Summary
The 2.56.0 tree added and documented a transient half-open resolver plus a process-wide recovery ratio limiter in #4626, but the production request path does not call the new dispatch APIs.
Current exact refs checked:
Current behavior
A source search outside src/routing/probe-lease.ts finds no production caller of:
resolveHeldAccountDispatchsharedPoolBackpressurecreatePoolBackpressureLimiterrecordInitialSendtryPermitRetryDispatchtryPermitProbeDispatch
Only direct unit tests call the resolver and limiter. Existing production imports of this module are for the older Codex quota-probe lease functions (tryAcquireCodexQuotaProbeLease, ownsProbeLease, and related settlement helpers). Those do not connect the new transient-hold resolver or the pool-wide initial/recovery send ratio.
Consequently, the new unit tests prove the isolated primitives, but a burst of separate requests still has no shared limiter at the initial-send and retry/probe dispatch boundaries. The structure contract currently says the limiter is active, which overstates runtime behavior.
Expected behavior
Production account selection should consume resolveHeldAccountDispatch for a bound transiently held account, preserving its working detour while permitting only one half-open probe. Every physical first send should call the shared limiter's recordInitialSend; every retry and transient probe should obtain a recovery permit before dispatch.
A refusal must return a future retry time rather than busy-looping, must not consume the request-local send budget, and must not discard the remembered detour.
Required regression coverage
- Two concurrent requests bound to the same held account produce one probe and one detour/withheld result through the real request boundary.
- Many requests share one process-wide recovery ratio; separate request objects cannot each obtain a private allowance.
- A refused recovery dispatch performs no provider fetch and returns a bounded future retry signal.
- Success/failure/expiry settlement cannot overwrite a newer affinity generation.
- Existing quota-probe behavior remains unchanged.
Scope note
This is not a claim that every probe lease is unused. The existing quota-probe lease is wired. The gap is specifically the transient-hold resolver and pool-wide recovery limiter introduced in #4626.
@lidge-jun This was reported by the post-promotion exact-tree review on #4694 and is present in the released 2.56.0 tree. I recommend treating the runtime wiring and the inaccurate active-contract wording as a 2.57 follow-up, not patching the release branch directly.
Summary
The 2.56.0 tree added and documented a transient half-open resolver plus a process-wide recovery ratio limiter in #4626, but the production request path does not call the new dispatch APIs.
Current exact refs checked:
dev:cc182a40526a1d87cf5b4b7949fdc6979e70747fmain/v2.56.0: includes feat(routing): bound recovery with a half-open probe lease and honour Retry-After in full (#4546) #4626 through the promoted386303af1product treeCurrent behavior
A source search outside
src/routing/probe-lease.tsfinds no production caller of:resolveHeldAccountDispatchsharedPoolBackpressurecreatePoolBackpressureLimiterrecordInitialSendtryPermitRetryDispatchtryPermitProbeDispatchOnly direct unit tests call the resolver and limiter. Existing production imports of this module are for the older Codex quota-probe lease functions (
tryAcquireCodexQuotaProbeLease,ownsProbeLease, and related settlement helpers). Those do not connect the new transient-hold resolver or the pool-wide initial/recovery send ratio.Consequently, the new unit tests prove the isolated primitives, but a burst of separate requests still has no shared limiter at the initial-send and retry/probe dispatch boundaries. The structure contract currently says the limiter is active, which overstates runtime behavior.
Expected behavior
Production account selection should consume
resolveHeldAccountDispatchfor a bound transiently held account, preserving its working detour while permitting only one half-open probe. Every physical first send should call the shared limiter'srecordInitialSend; every retry and transient probe should obtain a recovery permit before dispatch.A refusal must return a future retry time rather than busy-looping, must not consume the request-local send budget, and must not discard the remembered detour.
Required regression coverage
Scope note
This is not a claim that every probe lease is unused. The existing quota-probe lease is wired. The gap is specifically the transient-hold resolver and pool-wide recovery limiter introduced in #4626.
@lidge-jun This was reported by the post-promotion exact-tree review on #4694 and is present in the released 2.56.0 tree. I recommend treating the runtime wiring and the inaccurate active-contract wording as a 2.57 follow-up, not patching the release branch directly.