@crouton-kit/crouter 0.3.70 → 0.3.79

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/provider-rotation.test.ts

@@ -1,12 +1,14 @@
 import { before, after, test } from "node:test";
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 
 let home: string;
 let helpers: typeof import("../../lib/subscription-state.ts");
+let providerManagement: typeof import("../../../../core/provider-management.ts");
 let rotationModule: typeof import("../provider-rotation.ts");
 let providerRotationExtension: typeof import("../provider-rotation.ts").default;
 const previousHome = process.env.HOME;
@@ -83,10 +85,27 @@ function observeLines(stream: NodeJS.ReadableStream, onLine: (line: string) => v
   });
 }
 
+function within<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error: unknown) => {
+        clearTimeout(timer);
+        reject(error);
+      },
+    );
+  });
+}
+
 before(async () => {
   home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
   process.env.HOME = home;
   helpers = await import("../../lib/subscription-state.ts");
+  providerManagement = await import("../../../../core/provider-management.ts");
   rotationModule = await import("../provider-rotation.ts");
   providerRotationExtension = rotationModule.default;
 });
@@ -522,6 +541,24 @@ test("/provider-sub add with the default label persists the login credential to
   }
 });
 
+// The retained agent command must use the same coordinated removal as the Providers panel:
+// removing the default metadata slot also removes auth.json, so a later read cannot re-seed it.
+test("/provider-sub rm removes the default slot and its auth.json credential together", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(authPath, `${JSON.stringify({ anthropic: { type: "oauth", refresh: "refresh-default", access: "access-default", expires: Date.now() + 60_000 } })}\n`, "utf8");
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0]?.label, "anthropic");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.ui.notify = () => {};
+  await providerRotationExtension(pi);
+  await commands["provider-sub"].handler("anthropic rm anthropic", ctx);
+
+  assert.equal(JSON.parse(readFileSync(authPath, "utf8")).anthropic, undefined);
+  assert.equal(helpers.readSubscriptionPool("anthropic").some((entry) => entry.label === "anthropic"), false);
+});
+
 // A locked auth.json write failure must not let the default-label add path clear the
 // pool cooldown bookkeeping or pretend the add succeeded.
 test("/provider-sub add with the default label keeps the pool cooldown when auth.json write fails", async () => {
@@ -561,6 +598,97 @@ test("/provider-sub add with the default label keeps the pool cooldown when auth
   }
 });
 
+// loginWithManualInputCleanup (reviews mrf5doek + mrf68z4h): the manual-code-paste
+// dialog races pi-ai's loopback callback server. These exercise the wrapper directly
+// (not through __setLoginForProviderForTest, which bypasses it entirely) against a
+// fake `run` that mimics pi-ai's own "call onManualCodeInput, maybe never await it"
+// behavior. Dismissal is now correlated at the BROKER (aborting the dialog's signal
+// drops its pending entry AND emits an extension_ui_dismiss frame keyed to the
+// request id), not a broad notify -- so these assert on the SIGNAL, not a notify.
+
+test("loginWithManualInputCleanup aborts the still-open manual dialog's signal once the OAuth call settles without it (loopback-wins parity)", async () => {
+  let capturedSignal: AbortSignal | undefined;
+  const notifications: Array<{ message: string; type?: string }> = [];
+  const ctx = {
+    ui: {
+      notify: (message: string, type?: string) => notifications.push({ message, type }),
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) => {
+        capturedSignal = opts?.signal;
+        // Never resolves on its own -- mirrors pi-ai abandoning the manual-input
+        // promise once the loopback callback server wins the race.
+        return new Promise<string | undefined>(() => {});
+      },
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any) => {
+    // Start the manual-code prompt (as onManualCodeInput would) but -- like the real
+    // pi-ai race -- never await its outcome; the loopback callback "wins" instead.
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    return "loopback-code";
+  });
+
+  assert.equal(result, "loopback-code");
+  assert.equal(capturedSignal?.aborted, true, "the abandoned manual-input dialog's signal must be aborted once the OAuth call settles -- the broker turns that abort into a correlated extension_ui_dismiss");
+  assert.equal(notifications.length, 0, "no broad dismiss notify -- an unrelated notify must never be used as a dialog-dismissal signal");
+});
+
+test("loginWithManualInputCleanup dismisses the manual dialog at callback-win (onProgress), NOT after a delayed token exchange", async () => {
+  // Reproduces review mrf68z4h's OpenAI/pi-ai-shaped concern: pi-ai gets the code
+  // from the loopback callback, reports progress ("exchanging..."), then awaits a
+  // token exchange that has no timeout. The manual dialog must be aborted at the
+  // callback-win boundary (dismissManual, wired to onProgress), before the exchange
+  // resolves `run` -- otherwise a slow/hung exchange leaves the overlay up.
+  let order = 0;
+  let abortedAt: number | undefined;
+  let runResolvedAt: number | undefined;
+  const ctx = {
+    ui: {
+      notify: () => {},
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) =>
+        // Mirror the broker: resolve to undefined on abort (which readCode turns
+        // into a throw, inert on the abandoned promise like pi-ai's own .catch).
+        new Promise<string | undefined>((resolve) => {
+          opts?.signal?.addEventListener("abort", () => { abortedAt = order++; resolve(undefined); }, { once: true });
+        }),
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any, dismissManual: () => void) => {
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    dismissManual(); // pi-ai's onProgress fires here -- it already has the code
+    await new Promise((r) => setTimeout(r, 25)); // the (possibly slow) token exchange
+    runResolvedAt = order++;
+    return "exchanged-token";
+  });
+
+  assert.equal(result, "exchanged-token");
+  assert.notEqual(abortedAt, undefined, "the manual dialog's signal must have been aborted");
+  assert.notEqual(runResolvedAt, undefined);
+  assert.ok(abortedAt! < runResolvedAt!, "the manual dialog must be dismissed at callback-win (onProgress), BEFORE the delayed token exchange completes");
+});
+
+test("loginWithManualInputCleanup's readCode rejects (rather than resolving to \"\") when the manual dialog is cancelled or times out", async () => {
+  const ctx = {
+    ui: {
+      notify: () => {},
+      // ctx.ui.input resolving to undefined is exactly what a Cancel button or the
+      // dialog's own timeout produces (dialogPromise's cancelled/timeout default).
