@bitkyc08/opencodex 2.8.2-preview.20260731 → 2.9.1

package/src/codex/auth-context.ts

@@ -1,9 +1,12 @@
 import {
   CodexCredentialGenerationConflictError,
   CodexCredentialRefreshLockTimeoutError,
+  CodexCredentialRefreshBusyError,
+  CodexCredentialRefreshStaleError,
   getValidCodexToken,
   isCodexAccountGenerationLive,
 } from "./account-store";
+import { ConfigMutationLockError } from "../config";
 import { markAccountNeedsReauth } from "./account-runtime-state";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
@@ -24,12 +27,14 @@ import { formatErrorResponse } from "../bridge";
 import { getAccountQuota } from "./quota";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
 
 export type CodexAuthContext =
   | { kind: "main"; accountId: null }
   | {
       kind: "pool";
       accountId: string;
+      writerGeneration: number;
       generation: number;
       accessToken: string;
       chatgptAccountId: string;
@@ -49,6 +54,7 @@ export type CodexAuthContext =
       // (Option A). Distinct from "main" (passthrough fallback that forwards the client token).
       kind: "main-pool";
       accountId: string;
+      writerGeneration: number;
       accessToken: string;
       chatgptAccountId: string;
       /** See `pool.probeLeaseId`. */
@@ -180,7 +186,11 @@ export class CodexThreadAffinityExpiredError extends Error {
 }
 
 export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown): boolean {
-  return !(cause instanceof CodexCredentialGenerationConflictError) && !(cause instanceof CodexCredentialRefreshLockTimeoutError);
+  return !(cause instanceof CodexCredentialGenerationConflictError)
+    && !(cause instanceof CodexCredentialRefreshLockTimeoutError)
+    && !(cause instanceof CodexCredentialRefreshBusyError)
+    && !(cause instanceof CodexCredentialRefreshStaleError)
+    && !(cause instanceof ConfigMutationLockError);
 }
 
 export interface ResolveCodexAuthContextOptions {
@@ -195,6 +205,7 @@ export async function resolveCodexAuthContext(
   mode: CodexAccountMode,
   options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
+  const writerGeneration = captureConfigGeneration();
   if (mode === "direct") {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
@@ -254,6 +265,7 @@ export async function resolveCodexAuthContext(
     return {
       kind: "main-pool",
       accountId,
+      writerGeneration,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
       ...(quotaScope ? { quotaScope } : {}),
@@ -267,6 +279,7 @@ export async function resolveCodexAuthContext(
     return {
       kind: "pool",
       accountId,
+      writerGeneration,
       generation: token.generation,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
@@ -278,7 +291,7 @@ export async function resolveCodexAuthContext(
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
     if (shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
-      markAccountNeedsReauth(accountId);
+      markAccountNeedsReauth(accountId, writerGeneration);
     }
     throw new CodexAuthContextError(accountId, cause);
   }

package/src/codex/catalog/aggregation.ts

@@ -281,6 +281,21 @@ export function resetOpenAiApiCatalogWarningStateForTests(): void {
 export const slugAliasCollisionWarnings = new Set<string>();
 
 export const comboMasqueradeCollisionWarnings = new Set<string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileCatalogWarningMemos(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = openAiApiCollisionWarnings.size
+    + comboCatalogWarningSignatures.size
+    + slugAliasCollisionWarnings.size
+    + comboMasqueradeCollisionWarnings.size;
+  openAiApiCollisionWarnings.clear();
+  comboCatalogWarningSignatures.clear();
+  slugAliasCollisionWarnings.clear();
+  comboMasqueradeCollisionWarnings.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 export function warnComboMasqueradeCollisionOnce(slug: string): void {
   if (comboMasqueradeCollisionWarnings.has(slug)) return;

package/src/codex/catalog/provider-fetch.ts

@@ -53,6 +53,7 @@ import {
   type ProviderModelsApiItem,
 } from "../../providers/model-discovery";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
+import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } from "../../lib/admission";
 
 
 import { JAWCODE_CATALOG_AUGMENT_PROVIDERS, catalogModelSlug, shouldExposeRoutedModel } from "./parsing";
@@ -69,6 +70,21 @@ interface GatherFlightResult {
 }
 
