lidge-jun · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -149,6 +149,9 @@ its request and attempt failure cause is `transport-ambiguous`, with resend perm
 `refused-ambiguous`: the upstream may already have processed the turn. A genuine provider
 429 remains `rate-limit` with resend permission `permitted`.
 
+A Codex move to another account after HTTP 402 appears as **Account quota exhausted (402)**
+in the attempt's recovery details and counts as a quota recovery in exported metrics.
+
 Logs filters combine surface, intercepted requests, provider, exact model, status, time,
 speed, and conversation ID over the currently loaded request ring. Provider and model
 choices also include fallback attempts; model matching ignores case and surrounding spaces
@@ -207,8 +210,10 @@ without a matching price or usable usage are counted as excluded beside that amo
 reports pricing coverage fields. Usage that was only partly measured (`unreported` or `unsupported`)
 is not priced, and one excluded part excludes the whole request from that row's priced count. A
 leg that reached no upstream, or that upstream refused with an HTTP error before any output, spent
-nothing and does not; a leg whose response began (or ended without a status) but reported no usage
-may have been billed, so it does. A row with only excluded requests shows an em dash with that count
+nothing and does not; a client cancellation (499), or a leg whose response began or ended without
+a status but reported no usage, may have been billed, so it does. A refusal followed by a measured
+successful send contributes that send's cost to the summary even when the aggregate usage status
+is `unreported`. A row with only excluded requests shows an em dash with that count
 instead of a zero-dollar estimate, and a displayed zero-dollar value is a confirmed priced estimate.
 An older proxy that reports no coverage fields keeps a bare em dash with no count, so missing
 coverage stays distinct from an all-excluded row and from a confirmed zero estimate.

@@ -1148,6 +1148,7 @@ export const de: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API-Schlüssel erneut authentifiziert",
   "logs.detail.attempt.recovery.oauthAccount403": "Kontovalidierung erforderlich (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Konto rate-limitiert (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Kontingent des Kontos erschöpft (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Veralteter verschlüsselter Zustand verworfen",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Reasoning-Aufwand reduziert",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Schnellmodus abgelehnt, erneut mit Standardtempo versucht",

@@ -1206,6 +1206,7 @@ export const en = {
   "logs.detail.attempt.recovery.key401": "API key re-authentication",
   "logs.detail.attempt.recovery.oauthAccount403": "Account validation required (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Account rate-limited (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Account quota exhausted (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Stale encrypted state dropped",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Reasoning effort downgraded",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Fast mode refused, retried at standard speed",

@@ -1182,6 +1182,7 @@ export const fr: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "Ré-authentification de la clé API",
   "logs.detail.attempt.recovery.oauthAccount403": "Validation du compte requise (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Compte limité (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Quota du compte épuisé (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "État chiffré obsolète abandonné",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Effort de raisonnement réduit",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Mode rapide refusé, nouvel essai à vitesse standard",

@@ -1089,6 +1089,7 @@ export const ja: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API キーの再認証",
   "logs.detail.attempt.recovery.oauthAccount403": "アカウントの検証が必要 (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "アカウントのレート制限 (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "アカウントのクォータ枯渇 (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "古い暗号化状態を破棄",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "推論強度を下げて再試行",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "高速モードが拒否され、標準速度で再試行",

@@ -1187,6 +1187,7 @@ export const ko: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API 키 재인증",
   "logs.detail.attempt.recovery.oauthAccount403": "계정 확인 필요 (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "계정 속도 제한 (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "계정 할당량 소진 (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "만료된 암호화 상태 제거",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "추론 강도 하향",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "빠른 모드 거부, 표준 속도로 재시도",

@@ -1201,6 +1201,7 @@ export const pt: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "Reautenticação da chave de API",
   "logs.detail.attempt.recovery.oauthAccount403": "Validação da conta necessária (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Conta com limite de taxa (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Cota da conta esgotada (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Estado criptografado obsoleto descartado",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Esforço de raciocínio reduzido",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Modo rápido recusado, repetido em velocidade padrão",

@@ -1165,6 +1165,7 @@ export const ru: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "Повторная аутентификация API-ключа",
   "logs.detail.attempt.recovery.oauthAccount403": "Требуется проверка аккаунта (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Ограничение частоты для аккаунта (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Квота аккаунта исчерпана (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Устаревшее зашифрованное состояние отброшено",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Уровень рассуждения понижен",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Быстрый режим отклонён, повтор со стандартной скоростью",

@@ -1192,6 +1192,7 @@ export const tr: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API anahtarı yeniden doğrulandı",
   "logs.detail.attempt.recovery.oauthAccount403": "Hesap doğrulaması gerekli (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Hesap hız sınırına takıldı (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Hesap kotası tükendi (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Eski şifreli durum bırakıldı",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Akıl yürütme düzeyi düşürüldü",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Hızlı mod reddedildi, standart hızda yeniden denendi",