+      input: async () => undefined,
+    },
+  } as any;
+
+  // pi-ai only calls its onPrompt paste-only fallback when onManualCodeInput
+  // RESOLVES (even to a falsy value) -- never when it rejects. Asserting
+  // loginWithManualInputCleanup itself rejects (instead of resolving to "", the
+  // pre-fix behavior) proves readCode ends the OAuth attempt directly and pi-ai
+  // never gets the chance to fall through to that second, URL-less dialog.
+  await assert.rejects(
+    () => rotationModule.loginWithManualInputCleanup(ctx, (readCode) => readCode("Open this URL...", "placeholder")),
+    /OAuth login cancelled/,
+  );
+});
+
 // The default metadata slot is seeded whenever auth.json holds an OAuth credential for
 // the provider, even when the pool already contains explicit non-default accounts.
 test("seeds the default metadata slot even when the pool already has an explicit non-default account", () => {
@@ -835,6 +963,710 @@ test("keeps newest Retry-After cooldown across overlapping attempts", () => {
   assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
 });
 
+// Storage-hardening (design mrf6n12x): the locked read/modify/write primitive must preserve a
+// causally newer cooldown across a stale credential upsert, while still letting an equal-timestamp
+// reauth clear it.
+test("a stale upsert refreshes tokens but cannot erase a newer cooldown; an equal-timestamp reauth clears it", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("work", { refresh: "r0", access: "a0", lastRateLimitedAt: 100 })]);
+  // What a node reads before doing a slow token refresh.
+  const snapshot = helpers.readSubscriptionPool("anthropic")[0];
+
+  // "Other node" 429s the slot with a strictly newer basis while the refresh is in flight.
+  helpers.markSubscriptionRateLimited("anthropic", "work", 60_000, 500, 500);
+  const cooled = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(cooled.lastRateLimitedAt, 500);
+  assert.equal(cooled.rateLimitedUntil, 60_500);
+
+  // Stale refresh upsert built from the pre-429 snapshot: fresh tokens, stale cooldown basis.
+  helpers.upsertSubscription("anthropic", { ...snapshot, refresh: "r1", access: "a1", expires: snapshot.expires ?? 0 });
+  const merged = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(merged.refresh, "r1", "token fields take the incoming value");
+  assert.equal(merged.access, "a1");
+  assert.equal(merged.rateLimitedUntil, 60_500, "the newer cooldown survives the stale upsert");
+  assert.equal(merged.lastRateLimitedAt, 500);
+
+  // Reauth clears the cooldown while preserving lastRateLimitedAt (equal timestamp -> incoming wins).
+  helpers.upsertSubscription("anthropic", { ...merged, refresh: "r2", access: "a2", rateLimitedUntil: 0, lastRateLimitedAt: merged.lastRateLimitedAt });
+  const reauthed = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(reauthed.rateLimitedUntil, 0, "an equal-timestamp reauth clears the cooldown");
+  assert.equal(reauthed.refresh, "r2");
+});
+
+test("a stale success cannot reopen a slot cooled down by a newer 429", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 30_000, 500, 500);
+  // A success whose attempt STARTED before the 429 must not clear the newer cooldown.
+  helpers.markSubscriptionSuccess("anthropic", "personal", 200);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 30_500);
+  // A success that started after the 429 legitimately clears it.
+  helpers.markSubscriptionSuccess("anthropic", "personal", 600);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+// A mutation must genuinely go through the per-pool-file cross-process lock: while another
+// process holds the pool file's lock (the SAME FileAuthStorageBackend lock the backend uses),
+// a mutator throws after exhausting its retry budget rather than writing unlocked; once the
+// holder releases, the same call succeeds.
+test("pool mutations take the cross-process pool-file lock", async () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("openai-codex", [credential("work")]);
+  const poolFile = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+
+  const lockHolder = spawn(
+    process.execPath,
+    [
+      "--import",
+      "tsx/esm",
+      "--input-type=module",
+      "-e",
+      String.raw`import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
+const backend = new FileAuthStorageBackend(${JSON.stringify(poolFile)});
+await backend.withLockAsync(async () => {
+  process.stdout.write("locked\n");
+  await new Promise((resolve) => {
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", resolve);
+  });
+  return { result: undefined };
+});`,
+    ],
+    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+  );
+  let lockStderr = "";
+  lockHolder.stderr!.setEncoding("utf8");
+  lockHolder.stderr!.on("data", (chunk: string) => {
+    lockStderr += chunk;
+  });
+  let sawLocked = false;
+  const lockReady = new Promise<void>((resolve, reject) => {
+    lockHolder.once("error", reject);
+    lockHolder.once("close", (code) => {
+      if (!sawLocked) reject(new Error(`lock-holder exited with ${code} before signalling readiness: ${lockStderr.trim()}`));
+    });
+    observeLines(lockHolder.stdout!, (line) => {
+      if (line === "locked") {
+        sawLocked = true;
+        resolve();
+      }
+    });
+  });
+  // Teardown releases the lock and proves the child completed its awaited unlock before the
+  // post-release mutation runs. A wedged child still gets bounded TERM/KILL cleanup.
