Skip to content

fix(capacity): count uncalibrated Codex plans instead of excluding them - #3198

Merged
lidge-jun merged 1 commit into
devfrom
codex/3155-capacity-plan-default
Sep 1, 2026
Merged

lidge-jun merged 1 commit into
devfrom
codex/3155-capacity-plan-default

Conversation

@lidge-jun

@lidge-jun lidge-jun commented Sep 1, 2026 •

Copy link
Copy Markdown
Owner

Summary

A Business account upgraded to a Premium Seat (introduced 2026-08-25) started showing "Incomplete coverage: 1 account(s) excluded, including 1 unknown plan(s)" under Rate Limits, and disappeared from its own capacity estimate.

configuredWeight returned undefined for any plan outside a hardcoded five-entry map, and an account with no weight was skipped entirely.

The map is far behind the plan vocabulary. The bundled upstream snapshot alone carries 21 distinct plan strings — business, edu, edu_plus, edu_pro, education, enterprise, enterprise_cbp_automation, enterprise_cbp_usage_based, finserv, free, free_workspace, go, hc, k12, plus, pro, prolite, quorum, sci, self_serve_business_usage_based, team — against the five with weights. So sixteen real plans were already being excluded, including go. Premium Seat is just the one that made a user look.

That is why this does not add premium to the map. src/codex/quota.ts reached the same conclusion about the same field, one file over:

An allowlist of "known" plans was tried here and was wrong […] CodexAccount.plan is an unrestricted string, so any list is a list of the plans someone remembered. Twelve real plans would have been refused recovery and stayed cooled forever — the very defect this unit exists to fix, reintroduced as a typo-shaped hole.

The change

An uncalibrated plan is now weighted at the baseline seat (1 — the value plus, team and business already carry) instead of being dropped. Under-counting a large seat is a visibly conservative estimate; excluding it silently overstates coverage the operator is reading as complete.

unknownPlanAccounts still counts these, so the uncertainty stays on screen — it just no longer gates inclusion.

Blast radius is bounded: aggregateCodexPoolCapacity is documented display-only, "It never participates in account selection or routing". This changes a dashboard estimate, not routing.

The dashboard string is split to match. It claimed unknown plans were "excluded", which is now false. Exclusion (paused / needs-reauth / missing quota / stale quota) and calibration are separate sentences, across all 9 locales.

Closes #3155.

Verification

Exact head 541cdae89:

  • bun test ./tests/provider-capacity.test.ts — 18 pass, 0 fail.
  • cd gui && bun test tests/provider-capacity.test.ts tests/provider-capacity-credits.test.tsx tests/provider-capacity-shell.test.tsx tests/i18n-locales.test.ts — 31 pass, 0 fail.
  • bun x tsc --noEmit — clean for touched files.

Red-green on both halves:

  • Restoring the exclusion → the new baseline case goes red (13 pass / 5 fail).
  • Flattening calibration so everything gets the default → the "calibrated weights unchanged" case goes red (11 pass / 7 fail). A Pro seat must stay worth 20 baselines.

Five existing tests changed, each because the behavior they pinned is the defect. Two are worth calling out:

  • prototype and unknown plan names never become configured weights — the Object.hasOwn guard is untouched, so constructor still cannot resolve to Object.prototype.constructor; it now resolves to the numeric baseline. Verified the aggregate stays finite.
  • all exclusion reasons retain a coverage envelope — its future-plan row is now paused, so every row is still excluded for a reason that survives this change.

A new test pins the risk directly: the default must never resurrect an account excluded for a real reason. Paused, needs-reauth, missing-quota and stale-quota rows stay excluded regardless of plan.

UI change

No layout change; the wording is what changed. Rendered output from provider-capacity-shell.test.tsx, which mounts the real component:

capacity notice before and after: the single "Incomplete coverage: 1 account(s) excluded, including 1 unknown plan(s)" line becomes an exclusion line plus a separate uncalibrated-plan explanation

The strings are the shipped locale values rendered with the dashboard stylesheet. The same two lines are asserted in provider-capacity-shell.test.tsx, which mounts the real component:

Incomplete coverage: 1 account(s) excluded
1 account(s) on an uncalibrated plan are counted at the baseline seat weight, so this estimate may be conservative

One honesty note: this is not a capture of the reporter's own dashboard — reproducing that needs a real Business Premium Seat, which I do not have. It is the notice region rendered from the changed strings, next to the string it replaces.

