_param_state if error_param_state.present else None,
+        )
+    normalized_code = _normalize_error_code(error_code, error_type)
+    recoverable = _facade()._is_previous_response_not_found_error(
+        code=normalized_code,
+        param=error_param_state,
+        message=error_message,
+    )
+    if not recoverable and not _facade()._is_previous_response_not_found_public_shape(
+        code=normalized_code,
+        param=error_param_state,
+        message=error_message,
+    ):
+        return error_code, error_message, error_type, error_param_state
+    if recoverable:
+        _record_websocket_stale_anchor_failure(
+            request_state,
+            surface="websocket_terminal",
+            upstream_error_code=normalized_code,
+        )
+    else:
+        request_state.previous_response_not_found_recovery_blocked = True
+        _record_continuity_fail_closed(
+            surface="websocket_terminal",
+            reason=PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON,
+            previous_response_id=request_state.previous_response_id,
+            session_id=request_state.session_id,
+            upstream_error_code=normalized_code,
+        )
+    rewritten_code, rewritten_message = _websocket_continuity_error_fields(
+        reason="previous_response_not_found" if recoverable else PREVIOUS_RESPONSE_MALFORMED_PARAM_REASON,
+        expose_stale_previous_response_classifier=request_state.expose_stale_previous_response_classifier,
+    )
+    request_state.websocket_terminal_error_fields_sanitized = True
+    return (
+        rewritten_code,
+        rewritten_message,
+        "server_error",
+        None,
+    )
+
+
+def _find_websocket_request_state_by_response_id(
+    pending_requests: deque[_WebSocketRequestState],
+    response_id: str,
+) -> _WebSocketRequestState | None:
+    for request_state in pending_requests:
+        if request_state.response_id == response_id:
+            return request_state
+    return None
+
+
+def _assign_websocket_response_id(
+    pending_requests: deque[_WebSocketRequestState],
+    response_id: str | None,
+) -> _WebSocketRequestState | None:
+    if response_id is None:
+        return None
+    existing = _find_websocket_request_state_by_response_id(pending_requests, response_id)
+    if existing is not None:
+        return existing
+    for request_state in pending_requests:
+        if request_state.response_id is None and _http_bridge_request_counts_against_queue(request_state):
+            request_state.response_id = response_id
+            return request_state
+    for request_state in pending_requests:
+        if request_state.response_id is None and request_state.draining_until_terminal:
+            request_state.response_id = response_id
+            return request_state
+    for request_state in pending_requests:
+        if request_state.response_id is None:
+            request_state.response_id = response_id
+            return request_state
+    return None
+
+
+def _draining_websocket_request_states(
+    pending_requests: deque[_WebSocketRequestState],
+) -> list[_WebSocketRequestState]:
+    return [request_state for request_state in pending_requests if request_state.draining_until_terminal]
+
+
+def _is_response_output_event(event_type: str | None) -> bool:
+    """A ``response.*`` frame that is neither a terminal nor an error carries response output."""
+    return (
+        isinstance(event_type, str)
+        and event_type.startswith("response.")
+        and event_type not in {"response.completed", "response.failed", "response.incomplete"}
+    )
+
+
+def _match_websocket_request_state_for_anonymous_event(
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    prefer_previous_response_not_found: bool,
+    previous_response_id_hint: str | None = None,
+    error_message: str | None = None,
+    allow_unanchored_previous_response_error: bool = False,
+    prefer_draining_requests: bool = True,
+    event_type: str | None = None,
+) -> _WebSocketRequestState | None:
+    if prefer_previous_response_not_found:
+        return _match_websocket_request_state_for_previous_response_error(
+            pending_requests,
+            previous_response_id_hint=previous_response_id_hint,
+            error_message=error_message,
+            allow_unanchored_previous_response_error=allow_unanchored_previous_response_error,
+        )
+
+    if _is_response_output_event(event_type):
+        # Output frames carry no response id. On a pipelined socket they belong
+        # to the one response upstream has already created, whether that request
+        # is still visible or draining, never to a sibling still waiting for its
+        # own response.created (issue #2350). Vendor telemetry such as
+        # ``codex.rate_limits`` keeps the pre-created ownership below.
