fix(responses): bound API-key 429 rotations across continuations - #4621

sequenceDiagram
  participant Client
  participant ResponsesAdapter
  participant ProviderTransport
  participant KeyFailover
  Client->>ResponsesAdapter: submit Responses request
  ResponsesAdapter->>ProviderTransport: send request with current API key
  ProviderTransport-->>ResponsesAdapter: return 429
  ResponsesAdapter->>KeyFailover: request bounded rotation
  KeyFailover-->>ResponsesAdapter: record cooldown and return replacement or no replacement
  ResponsesAdapter->>ProviderTransport: send recovery or continuation request
  ProviderTransport-->>ResponsesAdapter: return response or final error
  ResponsesAdapter-->>Client: return Responses result

Merge Risk: 🟡 Moderate · up to 5efbb

Multi-target Responses requests can exceed their bounded upstream-send allowance, so the shared accounting should be corrected before merge. The provider documentation should also clarify which authentication and retry modes the limit covers.

• Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

✅ Deterministic PR hygiene checks passed.

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

@codex review

@coderabbitai review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

리뷰 · 우선순위 64 / 80

설명

이 PR(작성자 luvs01, draft)은 API 키 풀에서 429가 났을 때 키가 무한히 돌 수 있는 구멍을 막는다. 짧은 쿨다운이 끝나면 이미 시도한 키를 다시 고를 수 있고, reset-only 전송은 공유 transient retry budget을 안 켜서 요청이 키만 바꾸며 계속 도는 장면이 나온다. 고치는 방법은 단순하다. handleResponsesInner 한 번 호출마다 첫 전송 전 풀 크기 N을 찍고, 최초 복구와 terminal continuation이 합쳐서 최대 N-1번만 키를 바꾸게 한다. 쿨다운이 풀리거나 나중에 풀이 커져도 이 숫자는 다시 채워지지 않는다.

현재 dev tip은 4f788f916 (#4620 출시 기록까지 포함)이고, 이 PR 본문은 기준을 62f02223a0이라고 적었다. 그 사이 #4618(2.56.0 open)과 #4620(docs)이 올라왔으니 리베이스가 필요하다. 코드 본체는 src/server/responses/core.ts에 maxKeyPoolFailovers/keyPool429RetryAllowed 를 두고, src/providers/key-failover.ts의 rotateKeyOn429 / rotateProviderTransportOn429 에 allowRotation 플래그를 추가한다. 거절 시에도 실패한 키 쿨다운은 기록하되 다른 키를 고르거나 디스크에 쓰지 않는다. 401 경로에는 이 플래그를 일부러 안 붙였다.

테스트는 핵심을 잘 잡는다. tests/adapters/key-failover.test.ts 의 health-only 시나리오는 allowRotation=false일 때 설정 파일 바이트·선택 이벤트·쿨다운을 검사하고, tests/server/server-key-failover-e2e.test.ts 는 exhausted/continuation/transient/budget-exhausted 네 모드로 전송 횟수·최종 본문·취소 여부를 고정한다. 픽스처가 6회를 넘기면 바로 터지게 해서 '테스트가 타임아웃으로만 실패하던' 예전 형태를 피했다. 작성자가 밝힌 대로 좁은 스위트 74통과는 있지만, --changed 임팩트 스위트는 900초 제한에 걸렸고 6589 pass / 57 fail로 끝나지 않았다. draft 유지 이유가 그것이다.

문서 쪽은 영어 providers.md와 8개 로케일, 그리고 structure/transports/responses.md 의 Bounded API-key 429 rotation 절이 계약의 본체다. 그런데 같은 한 문장 링크를 adapters/catalog/clients/data-planes/gui/ops/xai/runtime/subagents/byte-accounting/inventory/streaming-health 등 관련 없는 structure 문서 여러 장 맨 위에 복붙했다. ownership 문서 폭발은 이 레포에서 자주 리뷰 지적되는 패턴이다. cost-guard #4546의 send-budget 계열(#4605~#4616)과 맞물리는 '요청 단위 상한'이라 방향은 현재 dev 과 잘 맞고, types/config 분할에 무효화되지도 않는다.