Checklist

  • Targets dev
  • Plan vocabulary established from the shipped snapshot, not guessed
  • Fixes the whole class rather than the one reported plan name
  • Both failure modes proven red-green; the "never resurrect an excluded account" risk has its own test
  • All 9 locales updated; i18n-locales parity green
  • Display-only surface; no routing, credential, or auth change

A Business seat upgraded to a Premium Seat started reporting a plan string the
capacity weight map does not list, so the account was dropped from its own
capacity estimate and the dashboard warned about incomplete coverage.

The map knows five plan names. The bundled upstream snapshot alone carries 21,
and CodexAccount.plan is an unrestricted string, so sixteen real plans were
already being excluded - Premium Seat is only the one a user noticed.
src/codex/quota.ts reached this same conclusion about this same field: an
allowlist is a list of the plans someone remembered.

Weight an uncalibrated plan at the baseline seat instead. Under-counting a large
seat is a visibly conservative estimate; excluding it silently overstates the
coverage an operator is reading. The calibrated weights are unchanged, and
paused, needs-reauth, missing-quota and stale-quota accounts are still excluded.

The dashboard string is split to match: unknown plans are no longer described as
excluded, because they are not.

Closes #3155
@lidge-jun
lidge-jun requested a review from Ingwannu as a code owner September 1, 2026 18:08
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 1, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-01T18:12:05.577632Z 541cdae PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

✅ Deterministic PR hygiene checks passed.

@github-actions github-actions Bot added the bug Something isn't working label Sep 1, 2026
@github-actions

github-actions Bot commented Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

✅ READY

  • all PR quality gates passed.

@github-actions
github-actions Bot marked this pull request as draft September 1, 2026 18:09
@github-actions
github-actions Bot marked this pull request as ready for review September 1, 2026 18:11
@lidge-jun
lidge-jun merged commit ef6a163 into dev Sep 1, 2026
24 of 27 checks passed
@lidge-jun
lidge-jun deleted the codex/3155-capacity-plan-default branch September 1, 2026 18:11

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 541cdae89e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +143 to +145
{aggregation && aggregation.unknownPlanAccounts > 0 && (
<div className="pws-capacity-incomplete">
{t("pws.capacity.uncalibratedPlan", { count: aggregation.unknownPlanAccounts })}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not label excluded unknown-plan accounts as counted

When an uncalibrated account is paused, needs reauthentication, lacks quota, or has stale quota, unknownPlanAccounts is still incremented before the source excludes it from every window; nevertheless, this component tells the operator that every account in that count "is counted at the baseline seat weight." The coverage-only fixture demonstrates the contradiction with includedAccounts: 0 and unknownPlanAccounts: 1. Track included uncalibrated accounts separately or use wording that does not claim all of them contributed.

AGENTS.md reference: gui/AGENTS.md:L9-L10

Useful? React with 👍 / 👎.

Comment on lines +116 to +120
function configuredWeight(plan: unknown): number {
const normalized = codexPlanKey(plan);
return normalized && Object.hasOwn(CODEX_CONFIGURED_CAPACITY_WEIGHTS, normalized)
? CODEX_CONFIGURED_CAPACITY_WEIGHTS[normalized as keyof typeof CODEX_CONFIGURED_CAPACITY_WEIGHTS]
: undefined;
: CODEX_DEFAULT_CAPACITY_WEIGHT;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the documented unknown-plan behavior

This fallback reverses the published contract in docs-site/src/content/docs/guides/providers.md:35-37, which still says an unknown plan cannot safely contribute and is a reason for incomplete coverage; after this change it contributes at weight 1 and can leave aggregation.incomplete false. Update that section and its translated copies so operators do not interpret the new estimate using the obsolete exclusion semantics.

AGENTS.md reference: AGENTS.md:L343-L344

Useful? React with 👍 / 👎.

lidge-jun pushed a commit that referenced this pull request Sep 1, 2026
#3200)

#3198 deliberately stopped excluding uncalibrated Codex plans from the pool
capacity estimate: a plan name the weight map does not list now counts at the
baseline seat weight, because exclusion silently overstated the coverage an
operator was reading. It updated provider-capacity.test.ts and the GUI tests,
but tests/provider-quota.test.ts kept one test asserting the old exclusion
shape, so it has failed deterministically on every clean dev checkout since —
expecting the malformed-plan account to be dropped (weekly 11, excluded 1,
incomplete) where the new contract blends it at baseline (weekly 44, both
included, complete coverage).