+        created_requests = [
+            request_state for request_state in pending_requests if request_state.response_id is not None
+        ]
+        if len(created_requests) == 1:
+            return created_requests[0]
+
+    visible_requests = [
+        request_state for request_state in pending_requests if _http_bridge_request_counts_against_queue(request_state)
+    ]
+    draining_requests = _draining_websocket_request_states(pending_requests)
+    if prefer_draining_requests and draining_requests:
+        unresolved_draining_requests = [
+            request_state for request_state in draining_requests if request_state.response_id is None
+        ]
+        if len(unresolved_draining_requests) == 1:
+            return unresolved_draining_requests[0]
+        if not visible_requests:
+            return draining_requests[0]
+
+    if len(visible_requests) == 1:
+        return visible_requests[0]
+
+    unresolved_visible_requests = [
+        request_state for request_state in visible_requests if request_state.response_id is None
+    ]
+    if len(unresolved_visible_requests) == 1:
+        return unresolved_visible_requests[0]
+
+    if not visible_requests and draining_requests:
+        unresolved_draining_requests = [
+            request_state for request_state in draining_requests if request_state.response_id is None
+        ]
+        if len(unresolved_draining_requests) == 1:
+            return unresolved_draining_requests[0]
+        return draining_requests[0]
+
+    return None
+
+
+def _match_websocket_request_state_for_precreated_terminal_event(
+    pending_requests: deque[_WebSocketRequestState],
+) -> _WebSocketRequestState | None:
+    unresolved_requests = [
+        request_state
+        for request_state in pending_requests
+        if request_state.response_id is None and request_state.awaiting_response_created
+    ]
+    if len(unresolved_requests) == 1:
+        return unresolved_requests[0]
+    return None
+
+
+def _match_websocket_request_state_for_previous_response_error(
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    previous_response_id_hint: str | None = None,
+    error_message: str | None = None,
+    allow_unanchored_previous_response_error: bool = False,
+) -> _WebSocketRequestState | None:
+    matching_requests = _matching_websocket_request_states_for_previous_response_error(
+        pending_requests,
+        previous_response_id_hint=previous_response_id_hint,
+        error_message=error_message,
+        allow_unanchored_previous_response_error=allow_unanchored_previous_response_error,
+    )
+    if len(matching_requests) == 1:
+        return matching_requests[0]
+    return None
+
+
+def _is_unanchored_previous_response_error_message(message: str | None) -> bool:
+    if message is None:
+        return False
+    normalized = " ".join(message.casefold().replace("`", "").split()).removesuffix(".").rstrip()
+    return normalized == "invalid previous_response_id"
+
+
+def _matching_websocket_request_states_for_previous_response_error(
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    previous_response_id_hint: str | None = None,
+    error_message: str | None = None,
+    allow_unanchored_previous_response_error: bool = False,
+) -> list[_WebSocketRequestState]:
+    followup_requests = [
+        request_state for request_state in pending_requests if request_state.previous_response_id is not None
+    ]
+    if not followup_requests:
+        if allow_unanchored_previous_response_error and len(pending_requests) == 1:
+            return [pending_requests[0]]
+        return []
+    if previous_response_id_hint is not None:
+        matching_requests = [
+            request_state
+            for request_state in followup_requests
+            if request_state.previous_response_id == previous_response_id_hint
+        ]
+        if matching_requests:
+            return matching_requests
+    if error_message is not None:
+        matching_requests = [
+            request_state
+            for request_state in followup_requests
+            if _facade()._message_mentions_previous_response_id(error_message, request_state.previous_response_id)
+        ]
+        if matching_requests:
+            return matching_requests
+    unresolved_followups = [request_state for request_state in followup_requests if request_state.response_id is None]
+    if len(unresolved_followups) == 1:
+        return unresolved_followups
+    if len(unresolved_followups) > 1:
+        unique_previous_response_ids = {
+            request_state.previous_response_id
+            for request_state in unresolved_followups
+            if request_state.previous_response_id
+        }
+        if len(unique_previous_response_ids) == 1:
+            return unresolved_followups
+    if (
+        allow_unanchored_previous_response_error
+        and len(followup_requests) == 1
+        and _is_unanchored_previous_response_error_message(error_message)
+    ):
+        # A post-created terminal error may omit both its response id and the
+        # rejected anchor id. When exactly one follow-up is pending, its
+        # previous-response ownership is the only safe correlation seam even
+        # after ``response.created`` assigned a response id.