우선순위 64는 '실제 비용/루프 버그를 막는 코드'라서 문서 PR보다 높고, 동시에 draft·임팩트 스위트 미완료·structure 산포·tip 뒤처짐 때문에 70대로 올리지 않은 점수다. 콤보 전체 예산이 아니고 '키를 한 번씩만' 보장도 아니라고 본문이 솔직히 말한다. 그 범위를 메인테이너가 받아들일지가 머지 판단의 핵심이다.

src/server/responses/core.ts keyPool429RetryAllowed - continuation=false일 때만 auth-recovery reserve를 엿보는데, countedExternally:true 로 reserveDispatch를 호출한다. '검사만 하고 소비하지 않는다'는 주석과 실제 reserve API 의미가 같은지 tip 기준으로 한 번 더 확인이 필요하다.
src/server/responses/core.ts maxKeyPoolFailovers - apiKeyPool이 없거나 길이 1이면 상한이 0이라 회전이 아예 막힌다. 의도가 '풀이 없으면 돌리지 말 것'이면 맞고, 예전처럼 단일 키 경로의 다른 복구는 그대로인지도 회귀로 박아 두면 좋다.
structure/* 다수 파일 - 무관한 ownership 문서 상단에 동일 문장 링크를 뿌린 것은 계약 본체인 responses.md만 두고 나머지로의 back-link는 최소화하는 편이 이 레포 습관에 맞다.
PR base 62f02223a0 vs 현재 tip 4f788f916 - #4618/#4620 이후로 rebase 필요. 충돌 가능성은 docs/structure 쪽보다 core.ts send-budget 인접이 더 민감하다.
Verification - 로컬 --changed 57 fail 미귀속 상태로 draft. Ready 체크리스트도 CI/Codex·CodeRabbit 미해결로 비어 있다.

메인테이너의 판단이 필요한 지점

• invocation-level N-1 상한을 콤보/워크플로 예산과 별도로 두는 설계를 [Bug]: Account pool routing destroys prompt cache and triggers 10x-50x token burn death-spiral above 80% usage threshold #4546 send-budget 이야기와 같은 층으로 받아들일지.
• structure 문서 산포를 걷어낸 뒤 머지할지, 소유권 그래프를 일부러 넓힐지.
• 임팩트 스위트 실패 57건을 이 PR 탓으로 볼지 baseline 노이즈로 볼지 — draft 해제 조건.

너의 추천
draft 유지. dev 4f788f916 위로 rebase한 뒤, structure 산포 문장을 걷거나 responses.md+providers 로케일만 남기고, 좁은 키-failover/e2e 스위트와 hosted CI가 초록인지 확인한 다음에만 Ready로 올린다. 지금 상태로는 머지하지 말고, #4546 레인에 'key-429 rotation cap'으로만 연결해 둔다.

이 댓글은 grok-bot이 작성했습니다

@codex review

@coderabbitai review

@codex review

@coderabbitai review

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 9336e38f99

Updated author evidence for the current head 9336e38. Both automated reviews are complete and their two findings are resolved, including the initially unpooled key and sidecar sites. CI completed with the explicitly documented Windows exceptions; this is author-ready, not a green-CI claim.

The reserve question was rechecked: reserveDispatch returns a permit, and shared state is charged only by permit.use(); the allowance query does not call it. Pools with fewer than two entries already decline key rotation in rotateKeyAfterFailure, while existing same-target retry and OAuth fallback policies remain separate.

The referenced dev changes from 62f0222 to 4f788f9 are a version bump and release evidence, with no diff in core.ts, key-failover.ts or request-execution-budget.ts. Rebasing solely to move the base label would restart validation without changing those semantics. The ownership manifest was not expanded: the short links satisfy its existing source-owner mapping while the contract stays in one canonical section. Maintainer acceptance of the invocation-level design remains a merge decision.

The four author-checklist boxes and review-ready label are complete. GitHub denied the author account permission to mark this PR ready, and the repository automation also reported a failed draft conversion. It therefore remains technically draft; a maintainer must perform that state transition. I have not retried the denied mutation.

The PR description now records the latest validation and remaining exceptions. Please review the refunded admission probe and the extracted combo-send budget helper on 5efbb309948272694420fdc8a71a835f59755551. These behavior changes were made after the previously recorded automated review.

