fix(codex): attribute a pool account move to its recovery kind and real failed status

[vadymhimself]

Summary

• When a Codex pool request moves to an alternate account (retryCodexPoolOnAlternateAccount), the alternate send called noteProviderAttemptSend(...) with no recovery kind. The second physical send on the row therefore had no cause (a burn monitor cannot tell a funded rotation from a duplicate send, and opencodex_recoveries_total misses it), and the first account's sealed attempt carried an inferred 502 instead of the status it actually answered (e.g. 429), with a cause derived from that wrong status.
• The move now books its send with an existing roster kind, so no new kind is needed and no consumer changes: oauth-account-429 for a quota move (429/402, including a body-confirmed quota wrapped in 5xx), and transient-5xx for a transient 5xx move. The gated-model 400 move has no fitting roster kind and stays unattributed, as before.
• Before the send that seals the first account's attempt, the attempt takes the status that account returned on the wire, so the sealed row says 429 with failureCause: "rate-limit" rather than 502 / upstream-fault.

Verification

• Red on dev: the new assertions in tests/responses/responses-account-label.test.ts ("a pre-stream quota retry updates attribution to the serving alternate account") fail: the first account is sealed with status: 502 and neither attempt has a recovery kind.
• Green: bun test tests/responses/responses-account-label.test.ts 9/0.
• Related pool-move suites (responses-pool-overload-failover, codex-pool-rotation, responses-pool-401-refresh, server-auth, codex-quota-rejection, responses-account-change-scrub, codex-model-denial-evidence, responses-main-quota-observation, responses-alternate-main-cancellation): 466/0.
• bun run typecheck: clean.
• bun run test:changed: 14674 pass, 1 fail. The failure (tests/cli/cli-connect-readiness.test.ts > "a rejected preferred runtime falls back without rewriting the saved selection") fails identically on a clean dev checkout and does not touch this path.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Improved the accuracy of retry status reporting for account moves following rate limits and temporary upstream errors. Rate-limit retries are now distinguished from the original failed attempt, while gated-model retries remain unattributed. This provides clearer records of which attempts failed and which were retried.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[vadymhimself]

@coderabbitai review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: dd4b7b69-70ea-45b7-a508-e50a0d342046

📥 Commits

Reviewing files that changed from the base of the PR and between 60bf4c7 and 1444e2d.

📒 Files selected for processing: 2

• src/server/responses/core-codex-account.ts
• tests/responses/responses-account-label.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Account-move retries now record the first response status and classify quota and transient upstream responses. The retry test checks status, send count, recovery kind, and failure cause for both attempts.

Changes: Account-move retry attribution

Layer / File(s)	Summary
Classify and record retry attempts src/server/responses/core-codex-account.ts, tests/responses/responses-account-label.test.ts	The retry records the first response status and classifies 402 and 429 as oauth-account-429, and transient upstream statuses as transient-5xx. Gated-model 400 responses remain unclassified. The test checks attribution for both attempts.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: ⚪ Minimal · up to 1444e

The change records the original response and attributes the account move to the retry attempt. No actionable PR-introduced merge risk is established.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and clearly summarizes the main change: attributing Codex pool account moves to recovery kinds and recording the real failed status.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• UI screenshot required.

What to do

• Add a screenshot of the UI change to the PR description.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@vadymhimself Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[lidge-jun]

Being carried into #7224 with your authorship preserved; this PR will be closed when the bundle lands.

[lidge-jun]

Landed on dev in 6ccb47a via #7224 (your change is its own commit in that bundle, and the squash keeps your authorship as Co-authored-by). Thank you!