+        return followup_requests
+    return []
+
+
+def _matching_websocket_request_states_for_missing_tool_output_error(
+    pending_requests: deque[_WebSocketRequestState],
+) -> list[_WebSocketRequestState]:
+    unresolved_followups = [
+        request_state
+        for request_state in pending_requests
+        if request_state.response_id is None and request_state.previous_response_id is not None
+    ]
+    if len(unresolved_followups) <= 1:
+        return unresolved_followups
+    unique_previous_response_ids = {
+        request_state.previous_response_id
+        for request_state in unresolved_followups
+        if request_state.previous_response_id
+    }
+    if len(unique_previous_response_ids) == 1:
+        return unresolved_followups
+    return []
+
+
+def _pop_matching_websocket_request_states(
+    pending_requests: deque[_WebSocketRequestState],
+    matching_requests: list[_WebSocketRequestState],
+) -> list[_WebSocketRequestState]:
+    popped_requests: list[_WebSocketRequestState] = []
+    for request_state in matching_requests:
+        try:
+            pending_requests.remove(request_state)
+        except ValueError:
+            continue
+        popped_requests.append(request_state)
+    return popped_requests
+
+
+async def _release_websocket_response_create_gate(
+    request_state: _WebSocketRequestState,
+    response_create_gate: asyncio.Semaphore,
+    *,
+    scheduler: Scheduler,
+) -> None:
+    """Release every create owner; ``scheduler`` owns the deferred lease-release task."""
+
+    cancellation: asyncio.CancelledError | None = None
+    account_response_create_lease = request_state.account_response_create_lease
+    account_response_create_release = request_state.account_response_create_release
+    request_state.account_response_create_lease = None
+    request_state.account_response_create_release = None
+    if request_state.response_create_admission is not None:
+        request_state.response_create_admission.release()
+        request_state.response_create_admission = None
+    if account_response_create_lease is not None and account_response_create_release is not None:
+        cancellation = await _await_cleanup_deferring_cancellation(
+            account_response_create_release(account_response_create_lease),
+            scheduler=scheduler,
+        )
+    request_state.awaiting_response_created = False
+    request_state.response_create_gate = None
+    if not request_state.response_create_gate_acquired:
+        if cancellation is not None:
+            raise cancellation
+        return
+    request_state.response_create_gate_acquired = False
+    response_create_gate.release()
+    if cancellation is not None:
+        raise cancellation
+
+
+def _pop_terminal_websocket_request_state(
+    pending_requests: deque[_WebSocketRequestState],
+    *,
+    response_id: str | None,
+    fallback_request_state: _WebSocketRequestState | None,
+    prefer_previous_response_not_found: bool = False,
+    previous_response_id_hint: str | None = None,
+    error_message: str | None = None,
+    allow_unanchored_previous_response_error: bool = False,
+    allow_precreated_terminal_fallback: bool = False,
+    prefer_draining_requests: bool = True,
+) -> _WebSocketRequestState | None:
+    if response_id is not None:
+        request_state = _find_websocket_request_state_by_response_id(pending_requests, response_id)
+        if request_state is not None:
+            pending_requests.remove(request_state)
+            return request_state
+    if fallback_request_state is not None and fallback_request_state in pending_requests:
+        pending_requests.remove(fallback_request_state)
+        return fallback_request_state
+    if response_id is not None and allow_precreated_terminal_fallback:
+        request_state = _match_websocket_request_state_for_precreated_terminal_event(pending_requests)
+        if request_state is not None and request_state in pending_requests:
+            pending_requests.remove(request_state)
+            return request_state
+    if response_id is not None and prefer_previous_response_not_found:
+        request_state = _match_websocket_request_state_for_previous_response_error(
+            pending_requests,
+            previous_response_id_hint=previous_response_id_hint,
+            error_message=error_message,
+            allow_unanchored_previous_response_error=allow_unanchored_previous_response_error,
+        )
+        if request_state is not None and request_state in pending_requests:
+            pending_requests.remove(request_state)
+            return request_state
+    if response_id is None:
+        request_state = _match_websocket_request_state_for_anonymous_event(
+            pending_requests,
+            prefer_previous_response_not_found=prefer_previous_response_not_found,
+            previous_response_id_hint=previous_response_id_hint,
+            error_message=error_message,
+            allow_unanchored_previous_response_error=allow_unanchored_previous_response_error,
+            prefer_draining_requests=prefer_draining_requests,
+        )
+        if request_state is not None and request_state in pending_requests:
+            pending_requests.remove(request_state)
+            return request_state
+    return None
+
+
+def _upstream_websocket_disconnect_message(message: UpstreamWebSocketMessage) -> str:
+    if message.kind == "error" and message.error:
+        return f"Upstream websocket closed before response.completed: {message.error}"
+    if message.close_code is not None:
+        return f"Upstream websocket closed before response.completed (close_code={message.close_code})"
+    return "Upstream websocket closed before response.completed"
+
+
+def _websocket_receive_timeout_for_pending_requests(
+    started_ats: Sequence[float],
+    *,
+    proxy_request_budget_seconds: float,
+    stream_idle_timeout_seconds: float,
+    now: float,
+) -> _WebSocketReceiveTimeout | None:
+    if not started_ats:
+        return None
+
+    idle_timeout_seconds = max(0.001, stream_idle_timeout_seconds)
+    oldest_started_at = min(started_ats)
+    budget_deadline = oldest_started_at + proxy_request_budget_seconds
+    # ``started_ats`` come from the owner's clock; ``now`` must too.