+  const childClosed = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
+    lockHolder.once("close", (code, signal) => resolve({ code, signal })),
+  );
+  let readyTimer: NodeJS.Timeout | undefined;
+  try {
+    await Promise.race([
+      lockReady,
+      new Promise<never>((_, reject) => {
+        // Boot budget, not a semantics guard: the child is a fresh `node --import tsx/esm`
+        // process that compiles the TS module graph before it can signal. Under the full
+        // tier's --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s,
+        // so give it real headroom -- a genuine lock bug shows up as a wrong outcome below,
+        // never as a slow boot.
+        readyTimer = setTimeout(() => reject(new Error("lock-holder did not signal readiness within 60s")), 60_000);
+      }),
+    ]);
+    assert.throws(() => helpers.markSubscriptionAttempt("openai-codex", "work", 123), /ELOCKED|already being held/i);
+  } finally {
+    if (readyTimer) clearTimeout(readyTimer);
+    try {
+      lockHolder.stdin!.write("release\n");
+      lockHolder.stdin!.end();
+    } catch {
+      /* child already gone */
+    }
+    // Wait for clean exit first: code 0 proves the async unlock completed. A wedged child gets
+    // bounded SIGTERM/SIGKILL cleanup, and its test-owned lock is removed only on that fallback.
+    const closedWithin = (ms: number) =>
+      Promise.race([
+        childClosed,
+        new Promise<null>((resolve) => setTimeout(() => resolve(null), ms)),
+      ]);
+    let closed = await closedWithin(2000);
+    let forced = false;
+    if (!closed || closed.code !== 0) {
+      forced = true;
+      lockHolder.kill("SIGTERM");
+      closed = await closedWithin(2000);
+      if (!closed) {
+        lockHolder.kill("SIGKILL");
+        closed = await closedWithin(2000);
+      }
+      if (!closed) throw new Error("lock-holder child did not exit after SIGKILL");
+    }
+    if (forced) {
+      rmSync(`${poolFile}.lock`, { recursive: true, force: true });
+      throw new Error(`lock-holder exited without clean unlock (code=${closed.code}, signal=${closed.signal})`);
+    }
+  }
+
+  const pool = helpers.markSubscriptionAttempt("openai-codex", "work", 456);
+  assert.equal(pool[0].lastAttemptAt, 456);
+});
+
+// Codex captures the login `accountId` and rejects the same account re-added under a different
+// label (a sticky browser session otherwise fakes redundancy on one quota); a distinct account
+// is stored with its own accountId.
+test("rejects a duplicate Codex account under a new label and stores accountId for a distinct one", async () => {
+  resetRotationState();
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  let nextAccountId = "acct-1";
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: nextAccountId }));
+
+  try {
+    await providerRotationExtension(pi);
+
+    await commands["provider-sub"].handler("openai-codex add codex-alt", ctx);
+    let pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
+    assert.equal(pool[0].accountId, "acct-1");
+
+    // Same account, different label -> rejected, pool unchanged.
+    notes.length = 0;
+    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
+    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "duplicate account is rejected with an error");
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
+
+    // Distinct account -> stored with its own accountId.
+    nextAccountId = "acct-2";
+    await commands["provider-sub"].handler("openai-codex add codex-other", ctx);
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label).sort(), ["codex-alt", "codex-other"]);
+    assert.equal(pool.find((e) => e.label === "codex-other")?.accountId, "acct-2");
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// Review finding 1: the DEFAULT Codex slot must carry its account identity too, so the account
+// already backing the default login cannot be re-added under a second label, and list shows it.
+test("the default Codex slot carries its account identity: blocks re-adding the same account and renders it in list", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-def", access: "a-def", expires: Date.now() + 60_000, accountId: "acct-default" } })}\n`,
+    "utf8",
+  );
+
+  // Reading the pool seeds a metadata-only default entry that carries the account identity --
+  // no token value copied into the pool.
+  let pool = helpers.readSubscriptionPool("openai-codex");
+  assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
+  assert.equal(pool[0].accountId, "acct-default");
+  assert.equal(pool[0].refresh, undefined);
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  // A sticky browser re-login yields the SAME ChatGPT account already backing the default slot.
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "acct-default" }));
+  try {
+    await providerRotationExtension(pi);
+
+    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
+    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "re-adding the default account under a new label is rejected");
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
+
+    notes.length = 0;
+    await commands["provider-sub"].handler("openai-codex list", ctx);
+    assert.match(notes.map((n) => n.message).join("\n"), /account=/);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// Drive the REAL default-login handler path: a collision with an explicit account must reject
+// before commitDefaultIdentity writes auth.json, so the failed OAuth result never partially
+// switches the default credential or creates a default pool entry with the duplicate identity.
+test("default-login handler rejects a colliding Codex account before switching auth.json", async () => {
+  resetRotationState();
+  helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-X" }));
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r-X", access: "a-X", expires: Date.now() + 60_000, accountId: "acct-X" }));
+  try {
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("openai-codex add openai-codex", ctx);
+    assert.ok(notes.some((note) => note.type === "error" && /already added/i.test(note.message)));
+    assert.equal(JSON.parse(readFileSync(authPath, "utf8"))["openai-codex"], undefined, "rejected default login must not switch auth.json");
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-X").length, 1);
+    assert.equal(pool.some((entry) => entry.label === "openai-codex"), false);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The handler snapshots the default slot before OAuth. A 429 recorded while OAuth is open is
+// causally newer, so completing a same-account login must not reopen that quota.
+test("default-login handler preserves a newer same-account cooldown recorded during OAuth", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: Date.now() + 60_000, accountId: "acct-default" } })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("openai-codex");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.ui.notify = () => {};
+  ctx.ui.input = async () => "";
+  let rateLimitedAt = 0;
+  rotationModule.__setLoginForProviderForTest(async () => {
+    rateLimitedAt = Date.now();
+    helpers.markSubscriptionRateLimited("openai-codex", "openai-codex", 60_000, rateLimitedAt, rateLimitedAt);
+    return { refresh: "r-new", access: "a-new", expires: Date.now() + 60_000, accountId: "acct-default" };
+  });
+  try {
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("openai-codex add openai-codex", ctx);
+    const [entry] = helpers.readSubscriptionPool("openai-codex");
+    assert.equal(entry.accountId, "acct-default");
+    assert.equal(entry.lastRateLimitedAt, rateLimitedAt);
+    assert.equal(entry.rateLimitedUntil, rateLimitedAt + 60_000);
+    assert.equal(JSON.parse(readFileSync(authPath, "utf8"))["openai-codex"].access, "a-new");
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// auth.json is the default slot's identity source of truth: every read reconciles the existing
+// metadata entry rather than only seeding it once. The pool never receives its token fields.
+test("the default slot re-syncs its identity from auth.json on every pool read", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: Date.now() + 60_000, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  let [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.accountId, "acct-old");
+  assert.equal(entry.refresh, undefined);
+  assert.equal(entry.access, undefined);
+  assert.equal(entry.expires, undefined);
+
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-new", access: "a-new", expires: Date.now() + 60_000, accountId: "acct-new" } })}\n`,
+    "utf8",
+  );
+  [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.accountId, "acct-new");
+  assert.equal(entry.refresh, undefined);
+  assert.equal(entry.access, undefined);
+  assert.equal(entry.expires, undefined);
+});
+
+// An auth writer outside provider rotation can change the default identity without the pool
+// lock. Reconciliation validates under that lock and refuses to return or persist two slots for
+// one account; removing the explicit duplicate remains a valid repair operation.
+test("auth-driven default reconciliation refuses a colliding explicit identity", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: 100, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("openai-codex");
+  helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-new" }));
+
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-new", access: "a-new", expires: 200, accountId: "acct-new" } })}\n`,
+    "utf8",
+  );
+  assert.throws(
+    () => helpers.readSubscriptionPool("openai-codex"),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  const rawAfterRejection = JSON.parse(readFileSync(poolPath, "utf8"));
+  assert.equal(rawAfterRejection.find((entry: { label: string }) => entry.label === "openai-codex").accountId, "acct-old");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.ui.notify = () => {};
+  await providerRotationExtension(pi);
+  await commands["provider-sub"].handler("openai-codex rm work", ctx);
+  assert.deepEqual(
+    helpers.readSubscriptionPool("openai-codex").map((entry) => ({ label: entry.label, accountId: entry.accountId })),
+    [{ label: "openai-codex", accountId: "acct-new" }],
+  );
+});
+
+// Explicit reauth uses the identity-checked upsert: it can refresh its OWN stored identity, but
+// cannot reauth into an account held by another slot.
+test("the uniqueness-aware reauth upsert refreshes its slot but rejects another slot's account", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("openai-codex", [credential("work", { accountId: "acct-old", rateLimitedUntil: 900, lastAttemptAt: 100, lastRateLimitedAt: 50 }), credential("other", { accountId: "acct-held" })]);
+  helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-new", refresh: "r-new", access: "a-new" }));
+  let pool = helpers.readSubscriptionPool("openai-codex");
+  const refreshed = pool.find((entry) => entry.label === "work");
+  assert.equal(refreshed?.accountId, "acct-new");
+  assert.equal(refreshed?.rateLimitedUntil, 900);
+  assert.equal(refreshed?.lastAttemptAt, 100);
+  assert.equal(refreshed?.lastRateLimitedAt, 50);
+  assert.throws(
+    () => helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-held", refresh: "r-collision", access: "a-collision" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  pool = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(pool.find((entry) => entry.label === "work")?.accountId, "acct-new");
+  assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+});
+
+// A rejected default identity move must leave BOTH stores untouched: account uniqueness happens
+// inside the pool lock before commitDefaultIdentity writes auth.json under the nested auth lock.
+test("commitDefaultIdentity rejects an explicit account without partially switching auth.json or the pool", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: 100, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  helpers.writeSubscriptionPool("openai-codex", [
+    { label: "openai-codex", accountId: "acct-old", rateLimitedUntil: 0, lastAttemptAt: 10, lastRateLimitedAt: 0 },
+    credential("work", { accountId: "acct-new" }),
+  ]);
+  const authBefore = readFileSync(authPath, "utf8");
+  const poolBefore = helpers.readSubscriptionPool("openai-codex");
+  assert.throws(
+    () =>
+      helpers.commitDefaultIdentity("openai-codex", {
+        refresh: "r-new",
+        access: "a-new",
+        expires: 200,
+        accountId: "acct-new",
+        lastRateLimitedAt: 0,
+      }),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  assert.equal(readFileSync(authPath, "utf8"), authBefore);
+  assert.deepEqual(helpers.readSubscriptionPool("openai-codex"), poolBefore);
+});
+
+// A same-account login uses its pre-OAuth rate-limit timestamp as a causal basis. A newer 429
+// survives, an equal-basis login may clear it, and a genuine account switch starts new quota clean.
+test("commitDefaultIdentity preserves newer same-account cooldowns and resets old-account cooldowns", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: 100, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("openai-codex");
+  helpers.markSubscriptionRateLimited("openai-codex", "openai-codex", 60_000, 100, 100);
+
+  helpers.commitDefaultIdentity("openai-codex", {
+    refresh: "r-stale",
+    access: "a-stale",
+    expires: 200,
+    accountId: "acct-old",
+    lastRateLimitedAt: 0,
+  });
+  let [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.lastRateLimitedAt, 100);
+  assert.equal(entry.rateLimitedUntil, 60_100, "a newer same-account 429 survives the stale login");
+
+  helpers.commitDefaultIdentity("openai-codex", {
+    refresh: "r-current",
+    access: "a-current",
+    expires: 300,
+    accountId: "acct-old",
+    lastRateLimitedAt: 100,
+  });
+  [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.rateLimitedUntil, 0, "an equal-basis same-account login may clear the cooldown");
+
+  helpers.markSubscriptionRateLimited("openai-codex", "openai-codex", 60_000, 200, 200);
+  helpers.commitDefaultIdentity("openai-codex", {
+    refresh: "r-other",
+    access: "a-other",
+    expires: 400,
+    accountId: "acct-other",
+    lastRateLimitedAt: 100,
+  });
+  [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.accountId, "acct-other");
+  assert.equal(entry.lastRateLimitedAt, 200);
+  assert.equal(entry.rateLimitedUntil, 0, "a different account does not inherit the old account's quota cooldown");
+});
+
+// Label AND account uniqueness are enforced INSIDE the locked add transform
+// (throwing a typed error), so the check-then-append is atomic rather than a lock-free race.
+test("addSubscription normalizes labels and enforces Codex account uniqueness inside the locked transform", () => {
+  resetRotationState();
+  helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-1" }));
+  assert.throws(
+    () => helpers.addSubscription("openai-codex", credential(" work ", { accountId: "acct-2" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already exists/i.test((err as Error).message),
+  );
+  assert.throws(
+    () => helpers.addSubscription("openai-codex", credential("   ", { accountId: "acct-3" })),
+    (err: unknown) => !(err instanceof helpers.DuplicateSubscriptionError) && /cannot be empty/i.test((err as Error).message),
+  );
+  assert.throws(
+    () => helpers.addSubscription("openai-codex", credential("work-2", { accountId: "acct-1" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  helpers.addSubscription("openai-codex", credential("work-3", { accountId: "acct-3" }));
+  assert.deepEqual(helpers.readSubscriptionPool("openai-codex").map((entry) => entry.label).sort(), ["work", "work-3"]);
+});
+
+// The first contender holds the real pool lock inside addSubscription's transform. The second
+// contender cannot reach its own transform until it has first attempted that same real lock.
+// This makes an outside-lock uniqueness check deterministic: both checks run while the pool is
+// empty, then both appends succeed after the holder releases.
+test("cross-process explicit adds admit exactly one duplicate Codex account", async () => {
+  resetRotationState();
+  const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+  const releasePath = join(home, "release-cross-process-add-race");
+  const holderInsidePath = join(home, "holder-inside-cross-process-add-race");
+  const subscriptionStateUrl = new URL("../../lib/subscription-state.ts", import.meta.url).href;
+  const spawnContender = (label: string, role: "holder" | "waiter") => {
+    const child = spawn(
+      process.execPath,
+      [
+        "--import",
+        "tsx/esm",
+        "--input-type=module",
+        "-e",
+        String.raw`import { existsSync, writeSync, writeFileSync } from "node:fs";
+import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
+const { addSubscription, DuplicateSubscriptionError } = await import(${JSON.stringify(subscriptionStateUrl)});
+const poolPath = ${JSON.stringify(poolPath)};
+const releasePath = ${JSON.stringify(releasePath)};
+const holderInsidePath = ${JSON.stringify(holderInsidePath)};
+const role = ${JSON.stringify(role)};
+// Yield the CPU while polling for a coordination file instead of a tight busy-spin. Two
+// contenders spinning at 100% CPU starve the parent's timeout observers on an
+// oversubscribed CI runner, which is one way this cross-process test flaked in CI while
+// passing locally. Atomics.wait blocks the thread for the poll interval without burning a
+// core -- the semantics (proceed the instant the file appears) are unchanged.
+const waitForFile = (path) => {
+  const idle = new Int32Array(new SharedArrayBuffer(4));
+  while (!existsSync(path)) Atomics.wait(idle, 0, 0, 5);
+};
+const originalWithLock = FileAuthStorageBackend.prototype.withLock;
+FileAuthStorageBackend.prototype.withLock = function (fn) {
+  if (this.authPath !== poolPath) return originalWithLock.call(this, fn);
+  writeSync(1, "attempt\n");
+  if (role === "waiter") {
+    // This is a real acquisition attempt against the holder's real lock. It happens after any
+    // hypothetical outside-lock validation but before the transform can run.
+    try {
+      originalWithLock.call(new FileAuthStorageBackend(poolPath), () => ({ result: undefined }));
+      throw new Error("waiter acquired the pool lock while the holder was still inside it");
+    } catch (error) {
+      if ((error).code !== "ELOCKED") throw error;
+    }
+    writeSync(1, "acquiring\n");
+    waitForFile(releasePath);
+  }
+  return originalWithLock.call(this, (current) => {
+    if (role === "holder") {
+      writeSync(1, "inside\n");
+      writeFileSync(holderInsidePath, "inside\n");
+      waitForFile(releasePath);
+    }
+    return fn(current);
+  });
+};
+// The holder's wait-for-release runs inside a SYNC withLock hold, which blocks its event
+// loop -- so the lock library's stale-refresh timer cannot fire and the lock's mtime ages.
+// If that sync hold spans this waiter's multi-second tsx boot on a slow CI runner, the
+// lock crosses the stale threshold and the waiter's probe STEALS it instead of hitting
+// ELOCKED (the exact full-tier CI failure). Both contenders therefore boot in parallel,
+// and the waiter gates HERE -- after its own boot, before touching the pool -- on the
+// holder being inside the lock, keeping the holder's sync hold to the sub-second
+// coordination tail, far under the stale window.
+if (role === "waiter") waitForFile(holderInsidePath);
+try {
+  addSubscription("openai-codex", {
+    label: ${JSON.stringify(label)}, refresh: "refresh-${label}", access: "access-${label}", expires: Date.now() + 60_000,
+    accountId: "acct-cross-process-race", rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0,
+  });
+  writeSync(1, "outcome:success\n");
+} catch (error) {
+  const outcome = error instanceof DuplicateSubscriptionError ? "duplicate" : "error";
+  writeSync(1, "outcome:" + outcome + "\n");
+  if (outcome === "error") process.stderr.write(String(error));
+}`,
+      ],
+      { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+    );
+    const signals = new Set<string>();
+    let outcome: string | undefined;
+    let stderr = "";
+    let stdout = "";
+    child.stdout!.on("data", (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr!.setEncoding("utf8");
+    child.stderr!.on("data", (chunk: string) => {
+      stderr += chunk;
+    });
+    const signal = (expected: string) =>
+      new Promise<void>((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (code) => {
+          if (!signals.has(expected)) reject(new Error(`${label} exited with ${code} before ${expected}: ${stderr.trim()}`));
+        });
+        observeLines(child.stdout!, (line) => {
+          signals.add(line);
+          if (line === expected) resolve();
+          if (line.startsWith("outcome:")) outcome = line.slice("outcome:".length);
+        });
+      });
+    const closed = new Promise<number | null>((resolve) => child.once("close", resolve));
+    const stdoutEnded = new Promise<void>((resolve) => child.stdout!.once("end", resolve));
+    return { child, closed, label, outcome: () => outcome, signal, stderr: () => stderr, stdout: () => stdout, stdoutEnded };
+  };
+
+  // Spawn both contenders up front so their expensive tsx boots overlap and neither boot
+  // happens while the holder is sitting inside its sync lock hold (see the child comment on
+  // lock staleness). The waiter self-gates on holderInsidePath, so the probe ordering --
+  // waiter attempts the lock only while the holder is inside it -- is unchanged.
+  const holder = spawnContender("race-left", "holder");
+  const waiter = spawnContender("race-right", "waiter");
+  const contenders = [holder, waiter];
+  try {
+    // Boot budgets, not semantics guards: each contender is a fresh `node --import tsx/esm`
+    // process that compiles the TS module graph before it can signal. Under the full tier's
+    // --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s, so give the
+    // coordination phases real headroom -- a genuine lock bug shows up as a wrong outcome in
+    // the assertions below, never as a slow boot.
+    await within(Promise.all([holder.signal("attempt"), holder.signal("inside")]), 60_000, "holder did not reach the locked transform within 60s");
+    await within(Promise.all([waiter.signal("attempt"), waiter.signal("acquiring")]), 60_000, "waiter did not attempt the held pool lock within 60s");
+    writeFileSync(releasePath, "release\n", "utf8");
+    const exitCodes = await within(Promise.all(contenders.map((contender) => contender.closed)), 30_000, "cross-process contenders did not exit within 30s");
+    await within(Promise.all(contenders.map((contender) => contender.stdoutEnded)), 15_000, "cross-process contender output did not close within 15s");
+    assert.deepEqual(exitCodes, [0, 0], contenders.map((contender) => contender.stderr()).join("\n"));
+    assert.deepEqual(contenders.map((contender) => contender.outcome()).sort(), ["duplicate", "success"], contenders.map((contender) => contender.stdout()).join("\n"));
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    assert.equal(pool.length, 1);
+    assert.ok(["race-left", "race-right"].includes(pool[0].label));
+  } finally {
+    const errors: unknown[] = [];
+    try {
+      // Unblock a waiter still gated on the holder-inside file as well as anyone waiting on
+      // release, so an early assertion failure cannot leave a child polling forever.
+      writeFileSync(holderInsidePath, "inside\n", "utf8");
+      writeFileSync(releasePath, "release\n", "utf8");
+    } catch (error) {
+      errors.push(error);
+    }
+    const teardown = async (contender: ReturnType<typeof spawnContender>) => {
+      if (contender.child.exitCode !== null || contender.child.signalCode !== null) return;
+      try {
+        contender.child.stdin!.end();
+      } catch {
+        // The child may already have closed its input.
+      }
+      if (await within(contender.closed.then(() => true), 1000, `${contender.label} did not exit gracefully within 1s`).catch(() => false)) return;
+      contender.child.kill("SIGTERM");
+      if (await within(contender.closed.then(() => true), 1000, `${contender.label} did not exit after SIGTERM`).catch(() => false)) return;
+      contender.child.kill("SIGKILL");
+      await within(contender.closed, 1000, `${contender.label} did not exit after SIGKILL`);
+    };
+    const results = await Promise.allSettled(contenders.map(teardown));
+    errors.push(...results.flatMap((result) => (result.status === "rejected" ? [result.reason] : [])));
+    try {
+      assert.equal(existsSync(`${poolPath}.lock`), false, "cross-process add race must release the pool lock directory");
+    } catch (error) {
+      errors.push(error);
+    }
+    if (errors.length) throw new AggregateError(errors, "cross-process contender teardown failed");
+  }
+});
+
+// Corruption can arrive after commitDefaultIdentity projects auth.json for its pool-lock
+// callback but before it obtains the nested auth lock to persist. That persistence parse must
+// fail loudly and leave both stores precisely as they were at the corruption point.
+test("malformed auth during nested default persistence preserves malformed bytes and the pool cooldown", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "r-old", access: "a-old", expires: 100, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("openai-codex");
+  helpers.markSubscriptionRateLimited("openai-codex", "openai-codex", 60_000, 500, 500);
+  const poolBefore = readFileSync(poolPath, "utf8");
+  const malformed = '{"openai-codex":';
+  const originalWithLock = FileAuthStorageBackend.prototype.withLock;
+  let authLockCalls = 0;
+  FileAuthStorageBackend.prototype.withLock = function (fn) {
+    const isAuthLock = (this as unknown as { authPath: string }).authPath === authPath;
+    if (isAuthLock) authLockCalls += 1;
+    const result = originalWithLock.call(this, fn);
+    if (isAuthLock && authLockCalls === 1) writeFileSync(authPath, malformed, "utf8");
+    return result;
+  };
+  try {
+    assert.throws(
+      () =>
+        helpers.commitDefaultIdentity("openai-codex", {
+          refresh: "r-new",
+          access: "a-new",
+          expires: 200,
+          accountId: "acct-old",
+          lastRateLimitedAt: 500,
+        }),
+      SyntaxError,
+    );
+  } finally {
+    FileAuthStorageBackend.prototype.withLock = originalWithLock;
+  }
+  assert.equal(authLockCalls, 2, "the second auth lock is the nested persistence parse");
+  assert.equal(readFileSync(authPath, "utf8"), malformed);
+  assert.equal(readFileSync(poolPath, "utf8"), poolBefore);
+  const [entry] = JSON.parse(poolBefore) as helpers.SubscriptionCredential[];
+  assert.deepEqual(
+    { lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil },
+    { lastRateLimitedAt: 500, rateLimitedUntil: 60_500 },
+  );
+});
+
+test("renames explicit subscriptions without permitting default-slot or case-insensitive collisions", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("openai-codex", [credential("openai-codex"), credential("work"), credential("personal")]);
+  assert.deepEqual(helpers.renameSubscription("openai-codex", "work", "Lab").map((entry) => entry.label), ["openai-codex", "Lab", "personal"]);
+  assert.throws(() => helpers.renameSubscription("openai-codex", "Lab", " PERSONAL "), helpers.DuplicateSubscriptionError);
+  assert.throws(() => helpers.renameSubscription("openai-codex", "openai-codex", "anything"), /Default account/);
+});
+
 test("treats numeric subscription refs as 1-based indexes", () => {
   resetRotationState();
   const pool = [credential("alpha"), credential("beta")];
@@ -1344,6 +2176,106 @@ test("automatically reauthenticates invalid refresh tokens when UI is available"
   }
 });
 
+// The real invalid-refresh path must route an explicit Codex reauth through the locked identity
+// gate. A colliding OAuth result is rejected, the old credential remains intact, and the slot is
+// cooled instead of being duplicated or streamed with another slot's quota.
+test("real explicit Codex reauth rejects an account held by another slot", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("openai-codex", [
+    credential("stale", { expires: 1, accountId: "acct-old" }),
+    credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }),
+  ]);
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "openai-codex") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async () => ({
+    refresh: "r-collision",
+    access: "a-collision",
+    expires: Date.now() + 60_000,
+    accountId: "acct-held",
+  }));
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+    for await (const _event of stream) {
+      // Drain the real managed-provider stream to completion.
+    }
+
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    const stale = pool.find((entry) => entry.label === "stale");
+    assert.equal(stale?.accountId, "acct-old");
+    assert.equal(stale?.refresh, "refresh-stale");
+    assert.ok((stale?.rateLimitedUntil ?? 0) > Date.now() + 29 * 24 * 60 * 60 * 1000);
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The default Codex reauth branch uses the same gate before auth persistence. A colliding login
+// leaves auth.json on the original account and keeps both pool identities unique.
+test("real default Codex reauth rejects an explicit slot's account before switching auth.json", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ "openai-codex": { type: "oauth", refresh: "dead-refresh", access: "stale-access", expires: 1, accountId: "acct-old" } })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("openai-codex");
+  helpers.addSubscription("openai-codex", credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }));
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "openai-codex") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async () => ({
+    refresh: "r-collision",
+    access: "a-collision",
+    expires: Date.now() + 60_000,
+    accountId: "acct-held",
+  }));
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+    for await (const _event of stream) {
+      // Drain the real managed-provider stream to completion.
+    }
+
+    const auth = JSON.parse(readFileSync(authPath, "utf8"))["openai-codex"];
+    assert.equal(auth.accountId, "acct-old");
+    assert.equal(auth.refresh, "dead-refresh");
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    assert.equal(pool.find((entry) => entry.label === "openai-codex")?.accountId, "acct-old");
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
 // A resolved-but-unauthenticated fallback stays on the current model and returns an
 // actionable "not authenticated" error when no provider is logged in.
 test("emits an actionable 'not authenticated' error without switching models when neither provider has ever logged in", async () => {
@@ -1515,6 +2447,97 @@ test("does not wait out a cooldown longer than the sole-provider wait cap; surfa
   }
 });
 
+// Live-incident regression (Hearth: a home's config.json had `gpt-5.6-*` ladder rungs baked
+// in while the installed guest's model registry only had `gpt-5.5`): when the ONLY viable
+// fallback target is authenticated (its pool has a credential) but its resolved model isn't
+// in this build's registry, the terminal error must name that specific reason -- not the old
+// generic "authenticate a fallback provider" text, which is actively wrong when the real
+// blocker is a stale/out-of-sync ladder, not a missing login.
+test("surfaces a specific 'not in model registry' reason instead of misleadingly telling the user to authenticate", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
+  // OpenAI Codex IS authenticated -- the fallback rejection must NOT be "no credentials".
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  // Registry recognizes anthropic's own model but NOT the configured openai-codex fallback
+  // rung (`gpt-5.6-sol`, from writeLadderConfig) -- simulating an installed guest whose
+  // catalog hasn't caught up with the configured ladder.
+  ctx.modelRegistry = {
+    find(provider: string, id: string) {
+      return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
+    },
+  };
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, []);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.match(emitted[0].error.errorMessage, /openai-codex\/gpt-5\.6-sol:high is not in this build's model registry/);
+    assert.match(emitted[0].error.errorMessage, /modelLadders config is out of sync with the installed model catalog/);
+    assert.doesNotMatch(emitted[0].error.errorMessage, /authenticate a fallback provider/);
+    // The repair command must be EXECUTABLE as printed: `--value`, the CONFIG ladder
+    // provider key (`openai`, not the runtime `openai-codex`), and the target's strength.
+    assert.match(
+      emitted[0].error.errorMessage,
+      /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/,
+    );
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Every fallback-rejection discriminant maps to advice that can actually resolve IT.
+// Only `no_credentials` may say "authenticate" -- telling the user to authenticate when both
+// providers are exhausted, when no ladder rung exists, or when the model is unregistered is
+// actively wrong and was the original bug.
