osdy-pi 1.11.4 → 1.11.6

package/README.md

@@ -59,19 +59,19 @@ Osdy Pi's own extension and themes are bundled—do not install them separately.
 
 Run **`/osdyConfig`** in interactive Pi to open the Osdy Control Center. The ten categories—**Theme, Header, Mascot, Editor, Git, Sounds, Account, Usage, TODO, and Agents**—provide inline controls or data in the same modal. Existing commands remain available.
 
-- Use **↑/↓**, **Home/End**, or **Page Up/Down** to navigate; **Tab** or **←/→** switches between categories and details. **Enter** selects.
+- Use **↑/↓**, **Home/End**, or **Page Up/Down** to navigate; **Tab** or **←/→** switches between categories and details. **Enter** selects. Single blank lines separate the heading, summary, compact options, selected-item help, status, and action hints—not individual options. Gaps yield on short viewports so the selected option and controls remain reachable. Press **?** to expand/collapse the selected help and view notes; resize if expanded help is clipped. Confirmation effects remain complete, and **?** never toggles help during confirmation, path editing, loading, querying, or saving.
 - TODO shows configured selection, current eligibility, and actually loaded SDK registration separately. Opt-in/out requires an idle session and a Cancel-first inline confirmation naming the target, owned Gentle filter effects, and reload. Successful selection closes/disposes the panel and releases its editor hold before reloading once; restart Pi if reload fails. Rejections stay in the panel. No installs or task-history changes occur; legacy `/osdy-pi todo on|off|status` remains available.
-- Agents inspects Joker/Gentle configuration without activating anything. Selection is idle-only and Cancel-first confirmed, naming the real target, possible Joker installation, owned agent filters, and preserved unrelated resources. Normal personal Pi only: `pi:dev` and isolated/override sessions are blocked, never redirected to personal settings. Success closes/disposes the panel and releases its editor hold before reloading once; restart Pi if reload fails. Legacy `/osdy-pi agents setup|on|off|status` is unchanged.
-- Theme lists Pi's available themes and marks the current theme. A successful selection applies live and saves globally in the active Pi agent directory; project settings can override it at startup. Failures appear in the modal.
+- Agents shows concise **Joker / Gentle** choices without activating anything. With detail focus, visible lowercase-only **j Joker / g Gentle** letters open the existing confirmation directly; only available, unambiguous rows get shortcuts. **↑/↓ + Enter** remains the fallback. Profile and Agent selections survive category navigation; unavailable choices fall back to the current row. Letters never bypass category focus, confirmation, path input, loading, querying, or saving. Selection is idle-only and Cancel-first confirmed, naming the real target, possible Joker installation, owned agent filters, and preserved unrelated resources. Normal personal Pi only: `pi:dev` and isolated/override sessions are blocked, never redirected to personal settings. Success closes/disposes the panel and releases its editor hold before reloading once; restart Pi if reload fails. Legacy `/osdy-pi agents setup|on|off|status` is unchanged.
+- Theme lists Pi's available themes and marks the current theme. Explicit **Page x/N** pages contain at most **8 themes**, fewer in short viewports or with expanded help. **Page Up/Down** changes pages, **Home/End** reaches the first/last theme, and arrows cross page boundaries. Selection survives category navigation and resizing; resizing adjusts the page around the selected theme. A successful selection applies live and saves globally in the active Pi agent directory; project settings can override it at startup. Failures appear in the modal.
 - Header offers **osdy-theme / neon**; Mascot offers **current / Bts**; Editor offers **auto / extended / simple**, with the current preference marked. Editor also shows the effective mode: small terminals stay simple/native even with extended selected.
 - Preferences save immediately through the same runtime and global Osdy settings store as `/osdy-pi` commands (`<agent-dir>/extensions/osdy-pi/settings.json`). Header/Mascot apply live without closing the panel. Editor replacement waits until all overlays close; if another overlay remains, the next existing responsive watcher tick applies the latest choice. The effective mode reports the actually mounted editor while queued. Opening a category only reads values; while Osdy is disabled, choices save for later without enabling it.
 - A selection shows **Saving** until persistence finishes and **Saved globally** only on success. Failed saves retain the live preference but report **could not be saved**; select again to retry. Application errors report **Not saved**, without claiming the runtime change succeeded. Duplicate selections are ignored while saving.
 - **Git** shows the current branch (or detached HEAD), changed-entry count/clean status, and the current widget position as a read-only session detail. Working-tree enablement applies and saves through the same owner as `/osdy-pi working-tree`; Git inspection never writes Git. `/osdy-pi diff` and position commands are unchanged.
 - **Sounds** shows each event's saved and effective path/source. Configure opens a single-line path editor **inside this overlay**: enter a readable `.mp3`/`.wav` path, then **Enter** to validate and save immediately, or **Esc** to cancel editing. Relative paths resolve against the project directory and save as absolute paths. Clear removes only that event's saved path from the existing v1 audio store (`<agent-dir>/extensions/osdy-pi/audio-notifications.json`). Notifications read this store afresh; refresh failures are reported separately from save failures.
 - Sounds' master enablement is **unavailable**: the existing schema has paths, not an enable switch or presets. Startup `--osdy-pi-sound-<event>` flags override saved paths, so **clearing a saved path does not disable flag-configured playback**. Only **Test effective** explicitly plays a sound; opening categories and configuring paths never play. Tests report unavailable files/platforms or playback failures; playback remains macOS/Windows only. The legacy `/osdy-pi sound setup` wizard is preserved.
-- **Account** lists validated profiles and current/default metadata. **View usage: profile** explicitly queries that profile's stored Codex credentials without activating it; opening, navigating or highlighting never queries. The preview shows remaining quota, next resets and checked time (local time); absent data is unknown, not zero. Switch, set default, and clear default require an **in-screen confirmation** with Cancel selected initially; **Esc** cancels confirmation without closing the overlay. Resize if the confirmation cannot fit. Switching waits for Pi to become idle, activates through the existing backend, and refreshes subscription usage. Login remains Pi-owned (`/login`); create/rename/remove remain available in `/osdy-account`. Category navigation never changes profiles or credentials.
-- **Usage** shows the runtime's cached subscription quota (used percentage, window, reset/fetch times) and the existing local history owner's recorded token/cache totals, cost gaps, and model detail. Select **Range: day/week/month** for the current local calendar period; toggle **Accounts: all/current** for local analytics (unmanaged when no valid current profile exists). Quota always belongs to the active account, not the analytics filter. Select **Refresh quota and local history** explicitly; rendering and filters never fetch. Empty, loading, unavailable, and limited/incomplete coverage are reported honestly. Estimates are not billing or subscription quota. `/usage` and `/osdy-usage` remain unchanged.