A malformed non-string plan such as `{ tier: "pro" }` is not a separate axis:
codexPlanKey normalizes it to undefined exactly like an unlisted name (the
tolerance 095a9a5 established), and #3198 routes every undefined key to the
baseline weight. Re-splitting malformed from unknown here would reintroduce the
distinction #3198 just collapsed, so the test moves to the new contract instead;
`unknownPlanAccounts` still records the seat, which is the observable the test's
cache half already pins.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
olddonkey added a commit to olddonkey/opencodex that referenced this pull request Sep 1, 2026
The review's headline finding was that the new comment stated a wrong mechanism
at a wrong layer: on this test's integration path the malformed plan never
reaches codexPlanKey — poolAccountDto strips it via codexPlanValue, so the
aggregation sees an ABSENT plan — and an unlisted string name normalizes to a
defined key that fails the weight-map lookup, not to undefined. The comment now
states both routes correctly, cites lidge-jun#3155 (PR lidge-jun#3198) the way the ten sibling
references do, and replaces its fourth copy of the policy rationale with a
pointer to CODEX_DEFAULT_CAPACITY_WEIGHT's own doc.

The assertions grew where the review showed regressions could ship green:

- weekly: { includedAccounts, excludedAccounts, incomplete } — the per-window
  flags are what the dashboard renders per bar, and nothing pinned them.
- JSON.stringify(refreshed) must not contain "tier" — with exclusion gone,
  nothing else proved the malformed value cannot escape into the public shape.
- the sibling's anti-leak regex over the aggregation, closing that asymmetry.
- the cached half now asserts the identity contract itself (toBe on the
  aggregation object) instead of re-reading a field of the object checked one
  line up, with a comment saying why content is only covered once.
- the load-bearing mock is documented: a fetched plan_type outranks the
  persisted plan, so it must stay non-string for every value below.

The test is renamed to what it now pins — counted at baseline, kept out of the
public shape — since "through cache and aggregation" was false on both nouns.

gui/tests/provider-capacity-shell.test.tsx gains the one missing pairing:
incomplete:false with unknownPlanAccounts>0, the lidge-jun#3155 reporter's own
fully-included pool. Mutation-checked: gating the uncalibrated notice under the
incomplete branch fails only the new test; every prior fixture passes, which is
exactly the silent-hide the review predicted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@lidge-jun

Copy link
Copy Markdown
Owner Author

리뷰 · 우선순위 58 / 80

이 PR은 Rate Limits 용량 추정에서 Codex 플랜 이름이 가중치 맵에 없으면 계정을 통째로 빼 버리던 버그를 고칩니다. 증상은 #3155로 보고된 Business → Premium Seat 업그레이드였습니다. 대시보드에 Incomplete coverage / unknown plan 경고가 뜨고, 그 계정이 자기 풀 추정에서 사라졌습니다.

원인은 src/providers/codex-capacity.ts의 configuredWeight가 하드코딩된 다섯 개 플랜(plus/team/business/prolite/pro) 밖이면 undefined를 돌려주고, aggregateCodexPoolCapacity가 그 경우를 제외 조건에 넣었기 때문입니다. 그런데 업스트림 CodexAccount.plan은 열린 문자열이고, 번들 스냅샷만 해도 go/edu_plus/finserv/k12/quorum 등 21개 플랜이 있습니다. 그래서 Premium Seat뿐 아니라 이미 16개 실제 플랜이 같은 구멍으로 빠지고 있었습니다. src/codex/quota.ts도 같은 필드에 대해 allowlist는 기억한 이름의 목록일 뿐이라고 이미 결론을 내린 상태입니다.