+    remaining_budget = max(0.0, budget_deadline - now)
+    idle_timeout_matches_request_budget = idle_timeout_seconds == max(0.001, proxy_request_budget_seconds)
+
+    if remaining_budget <= 0 and idle_timeout_matches_request_budget:
+        return _WebSocketReceiveTimeout(
+            timeout_seconds=0.0,
+            error_code="stream_idle_timeout",
+            error_message="Upstream stream idle timeout",
+        )
+    if idle_timeout_matches_request_budget and remaining_budget >= idle_timeout_seconds:
+        return _WebSocketReceiveTimeout(
+            timeout_seconds=remaining_budget,
+            error_code="stream_idle_timeout",
+            error_message="Upstream stream idle timeout",
+        )
+    if remaining_budget <= 0:
+        return _WebSocketReceiveTimeout(
+            timeout_seconds=0.0,
+            error_code="upstream_request_timeout",
+            error_message="Proxy request budget exhausted",
+        )
+    if idle_timeout_seconds < remaining_budget:
+        return _WebSocketReceiveTimeout(
+            timeout_seconds=idle_timeout_seconds,
+            error_code="stream_idle_timeout",
+            error_message="Upstream stream idle timeout",
+            fail_all_pending=True,
+        )
+    return _WebSocketReceiveTimeout(
+        timeout_seconds=remaining_budget,
+        error_code="upstream_request_timeout",
+        error_message="Proxy request budget exhausted",
+    )
+
+
+class _WebSocketJsonObject(dict[str, JsonValue]):
+    def __init__(self, pairs: list[tuple[str, JsonValue]]) -> None:
+        super().__init__(pairs)
+        self.raw_pairs = tuple(pairs)
+
+
+def _parse_websocket_payload(text: str) -> dict[str, JsonValue] | None:
+    try:
+        payload = json.loads(text, object_pairs_hook=_WebSocketJsonObject)
+    except json.JSONDecodeError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    return payload
+
+
+def _websocket_capability_metadata_values(payload: dict[str, JsonValue]) -> tuple[JsonValue, ...] | None:
+    normalized_name = CODEX_LB_REQUIRED_CAPABILITY_HEADER.lower()
+    payload_pairs = payload.raw_pairs if isinstance(payload, _WebSocketJsonObject) else tuple(payload.items())
+    misplaced_values = [value for key, value in payload_pairs if key.lower() == normalized_name]
+    if misplaced_values:
+        # The reserved per-frame carrier is valid only inside
+        # ``client_metadata``. Surface a deliberately ambiguous carrier set so
+        # the shared parser rejects any top-level placement before selection.
+        return (misplaced_values[0], misplaced_values[0])
+    if not isinstance(payload, _WebSocketJsonObject):
+        return None
+    metadata_objects = [value for key, value in payload.raw_pairs if key == "client_metadata"]
+    values: list[JsonValue] = []
+    for metadata in metadata_objects:
+        if not isinstance(metadata, _WebSocketJsonObject):
+            continue
+        values.extend(value for key, value in metadata.raw_pairs if key.lower() == normalized_name)
+    if len(metadata_objects) > 1 and values:
+        # A duplicate top-level metadata container can otherwise erase the
+        # sole marker through last-key-wins JSON decoding. Treat the carrier
+        # as ambiguous so routing fails before selection.
