@north-light/crouter 0.3.154

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/provider-rotation.test.ts

@@ -0,0 +1,2632 @@
+import { before, after, test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { LockedJsonFile } from "../../../../core/locked-file.ts";
+import type { FallbackTarget, SubscriptionCredential } from "../../lib/subscription-state.ts";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+
+// Child processes reach crouter's locked-file primitive by absolute URL: they run under
+// tsx with `--input-type=module`, so a bare relative specifier has no base to resolve from.
+const lockedFileUrl = new URL("../../../../core/locked-file.ts", import.meta.url).href;
+
+let home: string;
+let helpers: typeof import("../../lib/subscription-state.ts");
+let providerManagement: typeof import("../../../../core/provider-management.ts");
+let rotationModule: typeof import("../provider-rotation.ts");
+let providerRotationExtension: typeof import("../provider-rotation.ts").default;
+const previousHome = process.env.HOME;
+const previousAgentDir = process.env.PI_CODING_AGENT_DIR;
+
+function writeLadderConfig() {
+  const configPath = join(home, ".crouter", "config.json");
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(
+    configPath,
+    `${JSON.stringify(
+      {
+        modelLadders: {
+          anthropic: {
+            ultra: "anthropic/claude-fable-5:high",
+            strong: "anthropic/claude-opus-4-8:high",
+            medium: "anthropic/claude-sonnet-4-6:high",
+            light: "anthropic/custom-light-x",
+          },
+          openai: {
+            ultra: "openai-codex/gpt-5.6-sol:max",
+            strong: "openai-codex/gpt-5.6-sol:high",
+            medium: "openai-codex/gpt-5.6-terra:medium",
+            light: "openai-codex/gpt-5.6-luna:low",
+          },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+}
+
+function credential(label: string, overrides: Partial<SubscriptionCredential> = {}): SubscriptionCredential {
+  return {
+    label,
+    refresh: `refresh-${label}`,
+    access: `access-${label}`,
+    expires: Date.now() + 60_000,
+    rateLimitedUntil: 0,
+    lastAttemptAt: 0,
+    lastRateLimitedAt: 0,
+    ...overrides,
+  };
+}
+
+async function resetRotationState() {
+  rmSync(join(home, ".pi", "agent", "auth.json"), { force: true });
+  await helpers.writeSubscriptionPool("anthropic", []);
+  await helpers.writeSubscriptionPool("openai-codex", []);
+  helpers.clearPreferredModel();
+}
+
+function observeLines(stream: NodeJS.ReadableStream, onLine: (line: string) => void): void {
+  let buffer = "";
+  stream.setEncoding("utf8");
+  stream.on("data", (chunk: string) => {
+    buffer += chunk;
+    let newlineIndex = buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      const line = buffer.slice(0, newlineIndex);
+      buffer = buffer.slice(newlineIndex + 1);
+      onLine(line);
+      newlineIndex = buffer.indexOf("\n");
+    }
+  });
+}
+
+function within<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error: unknown) => {
+        clearTimeout(timer);
+        reject(error);
+      },
+    );
+  });
+}
+
+before(async () => {
+  home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
+  process.env.HOME = home;
+  process.env.PI_CODING_AGENT_DIR = join(home, ".pi", "agent");
+  helpers = await import("../../lib/subscription-state.ts");
+  providerManagement = await import("../../../../core/provider-management.ts");
+  rotationModule = await import("../provider-rotation.ts");
+  providerRotationExtension = rotationModule.default;
+});
+
+after(() => {
+  if (previousHome === undefined) delete process.env.HOME;
+  else process.env.HOME = previousHome;
+  if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+  else process.env.PI_CODING_AGENT_DIR = previousAgentDir;
+  rmSync(home, { recursive: true, force: true });
+});
+
+test("normalizes provider subscription pool files", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [
+    {
+      label: " personal ",
+      refresh: " refresh-token ",
+      access: " access-token ",
+      expires: 123,
+      rateLimitedUntil: Number.NaN,
+      lastAttemptAt: Number.NaN,
+      lastRateLimitedAt: Number.NaN,
+    },
+  ]);
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [
+    {
+      label: "personal",
+      refresh: "refresh-token",
+      access: "access-token",
+      expires: 123,
+      rateLimitedUntil: 0,
+      lastAttemptAt: 0,
+      lastRateLimitedAt: 0,
+    },
+  ]);
+});
+
+// Concurrent refreshes of the same expired pool credential serialize read, token exchange,
+// and write under one lock. The injected refresh runs once; the second caller observes the
+// winner's fresh token and does not make a second single-use refresh request.
+test("brick-repro: concurrent refreshes of the same expired pool token serialize through the lock (exactly one network refresh)", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "shared-refresh", access: "access-stale", expires: 1 })]);
+  const poolEntry = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(poolEntry.label, "anthropic");
+
+  let refreshCalls = 0;
+  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken) => {
+    refreshCalls += 1;
+    if (refreshCalls === 1) {
+      return { refresh: "shared-refresh-rotated", access: "access-fresh", expires: Date.now() + 60_000 };
+    }
+    // Any refresh call after the first is simulating "this refresh token was already
+    // consumed by the winner" -- a genuine invalid_grant from the provider.
+    throw Object.assign(new Error(`HTTP request failed. status=400; body={"error":"invalid_grant"} for token ${refreshToken}`), { status: 400 });
+  });
+
+  try {
+    const [a, b] = await Promise.all([
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+    ]);
+
+    assert.equal(refreshCalls, 1);
+    assert.equal(a.access, "access-fresh");
+    assert.equal(b.access, "access-fresh");
+
+    // The rotated value landed on the account it came from -- the pool is the only store now.
+    const [stored] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(stored.label, "anthropic");
+    assert.equal(stored.access, "access-fresh");
+    assert.equal(stored.refresh, "shared-refresh-rotated");
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+  }
+});
+
+test("a fresh default credential bypasses the cross-process refresh lock", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [
+    credential("openai-codex", { refresh: "refresh-codex", access: "access-codex-fresh", expires: Date.now() + 60_000 }),
+  ]);
+  const poolEntry = helpers.readSubscriptionPool("openai-codex")[0];
+  const originalWithLockAsync = LockedJsonFile.prototype.withLockAsync;
+  LockedJsonFile.prototype.withLockAsync = async () => {
+    throw new Error("fresh credential unexpectedly joined the auth refresh lock");
+  };
+
+  try {
+    const resolved = await rotationModule.__refreshCredentialIfNeededForTest("openai-codex", poolEntry);
+    assert.equal(resolved.access, "access-codex-fresh");
+  } finally {
+    LockedJsonFile.prototype.withLockAsync = originalWithLockAsync;
+  }
+});
+
+test("subscription bookkeeping retries lock collisions and then degrades without failing the provider turn", async () => {
+  const waits: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => { waits.push(ms); });
+  try {
+    let eventualCalls = 0;
+    const eventual = await rotationModule.__recordSubscriptionMutationForTest("testing eventual acquisition", async () => {
+      eventualCalls++;
+      if (eventualCalls < 4) throw Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED" });
+    });
+    assert.equal(eventual, true);
+    assert.equal(eventualCalls, 4);
+    assert.deepEqual(waits, [25, 75, 150]);
+
+    waits.length = 0;
+    let exhaustedCalls = 0;
+    const exhausted = await rotationModule.__recordSubscriptionMutationForTest("testing exhaustion", async () => {
+      exhaustedCalls++;
+      throw Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED" });
+    });
+    assert.equal(exhausted, false);
+    assert.equal(exhaustedCalls, 4);
+    assert.deepEqual(waits, [25, 75, 150]);
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// A GENUINE invalid_grant (the refresh token is actually dead, not merely raced) must
+// still reach the real cooldown -> reauth path through the new lock-delegated seam --
+// the fix must not accidentally swallow or misclassify a real failure. Drives it through
+// the actual provider stream (not the raw helper) so `isInvalidRefreshTokenError` +
+// reauthentication + the credential-store persist all fire for real.
+test("a genuine invalid_grant through the pool account's lock still reauthenticates and persists to the pool", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "dead-refresh", access: "access-stale", expires: 1 })]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  ctx.ui.notify = () => {};
+  const loginCalls: string[] = [];
+  // Plain Error, no typed .status: real pi-ai refresh failures carry the HTTP status
+  // in the message text, so the refresh path still recognizes an invalid_grant from this
+  // shape.
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async (providerId) => {
+    loginCalls.push(providerId);
+    return { refresh: "refresh-reauthed", access: "access-reauthed", expires: Date.now() + 60_000 };
+  });
+  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
+    return (async function* () {
+      yield { type: "text_delta", text: `hello with ${options?.apiKey}` };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple({ provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" }, ctx);
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(loginCalls, ["anthropic"]);
+    assert.deepEqual(setModelCalls, []);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+
+    // Reauth persisted onto the pool account's own pool entry -- the single owner -- with the
+    // cooldown the failed refresh recorded cleared again.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.equal(entry.refresh, "refresh-reauthed");
+    assert.equal(entry.access, "access-reauthed");
+    assert.equal(entry.rateLimitedUntil, 0);
+    assert.equal(entry.authFailure, undefined);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// A genuine invalid_grant through the pool account's lock seam cools the credential down
+// and falls back cross-provider when UI is unavailable: an expired default pool entry, an
+// authenticated Codex fallback, and the real streamSimple path all participate.
+test("a genuine invalid_grant through the pool account's lock with no UI reaches cooldown and falls back cross-provider", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "dead-refresh", access: "access-stale", expires: 1 })]);
+  // Authenticated Codex fallback already sitting in its own pool.
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  // ctx.hasUI is deliberately left falsy: reauth must be impossible, so the only path
+  // forward is cooldown + cross-provider fallback.
+  const streamedModels: any[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      // Plain Error, no typed .status: the refresh path reads the invalid_grant shape from
+      // the message text, matching production failures.