이 변경은 맵에 premium 하나를 추가하지 않습니다. 대신 CODEX_DEFAULT_CAPACITY_WEIGHT = 1(기존 plus/team/business와 같은 기준 좌석)로 미보정 플랜을 넣고, unknownPlanAccounts 카운트는 유지합니다. 큰 좌석을 낮게 잡는 것은 보수적인 추정이고, 조용히 빼서 커버리지를 과장하는 것보다 낫습니다. UI도 맞춰서 pws.capacity.incomplete에서 unknown 문구를 빼고, 새 키 pws.capacity.uncalibratedPlan을 9개 로케일에 분리했습니다. ProviderCapacityQuota.tsx는 제외 배너와 미보정 배너를 따로 그립니다.

중요한 안전 경계도 테스트로 고정했습니다. paused / needs-reauth / missing-quota / stale-quota는 플랜이 미보정이어도 계속 제외되고, 보정된 Pro=20 가중치는 그대로이며, Object.hasOwn 가드로 constructor 같은 프로토타입 키가 가중치 테이블로 새지 않습니다. PR 본문대로 이 함수는 display-only라 라우팅/계정 선택에는 안 탑니다.

현재 dev HEAD(f84dbf91e, #3215) 기준으로 이 수정은 이미 ef6a163c7(#3198)로 들어가 있고, 후속 fcf0da257(#3200)이 malformed-plan 풀 테스트까지 #3198 계약에 맞춰 두었습니다. #3155도 닫혀 있습니다. types.ts/config.ts 분할 캠페인과도 겹치지 않습니다.

라인 234 - aggregateCodexPoolCapacity의 continue 조건에서 weight === undefined가 빠져 미보정 계정이 집계에 남는 것은 의도된 핵심 수정이다, 운영자가 Premium 실중량을 기대하면 추정치가 계속 낮게 보일 수 있다(보수적 under-count는 문서화되어 있음).
gui/src/i18n/tr.ts - pws.capacity.incomplete가 다른 로케일의 Incomplete coverage 뜻과 달리 여전히 Kısmi pencere kapsamı 톤이라, 이번 PR이 건드린 줄인데 터키어만 의미 축이 어긋져 있다(기능 회귀는 아님).
CODEX_CONFIGURED_CAPACITY_WEIGHTS - go/edu_*/enterprise* 등 스냅샷에 있는 실플랜 가중치는 아직 없어서, 미보정 배너가 Premium Seat 이후에도 자주 남을 수 있다.

메인테이너의 판단이 필요한 지점

너의 추천
이미 dev에 반영된 올바른 수정이다 추가 머지/리베이스는 필요 없다. 남겨둘 일은 선택적이다. 실측 가능한 플랜 가중치가 생기면 맵을 보강하고, 터키어 incomplete 문구는 여유 있을 때 다른 로케일과 의미를 맞추면 된다. 지금 큐에서 막을 이슈는 없다.

이 댓글은 grok-bot이 작성했습니다

olddonkey added a commit to olddonkey/opencodex that referenced this pull request Sep 3, 2026
The review's headline finding was that the new comment stated a wrong mechanism
at a wrong layer: on this test's integration path the malformed plan never
reaches codexPlanKey — poolAccountDto strips it via codexPlanValue, so the
aggregation sees an ABSENT plan — and an unlisted string name normalizes to a
defined key that fails the weight-map lookup, not to undefined. The comment now
states both routes correctly, cites lidge-jun#3155 (PR lidge-jun#3198) the way the ten sibling
references do, and replaces its fourth copy of the policy rationale with a
pointer to CODEX_DEFAULT_CAPACITY_WEIGHT's own doc.

The assertions grew where the review showed regressions could ship green:

- weekly: { includedAccounts, excludedAccounts, incomplete } — the per-window
  flags are what the dashboard renders per bar, and nothing pinned them.
- JSON.stringify(refreshed) must not contain "tier" — with exclusion gone,
  nothing else proved the malformed value cannot escape into the public shape.
- the sibling's anti-leak regex over the aggregation, closing that asymmetry.
- the cached half now asserts the identity contract itself (toBe on the
  aggregation object) instead of re-reading a field of the object checked one
  line up, with a comment saying why content is only covered once.
- the load-bearing mock is documented: a fetched plan_type outranks the
  persisted plan, so it must stay non-string for every value below.

