fix(usage): consolidate spend admission and observation boundaries

[luvs01]

Summary

This draft carries #5358, #5283, #5275 and #5255 into one accounting/observation boundary review:

• Native Chat reserves durable spend immediately before each physical send, using message and tool-definition input estimates plus the output ceiling. A refused reservation returns a local 429 before contacting upstream; key reselection updates the privacy-safe account label.
• Usage reports keep configured providers ending in -main distinct, while retaining the three recognized legacy Codex labels. Long requested selectors use a bounded prefix plus a digest of the complete value, and request-history filters apply the same representation.
• Access-key usage remains unavailable when attribution is absent or malformed instead of displaying a misleading zero/never-used result.
• The Models GUI keeps its independently owned app-server status read alive across picker-tab changes. Existing cancellation on API-base/restart/unmount remains intact. This changes lifecycle behavior, with no new layout or visible copy.

The six source commits and author attribution are preserved with cherry-pick provenance:

Source	Source commits
#5358	347204ff33e42bba7781e7b057443ea9808e9d06
#5283	89a927228c3e30f330f313ab8b2af37199892afd
#5275, including its review follow-up	3c3f14b5f7c5aa9fb0db19449a89310a67b230f2, e7584c39a769f76e332c0e96a18a8166166bb246
#5255, including the selector-collision review fix	9e6870db8de95894c35456a3267c612918bc297b, e3d0f9b6ea193f0d9be760ad3bd918a49a4cd937

Integration follow-ups include tool-definition reservation coverage, lifecycle/encoding documentation, test relocation within existing file caps, explicit Windows fixture shutdown/reaping, and equivalent batched canonical fixture writing for the 1,500-row pagination test. No row count, page count, assertion, timeout, platform skip, ACL requirement, or production limit was relaxed.

#5305 is excluded and remains OPEN. Its unconditional 64 MiB rotation/legacy deletion conflicts with current dev's opt-in usageLedgerMaxBytes, whole-ledger readers, revision-checked atomic retention, and coordinated reader invalidation. It is a separate policy proposal, not a fully carried source. #5463 is already carried separately by #5538 and is not duplicated here.

Latest dev 41ec40f7e31969d1ca7140e0d510077f74f4cbe3 is merged. Its only changes relative to the preparation base are the release checksum verifier and its test; the usage/GUI source changes remain unchanged.

Verification

The following are distinct runs, not a claim that the entire final suite passed:

• Initial nine-file focused run: 406 pass / 1 skip / 1 fail. The failure was the existing 1,500-row pagination case exceeding the unchanged 5-second limit. Native spend cases and all seven opt-in retention cases passed.
• After test relocation and Windows teardown fixes: 22 pass / 1 fail across the two affected files. Native spend and ownership-release assertions passed; EBUSY, teardown timeout, and owner-home conflicts no longer occurred. Pagination remained the only failure.
• Identical instrumented pagination fixture on both preparation HEAD and dev: 1,500 separate appends took approximately 4.57 s / 4.67 s; both exceeded the unchanged overall limit. This identified fixture-writing I/O, rather than assuming a baseline failure from the test's age.
• After writing the same normalized canonical rows in one operation: 4 pass / 0 fail, 1,534 assertions. The unchanged 1,500-row/15-page pagination case passed in 412 ms; actual incremental/tail append and long-selector lookup cases also passed. Other tests were name-filtered only for this focused invocation.
• Models GUI focused tests: 22 pass / 0 fail, 120 assertions. Root typecheck, GUI app/node typecheck and Vite production build passed. Shared dependencies were reused without installation; build/cache output was isolated.
• Structure SSOT, privacy scan and whitespace checks passed. On the final head, the release-verifier file passed all 33 tests. Ratchet's eight other cases passed; its repository scan first exceeded the unchanged 5-second timeout, then passed when that one failed case was rerun under the same conditions. No file-size cap or timeout was raised.
• Full final suite, hosted exact-head CI and POSIX-only validation have not been claimed. Independent maintainer security review remains pending before merge.