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from codex fallback" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Fell back cross-provider and actually served the turn on Codex.
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "openai-codex");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+
+    // The pool account's entry got the ~30-day invalid-refresh exclusion, tagged with its auth
+    // cause through the real locked-refresh seam -- not a bypass.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.ok(entry.rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
+    assert.equal(entry.authFailure, "invalid_grant");
+
+    // No UI -- no reauth happened; the dead credential is still stored unchanged.
+    assert.equal(entry.refresh, "dead-refresh");
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("/provider-sub add still adds an explicit additional subscription alongside the pool account", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "refresh-first", access: "access-first" })]);
+
+  await helpers.upsertSubscription("anthropic", credential("work", { refresh: "refresh-work", access: "access-work" }));
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic").map((entry) => entry.label), ["anthropic", "work"]);
+});
+
+// /provider-sub <provider> add accepts the default label as the login-backed slot: the
+// registered command handler must store that login on the default pool entry rather than
+// discard it, because the pool is the only credential store a managed provider has.
+test("/provider-sub add with the default label persists the login credential to the default pool entry", async () => {
+  await resetRotationState();
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.ui.notify = () => {};
+  ctx.ui.input = async () => "personal";
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "refresh-login", access: "access-login", expires: Date.now() + 60_000 }));
+
+  try {
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("anthropic add", ctx);
+
+    // The default pool entry carries the login's value with the cooldown cleared -- not a
+    // broken "authenticated but valueless" slot.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "personal");
+    assert.equal(entry.refresh, "refresh-login");
+    assert.equal(entry.access, "access-login");
+    assert.equal(entry.rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The retained agent command must use the same coordinated removal as the Providers panel: the
+// pool account leaves the pool exactly like any explicit account.
+test("/provider-sub rm removes the pool account", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic")]);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0]?.label, "anthropic");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.ui.notify = () => {};
+  await providerRotationExtension(pi);
+  await commands["provider-sub"].handler("anthropic rm anthropic", ctx);
+
+  assert.equal(helpers.readSubscriptionPool("anthropic").some((entry) => entry.label === "anthropic"), false);
+});
+
+// The manual-code-paste dialog races pi-ai's loopback callback server. These tests exercise
+// the wrapper directly with a run function that can leave manual input pending. Aborting the
+// dialog signal removes its broker entry and emits a request-scoped dismissal frame, so the
+// assertions verify the signal rather than an unrelated notification.
+
+test("loginWithManualInputCleanup aborts the still-open manual dialog's signal once the OAuth call settles without it (loopback-wins parity)", async () => {
+  let capturedSignal: AbortSignal | undefined;
+  const notifications: Array<{ message: string; type?: string }> = [];
+  const ctx = {
+    ui: {
+      notify: (message: string, type?: string) => notifications.push({ message, type }),
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) => {
+        capturedSignal = opts?.signal;
+        // Never resolves on its own -- mirrors pi-ai abandoning the manual-input
+        // promise once the loopback callback server wins the race.
+        return new Promise<string | undefined>(() => {});
+      },
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any) => {
+    // Start the manual-code prompt (as onManualCodeInput would) but -- like the real
+    // pi-ai race -- never await its outcome; the loopback callback "wins" instead.
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    return "loopback-code";
+  });
+
+  assert.equal(result, "loopback-code");
+  assert.equal(capturedSignal?.aborted, true, "the abandoned manual-input dialog's signal must be aborted once the OAuth call settles -- the broker turns that abort into a correlated extension_ui_dismiss");
+  assert.equal(notifications.length, 0, "no broad dismiss notify -- an unrelated notify must never be used as a dialog-dismissal signal");
+});
+
+test("loginWithManualInputCleanup dismisses the manual dialog at callback-win (onProgress), NOT after a delayed token exchange", async () => {
+  // Once the loopback callback supplies a code, progress starts token exchange. The manual
+  // dialog is aborted at that boundary, before the exchange resolves, so a slow exchange does
+  // not leave its overlay open.
+  let order = 0;
+  let abortedAt: number | undefined;
+  let runResolvedAt: number | undefined;
+  const ctx = {
+    ui: {
+      notify: () => {},
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) =>
+        // Mirror the broker: resolve to undefined on abort (which readCode turns
+        // into a throw, inert on the abandoned promise like pi-ai's own .catch).
+        new Promise<string | undefined>((resolve) => {
+          opts?.signal?.addEventListener("abort", () => { abortedAt = order++; resolve(undefined); }, { once: true });
+        }),
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any, dismissManual: () => void) => {
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    dismissManual(); // pi-ai's onProgress fires here -- it already has the code
+    await new Promise((r) => setTimeout(r, 25)); // the (possibly slow) token exchange
+    runResolvedAt = order++;
+    return "exchanged-token";
+  });
+
+  assert.equal(result, "exchanged-token");
+  assert.notEqual(abortedAt, undefined, "the manual dialog's signal must have been aborted");
+  assert.notEqual(runResolvedAt, undefined);
+  assert.ok(abortedAt! < runResolvedAt!, "the manual dialog must be dismissed at callback-win (onProgress), BEFORE the delayed token exchange completes");
+});
+
+test("loginWithManualInputCleanup's readCode rejects (rather than resolving to \"\") when the manual dialog is cancelled or times out", async () => {
+  const ctx = {
+    ui: {
+      notify: () => {},
+      // ctx.ui.input resolving to undefined is exactly what a Cancel button or the
+      // dialog's own timeout produces (dialogPromise's cancelled/timeout default).
+      input: async () => undefined,
+    },
+  } as any;
+
+  // pi-ai only calls its onPrompt paste-only fallback when onManualCodeInput
+  // RESOLVES (even to a falsy value) -- never when it rejects. Asserting
+  // loginWithManualInputCleanup itself rejects (instead of resolving to "", the
+  // pre-fix behavior) proves readCode ends the OAuth attempt directly and pi-ai
+  // never gets the chance to fall through to that second, URL-less dialog.
+  await assert.rejects(
+    () => rotationModule.loginWithManualInputCleanup(ctx, (readCode) => readCode("Open this URL...", "placeholder")),
+    /OAuth login cancelled/,
+  );
+});
+
+test("resolves Anthropic to strength-matched OpenAI Codex fallback", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high"), {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-sol",
+    label: "openai-codex/gpt-5.6-sol:high",
+    strength: "strong",
+    thinkingLevel: "high",
+  });
+});
+
+test("shared launch/general candidate policy preserves a viable request, skips a cooling request, and reports total exhaustion", async () => {
+  const requested = { providerId: "anthropic", modelId: "claude-opus", registered: true, authenticated: true };
+  const fallback = { providerId: "openai-codex", modelId: "gpt-5", registered: true, authenticated: true };
+
+  assert.deepEqual(helpers.resolveProviderCandidates([requested, fallback], 100).candidates, [requested, fallback]);
+  assert.deepEqual(
+    helpers.resolveProviderCandidates([{ ...requested, coolingUntil: 200 }, fallback], 100).candidates,
+    [fallback],
+    "a cooling requested provider must not prevent launch/general selection of a viable fallback",
+  );
+  assert.deepEqual(
+    helpers.resolveProviderCandidates([
+      { ...requested, registered: false },
+      { ...fallback, authenticated: false },
+      { providerId: "anthropic", modelId: "claude-sonnet", registered: true, authenticated: true, coolingUntil: 200 },
+    ], 100).rejected.map(({ reason }) => reason),
+    ["unregistered", "unauthenticated", "cooling"],
+    "callers get one complete, actionable reason set when no candidate is viable",
+  );
+});
+
+test("resolves OpenAI Codex to strength-matched Anthropic fallback", async () => {
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "openai-codex/gpt-5.6-terra:medium"), {
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-6",
+    label: "anthropic/claude-sonnet-4-6:high",
+    strength: "medium",
+    thinkingLevel: "high",
+  });
+});
+
+// Ultra and strong share the bare model id gpt-5.6-sol; the live thinking level selects
+// the matching ladder rung.
+test("disambiguates colliding ladder rungs by the live thinking level", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  const config = helpers.readRotationConfig();
+
+  // max -> ultra rung -> Anthropic ultra (claude-fable-5)
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "max"), {
+    providerId: "anthropic",
+    modelId: "claude-fable-5",
+    label: "anthropic/claude-fable-5:high",
+    strength: "ultra",
+    thinkingLevel: "high",
+  });
+
+  // high -> strong rung -> Anthropic strong (claude-opus-4-8)
+  const highTarget = helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "high");
+  assert.ok(highTarget);
+  assert.equal(highTarget.modelId, "claude-opus-4-8");
+
+  // No thinking level falls back to the default-strength tie-break (strong -> opus).