 const gatherInflight = new Map<string, Promise<GatherFlightResult>>();
+const MAX_CONCURRENT_CATALOG_GATHERS = 8;
+const gatherGate = createAdmissionGate("catalog_gathers", MAX_CONCURRENT_CATALOG_GATHERS);
+
+export class CatalogGatherBusyError extends ResourceAdmissionError {
+  override readonly code = "catalog_busy";
+  readonly retryAfterSeconds = 1;
+  constructor() {
+    super("catalog_gathers", MAX_CONCURRENT_CATALOG_GATHERS);
+    this.name = "CatalogGatherBusyError";
+  }
+}
+
+export function catalogGatherAdmissionMetrics(): AdmissionMetrics {
+  return gatherGate.metrics();
+}
 
 function stableJson(value: unknown): string {
   return JSON.stringify(value, (_key, nested) => {
@@ -217,6 +233,15 @@ export function isDatedVariantId(liveId: string, configuredId: string): boolean
 }
 
 export const lastDropWarnSignature = new Map<string, string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileProviderFetchWarnings(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = lastDropWarnSignature.size;
+  lastDropWarnSignature.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai"]);
 
@@ -345,6 +370,7 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid
   const contextWindow =
     positiveSafeInteger(
       limits?.max_context_length,
+      metadata?.context_length,
       item.context_length,
       item.context_size,
       item.max_model_len,
@@ -648,10 +674,13 @@ export async function gatherRoutedModels(
   const key = gatherFlightKey(config);
   let promise = gatherInflight.get(key);
   if (!promise) {
+    const lease = gatherGate.tryAcquire();
+    if (!lease) throw new CatalogGatherBusyError();
     // Claim the slot synchronously before any await so same-key callers join this flight.
     // Distinct keys keep their own entries — a second config must not evict the first.
     const flight = gatherRoutedModelsUncached(config).finally(() => {
       if (gatherInflight.get(key) === flight) gatherInflight.delete(key);
+      lease.release();
     });
     gatherInflight.set(key, flight);
     promise = flight;

package/src/codex/catalog/sync.ts

@@ -492,6 +492,12 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{
   const catalog = loadCatalogForSync(catalogPath);
   if (!catalog) return { added: 0, path: catalogPath, catalogWritten: false, comboOmissions: [] };
 
+  // The bundled catalog is a reliable native template on the default path, but it is not the
+  // merge source. Preservation must inspect the file that this sync is about to overwrite;
+  // otherwise an empty/partial provider gather cannot see routed or user-native rows on disk.
+  const onDiskCatalog = readCatalog(catalogPath);
+  const catalogModelsForMerge = onDiskCatalog?.models ?? catalog.models ?? [];
+
   const template = findNativeTemplate(catalog);
 
   const comboOmissions: ComboCatalogOmission[] = [];
@@ -534,7 +540,7 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{
   // bare gpt-* rows that hard-404 via NoEnabledOpenAiProviderError. Keep natives when no
   // providers are configured yet (fresh install / catalog bootstrap tests).
   const includeNativeOpenAi = enabledProviders.length === 0 || hasCanonicalOpenai;
-  catalog.models = mergeCatalogEntriesForSync(catalog.models ?? [], goEntries, baseline, featured, wsEnabled, goIds, template, disabledNativeSlugs(config), gatheredProviderNames, multiAgentMode, exactComboSlugs, hasPhysicalComboProvider, includeNativeOpenAi);
+  catalog.models = mergeCatalogEntriesForSync(catalogModelsForMerge, goEntries, baseline, featured, wsEnabled, goIds, template, disabledNativeSlugs(config), gatheredProviderNames, multiAgentMode, exactComboSlugs, hasPhysicalComboProvider, includeNativeOpenAi);
   clampCatalogModelsToCodexSupport(catalog.models);
 
   atomicWriteFile(catalogPath, JSON.stringify(catalog, null, 2) + "\n");

package/src/codex/inject.ts

@@ -296,10 +296,10 @@ function stripExistingModelProvider(content: string): string {
 }
 