-- **Esc** closes without undoing live or saved changes. Account read-only previews are cancelled on category exit or close; late results are ignored even if cancellation is not honored. Other in-flight operations still finish and are not claimed cancelled. Late results cannot replace a closed overlay or another category. On narrow terminals, categories and details share the viewport; use Tab to switch.
+- **Account** shows one row per validated profile, marked **Active** and **Default** where applicable. Select a profile, then use its visible context bar: **v View usage**, **s Switch** (inactive profiles), **d Set default**, and **c Clear default** (when a default exists). **v** or **Enter** explicitly queries that profile's stored Codex credentials without activating it; no second action list appears. Opening, navigating or highlighting never queries; stored profiles are never polled. A dedicated quota view reuses `/usage` dashboard content: Session/Weekly cards, additional bucket groups, remaining-capacity bars, resets, and the quotas/account summary with plan and credits when available. Identity belongs to the selected stored profile; unknown provider/model metadata is labeled honestly. Checked and updated times use local time; absent data is unknown, not zero. Refresh/Back controls and query feedback stay pinned while long dashboard content scrolls. **r Refresh** repeats the selected profile query; **s Switch**, when available, confirms activation of the currently viewed inactive profile. Cancelling that confirmation preserves the quota view and scroll position. **b Back** or **Esc** returns to the overview with the profile selected, without closing the overlay. In quota details, **↑/↓** selects Refresh/Back and **Enter** activates it; **Page Up/Down** and **Home/End** scroll long quota data. Switch, set default, and clear default require an **in-screen confirmation** with Cancel selected initially; **Esc** cancels confirmation without closing the overlay. Single blank separators group the confirmation title, complete effects, choices, and instructions; gaps yield on short viewports. Resize if the full confirmation cannot fit—acceptance stays hidden and blocked. Switching waits for Pi to become idle, activates through the existing backend, and refreshes subscription usage. Login remains Pi-owned (`/login`); create/rename/remove remain available in `/osdy-account`. Category navigation never changes profiles or credentials.
+- **Usage** shows the runtime's cached active Codex subscription quota (remaining-capacity bars and percentages, window, reset/fetch times) and the existing local history owner's recorded token/cache totals, cost gaps, and model detail. Select **Range: day/week/month** for the current local calendar period; toggle **Accounts: all/current** for local analytics (unmanaged when no valid current profile exists). Quota always belongs to the active account, not the analytics filter; local token/cost totals never become quota percentages. Select **Refresh quota and local history** explicitly; rendering and filters never fetch. Empty, loading, unavailable, and limited/incomplete coverage are reported honestly. Estimates are not billing or subscription quota. `/usage` and `/osdy-usage` remain unchanged.
+- **Esc** closes without undoing live or saved changes, except when cancelling a confirmation/input or returning from Account quota details. Account read-only queries are cancelled on Back/Esc, category exit or close; late results are ignored even if cancellation is not honored. Other in-flight operations still finish and are not claimed cancelled. Late results cannot replace a closed overlay or another category. On narrow terminals, categories and details share the viewport; use Tab to switch.
 
 This modal requires Pi's terminal UI, not RPC, JSON, or print mode. `/osdy-pi` remains the legacy extension command; the external shell command `osdy` (`bin/osdy.mjs`) remains the isolated launcher described below.
 
@@ -216,9 +216,9 @@ For a project-local installation, run `pi remove -l npm:@juicesharp/rpiv-todo` i
 
 ## OpenAI account profiles
 
-**Quick path:** `/osdyConfig` → **Account** → **View usage: profile** → optionally **Switch to profile** (Activate, Cancel-first confirmation). Each profile has its own explicit preview before its separate switch operation; the active profile also has a preview.
+**Quick path:** `/osdyConfig` → **Account** → select a profile → **v** (or **Enter**) for quota bars. Use **r Refresh** to query again or **b Back** / **Esc** to return with the profile selected. From the overview or quota dashboard, **s Switch** opens the same Cancel-first confirmation for the eligible inactive profile; cancelling from quota preserves the view and scroll position. From the overview, **d** sets the default and **c** clears an existing default, also with Cancel-first confirmation. The active profile also supports explicit stored-credential queries.
 
-Preview is **Codex only**, a live query using the selected profile's **stored credentials snapshot**, with no automatic refresh. It never activates, borrows active credentials, refreshes tokens, writes auth, changes models/session state or overwrites active quota. Missing, malformed, expired or remotely rejected snapshots are unavailable—not zero quota. Even the current profile's stored snapshot may be stale: log in and save through the normal account workflow outside preview. Profile labels and decoded JWT claims do not verify human identity or server validity. Local history remains token/cost estimates, not subscription quota. Legacy `/osdy-account`, `/usage` and `/osdy-usage` remain unchanged; Agents configuration remains normal personal Pi only.
+Preview is **Codex only**, a live query using the selected profile's **stored credentials snapshot**, with no automatic refresh or stored-profile polling. Only **View usage** and the quota view's **Refresh** query; profile navigation does not. It never activates, borrows active credentials, refreshes tokens, writes auth, changes models/session state or overwrites active quota. Missing, malformed, expired or remotely rejected snapshots are unavailable—not zero quota. Even the current profile's stored snapshot may be stale: log in and save through the normal account workflow outside preview. Profile labels and decoded JWT claims do not verify human identity or server validity. Local history remains token/cost estimates, not subscription quota. Legacy `/osdy-account`, `/usage` and `/osdy-usage` remain unchanged; Agents configuration remains normal personal Pi only.
 
 Osdy Pi can keep multiple ChatGPT Plus/Pro accounts authenticated and let you choose which one starts Pi. `personal` and `work` are only examples—you can create as many named profiles as you need.
 
@@ -283,7 +283,7 @@ To resume a specific session directly from the terminal:
 osdy-pi account use work -- --session /absolute/path/to/session.jsonl
 ```
 
-> **Privacy:** each profile keeps a private `auth.json`; Pi runs against its canonical shared `auth.json`. Account activation/preservation atomically copies opaque auth files. The separate explicit **View usage: profile** preview reads a bounded stored auth snapshot, parses its Codex OAuth fields and unverified JWT claims, and sends the access token/account ID only to the fixed HTTPS Codex usage endpoint. It never refreshes tokens, logs in, switches accounts, writes auth, or queries automatically; it does not print or log credentials. Session history, settings, installed packages, and extension resources are shared, so every profile can access that local state. It keeps Pi's canonical `openai-codex` provider and delegates authentication to Pi's built-in `/login` flow.