+  const defaultTarget = helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config);
+  assert.ok(defaultTarget);
+  assert.equal(defaultTarget.modelId, "claude-opus-4-8");
+});
+
+test("parses Retry-After seconds and HTTP dates", async () => {
+  const now = Date.UTC(2026, 5, 16, 18, 30, 0);
+  assert.equal(helpers.parseRetryAfterHeader("1.5", now), 1500);
+
+  const retryAt = new Date(now + 15_000).toUTCString();
+  const parsed = helpers.parseRetryAfterHeader(retryAt, now);
+  assert.ok(parsed !== undefined && parsed >= 14_000 && parsed <= 15_000);
+  assert.equal(helpers.parseRetryAfterHeader("", now), undefined);
+  assert.equal(helpers.parseRetryAfterHeader("not-a-delay", now), undefined);
+});
+
+test("restores preferred model when its provider pool frees up", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.6-sol" } });
+
+  const setModelCalls: any[] = [];
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return { provider, id, api: provider === "openai-codex" ? "openai-codex-responses" : "anthropic-messages" };
+      },
+    },
+  } as any;
+  const pi = {
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+  } as any;
+
+  const restored = await helpers.restorePreferredModelIfPossible(pi, ctx);
+
+  assert.equal(restored, true);
+  assert.deepEqual(setModelCalls[0], {
+    provider: "openai-codex",
+    id: "gpt-5.6-sol",
+    api: "openai-codex-responses",
+  });
+  assert.equal(helpers.readRotationConfig().preferredModel, undefined);
+});
+
+test("pinned and exact launches retain their captured model during startup preferred-model restoration", async () => {
+  for (const reason of ["provider-pinned", "model-exact"] as const) {
+    await resetRotationState();
+    await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+    helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.6-sol" } });
+
+    const { ctx, events, pi, setModelCalls } = makeRotationCtx();
+    ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+    ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
+      allowCrossProviderFallback: false,
+      reason,
+    });
+
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    await events.before_agent_start?.({}, ctx);
+
+    assert.deepEqual(setModelCalls, [], `${reason} launches must not restore the shared preferred model`);
+    assert.deepEqual(ctx.model, { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" });
+    assert.deepEqual(helpers.readRotationConfig().preferredModel, { providerId: "openai-codex", modelId: "gpt-5.6-sol" });
+  }
+});
+
+test("keeps newest Retry-After cooldown across overlapping attempts", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  await helpers.markSubscriptionAttempt("anthropic", "personal", 100);
+  await helpers.markSubscriptionAttempt("anthropic", "personal", 200);
+  await helpers.markSubscriptionRateLimited("anthropic", "personal", 60_000, 100, 150);
+  await helpers.markSubscriptionRateLimited("anthropic", "personal", 5_000, 200, 205);
+  await helpers.markSubscriptionRateLimited("anthropic", "personal", 10_000, 100, 300);
+
+  const [entry] = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(
+    { lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil },
+    { lastAttemptAt: 200, lastRateLimitedAt: 300, rateLimitedUntil: 10300 },
+  );
+
+  await helpers.markSubscriptionSuccess("anthropic", "personal", 250);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 10300);
+  await helpers.markSubscriptionSuccess("anthropic", "personal", 400);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+// Storage-hardening (design mrf6n12x): the locked read/modify/write primitive must preserve a
+// causally newer cooldown across a stale credential upsert, while still letting an equal-timestamp
+// reauth clear it.
+test("a stale upsert refreshes tokens but cannot erase a newer cooldown; an equal-timestamp reauth clears it", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("work", { refresh: "r0", access: "a0", lastRateLimitedAt: 100 })]);
+  // What a node reads before doing a slow token refresh.
+  const snapshot = helpers.readSubscriptionPool("anthropic")[0];
+
+  // "Other node" 429s the slot with a strictly newer basis while the refresh is in flight.
+  await helpers.markSubscriptionRateLimited("anthropic", "work", 60_000, 500, 500);
+  const cooled = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(cooled.lastRateLimitedAt, 500);
+  assert.equal(cooled.rateLimitedUntil, 60_500);
+
+  // Stale refresh upsert built from the pre-429 snapshot: fresh tokens, stale cooldown basis.
+  await helpers.upsertSubscription("anthropic", { ...snapshot, refresh: "r1", access: "a1", expires: snapshot.expires ?? 0 });
+  const merged = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(merged.refresh, "r1", "token fields take the incoming value");
+  assert.equal(merged.access, "a1");
+  assert.equal(merged.rateLimitedUntil, 60_500, "the newer cooldown survives the stale upsert");
+  assert.equal(merged.lastRateLimitedAt, 500);
+
+  // Reauth clears the cooldown while preserving lastRateLimitedAt (equal timestamp -> incoming wins).
+  await helpers.upsertSubscription("anthropic", { ...merged, refresh: "r2", access: "a2", rateLimitedUntil: 0, lastRateLimitedAt: merged.lastRateLimitedAt });
+  const reauthed = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(reauthed.rateLimitedUntil, 0, "an equal-timestamp reauth clears the cooldown");
+  assert.equal(reauthed.refresh, "r2");
+});
+
+test("a stale success cannot reopen a slot cooled down by a newer 429", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "personal", 30_000, 500, 500);
+  // A success whose attempt STARTED before the 429 must not clear the newer cooldown.
+  await helpers.markSubscriptionSuccess("anthropic", "personal", 200);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 30_500);
+  // A success that started after the 429 legitimately clears it.
+  await helpers.markSubscriptionSuccess("anthropic", "personal", 600);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+// A mutation must genuinely go through the per-pool-file cross-process lock: while another
+// process holds the pool file's lock (the SAME LockedJsonFile lock the backend uses),
+// a mutator throws after exhausting its retry budget rather than writing unlocked; once the
+// holder releases, the same call succeeds.
+test("pool mutations take the cross-process pool-file lock", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("work")]);
+  const poolFile = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+
+  const lockHolder = spawn(
+    process.execPath,
+    [
+      "--import",
+      "tsx/esm",
+      "--input-type=module",
+      "-e",
+      String.raw`const { LockedJsonFile } = await import(${JSON.stringify(lockedFileUrl)});
+const backend = new LockedJsonFile(${JSON.stringify(poolFile)});
+await backend.withLockAsync(async () => {
+  process.stdout.write("locked\n");
+  await new Promise((resolve) => {
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", resolve);
+  });
+  return { result: undefined };
+});`,
+    ],
+    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+  );
+  let lockStderr = "";
+  lockHolder.stderr!.setEncoding("utf8");
+  lockHolder.stderr!.on("data", (chunk: string) => {
+    lockStderr += chunk;
+  });
+  let sawLocked = false;
+  const lockReady = new Promise<void>((resolve, reject) => {
+    lockHolder.once("error", reject);
+    lockHolder.once("close", (code) => {
+      if (!sawLocked) reject(new Error(`lock-holder exited with ${code} before signalling readiness: ${lockStderr.trim()}`));
+    });
+    observeLines(lockHolder.stdout!, (line) => {
+      if (line === "locked") {
+        sawLocked = true;
+        resolve();
+      }
+    });
+  });
+  // Teardown releases the lock and proves the child completed its awaited unlock before the
+  // post-release mutation runs. A wedged child still gets bounded TERM/KILL cleanup.
+  const childClosed = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
+    lockHolder.once("close", (code, signal) => resolve({ code, signal })),
+  );
+  let readyTimer: NodeJS.Timeout | undefined;
+  try {
+    await Promise.race([
+      lockReady,
+      new Promise<never>((_, reject) => {
+        // Boot budget, not a semantics guard: the child is a fresh `node --import tsx/esm`
+        // process that compiles the TS module graph before it can signal. Under the full
+        // tier's --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s,
+        // so give it real headroom -- a genuine lock bug shows up as a wrong outcome below,
+        // never as a slow boot.
+        readyTimer = setTimeout(() => reject(new Error("lock-holder did not signal readiness within 60s")), 60_000);
+      }),
+    ]);
+    const mutation = helpers.markSubscriptionAttempt("openai-codex", "work", 123);
+    // Let the async acquirer observe the held cross-process lock before releasing it. The
+    // single asynchronous lock path waits without blocking the event loop, then commits once
+    // the holder releases.
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    lockHolder.stdin!.write("release\n");
+    lockHolder.stdin!.end();
+    const pool = await mutation;
+    assert.equal(pool[0].lastAttemptAt, 123);
+  } finally {
+    if (readyTimer) clearTimeout(readyTimer);
+    try {
+      lockHolder.stdin!.write("release\n");
+      lockHolder.stdin!.end();
+    } catch {
+      /* child already gone */
+    }
+    // Wait for clean exit first: code 0 proves the async unlock completed. A wedged child gets
+    // bounded SIGTERM/SIGKILL cleanup, and its test-owned lock is removed only on that fallback.
+    const closedWithin = (ms: number) =>
+      Promise.race([
+        childClosed,
+        new Promise<null>((resolve) => setTimeout(() => resolve(null), ms)),
+      ]);
+    let closed = await closedWithin(2000);
+    let forced = false;
+    if (!closed || closed.code !== 0) {
+      forced = true;
+      lockHolder.kill("SIGTERM");
+      closed = await closedWithin(2000);
+      if (!closed) {
+        lockHolder.kill("SIGKILL");
+        closed = await closedWithin(2000);
+      }
+      if (!closed) throw new Error("lock-holder child did not exit after SIGKILL");
+    }
+    if (forced) {
+      rmSync(`${poolFile}.lock`, { recursive: true, force: true });
+      throw new Error(`lock-holder exited without clean unlock (code=${closed.code}, signal=${closed.signal})`);
+    }
+  }
+
+  const pool = await helpers.markSubscriptionAttempt("openai-codex", "work", 456);
+  assert.equal(pool[0].lastAttemptAt, 456);
+});
+
+// Codex captures the login `accountId` and rejects the same account re-added under a different
+// label (a sticky browser session otherwise fakes redundancy on one quota); a distinct account
+// is stored with its own accountId.
+test("rejects a duplicate Codex account under a new label and stores accountId for a distinct one", async () => {
+  await resetRotationState();
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  let nextAccountId = "acct-1";
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: nextAccountId }));
+
+  try {
+    await providerRotationExtension(pi);
+
+    await commands["provider-sub"].handler("openai-codex add codex-alt", ctx);
+    let pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
+    assert.equal(pool[0].accountId, "acct-1");
+
+    // Same account, different label -> rejected, pool unchanged.
+    notes.length = 0;
+    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
+    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "duplicate account is rejected with an error");
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["codex-alt"]);
+
+    // Distinct account -> stored with its own accountId.
+    nextAccountId = "acct-2";
+    await commands["provider-sub"].handler("openai-codex add codex-other", ctx);
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label).sort(), ["codex-alt", "codex-other"]);
+    assert.equal(pool.find((e) => e.label === "codex-other")?.accountId, "acct-2");
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The default Codex slot carries its account identity, preventing a second label from claiming
+// the same quota and making that identity visible in the list.