The test is renamed to what it now pins — counted at baseline, kept out of the
public shape — since "through cache and aggregation" was false on both nouns.

gui/tests/provider-capacity-shell.test.tsx gains the one missing pairing:
incomplete:false with unknownPlanAccounts>0, the lidge-jun#3155 reporter's own
fully-included pool. Mutation-checked: gating the uncalibrated notice under the
incomplete branch fails only the new test; every prior fixture passes, which is
exactly the silent-hide the review predicted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lidge-jun pushed a commit that referenced this pull request Sep 4, 2026
…comment

Carried from #3327. Two gaps the original #3198 tests left open: the uncalibrated-plan
notice was never pinned independently of the incomplete-coverage gate, so folding it
under that branch would have passed every existing fixture while silently hiding it;
and the malformed-plan path was described as if it reached aggregation the same way an
unlisted plan name does, when poolAccountDto strips it earlier via codexPlanValue and
the aggregate sees an absent plan instead.

One assertion is narrowed from the original.  over the whole
envelope also matches any unrelated field whose name contains that substring --
serviceTier, tierOutcome -- so it would fail on changes with nothing to do with plan
leakage. Scoped to the report rows and to the quoted key, which is where the malformed
value could actually surface.

Carried rather than merged in place: #3327 is a fork PR, and Cross-platform CI never
ran on its head. enforce-target was also red there because touching gui/tests/ trips
the UI-screenshot gate on a test-only change.

Co-authored-by: olddonkey <olddonkeyblog@gmail.com>
lidge-jun added a commit that referenced this pull request Sep 4, 2026
…redit redeems a stable identity (#3474)

Reimplements #3332 by @full999, which could not be cherry-picked. One line differs from the original and it matters: the PR mapped the vendor table's maxTokens -- an OUTPUT ceiling -- onto maxInputTokens, and because aggregation takes Math.min over member input ceilings, a single Claude member would have dragged a 1M combo down to 128k and the auto-compaction budget from 900k to 128k with it.

Also wires the reset-credit operation ledger, which was complete and had zero production callers while the consume endpoint minted a fresh UUID per call. An optional operationId now becomes the redeem_request_id. Opening fails closed, because falling back to a random id is the double-spend the identity prevents; settling fails open, because by then the credit is gone and reporting failure would invite a manual retry. Omitting operationId keeps today's behavior unchanged.

Carried from #3327 by @olddonkey as well: two coverage holes from #3198, with one over-broad assertion narrowed.

Also lands #3251 by @abhisheksharma2411: the GUI now consumes tierOutcome, which the backend already shipped and nothing displayed.

Co-authored-by: full999 <daiki.furutani@walker-s.co.jp>
Co-authored-by: olddonkey <olddonkeyblog@gmail.com>
Co-authored-by: Abhishek Sharma <abhicse24@gmail.com>
tarunravi pushed a commit to tarunravi/opencodex that referenced this pull request Sep 14, 2026
…em (lidge-jun#3198)

A Business seat upgraded to a Premium Seat started reporting a plan string the
capacity weight map does not list, so the account was dropped from its own
capacity estimate and the dashboard warned about incomplete coverage.

The map knows five plan names. The bundled upstream snapshot alone carries 21,
and CodexAccount.plan is an unrestricted string, so sixteen real plans were
already being excluded - Premium Seat is only the one a user noticed.
src/codex/quota.ts reached this same conclusion about this same field: an
allowlist is a list of the plans someone remembered.

Weight an uncalibrated plan at the baseline seat instead. Under-counting a large
seat is a visibly conservative estimate; excluding it silently overstates the
coverage an operator is reading. The calibrated weights are unchanged, and
paused, needs-reauth, missing-quota and stale-quota accounts are still excluded.

The dashboard string is split to match: unknown plans are no longer described as
excluded, because they are not.

Closes lidge-jun#3155

Co-authored-by: jun <jun@lidge.dev>
tarunravi pushed a commit to tarunravi/opencodex that referenced this pull request Sep 14, 2026
…contract (lidge-jun#3200)

lidge-jun#3198 deliberately stopped excluding uncalibrated Codex plans from the pool
capacity estimate: a plan name the weight map does not list now counts at the
baseline seat weight, because exclusion silently overstated the coverage an
operator was reading. It updated provider-capacity.test.ts and the GUI tests,
but tests/provider-quota.test.ts kept one test asserting the old exclusion
shape, so it has failed deterministically on every clean dev checkout since —
expecting the malformed-plan account to be dropped (weekly 11, excluded 1,
incomplete) where the new contract blends it at baseline (weekly 44, both
included, complete coverage).