+test("fallback rejection hints: only no_credentials advises authentication; every other discriminant gets accurate advice", () => {
+  const codex = {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-sol",
+    label: "openai-codex/gpt-5.6-sol:high",
+    strength: "strong",
+  } as helpers.FallbackTarget;
+
+  const noCreds = rotationModule.__fallbackRejectionHintForTest("no_credentials", codex);
+  assert.match(noCreds, /authenticate a fallback provider/);
+  assert.match(noCreds, /OpenAI Codex/);
+  assert.match(noCreds, /\/provider-sub openai-codex add/);
+
+  const unregistered = rotationModule.__fallbackRejectionHintForTest("model_unregistered", codex);
+  assert.doesNotMatch(unregistered, /authenticate a fallback provider/);
+  assert.match(unregistered, /not in this build's model registry/);
+  // Executable repair command: --value, CONFIG ladder key (openai), target strength.
+  assert.match(unregistered, /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/);
+
+  const alreadyTried = rotationModule.__fallbackRejectionHintForTest("already_attempted", codex);
+  assert.doesNotMatch(alreadyTried, /authenticate a fallback provider/);
+  assert.match(alreadyTried, /already tried this turn/);
+  assert.match(alreadyTried, /try again later/);
+
+  const noLadder = rotationModule.__fallbackRejectionHintForTest("no_ladder_entry");
+  assert.doesNotMatch(noLadder, /authenticate a fallback provider/);
+  assert.match(noLadder, /no cross-provider fallback is configured/);
+  assert.match(noLadder, /modelLadders/);
+});
+
 // The wait-out decision uses the pool state from the current turn, not a stale snapshot.
 test("waits out a sole credential's cooldown observed in THIS turn, not a stale pre-attempt pool snapshot", async () => {
   resetRotationState();
@@ -1618,3 +2641,94 @@ test("treats a Codex usage-limit message on a non-429 status as a rate limit: co
     rotationModule.__setStreamForProviderForTest(undefined);
   }
 });
+
+// --- Provider-management removal routing + login coordination (final review findings #1, #2) ---
+
+function writeDefaultAuthRecord(providerId: "anthropic" | "openai-codex", extra: Record<string, unknown> = {}): void {
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ [providerId]: { type: "oauth", refresh: "r", access: "a", expires: Date.now() + 60_000, ...extra } }, null, 2)}\n`,
+    { encoding: "utf8", mode: 0o600 },
+  );
+}
+
+function readAuthRecord(providerId: string): unknown {
+  const raw = readFileSync(join(home, ".pi", "agent", "auth.json"), "utf8");
+  return (JSON.parse(raw) as Record<string, unknown>)[providerId];
+}
+
+// The exact guard finding #1 tripped: removing a managed provider from its HEADER row (no
+// label -- the default cursor position) MUST route through the coordinated service and clear
+// BOTH auth.json and the rotation pool. The old code fell through to a raw AuthStorage.logout(),
+// which cleared only auth.json and left the explicit account configured while the panel said
+// "Removed" -- so the surviving pool entry below is what catches the regression.
+test("removeProviderRow on a managed HEADER row clears auth.json AND the whole pool (finding #1)", () => {
+  resetRotationState();
+  writeDefaultAuthRecord("anthropic");
+  helpers.upsertSubscription("anthropic", credential("work"));
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "anthropic"), "default slot seeded from auth.json");
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "work"), "explicit account present");
+
+  const notice = providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    configured: true,
+    // no label -> the provider header row
+  });
+
+  assert.equal(notice, "Removed Claude");
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [], "pool fully torn down (would still hold 'work' under the old logout() bug)");
+  assert.equal(readAuthRecord("anthropic"), undefined, "auth.json default record cleared");
+});
+
+// An account ROW (has a label) removes just that account and leaves the rest of the pool intact.
+test("removeProviderRow on a managed account row removes only that account", () => {
+  resetRotationState();
+  writeDefaultAuthRecord("anthropic");
+  helpers.upsertSubscription("anthropic", credential("work"));
+
+  const notice = providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    label: "work",
+  });
+
+  assert.equal(notice, "Removed Claude account");
+  assert.deepEqual(
+    helpers.readSubscriptionPool("anthropic").map((e) => e.label),
+    ["anthropic"],
+    "only the default slot remains",
+  );
+  assert.ok(readAuthRecord("anthropic"), "auth.json default record untouched");
+});
+
+// /login coordination (finding #2): the default slot commits through commitDefaultIdentity, so
+// auth.json gets the oauth record AND the pool default slot reflects the identity as metadata only.
+test("commitManagedLogin default slot writes auth.json + metadata-only pool identity", () => {
+  resetRotationState();
+  helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "r1", access: "a1", expires: Date.now() + 60_000, accountId: "acct-1" });
+
+  const record = readAuthRecord("anthropic") as { type?: string; accountId?: string } | undefined;
+  assert.equal(record?.type, "oauth");
+  assert.equal(record?.accountId, "acct-1");
+
+  const slot = helpers.readSubscriptionPool("anthropic").find((e) => e.label === "anthropic");
+  assert.ok(slot, "default slot present");
+  assert.equal(slot?.accountId, "acct-1", "pool default slot carries the identity");
+  assert.equal(slot?.refresh, undefined, "pool default slot stays metadata-only (no token)");
+});
+
+// The account-uniqueness gate the raw authStorage.login() path skipped: a second slot for the
+// same account (same accountId) is rejected.
+test("commitManagedLogin enforces account uniqueness the raw login path skipped", () => {
+  resetRotationState();
+  helpers.commitManagedLogin("openai-codex", "openai-codex", { refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: "dup" });
+  assert.throws(
+    () => helpers.commitManagedLogin("openai-codex", "second", { refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "dup" }),
+    /already added/,
+  );
+});