+test("the default Codex slot carries its account identity: blocks re-adding the same account and renders it in list", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [
+    credential("openai-codex", { refresh: "r-def", access: "a-def", accountId: "acct-default" }),
+  ]);
+
+  let pool = helpers.readSubscriptionPool("openai-codex");
+  assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
+  assert.equal(pool[0].accountId, "acct-default");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  // A sticky browser re-login yields the SAME ChatGPT account already backing the pool account.
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "acct-default" }));
+  try {
+    await providerRotationExtension(pi);
+
+    await commands["provider-sub"].handler("openai-codex add codex-dup", ctx);
+    assert.ok(notes.some((n) => n.type === "error" && /already added/i.test(n.message)), "re-adding the account under a new label is rejected");
+    pool = helpers.readSubscriptionPool("openai-codex");
+    assert.deepEqual(pool.map((e) => e.label), ["openai-codex"]);
+
+    notes.length = 0;
+    await commands["provider-sub"].handler("openai-codex list", ctx);
+    assert.match(notes.map((n) => n.message).join("\n"), /account=/);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// Drive the REAL login handler path: a collision with an explicit account must reject
+// before commitManagedLogin writes anything, so the failed OAuth result never partially
+// switches the default credential or creates a default pool entry with the duplicate identity.
+test("login handler rejects a colliding Codex account before switching the pool account", async () => {
+  await resetRotationState();
+  await helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-X" }));
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  ctx.ui.input = async () => "";
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "r-X", access: "a-X", expires: Date.now() + 60_000, accountId: "acct-X" }));
+  try {
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("openai-codex add openai-codex", ctx);
+    assert.ok(notes.some((note) => note.type === "error" && /already added/i.test(note.message)));
+    assert.equal(readAuthRecord("openai-codex"), undefined, "rejected login must not write auth.json");
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-X").length, 1);
+    assert.equal(pool.some((entry) => entry.label === "openai-codex"), false);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The handler snapshots the pool account before OAuth. A 429 recorded while OAuth is open is
+// causally newer, so completing a same-account login must not reopen that quota.
+test("the uniqueness-aware reauth upsert refreshes its slot but rejects another slot's account", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("work", { accountId: "acct-old", rateLimitedUntil: 900, lastAttemptAt: 100, lastRateLimitedAt: 50 }), credential("other", { accountId: "acct-held" })]);
+  await helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-new", refresh: "r-new", access: "a-new" }));
+  let pool = helpers.readSubscriptionPool("openai-codex");
+  const refreshed = pool.find((entry) => entry.label === "work");
+  assert.equal(refreshed?.accountId, "acct-new");
+  assert.equal(refreshed?.rateLimitedUntil, 900);
+  assert.equal(refreshed?.lastAttemptAt, 100);
+  assert.equal(refreshed?.lastRateLimitedAt, 50);
+  await assert.rejects(
+    () => helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-held", refresh: "r-collision", access: "a-collision" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  pool = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(pool.find((entry) => entry.label === "work")?.accountId, "acct-new");
+  assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+});
+
+// A rejected default identity move must leave the pool untouched — account uniqueness is decided
+// inside the pool lock, before anything is written — and must not touch auth.json at all, which
+// no managed path writes any more.
+test("addSubscription normalizes labels and enforces Codex account uniqueness inside the locked transform", async () => {
+  await resetRotationState();
+  await helpers.addSubscription("openai-codex", credential("work", { accountId: "acct-1" }));
+  await assert.rejects(
+    () => helpers.addSubscription("openai-codex", credential(" work ", { accountId: "acct-2" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already exists/i.test((err as Error).message),
+  );
+  await assert.rejects(
+    () => helpers.addSubscription("openai-codex", credential("   ", { accountId: "acct-3" })),
+    (err: unknown) => !(err instanceof helpers.DuplicateSubscriptionError) && /cannot be empty/i.test((err as Error).message),
+  );
+  await assert.rejects(
+    () => helpers.addSubscription("openai-codex", credential("work-2", { accountId: "acct-1" })),
+    (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
+  );
+  await helpers.addSubscription("openai-codex", credential("work-3", { accountId: "acct-3" }));
+  assert.deepEqual(helpers.readSubscriptionPool("openai-codex").map((entry) => entry.label).sort(), ["work", "work-3"]);
+});
+
+// The first contender holds the real pool lock inside addSubscription's transform. The second
+// contender cannot reach its own transform until it has first attempted that same real lock.
+// This makes an outside-lock uniqueness check deterministic: both checks run while the pool is
+// empty, then both appends succeed after the holder releases.
+// Approved slow-test exception: two fresh TypeScript child processes can take over 10s to boot
+// on a hosted runner; the test's bounded coordination budgets distinguish a genuine regression.
+test("cross-process explicit adds admit exactly one duplicate Codex account", { timeout: 60_000 }, async () => {
+  await resetRotationState();
+  const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+  const subscriptionStateUrl = new URL("../../lib/subscription-state.ts", import.meta.url).href;
+  const spawnContender = (label: string) => {
+    const child = spawn(
+      process.execPath,
+      [
+        "--import",
+        "tsx/esm",
+        "--input-type=module",
+        "-e",
+        String.raw`const { addSubscription, DuplicateSubscriptionError } = await import(${JSON.stringify(subscriptionStateUrl)});
+try {
+  await addSubscription("openai-codex", {
+    label: ${JSON.stringify(label)}, refresh: "refresh-${label}", access: "access-${label}", expires: Date.now() + 60_000,
+    accountId: "acct-cross-process-race", rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0,
+  });
+  process.stdout.write("outcome:success\n");
+} catch (error) {
+  const outcome = error instanceof DuplicateSubscriptionError ? "duplicate" : "error";
+  process.stdout.write("outcome:" + outcome + "\n");
+  if (outcome === "error") process.stderr.write(String(error));
+}`,
+      ],
+      { env: { ...process.env, HOME: home }, stdio: ["ignore", "pipe", "pipe"] },
+    );
+    return new Promise<{ outcome: string; stderr: string }>((resolve, reject) => {
+      let stdout = "";
+      let stderr = "";
+      child.stdout!.on("data", (chunk: string) => { stdout += chunk; });
+      child.stderr!.on("data", (chunk: string) => { stderr += chunk; });
+      child.once("error", reject);
+      child.once("close", (code) => {
+        const outcome = /outcome:([^\n]+)/.exec(stdout)?.[1];
+        if (code !== 0 || outcome === undefined) reject(new Error(`${label} exited with ${code}: ${stderr.trim()}`));
+        else resolve({ outcome, stderr });
+      });
+    });
+  };
+
+  const results = await Promise.all([spawnContender("race-left"), spawnContender("race-right")]);
+  assert.deepEqual(results.map((result) => result.outcome).sort(), ["duplicate", "success"], results.map((result) => result.stderr).join("\n"));
+  const pool = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(pool.length, 1);
+  assert.ok(["race-left", "race-right"].includes(pool[0].label));
+  assert.equal(existsSync(`${poolPath}.lock`), false, "cross-process add race must release the pool lock directory");
+});
+
+test("renames explicit subscriptions without permitting pool or case-insensitive collisions", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("openai-codex"), credential("work"), credential("personal")]);
+  assert.deepEqual((await helpers.renameSubscription("openai-codex", "work", "Lab")).map((entry) => entry.label), ["openai-codex", "Lab", "personal"]);
+  await assert.rejects(() => helpers.renameSubscription("openai-codex", "Lab", " PERSONAL "), helpers.DuplicateSubscriptionError);
+  await helpers.renameSubscription("openai-codex", "openai-codex", "anything");
+});
+
+test("treats numeric subscription refs as 1-based indexes", async () => {
+  await resetRotationState();
+  const pool = [credential("alpha"), credential("beta")];
+
+  await helpers.writeSubscriptionPool("openai-codex", pool);
+  assert.deepEqual(
+    (await helpers.removeSubscription("openai-codex", "1")).map((entry) => entry.label),
+    ["beta"],
+  );
+
+  await helpers.writeSubscriptionPool("openai-codex", pool);
+  assert.deepEqual(
+    (await helpers.promoteSubscription("openai-codex", "2")).map((entry) => entry.label),
+    ["beta", "alpha"],
+  );
+});
+
+test("switches exhausted Anthropic sessions to OpenAI Codex fallback", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-sonnet-4-6", api: "anthropic-messages" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return provider === "openai-codex" && id === "gpt-5.6-terra" ? { provider, id, api: "openai-codex-responses" } : undefined;
+      },
+    },
+  } as any;
+  let switchedTo: any;
+  let thinkingLevel: string | undefined;
+  const piApi = {
+    async setModel(model: any) {
+      switchedTo = model;
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel(level: string) {
+      thinkingLevel = level;
+    },
+  } as any;
+
+  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
+
+  assert.deepEqual(target, {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-terra",
+    label: "openai-codex/gpt-5.6-terra:medium",
+    strength: "medium",
+    thinkingLevel: "medium",
+  });
+  assert.deepEqual(switchedTo, {
+    provider: "openai-codex",
+    id: "gpt-5.6-terra",
+    api: "openai-codex-responses",
+  });
+  assert.equal(thinkingLevel, "medium");
+  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-6",
+  });
+});
+
+test("switches exhausted OpenAI Codex sessions to Anthropic fallback", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+
+  const ctx = {
+    model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
+      },
+    },
+  } as any;
+  let switchedTo: any;
+  let thinkingLevel: string | undefined;
+  const piApi = {
+    async setModel(model: any) {
+      switchedTo = model;
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel(level: string) {
+      thinkingLevel = level;
+    },
+  } as any;
+
+  const target = await helpers.switchToFallbackIfPossible(piApi, ctx);
+
+  assert.deepEqual(target, {
+    providerId: "anthropic",
+    modelId: "claude-opus-4-8",
+    label: "anthropic/claude-opus-4-8:high",
+    strength: "strong",
+    thinkingLevel: "high",
+  });
+  assert.deepEqual(switchedTo, {
+    provider: "anthropic",
+    id: "claude-opus-4-8",
+    api: "anthropic-messages",
+  });
+  assert.equal(thinkingLevel, "high");
+  assert.deepEqual(helpers.readRotationConfig().preferredModel, {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-sol",
+  });
+});
+
+function makeRotationCtx() {
+  const ctx = {
+    model: { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+    ui: { setStatus() {} },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        if (provider === "anthropic" && id === "claude-opus-4-8") return { provider, id, api: "anthropic-messages" };
+        if (provider === "openai-codex" && id === "gpt-5.6-sol") return { provider, id, api: "openai-codex-responses" };
+        return undefined;
+      },
+    },
+  } as any;
+  const setModelCalls: any[] = [];
+  const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
+  const events: Record<string, (...args: any[]) => unknown> = {};
+  const commands: Record<string, { handler: (args: string, ctx: any) => unknown }> = {};
+  const pi = {
+    registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
+      providers[name] = provider;
+    },
+    registerCommand(name: string, command: { handler: (args: string, ctx: any) => unknown }) {
+      commands[name] = command;
+    },
+    on(eventName: string, handler: (...args: any[]) => unknown) {
+      events[eventName] = handler;
+    },
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel() {},
+  } as any;
+  return { ctx, setModelCalls, providers, events, commands, pi };
+}
+
+// Codex exhaustion switches the model and serves the same turn on the Anthropic fallback.