@codex review
@coderabbitai review

#!/bin/bash
set -euo pipefail

git status --short
git rev-parse HEAD
git show --stat --oneline --decorate --no-renames 5efbb309948272694420fdc8a71a835f59755551
git diff --no-ext-diff --unified=80 5efbb309948272694420fdc8a71a835f59755551^ 5efbb309948272694420fdc8a71a835f59755551 -- src/server/responses/core.ts src/server/request-execution-budget.ts tests/server/server-key-failover-e2e.test.ts
ast-grep outline src/server/responses/core.ts --items all --type function --match 'handleResponsesInner|keyPool429RetryAllowed'
ast-grep outline src/server/request-execution-budget.ts --items all
rg -n -C 4 '\b(combo|reserveDispatch|sendBudgetExhausted|keyPool429RetryAllowed|allowRotation)\b' src/server/responses/core.ts src/server/request-execution-budget.ts tests/server/server-key-failover-e2e.test.ts

#!/bin/bash
set -euo pipefail

echo 'HEAD'
git rev-parse HEAD
echo 'DIFF'
git diff --no-ext-diff --unified=50 5efbb309948272694420fdc8a71a835f59755551^ 5efbb309948272694420fdc8a71a835f59755551 -- src/server/responses/core.ts src/server/request-execution-budget.ts
echo 'CORE SYMBOLS'
rg -n -C 8 '\b(reserveDispatch|sendBudgetExhausted|keyPool429RetryAllowed|combo.*budget|budget.*combo)\b' src/server/responses/core.ts
echo 'BUDGET FILE'
fd -a '^request-execution-budget\.ts$' .
if [ -f src/server/request-execution-budget.ts ]; then
  cat -n src/server/request-execution-budget.ts
fi

#!/bin/bash
set -euo pipefail

ast-grep outline src/server/responses/combo-send-budget.ts --items all
sed -n '1,240p' src/server/responses/combo-send-budget.ts
ast-grep outline src/lib/request-execution-budget.ts --items all
sed -n '1,360p' src/lib/request-execution-budget.ts
echo 'CALL SITES AND TESTS'
rg -n -C 6 '\.permit\.release\(\)|reserveDispatch\(\{|keyPool429RetryAllowed|comboTargetSendBudget|comboExecutionBudgetPolicy|deriveSendBudgetScope' src tests -g '*.ts'
echo 'CHANGED TEST FILES IN CURRENT COMMIT'
git diff-tree --no-commit-id --name-status -r 5efbb309948272694420fdc8a71a835f59755551
echo 'PARENT VS HEAD HELPER'
git show 5efbb309948272694420fdc8a71a835f59755551^:src/server/responses/core.ts | sed -n '8000,8045p'
sed -n '8000,8045p' src/server/responses/core.ts

#!/bin/bash
set -euo pipefail

echo 'HISTORY'
git log --oneline --decorate -8
echo 'PROBE INTRODUCTION'
git log -S 'decision.permit.release()' --oneline --all -- src/server/responses/core.ts
echo 'RECOVERY HELPERS'
rg -n -C 12 '\b(rebuildAndRefetch|pendingHopPermit|reserveRecovery|rebuild.*permit|key-429)\b' src/server/responses/core.ts
echo '429 MAIN LOOP'
sed -n '8450,8555p' src/server/responses/core.ts
echo 'REQUEST-BUDGET TEST RANGES'
sed -n '1,250p' tests/lib/execution-budget-permits.test.ts
echo 'COMBO TEST REFERENCES'
rg -n -C 5 '\b(combo|send budget|sendBudget|target.*send|six|twelve)\b' tests -g '*.test.ts' -g '*.ts' | head -n 450
echo 'MODULE IMPORTS'
rg -n -C 3 'from ["'\''].*combo-send-budget["'\'']' src tests -g '*.ts'

#!/bin/bash
set -euo pipefail

echo 'GENERIC REBUILD HELPER'
sed -n '8215,8350p' src/server/responses/core.ts
echo 'RECOVERY ALLOWANCE AND SEND ACCOUNTING'
sed -n '5240,5395p' src/server/responses/core.ts
echo 'KEY-429 TESTS'
rg -n -i -C 8 'key-429|key.*rotation|rotation.*budget|refund.*(admission|reservation)|admission.*refund' tests src/server -g '*.ts'
echo 'COMMIT 855c435ee DIFF'
git show --no-ext-diff --unified=80 --format=fuller 855c435ee -- src/server/responses/core.ts tests
echo 'IMPORT RESOLUTION'
python3 - <<'PY'
from pathlib import Path
p = Path("src/server/responses/core.ts")
target = (p.parent / "combo-send-budget.ts").resolve()
print(target)
print(target.is_file())
PY

@luvs01 Reviewed commit 5efbb309948272694420fdc8a71a835f59755551.

