@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/codex/runtime.ts

@@ -13,32 +13,38 @@ export type CodexRuntimeSource =
   | "path"
   | "fallback";
 
+export type DeepReadonly<T> =
+  T extends (...args: never[]) => unknown ? T
+    : T extends readonly (infer U)[] ? readonly DeepReadonly<U>[]
+      : T extends object ? { readonly [K in keyof T]: DeepReadonly<T[K]> }
+        : T;
+
 export interface ResolvedCodexRuntime {
-  command: string;
-  version: string | null;
-  source: CodexRuntimeSource;
+  readonly command: string;
+  readonly version: string | null;
+  readonly source: CodexRuntimeSource;
 }
 
 export interface RuntimeProbeFailure {
-  command: string;
-  source: CodexRuntimeSource;
-  reason: string;
+  readonly command: string;
+  readonly source: CodexRuntimeSource;
+  readonly reason: string;
 }
 
 export interface EffortClampDiagnostic {
-  runtimePath: string;
-  runtimeVersion: string | null;
-  removedEfforts: string[];
-  affectedModels: string[];
+  readonly runtimePath: string;
+  readonly runtimeVersion: string | null;
+  readonly removedEfforts: readonly string[];
+  readonly affectedModels: readonly string[];
 }
 
 export interface ResolveCodexRuntimeResult {
-  runtime: ResolvedCodexRuntime;
-  failures: RuntimeProbeFailure[];
-  replacedConfigured?: { from: ResolvedCodexRuntime; reason: string };
-  newerAvailable?: ResolvedCodexRuntime;
+  readonly runtime: ResolvedCodexRuntime;
+  readonly failures: readonly RuntimeProbeFailure[];
+  readonly replacedConfigured?: Readonly<{ from: ResolvedCodexRuntime; reason: string }>;
+  readonly newerAvailable?: ResolvedCodexRuntime;
   /** Set when the selected runtime could not be written to codex-runtime.json. */
-  persistError?: string;
+  readonly persistError?: string;
 }
 
 export type RuntimeExecFile = (
@@ -70,17 +76,43 @@ export interface ResolveCodexRuntimeDeps {
   discoverAlternatives?: boolean;
 }
 
-interface PersistedRuntimeState {
-  version: 1;
-  command: string;
-  source: CodexRuntimeSource;
-  selectedVersion: string | null;
-  updatedAt: string;
+export interface PersistedCodexRuntimeState {
+  readonly version: 1;
+  readonly command: string;
+  readonly source: CodexRuntimeSource;
+  readonly selectedVersion?: string | null;
+  readonly updatedAt: string;
 }
 
 const PERSIST_FILE = "codex-runtime.json";
 const CLAMP_PERSIST_FILE = "codex-runtime-clamp.json";
 
+function cloneAndDeepFreeze<T>(value: T): DeepReadonly<T> {
+  const clone = (current: unknown): unknown => {
+    if (Array.isArray(current)) return current.map(clone);
+    if (current && typeof current === "object") {
+      const out: Record<string, unknown> = {};
+      for (const [key, child] of Object.entries(current)) out[key] = clone(child);
+      return out;
+    }
+    return current;
+  };
+  const freeze = (current: unknown): unknown => {
+    if (!current || typeof current !== "object" || Object.isFrozen(current)) return current;
+    for (const child of Object.values(current)) freeze(child);
+    return Object.freeze(current);
+  };
+  return freeze(clone(value)) as DeepReadonly<T>;
+}
+
+function isCodexRuntimeSource(value: unknown): value is CodexRuntimeSource {
+  return value === "environment"
+    || value === "configured"
+    || value === "shim"
+    || value === "path"
+    || value === "fallback";
+}
+
 export function codexRuntimeStatePath(configDir: string = getConfigDir()): string {
   return join(configDir, PERSIST_FILE);
 }
@@ -94,9 +126,16 @@ interface PersistedClampState extends EffortClampDiagnostic {
   updatedAt: string;
 }
 