+test("falls back transparently and serves the turn on Anthropic when Codex is exhausted", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  const streamedModels: any[] = [];
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from anthropic" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Session model was switched to the Anthropic fallback...
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
+    // ...and the turn was actually STREAMED on the Anthropic model (not the codex one).
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "anthropic");
+    // The turn was served with content, never failed with an error.
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// Live incident: a viewer explicitly selected qualified Sol, which set the
+// broker's provider pin, but the extension ignored that broker state. The first
+// model call could request a tool; on the post-tool continuation a shared Codex
+// cooldown then rotated the supposedly-pinned session through every Anthropic
+// credential. The live broker policy must be consulted on every provider call.
+test("an explicit live Sol pin forbids Anthropic fallback on a post-tool provider continuation", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
+  const expectedDeadline = helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil;
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
+    allowCrossProviderFallback: false,
+    reason: "provider-pinned",
+  });
+  let streamCalls = 0;
+  rotationModule.__setStreamForProviderForTest((_model) => {
+    streamCalls += 1;
+    return (async function* () {
+      yield { type: "text_delta", text: "must not call a cooling or fallback provider" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, [], "the pinned Sol session never switches to Anthropic");
+    assert.equal(streamCalls, 0);
+    assert.equal(emitted.length, 1);
+    assert.match(emitted[0].error.errorMessage, /explicitly pinned/i);
+    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// Request timeouts and other transient network/5xx blips retry the same provider in place
+// without cooling the credential down or rotating away.
+test("treats a request timeout as transient: retries the SAME provider in place, no cooldown or rotation", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  const sleepCalls: number[] = [];
+  let anthropicCalls = 0;
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      if (model.provider === "anthropic") {
+        anthropicCalls += 1;
+        if (anthropicCalls === 1) {
+          yield { type: "error", error: Object.assign(new Error("Request timed out."), { errorMessage: "Request timed out." }) };
+          return;
+        }
+        yield { type: "text_delta", text: "hello from anthropic, second try" };
+        return;
+      }
+      yield { type: "text_delta", text: "hello from codex" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Never switched providers or models -- both attempts stayed on anthropic.
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(streamedModels.map((m) => m.provider), ["anthropic", "anthropic"]);
+    assert.deepEqual(sleepCalls, [250]);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    // No cooldown -- a transient blip must never cool down a healthy subscription.
+    assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Once the in-place transient retry budget is exhausted, the failure is surfaced to the
+// user AND the credential is rotated away: the struggling credential cools down briefly and
+// the turn continues on the fallback provider, rather than hard-failing.
+test("surfaces the transient error and rotates to the fallback once the in-place retry budget is exhausted", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const notifications: Array<{ message: string; level: string }> = [];
+  ctx.ui.notify = (message: string, level: string) => {
+    notifications.push({ message, level });
+  };
+  const streamedModels: any[] = [];
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      if (model.provider === "anthropic") {
+        // 503 with no retry-after header is transient by STATUS, not just by message.
+        yield { type: "error", error: Object.assign(new Error("Service Unavailable"), { status: 503 }) };
+        return;
+      }
+      yield { type: "text_delta", text: "hello from codex fallback" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Retried the same anthropic credential in place (3 attempts) then rotated to codex.
+    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 3);
+    assert.deepEqual(sleepCalls, [250, 750]);
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    // The turn was served on the fallback, never failed with a terminal error.
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    // The user was told about the transient failure AND that it rotated.
+    assert.ok(notifications.some((n) => /transient error after 3 attempts/.test(n.message) && /rotating/i.test(n.message)));
+    // The struggling anthropic credential was cooled down so rotation moved on.
+    assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now());
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Regression: a genuine rate limit (HTTP 429) must never get the transient in-place
+// retry treatment -- it cools the credential down and rotates on the FIRST failure. The
+// cooldown duration must reflect a real Retry-After header (5s here) rather than always
+// falling back to the 5-minute default, so a misclassification is obvious from the numbers.
+test("treats HTTP 429 as a genuine rate limit: rotates immediately using the Retry-After header, no in-place retry", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    streamedModels.push(model);
+    return (async function* () {
+      if (model.provider === "anthropic") {
+        await options?.onResponse?.({ status: 429, headers: { "retry-after": "5" } }, model);
+        yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+        return;
+      }
+      yield { type: "text_delta", text: "hello from codex" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 1);
+    assert.deepEqual(sleepCalls, []); // a genuine rate limit rotates immediately, it never sleeps in place
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    // Retry-After: 5 -> ~5s cooldown, not the 5-minute default backoff.
+    assert.ok(entry.rateLimitedUntil > Date.now() + 4_000 && entry.rateLimitedUntil <= Date.now() + 5_000);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+test("re-enters an already-attempted provider when a concurrent success makes it ready again", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedProviders: string[] = [];
+  let anthropicAttempts = 0;
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    streamedProviders.push(model.provider);
+    return (async function* () {
+      if (model.provider === "anthropic" && anthropicAttempts++ > 0) {
+        yield { type: "text_delta", text: "recovered on Anthropic" };
+        return;
+      }
+      if (model.provider === "openai-codex") {
+        // A concurrent turn began after this turn's 429, so its causal success
+        // may legitimately clear Anthropic's cooldown before Codex exhausts.
+        await helpers.markSubscriptionSuccess("anthropic", "primary", Date.now() + 1);
+      }
+      await options?.onResponse?.({ status: 429, headers: { "retry-after": "0" } }, model);
+      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(streamedProviders, ["anthropic", "openai-codex", "anthropic"]);
+    assert.deepEqual(setModelCalls.map((entry) => entry.provider), ["openai-codex", "anthropic"]);
+    assert.ok(emitted.some((event) => event.type === "text_delta"));
+    assert.ok(!emitted.some((event) => event.type === "error"), "the ready-again provider must not fall into fatal exhaustion");
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("does not cool down credentials or switch providers when the user aborts", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield {
+        type: "error",
+        reason: "aborted",
+        error: {
+          role: "assistant",
+          content: [],
+          api: model.api,
+          provider: model.provider,
+          model: model.id,
+          usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+          stopReason: "aborted",
+          errorMessage: "Request was aborted",
+          timestamp: Date.now(),
+        },
+      };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    // No AbortSignal is threaded through options here on purpose: the abort must be recognized
+    // from the event's own `reason: "aborted"` marker alone. Requiring the signal is exactly the
+    // regression that let an ESC cool down every credential and drain both provider pools.
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(streamedModels.map((m) => m.provider), ["anthropic"]);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.equal(emitted[0].reason, "aborted");
+    assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("skips invalid refresh tokens and serves the turn on the fallback provider", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  // Plain Error, no typed .status: the pool path still recognizes invalid_grant
+  // from the message text.
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from codex" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "openai-codex");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+    assert.ok(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("all invalid refresh credentials surface an auth terminal instead of a typed cooldown", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("anthropic-stale", { expires: 1 })]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex-stale", { expires: 1 })]);
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  rotationModule.__setRefreshForProviderForTest(async () => {
+    throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant"}');
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    const terminal = emitted.find((event) => event.type === "error");
+    assert.ok(terminal, "all invalid credentials must terminate the turn");
+    assert.match(terminal.error.errorMessage, /authentication failed.*invalid_grant/i);
+    assert.equal(terminal.error.diagnostics, undefined, "an auth failure must not carry the auto-cooling diagnostic");
+    assert.equal(helpers.readSubscriptionPool("anthropic")[0].authFailure, "invalid_grant");
+    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].authFailure, "invalid_grant");
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+  }
+});
+
+test("automatically reauthenticates invalid refresh tokens when UI is available", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("stale", { expires: 1 })]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  ctx.ui.notify = () => {};
+  const loginCalls: string[] = [];
+  const streamedOptions: any[] = [];
+  // Plain Error, no typed .status: the pool path still recognizes invalid_grant
+  // from the message text.
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async (providerId) => {
+    loginCalls.push(providerId);
+    return { refresh: "refresh-fresh", access: "access-fresh", expires: Date.now() + 60_000 };
+  });
+  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
+    streamedOptions.push(options);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello after reauth" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(loginCalls, ["anthropic"]);
+    assert.deepEqual(setModelCalls, []);
+    assert.equal(streamedOptions[0].apiKey, "access-fresh");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    const [stored] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(stored.label, "stale");
+    assert.equal(stored.refresh, "refresh-fresh");
+    assert.equal(stored.access, "access-fresh");
+    assert.equal(stored.rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// The real invalid-refresh path must route an explicit Codex reauth through the locked identity
+// gate. A colliding OAuth result is rejected, the old credential remains intact, and the slot is
+// cooled instead of being duplicated or streamed with another slot's quota.