+> **Privacy:** each profile keeps a private `auth.json`; Pi runs against its canonical shared `auth.json`. Account activation/preservation atomically copies opaque auth files. The separate explicit Account **View usage / Refresh** query reads a bounded stored auth snapshot, parses its Codex OAuth fields and unverified JWT claims, and sends the access token/account ID only to the fixed HTTPS Codex usage endpoint. It never refreshes tokens, logs in, switches accounts, writes auth, or queries automatically; it does not print or log credentials. Session history, settings, installed packages, and extension resources are shared, so every profile can access that local state. It keeps Pi's canonical `openai-codex` provider and delegates authentication to Pi's built-in `/login` flow.
 
 Account switching is serialized in-process and protected by a private cross-process lock. Osdy Pi accepts only bounded regular auth files, refuses symlink-based auth sources, writes replacements with private permissions, and restores the previous canonical auth and account metadata when activation fails. A separate namespace lock protects concurrent profile creation, rename, and removal. Launchers activate the selected auth before starting Pi while continuing to use the shared agent directory; existing managed-directory links from earlier profile layouts are resolved for compatibility.
 
@@ -427,11 +427,13 @@ Run `/usage` to open the Codex subscription dashboard for the active managed `op
 
 The main windows are labeled **Session** and **Weekly** (the API/domain remains primary/secondary). Their remaining-capacity bars are full at 100% remaining and empty at 0%; labels use the active theme's bold accent, Session uses the accent fill, Weekly uses `mdLink`, and empty segments are muted. The remaining percentage stays muted above 40%, changes to the theme's warning color at 40% or less, and changes to its error color at 15% or less. The same thresholds apply in the `/usage` dashboard and compact footer/editor quota bars. A double themed frame, section dividers, and spacing separate the display. Detail cards show each duration and relative, local, and UTC reset times. Plan, availability, credits/reset count, and additional buckets appear only when the service supplies them; absent optional values are omitted.
 
-At wide widths, the modal pairs the Session and Weekly detail cards. Below 72 content columns, cards and bars stack and account/model data wraps. The native footer and extended editor also show compact Session/Weekly remaining-capacity bars below model and thinking metadata whenever a current Codex snapshot exists. Wide widths combine those bars; narrow widths stack them. Additional buckets appear only in `/usage`.
+At wide widths, the modal pairs the Session and Weekly detail cards. Below 72 content columns, cards and bars stack and account/model data wraps. The native footer and extended editor also show compact Session/Weekly remaining-capacity bars below model and thinking metadata whenever a current Codex snapshot exists. Wide widths combine those bars; narrow widths stack them. Additional buckets appear in `/usage` and the selected-profile Control Center quota view, not compact editor/footer bars.
 
-Usage loads once when the session starts and refreshes when the modal opens or `r` is pressed; it does not poll. A refresh clears the previous snapshot before authentication resolves, and shutdown clears state, so quota data cannot cross account or profile boundaries.
+Active quota loads when an enabled session starts and refreshes when `/usage` opens or `r` is pressed. It also refreshes while idle on a **60-second** schedule, only after settings are loaded, with Osdy enabled, an interactive terminal UI, an `openai-codex` model selected, and no quota request already in flight. Automatic failures double the retry delay up to **10 minutes**; a successful automatic query restores the 60-second interval. This scheduler never polls stored profiles.
 
-> **Privacy:** this active-account `/usage` path resolves OAuth through Pi's `modelRegistry`, rather than directly reading auth files. The separate Control Center **View usage: profile** path reads the selected profile's bounded stored credentials snapshot; it never borrows active credentials or refreshes tokens, logs in, switches accounts, writes auth, or queries automatically. Both paths transmit the access token/account ID only to the fixed HTTPS Codex usage endpoint, reject redirects, and bound timeout and response size. Quota previews do not persist or log credentials or display account IDs, tokens, raw response bodies, or endpoint internals.
+Automatic refresh retains the last snapshot during loading and on error, so an older reading can remain visible until a successful query replaces it. Manual refresh clears the previous snapshot before authentication resolves and supersedes any in-flight automatic request. Account switching refreshes active quota through that same clearing path. Session replacement and shutdown stop the timer, cancel pending requests and clear quota state; late results are ignored.
+
+> **Privacy:** this active-account `/usage` path resolves OAuth through Pi's `modelRegistry`, rather than directly reading auth files. The separate Control Center Account **View usage / Refresh** path reads the selected profile's bounded stored credentials snapshot; it never borrows active credentials or refreshes tokens, logs in, switches accounts, writes auth, or queries automatically. Both paths transmit the access token/account ID only to the fixed HTTPS Codex usage endpoint, reject redirects, and bound timeout and response size. Quota previews do not persist or log credentials or display account IDs, tokens, raw response bodies, or endpoint internals.
 
 ### Local usage analytics (starting in 1.10.0)
 
@@ -486,6 +488,19 @@ While work is active, Osdy Pi centers an activity label and compact animated gly
 | `Delegating...` | ✧ ✦ ✧ | Subagent handoffs. |
 | `Executing...` | ◴ ◷ ◶ ◵ | Unknown or ambiguous tools. |
 
+**Subagent assignment is not live activity.** While a `subagent_run` or `subagent_continue` parent call is active, the indicator distinguishes the two:
+
+| Source | Example | Meaning |
+| --- | --- | --- |
+| Validated public `agent` and optional `label` arguments | `explore · Task: map footer data` | Submitted assignment, not a claimed tool operation. This provider-neutral fallback works with Gentle Agents, which currently emits no live child progress. |
+| Public foreground progress from Joker (`pi-subagents-j0k3r`) | `scout · read` | Observable child activity; takes precedence over assignment copy. |
+
+Without a usable label, assignment copy is `Task assigned`; continuations without agent identity use `Subagent`, never an inferred identity. Full tasks, prompts and context are never read or displayed. Model activity uses fixed `Waiting on model` / `Responding` labels, never reasoning or response text.
+
+For multiple running children, the indicator uses the first child in snapshot order with a compact additional-child count. Missing, malformed or no-running-child progress restores the assignment, or ordinary parent activity when assignment metadata is unavailable. Labels are bounded, control-safe and clipped to terminal width. Matching tool end, agent/session end and reload cleanup discard per-call state.