+interface LoadedEffortClampDiagnostic {
+  runtimePath: string;
+  runtimeVersion: string | null;
+  removedEfforts: string[];
+  affectedModels: string[];
+}
+
 export function loadLastEffortClamp(
   deps: ResolveCodexRuntimeDeps = {},
-): EffortClampDiagnostic | null {
+): LoadedEffortClampDiagnostic | null {
   const configDir = deps.configDir ?? getConfigDir();
   const read = deps.readFileSync ?? ((path, encoding) => readFileSync(path, encoding));
   try {
@@ -196,15 +235,31 @@ export function compareCodexVersions(a: string | null, b: string | null): number
   return 0;
 }
 
+/** Parse already-observed runtime-selection bytes without consulting the filesystem. */
+export function parsePersistedCodexRuntime(
+  bytes: string | Uint8Array,
+): DeepReadonly<PersistedCodexRuntimeState> | null {
+  try {
+    const text = typeof bytes === "string" ? bytes : Buffer.from(bytes).toString("utf8");
+    const raw = JSON.parse(text) as Partial<PersistedCodexRuntimeState>;
+    if (raw.version !== 1 || typeof raw.command !== "string" || !raw.command.trim()) return null;
+    if (!isCodexRuntimeSource(raw.source) || typeof raw.updatedAt !== "string") return null;
+    if (raw.selectedVersion !== undefined
+      && raw.selectedVersion !== null
+      && typeof raw.selectedVersion !== "string") return null;
+    return cloneAndDeepFreeze(raw as PersistedCodexRuntimeState);
+  } catch {
+    return null;
+  }
+}
+
 export function loadPersistedCodexRuntime(
   deps: ResolveCodexRuntimeDeps = {},
-): PersistedRuntimeState | null {
+): DeepReadonly<PersistedCodexRuntimeState> | null {
   const configDir = deps.configDir ?? getConfigDir();
   const read = deps.readFileSync ?? ((path, encoding) => readFileSync(path, encoding));
   try {
-    const raw = JSON.parse(read(codexRuntimeStatePath(configDir), "utf8")) as PersistedRuntimeState;
-    if (raw?.version !== 1 || typeof raw.command !== "string" || !raw.command.trim()) return null;
-    return raw;
+    return parsePersistedCodexRuntime(read(codexRuntimeStatePath(configDir), "utf8"));
   } catch {
     return null;
   }
@@ -216,16 +271,16 @@ export function persistCodexRuntime(
 ): void {
   const configDir = deps.configDir ?? getConfigDir();
   mkdirSync(configDir, { recursive: true, mode: 0o700 });
-  const payload: PersistedRuntimeState = {
+  const payload: PersistedCodexRuntimeState = {
     version: 1,
     command: runtime.command,
     source: runtime.source,
     selectedVersion: runtime.version,
     updatedAt: new Date((deps.now ?? Date.now)()).toISOString(),
   };
+  // Invalidate process authority before the persisted replacement is visible.
+  clearCodexRuntimeResolveCache();
   atomicWriteFile(codexRuntimeStatePath(configDir), `${JSON.stringify(payload, null, 2)}\n`);
-  // Same-process consumers must re-resolve; catalog cache is keyed by runtime identity.
-  resolveCache = null;
 }
 
 function probeVersion(
@@ -360,15 +415,68 @@ export function effortClampAppliesToRuntime(
 }
 
 const RESOLVE_CACHE_MS = 15_000;
-let resolveCache: { key: string; at: number; value: ResolveCodexRuntimeResult } | null = null;
+interface ResolveCacheMemo {
+  readonly key: string;
+  readonly at: number;
+  readonly epoch: number;
+  readonly valueIdentity: string;
+  readonly value: DeepReadonly<ResolveCodexRuntimeResult>;
+}
+
+export type CodexRuntimeProcessCachePeek =
+  | Readonly<{
+      kind: "available";
+      epoch: number;
+      valueIdentity: string;
+      value: DeepReadonly<ResolveCodexRuntimeResult>;
+    }>
+  | Readonly<{ kind: "unavailable"; epoch: number }>;
+
+let resolveCacheEpoch = 0;
+let resolveCache: ResolveCacheMemo | null = null;
+
+function publishResolveCache(key: string, at: number, value: ResolveCodexRuntimeResult): void {
+  const epoch = ++resolveCacheEpoch;
+  resolveCache = {
+    key,
+    at,
+    epoch,
+    valueIdentity: `runtime:${epoch}`,
+    value: cloneAndDeepFreeze(value),
+  };
+}
+
+function clearResolveCache(): void {
+  resolveCacheEpoch += 1;
+  resolveCache = null;
+}
+
+/** Clear process-local runtime authority without resolving a replacement. */
+export function clearCodexRuntimeResolveCache(): void {
+  clearResolveCache();
+}
+
+/** Observe only an unexpired successful process memo; never resolves or probes. */
+export function peekCodexRuntimeProcessCache(): CodexRuntimeProcessCachePeek {
+  const memo = resolveCache;
+  if (!memo || Date.now() - memo.at >= RESOLVE_CACHE_MS) {
+    return Object.freeze({ kind: "unavailable" as const, epoch: resolveCacheEpoch });
+  }
+  return Object.freeze({
+    kind: "available" as const,
+    epoch: memo.epoch,
+    valueIdentity: memo.valueIdentity,
+    value: cloneAndDeepFreeze(memo.value),
+  });
+}
 
 function persistedRuntimeCacheStamp(deps: ResolveCodexRuntimeDeps): string {
   // Include on-disk selection so doctor --fix in another process busts this memo.
   const configDir = deps.configDir ?? getConfigDir();
   const read = deps.readFileSync ?? ((path, encoding) => readFileSync(path, encoding));
   try {
-    const raw = JSON.parse(read(codexRuntimeStatePath(configDir), "utf8")) as PersistedRuntimeState;
-    if (raw?.version !== 1 || typeof raw.command !== "string") return "";
+    const raw = parsePersistedCodexRuntime(read(codexRuntimeStatePath(configDir), "utf8"));
+    if (!raw) return "";
     return `${raw.command}|${raw.selectedVersion ?? ""}|${raw.updatedAt ?? ""}`;
   } catch {
     return "";
@@ -397,17 +505,30 @@ function resolveCacheKey(deps: ResolveCodexRuntimeDeps): string | null {
 export function resolveCodexRuntime(deps: ResolveCodexRuntimeDeps = {}): ResolveCodexRuntimeResult {
   const cacheKey = resolveCacheKey(deps);
   if (cacheKey && resolveCache && resolveCache.key === cacheKey && Date.now() - resolveCache.at < RESOLVE_CACHE_MS) {
-    return resolveCache.value;
+    return cloneAndDeepFreeze(resolveCache.value);
   }
 
   const result = resolveCodexRuntimeUncached(deps);
-  if (cacheKey) resolveCache = { key: cacheKey, at: Date.now(), value: result };
-  return result;
+  if (cacheKey) {
+    publishResolveCache(cacheKey, Date.now(), result);
+    return cloneAndDeepFreeze(resolveCache!.value);
+  }
+  return cloneAndDeepFreeze(result);
 }
 
 /** Test-only: drop the short-lived process resolve cache. */
 export function resetCodexRuntimeResolveCacheForTests(): void {
-  resolveCache = null;
+  clearCodexRuntimeResolveCache();
+}
+
+/** Test-only owner mutation seam; input is cloned and frozen before publication. */
+export function setCodexRuntimeResolveCacheForTests(
+  value: ResolveCodexRuntimeResult,
+  deps: ResolveCodexRuntimeDeps = {},
+): void {
+  const key = resolveCacheKey(deps);
+  if (!key) throw new TypeError("Injected runtime dependencies cannot populate the process memo.");
+  publishResolveCache(key, Date.now(), value);
 }
 
