@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/codex/auth-api/main-account-probe.ts

@@ -1,3 +1,10 @@
+import { fetchCodexUsage } from "../quota-query-backoff";
+import type { CodexUsageOwner } from "../quota-query-backoff";
+import { loadConfig } from "../../config";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
+import { providerCodexAccountMode } from "../../providers/registry";
+import { isSelectableCodexPoolAccount } from "../account-id";
+import type { OcxConfig } from "../../types";
 import { parseMainPolicyUsageQuota, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
 import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
 import { reconcileMainCodexAccountRuntimeState } from "../account-lifecycle";
@@ -15,7 +22,7 @@ import { nonEmptyPlan } from "./runtime-config";
 import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
 import { WHAM_REQUEST_TIMEOUT_MS } from "../quota-recovery-timing";
 import { withNativeMainCredentialClaim, isNativeMainClaimUnavailable } from "./http";
-import { MAIN_TERMINAL_AUTH_CODES, readMainAuthErrorCode, nextQuotaDispatchSequence, isQuotaDispatchCurrent, publishQuotaDispatch } from "./pool-quota-probe";
+import { MAIN_TERMINAL_AUTH_CODES, readMainAuthErrorCode, currentQuotaDispatchSequence, nextQuotaDispatchSequence, isQuotaDispatchCurrent, publishQuotaDispatch } from "./pool-quota-probe";
 
 /**
  * Last reset-credit count this process parsed for the main account, tagged with the
@@ -52,6 +59,14 @@ export function mainResetCreditsForCurrentIdentity(): number | undefined {
 
 export const MAIN_CACHE_TTL = 5 * 60_000;
 
+function sharedMainQuotaPacingEnabled(config: OcxConfig): boolean {
+  const openai = config.providers[OPENAI_CODEX_PROVIDER_ID];
+  if (openai?.disabled === true || openai?.codexAccountMode === "direct") return false;
+  return (openai !== undefined && isCanonicalOpenAiForwardProvider(openai)
+    && providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) === "pool")
+    || (config.codexAccounts ?? []).some(isSelectableCodexPoolAccount);
+}
+
 /**
  * A WHAM 401 is not itself proof the local credential died. Upstream edges can
  * transiently reject a still-valid access token (region/anti-abuse/rotation
@@ -80,6 +95,8 @@ export interface MainResetQuotaProof {
 
 export interface MainAccountInfoFetchResult {
   info: MainAccountInfo;
+  /** Parsed ordinary info from a stale credential; callers must not display it as shared state. */
+  infoUnpublished?: true;
   resetRecoveryProof?: MainResetQuotaProof & { dispatchSequence: number };
   /** Ephemeral result of this attempt, omitted when no WHAM request was made. */
   quotaRefresh?: CodexQuotaRefreshOutcome;
@@ -91,22 +108,25 @@ export interface MainAccountInfoFetchResult {
   hasCredential: boolean;
   /** Main identity generation captured while the native-main claim was held. */
   identityGeneration?: number;
-  /** Present only when this call freshly parsed a WHAM usage response. */
+  /** Freshly parsed usage from the current credential; stale ordinary return values are excluded. */
   freshQuota?: Omit<StoredAccountQuota, "updatedAt">;
-  /** Present only when this call's WHAM response included `rate_limit_reset_credits.available_count`. */
+  /** Current-credential response's `rate_limit_reset_credits.available_count`, when present. */
   freshResetCredits?: number;
 }
 
 export interface MainAccountInfoSnapshot {
   info: MainAccountInfo;
+  /** Ordinary info that was never published and must not become provider quota. */
+  infoUnpublished?: true;
   mainIdentityGeneration: number;
   quotaRefresh?: CodexQuotaRefreshOutcome;
 }
 
-export async function fetchMainAccountInfoSnapshot(forceRefresh = false): Promise<MainAccountInfoSnapshot> {
-  const result = await fetchMainAccountInfoAttempt(forceRefresh, 1);
+export async function fetchMainAccountInfoSnapshot(forceRefresh = false, config?: OcxConfig): Promise<MainAccountInfoSnapshot> {
+  const result = await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false, forceRefresh, false, config);
   return {
     info: result.info,
+    ...(result.infoUnpublished ? { infoUnpublished: true as const } : {}),
     ...(result.quotaRefresh && result.quotaRefreshGeneration !== undefined
       && isMainAccountIdentityGenerationLive(result.quotaRefreshGeneration)
       ? { quotaRefresh: result.quotaRefresh } : {}),
@@ -114,8 +134,8 @@ export async function fetchMainAccountInfoSnapshot(forceRefresh = false): Promis
   };
 }
 
-export async function fetchMainAccountInfo(forceRefresh = false): Promise<MainAccountInfo> {
-  return (await fetchMainAccountInfoSnapshot(forceRefresh)).info;
+export async function fetchMainAccountInfo(forceRefresh = false, config?: OcxConfig): Promise<MainAccountInfo> {
+  return (await fetchMainAccountInfoSnapshot(forceRefresh, config)).info;
 }
 
 export const EMPTY_MAIN_ACCOUNT_INFO: MainAccountInfo = { email: null, plan: null, quota: null };
@@ -125,12 +145,13 @@ export async function retryMainAccountInfoIfIdentityChanged(
   retriesRemaining: number,
   nativeMainLease: AdmissionLease,
   explicitRefresh: boolean,
+  paced: boolean,
 ): Promise<MainAccountInfoFetchResult | null> {
   const currentAccountId = getMainChatgptAccountId();
   if (currentAccountId === null || currentAccountId === requestAccountId) return null;
   reconcileMainCodexAccountRuntimeState();
   return retriesRemaining > 0
-    ? fetchMainAccountInfoWhileOwned(true, retriesRemaining - 1, nativeMainLease, explicitRefresh)
+    ? fetchMainAccountInfoWhileOwned(true, retriesRemaining - 1, nativeMainLease, explicitRefresh, false, paced)
     : { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
 }
 
@@ -140,6 +161,8 @@ export async function fetchMainAccountInfoAttempt(
   existingNativeMainLease?: AdmissionLease,
   nativeMainSharedClaimHeld = false,
   explicitRefresh: boolean = forceRefresh,
+  postReset = false,
+  config?: OcxConfig,
 ): Promise<MainAccountInfoFetchResult> {
   const nativeMainLease = existingNativeMainLease ?? tryAcquireNativeMainProfileClaim();
   if (!nativeMainLease) {
@@ -151,8 +174,9 @@ export async function fetchMainAccountInfoAttempt(
     };
   }
   try {
+    const paced = sharedMainQuotaPacingEnabled(config ?? loadConfig());
     const operation = async () => ({
-      ...await fetchMainAccountInfoWhileOwned(forceRefresh, retriesRemaining, nativeMainLease, explicitRefresh),
+      ...await fetchMainAccountInfoWhileOwned(forceRefresh, retriesRemaining, nativeMainLease, explicitRefresh, postReset, paced),
       identityGeneration: captureMainAccountIdentityGeneration(),
     });
     if (nativeMainSharedClaimHeld) return await operation();
@@ -174,6 +198,11 @@ export async function fetchMainAccountInfoAttempt(
   }
 }
 
+/**
+ * Read native-main usage while ownership is held, publishing only current credential evidence.
+ * A replaced same-account bearer may return its parsed ordinary info without mutating shared
+ * state or supplying recovery proof. Conflicting identities and stale errors return cached info.
+ */
 export async function fetchMainAccountInfoWhileOwned(
   forceRefresh: boolean,
   retriesRemaining: number,
@@ -185,6 +214,9 @@ export async function fetchMainAccountInfoWhileOwned(
    * promoting a background poll into operator intent below.
    */
   explicitRefresh: boolean = forceRefresh,
+  /** Reset-credit consume needs a fresh post-spend observation, not an earlier read. */
+  postReset = false,
+  paced = true,
 ): Promise<MainAccountInfoFetchResult> {
   const writerGeneration = captureConfigGeneration();
   reconcileMainCodexAccountRuntimeState();
@@ -212,120 +244,164 @@ export async function fetchMainAccountInfoWhileOwned(
     ? observeMainQuotaCredential(tokens.access_token, tokens.account_id)
     : undefined;
   const mainQuotaCredentialGeneration = getMainQuotaCredentialGeneration();
+  /** A disk replacement may have no second probe to advance the credential generation. */
+  const credentialIsCurrent = (): boolean => {
+    const current = readCodexTokensResult(undefined, { bounded: true });
+    if (current.status !== "ok") return false;
+    const effectiveAccountId = extractAccountId(current.tokens.id_token, current.tokens.access_token)
+      ?? (current.tokens.account_id || null);
+    if (effectiveAccountId !== current.tokens.account_id || effectiveAccountId !== requestAccountId) return false;
+    observeMainQuotaCredential(current.tokens.access_token, current.tokens.account_id);
+    return mainQuotaWriter !== undefined
+      && isMainQuotaWriterLive(mainQuotaWriter)
+      && mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
+      && matchesMainQuotaCredential(tokens.access_token, tokens.account_id);
+  };
   // Keep diagnostics separate from authentication and freshness policy. Never serialize errors.
   const quotaSignal = AbortSignal.timeout(WHAM_REQUEST_TIMEOUT_MS);
   let quotaPhase: "request" | "body" | "decode" | "publish" = "request";
   let quotaRefreshGeneration = captureMainAccountIdentityGeneration();
-  try {
-    const dispatchSequence = nextQuotaDispatchSequence();
-    const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
-      headers: { Authorization: `Bearer ${tokens.access_token}`, "ChatGPT-Account-Id": tokens.account_id },
-      signal: quotaSignal,
-    });
-    quotaPhase = "publish";
-    if (!resp.ok) {
-      const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
-      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
+  const readState: { owner?: CodexUsageOwner<MainAccountInfoFetchResult>; usable: boolean } = { usable: false };
+  const read = async (): Promise<MainAccountInfoFetchResult> => {
+    try {
+      let dispatchSequence = 0;
+      const baseKey = `main:${writerGeneration}:${mainQuotaCredentialGeneration}`;
+      const resetEpoch = postReset ? `:post-reset:${currentQuotaDispatchSequence()}` : "";
+      const admission = await fetchCodexUsage<MainAccountInfoFetchResult>(
+        `${baseKey}${resetEpoch}`, {
+        headers: { Authorization: `Bearer ${tokens.access_token}`, "ChatGPT-Account-Id": tokens.account_id },
+        signal: quotaSignal,
+      }, () => { dispatchSequence = nextQuotaDispatchSequence(); },
+      paced ? { pacingKey: baseKey } : { unpaced: true });
+      if (!admission) return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+        credentialChecked: true, hasCredential: true };
+      if (admission.kind === "joined") {
+        const current = credentialIsCurrent() && writerGeneration === captureConfigGeneration();
+        if (!current) return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: true, hasCredential: true };
+        if (explicitRefresh && (admission.result.quotaRefresh?.status === "ok"
+          || admission.result.quotaRefresh?.status === "not_reported")) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        return admission.result;
+      }
+      readState.owner = admission;
+      const resp = admission.response;
+      quotaPhase = "publish";
+      if (!resp.ok) {
+        const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
+        const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
+        if (retried) return retried;
+        if (!isQuotaDispatchCurrent(dispatchSequence) || !credentialIsCurrent()) {
+          return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+            credentialChecked: true, hasCredential: true };
+        }
+        if (terminalAuthFailure) {
+          // Account for this attempt's own synchronous invalidation, never prior external drift.
+          const diagnosticStillLive = isMainAccountIdentityGenerationLive(quotaRefreshGeneration);
+          clearMainAccountInfoCache();
+          if (diagnosticStillLive) quotaRefreshGeneration = captureMainAccountIdentityGeneration();
+          markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
+        }
+        return {
+          info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
+          quotaRefresh: { status: "http_error", httpStatus: resp.status },
+          quotaRefreshGeneration,
+        };
+      }
+      quotaPhase = "body";
+      const data = (await resp.json()) as WhamUsageResponse;
+      quotaPhase = "publish";
+      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
       if (retried) return retried;
+      quotaPhase = "decode";
+      if (data === null || typeof data !== "object" || Array.isArray(data)) {
+        throw new Error("Invalid WHAM usage object");
+      }
+      // A newer published response wins over this attempt, including its returned display info.
       if (!isQuotaDispatchCurrent(dispatchSequence)) {
         return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
           credentialChecked: true, hasCredential: true };
       }
-      if (terminalAuthFailure) {
-        // Account for this attempt's own synchronous invalidation, never prior external drift.
-        const diagnosticStillLive = isMainAccountIdentityGenerationLive(quotaRefreshGeneration);
-        clearMainAccountInfoCache();
-        if (diagnosticStillLive) quotaRefreshGeneration = captureMainAccountIdentityGeneration();
-        markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
+      quotaPhase = "publish";
+      // A delayed response from a replaced bearer cannot revoke a newer Reserve grant,
+      // even in the same workspace or after an A→B→A credential transition.
+      if (credentialIsCurrent()) {
+        observeMainReserveRevocation(data, mainQuotaWriter);
+      }
+      quotaPhase = "decode";
+      const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
+      const usage = { ...data, ...(plan ? { plan_type: plan } : {}) };
+      const quota = parseUsageQuota(usage);
+      const policyQuota = parseMainPolicyUsageQuota(usage);
+      quotaPhase = "publish";
+      const result = {
+        email: data.email ?? null,
+        plan,
+        quota,
+        ts: Date.now(),
+      };
+      if (!credentialIsCurrent()) {
+        // Preserve same-identity ordinary info, but never publish stale evidence or state.
+        if (mainQuotaWriter && isMainQuotaWriterLive(mainQuotaWriter)) {
+          return { info: result, infoUnpublished: true, credentialChecked: true, hasCredential: true };
+        }
+        return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: true, hasCredential: true };
+      }
+      const freshResetCredits = quota?.resetCredits;
+      // Tag the count with the identity it was read from, so a later response that omits the
+      // summary can restore the badge without ever crossing an account boundary.
+      rememberMainResetCredits(requestAccountId, freshResetCredits);
+      setMainAccountInfoCache(result);
+      // Only an explicit refresh may retract a reauth quarantine. A 200 from
+      // /wham/usage proves the token authenticates to the usage endpoint; it does not
+      // prove the account can serve Responses traffic, which is a different backend path
+      // and still answers 403 for a workspace the token may no longer select (#327).
+      // Letting the background poll clear the flag put such an account straight back into
+      // rotation: the next request failed the same way and re-marked it, so needsReauth
+      // never settled and the dashboard kept showing nothing — the symptom #327 reported.
+      // An explicit refresh is an operator asking to re-evaluate, normally right after
+      // signing in again, so it stays authoritative.
+      if (explicitRefresh) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+      // Mirror main quota + plan into the shared stores so the rotation engine can
+      // score and auto-switch the main account exactly like a pool account (Option A).
+      setMainAccountPlan(result.plan);
+      if (result.quota) {
+        setAccountQuotaFromParsed(MAIN_CODEX_ACCOUNT_ID, result.quota, writerGeneration, mainQuotaWriter, policyQuota);
       }
+      publishQuotaDispatch(dispatchSequence);
+      readState.usable = quota !== null;
+      return {
+        info: result,
+        quotaRefresh: { status: quota ? "ok" : "not_reported" },
+        quotaRefreshGeneration,
+        credentialChecked: true,
+        hasCredential: true,
+        ...(quota ? { freshQuota: quota } : {}),
+        ...(quota && mainQuotaWriter && credentialIsCurrent()
+          ? { resetRecoveryProof: { writer: mainQuotaWriter, credentialGeneration: mainQuotaCredentialGeneration, dispatchSequence } }
+          : {}),
+        ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
+      };
+    } catch (error) {
+      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
+      if (retried) return retried;
+      if (!credentialIsCurrent()) {
+        return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: true, hasCredential: true };
+      }
+      let status: CodexQuotaRefreshOutcome["status"] = "internal_error";
+      if ((quotaPhase === "request" || quotaPhase === "body") && quotaSignal.aborted) status = "timeout";
+      else if (quotaPhase === "request") status = "network_error";
+      else if (quotaPhase === "body") status = error instanceof SyntaxError ? "invalid_response" : "network_error";
+      else if (quotaPhase === "decode") status = "invalid_response";
       return {
         info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
-        quotaRefresh: { status: "http_error", httpStatus: resp.status },
+        quotaRefresh: { status },
         quotaRefreshGeneration,
       };
     }
-    quotaPhase = "body";
-    const data = (await resp.json()) as WhamUsageResponse;
-    quotaPhase = "publish";
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
-    if (retried) return retried;
-    quotaPhase = "decode";
-    if (data === null || typeof data !== "object" || Array.isArray(data)) {
-      throw new Error("Invalid WHAM usage object");
-    }
-    // Check after body/retry awaits and before any cache, credits, policy or
-    // Reserve publication. Returning cached state supplies no fresh recovery proof.
-    if (!isQuotaDispatchCurrent(dispatchSequence)) {
-      return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO,
-        credentialChecked: true, hasCredential: true };
-    }
-    quotaPhase = "publish";
-    // A delayed response from a replaced bearer cannot revoke a newer Reserve grant,
-    // even in the same workspace or after an A→B→A credential transition.
-    if (mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
-      && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)) {
-      observeMainReserveRevocation(data, mainQuotaWriter);
-    }
-    quotaPhase = "decode";
-    const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
-    const usage = { ...data, ...(plan ? { plan_type: plan } : {}) };
-    const quota = parseUsageQuota(usage);
-    const policyQuota = parseMainPolicyUsageQuota(usage);
-    quotaPhase = "publish";
-    const freshResetCredits = quota?.resetCredits;
-    // Tag the count with the identity it was read from, so a later response that omits the
-    // summary can restore the badge without ever crossing an account boundary.
-    rememberMainResetCredits(requestAccountId, freshResetCredits);
-    const result = {
-      email: data.email ?? null,
-      plan,
-      quota,
-      ts: Date.now(),
-    };
-    setMainAccountInfoCache(result);
-    // Only an explicit refresh may retract a reauth quarantine. A 200 from
-    // /wham/usage proves the token authenticates to the usage endpoint; it does not
-    // prove the account can serve Responses traffic, which is a different backend path
-    // and still answers 403 for a workspace the token may no longer select (#327).
-    // Letting the background poll clear the flag put such an account straight back into
-    // rotation: the next request failed the same way and re-marked it, so needsReauth
-    // never settled and the dashboard kept showing nothing — the symptom #327 reported.
-    // An explicit refresh is an operator asking to re-evaluate, normally right after
-    // signing in again, so it stays authoritative.
-    if (explicitRefresh) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
-    // Mirror main quota + plan into the shared stores so the rotation engine can
-    // score and auto-switch the main account exactly like a pool account (Option A).
-    setMainAccountPlan(result.plan);
-    if (result.quota) {
-      setAccountQuotaFromParsed(MAIN_CODEX_ACCOUNT_ID, result.quota, writerGeneration, mainQuotaWriter, policyQuota);
-    }
-    publishQuotaDispatch(dispatchSequence);
-    return {
-      info: result,
-      quotaRefresh: { status: quota ? "ok" : "not_reported" },
-      quotaRefreshGeneration,
-      credentialChecked: true,
-      hasCredential: true,
-      ...(quota ? { freshQuota: quota } : {}),
-      ...(quota && mainQuotaWriter && isMainQuotaWriterLive(mainQuotaWriter)
-        && mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
-        && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)
-        ? { resetRecoveryProof: { writer: mainQuotaWriter, credentialGeneration: mainQuotaCredentialGeneration, dispatchSequence } }
-        : {}),
-      ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
-    };
-  } catch (error) {
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
-    if (retried) return retried;
-    let status: CodexQuotaRefreshOutcome["status"] = "internal_error";
-    if ((quotaPhase === "request" || quotaPhase === "body") && quotaSignal.aborted) status = "timeout";
-    else if (quotaPhase === "request") status = "network_error";
-    else if (quotaPhase === "body") status = error instanceof SyntaxError ? "invalid_response" : "network_error";
-    else if (quotaPhase === "decode") status = "invalid_response";
-    return {
-      info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
-      quotaRefresh: { status },
-      quotaRefreshGeneration,
-    };
-  }
+  };
+  let outcome: MainAccountInfoFetchResult | undefined;
+  try { outcome = await read(); return outcome; }
+  finally { readState.owner?.settle(readState.usable, outcome); }
 }

package/src/codex/auth-api/pool-mode-gate.ts

@@ -1,3 +1,4 @@
+import { nextCodexUsageQueryAt, nextQuotaQueryDelay, pruneRemovedCodexPoolUsageAccounts } from "../quota-query-backoff";
 import { CODEX_PRIORITY_FAILBACK_REFRESH_MS } from "../account-priority";
 import { codexQuotaHasFreshUsage } from "../quota-observation-freshness";
 import { getCodexAccountCredential, getValidCodexToken, readCodexAccountRecord } from "../account-store";
@@ -8,7 +9,7 @@ import { readCodexTokens } from "../auth-collision";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
 import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
 import { captureConfigGeneration, registerStateSweepAfterTick } from "../../lib/state-store-sweeper";
-import { captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
+import { observeMainQuotaCredential, getMainQuotaCredentialGeneration, captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
 import type { OcxConfig } from "../../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
@@ -52,7 +53,8 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
         return;
       }
       try {
-        const result = await fetchPoolAccountQuota(claim.accountId, true, account.plan);
+        const result = await fetchPoolAccountQuota(claim.accountId, true, account.plan,
+          undefined, false, undefined, now);
         // Defence in depth: independent scopes are already excluded at the claim site.
         // Generic WHAM must never clear Reserve even if claim selection changes.
         const recovered = (claim.scope === undefined || claim.scope === "shared")
@@ -71,12 +73,26 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
 }
 
 let mainHardLockRecoveryInFlight: Promise<void> | null = null;
+let mainHardLockRecoveryAttempt: { identity: number; credential: number; after: number; delay: number } | undefined;
 
 /** Metadata-only recovery on the existing sweep; failures retain the observed policy block. */
 export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise<void> {
   if (mainHardLockRecoveryInFlight) return mainHardLockRecoveryInFlight;
-  if (getMainAccountHardLockStatus(config).state !== "blocked"
-    || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
+  const status = getMainAccountHardLockStatus(config);
+  if (status.state !== "blocked") { mainHardLockRecoveryAttempt = undefined; return; }
+  if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
+  // A predicted reset is a scheduling hint, never proof that the hard lock can be lifted.
+  if (status.resetAt !== undefined && status.resetAt > Date.now()) return;
+  // Reconcile the owned physical credential before skipping work for an older one.
+  reconcileMainCodexAccountRuntimeState();
+  const physical = readCodexTokens();
+  if (physical) observeMainQuotaCredential(physical.access_token, physical.account_id);
+  const identity = captureMainAccountIdentityGeneration();
+  const credential = getMainQuotaCredentialGeneration();
+  const previous = mainHardLockRecoveryAttempt;
+  const queryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
+  if ((previous?.identity === identity && previous.credential === credential
+    && previous.after > Date.now()) || queryAfter > Date.now()) return;
   const lease = tryAcquireNativeMainProfileClaim();
   if (!lease) return;
   mainHardLockRecoveryInFlight = (async () => {
@@ -88,7 +104,9 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
     try {
       // Refresh can require an exclusive credential claim: never hold WHAM's shared
       // claim while obtaining a valid token. The runtime lease spans both operations.
-      if (!await getValidMainAccountToken({ preserveReauth: true })) return;
+      const prepared = await getValidMainAccountToken({ preserveReauth: true });
+      if (!prepared) return;
+      observeMainQuotaCredential(prepared.accessToken, prepared.chatgptAccountId);
     } catch (error) {
       if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth"
         && isMainAccountIdentityGenerationLive(identityGeneration)) {
@@ -97,7 +115,41 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
       return;
     }
     if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
-    await fetchMainAccountInfoAttempt(true, 1, lease, false, false);
+    const credential = getMainQuotaCredentialGeneration();
+    // Reconcile the physical bearer before consulting the previous credential's delay.
+    if (previous?.identity === identityGeneration && previous.credential === credential
+      && previous.after > Date.now()) return;
+    const currentQueryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
+    if (currentQueryAfter > Date.now()) {
+      mainHardLockRecoveryAttempt = { identity: identityGeneration, credential,
+        delay: previous?.identity === identityGeneration && previous.credential === credential ? previous.delay : 0,
+        after: currentQueryAfter };
+      return;
+    }
+    const result = await fetchMainAccountInfoAttempt(true, 1, lease, false, false, false, config);
+    // Never charge a replacement credential for a late result from its predecessor.
+    if (isMainAccountIdentityGenerationLive(identityGeneration)
+      && credential === getMainQuotaCredentialGeneration()) {
+      const queryAfter = nextCodexUsageQueryAt(`main:${captureConfigGeneration()}:${credential}`) ?? 0;
+      const previousDelay = previous?.identity === identityGeneration && previous.credential === credential
+        ? previous.delay : 0;
+      if (result.quotaRefresh) {
+        const authStatus = result.quotaRefresh.status === "http_error"
+          ? result.quotaRefresh.httpStatus : undefined;
+        const transientAuth = (authStatus === 401 || authStatus === 403)
+          && !isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        if (transientAuth) mainHardLockRecoveryAttempt = undefined;
+        else {
+          const delay = nextQuotaQueryDelay(previousDelay || undefined);
+          mainHardLockRecoveryAttempt = getMainAccountHardLockStatus(config).state === "blocked"
+            ? { identity: identityGeneration, credential, delay, after: Math.max(Date.now() + delay, queryAfter) }
+            : undefined;
+        }
+      } else if (queryAfter > Date.now()) {
+        mainHardLockRecoveryAttempt = { identity: identityGeneration, credential,
+          delay: previousDelay, after: queryAfter };
+      }
+    }
   })().catch(() => {
     // Best-effort background metadata read; no cooldown/pause or policy clearing on failure.
   }).finally(() => {
@@ -169,6 +221,7 @@ export async function primeCodexPoolQuotas(
   // retry the restored credential is entitled to.
   const runtimeConfig = getRuntimeConfig(config);
   const configuredPoolIds = new Set((runtimeConfig.codexAccounts ?? []).map(account => account.id));
+  pruneRemovedCodexPoolUsageAccounts(configuredPoolIds);
   for (const accountId of poolQuotaPrimeAttemptedAt.keys()) {
     if (!configuredPoolIds.has(accountId)) poolQuotaPrimeAttemptedAt.delete(accountId);
   }
@@ -220,7 +273,8 @@ export async function primeCodexPoolQuotas(
             const bypassCachedQuota = !!observationStale;
             if (options.fetchMainInfo) await options.fetchMainInfo(bypassCachedQuota);
             // Cache bypass is passive observation, never an explicit reauthentication recovery.
-            else await fetchMainAccountInfoAttempt(bypassCachedQuota, 1, mainLease, true, false);
+            else await fetchMainAccountInfoAttempt(bypassCachedQuota, 1, mainLease, true,
+              false, false, config);
           });
         } catch (error) {
           if (!isNativeMainClaimUnavailable(error)) throw error;