+
+**Background limitation:** assignments appear only while their parent call is active. There is no persistent background live feed, polling or task cache.
+
 When tools overlap, the latest remaining tool owns the display. All glyphs share a brightness pulse through the active theme's `mdQuoteBorder`, `thinkingHigh`, `accent`, and `borderAccent` colors; the animation signals activity, not measured percentage progress. Glyphs and labels use a single 80 ms timer, with no new controls or settings.
 
 A two-color wave travels across the label: the current letter uses the active theme's `accent`, the trailing letter uses `warning`, and the rest use `text`. Only the current `accent` letter tries the active theme's bold styling; this is a terminal-dependent visual trial, not a change to font size. The trailing `warning` letter and glyph stay plain. The glyph and label update when the theme changes. Osdy Pi hides Pi's built-in working row while enabled to avoid a duplicate indicator.
@@ -589,7 +604,7 @@ An isolated agent directory does **not** make custom audio paths or real provide
 
 - Open `/osdyConfig` in regular and fullscreen Pi. Check arrows/Home/End/Page Up/Down, Tab or left/right, Enter, and Esc; shrink and restore the terminal, checking both panes remain reachable.
 - In disposable settings, change a visual preference, wait for **Saved globally**, close and reopen, then reload/restart to check persistence. Esc does not undo changes; distinguish save/application errors from success.
-- Account (manual): with disposable profiles only, check Cancel-first switch/set-default/clear-default confirmations, Esc cancellation, idle switching, and current/default labels. Check explicit **View usage: profile** before optional switching, no query on navigation, and cancellation on exit. Create/rename/remove stay in `/osdy-account`, login in `/login`.
+- Account (manual): with disposable profiles only, check Cancel-first switch/set-default/clear-default confirmations, Esc cancellation, idle switching, and current/default labels. Check one row per profile with **v/s/d/c** context actions and **Enter** usage fallback, without a second action list. From **v** quota details, check eligible **s Switch** opens the same Cancel-first confirmation, with blank separators between the title/effects, choices, and instructions; Cancel/Esc must retain the quota view and scroll position. Check gaps yield on short viewports without hiding safety content or enabling acceptance when the full confirmation cannot fit. Check remaining-capacity bars, **r Refresh**, **b Back/Esc** returning to the selected profile, long-view scrolling, no query on navigation, no stored-profile polling, and cancellation on exit. Create/rename/remove stay in `/osdy-account`, login in `/login`.
 - Usage (manual): check day/week/month and all/current filters, empty/unavailable/limited states, and explicit refresh. Authenticated quota and post-switch account correctness need an intentionally authorized live provider check; local estimates are not billing.
 - Sounds (manual): use disposable readable `.mp3`/`.wav` files to check configure, cancel, clear, and startup-flag precedence. Only choose **Test effective** when playback is intended; actual macOS/Windows playback still needs a live check.
 

package/extensions/osdy-pi/codex-usage-refresh.test.ts

@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { registerHooks } from "node:module";
+import type { CodexUsageRefreshClock, CodexUsageRefreshTimer } from "./codex-usage-refresh.js";
+
+registerHooks({
+	resolve(specifier, context, nextResolve) {
+		if (specifier === "./codex-usage-refresh.js") {
+			return { shortCircuit: true, url: new URL("./codex-usage-refresh.ts", context.parentURL).href };
+		}
+		return nextResolve(specifier, context);
+	},
+});
+const { createCodexUsageRefresh } = await import("./codex-usage-refresh.js");
+
+class FakeClock implements CodexUsageRefreshClock {
+	now = 0;
+	jobs = new Map<CodexUsageRefreshTimer, { at: number; run: () => void }>();
+	setTimeout(run: () => void, delay: number): CodexUsageRefreshTimer {
+		const handle = { cancel: () => { this.jobs.delete(handle); } };
+		this.jobs.set(handle, { at: this.now + delay, run });
+		return handle;
+	}
+	async advance(ms: number): Promise<void> {
+		this.now += ms;
+		for (const [handle, job] of this.jobs) {
+			if (job.at <= this.now) { this.jobs.delete(handle); job.run(); }
+		}
+		for (let i = 0; i < 8; i++) await Promise.resolve();
+	}
+}
+
+void test("idle refresh waits 60 seconds and owns one timer and request", async () => {
+	const clock = new FakeClock();
+	let calls = 0;
+	let finish: (value: boolean) => void = () => {};
+	const service = createCodexUsageRefresh(() => {
+		calls++;
+		return new Promise<boolean>(resolve => { finish = resolve; });
+	}, clock);
+	service.start(); service.start();
+	assert.equal(clock.jobs.size, 1);
+	await clock.advance(59_999); assert.equal(calls, 0);
+	await clock.advance(1); assert.equal(calls, 1);
+	await clock.advance(600_000); assert.equal(calls, 1);
+	assert.equal(clock.jobs.size, 0);
+	finish(true); await clock.advance(0);
+	assert.equal(clock.jobs.size, 1);
+	await clock.advance(59_999); assert.equal(calls, 1);
+	await clock.advance(1); assert.equal(calls, 2);
+	service.stop(); finish(true); await clock.advance(0);
+	assert.equal(clock.jobs.size, 0);
+});
+
+void test("failures increase delay to a bounded ten minutes and success resets it", async () => {
+	const clock = new FakeClock();
+	let result: boolean | undefined = false;
+	let calls = 0;
+	const service = createCodexUsageRefresh(() => { calls++; return Promise.resolve(result); }, clock);
+	service.start();
+	for (const delay of [60_000, 120_000, 240_000, 480_000, 600_000, 600_000]) {
+		const before = calls;
+		await clock.advance(delay - 1); assert.equal(calls, before);
+		await clock.advance(1); assert.equal(calls, before + 1);
+	}
+	result = true; await clock.advance(600_000);
+	const recovered = calls;
+	await clock.advance(60_000); assert.equal(calls, recovered + 1);
+	result = undefined; await clock.advance(60_000);
+	assert.equal(clock.jobs.size, 1, "skipped refresh still retries at normal cadence");
+	service.stop();
+});
+
+void test("stop and restart isolate both pending timers and pending completions", async () => {
+	const clock = new FakeClock();
+	const finishes: Array<(value: boolean) => void> = [];
+	const service = createCodexUsageRefresh(() => new Promise<boolean>(resolve => finishes.push(resolve)), clock);
+	service.start(); service.stop();
+	await clock.advance(60_000); assert.equal(finishes.length, 0);
+	service.start(); await clock.advance(60_000);
+	service.stop(); service.start();
+	finishes[0]?.(false); await clock.advance(0);
+	assert.equal(clock.jobs.size, 1);
+	await clock.advance(60_000); assert.equal(finishes.length, 2);
+	service.stop(); finishes[1]?.(true); await clock.advance(0);
+	assert.equal(clock.jobs.size, 0);
+});
+
+void test("unexpected refresh rejection backs off without an unhandled promise", async () => {
+	const clock = new FakeClock(); let calls = 0;
+	const service = createCodexUsageRefresh(() => { calls++; return Promise.reject(new Error("offline")); }, clock);
+	service.start(); await clock.advance(60_000);
+	await clock.advance(119_999); assert.equal(calls, 1);
+	await clock.advance(1); assert.equal(calls, 2);
+	service.stop();
+});

package/extensions/osdy-pi/codex-usage-refresh.ts

@@ -0,0 +1,57 @@
+export interface CodexUsageRefreshTimer { cancel(): void }
+
+export interface CodexUsageRefreshClock {
+	setTimeout(callback: () => void, delayMs: number): CodexUsageRefreshTimer;
+}
+
+const clock: CodexUsageRefreshClock = {
+	setTimeout: (callback, delayMs) => {
+		const timer = setTimeout(callback, delayMs);
+		timer.unref();
+		return { cancel: () => clearTimeout(timer) };
+	},
+};
+
+const INTERVAL_MS = 60_000;
+const MAX_RETRY_MS = 600_000;
+
+/** One session owns one timer; undefined means eligibility skipped the query. */
+export function createCodexUsageRefresh(
+	refresh: () => Promise<boolean | undefined>,
+	timers: CodexUsageRefreshClock = clock,
+): { start(): void; stop(): void } {
+	let running = false;
+	let generation = 0;
+	let timer: CodexUsageRefreshTimer | undefined;
+	let delayMs = INTERVAL_MS;
+
+	const schedule = (owner: number): void => {
+		timer = timers.setTimeout(() => {
+			timer = undefined;
+			void tick(owner);
+		}, delayMs);
+	};
+	const tick = async (owner: number): Promise<void> => {
+		if (!running || owner !== generation) return;
+		let result: boolean | undefined;
+		try { result = await refresh(); } catch { result = false; }
+		if (!running || owner !== generation) return;
+		if (result === false) delayMs = Math.min(delayMs * 2, MAX_RETRY_MS);
+		else if (result === true) delayMs = INTERVAL_MS;
+		schedule(owner);
+	};
+	return {
+		start() {
+			if (running) return;
+			running = true;
+			delayMs = INTERVAL_MS;
+			schedule(++generation);
+		},
+		stop() {
+			running = false;
+			generation++;
+			timer?.cancel();
+			timer = undefined;
+		},
+	};
+}

package/extensions/osdy-pi/codex-usage-ui.test.ts

@@ -50,6 +50,8 @@ const {
 	formatCodexUsageWindow,
 	renderCompactCodexQuotaBars,
 	formatRemainingPercent,
+	renderControlCenterQuotaLines,
+	renderCodexUsageDashboardContentLines,
 	renderCodexUsageDashboardLines,
 	renderCodexUsagePanelLines,
 	renderCodexUsageReadyLines,
@@ -1136,6 +1138,64 @@ void test("repaints the modal after refresh synchronously enters loading and whe
 	assert.deepEqual(state, { kind: "ready", snapshot: refreshedSnapshot });
 });
 
+void test("Control Center shared quota bars preserve extremes, unknowns, windows and ANSI width", () => {
+	const theme: SimpleTheme = { fg: (_color, text) => `\x1b[32m${text}\x1b[0m` };
+	const now = 1_900_000_000_000;
+	const snapshot: CodexUsageSnapshot = { fetchedAt: now, planType: undefined, credits: undefined, ordinaryUsageAllowed: undefined,
+		buckets: [
+			{ id: "codex", label: "Codex", primary: { usedPercent: 0, windowMinutes: 30, resetsAt: now / 1000 + 60 },
+				secondary: { usedPercent: 100, windowMinutes: 10080, resetsAt: undefined } },
+			{ id: "extra", label: "Extra\x1b[2J bucket", primary: { usedPercent: NaN, windowMinutes: undefined, resetsAt: NaN }, secondary: undefined },
+			{ id: "missing", label: undefined, primary: undefined, secondary: undefined },
+		] };
+	const text = stripSgr(renderControlCenterQuotaLines(theme, snapshot, 100, now).join("\n"));
+	assert.match(text, /Session 30m 100% left █+/);
+	assert.match(text, /Weekly 7d 0% left ░+/);
+	assert.match(text, /Session quota window unknown/);
+	assert.match(text, /resets in 1m/);
+	assert.ok(text.includes(`Next reset: ${new Date(now + 60000).toLocaleString()}`));
+	assert.match(text, /Quota and next reset: unknown/);
+	assert.doesNotMatch(text, /NaN/);
+	assert.equal(text.includes("\x1b[2J"), false);
+	for (const width of [1, 8, 24, 48, 100]) {
+		const lines = renderControlCenterQuotaLines(theme, snapshot, width, now);
+		assert.ok(lines.every(line => visibleWidth(line) <= width), `width ${width}`);
+	}
+	assert.equal(formatRemainingPercent(Infinity), "unknown");
+	assert.equal(formatRemainingPercent(-10), "100% left");
+	assert.equal(formatRemainingPercent(110), "0% left");