 function resolveCodexRuntimeUncached(deps: ResolveCodexRuntimeDeps = {}): ResolveCodexRuntimeResult {
@@ -468,7 +589,7 @@ function resolveCodexRuntimeUncached(deps: ResolveCodexRuntimeDeps = {}): Resolv
       replacedConfigured = {
         from: {
           command: persisted.command,
-          version: persisted.selectedVersion,
+          version: persisted.selectedVersion ?? null,
           source: "configured",
         },
         reason: failures.find(item => sameRuntimeCommand(item.command, persisted.command))?.reason
@@ -518,7 +639,7 @@ export function resolveAndPersistCodexRuntime(
       const message = error instanceof Error ? error.message : String(error);
       const persistError = redactUserPath(redactSecretString(message)).slice(0, 200);
       console.warn(`[opencodex] Failed to persist Codex runtime selection: ${persistError}`);
-      return { ...result, persistError };
+      return cloneAndDeepFreeze({ ...result, persistError });
     }
   }
   return result;

package/src/codex/shim.ts

@@ -19,7 +19,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { getConfigDir } from "../config";
-import { durableBunPath } from "../lib/bun-runtime";
+import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime } from "../lib/bun-runtime";
+import type { BunRuntimeSource } from "../lib/bun-runtime";
 import { isProcessAlive } from "../lib/process-control";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
@@ -120,11 +121,13 @@ export type CodexShimAutoRestoreResult =
   | { status: "ineligible" | "deferred"; message?: string }
   | { status: "restored"; message: string };
 
-function cliEntry(): { bun: string; cli: string } {
+function cliEntry(): { bun: string; bunRuntimeSource: BunRuntimeSource; cli: string } {
   // Bundled Bun path (survives `ocx update`); all three shim builders
   // (Unix / Windows cmd / Windows PowerShell) receive it via this entry.
   // This module lives in src/codex/, the CLI entry in src/cli/index.ts.
-  return { bun: durableBunPath(), cli: join(import.meta.dir, "..", "cli", "index.ts") };
+  // Path and provenance resolve together so the marker always describes this binary.
+  const runtime = durableBunRuntime();
+  return { bun: runtime.path, bunRuntimeSource: runtime.source, cli: join(import.meta.dir, "..", "cli", "index.ts") };
 }
 
 function commandNames(name: string): string[] {
@@ -366,7 +369,16 @@ function shQuote(value: string): string {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 
-export function buildUnixCodexShim(realCodexPath: string, bunPath: string, cliPath: string, tokenFile = serviceApiTokenFilePath()): string {
+// Provenance is required rather than defaulted: a default would let a caller pass an
+// override binary and silently label it something else, which is precisely the
+// path/marker disagreement this feature exists to prevent.
+//
+// The marker is scoped to the `ensure` invocation in every flavor below and is never
+// exported into the shim's own environment. A shim wraps the real `codex`, so an
+// exported marker would be inherited by Codex and everything it spawns — a shell that
+// then ran a *different* Bun directly would carry a provenance describing a binary it
+// is not executing.
+export function buildUnixCodexShim(realCodexPath: string, bunPath: string, cliPath: string, bunRuntimeSource: BunRuntimeSource, tokenFile = serviceApiTokenFilePath()): string {
   const internalCommands = CODEX_INTERNAL_COMMANDS.join("|");
   const valueOptions = CODEX_GLOBAL_OPTIONS_WITH_VALUE.join("|");
   return `#!/usr/bin/env sh
@@ -406,7 +418,7 @@ case "$ocx_subcommand" in
     ;;
   *)
     if [ -z "$OCX_SHIM_BYPASS" ]; then
-      ${shQuote(bunPath)} ${shQuote(cliPath)} ensure >/dev/null 2>&1 || true
+      ${BUN_RUNTIME_SOURCE_ENV}=${shQuote(bunRuntimeSource)} ${BUN_RUNTIME_PATH_ENV}=${shQuote(bunPath)} ${shQuote(bunPath)} ${shQuote(cliPath)} ensure >/dev/null 2>&1 || true
     fi
     ;;
 esac
@@ -431,7 +443,7 @@ function windowsBatchSet(name: string, value: string): string {
   return `set "${name}=${windowsEnvIndirectBatchValue(value, windowsBatchValue)}"`;
 }
 
-export function buildWindowsCodexShim(realCodexPath: string, bunPath: string, cliPath: string): string {
+export function buildWindowsCodexShim(realCodexPath: string, bunPath: string, cliPath: string, bunRuntimeSource: BunRuntimeSource): string {
   const internalCommandChecks = CODEX_INTERNAL_COMMANDS.map(command => `if /I "%~1"=="${command}" goto run_codex`).join("\r\n");
   const valueOptionChecks = CODEX_GLOBAL_OPTIONS_WITH_VALUE.map(option => `if /I "%~1"=="${option}" goto skip_option_value`).join("\r\n");
   return `@echo off\r
@@ -462,7 +474,11 @@ if "%~1"=="" goto ensure_ocx\r
 shift\r
 goto scan_codex_args\r
 :ensure_ocx\r
+setlocal\r
+${windowsBatchSet(BUN_RUNTIME_SOURCE_ENV, bunRuntimeSource)}\r
+${windowsBatchSet(BUN_RUNTIME_PATH_ENV, bunPath)}\r
 "%OCX_BUN%" "%OCX_CLI%" ensure >nul 2>nul\r
+endlocal\r
 :run_codex\r
 "%OCX_REAL_CODEX%" %*\r
 `;
@@ -472,7 +488,7 @@ function psString(value: string): string {
   return `'${value.replace(/'/g, "''")}'`;
 }
 
-export function buildWindowsPowerShellCodexShim(realCodexPath: string, bunPath: string, cliPath: string): string {
+export function buildWindowsPowerShellCodexShim(realCodexPath: string, bunPath: string, cliPath: string, bunRuntimeSource: BunRuntimeSource): string {
   const internalCommands = CODEX_INTERNAL_COMMANDS.map(command => psString(command)).join(", ");
   const valueOptions = CODEX_GLOBAL_OPTIONS_WITH_VALUE.map(option => psString(option)).join(", ");
   const tokenFile = serviceApiTokenFilePath();
@@ -497,7 +513,17 @@ foreach ($argValue in $args) {
 }
 $skipEnsure = $env:OCX_SHIM_BYPASS -or $internalCommands -contains $subcommand -or @("--help", "-h", "--version", "-V") -contains $subcommand
 if (-not $skipEnsure) {
-  & ${psString(bunPath)} ${psString(cliPath)} ensure *> $null
+  $priorRuntimeSource = $env:${BUN_RUNTIME_SOURCE_ENV}
+  $priorRuntimePath = $env:${BUN_RUNTIME_PATH_ENV}
+  $env:${BUN_RUNTIME_SOURCE_ENV} = ${psString(bunRuntimeSource)}
+  $env:${BUN_RUNTIME_PATH_ENV} = ${psString(bunPath)}
+  try { & ${psString(bunPath)} ${psString(cliPath)} ensure *> $null }
+  finally {
+    if ($null -eq $priorRuntimeSource) { Remove-Item Env:\\${BUN_RUNTIME_SOURCE_ENV} -ErrorAction SilentlyContinue }
+    else { $env:${BUN_RUNTIME_SOURCE_ENV} = $priorRuntimeSource }
+    if ($null -eq $priorRuntimePath) { Remove-Item Env:\\${BUN_RUNTIME_PATH_ENV} -ErrorAction SilentlyContinue }
+    else { $env:${BUN_RUNTIME_PATH_ENV} = $priorRuntimePath }
+  }
 }
 & ${psString(realCodexPath)} @args
 exit $LASTEXITCODE
@@ -601,25 +627,25 @@ function gitBashPath(path: string): string {
 }
 
 function writeShim(wrapperPath: string, realCodexPath: string): void {
-  const { bun, cli } = cliEntry();
+  const { bun, bunRuntimeSource, cli } = cliEntry();
   if (process.platform === "win32") {
     const lower = wrapperPath.toLowerCase();
     if (lower.endsWith(".ps1")) {
       // UTF-8 BOM: Windows PowerShell 5.1 decodes BOM-less .ps1 files in the ANSI
       // codepage, which mangles non-ASCII paths embedded in the shim.
-      writeFileSync(wrapperPath, `\uFEFF${buildWindowsPowerShellCodexShim(realCodexPath, bun, cli)}`, "utf8");
+      writeFileSync(wrapperPath, `\uFEFF${buildWindowsPowerShellCodexShim(realCodexPath, bun, cli, bunRuntimeSource)}`, "utf8");
     } else if (lower.endsWith(".cmd") || lower.endsWith(".bat")) {
-      writeFileSync(wrapperPath, buildWindowsCodexShim(realCodexPath, bun, cli), "utf8");
+      writeFileSync(wrapperPath, buildWindowsCodexShim(realCodexPath, bun, cli, bunRuntimeSource), "utf8");
     } else {
       // Extensionless Git-Bash sh launcher: sh shim with forward-slash paths.
       writeFileSync(
         wrapperPath,
-        buildUnixCodexShim(gitBashPath(realCodexPath), gitBashPath(bun), gitBashPath(cli), gitBashPath(serviceApiTokenFilePath())),
+        buildUnixCodexShim(gitBashPath(realCodexPath), gitBashPath(bun), gitBashPath(cli), bunRuntimeSource, gitBashPath(serviceApiTokenFilePath())),
         "utf8",
       );
     }
   } else {
-    writeFileSync(wrapperPath, buildUnixCodexShim(realCodexPath, bun, cli), "utf8");
+    writeFileSync(wrapperPath, buildUnixCodexShim(realCodexPath, bun, cli, bunRuntimeSource), "utf8");
     chmodSync(wrapperPath, 0o755);
   }
 }

package/src/codex/subagent-model-fallback.ts

@@ -15,11 +15,16 @@ import { CODEX_HOME, getCodexHome } from "./paths";
 import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import {
   canAcquireCodexQuotaProbeLease,
+  codexQuotaScopeForModel,
   computeCodexUsageScore,
+  getCodexQuotaHealthSnapshot,
   getPoolAccountPlan,
   isCodexAccountInCooldown,
 } from "./routing";
-import { isCodexAccountUsable } from "./account-usability";
+import {
+  isCodexAccountUsable,
+  type CodexAccountUsabilityOptions,
+} from "./account-usability";
 import { isCodexAccountPaused } from "./account-pause";
 import { slugEquals } from "../providers/slug-codec";
 import { isThreadSpawnRequest } from "../server/effort-policy";
@@ -27,6 +32,7 @@ import { PROVIDER_REGISTRY } from "../providers/registry";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { routeModel, type RouteResult } from "../router";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { codexAccountNamespaceForModel } from "./account-namespace-match";
 export const DEFAULT_SUBAGENT_MODEL_FALLBACK_POLL_MS = 60_000;
 
 type SubagentQuotaPrimeFn = (config: OcxConfig, reason: string) => Promise<void>;
@@ -68,6 +74,13 @@ function isDisabledFallbackModel(model: string, config: OcxConfig): boolean {
   const slash = model.indexOf("/");
   const provider = model.slice(0, slash);
   const modelId = model.slice(slash + 1);
+  if (codexAccountNamespaceForModel(config.codexAccountNamespaces, model)) {
+    return disabled.some(stored =>
+      stored === model
+      || stored === modelId
+      || slugEquals(stored, "openai", modelId)
+    );
+  }
   return disabled.some(stored => stored === model || slugEquals(stored, provider, modelId));
 }
 
@@ -79,13 +92,22 @@ function pollIntervalMs(config: OcxConfig): number {
   return configured;
 }
 