The screenshot uses the actual Models component, language provider and stylesheet with synthetic API data. Headless DOM checks confirmed that switching to Combos did not abort the held status request and that its stale response rendered the existing banner. This is a retained-state capture, not a visual redesign.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness remains draft:

• All CI tests are green on my local testing.
• I pushed my PR to the latest dev commit.
• I resolved all correct Codex and CodeRabbit findings.
• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 62 / 80

이 PR은 쓰임새와 한도 지키는 일을 한곳에 모읍니다. 예전에는 Native Chat이 위쪽으로 바로 나가서, 뿌리·계정·풀 한도를 피했습니다. 이제는 실제로 보내기 직전에 메시지·도구 설명·출력 상한을 셈해서 자리를 잡고, 자리가 없으면 위쪽에 손도 대지 않고 로컬 429를 돌려줍니다. 키가 바뀌면 안전한 계정 이름도 다시 찍습니다.

보고 쪽도 고칩니다. 이름이 -main으로 끝나는 설정 공급자는 서로 다른 줄로 남기고, 예전에 쓰이던 Codex 라벨 세 개만 합칩니다. 아주 긴 모델 이름은 앞부분과 전체의 짧은 지문으로 줄여 저장하고, 요청 기록 검색도 같은 방식으로 맞춥니다. 접근 키 쓰임새는 시작 시각이 없거나 깨져 있으면 0이나 "한 번도 안 씀" 대신 "unavailable"을 보여 줍니다. Models 화면은 Combos 탭으로 옮겨도 앱 서버 상태 읽기를 끊지 않습니다. 베이스는 dev이고, #5305·#5463은 일부러 안 넣었습니다.

tests/server/server-key-failover-e2e.test.ts / tests/server/server-xai-oauth-401-replay.test.ts - 호스트 CI가 같은 이유로 빨갛습니다. Native Chat이 보내기 전에 입력 토큰을 미리 셈한 뒤, 위쪽이 알려 준 실제 쓰임새 대신 그 추정치가 시도/기록 줄에 남습니다. 실패 예는 실제 inputTokens: 3 대신 estimated: true와 inputTokens: 8~9, totalTokens는 5가 아니라 11입니다. 한도를 막는 일은 맞는데, 기록의 "실제 사용량"이 틀어집니다.

src/server/chat-completions.ts / src/server/chat-native.ts - 추정치를 usageLogInputTokens에 넣고 noteProviderAttemptSend에 넘깁니다. 위쪽이 prompt_tokens/completion_tokens를 준 뒤에는 그 값이 최종 줄과 시도 줄을 덮어야 하는데, 지금 CI는 덮지 못한 상태를 보여 줍니다. 새로 넣은 spend 테스트만으로는 이 기록 회귀가 안 잡힙니다.

tests/usage/request-history-index.test.ts - 1,500줄 페이지 테스트가 한 번에 정규화한 파일을 씁니다. 시간은 살아났지만, 그 큰 경우는 실제 appendUsageEntry 경로를 더 이상 밟지 않습니다. 작은 증분 테스트는 남아 있습니다.

메인테이너의 판단이 필요한 지점

초안이고 작성자도 전체 스위트·보안 리뷰를 아직 안 끝냈다고 적었습니다. CI의 사용량 기록 깨짐이 "테스트만 고치면 된다"인지, "추정이 실제 보고를 가로막는 버그"인지 먼저 정해야 합니다. #5305를 빼 둔 판단은 문서와 맞고, 같은 묶음으로 넣으면 안 됩니다.

너의 추천

머지하지 말고, 먼저 Native Chat에서 위쪽 사용량이 오면 추정 줄을 실제 줄로 바꾸는 경로를 고치거나 증명하세요. server-key-failover-e2e와 server-xai-oauth-401-replay의 Native Chat 케이스가 초록이 되면 그다음입니다. 한도 거절·-main 분리·긴 셀렉터·unavailable 표시·Models 탭 유지 방향은 유지해도 됩니다.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Carried in #5608: ten commits are cherry-picked with authorship kept, plus follow-ups that accept only an ISO-8601 UTC attributionSince and document the aliasing limit of the idempotent selector encoding. The screenshot-asset commit is not carried; #5608 links the capture. Closing as superseded. Thank you @luvs01.