+	assert.match(renderControlCenterQuotaLines(theme, { ...snapshot, buckets: [] }, 100).join(" "), /unknown/);
+});
+
+void test("Pure dashboard content matches /usage groups while leaving caller controls and identity separate", () => {
+	const theme: SimpleTheme = { fg: (_color, text) => `${String.fromCharCode(27)}[32m${text}${String.fromCharCode(27)}[0m` };
+	const now = 1_900_000_000_000;
+	const snapshot: CodexUsageSnapshot = { fetchedAt: now, planType: "plus", ordinaryUsageAllowed: false,
+		credits: { hasCredits: true, unlimited: false, balance: "0", resetCreditCount: 0 },
+		buckets: [
+			{ id: "codex", label: "Codex", primary: { usedPercent: 0, windowMinutes: 300, resetsAt: now / 1000 + 60 },
+				secondary: { usedPercent: 100, windowMinutes: 10080, resetsAt: 0 } },
+			{ id: "extra", label: "Additional", primary: { usedPercent: NaN, windowMinutes: undefined, resetsAt: NaN }, secondary: undefined },
+			{ id: "missing", label: undefined, primary: undefined, secondary: undefined },
+		] };
+	for (let width = 1; width <= 120; width++) {
+		const presentation = { profile: "personal" };
+		const content = renderCodexUsageDashboardContentLines(theme, snapshot, presentation, now, width);
+		const dashboard = renderCodexUsageDashboardLines(theme, snapshot, presentation, now, width);
+		assert.deepEqual(content, dashboard.slice(0, -1), `shared content at width ${width}`);
+		assert.ok(content.every(line => visibleWidth(line) <= width), `ANSI width ${width}: ${JSON.stringify(content.filter(line => visibleWidth(line) > width).map(stripSgr))}`);
+		assert.doesNotMatch(stripSgr(content.join("\n")), /NaN|Invalid Date|esc\/q close/);
+	}
+	const text = stripSgr(renderCodexUsageDashboardContentLines(theme, snapshot, { profile: "personal" }, now, 120).join("\n"));
+	for (const field of ["Session", "Weekly", "100% left", "0% left", "Additional [extra]", "Quotas + account", "Profile: personal", "Plan: plus", "Availability: not allowed", "Credits: 0", "Credit resets: 0", "resets in 1m", "1970-01-01 00:00 UTC", "Reset: unavailable", "unknown", "No quota windows available"]) assert.ok(text.includes(field), field);
+	assert.doesNotMatch(text, /Profile: work|openai-codex\/|gpt-/);
+	const unlimited = { ...snapshot, credits: { hasCredits: false, unlimited: true, balance: undefined, resetCreditCount: undefined } };
+	assert.match(stripSgr(renderCodexUsageDashboardContentLines(theme, unlimited, {}, now, 100).join("\n")), /Credits: unlimited/);
+	const empty = { ...snapshot, buckets: [], credits: undefined, planType: undefined, ordinaryUsageAllowed: undefined };
+	const absent = stripSgr(renderCodexUsageDashboardContentLines(theme, empty, {}, now, 100).join("\n"));
+	assert.match(absent, /Quotas \+ account/); assert.doesNotMatch(absent, /Credits:|Plan:|Availability:|0% left/);
+});
+
 void test("keeps Codex quota out of the editor top border layout", () => {
 	const title = " Osdy-Pi ";
 	const modelAndThinking = "openai-codex/gpt-5.6-sol · think medium";

package/extensions/osdy-pi/codex-usage-ui.ts

@@ -2,6 +2,7 @@ import {
 	matchesKey,
 	truncateToWidth,
 	visibleWidth,
+	wrapTextWithAnsi,
 	type Component,
 	type TUI,
 } from "@earendil-works/pi-tui";
@@ -60,7 +61,41 @@ function divider(theme: SimpleTheme, width: number): string {
 }
 
 export function formatRemainingPercent(usedPercent: number): string {
-	return `${Math.max(0, Math.round(100 - usedPercent))}% left`;
+	return Number.isFinite(usedPercent) ? `${Math.max(0, Math.min(100, Math.round(100 - usedPercent)))}% left` : "unknown";
+}
+
+/** Shared remaining-capacity presentation for the Control Center's cached snapshots. */
+export function renderControlCenterQuotaWindow(theme: SimpleTheme, window: CodexUsageWindow, width: number,
+	name: "Session" | "Weekly" = "Session", now = Date.now()): string[] {
+	const maximumWidth = Math.max(1, Math.floor(width));
+	const label = `${name} ${formatWindowDuration(window)} ${formatRemainingPercent(window.usedPercent)}`;
+	const barWidth = Math.min(28, maximumWidth - visibleWidth(label) - 1);
+	const bar = Number.isFinite(window.usedPercent) ? progress(theme, window, Math.max(1, barWidth), quotaTheme(name)) : "";
+	const heading = bar && barWidth > 0 ? `${label} ${bar}` : label;
+	return [
+		...wrapTextWithAnsi(heading, maximumWidth),
+		...(bar && barWidth <= 0 ? [progress(theme, window, Math.min(12, maximumWidth), quotaTheme(name))] : []),
+		...wrapTextWithAnsi(`Window: ${window.windowMinutes === undefined ? "unknown" : `${window.windowMinutes} minutes`} · Next reset: ${validReset(window.resetsAt) ? new Date(window.resetsAt * 1000).toLocaleString() : "unknown"}`, maximumWidth),
+		...(validReset(window.resetsAt) ? wrapTextWithAnsi(formatResetTiming(window.resetsAt, now) ?? "", maximumWidth) : []),
+	];
+}
+
+function validReset(value: number | undefined): value is number {
+	return value !== undefined && Number.isFinite(value) && !Number.isNaN(new Date(value * 1000).getTime());
+}
+
+export function renderControlCenterQuotaLines(theme: SimpleTheme, snapshot: CodexUsageSnapshot, width: number,
+	now = Date.now()): string[] {
+	const lines: string[] = [];
+	for (const bucket of snapshot.buckets) {
+		lines.push(...wrapTextWithAnsi(bucketDisplay(bucket).label, Math.max(1, width)));
+		for (const [name, window] of [["Session", bucket.primary], ["Weekly", bucket.secondary]] as const) {
+			if (window) lines.push(...renderControlCenterQuotaWindow(theme, window, width, name, now));
+		}
+		if (!bucket.primary && !bucket.secondary) lines.push("Quota and next reset: unknown");
+	}
+	return (lines.length ? lines : ["Quota and next reset: unknown (no quota windows returned)."])
