[TheViniAlmeida]

Problem and behavior

When a combo consumes a provider HALF_OPEN probe, a successful response cannot pass its own canExecute() guard. The provider stays blocked until the probe lease expires. Alias keys can diverge from the canonical chat key, and locally generated provider_circuit_open responses can be retried and recorded as upstream failures.

This change settles acquired probes inside execute() under the existing generation fence, preserves the settled identity through SSE wrappers, canonicalizes provider/connection accounting, and immediately advances priority and round-robin combos on local circuit refusals. External callbacks without the acquired lease cannot settle HALF_OPEN provider probes. Persisted credential errors do not count as new upstream attempts; genuine upstream 503 responses still count.

Closes #15588. Complements the consumed-probe recovery work in #15555 and #15257 with alias identity, stale-probe fencing, streaming propagation and local-refusal handling. Neither referenced PR is modified or assumed merged.

Validation

• Six isolated RED runs reproduce assertion failures on base 23a11484 (consumed probe, stale generation, alias identity, priority/round-robin local refusal, classifier, SSE and stored credential 503 paths).

• 33 focused regression tests pass, including an actual streamed combo response and no-credentials/all-rate-limited with zero provider fetches.

• Expanded native regression selection: 187 tests pass (breaker, cooldown, combo fallback/retry and streaming).

• Independent review: 24 regression tests pass in a clean environment.

• Full MCP/autoCombo/cache Vitest suite: 54 files, 493 tests pass (npm run test:vitest -- --maxWorkers=2, clean environment).

• Core typecheck, focused ESLint, file-size limits, changelog integrity and git diff --check pass. Commit hooks run without bypass.

• Production Docker runner-base build passes with the supported builder-only arguments OMNIROUTE_BUILD_MEMORY_MB=12288 and OMNIROUTE_BUILD_WORKERS=1 (the default 6144MB heap exhausted during webpack compilation). This custom artifact also preserves a pre-existing deployment heartbeat patch; that separate patch is outside this PR.

• Self-hosted canary and previous-image offline control pass with unchanged stable configuration and schema. Authenticated post-rollout validation passes for eight combo streams plus Chat nonstream and Responses stream (short synthetic prompts).

⚠️ base-red inherited: #15306. The full native/integration suites are not claimed green by this PR; native validation uses the expanded regression selection above. The complete configured Vitest suite passed in this contribution. No dependency, schema, security-policy or baseline-budget changes.

[lotexdj]

Additional production confirmation from an operator-authorized investigation on 2026-10-13. Posting here rather than opening a duplicate because the consumed-probe recovery defect matches this PR. This is evidence from 3.8.51, not a regression claim against the merged fix.

Affected artifact: official diegosouzapw/omniroute:3.8.51, digest sha256:8bd462c9f60d8eda79329cfbb6ea7ea723505fe7721beb944f3d43835409e218.

Observed behavior: the persisted canonical codex breaker remained HALF_OPEN, failure count 4, reset timeout 60000 ms, one probe permit. A two-hour call-log window contained 77 Codex 503 Pipeline gate rejected entries, while fixed-connection combo requests to the same Codex provider continued to return HTTP 200. Logs said Circuit breaker OPEN ... rejecting request even when the persisted state was HALF_OPEN. No OOM/restarts or resource-pressure events were present in the inspected interval.

Shipped-code reproduction: extracted the actual CircuitBreaker class from the installed bundle and stubbed persistence only. Starting with HALF_OPEN/one permit, execute(async () => ({success:true,status:200}), {classifyResult: () => 'ignore'}) consumed the permit but left HALF_OPEN and canExecute() === false. Advancing past the 60-second lease allowed another success that repeated the cycle. Explicit successful outcome accounting closed the breaker in the control. This reproduces the class-level symptom; it is not a replacement for your full combo regression coverage.

A temporary Codex-only local mitigation credits confirmed parsed nonstream success or clean terminal stream completion, with duplicate/shadow/stale-generation exclusions and unchanged failure handling. After deploying it, the persisted HALF_OPEN breaker transitioned to CLOSED with failure count 0 at 12:42:53 UTC. Two authenticated combo chats, completed combo SSE, and two consecutive direct Codex chats passed; the final breaker remained CLOSED/0. Focused negative checks covered abort/error completion and stale-generation exclusion. This local mitigation is not claimed equivalent to your acquired-lease design, nor is it proposed as an additional upstream patch.

We discovered this merged PR during duplicate checking after the local mitigation. We have not yet tested an official release containing #15594 on this instance. Please treat this as independent confirmation of the impact on the older shipped artifact and of the need to credit successful consumed probes. No hostnames, addresses, account identifiers, credentials, prompts from real workloads, or raw logs are included.