A malformed non-string plan such as `{ tier: "pro" }` is not a separate axis:
codexPlanKey normalizes it to undefined exactly like an unlisted name (the
tolerance 095a9a5 established), and lidge-jun#3198 routes every undefined key to the
baseline weight. Re-splitting malformed from unknown here would reintroduce the
distinction lidge-jun#3198 just collapsed, so the test moves to the new contract instead;
`unknownPlanAccounts` still records the seat, which is the observable the test's
cache half already pins.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
agentHits pushed a commit to agentHits/opencodex that referenced this pull request Sep 17, 2026
…em (lidge-jun#3198)

A Business seat upgraded to a Premium Seat started reporting a plan string the
capacity weight map does not list, so the account was dropped from its own
capacity estimate and the dashboard warned about incomplete coverage.

The map knows five plan names. The bundled upstream snapshot alone carries 21,
and CodexAccount.plan is an unrestricted string, so sixteen real plans were
already being excluded - Premium Seat is only the one a user noticed.
src/codex/quota.ts reached this same conclusion about this same field: an
allowlist is a list of the plans someone remembered.

Weight an uncalibrated plan at the baseline seat instead. Under-counting a large
seat is a visibly conservative estimate; excluding it silently overstates the
coverage an operator is reading. The calibrated weights are unchanged, and
paused, needs-reauth, missing-quota and stale-quota accounts are still excluded.

The dashboard string is split to match: unknown plans are no longer described as
excluded, because they are not.

Closes lidge-jun#3155

Co-authored-by: jun <jun@lidge.dev>
agentHits pushed a commit to agentHits/opencodex that referenced this pull request Sep 17, 2026
…contract (lidge-jun#3200)

lidge-jun#3198 deliberately stopped excluding uncalibrated Codex plans from the pool
capacity estimate: a plan name the weight map does not list now counts at the
baseline seat weight, because exclusion silently overstated the coverage an
operator was reading. It updated provider-capacity.test.ts and the GUI tests,
but tests/provider-quota.test.ts kept one test asserting the old exclusion
shape, so it has failed deterministically on every clean dev checkout since —
expecting the malformed-plan account to be dropped (weekly 11, excluded 1,
incomplete) where the new contract blends it at baseline (weekly 44, both
included, complete coverage).

A malformed non-string plan such as `{ tier: "pro" }` is not a separate axis:
codexPlanKey normalizes it to undefined exactly like an unlisted name (the
tolerance 9accc38 established), and lidge-jun#3198 routes every undefined key to the
baseline weight. Re-splitting malformed from unknown here would reintroduce the
distinction lidge-jun#3198 just collapsed, so the test moves to the new contract instead;
`unknownPlanAccounts` still records the seat, which is the observable the test's
cache half already pins.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
agentHits pushed a commit to agentHits/opencodex that referenced this pull request Sep 17, 2026
…redit redeems a stable identity (lidge-jun#3474)

Reimplements lidge-jun#3332 by @full999, which could not be cherry-picked. One line differs from the original and it matters: the PR mapped the vendor table's maxTokens -- an OUTPUT ceiling -- onto maxInputTokens, and because aggregation takes Math.min over member input ceilings, a single Claude member would have dragged a 1M combo down to 128k and the auto-compaction budget from 900k to 128k with it.

Also wires the reset-credit operation ledger, which was complete and had zero production callers while the consume endpoint minted a fresh UUID per call. An optional operationId now becomes the redeem_request_id. Opening fails closed, because falling back to a random id is the double-spend the identity prevents; settling fails open, because by then the credit is gone and reporting failure would invite a manual retry. Omitting operationId keeps today's behavior unchanged.

Carried from lidge-jun#3327 by @olddonkey as well: two coverage holes from lidge-jun#3198, with one over-broad assertion narrowed.

Also lands lidge-jun#3251 by @abhisheksharma2411: the GUI now consumes tierOutcome, which the backend already shipped and nothing displayed.

Co-authored-by: full999 <daiki.furutani@walker-s.co.jp>
Co-authored-by: olddonkey <olddonkeyblog@gmail.com>
Co-authored-by: Abhishek Sharma <abhicse24@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant