@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/codex/routing.ts

@@ -1,9 +1,11 @@
+import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
+import { codexQuotaHasFreshUsage } from "./quota-observation-freshness";
 import { saveConfigPreservingClaudeCode } from "../config";
 import { isCodexAccountGenerationLive, registerCodexRefreshGenerationHandoff } from "./account-store";
 import { handOffThreadAffinityGeneration } from "./routing/thread-affinity";
 import { codexAccountLogLabel } from "./account-label";
 import { isCodexAccountPaused } from "./account-pause";
-import { clearCodexAccountPin, pinnedCodexAccountId } from "./account-priority";
+import { clearCodexAccountPin, pinnedCodexAccountId, codexAccountPriorityFailbackEnabled, CODEX_PRIORITY_FAILBACK_REFRESH_MS } from "./account-priority";
 import { isCodexAccountUsable, type CodexAccountUsabilityOptions } from "./account-usability";
 import { markAccountNeedsReauth } from "./account-runtime-state";
 import { codexAccountPinDrainReason } from "./routing/pin-drain";
@@ -109,6 +111,7 @@ import {
   pickUnboundStrategyAccount,
   preferModelEntitledAccount,
   sharedStateSelectionOptions,
+  sharesActiveSelection,
   strategySelectionOptionsForModelDetour,
   shouldFailover,
   peekAlternateCodexAccount,
@@ -492,6 +495,38 @@ export function resolveCodexAccountForThread(
   return resolution.status === "selected" ? resolution.accountId : null;
 }
 
+/** The opt-in may preempt priority, never eligibility, a quota refusal or a manual pin. */
+function pickAffinityPriorityFailback(
+  config: OcxConfig,
+  accountId: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string | null {
+  if (!codexAccountPriorityFailbackEnabled(config, accountId)
+    || accountPoolStrategyForScope(config, quotaScope) !== "quota") return null;
+  if (!pickPriorityPreemption(config, accountId, now, quotaScope, selectionOptions)) return null;
+  // The selected tier can contain a stale cooler account beside a fresh one.
+  // Check every member before the lowest-usage picker sees it.
+  const candidates = getEligiblePoolAccounts(config, undefined, now, quotaScope, selectionOptions).filter(id => {
+    if (!hasCodexQuotaHeadroom(config, id, selectionOptions, now)
+      || hasUnrecoveredCodexQuotaRefusal(id, quotaScope)
+      || shouldFailover(config, id, now)) return false;
+    const quota = getAccountQuota(id);
+    const plan = getPoolAccountPlanForSelection(config, id, selectionOptions);
+    // Retained bars alone are not a reason to discard a healthy conversation's cache.
+    if (!quota || !codexQuotaHasFreshUsage(quota, plan, now, CODEX_PRIORITY_FAILBACK_REFRESH_MS)
+      || !Number.isFinite(quota.updatedAt)
+      || now - quota.updatedAt >= CODEX_PRIORITY_FAILBACK_REFRESH_MS
+      || (quota.shortObservedAt !== undefined
+        && now - quota.shortObservedAt >= CODEX_PRIORITY_FAILBACK_REFRESH_MS)) return false;
+    const usage = computeCodexUsageScore(quota, plan, now);
+    const threshold = getEffectiveCodexAutoSwitchThreshold(config, id);
+    return !isUnknownUsage(usage) && usage < 100 && (threshold <= 0 || usage < threshold);
+  });
+  return pickLowestUsageAmong(config, candidates, selectionOptions, now);
+}
+
 function previewReusableAffinityAccount(
   entry: ThreadAffinityEntry | undefined,
   config: OcxConfig,
@@ -528,10 +563,12 @@ function previewReusableAffinityAccount(
   if (accountPoolStrategyForScope(config, quotaScope) === "reset-first") {
     return resetFirstAffinityReplacement(entry, config, now, quotaScope, selectionOptions) ?? entry.accountId;
   }
+  const recovered = pickAffinityPriorityFailback(config, entry.accountId, now, quotaScope, selectionOptions);
+  if (recovered) return recovered;
   // Quota strategy only: non-quota strategies keep affinity for ongoing threads
   // (new-session-only rotation — docs / affinity policy A).
   if (accountPoolStrategyForScope(config, quotaScope) === "quota") {
-    const threshold = config.autoSwitchThreshold ?? 80;
+    const threshold = getEffectiveCodexAutoSwitchThreshold(config, entry.accountId);
     if (threshold > 0) {
       const usage = computeCodexUsageScore(
         getAccountQuota(entry.accountId),
@@ -564,7 +601,7 @@ function resetFirstAffinityReplacement(
   quotaScope?: CodexQuotaScope,
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, entry.accountId);
   if (threshold <= 0) return null;
   const usage = computeCodexUsageScore(getAccountQuota(entry.accountId), getPoolAccountPlanForSelection(config, entry.accountId, selectionOptions), now);
   if (!mayRebindAffinityForQuota(config, entry.accountId, usage, threshold, selectionOptions)) return null;
@@ -652,7 +689,9 @@ function reevaluateAffinityQuota(
     return replacement;
   }
   if (strategy !== "quota") return null;
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const recovered = pickAffinityPriorityFailback(config, entry.accountId, now, quotaScope, selectionOptions);
+  if (recovered) { entry.lastReevalAt = now; return recovered; }
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, entry.accountId);
   const usage = threshold > 0
     ? computeCodexUsageScore(
         getAccountQuota(entry.accountId),
@@ -773,7 +812,7 @@ export function previewCodexAccountForRequest(
   }
   active = pickPriorityPreemption(config, active, now, quotaScope, selectionOptions) ?? active;
 
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, active);
   if (threshold > 0) {
     const usage = computeCodexUsageScore(
       getAccountQuota(active),
@@ -932,7 +971,7 @@ export function resolveCodexAccountForThreadDetailed(
       if (entry.transientHoldSince !== undefined) delete entry.transientHoldSince;
       if (entry.transientDetourAccountId !== undefined) delete entry.transientDetourAccountId;
       // Periodic quota re-eval: a long-lived bound thread must still switch when
-      // it crosses autoSwitchThreshold, but only onto an account that has genuine
+      // it crosses its effective threshold, but only onto an account that has genuine
       // quota headroom AND is strictly cooler — moving to a destination still over
       // the threshold just trades the warmed prompt-cache prefix for an equally hot
       // account, which is the #4546 ping-pong.
@@ -944,7 +983,7 @@ export function resolveCodexAccountForThreadDetailed(
       // rotation is new-session-only (affinity policy A).
       const cooler = reevaluateAffinityQuota(entry, config, now, quotaScope, selectionOptions);
       if (cooler) {
-        if (!isIndependentCodexQuotaScope(quotaScope)) {
+        if (!isIndependentCodexQuotaScope(quotaScope) && sharesActiveSelection(cooler, selectionOptions)) {
           promoteActiveCodexAccount(config, cooler);
         }
         bindThreadAffinity(threadId, cooler, now, quotaScope); // rebinds + resets clocks
@@ -990,7 +1029,9 @@ export function resolveCodexAccountForThreadDetailed(
         && !shouldFailover(config, expiredDetour, now)
         && !isCodexAccountSoftAvoided(expiredDetour, now)
       ) {
-        if (!isIndependentCodexQuotaScope(quotaScope)) promoteActiveCodexAccount(config, expiredDetour);
+        if (!isIndependentCodexQuotaScope(quotaScope) && sharesActiveSelection(expiredDetour, selectionOptions)) {
+          promoteActiveCodexAccount(config, expiredDetour);
+        }
         bindThreadAffinity(threadId, expiredDetour, now, quotaScope);
         return {
           status: "selected",
@@ -1084,7 +1125,7 @@ export function resolveCodexAccountForThreadDetailed(
       // process-local cursor to whoever is actually serving and releases the pin; the
       // operator's persisted activeCodexAccountId is left untouched either way, which is
       // the thing the preference exists to protect.
-      promoteActiveCodexAccount(config, strategyPick);
+      if (sharesActiveSelection(strategyPick, selectionOptions)) promoteActiveCodexAccount(config, strategyPick);
     }
     return { status: "selected", accountId: strategyPick, affinity: affinityAfterRelease(threadId, releaseReason) };
   }
@@ -1102,7 +1143,7 @@ export function resolveCodexAccountForThreadDetailed(
       return { status: "none", affinity: affinityOnNoAccount(threadId, releaseReason) };
     }
     if (!isIndependentCodexQuotaScope(quotaScope) && !modelScopedSelection) {
-      setActiveCodexAccount(config, selected);
+      if (sharesActiveSelection(selected, selectionOptions)) setActiveCodexAccount(config, selected);
     }
     active = selected;
   }
@@ -1123,7 +1164,7 @@ export function resolveCodexAccountForThreadDetailed(
         && preserveSharedSelectionForModelDetour
         && activeHealthyForSharedSelection;
       if (!isIndependentCodexQuotaScope(quotaScope) && !modelOnlyMove) {
-        setActiveCodexAccount(config, fallback);
+        if (sharesActiveSelection(fallback, selectionOptions)) setActiveCodexAccount(config, fallback);
       }
       active = fallback;
     } else if (
@@ -1157,6 +1198,7 @@ export function resolveCodexAccountForThreadDetailed(
     if (
       !preserveSharedSelectionForModelDetour
       && !isIndependentCodexQuotaScope(quotaScope)
+      && sharesActiveSelection(preempted, selectionOptions)
     ) {
       // Preemption is an automatic pick competing with the operator, so it yields.
       if (!manualPreferenceBlocks(POOL_KEY_CODEX, preempted)) {

package/src/codex/subagent-model-fallback.ts

@@ -27,6 +27,7 @@ import {
   type CodexAccountUsabilityOptions,
 } from "./account-usability";
 import { isCodexAccountPaused } from "./account-pause";
+import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
 import { slugEquals } from "../providers/slug-codec";
 import { isThreadSpawnRequest } from "../server/effort-policy";
 import { PROVIDER_REGISTRY } from "../providers/registry";
@@ -157,8 +158,8 @@ export function buildSubagentModelChain(
   return normalizedChain(primary, config, extraFallback);
 }
 
-function quotaThreshold(config: OcxConfig): number {
-  const threshold = config.autoSwitchThreshold ?? 80;
+function quotaThreshold(config: OcxConfig, accountId: string): number {
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, accountId);
   return threshold > 0 ? threshold : Number.POSITIVE_INFINITY;
 }
 
@@ -233,7 +234,7 @@ export function isNativeModelQuotaExhausted(
   // rather than letting the scorer read wall time - the two would silently diverge.
   const usage = computeCodexUsageScore(quota, getPoolAccountPlan(config, resolvedAccountId), now);
   if (usage >= CODEX_UNKNOWN_USAGE_SCORE) return false;
-  return usage >= quotaThreshold(config);
+  return usage >= quotaThreshold(config, resolvedAccountId);
 }
 
 export function isModelHealthBlocked(

package/src/codex/sync.ts

@@ -14,6 +14,7 @@ import {
 import { admitCodexWrite, type CodexAdmission } from "./admission";
 import type { CodexCatalogSyncOptions } from "./catalog/sync";
 import { resetCodexAppServerCatalogStateCache } from "./app-server-processes";
+import { providerUsesReasoningMetadata, refreshReasoningMetadata } from "../providers/reasoning-metadata";
 
 export interface CodexSyncResult {
   /**
@@ -67,13 +68,21 @@ interface CodexSyncDeps {
   admitCodexWrite?: () => CodexSyncAdmission;
   currentExternalCodexModelProvider?: typeof currentExternalCodexModelProvider;
   collectCodexHomeDiagnostic?: typeof collectOrcaCodexHomeDiagnostic;
+  refreshReasoningMetadata?: typeof refreshReasoningMetadata;
 }
 
 const defaultDeps: CodexSyncDeps = {
   refreshCodexModelCatalog,
   injectCodexConfig,
+  refreshReasoningMetadata,
 };
 
+async function refreshReasoningMetadataForSync(config: OcxConfig, deps: CodexSyncDeps): Promise<void> {
+  if (Object.values(config.providers).some(providerUsesReasoningMetadata)) {
+    await deps.refreshReasoningMetadata?.({ waitMs: 2_000 });
+  }
+}
+
 function reportCodexHomeTarget(
   log: Pick<Console, "log" | "error"> | null,
   collectDiagnostic: typeof collectOrcaCodexHomeDiagnostic,
@@ -234,6 +243,7 @@ export async function syncModelsToCodex(
   }
 
   applyProxyEnv(config); // `ocx ensure`/`ocx sync` fetch provider models outside the server process
+  await refreshReasoningMetadataForSync(config, deps);
   let added = 0;
   let catalogPath: string | null = null;
   let catalogPathForInjection: string | null | undefined;
@@ -339,6 +349,7 @@ async function refreshCatalogForSync(
   let refreshOutcome: "committed" | "refused" | undefined;
   let comboOmissions: ComboCatalogOmission[] = [];
   try {
+    await refreshReasoningMetadataForSync(config, deps);
     const cat = await deps.refreshCodexModelCatalog(config, undefined, catalogOptions);
     refreshOutcome = cat.refreshOutcome;
     added = cat.added;

package/src/codex/windows-installation-files.ts

@@ -18,6 +18,10 @@ export interface WindowsInstallationFileRequest {
   readonly path: string;
   readonly maxBytes: number;
   readonly hashOnly?: boolean;
+  /** Validate and hold the path without reading its contents. */
+  readonly metadataOnly?: boolean;
+  /** Read at most maxBytes from the start instead of refusing an oversized file. */
+  readonly prefixOnly?: boolean;
 }
 export interface WindowsInstallationFileIdentity {
   readonly volumeSerial: string;
@@ -31,10 +35,20 @@ export type WindowsInstallationFilesResult =
     path: string; identity: WindowsInstallationFileIdentity; bytes: Uint8Array; digest: string;
   }[] }
   | { kind: "refused"; reason: "unsupported-platform" | "invalid-request" | "native-api-unavailable"
-    | "volume-unavailable" | "open-refused" | "reparse-point" | "not-regular-file"
+    | "volume-unavailable" | "not-found" | "open-refused" | "reparse-point" | "not-regular-file"
     | "size-limit" | "read-failed" | "identity-changed" | "inspection-failed" };
 
 type Refusal = Extract<WindowsInstallationFilesResult, { kind: "refused" }>["reason"];
+/** Only these two NTSTATUS values prove that a candidate or its ancestor is absent. */
+export function ntCreateFileRefusal(status: number): Refusal {
+  switch (status >>> 0) {
+    case 0xc0000034: // STATUS_OBJECT_NAME_NOT_FOUND
+    case 0xc000003a: // STATUS_OBJECT_PATH_NOT_FOUND
+      return "not-found";
+    default:
+      return "open-refused";
+  }
+}
 class InspectionRefusal extends Error {
   constructor(readonly reason: Refusal) { super(reason); }
 }
@@ -76,6 +90,8 @@ export async function inspectWindowsInstallationFiles(
     const parsedPath = request && components(request.path);
     if (!parsedPath || !Number.isSafeInteger(request.maxBytes) || request.maxBytes < 0
       || (request.hashOnly !== undefined && typeof request.hashOnly !== "boolean")
+      || (request.metadataOnly !== undefined && typeof request.metadataOnly !== "boolean")
+      || (request.prefixOnly !== undefined && typeof request.prefixOnly !== "boolean")
       || request.maxBytes > (request.hashOnly ? 256 * MIB : MIB)) return null;
     ceiling += request.maxBytes;
     return parsedPath;
@@ -163,7 +179,7 @@ export async function inspectWindowsInstallationFiles(
       // Share READ only: while held, writes/reparse edits and delete/rename opens are refused.
       const result = nt!.symbols.NtCreateFile!(ffi.ptr(output), 0x100081, ffi.ptr(attributes),
         ffi.ptr(status), null, 0, 1, 1, 0x200020 | (directory ? 1 : 0), null, 0);
-      if (result < 0) throw new InspectionRefusal("open-refused");
+      if (result < 0) throw new InspectionRefusal(ntCreateFileRefusal(result));
       const handle = keep(output.readBigUInt64LE(0));
       inspect(handle, directory);
       return handle;
@@ -184,29 +200,35 @@ export async function inspectWindowsInstallationFiles(
       }
       const handle = relativeOpen(parent, names[names.length - 1]!, false);
       const identity = inspect(handle, false);
-      if (identity.size > request.maxBytes) throw new InspectionRefusal("size-limit");
+      if (!request.metadataOnly && !(request.prefixOnly && !request.hashOnly)
+        && identity.size > request.maxBytes) throw new InspectionRefusal("size-limit");
       return { request, handle, identity };
     });
     openedForTests?.();
     const observed = files.map(({ request, handle, identity }) => {
       const hash = createHash("sha256");
-      const bytes = request.hashOnly ? new Uint8Array() : new Uint8Array(identity.size);
-      const chunk = Buffer.alloc(Math.min(MIB, Math.max(1, identity.size)));
+      if (request.metadataOnly) return { path: request.path, identity, bytes: new Uint8Array(), digest: "" };
+      const truncated = Boolean(request.prefixOnly) && !request.hashOnly && identity.size > request.maxBytes;
+      const readLimit = truncated ? request.maxBytes : identity.size;
+      const bytes = request.hashOnly ? new Uint8Array() : new Uint8Array(readLimit);
+      const chunk = Buffer.alloc(Math.min(MIB, Math.max(1, readLimit)));
       const read = Buffer.alloc(4);
       let offset = 0;
-      while (offset < identity.size) {
-        const length = Math.min(chunk.length, identity.size - offset);
+      while (offset < readLimit) {
+        const length = Math.min(chunk.length, readLimit - offset);
         if (!k.ReadFile!(handle, ffi.ptr(chunk), length, ffi.ptr(read), null)) throw new InspectionRefusal("read-failed");
         const count = read.readUInt32LE(0);
         if (!count || count > length) throw new InspectionRefusal("read-failed");
-        hash.update(chunk.subarray(0, count));
         if (!request.hashOnly) bytes.set(chunk.subarray(0, count), offset);
+        if (!truncated) hash.update(chunk.subarray(0, count));
         offset += count;
       }
-      if (!k.ReadFile!(handle, ffi.ptr(chunk), 1, ffi.ptr(read), null) || read.readUInt32LE(0) !== 0) {
-        throw new InspectionRefusal("identity-changed");
+      if (!truncated) {
+        if (!k.ReadFile!(handle, ffi.ptr(chunk), 1, ffi.ptr(read), null) || read.readUInt32LE(0) !== 0) {
+          throw new InspectionRefusal("identity-changed");
+        }
       }
-      return { path: request.path, identity, bytes, digest: hash.digest("hex") };
+      return { path: request.path, identity, bytes, digest: truncated ? "" : hash.digest("hex") };
     });
     for (const file of files) {
       if (JSON.stringify(inspect(file.handle, false)) !== JSON.stringify(file.identity)) {

package/src/codex/write-coordination.ts

@@ -20,6 +20,10 @@
  * enumeration of those was already incomplete once. Hashing the computed
  * candidate bytes closes the class instead of the instance — an input that
  * changes the output changes the id whether or not anyone remembered to list it.
+ * The pre-lock comparison id admits the original candidate. If a native feature
+ * transition changes that candidate under the lock, the coordinator publishes
+ * a new id derived from the bytes it commits; admission remains the stale-input
+ * guard and is not reused as a committed-byte witness.
  */
 import { createHash } from "node:crypto";
 

package/src/combos/request.ts

@@ -110,9 +110,13 @@ export function concreteComboRequestBody(
     return clone;
   }
   if (reasoning === undefined) {
-    clone.reasoning = { effort: resolvedEffort };
+    clone.reasoning = { effort: resolvedEffort, summary: "auto" };
   } else {
-    clone.reasoning = { ...(reasoning as Record<string, unknown>), effort: resolvedEffort };
+    clone.reasoning = {
+      ...(reasoning as Record<string, unknown>),
+      effort: resolvedEffort,
+      ...((reasoning as Record<string, unknown>).summary === undefined ? { summary: "auto" } : {}),
+    };
   }
   return clone;
 }

package/src/companion/settings.ts

@@ -4,6 +4,7 @@ import { getConfigDir } from "../config/paths";
 import {
   TIMELINE_HOURS,
   isTimelineModelId,
+  normalizeTimelineModelId,
   type TimelineAggregation,
   type TimelineGrouping,
   type TimelineMetric,
@@ -104,7 +105,11 @@ export function applyCompanionSettingsPatch(
     const error = validateValue(key as keyof CompanionSettings, values[key]);
     if (error) return invalid(error);
   }
-  return { ...current, ...values } as CompanionSettings;
+  const next = { ...current, ...values } as CompanionSettings;
+  // Every companion re-filters timeline rows against these ids, so a selection saved while the chart
+  // still split pool accounts has to name the merged row the timeline now returns.
+  if (next.models !== null) next.models = [...new Set(next.models.map(normalizeTimelineModelId))];
+  return next;
 }
 
 export function loadCompanionSettings(): { settings: CompanionSettings; updatedAt: number | null; corrupt?: true } {

package/src/config/atomic-write.ts

@@ -277,8 +277,9 @@ function atomicWriteFileToTarget(
   target: string,
   io?: AtomicWriteIO,
   hooks: AtomicWriteHooks = {},
+  recordOwnership = true,
 ): void {
-  recordOwnedConfigPath(getConfigDir(), path);
+  if (recordOwnership) recordOwnedConfigPath(getConfigDir(), path);
   assertResolvedTargetAllowed(path, target);
   const tmp = `${target}.ocx.${process.pid}.${nextAtomicTempSequence()}.tmp`;
   let hardened = false;
@@ -399,6 +400,16 @@ export function atomicWriteFileNoFollow(
   atomicWriteFileToTarget(path, content, join(resolveWriteTarget(dirname(path)), basename(path)), io, hooks);
 }
 
+/**
+ * The no-follow replacement above, for rewriting a file whose uninstall ownership must stay as
+ * it was: it does not record the path in the owner manifest. Used to rewrite the OAuth downgrade
+ * backup, which a pre-registration install may have left deliberately unclaimed; claiming it
+ * here would let a later uninstall delete recovery data it never owned.
+ */
+export function atomicWriteFileNoFollowUnclaimed(path: string, content: string): void {
+  atomicWriteFileToTarget(path, content, join(resolveWriteTarget(dirname(path)), basename(path)), undefined, {}, false);
+}
+
 export interface AtomicWriteAsyncIO {
   write: (path: string, content: string) => void | Promise<void>;
   harden: (path: string) => void | Promise<void>;

package/src/config/derived-registries.ts

@@ -0,0 +1,29 @@
+import { setConfiguredNativeOpenAiModels } from "../codex/catalog/native-models";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers-destination";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { refreshUserCostOverlays } from "../usage/user-cost-overlays";
+
+/**
+ * Bare `gpt-*` ids listed under `providers.openai.models` that become configured natives.
+ *
+ * Only the canonical Codex forward provider qualifies (an omitted authMode is the registry's
+ * forward default): `providers.openai.models` is otherwise ignored for that provider, and on any
+ * other shape the list means routed models, which must not turn into native rows.
+ */
+export function configuredNativeOpenAiModelIds(config: Pick<OcxConfig, "providers">): string[] {
+  const provider = config.providers?.[OPENAI_CODEX_PROVIDER_ID] as OcxProviderConfig | undefined;
+  if (!provider || provider.disabled === true || !Array.isArray(provider.models)) return [];
+  const canonical = provider.authMode === undefined ? { ...provider, authMode: "forward" as const } : provider;
+  if (!isCanonicalOpenAiForwardProvider(canonical)) return [];
+  return provider.models.flatMap(id => typeof id === "string" ? [id.trim()] : []);
+}
+
+/**
+ * Rebuild every process-local registry derived from a committed config: user price overlays and
+ * configured native GPT models. Called wherever a loaded, persisted or reconciled config becomes
+ * current, so the two never disagree about which config is live.
+ */
+export function refreshConfigDerivedRegistries(config: OcxConfig): void {
+  refreshUserCostOverlays(config);
+  setConfiguredNativeOpenAiModels(configuredNativeOpenAiModelIds(config));
+}

package/src/config/diagnostics.ts

@@ -52,6 +52,7 @@ import {
   clientConnectionSchema,
   CODEX_ACCOUNT_PIN_PATTERN,
   codexAccountPrioritiesSchema,
+  codexAccountAutoSwitchThresholdsSchema,
   codexPoolSchema,
   codexQuotaAutoRefreshSchema,
   credentialGroupsSchema,
@@ -347,6 +348,13 @@ function codexAccountPrioritiesError(value: unknown): string | null {
       return schemaDiagnosticsError(parsed.error).replace("schema_invalid: ", "schema_invalid: codexAccountPriorities.");
     }
   }
+  if (raw.codexAccountAutoSwitchThresholds !== undefined) {
+    const parsed = codexAccountAutoSwitchThresholdsSchema.safeParse(raw.codexAccountAutoSwitchThresholds);
+    if (!parsed.success) {
+      return schemaDiagnosticsError(parsed.error)
+        .replace("schema_invalid: ", "schema_invalid: codexAccountAutoSwitchThresholds.");
+    }
+  }
   // Tested as a string rather than coerced: `String(123)` matches the id pattern, so a
   // coercing guard waves a non-string pin through to the schema, where `.catch(undefined)`
   // drops it and reports the write as a success — the exact silent-degrade this guards.
@@ -357,6 +365,14 @@ function codexAccountPrioritiesError(value: unknown): string | null {
   return null;
 }
 
+function codexAccountPriorityFailbackError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "codexAccountPriorityFailback")) return null;
+  const enabled = raw.codexAccountPriorityFailback;
+  if (enabled === undefined || typeof enabled === "boolean") return null;
+  return "schema_invalid: codexAccountPriorityFailback: must be a boolean or omitted";
+}
+
 /**
  * Same reasoning as {@link codexAccountPrioritiesError}, plus one of its own. The read
  * path drops an invalid grouping, so a degraded write would erase a declaration the
@@ -595,6 +611,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)
     ?? codexAccountPrioritiesError(value)
+    ?? codexAccountPriorityFailbackError(value)
     ?? poolCredentialGroupsError(value)
     ?? codexQuotaAutoRefreshError(value)
     ?? codexAccountPickerEnabledError(value)

package/src/config/live-reconcile.ts

@@ -1,8 +1,12 @@
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
-import { refreshPreservedProviderOwner, refreshUserCostOverlays } from "../usage/user-cost-overlays";
+import { refreshPreservedProviderOwner } from "../usage/user-cost-overlays";
+import { refreshConfigDerivedRegistries } from "./derived-registries";
 import {
+  applyConfigObjectChildDeletions,
+  clearPendingConfigObjectChildDeletions,
+  prepareConfigObjectChildDeletionRebase,
   clearPendingConfigTopLevelDeletions,
   configHasRebaseProvenance,
   configRebaseDeletionKeys,
@@ -357,12 +361,14 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
     ...(persisted.hostname !== undefined ? { hostname: persisted.hostname } : {}),
   });
 
+  const childDeletions = prepareConfigObjectChildDeletionRebase(config);
   reconcileConfigRecord(
     config as unknown as Record<string, unknown>,
     persistedBaseline as unknown as Record<string, unknown>,
     persisted as unknown as Record<string, unknown>,
     new Set(["hostname", "port", ...(claudeGuardArmed ? ["claudeCode"] : [])]),
   );
+  applyConfigObjectChildDeletions(config, childDeletions);
 
   if (claudeGuardArmed && !pendingLiveClaudeMutation) {
     if (persisted.claudeCode === undefined) delete config.claudeCode;
@@ -372,7 +378,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
   // The reconciliation may have adopted a providers.<name>.modelCosts edit made
   // by a cooperating process while the OAuth login was pending; keep the overlay
   // registry (and the usage-cache overlay version) in sync with the live config.
-  refreshUserCostOverlays(config);
+  refreshConfigDerivedRegistries(config);
 }
 
 /**
@@ -420,6 +426,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
   const pinError = configReasoningPinsConfigError(config);
   if (pinError) throw new Error(pinError);
   withConfigMutationLockSync(() => {
+    const childDeletions = prepareConfigObjectChildDeletionRebase(config);
     const bindingBaseline = persistedLiveServerBinding.get(config);
     // One authoritative pre-write read feeds both the live-config reconciliation and
     // custom-model deletion migration. A second read could observe different bytes.
@@ -477,6 +484,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
         }
       }
     }
+    applyConfigObjectChildDeletions(config, childDeletions);
     if (claudeCodeBaseline.has(config)) {
       if (onDisk !== undefined) {
         const baseline = claudeCodeBaseline.get(config);
@@ -516,6 +524,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
       else config.configRebaseProvenance = structuredClone(projectedConfig.configRebaseProvenance);
       liveConfigBaseline.set(config, structuredClone(projectedConfig));
     }
+    clearPendingConfigObjectChildDeletions(config);
     clearPendingConfigTopLevelDeletions(config);
   });
 }

package/src/config/load-degrade.ts

@@ -17,7 +17,7 @@ import { MODEL_ALIAS_PATTERN } from "../providers/default-aliases";
 import { MODEL_DISCOVERY_MAX_MODELS } from "../providers/model-discovery-limits";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport, registryModelServiceTierCapabilityApplies } from "../providers/registry";
 import { isCodexReasoningEffort } from "../reasoning-effort";
-import { refreshUserCostOverlays } from "../usage/user-cost-overlays";
+import { refreshConfigDerivedRegistries } from "./derived-registries";
 import { type OcxClaudeCodeConfig, type OcxConfig } from "../types";
 import {
   agentTaskRecoverySchema,
@@ -26,6 +26,7 @@ import {
   isUsableApiKeySecret,
   managementIngressSchema,
   codexPoolSchema,
+  codexAccountAutoSwitchThresholdsSchema,
   providerModelCostsConfigError,
   credentialGroupsSchema,
   hubConfigSchema,
@@ -389,6 +390,12 @@ export function degradedCodexAccountPriorityWarnings(rawParsed: unknown, validat
   if (raw !== undefined && validated.codexAccountPriorities === undefined) {
     warnings.push("codexAccountPriorities is invalid (expected account ids mapped to integers between -100 and 100) — account selection order is disabled");
   }
+  const rawThresholds = record?.codexAccountAutoSwitchThresholds;
+  if (rawThresholds !== undefined && !codexAccountAutoSwitchThresholdsSchema.safeParse(rawThresholds).success) {
+    warnings.push(validated.codexAccountAutoSwitchThresholds === undefined
+      ? "codexAccountAutoSwitchThresholds is invalid (expected account ids mapped to integers between 0 and 100) — per-account usage thresholds are disabled"
+      : "codexAccountAutoSwitchThresholds contains invalid entries (expected account ids mapped to integers between 0 and 100) — invalid entries were ignored");
+  }
   return warnings;
 }
 
@@ -934,6 +941,6 @@ export function sanitizeModelDisplayNamesForLoad(raw: unknown): void {
 
 /** Refresh the user cost-overlay registry from `config` and return it unchanged. */
 export function withRefreshedCostOverlays(config: OcxConfig): OcxConfig {
-  refreshUserCostOverlays(config);
+  refreshConfigDerivedRegistries(config);
   return config;
 }

package/src/config/persist-unlocked.ts

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import type { OcxConfig } from "../types";
-import { refreshUserCostOverlays, withPreservedDiskOnlyProviders } from "../usage/user-cost-overlays";
+import { withPreservedDiskOnlyProviders } from "../usage/user-cost-overlays";
+import { refreshConfigDerivedRegistries } from "./derived-registries";
 import { atomicWriteFile, isMissingPathError } from "./atomic-write";
 import { getConfigPath } from "./paths";
 import { configRebaseDeletionKeys, projectConfigRebaseProvenance } from "./rebase-provenance";
@@ -81,12 +82,12 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   // the same bytes (e.g. before a proxy notification), and Logs/Usage must
   // adopt the overlay without waiting for a changed save or restart.
   if (unchanged) {
-    refreshUserCostOverlays(persisted);
+    refreshConfigDerivedRegistries(persisted);
     return false;
   }
   atomicWriteFile(configPath, bytes);
   // For changed saves, refresh only AFTER the write succeeded so a failed
   // write cannot leave estimates reflecting configuration never persisted.
-  refreshUserCostOverlays(persisted);
+  refreshConfigDerivedRegistries(persisted);
   return true;
 }