+test("real explicit Codex reauth rejects an account held by another slot", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [
+    credential("stale", { expires: 1, accountId: "acct-old" }),
+    credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }),
+  ]);
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "openai-codex") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async () => ({
+    refresh: "r-collision",
+    access: "a-collision",
+    expires: Date.now() + 60_000,
+    accountId: "acct-held",
+  }));
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+    for await (const _event of stream) {
+      // Drain the real managed-provider stream to completion.
+    }
+
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    const stale = pool.find((entry) => entry.label === "stale");
+    assert.equal(stale?.accountId, "acct-old");
+    assert.equal(stale?.refresh, "refresh-stale");
+    assert.ok((stale?.rateLimitedUntil ?? 0) > Date.now() + 29 * 24 * 60 * 60 * 1000);
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The default Codex reauth branch uses the same gate before it commits. A colliding login leaves
+// the default pool entry on the original account and keeps both pool identities unique.
+test("real default Codex reauth rejects an explicit slot's account before switching the default entry", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [
+    credential("openai-codex", { refresh: "dead-refresh", access: "stale-access", expires: 1, accountId: "acct-old" }),
+  ]);
+  await helpers.addSubscription("openai-codex", credential("held", { accountId: "acct-held", rateLimitedUntil: Date.now() + 10 * 60_000 }));
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  const notes: Array<{ message: string; type?: string }> = [];
+  ctx.ui.notify = (message: string, type?: string) => notes.push({ message, type });
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "openai-codex") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async () => ({
+    refresh: "r-collision",
+    access: "a-collision",
+    expires: Date.now() + 60_000,
+    accountId: "acct-held",
+  }));
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+    for await (const _event of stream) {
+      // Drain the real managed-provider stream to completion.
+    }
+
+    const pool = helpers.readSubscriptionPool("openai-codex");
+    const slot = pool.find((entry) => entry.label === "openai-codex");
+    assert.equal(slot?.accountId, "acct-old");
+    assert.equal(slot?.refresh, "dead-refresh");
+    assert.equal(pool.filter((entry) => entry.accountId === "acct-held").length, 1);
+    assert.ok(notes.some((note) => note.type === "error" && /re-authentication failed.*already added/i.test(note.message)));
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// A resolved-but-unauthenticated fallback stays on the current model and returns an
+// actionable "not authenticated" error when no provider is logged in.
+test("emits an actionable 'not authenticated' error without switching models when neither provider has ever logged in", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+
+  await providerRotationExtension(pi);
+  await events.session_start?.({}, ctx);
+  const stream = providers["openai-codex"].streamSimple(ctx.model, ctx);
+  const emitted = [] as any[];
+  for await (const event of stream) emitted.push(event);
+
+  // Never switches to the unauthenticated fallback -- nothing to try it with.
+  assert.deepEqual(setModelCalls, []);
+  assert.equal(emitted.length, 1);
+  assert.equal(emitted[0].type, "error");
+  assert.match(emitted[0].error.errorMessage, /OpenAI Codex not authenticated.*crtr sys setup/);
+});
+
+// The builtin ladder is available even with no ~/.crouter/config.json, so a config-less
+// user can still resolve cross-provider fallbacks.
+test("degrades gracefully via the builtin ladder when a config-less user has no cross-provider credentials", async () => {
+  await resetRotationState();
+  rmSync(join(home, ".crouter", "config.json"), { force: true });
+
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+    ui: { setStatus() {} },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        if (provider === "anthropic" && id === "claude-opus-4-8") return { provider, id, api: "anthropic-messages" };
+        if (provider === "openai-codex" && id === "gpt-5.6-sol") return { provider, id, api: "openai-codex-responses" };
+        return undefined;
+      },
+    },
+  } as any;
+  const setModelCalls: any[] = [];
+  const providers: Record<string, { streamSimple: (...args: any[]) => AsyncIterable<any> }> = {};
+  const events: Record<string, (...args: any[]) => unknown> = {};
+  const pi = {
+    registerProvider(name: string, provider: { streamSimple: (...args: any[]) => AsyncIterable<any> }) {
+      providers[name] = provider;
+    },
+    registerCommand() {},
+    on(eventName: string, handler: (...args: any[]) => unknown) {
+      events[eventName] = handler;
+    },
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+    setThinkingLevel() {},
+  } as any;
+
+  await providerRotationExtension(pi);
+  await events.session_start?.({}, ctx);
+  // Anthropic's pool is empty, so the credential loop never runs. The builtin ladder resolves
+  // a cross-provider target (openai-codex/gpt-5.6-sol), but that provider is also
+  // unauthenticated; the session model stays unchanged and the turn returns actionable advice.
+  const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
+  const emitted = [] as any[];
+  for await (const event of stream) emitted.push(event);
+
+  assert.deepEqual(setModelCalls, []);
+  assert.equal(emitted.length, 1);
+  assert.equal(emitted[0].type, "error");
+  assert.match(emitted[0].error.errorMessage, /Claude not authenticated.*crtr sys setup/);
+  assert.ok(!emitted[0].error.errorMessage.includes("configure a openai ladder"));
+});
+
+// readModelLadders() reads the builtin anthropic/openai ladder when config.json is absent.
+test("resolves the builtin anthropic ladder (medium = sonnet-5) with no ~/.crouter/config.json present", async () => {
+  await resetRotationState();
+  rmSync(join(home, ".crouter", "config.json"), { force: true });
+
+  const target = helpers.resolveFallbackTarget("anthropic", "anthropic/claude-sonnet-5:xhigh");
+
+  assert.deepEqual(target, {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-terra",
+    label: "openai-codex/gpt-5.6-terra:medium",
+    strength: "medium",
+    thinkingLevel: "medium",
+  });
+});
+
+// A cooling provider must settle the turn with a typed retry deadline. Holding
+// the stream open here rendered the node as generic `Working...` for five silent
+// minutes and prevented the broker's existing scheduled retry path from owning
+// recovery.
+test("settles a sole provider cooldown with a typed retry deadline instead of sleeping in-stream", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30_000);
+  const expectedDeadline = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
+  let streamCalls = 0;
+  rotationModule.__setStreamForProviderForTest((_model) => {
+    streamCalls += 1;
+    return (async function* () {
+      yield { type: "text_delta", text: "must not stream while cooling" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, []);
+    assert.equal(streamCalls, 0);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// A fallback that is itself cooling must contribute its earlier deadline without
+// churning the live session model to a provider that cannot serve the turn.
+test("does not switch to a cooling fallback and schedules the earliest provider deadline", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "primary", 60_000);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.markSubscriptionRateLimited("openai-codex", "codex", 30_000);
+  const expectedDeadline = helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil;
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const sleepCalls: number[] = [];
+  let streamCalls = 0;
+  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
+  rotationModule.__setStreamForProviderForTest((_model) => {
+    streamCalls += 1;
+    return (async function* () {
+      yield { type: "text_delta", text: "must not stream while cooling" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, [], "a cooling fallback does not churn the session model");
+    assert.deepEqual(sleepCalls, []);
+    assert.equal(streamCalls, 0);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Even an unusually long provider deadline uses the same typed scheduled-retry
+// path; invalid-grant remains separately classified before this branch.
+test("emits a typed rate-limit cooling error for a long provider deadline", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
+  const expectedDeadline = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, [], "a cooldown past the cap must not sleep in-process");
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    // Rate-limit-classifiable so classify('pi→provider', msg) → rate-limit/auto (not fatal other).
+    assert.match(emitted[0].error.errorMessage, /rate limit/i);
+    // Still carries the actionable fallback hint.
+    assert.match(emitted[0].error.errorMessage, /authenticate a fallback provider/);
+    // And the typed cooling diagnostic carrying the exact pool deadline for the stophook.
+    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+test("an excluded invalid_grant credential does not mask a cooling credential", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [
+    credential("dead", { authFailure: "invalid_grant", rateLimitedUntil: Date.now() + 30 * 24 * 60 * 60 * 1000 }),
+    credential("cooling", { rateLimitedUntil: Date.now() + 60_000 }),
+  ]);
+  const expectedDeadline = helpers.readSubscriptionPool("anthropic").find((entry) => entry.label === "cooling")!.rateLimitedUntil;
+
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+
+  await providerRotationExtension(pi);
+  await events.session_start?.({}, ctx);
+  const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
+  const emitted = [] as any[];
+  for await (const event of stream) emitted.push(event);
+
+  assert.equal(emitted.length, 1);
+  assert.equal(emitted[0].type, "error");
+  assert.match(emitted[0].error.errorMessage, /rate limited/i);
+  assert.doesNotMatch(emitted[0].error.errorMessage, /invalid_grant/);
+  assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+  assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, expectedDeadline);
+});
+
+// Fix 1 (switchToFallbackIfPossible): pi's `setModel` returns false when the target lacks
+// configured auth and leaves the model unchanged. A concurrent transition can still land on
+// the target while that call is in flight; accept only that observed live result and reject
+// every other false return.
+test("a same-turn 429 settles immediately instead of starting cooldown continuations", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  let attempts = 0;
+  let waits = 0;
+  rotationModule.__setSleepForTest(async () => { waits++; });
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    attempts++;
+    return (async function* () {
+      await options?.onResponse?.({ status: 429, headers: { "retry-after": "1" } }, model);
+      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.equal(attempts, 1, "the mocked clock keeps the credential cooling after its first 429");
+    assert.equal(waits, 0, "cooldown recovery never sleeps inside the active turn");
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("does not requeue a zero Retry-After credential without a later success", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  const { ctx, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  let attempts = 0;
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    attempts++;
+    return (async function* () {
+      await options?.onResponse?.({ status: 429, headers: { "retry-after": "0" } }, model);
+      yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(ctx.model, ctx);
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.equal(attempts, 1, "a zero deadline must not manufacture a fresh candidate");
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("switchToFallbackIfPossible accepts a false setModel only when the live model already equals the target", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+
+  const target = helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high");
+  assert.ok(target && target.providerId === "openai-codex" && target.modelId === "gpt-5.6-sol", "anthropic opus falls back to codex sol");
+
+  // Benign: setModel returns false without changing the model, while an independent
+  // concurrent transition lands on the exact target before the required live re-read.