I found no correctness issue in the requested changes.

• In src/server/responses/core.ts, Lines 8028-8035, the admission probe reserves and releases the final-recovery slot before key rotation. SingleUseDispatchPermit.release() restores the pending external-send state and all affected budget state.
• The actual rotated request uses rebuildAndRefetch("key-429") at Line 8514. That path obtains the real permit through recoverySendAllowance, uses it immediately before dispatch, and settles it through onSendsConsumed.
• Both paths use the same request-scoped sendBudget and the same provider|model|key-429 target identity. The probe therefore checks the same admission constraint that the real recovery later consumes.
• The recovery-success case in tests/server/server-key-failover-e2e.test.ts verifies the important sequence: three base sends, then a successful rotated fourth send from the final-recovery reserve.
• src/server/responses/combo-send-budget.ts is a behavior-preserving extraction of the combo budget helpers. The import in src/server/responses/core.ts resolves correctly.

I inspected source and tests only. I did not run the test suite in this environment.

You are interacting with an AI system.

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 5efbb30994

The shared-reservation finding is fixed in 613cea47a8386e7d4bc0a631eef660699354de86 and answered in its review conversation. Please review the factory-derived scopes and the physical-send regression. The description includes current validation and the pending CI run.

@codex review
@coderabbitai review

#!/bin/bash
set -euo pipefail

commit="613cea47a8386e7d4bc0a631eef660699354de86"

echo 'HEAD'
git rev-parse HEAD
echo 'COMMIT'
git show --no-ext-diff --format=fuller --stat --summary "$commit"
echo 'CHANGED FILES'
git diff-tree --no-commit-id --name-status -r "$commit"

echo 'RELEVANT DIFF'
git diff --no-ext-diff --unified=100 "${commit}^" "$commit" -- \
  src/server/responses/combo-send-budget.ts \
  src/server/responses/core.ts \
  src/lib/request-execution-budget.ts \
  tests/server/server-key-failover-e2e.test.ts \
  tests/lib/execution-budget-permits.test.ts

echo 'OUTLINES'
ast-grep outline src/server/responses/combo-send-budget.ts --items all
ast-grep outline src/lib/request-execution-budget.ts --items all
ast-grep outline src/server/responses/core.ts --items all --type function --match 'handleResponsesInner|rebuildAndRefetch'

echo 'FACTORY AND RESERVATION REFERENCES'
rg -n -C 8 '\b(deriveSendBudgetScope|comboTargetSendBudget|comboExecutionBudgetPolicy|reserveDispatch|SingleUseDispatchPermit|pendingExternal|permit\.release|permit\.use)\b' \
  src/server/responses/combo-send-budget.ts \
  src/lib/request-execution-budget.ts \
  src/server/responses/core.ts \
  tests -g '*.ts'

echo 'TARGETED TEST REFERENCES'
rg -n -i -C 10 '\b(physical send|physical-send|shared.reserv|reservation|combo.*budget|budget.*combo)\b' tests -g '*.ts'

#!/bin/bash
set -euo pipefail
commit="613cea47a8386e7d4bc0a631eef660699354de86"

echo '=== COMMIT FILES ==='
git diff-tree --no-commit-id --name-status -r "$commit"

echo '=== COMMIT DIFF: COMBO SCOPE ==='
git diff --no-ext-diff --unified=40 "${commit}^" "$commit" -- src/server/responses/combo-send-budget.ts

echo '=== COMMIT DIFF: BUDGET CORE ==='
git diff --no-ext-diff --unified=40 "${commit}^" "$commit" -- src/lib/request-execution-budget.ts

echo '=== COMMIT DIFF: PHYSICAL-SEND TEST ==='
git diff --no-ext-diff --unified=60 "${commit}^" "$commit" -- tests/responses/responses-send-budget-counts.test.ts tests/lib/execution-budget-permits.test.ts

echo '=== COMBO SCOPE IMPLEMENTATION ==='
cat -n src/server/responses/combo-send-budget.ts

echo '=== REQUEST BUDGET IMPLEMENTATION ==='
cat -n src/lib/request-execution-budget.ts

echo '=== PHYSICAL-SEND TEST ==='
sed -n '1,180p' tests/responses/responses-send-budget-counts.test.ts

echo '=== COMBO FACTORY CALL SITES ==='
rg -n -C 12 '\b(comboExecutionBudgetPolicy|deriveSendBudgetScope|comboTargetSendBudget)\s*\(' src/server -g '*.ts'