@@ -1186,6 +1186,7 @@ export const vi: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "Xác thực lại khóa API",
   "logs.detail.attempt.recovery.oauthAccount403": "Cần xác minh tài khoản (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "Tài khoản bị giới hạn tần suất (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "Tài khoản đã hết hạn mức (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "Đã bỏ trạng thái mã hóa cũ",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "Đã giảm mức suy luận",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "Chế độ nhanh bị từ chối, thử lại ở tốc độ chuẩn",

@@ -3002,6 +3002,7 @@ export const zhTW: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API 金鑰重新驗證",
   "logs.detail.attempt.recovery.oauthAccount403": "需要驗證帳號 (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "帳號速率受限 (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "帳號配額已用盡 (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "已捨棄過期加密狀態",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "已降低推理強度",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "快速模式遭拒，改以標準速度重試",

@@ -1160,6 +1160,7 @@ export const zh: Record<TKey, string> = {
   "logs.detail.attempt.recovery.key401": "API 密钥重新认证",
   "logs.detail.attempt.recovery.oauthAccount403": "需要验证账号 (403)",
   "logs.detail.attempt.recovery.oauthAccount429": "账号速率受限 (429)",
+  "logs.detail.attempt.recovery.oauthAccount402": "账号配额已用尽 (402)",
   "logs.detail.attempt.recovery.opaqueBlobRejection": "已丢弃过期加密状态",
   "logs.detail.attempt.recovery.reasoningEffortDowngrade": "已降低推理强度",
   "logs.detail.attempt.recovery.anthropicFastDowngrade": "快速模式被拒，按标准速度重试",

@@ -355,6 +355,7 @@ const RECOVERY_KIND_KEYS = {
   "rate-limit-429": "logs.detail.attempt.recovery.rateLimit429",
   "anthropic-oauth-429": "logs.detail.attempt.recovery.anthropicOauth429",
   "oauth-account-429": "logs.detail.attempt.recovery.oauthAccount429",
+  "oauth-account-402": "logs.detail.attempt.recovery.oauthAccount402",
   "image-413": "logs.detail.attempt.recovery.image413",
   "empty-completion": "logs.detail.attempt.recovery.emptyCompletion",
   "console-go-upload-retry": "logs.detail.attempt.recovery.consoleGoUpload",

@@ -1416,7 +1416,7 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
                 } else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string" && serverSearch?.streaming
                     && serverSearch.json.length < 4096) {
                   // Capped: an input past 4 KiB loses its label (query / url), never the call.
-                  serverSearch.json += delta.partial_json;
+                  serverSearch.json += delta.partial_json.slice(0, 4096 - serverSearch.json.length);
                 }
                 break;
               }

@@ -223,6 +223,8 @@ const RECOVERY_KIND_CAUSE = {
   "rate-limit-429": "rate-limit",
   "anthropic-oauth-429": "rate-limit",
   "oauth-account-429": "rate-limit",
+  // A 402 is the account's quota, not a transient limit; only another account can serve it.
+  "oauth-account-402": "quota-exhausted",
   "image-413": "payload-too-large",
   // The gateway rejects a body it accepts seconds later and the replay is byte-identical, so
   // nothing about the payload was wrong; the origin declined to take it at that moment.

@@ -483,7 +483,8 @@ export function noteGenericPoolSelection(
  * Cool the account that actually 429'd and name the next eligible one, or null.
  *
  * Returns the id only; the caller mints the credential so a failed refresh does not leave the
- * cooldown applied to an account we then could not use.
+ * cooldown applied to an account we then could not use. `commit: false` still cools the failed
+ * account but only peeks the round-robin ring, for callers that will not dispatch the answer.
  */
 export function rotateGenericOAuthAccountOn429(
   config: OcxConfig,
@@ -492,9 +493,10 @@ export function rotateGenericOAuthAccountOn429(
   retryAfterHeader: string | null | undefined,
   now = Date.now(),
   requestedModelId?: string | null,
+  commit = true,
 ): string | null {
   return rotateGenericOAuthAccountOnRefusal(config, providerName, failedAccountId, "rate",
-    retryAfterHeader, now, requestedModelId);
+    retryAfterHeader, now, requestedModelId, undefined, commit);
 }
 
 /** Kiro adds account-scoped refusal classes; all other providers retain their 429 policy. */
@@ -507,6 +509,7 @@ export function rotateGenericOAuthAccountOnRefusal(
   now = Date.now(),
   requestedModelId?: string | null,
   monthlyCooldownMs?: number,
+  commit = true,
 ): string | null {
   if (kind === "other" || (providerName !== "kiro" && kind !== "rate")) return null;
   if (!isGenericOAuthFailoverEnabled(config, providerName)) return null;
@@ -566,8 +569,8 @@ export function rotateGenericOAuthAccountOnRefusal(
   }
   if (strategy === "round-robin") {
     // PICK here, not peek: the failure already happened and this answer is the one being used,
-    // so the ring genuinely advances.
-    return pickRoundRobinAccount(
+    // so the ring genuinely advances. A caller that only asks whether a sibling exists peeks.
+    return (commit ? pickRoundRobinAccount : peekRoundRobinAccount)(
       genericPoolKey(providerName),
       candidates,
       genericStickyLimit(config, providerName),

