feat: bound inference capacity replay

[AnthonyRonning]

Browser follow-up errors could trigger a blanket resend, and independent SDK repair and capacity retry paths could exceed the intended request count. This change gives browser Responses and native Agent inference one shared ceiling of two actual inference HTTP sends per logical model request.

• Replay the identical request at most once, only before stream consumption and only for OpenSecret's exact version-1, replay-safe inference_capacity contract. Cancellation interrupts the retry delay. Generic HTTP errors, provider 429/503 responses without that contract, malformed streams, and failures after streaming starts remain terminal. Browser capacity failure restores the composer input. See the backend contract and browser replay implementation.
• Share the send ceiling across capacity replay and SDK authentication/session repair. Bounded browser requests disable redirect following; native inference disables redirects and transport retries. Agent Mode also disables Goose's additional provider retries and withholds tool calls until a valid terminal stream, including exact [DONE], permits execution. See the Agent provider and Rust SDK transport.
• Remove Maple-imposed generation token caps from Agent requests, titles, thought labels, permission classifiers, and image descriptions. Clear Goose defaults and restored request parameters during configuration and again before logging/sending the final Agent payload, covering auxiliary and compaction calls. Model context metadata remains intact. Generic SDK/API callers retain their explicit generation-limit fields; the removal is scoped to Maple-owned inference.

The rebase preserves #878: Agent Mode uses the shared Quick/Powerful selector, defaults to Quick, migrates the previous GLM 5.2 recommendation, and preserves other explicit choices and existing session model locks.

Requires OpenSecret #300 for the replay contract. The client consumes that contract in either backend routing mode without changing provider/model selection or enabling Router v2. Unmarked errors fail closed. SDK integration revision: 91ed2e573aa5f358cfd0d59defd04d414be762fe.

Local validation at Maple 9cfcbc0e0d7ef55e74d0889089e90b4e71119f3b, based on master 57fb918a36c2dcc8c5d9d93cf32ddf45f1720177:

• Frontend format, lint and typechecks passed; 818 tests passed, zero failures, with 14 existing lint warnings. PR web build passed.
• TypeScript SDK format/build and credential-free functional tests passed: 123 passed, 3 hosted-attestation skips, zero failures. Audit status is separate below.
• Native Rust: 412 library tests and 3 binary tests passed, zero failures, 2 intentional ignores. Direct pinned formatter and warning-denied Clippy passed.
• Rust SDK: 85 unit tests passed, with pinned format, warning-denied Clippy and rustdoc checks passed. Proxy checks passed 24 unit and 3 integration tests, docs and dependency checks. Local dependency verification confirmed one in-tree SDK and proxy.
• The suites cover exact replay and shared SDK repair accounting, terminal tool buffering, restored configuration and final-wire token-limit removal, and selector regressions. Independent exact-head P0/P1 review found no actionable issues.

Audit remains failed: Bun reported four high-severity fast-uri advisories through ajv. The dependency manifests and lockfiles match master; the reviewed dependency path is SDK declaration-build tooling, with no identified application-runtime or outbound-request sink. Passing functional checks do not constitute an audit pass; dependency remediation remains separate.

Cumulative encrypted SDK smoke at final backend fc0e798a and Maple 9cfcbc0e passed all five Kimi mock scenarios in both routing modes: Chat, Responses, disconnect/reload, explicit cancellation, and tool continuation. Disconnect at 24 characters yielded durable completion with 7,917 characters after a fresh encrypted reload. Explicit cancellation returned HTTP 200, aborted upstream work, and durably retained 24 characters. An advertised search tool's empty-query error persisted through a second provider turn without external search. The mock rejected numeric generation-limit fields; every scenario used one client inference send.

Live standard GLM 5.3 Chat and Responses passed with Router v2 off and on, one client inference send each. Chat verified usage and exactly one finish/[DONE]; Responses verified terminal integrity and fresh-session durable retrieval. Backend identity and routing evidence confirmed both modes and GLM's Continuum route; a separate GLM 5.3 Flash legacy Chat request passed on Tinfoil.

The macOS workspace overlay debug package was built and its exact app identity and executable hash verified. Native Agent Mode, in read-only mode with no MCP servers, completed a GLM 5.3 legacy turn and generated a title. After quit/relaunch, the same task restored its transcript, title, and model lock, then completed a v2 turn. The app was quit afterward. This proves the packaged local overlay path, not released binaries, other-platform runtime, or native mocked-failure recovery.

Final GitHub snapshot, 2026-09-04 23:32:16 UTC: 30 successful checks, 2 expected master-only Web skips, no pending or failed checks. The exact head/master base/merge-base match; the PR is open, non-draft, mergeable/CLEAN, and zero commits behind. SDK integration passed against exact #300 91ed2e57: TypeScript 82 passed / 18 skipped / 0 failed; Rust 140 passed / 14 ignored / 0 failed, including 85 unit tests. Live-provider opt-ins were skipped. CodeQL has zero open alerts, with 7 dismissed Rust results. Web, macOS, Linux, Windows, iOS, and fake-signed Android artifact integrity was independently verified. Canonical unsigned Apple hashes were not independently reproduced, and CI artifacts were not launched. The TypeScript SDK job's aggregate success masks its failed audit, retained above.

Backend integration qualification: the exact final #300 scoped AEAD/database suite passed 20 tests with process exit 0 under pinned Rust 1.90 and 31 applied migrations. The complete helper remains failed because OAuth reported 2 passing assertions and then exited with SIGSEGV, also reproduced on unchanged backend master.

After smoke, both local fixture overrides were deleted and verified default off. The mock and native overlay were stopped, managed Continuum/OpenSecret restored, and the final managed workspace smoke passed. These checks do not enable production Router v2.

Routing walkthrough: capacity contract and Maple integration.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	72e8cc3
Status:	✅  Deploy successful!
Preview URL:	https://dcb9af14.maple-ca8.pages.dev
Branch Preview URL:	https://codex-routing-v2-capacity-re.maple-ca8.pages.dev

View logs