feat(gui): live routing tab: see which account answered, why others were skipped, and where the time went - #8730

Summary

The problem. When a request goes through OpenCodex there is no single place to see how it was routed: which account or combo target answered, why the other accounts were passed over, where the time went. The Logs page has the raw rows, but the reasoning is spread across routeDecision, attempts[] and account state that is never recorded at all.

What changes. The Models page gets a Live routing tab (#models/live), modeled on the routing page of Magpie (MIT, © yetone; ported logic carries the notice). For the latest request, or one selected in the list, it shows:

• The route: client → OpenCodex → every candidate. The account or combo target that answered, the ones that failed (HTTP status and reason), and the ones skipped before any send, each with a plain reason. A one-line outcome ("Tried 2 times; Personal answered last") and a numbered "how this request was routed" list explain it step by step.
• Where the time went: OpenCodex internal time, earlier failed attempts, the wait for the first token, and streaming. Every segment is a measured field; there is no DNS/TLS split because Bun's fetch does not expose one.
• Recent requests, grouped by request, session or API key, with account, model, effort, duration, time to first token, tokens, cache-hit %, tok/s and estimated cost. A value that is unknown shows a dash, never zero.

Combos and accounts keep their own pages; the tab links to them (Models › Combos, and the provider's Accounts tab with a one-line pool summary).

Who notices. Anyone running several OAuth accounts or combos can now answer "why did this request land on that account?" without reading JSON.

Backend (small, in-memory only)

• accountRoster on the final request row: for a request served by a multi-account generic OAuth provider, each account's hashed o-label and its state when the request finished (available, paused, needs-reauth, cooldown, quota-exhausted, model-unlisted), classified with the same checks the selector uses. Registered by the OAuth layer into a slot (src/server/request-log-route-live.ts), so request-log.ts does not import src/oauth, and an install that never loads OAuth pays one null check. The gate is the served o-label, which needs no config read.
• upstreamSendMs (request start to the final attempt's start) and an optional privacyRedactionMs, so the time bar is built from measurements only.
• GET /api/oauth/accounts returns the same logLabel per generic OAuth account, so the dashboard can show the account's display label for a roster entry.
• None of these fields reach usage.jsonl: the persistence projection rebuilds its row field by field and does not copy them. No bodies, account ids, emails or secrets are recorded.
• request-log.ts grows by 3 lines (1983 → 1986, cap 2000); everything else lives in new sibling files. No new import reaches src/lab/ from the core path.

A stacked follow-up PR (#8731) adds the context-window breakdown (system prompt, tools, skills, memory files, files, tool results, per-turn) on top of this.

Screenshots

Local test instance with a fake upstream: four OAuth accounts (one rate-limited, one paused, one needing sign-in) and a failover combo. Account labels are aliases from the fake store.

(The screenshot was taken on the stacked branch, so it also shows the context-window card from the follow-up PR.)

Verification

• bun run typecheck, bun run structure:check, bun run privacy:scan: pass.
• Focused backend tests: tests/usage/request-log-account-roster.test.ts, tests/usage/request-log-route-live-timing.test.ts, tests/oauth/oauth-accounts-log-label.test.ts, tests/usage/request-log.test.ts, tests/lab/core-lab-boundary.test.ts, tests/ci-workflows/file-size-ratchet.test.ts, tests/test-layout.test.ts, tests/gui/models-workspace-tabs.test.ts: pass.
• GUI: cd gui && bun test tests/route-live* tests/fr-localization.test.ts tests/locale-parity.test.ts tests/models-workspace-panels.test.tsx tests/compatibility-lab.test.tsx tests/models-keep-native-v1-placement.test.ts (includes new route-live-model, route-live-time, route-live-render), bun run lint, bun run lint:i18n, tsc --noEmit, bun run build: pass.
• Manual: ran the proxy from this branch with a fake OpenAI-compatible upstream and sent Responses, Chat Completions and Messages requests (account 429 failover, paused and needs-sign-in accounts, combo failover); the tab showed each case as described above.
• Not run locally: the full bun run test suite. Several sessions were running suites on the same Windows machine, so full-suite timeouts there were load, not signal; and the test preload's git-config guard rejects GIT_CONFIG_GLOBAL=NUL with this machine's git 2.56, failing the first case of every file and a handful of test-layout-tooling cases on unmodified dev as well. Focused files ran with OCX_GIT_CONFIG_GUARD_CHECKOUT pointing at a directory without .git. A local GUI suite run showed no failures in files this PR touches beyond one French-copy case, which is fixed here. Full coverage is left to CI.

Readiness (2026-11-13)

• Branch is 2 commit(s) behind dev (873ec9b), inside the gate's window; no rebase for review.
• No Codex or CodeRabbit findings are open on this PR (CodeRabbit skipped the draft; there are no inline review comments).
• Also merged into a local integration build with the other open PRs of this series and deployed on a real install. The combined build passed bun run typecheck, structure:check, skill:surface:check, privacy:scan, the layout and file-size guards and this PR's focused tests; after the deploy one real request each through Claude, GPT, Gemini, DeepSeek and Grok returned 200 and the error rate did not rise.
• Still needs the maintainer-sponsored label: the hygiene gate flags src/oauth/generic-account-failover.ts and src/server/management/oauth-account-routes.ts. Everything else is ready for review.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (docs-site/.../guides/model-routing.md, "Watching routing live")
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. (Only hashed account labels and sizes are recorded; /api/oauth/accounts gains a non-secret hashed label.)

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.