+		.flatMap(line => wrapTextWithAnsi(line, Math.max(1, width)));
 }
 
 function remainingPercentTheme(
@@ -156,13 +191,14 @@ function borderBox(
 	titleTheme: "accent" | "mdLink" = "accent",
 ): string[] {
 	const innerWidth = Math.max(1, width - 2);
-	const heading = truncateToWidth(` ${title} `, innerWidth, "...", true);
+	const ellipsis = innerWidth >= 3 ? "..." : "";
+	const heading = truncateToWidth(` ${title} `, innerWidth, ellipsis, true);
 	const leftWidth = Math.floor(
 		Math.max(0, innerWidth - visibleWidth(heading)) / 2,
 	);
 	const rightWidth = Math.max(0, innerWidth - visibleWidth(heading) - leftWidth);
 	const pad = (line: string): string => {
-		const text = truncateToWidth(line, innerWidth, "...", true);
+		const text = truncateToWidth(line, innerWidth, ellipsis, true);
 		return `${text}${" ".repeat(Math.max(0, innerWidth - visibleWidth(text)))}`;
 	};
 	return [
@@ -323,7 +359,7 @@ function formatResetDetails(
 	resetAt: number | undefined,
 	now: number,
 ): string[] {
-	if (resetAt === undefined) return ["Reset: unavailable"];
+	if (!validReset(resetAt)) return ["Reset: unavailable"];
 	const date = new Date(resetAt * 1_000);
 	return [
 		`Reset: ${formatResetRelative(resetAt, now)}`,
@@ -389,7 +425,7 @@ function renderQuotaBucketSection(
 		divider(theme, width),
 	];
 	if (cards.length === 0) {
-		lines.push(theme.fg("muted", "No quota windows available"));
+		lines.push(...wrapToVisibleWidth("No quota windows available", width).map(line => theme.fg("muted", line)));
 		return lines;
 	}
 	const [primaryCard, secondaryCard] = cards;
@@ -414,6 +450,8 @@ function combineCards(left: string[], right: string[]): string[] {
 
 function wrapToVisibleWidth(text: string, width: number): string[] {
 	const maximumWidth = Math.max(1, Math.floor(width));
+	if (visibleWidth(text) <= maximumWidth) return [text];
+	if (text.includes(String.fromCharCode(27))) return wrapTextWithAnsi(text, maximumWidth);
 	const lines: string[] = [];
 	let line = "";
 	for (const character of Array.from(text)) {
@@ -434,7 +472,7 @@ function renderQuotaFooterLines(
 	presentation: CodexUsagePresentation,
 	width: number,
 ): string[] {
-	const lines = [theme.fg("accent", "Quotas + account"), divider(theme, width)];
+	const lines = [...wrapToVisibleWidth("Quotas + account", width).map(line => theme.fg("accent", line)), divider(theme, width)];
 	const quotaLines: string[] = [];
 	for (const bucket of snapshot.buckets) {
 		const { label } = bucketDisplay(bucket);
@@ -446,6 +484,10 @@ function renderQuotaFooterLines(
 			const prefix = `${label} ${name} `;
 			const themedLabel = `${theme.fg("muted", `${label} `)}${quotaLabel(theme, name, " ")}`;
 			const remaining = formatRemainingPercent(window.usedPercent);
+			if (!Number.isFinite(window.usedPercent)) {
+				quotaLines.push(...wrapToVisibleWidth(`${themedLabel}unknown`, width));
+				continue;
+			}
 			const suffix = ` ${remaining} · ${Math.round(window.usedPercent)}% used`;
 			const themedSuffix = `${theme.fg("muted", " ")}${themedRemainingPercent(theme, window.usedPercent)}${theme.fg("muted", ` · ${Math.round(window.usedPercent)}% used`)}`;
 			const compactThemedSuffix = `${themedRemainingPercent(theme, window.usedPercent)}${theme.fg("muted", ` · ${Math.round(window.usedPercent)}% used`)}`;
@@ -539,7 +581,8 @@ function controlHints(theme: SimpleTheme, width: number): string {
 	);
 }
 
-export function renderCodexUsageDashboardLines(
+/** Snapshot-only dashboard content; callers own controls and source-specific metadata. */
+export function renderCodexUsageDashboardContentLines(
 	theme: SimpleTheme,
 	snapshot: CodexUsageSnapshot,
 	presentation: CodexUsagePresentation = {},
@@ -551,8 +594,20 @@ export function renderCodexUsageDashboardLines(
 		lines.push(...renderQuotaBucketSection(theme, bucket, now, width));
 	lines.push(theme.fg("border", "─".repeat(Math.max(1, width))));
 	lines.push(...renderQuotaFooterLines(theme, snapshot, presentation, width));
-	lines.push(controlHints(theme, width));
-	return lines;
+	return width < 4 ? lines.map(line => truncateToWidth(line, Math.max(1, width), "")) : lines;
+}
+
+export function renderCodexUsageDashboardLines(
+	theme: SimpleTheme,
+	snapshot: CodexUsageSnapshot,
+	presentation: CodexUsagePresentation = {},
+	now = Date.now(),
+	width = 94,
+): string[] {
+	return [
+		...renderCodexUsageDashboardContentLines(theme, snapshot, presentation, now, width),
+		controlHints(theme, width),
+	];
 }
 
 export function renderCodexUsagePanelLines(

package/extensions/osdy-pi/control-center-account.test.ts

@@ -31,15 +31,21 @@ void test("Profile preview is explicit, independently selected and never activat
 	});
 	const initial = await service.read();
 	assert.deepEqual(requests, []);
-	assert.equal(initial.rows[0]?.label, "View usage: work");
-	assert.ok(initial.rows.findIndex(row => row.label === "View usage: personal") < initial.rows.findIndex(row => row.label === "Switch to personal"));
+	assert.equal(initial.rows.length, 2);
+	assert.equal(initial.rows[0]?.label, "work · Active");
+	assert.equal(initial.rows[1]?.action.kind, "account-select");
+	assert.equal(initial.rows[1]?.actions?.[0]?.label, "View usage");
 	for (const profile of ["work", "personal"]) {
 		assert.equal((await service.apply({ kind: "account-usage", profile })).failed, false);
-		const row = (await service.read()).rows.find(row => row.label === `View usage: ${profile}`);
-		assert.match(row?.details?.join(" ") ?? "", /75% remaining/);
-		assert.match(row?.details?.join(" ") ?? "", /Weekly: 20% remaining.*Next reset: unknown/);
-		assert.match(row?.details?.join(" ") ?? "", /Extra bucket.*90% remaining.*Next reset: unknown/);
+		const row = { details: service.quotaDetails?.(profile) };
+		assert.match(row?.details?.join(" ") ?? "", /75% left/);
+		assert.match(row?.details?.join(" ") ?? "", /Weekly 7d 20% left.*Next reset: unknown/);
+		assert.match(row?.details?.join(" ") ?? "", /Extra bucket.*90% left.*Next reset: unknown/);
 		assert.ok(row?.details?.includes(`Profile: ${profile}`));
+		assert.equal(service.quotaSnapshot("personal"), profile === "personal" ? service.quotaSnapshot(profile) : undefined);
+		assert.equal(service.quotaSnapshot(profile)?.buckets.length, 2);