+  {
+    let modelReads = 0;
+    const ctx = {
+      get model() {
+        modelReads++;
+        return modelReads === 1
+          ? { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" }
+          : { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
+      },
+      modelRegistry: { find: (provider: string, id: string) => ({ provider, id, api: "x" }) },
+    } as any;
+    const pi = {
+      async setModel(_m: any) { return false; },
+      setThinkingLevel() {},
+      getThinkingLevel() { return undefined; },
+    } as any;
+    const result = await helpers.switchToFallbackIfPossible(pi, ctx);
+    assert.ok(result, "a false setModel with the target already current must be accepted");
+    assert.equal(result!.providerId, "openai-codex");
+    assert.equal(result!.modelId, "gpt-5.6-sol");
+  }
+
+  // Real failure: setModel returns false and the live model stays DIFFERENT from the target
+  // → the switch is a genuine failure and must be rejected (undefined).
+  {
+    const ctx = {
+      model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      modelRegistry: { find: (provider: string, id: string) => ({ provider, id, api: "x" }) },
+    } as any;
+    const pi = {
+      async setModel(_m: any) { return false; }, // leaves ctx.model on anthropic
+      setThinkingLevel() {},
+      getThinkingLevel() { return undefined; },
+    } as any;
+    const result = await helpers.switchToFallbackIfPossible(pi, ctx);
+    assert.equal(result, undefined, "a false setModel that did not land on the target is a real failure");
+  }
+});
+
+// Fresh-availability re-entry (Fix 3a): a credential that becomes ready AFTER the initial
+// `available` snapshot (a concurrent turn's cooldown expiring, or a causally valid success)
+// must be consumed by re-entering the SAME provider, not lost to a stale snapshot that would
+// wrongly declare exhaustion. Start on an unauthenticated Anthropic (empty pool) so the
+// fallback to Codex is already attempted; Codex has A ready + B cooling; A's 429 frees B
+// mid-attempt, so the re-entry must attempt B and stream the turn with no terminal error.
+test("re-enters the same provider to consume a credential that became ready after the initial snapshot", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  // Anthropic unauthenticated (empty) so the turn falls back to Codex immediately.
+  await helpers.writeSubscriptionPool("anthropic", []);
+  // Codex: A ready now, B cooling (absent from the initial ready snapshot).
+  await helpers.writeSubscriptionPool("openai-codex", [
+    credential("A"),
+    credential("B", { rateLimitedUntil: Date.now() + 60_000 }),
+  ]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const streamedModels: any[] = [];
+  let codexAttempt = 0;
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    streamedModels.push(model.provider);
+    return (async function* () {
+      if (model.provider === "openai-codex") {
+        codexAttempt += 1;
+        if (codexAttempt === 1) {
+          // Attempt A: 429 (cools A). Free B mid-attempt so it becomes ready AFTER the
+          // snapshot that only saw A — the fresh-availability condition under test.
+          await options?.onResponse?.({ status: 429, headers: { "retry-after": "5" } }, model);
+          const pool = helpers.readSubscriptionPool("openai-codex");
+          await helpers.writeSubscriptionPool(
+            "openai-codex",
+            pool.map((entry) => (entry.label === "B" ? { ...entry, rateLimitedUntil: 0 } : entry)),
+          );
+          yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+          return;
+        }
+        // Re-entry attempt: B is now ready — serve the turn.
+        yield { type: "text_delta", text: "hello from codex B after re-entry" };
+        return;
+      }
+      yield { type: "text_delta", text: "unexpected" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Fell back to codex, attempted A (429), then re-entered and attempted B to success.
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.equal(codexAttempt, 2, "re-entered the same provider once to consume the freshly-ready credential");
+    assert.ok(emitted.some((e) => e.type === "text_delta"), "the turn was served, not terminally failed");
+    assert.ok(!emitted.some((e) => e.type === "error"), "no terminal all-pools error despite the stale initial snapshot");
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// Both-pools-cooling typed diagnostic (Fix 3b): when EVERY managed pool tried this turn is
+// cooling with a finite future deadline, the terminal error must be rate-limit-classifiable
+// AND carry the typed cooling diagnostic whose deadline is the exact MINIMUM across the tried
+// pools (so the stophook stamps retry.nextAt at the soonest pool free-up).
+test("both pools cooling: emits a rate-limit-classifiable terminal carrying the exact earliest deadline as a typed diagnostic", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  const now = Date.now();
+  const anthropicDeadline = now + 10 * 60_000; // earliest
+  const codexDeadline = now + 20 * 60_000;
+  await helpers.writeSubscriptionPool("anthropic", [credential("a", { rateLimitedUntil: anthropicDeadline })]);
+  await helpers.writeSubscriptionPool("openai-codex", [credential("c", { rateLimitedUntil: codexDeadline })]);
+  const expectedMin = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // A cooling fallback contributes its deadline without churning the live model.
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, [], "cooldowns are never waited out in-process");
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.match(emitted[0].error.errorMessage, /rate limit/i, "classifiable as rate-limit (auto), not fatal other");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+    assert.equal(
+      emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil,
+      expectedMin,
+      "the diagnostic carries the exact MINIMUM deadline across both tried pools",
+    );
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Live-incident regression (Hearth: a home's config.json had `gpt-5.6-*` ladder rungs baked
+// in while the installed guest's model registry only had `gpt-5.5`): when the ONLY viable
+// fallback target is authenticated (its pool has a credential) but its resolved model isn't
+// in this build's registry, the terminal error must name that specific reason -- not the old
+// generic "authenticate a fallback provider" text, which is actively wrong when the real
+// blocker is a stale/out-of-sync ladder, not a missing login.
+test("surfaces a specific 'not in model registry' reason instead of misleadingly telling the user to authenticate", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
+  // OpenAI Codex IS authenticated -- the fallback rejection must NOT be "no credentials".
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  // Registry recognizes anthropic's own model but NOT the configured openai-codex fallback
+  // rung (`gpt-5.6-sol`, from writeLadderConfig) -- simulating an installed guest whose
+  // catalog hasn't caught up with the configured ladder.
+  ctx.modelRegistry = {
+    find(provider: string, id: string) {
+      return provider === "anthropic" && id === "claude-opus-4-8" ? { provider, id, api: "anthropic-messages" } : undefined;
+    },
+  };
+  const sleepCalls: number[] = [];
+  rotationModule.__setSleepForTest(async (ms) => {
+    sleepCalls.push(ms);
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, []);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.match(emitted[0].error.errorMessage, /openai-codex\/gpt-5\.6-sol:high is not in this build's model registry/);
+    assert.match(emitted[0].error.errorMessage, /modelLadders config is out of sync with the installed model catalog/);
+    assert.doesNotMatch(emitted[0].error.errorMessage, /authenticate a fallback provider/);
+    // The repair command must be EXECUTABLE as printed: `--value`, the CONFIG ladder
+    // provider key (`openai`, not the runtime `openai-codex`), and the target's strength.
+    assert.match(
+      emitted[0].error.errorMessage,
+      /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/,
+    );
+  } finally {
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// Every fallback-rejection discriminant maps to actionable advice. Only `no_credentials`
+// advises authentication because the other rejection states require a different remedy.
+test("fallback rejection hints: only no_credentials advises authentication; every other discriminant gets accurate advice", async () => {
+  const codex = {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-sol",
+    label: "openai-codex/gpt-5.6-sol:high",
+    strength: "strong",
+  } as FallbackTarget;
+
+  const noCreds = rotationModule.__fallbackRejectionHintForTest("no_credentials", codex);
+  assert.match(noCreds, /authenticate a fallback provider/);
+  assert.match(noCreds, /OpenAI Codex/);
+  assert.match(noCreds, /\/provider-sub openai-codex add/);
+
+  const unregistered = rotationModule.__fallbackRejectionHintForTest("model_unregistered", codex);
+  assert.doesNotMatch(unregistered, /authenticate a fallback provider/);
+  assert.match(unregistered, /not in this build's model registry/);
+  // Executable repair command: --value, CONFIG ladder key (openai), target strength.
+  assert.match(unregistered, /crtr sys config set modelLadders\.openai\.strong --value <installed-model-id>/);
+
+  const alreadyTried = rotationModule.__fallbackRejectionHintForTest("already_attempted", codex);
+  assert.doesNotMatch(alreadyTried, /authenticate a fallback provider/);
+  assert.match(alreadyTried, /already tried this turn/);
+  assert.match(alreadyTried, /try again later/);
+
+  const cooling = rotationModule.__fallbackRejectionHintForTest("cooling", codex);
+  assert.doesNotMatch(cooling, /authenticate a fallback provider/);
+  assert.match(cooling, /also cooling down/);
+
+  const pinned = rotationModule.__fallbackRejectionHintForTest("provider_pinned");
+  assert.doesNotMatch(pinned, /authenticate a fallback provider/);
+  assert.match(pinned, /explicitly pinned/);
+
+  const noLadder = rotationModule.__fallbackRejectionHintForTest("no_ladder_entry");
+  assert.doesNotMatch(noLadder, /authenticate a fallback provider/);
+  assert.match(noLadder, /no cross-provider fallback is configured/);
+  assert.match(noLadder, /modelLadders/);
+});
+
+// A 429 observed during this provider call must author the deadline from the
+// freshly-mutated pool, without retrying or sleeping inside the active turn.
+test("schedules a sole credential cooldown observed in this turn from fresh pool state", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  // openai-codex pool stays empty -- no authenticated fallback to switch to.