@@ -122,6 +122,7 @@ const COOLDOWN_RECOVERY_KINDS = new Set([
   "oauth-account-403",
   "anthropic-oauth-429",
   "oauth-account-429",
+  "oauth-account-402",
 ]);
 
 function percentile(sorted: number[], p: number): number | undefined {

@@ -975,8 +975,8 @@ export async function retryCodexPoolOnAlternateAccount(
   const maxRetrySends = retrySameConfirmedAccount ? 7 : 1;
   let retrySendCount = 0;
   // The gated-model 400 has no roster kind; it stays unattributed as before.
-  const moveRecovery: AttemptRecoveryKind | undefined = outcomeStatus === 429 || outcomeStatus === 402
-    ? "oauth-account-429"
+  const moveRecovery: AttemptRecoveryKind | undefined = outcomeStatus === 429 ? "oauth-account-429"
+    : outcomeStatus === 402 ? "oauth-account-402"
     : isTransientUpstreamStatus(outcomeStatus) ? "transient-5xx" : undefined;
   let upstreamResponse: Response;
   try {

@@ -144,7 +144,8 @@ function cooledPoolAccountLabel(config: OcxConfig, providerName: string, modelId
  * through `accountLogLabel`, but the per-request account budget can end the pool's own rotation
  * before the last refused account is recorded. Hand that account to the pool's rotator, which
  * cools it under the pool's own Retry-After policy, and spare the target only when the pool still
- * has an eligible sibling. A lone account or an all-cooled pool returns null and cools the target.
+ * has an eligible sibling. The rotator only peeks round-robin here: nothing is sent to that sibling.
+ * A lone account or an all-cooled pool returns null and cools the target.
  */
 function cooledGenericOAuthAccountLabel(
   config: OcxConfig, providerName: string, modelId: string, label: string | undefined, retryAfter: string | undefined,
@@ -155,7 +156,7 @@ function cooledGenericOAuthAccountLabel(
   const matches = getAccountSet(providerName)?.accounts.filter(account =>
     oauthAccountLogLabel(account.id, base) === label) ?? [];
   return matches.length === 1
-    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId)
+    && rotateGenericOAuthAccountOn429(config, providerName, matches[0]!.id, retryAfter, Date.now(), modelId, false)
     ? label : undefined;
 }
 

@@ -665,8 +665,12 @@ function addEstimatedCost(
   entry: Pick<PersistedUsageEntry, "usageStatus" | "usage" | "attempts">,
   costInfo: EntryCostInfo,
 ): void {
-  if (entry.usageStatus === "unreported" || entry.usageStatus === "unsupported"
-    || (!entry.usage && !entry.attempts?.length)) {
+  // A row of attempts reads `unreported` when any leg lacks usage. Once one leg is measured the row
+  // is metered and the attempt-level pricing decides, matching the model and provider breakdowns.
+  const measuredAttempt = entry.attempts?.some(attempt => attempt.usage && isMeasuredStatus(attempt.usageStatus));
+  if (!measuredAttempt
+    && (entry.usageStatus === "unreported" || entry.usageStatus === "unsupported"
+      || (!entry.usage && !entry.attempts?.length))) {
     totals.unmeteredRequests += 1;
     return;
   }
@@ -822,7 +826,9 @@ function blankRequestCounts(): UsageRequestCounts {
 function spentNothing(attempt: NonNullable<PersistedUsageEntry["attempts"]>[number] | undefined): boolean {
   if (!attempt || attempt.usage) return false;
   if (attempt.sendCount === 0 || attempt.locallyAnswered === true) return true;
-  return attempt.status >= 400 && attempt.streamAborted !== true && attempt.firstOutputMs === undefined;
+  // A 499 is the client hanging up on a send upstream may already be generating for.
+  return attempt.status >= 400 && attempt.status !== 499
+    && attempt.streamAborted !== true && attempt.firstOutputMs === undefined;
 }
 
 function bumpRequestCounts(counts: UsageRequestCounts, facts: number, amount = 1): void {

@@ -32,6 +32,7 @@ export const ATTEMPT_RECOVERY_KIND_ROSTER = Object.freeze([
   "rate-limit-429",
   "anthropic-oauth-429",
   "oauth-account-429",
+  "oauth-account-402",
   "image-413",
   "console-go-upload-retry",
   "opaque-blob-rejection",