fix(server): record recovery kind and de-duplicate Responses param shaping

CodeRabbit follow-up on the Copilot Responses-wire work.

The new passthrough recovery loop called noteAttemptSend without the third
`recovery` argument, so a request that silently self-healed via OAuth refresh
or key rotation showed an inflated sendCount with no recorded reason — exactly
the case this path exists to make debuggable. Thread the existing
AttemptRecoveryKind values ("oauth-401" / "key-429") through, matching what
rebuildAndRefetch does in the normal adapter loop.

Both translate-and-replay inbound handlers also carried identical copies of the
Responses sampling-param block, and this PR had to patch the two in lockstep —
the drift risk in concrete form. Extract
`stripUnsupportedResponsesSamplingParams`. `store` stays inline: only the Chat
Completions handler has a non-Responses default for it.

Full suite: 6069 pass, 6 fail — the same six that fail on the unmodified base.

Author: mushikingh

src/server/chat-completions.ts

@@ -20,6 +20,7 @@ import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
+import { stripUnsupportedResponsesSamplingParams } from "./responses-wire-params";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import {
@@ -88,19 +89,7 @@ export async function handleChatCompletions(
       directRoute = route.codexAccountMode === "direct";
       // ChatGPT backend rejects store:true and unsupported sampling knobs.
       internalBody.store = false;
-      // Forward mode is the only route that 400s on max_output_tokens, and the adapter's
-      // own stripUnsupportedForwardParams already drops it there on the same condition.
-      // A routed Responses gateway (Copilot, api.openai.com, ...) honors the field, and
-      // dropping it there silently ignores the caller's max_tokens.
-      if (route.provider.authMode === "forward") delete internalBody.max_output_tokens;
-      // temperature/top_p/stop/user stay stripped on every Responses route: `stop` is not
-      // a Responses parameter at all, reasoning models reject temperature/top_p, and the
-      // passthrough adapter relays the body verbatim — `noTemperatureModels` and friends
-      // are honored only by the openai-chat adapter, so there is no per-model filter here.
-      delete internalBody.temperature;
-      delete internalBody.top_p;
-      delete internalBody.stop;
-      delete internalBody.user;
+      stripUnsupportedResponsesSamplingParams(internalBody, route.provider);
     } else if (internalBody.store === undefined) {
       internalBody.store = false;
     }

src/server/claude-messages.ts

@@ -27,6 +27,7 @@ import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
+import { stripUnsupportedResponsesSamplingParams } from "./responses-wire-params";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForTerminalStatus, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log";
@@ -599,20 +600,7 @@ export async function handleClaudeMessages(
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
     if (route.provider.adapter === "openai-responses") {
       nativeRoute = true;
-      // Forward mode is the only route that 400s on max_output_tokens ("Unsupported
-      // parameter", verified live 2026-07-11), and the adapter's own
-      // stripUnsupportedForwardParams already drops it there on the same condition. A routed
-      // Responses gateway (Copilot, api.openai.com, ...) honors the field, and dropping it
-      // there silently ignores the caller's max_tokens.
-      if (route.provider.authMode === "forward") delete internalBody.max_output_tokens;
-      // temperature/top_p/stop/user stay stripped on every Responses route: `stop` is not
-      // a Responses parameter at all, reasoning models reject temperature/top_p, and the
-      // passthrough adapter relays the body verbatim — `noTemperatureModels` and friends
-      // are honored only by the openai-chat adapter, so there is no per-model filter here.
-      delete internalBody.temperature;
-      delete internalBody.top_p;
-      delete internalBody.stop;
-      delete internalBody.user;
+      stripUnsupportedResponsesSamplingParams(internalBody, route.provider);
     }
     // Estimated-usage adapters (cursor/kiro) report no per-turn input tokens; stash a
     // request-side estimate so the log's in:0 rows get a floor. NEVER set this for

src/server/responses-wire-params.ts

@@ -0,0 +1,32 @@
+import type { OcxProviderConfig } from "../types";
+
+/**
+ * Shape a translated Responses body for the wire the route actually uses.
+ *
+ * Shared by both translate-and-replay inbound handlers (Chat Completions and Anthropic
+ * Messages). They previously carried identical copies of this block and had to be patched
+ * in lockstep when the Copilot routed-gateway case appeared, which is exactly how the two
+ * drift apart.
+ *
+ * `store` is deliberately not handled here — only the Chat Completions handler has a
+ * non-Responses default for it.
+ */
+export function stripUnsupportedResponsesSamplingParams(
+  body: Record<string, unknown>,
+  provider: Pick<OcxProviderConfig, "authMode">,
+): void {
+  // Forward mode is the only route that 400s on max_output_tokens ("Unsupported parameter",
+  // verified live 2026-07-11), and the adapter's own stripUnsupportedForwardParams already
+  // drops it there on the same condition. A routed Responses gateway (Copilot,
+  // api.openai.com, ...) honors the field, and dropping it there silently ignores the
+  // caller's max_tokens.
+  if (provider.authMode === "forward") delete body.max_output_tokens;
+  // temperature/top_p/stop/user stay stripped on every Responses route: `stop` is not a
+  // Responses parameter at all, reasoning models reject temperature/top_p, and the
+  // passthrough adapter relays the body verbatim — `noTemperatureModels` and friends are
+  // honored only by the openai-chat adapter, so there is no per-model filter here.
+  delete body.temperature;
+  delete body.top_p;
+  delete body.stop;
+  delete body.user;
+}

src/server/responses/core.ts

@@ -1524,8 +1524,12 @@ export async function handleResponses(
       // Bounded: at most one token refresh, then one replay per remaining pool key.
       for (;;) {
         let nextProvider: OcxProviderConfig | undefined;
+        // Recorded on the replay's send so the request log explains WHY the send count grew,
+        // exactly as the normal loop's rebuildAndRefetch does.
+        let recoveryKind: AttemptRecoveryKind | undefined;
         if (upstreamResponse.status === 401 && isOAuth401ReplayProvider && sentOAuthSnapshot && !oauth401Replayed) {
           oauth401Replayed = true;
+          recoveryKind = "oauth-401";
           // Release the rejected response's socket before the refresh round-trip, not just
           // before the replay — a failed refresh returns without reaching the shared cancel.
           try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
@@ -1544,6 +1548,7 @@ export async function handleResponses(
             route.providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(route.providerName) : undefined,
           );
         } else if (upstreamResponse.status === 429 && hasKeyPoolFailover(route.provider)) {
+          recoveryKind = "key-429";
           nextProvider = rotateProviderTransportOn429(config, route.providerName, route.provider, {
             retryAfter: upstreamResponse.headers.get("retry-after"),
             now: Date.now(),
@@ -1563,7 +1568,7 @@ export async function handleResponses(
         request = await passthroughAdapter.buildRequest(parsed, { headers: selectedForwardHeaders });
         // Keep the request log's attempt count honest: a replay is a second upstream send,
         // exactly as the transient-5xx retry above records one.
-        noteAttemptSend(logCtx.activeAttempt, passthroughEstimate);
+        noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recoveryKind);
         try {
           upstreamResponse = await fetchWithHeaderTimeout(request.url, {
             method: request.method, headers: request.headers, body: request.body,