+		assert.ok(row?.details?.some(line => line.startsWith("Window: 300 minutes")));
+		assert.ok(row?.details?.some(line => line.startsWith("Window: unknown")));
 		assert.ok(row?.details?.includes(`Checked: ${new Date(1000).toLocaleString()} (local time)`));
 		assert.ok(row?.details?.some(line => line.endsWith(`Next reset: ${new Date(2000 * 1000).toLocaleString()}`)));
 	}
@@ -61,13 +67,13 @@ void test("Profile preview preserves timestamp units and marks missing or invali
 						secondary: { usedPercent: 80, windowMinutes: 10080, resetsAt } }] } }),
 		});
 		await service.apply({ kind: "account-usage", profile: "work" });
-		const details = (await service.read()).rows[0]?.details ?? [];
+		const details = service.quotaDetails?.("work") ?? [];
 		assert.ok(details.includes(`Checked: ${new Date(checkedAt).toLocaleString()} (local time)`));
 		const expectedReset = resetsAt === 1_780_000_000 || resetsAt === 0
 			? new Date(resetsAt * 1000).toLocaleString() : "unknown";
-		for (const label of ["Session: 75", "Weekly: 20"]) {
-			assert.ok(details.includes(`codex / ${label}% remaining · Next reset: ${expectedReset}`));
-		}
+		assert.match(details.join(" "), /Session 5h 75% left/);
+		assert.match(details.join(" "), /Weekly 7d 20% left/);
+		assert.equal(details.filter(line => line.endsWith(`Next reset: ${expectedReset}`)).length, 2);
 	}
 });
 
@@ -81,7 +87,7 @@ void test("Account projects validated metadata, never output or credential field
 	assert.match(view.summary, /Current: work.*Default: personal/);
 	assert.equal(JSON.stringify(view).includes("secret"), false);
 	assert.equal(JSON.stringify(view).includes("auth.json"), false);
-	assert.equal(view.rows.some(row => row.label === "Switch to personal"), true);
+	assert.equal(view.rows.some(row => row.actions?.some(action => action.label === "Switch to personal")), true);
 });
 
 void test("Account revalidates membership and uses real switch/default adapters", async () => {
@@ -144,13 +150,13 @@ void test("Bound Account validates live external active names without rendering
 			else process.env.OSDY_PI_PROFILE_NAME = value;
 			const view = await service.read();
 			assert.match(view.summary, /Current: unmanaged/);
-			assert.equal(view.rows.some(row => row.label === "Switch to work"), true);
+			assert.equal(view.rows.some(row => row.actions?.some(action => action.label === "Switch to work")), true);
 			assert.equal(JSON.stringify(view).includes("token-secret"), false);
 			assert.equal(JSON.stringify(view).includes("auth.json"), false);
 		}
 		process.env.OSDY_PI_PROFILE_NAME = "Work";
 		assert.match((await service.read()).summary, /Current: Work/);
-		assert.equal((await service.read()).rows.some(row => row.label === "Switch to work"), false);
+		assert.equal((await service.read()).rows.some(row => row.actions?.some(action => action.label === "Switch to work")), false);
 	} finally {
 		if (previous === undefined) delete process.env.OSDY_PI_PROFILE_NAME;
 		else process.env.OSDY_PI_PROFILE_NAME = previous;
@@ -195,15 +201,15 @@ void test("Profile preview cancellation, supersession and stale runtime discard
 	requests[1]?.finish({ status: "unavailable", profile: "personal", checkedAt: 1000, reason: "remote-usage-unavailable" });
 	await second;
 	requests[0]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await first;
-	assert.match(JSON.stringify(await service.read()), /Remote Codex usage unavailable/);
-	assert.doesNotMatch(JSON.stringify(await service.read()), /Stored credentials unavailable \(missing/);
+	assert.match(JSON.stringify(service.quotaDetails?.("personal")), /Remote Codex usage unavailable/);
+	assert.doesNotMatch(JSON.stringify(service.quotaDetails?.("personal")), /Stored credentials unavailable \(missing/);
 	const third = service.apply({ kind: "account-usage", profile: "work" }); await flush();
 	service.cancelUsage?.(); assert.equal(requests[2]?.signal.aborted, true);
 	requests[2]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await third;
-	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	assert.doesNotMatch(JSON.stringify(service.quotaDetails?.("work")), /Checked: .*local time/);
 	const fourth = service.apply({ kind: "account-usage", profile: "work" }); await flush(); current = false;
 	requests[3]?.finish({ status: "unavailable", profile: "work", checkedAt: 1000, reason: "stored-credentials-unavailable" }); await fourth;
-	assert.doesNotMatch(JSON.stringify(await service.read()), /Checked:/);
+	assert.doesNotMatch(JSON.stringify(service.quotaDetails?.("work")), /Checked: .*local time/);
 	assert.equal((await service.apply({ kind: "account-switch", profile: "personal" })).failed, true);
 });
 
@@ -220,12 +226,23 @@ void test("Unavailable, cancelled, absent quota and unexpected errors never fabr
 			},
 		});
 		await service.apply({ kind: "account-usage", profile: "work" });
-		const text = JSON.stringify(await service.read());
+		const text = JSON.stringify(service.quotaDetails?.("work"));
 		assert.doesNotMatch(text, /0%|token-secret|private\/auth/);
 		assert.match(text, outcome === "empty" ? /unknown/ : /unavailable|cancelled/);
 	}
 });
 
+void test("A mismatched profile result cannot publish another profile's quota snapshot", async () => {
+	const service = createControlCenterAccount({ profiles: () => Promise.resolve(["work", "personal"]), active: () => "work",
+		defaultProfile: () => Promise.resolve(undefined), switch: () => Promise.resolve(true), setDefault: () => Promise.resolve(true),
+		usage: () => Promise.resolve({ status: "ready", profile: "work", checkedAt: 1000,
+			quotaSnapshot: { fetchedAt: 1000, buckets: [], credits: undefined, planType: undefined, ordinaryUsageAllowed: undefined } }),
+	});
+	assert.equal((await service.apply({ kind: "account-usage", profile: "personal" })).failed, true);
+	assert.equal(service.quotaSnapshot("personal"), undefined);
+	assert.doesNotMatch(service.quotaDetails("personal").join(" "), /local time/);
+});
+
 void test("Bound preview uses injected service independently of active refresh and queued stale activation", async () => {
 	let current = true; let release = () => {}; const names: string[] = [];
 	const service = bindControlCenterAccount({ isIdle: () => false, waitForIdle: () => new Promise<void>(resolve => { release = resolve; }),