+function fallbackChainKey(model: string, namespaces: unknown): string {
+  const selector = codexAccountNamespaceForModel(namespaces, model);
+  if (!selector) return JSON.stringify(["model", model.toLowerCase()]);
+  const slash = model.indexOf("/");
+  // Selector keys are exact-case account boundaries. Keep that segment distinct while
+  // retaining legacy case-insensitive de-duplication for the native model suffix.
+  return JSON.stringify(["account", selector, model.slice(slash + 1).toLowerCase()]);
+}
+
 function normalizedChain(primary: string, config: OcxConfig, extra: readonly string[] = []): string[] {
   const chain: string[] = [];
   const seen = new Set<string>();
   const push = (model: string | undefined) => {
     if (!model || model.trim() === "") return;
     const trimmed = model.trim();
-    const key = trimmed.toLowerCase();
+    const key = fallbackChainKey(trimmed, config.codexAccountNamespaces);
     if (seen.has(key)) return;
     seen.add(key);
     chain.push(trimmed);
@@ -127,9 +149,18 @@ function resolvePoolFallbackAccountId(
   return activeCodexAccountId(config);
 }
 
+function resolveRouteFallbackAccountId(
+  route: RouteResult | null,
+  config: OcxConfig,
+  accountId?: string | null,
+): string | null {
+  return route?.codexAccountId ?? resolvePoolFallbackAccountId(config, accountId);
+}
+
 function isRoutableFallbackModel(model: string, config: OcxConfig): boolean {
   const slash = model.indexOf("/");
   if (slash > 0) {
+    if (codexAccountNamespaceForModel(config.codexAccountNamespaces, model)) return true;
     const providerName = model.slice(0, slash);
     if (!hasOwnProvider(config.providers, providerName)) {
       // Allow well-known "vendor/model" ids (e.g. anthropic/claude-*) to flow as
@@ -150,7 +181,7 @@ export function isNativeModelQuotaExhausted(
 ): boolean {
   const route = tryRouteFallbackModel(config, model);
   if (!route || !isPoolCodexRoute(route)) return false;
-  const resolvedAccountId = resolvePoolFallbackAccountId(config, accountId);
+  const resolvedAccountId = resolveRouteFallbackAccountId(route, config, accountId);
   if (!resolvedAccountId) return false;
   const quota = getAccountQuota(resolvedAccountId);
   const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId));
@@ -167,7 +198,11 @@ export function isModelHealthBlocked(
   const route = tryRouteFallbackModel(config, model);
   const poolScoped = !!route && isPoolCodexRoute(route);
   const health = modelHealth.get(
-    healthKey(model, resolvePoolFallbackAccountId(config, accountId), poolScoped),
+    healthKey(
+      model,
+      resolveRouteFallbackAccountId(route, config, accountId),
+      poolScoped,
+    ),
   );
   return !!health && health.unavailableUntil > now;
 }
@@ -177,6 +212,7 @@ export function isSubagentModelUnavailable(
   config: OcxConfig,
   accountId?: string | null,
   now = Date.now(),
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): boolean {
   if (isDisabledFallbackModel(model, config)) return true;
   if (!isRoutableFallbackModel(model, config)) return true;
@@ -187,11 +223,17 @@ export function isSubagentModelUnavailable(
 
