Deep combo-flow audit (all combo types x 14 strategies x resilience x proxy),
TDD-validated. Three production fixes:
1. chatCore executor-level emergency budget hop REMOVED: it executed the
emergency provider's request with the FAILING provider's credentials
(e.g. the OpenAI API key sent to integrate.api.nvidia.com) on every
non-stream 402/quota-429 - a cross-provider credential leak that also
never succeeded upstream (foreign keys are always rejected). Emergency
fallback is now orchestrated exclusively by the routing layer
(src/sse/handlers/chat.ts), which resolves credentials FOR the
emergency provider via account selection.
2. chat.ts emergency hop gated with !comboName: combos are the operator's
fallback policy (target-level orchestration + global fallback #689),
and the per-target hop burned extra upstream calls against exhausted
providers (#1731) and bypassed context-relay handoff injection on
account switches (the switch happened inside the detour with
comboStrategy=null, silently swapping the model for gpt-oss-120b).
3. /v1/messages/count_tokens now resolves the connection proxy and wraps
the provider-side count in runWithProxyContext - it previously ran
with no proxy context at all, going DIRECT regardless of configured
proxies. safeResolveProxy failures are now logged at warn (silent
proxy bypass was debug-only).
Tests: restores the five #1731 fast-skip integration tests skipped since
v3.8.2 (rewritten against the current routing policy, 8/8), adds
combo-strategy-fallbacks.test.ts (11 tests: fill-first/p2c/random/
cost-optimized/strict-random fallback paths, HALF_OPEN recovery, strategy
normalization), adds proxy-context-passthrough.test.ts (per-target combo
proxy independence + count_tokens proxy), and realigns the three tests
that asserted the removed leaking behavior.