#!/bin/bash
set -euo pipefail

echo '=== COMBO LOOP ==='
sed -n '3160,3345p' src/server/responses/core.ts

echo '=== CHILD OPTIONS AND COMBO FAILURE HANDLING ==='
sed -n '3345,3485p' src/server/responses/core.ts

echo '=== SEND-BUDGET RESERVATION CALL SITES ==='
rg -n -C 10 '\.reserveDispatch\(\{' src/server/responses/core.ts

echo '=== COMBO RECOVERY TESTS ==='
rg -n -i -C 12 '\b(combo|fan).*(401|429|repair|rebuild|recovery|reserve)|\b(401|429|repair|rebuild|recovery|reserve).*(combo|fan)' \
  tests/responses tests/server tests/lib -g '*.ts'

echo '=== COMBO SEND-BUDGET TEST LOCATIONS ==='
rg -n -C 8 'comboOverTargets|comboExecutionBudgetPolicy|comboTargetSendBudget|comboSendScope|finalRecoveryAllowance' \
  tests src/server/responses/core.ts -g '*.ts'

@luvs01 I found one correctness issue in commit 613cea47a8386e7d4bc0a631eef660699354de86.

finalRecoveryAllowance is no longer shared across combo target scopes.

In src/lib/request-execution-budget.ts, Lines 155-158 create reserveSpent as a new local value for every deriveScope() result. Line 178 shares only ledger.spent and ledger.pendingExternalSends.

In src/server/responses/combo-send-budget.ts, Lines 69-77 then give every comboTargetSendBudget() scope the same nonzero finalRecoveryAllowance. Therefore, each target scope can authorize its own reserve-funded auth-recovery send. The request-wide total still stops the final extra send, but an early target can consume the send held for a later declared target.

For a three-target combo, the affected sequence is:

1. Target 1 uses its base ladder and its local recovery reserve.
2. Target 2 uses its initial send and its separate local recovery reserve.
3. The shared total reaches six sends.
4. Target 3 receives no physical send.

This violates the stated guarantee that the clamp preserves a send for each later target. The physical-send regression in tests/responses/responses-send-budget-counts.test.ts, Lines 123-151, cannot detect this case because a pure 5xx transient streak never uses finalRecoveryAllowance.

Update the derived-scope factory so combo child scopes share the combo-level reserveSpent state, or remove the recovery allowance from child scopes after the combo reserve is committed. Add an end-to-end regression where the first combo target performs a reserve-funded recovery and fails. Assert that the later declared target still receives its protected physical send. Also update the unit test in tests/lib/execution-budget-permits.test.ts, Lines 157-173, to assert per-target sends, not only the aggregate total.

I inspected the source and tests. I did not run the test suite in this environment.

You are interacting with an AI system.

Latest findings are fixed in 90f6c2b39bda6883637b3598a67cc9048424e1d8 and answered in their conversations. The later-target concern is handled by a hard child ceiling that includes recovery sends, rather than only a base-allowance clamp. The recovery-heavy regression now requires [4, 1, 1], so exhausting the total while starving target three cannot pass. Scope-local recovery ledgers remain intentional inside that physical ceiling. The description records final focused validation and the current CI run.

@codex review
@coderabbitai review

#!/bin/bash
set -euo pipefail

commit="90f6c2b39bda6883637b3598a67cc9048424e1d8"

echo '=== HEAD / COMMIT ==='
git rev-parse HEAD
git show --no-ext-diff --format=fuller --stat --summary "$commit"
echo '=== CHANGED FILES ==='
git diff-tree --no-commit-id --name-status -r "$commit"

echo '=== RELEVANT DIFF ==='
git diff --no-ext-diff --unified=100 "${commit}^" "$commit" -- \
  src/server/responses/combo-send-budget.ts \
  src/server/responses/core.ts \
  src/lib/request-execution-budget.ts \
  tests/responses/responses-send-budget-counts.test.ts \
  tests/lib/execution-budget-permits.test.ts \
  tests/server/server-key-failover-e2e.test.ts

echo '=== OUTLINES ==='
ast-grep outline src/server/responses/combo-send-budget.ts --items all
ast-grep outline src/lib/request-execution-budget.ts --items all
ast-grep outline tests/responses/responses-send-budget-counts.test.ts --items all