+        values.append(values[0])
+    return tuple(values)
+
+
+def _is_websocket_response_create(payload: dict[str, JsonValue]) -> bool:
+    payload_type = payload.get("type")
+    return isinstance(payload_type, str) and payload_type == "response.create"
+
+
+def _app_error_to_websocket_event(exc: AppError) -> dict[str, JsonValue]:
+    payload = openai_error(exc.code, exc.message, error_type=getattr(exc, "error_type", "server_error"))
+    if exc.param is not None:
+        payload["error"]["param"] = exc.param
+    return _wrapped_websocket_error_event(
+        exc.status_code,
+        payload,
+    )
+
+
+def _wrapped_websocket_error_event(
+    status_code: int,
+    payload: OpenAIErrorEnvelope,
+    *,
+    expose_stale_previous_response_classifier: bool = False,
+) -> dict[str, JsonValue]:
+    error = payload["error"]
+    error_code = _normalize_error_code(
+        error.get("code"),
+        error.get("type"),
+    )
+    error_param = OpenAIErrorParam.from_mapping(cast(Mapping[str, JsonValue], error))
+    error_message = error.get("message")
+    if _facade()._is_previous_response_not_found_public_shape(
+        code=error_code,
+        param=error_param,
+        message=error_message,
+    ):
+        status_code = 502
+        # On the Codex-native route, the caller has already sanitized this to
+        # the canonical code (see _sanitize_websocket_previous_response_error);
+        # do not re-mask it back to stream_incomplete. Every other caller
+        # (public /v1, or a raw error this function is seeing for the first
+        # time) keeps the existing stream_incomplete safety net.
+        expose = expose_stale_previous_response_classifier and _facade()._is_previous_response_not_found_error(
+            code=error_code,
+            param=error_param,
+            message=error_message,
+        )
+        if not expose:
+            payload = previous_response_stream_incomplete_error()
+    error_payload = cast(
+        JsonValue,
+        sanitize_public_error_detail(cast(Mapping[str, JsonValue], payload["error"])),
+    )
+    event: dict[str, JsonValue] = {
+        "type": "error",
+        "status": status_code,
+        "error": error_payload,
+    }
+    return event
+
+
+def _serialize_websocket_error_event(payload: dict[str, JsonValue]) -> str:
+    return json.dumps(payload, ensure_ascii=True, separators=(",", ":"))
+
+
+def _trim_websocket_previous_response_input_items(input_items: list[JsonValue]) -> list[JsonValue]:
+    first_output_index = next(
+        (
+            index
+            for index, item in enumerate(input_items)
+            if _websocket_input_item_type(item)
+            in {"function_call_output", "custom_tool_call_output", "apply_patch_call_output"}
+        ),
+        None,
+    )
+    if first_output_index is None or first_output_index == 0:
+        return input_items
+    prefix = input_items[:first_output_index]
+    if not all(_is_websocket_previous_response_output_item(item) for item in prefix):
+        return input_items
+    return input_items[first_output_index:]
+
+
+def _is_websocket_previous_response_output_item(item: JsonValue) -> bool:
+    if isinstance(item, dict) and _websocket_input_item_type(item) is None and item.get("role") == "assistant":
+        return True
+    item_type = _websocket_input_item_type(item)
+    if item_type in {"reasoning", "function_call", "custom_tool_call", "apply_patch_call"}:
+        return True
+    if item_type != "message" or not isinstance(item, dict):
+        return False
+    return item.get("role") == "assistant"
+
+
+def _websocket_input_item_type(item: JsonValue) -> str | None:
+    if not isinstance(item, dict):
+        return None
+    item_type = item.get("type")
+    return item_type if isinstance(item_type, str) else None
+
+
+def _websocket_connect_deadline(request_state: _WebSocketRequestState, budget_seconds: float, *, now: float) -> float:
+    # ``now`` is the owner's clock sample: the fallback for a request state
+    # without a start stamp must live in the same time domain as the budget
+    # checks that later compare against this deadline.
+    started_at = request_state.started_at if request_state.started_at > 0 else now
+    return started_at + budget_seconds