   // Pool candidates need a usable account. Derive requirement from the resolved
   // route (canonical openai defaults to pool even when codexAccountMode is omitted).
-  const resolvedAccountId = resolvePoolFallbackAccountId(config, accountId);
+  const resolvedAccountId = resolveRouteFallbackAccountId(route, config, accountId);
   if (!resolvedAccountId) return true;
   if (isCodexAccountPaused(config, resolvedAccountId)) return true;
-  if (!isCodexAccountUsable(config, resolvedAccountId)) return true;
-  if (
+  if (!isCodexAccountUsable(config, resolvedAccountId, accountUsabilityOptions)) return true;
+  if (route.codexAccountId !== undefined) {
+    // An account-qualified route is pinned and cannot consume Pool's recovery-probe
+    // escape hatch. Honor both account-wide and model-scoped cooldowns so fallback
+    // advances instead of selecting a candidate that exact auth will reject.
+    const quotaScope = codexQuotaScopeForModel(route.modelId);
+    if (getCodexQuotaHealthSnapshot(resolvedAccountId, quotaScope, now) !== null) return true;
+  } else if (
     isCodexAccountInCooldown(resolvedAccountId, now)
     && !canAcquireCodexQuotaProbeLease(resolvedAccountId, now)
   ) {
@@ -207,6 +249,7 @@ export function selectAvailableSubagentModel(
   accountId?: string | null,
   now = Date.now(),
   nativeFallbackOnly = false,
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): { model: string; rewritten: boolean; skipped: string[] } {
   const chain = normalizedChain(primary, config, extraFallback);
   const skipped: string[] = [];
@@ -218,7 +261,7 @@ export function selectAvailableSubagentModel(
         continue;
       }
     }
-    if (isSubagentModelUnavailable(candidate, config, accountId, now)) {
+    if (isSubagentModelUnavailable(candidate, config, accountId, now, accountUsabilityOptions)) {
       skipped.push(candidate);
       continue;
     }
@@ -240,7 +283,11 @@ export function noteSubagentModelFailure(
   const route = tryRouteFallbackModel(config, model);
   const poolScoped = !!route && isPoolCodexRoute(route);
   modelHealth.set(
-    healthKey(model, resolvePoolFallbackAccountId(config, accountId), poolScoped),
+    healthKey(
+      model,
+      resolveRouteFallbackAccountId(route, config, accountId),
+      poolScoped,
+    ),
     {
       unavailableUntil: now + interval,
       reason: "quota_exhausted",
@@ -324,13 +371,16 @@ export function readCodexAgentModel(role: string, codexHome = CODEX_HOME): strin
 export function resolveAgentModelFallbackForPrimary(
   primary: string,
   codexHome = CODEX_HOME,
+  namespaces?: unknown,
 ): string[] {
   const merged: string[] = [];
   const seen = new Set<string>();
   const push = (model: string | null | undefined) => {
     if (!model || model.trim() === "") return;
     const trimmed = model.trim();
-    const key = trimmed.toLowerCase();
+    // Match global-chain de-dupe: keep account-selector prefixes case-sensitive when
+    // those selectors are configured, while ordinary provider/model ids stay case-insensitive.
+    const key = fallbackChainKey(trimmed, namespaces);
     if (seen.has(key)) return;
     seen.add(key);
     merged.push(trimmed);
@@ -349,7 +399,12 @@ export function resolveAgentModelFallbackForPrimary(
  * after a successful refresh so failures remain retryable. Errors are swallowed so
  * spawn routing can continue.
  */
-export function maybePrimeSubagentQuota(config: OcxConfig, now = Date.now()): Promise<void> {
+export function maybePrimeSubagentQuota(
+  config: OcxConfig,
+  now = Date.now(),
+  options: { nativeMainReadsForbidden?: boolean } = {},
+): Promise<void> {
+  if (options.nativeMainReadsForbidden) return Promise.resolve();
   if (quotaPrimeInFlight) return quotaPrimeInFlight;
   if (!shouldPrimeSubagentQuota(config, now)) return Promise.resolve();
 
@@ -391,9 +446,14 @@ export function applySubagentModelFallback(
   accountId?: string | null,
   now = Date.now(),
   nativeFallbackOnly = false,
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): { from?: string; to?: string; skipped?: string[] } | null {
   if (!isThreadSpawnRequest(headers)) return null;
-  const roleFallback = resolveAgentModelFallbackForPrimary(parsed.modelId, getCodexHome());
+  const roleFallback = resolveAgentModelFallbackForPrimary(
+    parsed.modelId,
+    getCodexHome(),
+    config.codexAccountNamespaces,
+  );
   const globalFallback = config.subagentModelFallback ?? [];
   if (globalFallback.length === 0 && roleFallback.length === 0) return null;
   const selection = selectAvailableSubagentModel(
@@ -403,6 +463,7 @@ export function applySubagentModelFallback(
     accountId,
     now,
     nativeFallbackOnly,
+    accountUsabilityOptions,
   );
   if (!selection.rewritten) return selection.skipped.length > 0
     ? { from: parsed.modelId, to: parsed.modelId, skipped: selection.skipped }