fix(combos): peek the round-robin ring in the combo's sibling check

[vadymhimself]

Summary

• Codex review on fix: carry OAuth combo cooldown, account rotation and health evidence fixes #7224 (core-combo.ts sibling check): with pool.kernel on and the generic OAuth round-robin strategy, a combo-level 429 after the account budget was spent called rotateGenericOAuthAccountOn429 only to test whether a healthy sibling exists. That rotator commits pickRoundRobinAccount, so the pool cursor moved to an account no request was sent to.
• rotateGenericOAuthAccountOn429 / rotateGenericOAuthAccountOnRefusal take commit = true. The combo passes false, so the spent account is still cooled, but the successor is only peeked via the existing peekRoundRobinAccount.

Follow-up to the batch-2 bundle (#7224/#7225), which landed at a head from before this review finding was fixed on the source PR. The same commit was offered on the bundle.

Verification

• Red on dev 7a42860 with only the new test: bun test tests/oauth/generic-oauth-combo-account-cooldown.test.ts gives 2 pass, 1 fail. After a 4-of-5-spent request the ring stays on account 5, which was never sent.
• Green: 14 pass, 0 fail (with the layout and ratchet guards).
• bun x tsc --noEmit: clean.
• tests/test-layout.test.ts and tests/ci-workflows/file-size-ratchet.test.ts: pass.
• Full suite not run locally; the change is confined to the files above and their focused tests.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

🤖 Generated with Claude Code

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Improved OAuth rate-limit failover handling: checking a fallback account no longer advances round-robin selection or sends a request to an account that wasn’t selected.
  • Failed accounts continue to be cooled down, while unsent accounts remain available for subsequent requests.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/generic-account-failover.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/generic-account-failover.ts.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[vadymhimself]

@coderabbitai full review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8f99f71e-4df3-44d2-ab2b-20e309a59a80

📥 Commits

Reviewing files that changed from the base of the PR and between 7a42860 and 9622793.

📒 Files selected for processing: 3

• src/oauth/generic-account-failover.ts
• src/server/responses/core-combo.ts
• tests/oauth/generic-oauth-combo-account-cooldown.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

Generic OAuth failover now supports checking a round-robin account without advancing the pool. The combo path uses this mode, and a regression test checks the fallback response, account requests, cooldown behavior, and pool position.

Changes: Generic OAuth failover

Layer / File(s)	Summary
Failover commit choice src/oauth/generic-account-failover.ts	The 429 and refusal helpers accept a commit argument, defaulting to true. Round-robin refusal handling picks an account when commit is true and peeks when false. The failed account is cooled in either case.
Combo eligibility probe src/server/responses/core-combo.ts, tests/oauth/generic-oauth-combo-account-cooldown.test.ts	The combo path passes false to the 429 rotator. The regression test verifies fallback behavior, confirms the fifth account is not requested, and checks that the pool position does not advance during the eligibility check.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: ⚪ Minimal · up to 96227

The combo checks for a healthy sibling without advancing the round-robin pool or dispatching an unintended request. The supplied change presents no actionable merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: the combo sibling check now peeks at the round-robin ring instead of advancing it.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Full review finished.

[lidge-jun]

Being carried into #7236 with your authorship preserved; this PR will be closed when the bundle lands.