 /**
- * Drop ROOT-level `model_context_window` / `model_auto_compact_token_limit` overrides (keys before
- * the first table header). Codex treats these root keys as a global override that wins over the
- * per-model catalog values, so a stale `model_context_window = 1000000` makes every model (e.g.
- * gpt-5.5) report a 1M window. Stripping them on (re)injection lets the catalog drive context size.
+ * Drop ROOT-level `model_context_window` overrides (keys before the first table header). Codex
+ * treats this root key as a global override that wins over the per-model catalog values, so a stale
+ * `model_context_window = 1000000` makes every model (e.g. gpt-5.5) report a 1M window. User-owned
+ * compaction limits do not alter the advertised context window and must survive reinjection.
  */
 export function stripRootContextWindowOverrides(content: string): string {
   const lines = content.split("\n");
@@ -307,7 +307,7 @@ export function stripRootContextWindowOverrides(content: string): string {
   return lines
     .filter((line, i) => {
       const isRoot = firstTable === -1 || i < firstTable;
-      return !isRoot || !/^\s*model_(?:context_window|auto_compact_token_limit)\s*=/.test(line);
+      return !isRoot || !/^\s*model_context_window\s*=/.test(line);
     })
     .join("\n");
 }

package/src/codex/main-account-cache.ts

@@ -1,4 +1,7 @@
 import type { StoredAccountQuota } from "./quota";
+import { truncateRetainedUtf8 } from "../lib/admission";
+
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
 export interface MainAccountInfo {
   email: string | null;
@@ -17,7 +20,11 @@ export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
 }
 
 export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
-  cachedMainAccountInfo = value;
+  cachedMainAccountInfo = {
+    ...value,
+    email: value.email === null ? null : truncateRetainedUtf8(value.email, MAX_DIAGNOSTIC_VALUE_BYTES),
+    plan: value.plan === null ? null : truncateRetainedUtf8(value.plan, MAX_DIAGNOSTIC_VALUE_BYTES),
+  };
 }
 
 export function clearMainAccountInfoCache(): void {

package/src/codex/model-cache.ts

@@ -8,6 +8,8 @@
  * restarts, so an in-memory cache is sufficient here (no SQLite layer needed).
  */
 import type { CatalogModel } from "./catalog";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
 
 /** Default freshness window. Matches Codex's own 5-min models cache so the two stay in step. */
 export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
@@ -15,6 +17,7 @@ export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
 interface CacheEntry {
   models: CatalogModel[];
   fetchedAt: number;
+  sizeBytes: number;
 }
 
 export type ProviderModelDiscoveryFailureReason =
@@ -40,6 +43,29 @@ export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends
   : never;
 
 const cache = new Map<string, CacheEntry>();
+let cacheBytes = 0;
+let oldestCachedProvider: string | undefined;
+let oldestCachedAt: number | null = null;
+const modelCacheEncoder = new TextEncoder();
+
+function recomputeOldestCachedProvider(): void {
+  oldestCachedProvider = undefined;
+  oldestCachedAt = null;
+  for (const [provider, entry] of cache) {
+    if (oldestCachedAt !== null && entry.fetchedAt >= oldestCachedAt) continue;
+    oldestCachedProvider = provider;
+    oldestCachedAt = entry.fetchedAt;
+  }
+}
+
+function deleteCachedProvider(provider: string): number {
+  const entry = cache.get(provider);
+  if (!entry) return 0;
+  cache.delete(provider);
+  cacheBytes = Math.max(0, cacheBytes - entry.sizeBytes);
+  if (oldestCachedProvider === provider) recomputeOldestCachedProvider();
+  return entry.sizeBytes;
+}
 
 /** Cooldown after a failed live `/models` fetch, so a dead/unreachable provider doesn't re-pay
  * the full fetch timeout on every catalog poll (issue #54: UI stalls behind corporate proxies). */
@@ -54,6 +80,7 @@ const discoveryStatus = new Map<string, ProviderModelDiscoveryStatus>();
  * custom-only, and the provider's configured fallback would wrongly stay authoritative.
  */
 const liveModelCounts = new Map<string, number>();
+let lastReconciledGeneration = 0;
 
 export function markModelsFetchFailure(provider: string, now = Date.now()): void {
   failureAt.set(provider, now);
@@ -129,20 +156,72 @@ export function getStaleCached(provider: string): CatalogModel[] | null {
 }
 
 export function setCached(provider: string, models: CatalogModel[], now = Date.now()): void {
-  cache.set(provider, { models, fetchedAt: now });
+  deleteCachedProvider(provider);
+  const sizeBytes = modelCacheEncoder.encode(provider).byteLength
+    + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
+  cache.set(provider, { models, fetchedAt: now, sizeBytes });
+  cacheBytes += sizeBytes;
+  if (oldestCachedAt === null || now < oldestCachedAt) {
+    oldestCachedProvider = provider;
+    oldestCachedAt = now;
+  }
+  enforceAppOwnedMemoryBudget();
 }
 
 /** Drop one provider's cache (or all) so the next resolve forces a live re-fetch. */
 export function clearModelCache(provider?: string): void {
   if (provider) {
-    cache.delete(provider);
+    deleteCachedProvider(provider);
     failureAt.delete(provider);
     discoveryStatus.delete(provider);
     liveModelCounts.delete(provider);
   } else {
     cache.clear();
+    cacheBytes = 0;
+    oldestCachedProvider = undefined;
+    oldestCachedAt = null;
     failureAt.clear();
     discoveryStatus.clear();
     liveModelCounts.clear();
   }
 }
+
+export function reconcileModelCacheProviders(
+  validProviders: ReadonlySet<string>,
+  generation = lastReconciledGeneration + 1,
+): number {
+  if (generation <= lastReconciledGeneration) return 0;
+  const removedProviders = new Set<string>();
+  for (const store of [failureAt, discoveryStatus, liveModelCounts]) {
+    for (const provider of store.keys()) {
+      if (validProviders.has(provider)) continue;
+      store.delete(provider);
+      removedProviders.add(provider);
+    }
+  }
+  for (const provider of cache.keys()) {
+    if (validProviders.has(provider)) continue;
+    deleteCachedProvider(provider);
+    removedProviders.add(provider);
+  }
+  lastReconciledGeneration = generation;
+  return removedProviders.size;
+}
+
+export function reconcileModelCacheGeneration(context: GenerationContext): number {
+  return reconcileModelCacheProviders(context.providerNames, context.generation);
+}
+
+export function modelCacheRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  return {
+    count: cache.size,
+    bytes: cacheBytes,
+    evictableBytes: cacheBytes,
+    pinnedBytes: 0,
+    oldestAt: oldestCachedAt,
+  };
+}
+
+export function evictOldestModelCacheForBudget(): number {
+  return oldestCachedProvider === undefined ? 0 : deleteCachedProvider(oldestCachedProvider);
+}

package/src/codex/pool-rotation.ts

@@ -1,4 +1,5 @@
 import type { OcxAccountPoolRotationStrategy } from "../types";
+import type { GenerationContext } from "../lib/state-store-sweeper";
 
 export const POOL_KEY_CODEX = "codex";
 export const POOL_KEY_ANTHROPIC = "anthropic";
@@ -10,6 +11,7 @@ interface SelectionState {
 }
 
 const selectionState = new Map<string, SelectionState>();
+let lastReconciledGeneration = 0;
 
 const DEFAULT_STICKY_LIMIT = 1;
 const MIN_STICKY_LIMIT = 1;
@@ -184,3 +186,40 @@ export function clearPoolRotationState(poolKey?: string): void {
   }
   selectionState.delete(poolKey);
 }
+
+export function reconcilePoolRotationState(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  const anthropicIds = new Set<string>();
+  for (const key of context.oauthAccountKeys) {
+    const separator = key.indexOf("\0");
+    if (separator > 0 && key.slice(0, separator) === "anthropic") {
+      anthropicIds.add(key.slice(separator + 1));
+    }
+  }
+  let removed = 0;
+  for (const [poolKey, state] of selectionState) {
+    const valid = poolKey === POOL_KEY_ANTHROPIC
+      ? anthropicIds
+      : poolKey === POOL_KEY_CODEX || poolKey.startsWith(`${POOL_KEY_CODEX}:`)
+        ? context.codexAccountIds
+        : null;
+    if (!valid) continue;
+    if (valid.size === 0) {
+      selectionState.delete(poolKey);
+      removed += 1;
+      continue;
+    }
+    if (state.activeKey && !valid.has(state.activeKey)) {
+      delete state.activeKey;
+      state.successes = 0;
+      removed += 1;
+    }
+    for (const accountId of state.currentWeights.keys()) {
+      if (valid.has(accountId)) continue;
+      state.currentWeights.delete(accountId);
+      removed += 1;
+    }
+  }
+  lastReconciledGeneration = context.generation;
+  return removed;
+}

package/src/codex/project-config-warnings.ts

@@ -3,9 +3,11 @@ import path, { dirname, join, resolve } from "node:path";
 import { expandUserPath } from "../config";
 import { defaultCodexHome } from "./home";
 import { readRootTomlString } from "./paths";
+import { truncateRetainedUtf8 } from "../lib/admission";
 
 const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
 const DIAGNOSTICS_CACHE_TTL_MS = 30_000;
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
 function resolveCodexConfigPath(): string {
   const raw = process.env.CODEX_HOME?.trim();
@@ -309,7 +311,16 @@ export function getCachedProjectConfigDiagnostics(): {
 } {
   const now = Date.now();
   if (!diagnosticsCache || now - diagnosticsCache.at > DIAGNOSTICS_CACHE_TTL_MS) {
-    diagnosticsCache = { at: now, warnings: collectProjectCodexConfigWarnings() };
+    diagnosticsCache = {
+      at: now,
+      warnings: collectProjectCodexConfigWarnings().map(warning => ({
+        ...warning,
+        path: truncateRetainedUtf8(warning.path, MAX_DIAGNOSTIC_VALUE_BYTES),
+        detail: truncateRetainedUtf8(warning.detail, MAX_DIAGNOSTIC_VALUE_BYTES),
+        ...(warning.profileName === undefined ? {} : { profileName: truncateRetainedUtf8(warning.profileName, MAX_DIAGNOSTIC_VALUE_BYTES) }),
+        message: truncateRetainedUtf8(warning.message, MAX_DIAGNOSTIC_VALUE_BYTES),
+      })),
+    };
   }
   const warnings = diagnosticsCache.warnings;
   return { warnings, grouped: groupProjectCodexConfigWarningsByPath(warnings) };

package/src/codex/quota.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
+import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 
 export type StoredAccountQuota = {
   weeklyPercent?: number;
@@ -49,8 +50,16 @@ const MONTHLY_WINDOW_MIN_SECONDS = 28 * 24 * 60 * 60;
 const MONTHLY_WINDOW_MIN_MINUTES = MONTHLY_WINDOW_MIN_SECONDS / 60;
 
 const accountQuota = new Map<string, StoredAccountQuota>();
+let lastReconciledGeneration = 0;
+let liveAccountIds = new Set<string>();
 
-export const CODEX_UNKNOWN_USAGE_SCORE = 100;
+function mayCommitAccountQuota(accountId: string, writerGeneration: number): boolean {
+  return writerGeneration >= lastReconciledGeneration || liveAccountIds.has(accountId);
+}
+
+// Valid upstream percentages are normalized to 0..100. Keep "unknown" outside that domain so an
+// actually exhausted account is still eligible for threshold rotation.
+export const CODEX_UNKNOWN_USAGE_SCORE = 101;
 export const CODEX_EXHAUSTED_USAGE_PERCENT = 100;
 
 export function isCodexQuotaExhausted(
@@ -125,8 +134,10 @@ function snapshotHasUsage(quota: Omit<StoredAccountQuota, "updatedAt">): boolean
 export function setAccountQuotaFromParsed(
   accountId: string,
   quota: Omit<StoredAccountQuota, "updatedAt"> | null,
+  writerGeneration = captureConfigGeneration(),
 ): void {
   if (!quota) return;
+  if (!mayCommitAccountQuota(accountId, writerGeneration)) return;
   const existing = accountQuota.get(accountId);
   const next: StoredAccountQuota = { updatedAt: Date.now() };
   const creditsOnly = quota.resetCredits !== undefined && !snapshotHasUsage(quota);
@@ -214,10 +225,14 @@ export function parseUpstreamQuotaHeaders(headers: Headers): Omit<StoredAccountQ
   return hasKnownQuotaValue(quota) ? quota : null;
 }
 
-export function applyAccountQuotaFromUpstreamHeaders(accountId: string, headers: Headers): void {
+export function applyAccountQuotaFromUpstreamHeaders(
+  accountId: string,
+  headers: Headers,
+  writerGeneration = captureConfigGeneration(),
+): void {
   const quota = parseUpstreamQuotaHeaders(headers);
   if (!quota) return;
-  setAccountQuotaFromParsed(accountId, quota);
+  setAccountQuotaFromParsed(accountId, quota, writerGeneration);
 }
 
 export function updateAccountQuota(
@@ -227,7 +242,9 @@ export function updateAccountQuota(
   monthly?: unknown,
   monthlyResetAt?: unknown,
   resetCredits?: number,
+  writerGeneration = captureConfigGeneration(),
 ): void {
+  if (!mayCommitAccountQuota(accountId, writerGeneration)) return;
   const existing = accountQuota.get(accountId);
   const nextWeekly = normalizeUsagePercent(weekly);
   const nextMonthly = normalizeUsagePercent(monthly);
@@ -325,6 +342,21 @@ export function clearAccountQuota(accountId?: string): void {
   }
 }
 
+export function reconcileCodexQuotaAccounts(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  hydrateAccountQuotasFromDisk();
+  let removed = 0;
+  for (const accountId of accountQuota.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    accountQuota.delete(accountId);
+    removed += 1;
+  }
+  liveAccountIds = new Set(context.codexAccountIds);
+  lastReconciledGeneration = context.generation;
+  if (removed > 0) schedulePersistAccountQuotas();
+  return removed;
+}
+
 export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuota, "updatedAt"> | null {
   const resetCredits = typeof data.rate_limit_reset_credits?.available_count === "number"
     ? data.rate_limit_reset_credits.available_count

package/src/codex/routing.ts

@@ -19,6 +19,9 @@ import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./main-account";
 import { isSelectableCodexPoolAccount } from "./account-id";
 import type { OcxConfig } from "../types";
+import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { retainedUtf8Bytes } from "../lib/admission";
 
 type ThreadAffinityEntry = {
   accountId: string;
@@ -104,6 +107,7 @@ const CODEX_TRANSIENT_SOFT_AVOID_ESCALATION_MS = [
 ] as const;
 export const CODEX_THREAD_AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 export const CODEX_THREAD_AFFINITY_MAX_ENTRIES = 2048;
+const MAX_AFFINITY_COMPONENT_BYTES = 512;
 // Min interval between quota threshold re-evaluations for a single bound thread.
 // Well under the 5h/weekly quota windows, but enough to stop per-request flapping.
 export const CODEX_THREAD_AFFINITY_REEVAL_INTERVAL_MS = 60_000;
@@ -115,6 +119,8 @@ const upstreamHealth = new Map<string, CodexUpstreamHealth>();
  * from account-wide Retry-After/default throttles and transient health.
  */
 const quotaScopedHealth = new Map<string, Map<CodexQuotaScope, CodexUpstreamHealth>>();
+let lastReconciledGeneration = 0;
+let liveHealthAccountIds = new Set<string>();
 
 export type CodexUpstreamOutcome = number | "connect_error" | "timeout";
 export type CodexUpstreamOutcomeClass = "success" | "credential" | "quota" | "transient" | "caller" | "unknown";
@@ -185,6 +191,8 @@ export type CodexUpstreamOutcomeMeta = {
    * again (which would advance a round-robin ring twice).
    */
   promoteAccountId?: string;
+  /** Generation captured when this routed account was selected. */
+  writerGeneration?: number;
 };
 
 function hasConfiguredPoolAccount(config: OcxConfig, accountId: string): boolean {
@@ -193,6 +201,15 @@ function hasConfiguredPoolAccount(config: OcxConfig, accountId: string): boolean
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);
 }
 
+export function listLiveCodexAccountIds(config: OcxConfig): ReadonlySet<string> {
+  const ids = new Set((config.codexAccounts ?? []).map(account => account.id));
+  const openai = config.providers.openai;
+  if (openai && openai.disabled !== true && isCanonicalOpenAiForwardProvider(openai)) {
+    ids.add(MAIN_CODEX_ACCOUNT_ID);
+  }
+  return ids;
+}
+
 export function clearThreadAccountMap(): void {
   threadAccountMap.clear();
 }
@@ -217,6 +234,24 @@ export function clearCodexUpstreamHealthForAccount(accountId: string): void {
   quotaScopedHealth.delete(accountId);
 }
 
+export function reconcileCodexRoutingHealth(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  let removed = 0;
+  for (const accountId of upstreamHealth.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    upstreamHealth.delete(accountId);
+    removed += 1;
+  }
+  for (const accountId of quotaScopedHealth.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    quotaScopedHealth.delete(accountId);
+    removed += 1;
+  }
+  liveHealthAccountIds = new Set(context.codexAccountIds);
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
+
 export function getCodexUpstreamHealth(
   accountId: string,
 ): CodexUpstreamHealth | null {
@@ -600,11 +635,17 @@ function threadAffinityScope(quotaScope?: CodexQuotaScope): ThreadAffinityScope
   return quotaScope ?? LEGACY_THREAD_AFFINITY_SCOPE;
 }
 
+function admissibleAffinityComponent(value: string): boolean {
+  return retainedUtf8Bytes(value) <= MAX_AFFINITY_COMPONENT_BYTES;
+}
+
 function getThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): ThreadAffinityEntry | undefined {
+  if (!admissibleAffinityComponent(threadId)) return undefined;
   return threadAccountMap.get(threadId)?.get(threadAffinityScope(quotaScope));
 }
 
 function deleteThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): void {
+  if (!admissibleAffinityComponent(threadId)) return;
   const affinities = threadAccountMap.get(threadId);
   if (!affinities) return;
   affinities.delete(threadAffinityScope(quotaScope));
@@ -613,6 +654,7 @@ function deleteThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): v
 
 /** Remove only the matching failed account's affinities for one thread. */
 function deleteThreadAffinitiesForAccount(threadId: string, accountId: string): void {
+  if (!admissibleAffinityComponent(threadId) || !admissibleAffinityComponent(accountId)) return;
   const affinities = threadAccountMap.get(threadId);
   if (!affinities) return;
   for (const [scope, entry] of affinities) {
@@ -671,6 +713,7 @@ function bindThreadAffinity(
   now: number,
   quotaScope?: CodexQuotaScope,
 ): void {
+  if (!admissibleAffinityComponent(threadId) || !admissibleAffinityComponent(accountId)) return;
   const record = accountId === MAIN_CODEX_ACCOUNT_ID ? undefined : readCodexAccountRecord(accountId);
   if (accountId !== MAIN_CODEX_ACCOUNT_ID && (!record?.credential || record.deletedAt != null)) return;
   pruneExpiredThreadAffinities(now);
@@ -1204,6 +1247,8 @@ export function recordCodexUpstreamOutcome(
   meta: CodexUpstreamOutcomeMeta = {},
 ): void {
   if (!accountId) return;
+  const writerGeneration = meta.writerGeneration ?? captureConfigGeneration();
+  if (writerGeneration < lastReconciledGeneration && !liveHealthAccountIds.has(accountId)) return;
   const now = meta.now ?? Date.now();
   const outcomeClass = classifyCodexUpstreamOutcome(outcome);
   const quotaScope = codexQuotaScopeForModel(meta.modelId);
@@ -1275,7 +1320,7 @@ export function recordCodexUpstreamOutcome(
       lastFailureAt: now,
     });
     quotaScopedHealth.delete(accountId);
-    markAccountNeedsReauth(accountId);
+    markAccountNeedsReauth(accountId, writerGeneration);
     clearThreadAccountMapForAccount(accountId);
     return;
   }