echo '=== IMPLEMENTATIONS ==='
cat -n src/server/responses/combo-send-budget.ts
sed -n '1,320p' src/lib/request-execution-budget.ts

echo '=== FACTORY CALL SITES / RESERVATIONS ==='
rg -n -C 12 '\b(comboExecutionBudgetPolicy|deriveSendBudgetScope|comboTargetSendBudget|reserveDispatch|finalRecoveryAllowance|reserveSpent|pendingExternalSends)\b' \
  src/server/responses/core.ts \
  src/server/responses/combo-send-budget.ts \
  src/lib/request-execution-budget.ts \
  tests -g '*.ts'

echo '=== PHYSICAL-SEND REGRESSION ==='
rg -n -C 30 '\[4,\s*1,\s*1\]|recovery-heavy|physical send|physical-send|combo' \
  tests/responses/responses-send-budget-counts.test.ts \
  tests/lib/execution-budget-permits.test.ts

echo '=== COMBO EXECUTION ==='
rg -n -C 20 '\b(comboExecutionBudgetPolicy|comboTargetSendBudget|deriveSendBudgetScope)\s*\(' src/server/responses/core.ts

#!/bin/bash
set -euo pipefail

echo '=== BUDGET ACCOUNTING CALL SITES ==='
rg -n -C 10 'onSendsConsumed|sendBudget\.used|\.used \+=|\.used =|remainingTransientSendBudget|recoverySendAllowance' \
  src tests -g '*.ts'

echo '=== RESPONSE CORE SEND BUDGET HELPERS ==='
sed -n '5260,5405p' src/server/responses/core.ts

echo '=== COMBO CHILD EXECUTION AND FAILURE BRANCHES ==='
sed -n '3230,3555p' src/server/responses/core.ts

echo '=== KIRO COMBO TEST AND RETRY ACCOUNTING ==='
sed -n '45,95p' tests/adapters/adapter-inner-send-budget.test.ts
fd -a '^kiro-retry\.ts$|^transport-retry\.ts$|^upstream-retry\.ts$' src
rg -n -C 12 'onSendsConsumed|sendBudget|remainingBaseSends' src/adapters/kiro-retry.ts src/lib/upstream-retry.ts src/adapters/cursor/transport-retry.ts 2>/dev/null || true

echo '=== CHILD EARLY RETURNS / THROWS BEFORE ADAPTER SEND ==='
rg -n -C 8 'return |throw |handleResponses\(' src/server/responses/core.ts -g '*.ts' | sed -n '1,520p'

@luvs01 Reviewed commit 90f6c2b39bda6883637b3598a67cc9048424e1d8. I found no new correctness issue in the factory-derived scopes or the physical-send accounting.

The prior later-target starvation issue is addressed.

• In src/server/responses/combo-send-budget.ts, Lines 69-74, ceiling now becomes the child scope’s maxTotalModelSends. This ceiling includes base sends and a qualifying recovery send. For three targets, the first child can use four sends, while the second and third children retain one send each.
• In src/lib/request-execution-budget.ts, Lines 184-187 derive a child scope with the exact pending booking from the combo-hop permit. Lines 202-240 consume that booking once. This prevents the child’s first physical send from adding a second charge.
• In src/server/responses/core.ts, Lines 3235-3250 reserve the combo hop and pass its permit to comboTargetSendBudget(...). This connects the parent reservation to the child scope that performs the physical send.
• In tests/lib/execution-budget-permits.test.ts, Lines 157-176, the test now asserts [4, 1, 1]. This catches the previous failure mode where the first target exhausts the total and prevents target three from sending.
• In tests/adapters/adapter-inner-send-budget.test.ts, Lines 56-71, the Kiro regression verifies physical sends as [3, 2, 1] and verifies six total sends. This covers adapter-owned sends that reserve each dispatch directly.

I inspected the source and tests. I did not run the test suite in this environment.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

You are interacting with an AI system.

The latest inline findings are corrected in 63807e330f76fe152ae9fcd948a736f3f2c0d8db. Regression evidence and remaining CI limitations are in the description.

@codex review

Updated to c23a71c11b98418ce3b53f5c85c9156f92d7def0 after integrating dev and resolving the module-extraction conflicts. Validation and the exact-head CI run are in the description.

@codex review