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  const sleepCalls: number[] = [];
+  let anthropicCalls = 0;
+  rotationModule.__setSleepForTest(async (ms) => { sleepCalls.push(ms); });
+  rotationModule.__setStreamForProviderForTest((model, _context, options) => {
+    return (async function* () {
+      anthropicCalls += 1;
+      if (anthropicCalls === 1) {
+        await options?.onResponse?.({ status: 429, headers: { "retry-after": "1" } }, model);
+        yield { type: "error", error: Object.assign(new Error("Too Many Requests"), { status: 429 }) };
+        return;
+      }
+      yield { type: "text_delta", text: "must not retry inside this turn" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.deepEqual(sleepCalls, []);
+    assert.equal(anthropicCalls, 1);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].type, "error");
+    assert.equal(emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil, helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+    rotationModule.__setSleepForTest(undefined);
+  }
+});
+
+// pi-ai's Codex adapter can surface a genuine usage-limit exhaustion on a non-429
+// status. Without Retry-After it is local to this turn (never a global gate),
+// while the authenticated fallback still serves the same turn.
+test("treats a headerless Codex usage-limit message as turn-local and falls back", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
+  const streamedModels: any[] = [];
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      if (model.provider === "openai-codex") {
+        yield {
+          type: "error",
+          error: Object.assign(new Error("You have hit your ChatGPT usage limit. Please try again later."), {
+            status: 403,
+            errorMessage: "You have hit your ChatGPT usage limit. usage_limit_reached",
+          }),
+        };
+        return;
+      }
+      yield { type: "text_delta", text: "hello from anthropic fallback" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["openai-codex"].streamSimple(
+      { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // A headerless usage-limit signal is turn-local: it proves this request
+    // failed, not that unrelated brokers sharing the credential are cooling.
+    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
+    // Fell back to the authenticated Anthropic subscription and served the turn on it.
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["anthropic"]);
+    assert.equal(streamedModels.filter((m) => m.provider === "anthropic").length, 1);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("a pinned provider's headerless usage-limit stays turn-local and carries its retry deadline", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  await helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "openai-codex", id: "gpt-5.6-sol", api: "openai-codex-responses" };
+  ctx.ui[Symbol.for("@crouton-kit/crtr:managed-provider-rotation-policy")] = () => ({
+    allowCrossProviderFallback: false,
+    reason: "provider-pinned",
+  });
+  rotationModule.__setStreamForProviderForTest(() => {
+    return (async function* () {
+      yield {
+        type: "error",
+        error: Object.assign(new Error("You have hit your ChatGPT usage limit."), {
+          status: 403,
+          errorMessage: "usage_limit_reached",
+        }),
+      };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const before = Date.now();
+    const emitted = [] as any[];
+    for await (const event of providers["openai-codex"].streamSimple(ctx.model, ctx)) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.equal(helpers.readSubscriptionPool("openai-codex")[0].rateLimitedUntil, 0);
+    assert.equal(emitted.length, 1);
+    assert.equal(emitted[0].error.diagnostics?.[0]?.type, "crtr:managed-provider-cooling");
+    const deadline = emitted[0].error.diagnostics?.[0]?.details?.rateLimitedUntil;
+    assert.ok(deadline >= before + 14_000 && deadline <= Date.now() + 15_000);
+  } finally {
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// --- Provider-management removal routing and login coordination ---
+
+function readAuthRecord(providerId: string): unknown {
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  if (!existsSync(authPath)) return undefined;
+  return (JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>)[providerId];
+}
+
+// Removing a managed provider from its HEADER row (no label -- the default cursor position) tears
+// down the WHOLE pool, not just the account: a surviving explicit account would stay
+// configured and keep serving turns while the panel said "Removed".
+test("removeProviderRow on a managed HEADER row clears the whole pool", async () => {
+  await resetRotationState();
+  await helpers.upsertSubscription("anthropic", credential("anthropic"));
+  await helpers.upsertSubscription("anthropic", credential("work"));
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "anthropic"), "pool account present");
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "work"), "explicit account present");
+
+  const notice = await providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    configured: true,
+    // no label -> the provider header row
+  });
+
+  assert.equal(notice, "Removed Claude");
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [], "pool fully torn down");
+});
+
+// An account ROW (has a label) removes just that account and leaves the rest of the pool intact.
+test("removeProviderRow on a managed account row removes only that account", async () => {
+  await resetRotationState();
+  await helpers.upsertSubscription("anthropic", credential("anthropic"));
+  await helpers.upsertSubscription("anthropic", credential("work"));
+
+  const notice = await providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    label: "work",
+  });
+
+  assert.equal(notice, "Removed Claude account");
+  const remaining = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(
+    remaining.map((e) => e.label),
+    ["anthropic"],
+    "only the pool account remains",
+  );
+  assert.equal(remaining[0].refresh, "refresh-anthropic", "the pool account keeps its own token");
+});
+
+// Managed login commits the pool account through commitManagedLogin; the default pool entry
+// carries its tokens and auth.json has no managed OAuth record.
+test("commitManagedLogin pool account writes tokens into the default pool entry, not auth.json", async () => {
+  await resetRotationState();
+  await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "r1", access: "a1", expires: Date.now() + 60_000, accountId: "acct-1", lastRateLimitedAt: 0 });
+
+  const slot = helpers.readSubscriptionPool("anthropic").find((e) => e.label === "anthropic");
+  assert.ok(slot, "pool account present");
+  assert.equal(slot?.accountId, "acct-1", "pool pool account carries the identity");
+  assert.equal(slot?.refresh, "r1", "pool pool account carries its own token");
+  assert.equal(readAuthRecord("anthropic"), undefined, "no auth.json record written for a managed login");
+});
+
+// A managed login that identifies an existing account refreshes that row rather than creating a
+// second quota slot under the requested label.
+test("commitManagedLogin updates an existing account identity", async () => {
+  await resetRotationState();
+  await helpers.commitManagedLogin("openai-codex", "first", { refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: "dup", lastRateLimitedAt: 0 });
+  await helpers.commitManagedLogin("openai-codex", "second", { refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "dup", lastRateLimitedAt: 0 });
+  const pool = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(pool.length, 1);
+  assert.equal(pool[0].label, "first");
+  assert.equal(pool[0].refresh, "r2");
+});
+
+// A provider with NO account must never be switched onto: rotation would move the session model
+// onto a provider pi cannot serve, and the next turn dies with the non-retryable
+// `Provider is not configured: openai-codex`, which no agent can clear from inside a turn that
+// fails before it starts.
+test("a provider with no account: rotation never switches onto it", async () => {
+  await resetRotationState();
+  writeLadderConfig();
+  await helpers.writeSubscriptionPool("anthropic", [credential("primary")]);
+  await helpers.markSubscriptionRateLimited("anthropic", "primary", 30 * 24 * 60 * 60 * 1000);
+  await helpers.writeSubscriptionPool("openai-codex", []);
+  assert.equal(helpers.readSubscriptionPool("openai-codex").length, 0, "no account stored");
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+
+  await providerRotationExtension(pi);
+  await events.session_start?.({}, ctx);
+  const stream = providers["anthropic"].streamSimple(
+    { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+    ctx,
+  );
+  const emitted = [] as any[];
+  for await (const event of stream) emitted.push(event);
+
+  assert.deepEqual(setModelCalls, [], "never switches the session model onto an unconfigured provider");
+  assert.equal(emitted.length, 1);
+  assert.equal(emitted[0].type, "error");
+  // The blocker is a missing login, and the error says exactly that instead of wedging a node.
+  assert.match(emitted[0].error.errorMessage, /authenticate a fallback provider/);
+  assert.match(emitted[0].error.errorMessage, /\/provider-sub openai-codex add/);
+});
+
+
+test("Anthropic profile enrichment reads the real account identity", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => new Response(JSON.stringify({ account: { uuid: "account-a", email: "a@example.test" } }), { status: 200 });
+  try {
+    assert.deepEqual(
+      await helpers.enrichManagedLoginIdentity("anthropic", { access: "test-access" }),
+      { accountId: "account-a", email: "a@example.test" },
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("a failed Anthropic profile lookup leaves identity unknown", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => { throw new Error("profile unavailable"); };
+  try {
+    assert.deepEqual(await helpers.enrichManagedLoginIdentity("anthropic", { access: "test-access" }), {});
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("Anthropic managed login auto-labels new accounts and updates the matching account", async () => {
+  await resetRotationState();
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (_url, options) => {
+    const access = (options as RequestInit).headers as Record<string, string>;
+    const account = access.Authorization === "Bearer a1" || access.Authorization === "Bearer a2"
+      ? { uuid: "account-a", email: "a@example.test" }
+      : { uuid: "account-b", email: "b@example.test" };
+    return new Response(JSON.stringify({ account }), { status: 200 });
+  };
+  try {
+    const expires = Date.now() + 60_000;
+    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-a1", access: "a1", expires, lastRateLimitedAt: 0, autoLabel: true });
+    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-a2", access: "a2", expires, lastRateLimitedAt: 0, autoLabel: true });
+    await helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "refresh-b", access: "b", expires, lastRateLimitedAt: 0, autoLabel: true });
+    const pool = helpers.readSubscriptionPool("anthropic");
+    assert.deepEqual(pool.map((entry) => entry.label), ["a@example.test", "b@example.test"]);
+    assert.equal(pool[0]?.refresh, "refresh-a2");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("managed login preserves a cooldown newer than its login snapshot", async () => {
+  await resetRotationState();
+  await helpers.writeSubscriptionPool("openai-codex", [credential("personal", { accountId: "account-a", lastRateLimitedAt: 100, rateLimitedUntil: 60_100 })]);
+  await helpers.commitManagedLogin("openai-codex", "personal", {
+    refresh: "refresh-new",
+    access: "access-new",
+    expires: Date.now() + 60_000,
+    accountId: "account-a",
+    lastRateLimitedAt: 0,
+  });
+  const [entry] = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(entry.rateLimitedUntil, 60_100);
+  assert.equal(entry.lastRateLimitedAt, 100);
+});