[Hylouis233]

Summary

Pool accounts with exhausted included usage can be incorrectly dropped five minutes after a successful credit observation: inference headers renew the aggregate quota timestamp without renewing the separate spendable-credit timestamp. The cache then looks fresh while routing sees stale credits, producing repeated local refusals despite available funds.

• Refresh expired or absent spendable-credit evidence before selecting an opted-in, unpaused exhausted pool account. Bypass usage-only cache freshness and coalesce metadata refreshes through existing priming; dispatched failed observations are paced per credential generation.
• Keep the five-minute credit validity boundary. A failed observation never authorizes spending stale funds, inference, or reset-credit redemption. Exact-account refresh is limited to its selected account, and cancelled selection does not start discovery.
• Do not fall back to the observed native-main caller credential while that main account is paused. Unrelated caller-owned Direct credentials retain their behavior.

Verification

• Seven added regression cases exercise expiry across prime/selection/cache/exact-account paths, fresh negative evidence and opt-outs, cancellation, and failed-observation pacing; the paused-main fallback has separate coverage. The first five regression cases were also run against unchanged source and all failed, then passed with the fix.
• Bun 1.4.3 focused suite: 159 passed, 0 failed across quota priming, auth context, pool/main credits-after-limit, and credit publication.
• bun run typecheck, bun run structure:check, bun run privacy:scan, and bun scripts/file-size-ratchet.ts passed.
• Documentation: cd docs-site && bun install --frozen-lockfile && bun run build passed (577 pages).
• bun run test:changed was started with the pinned Bun runtime but interrupted before a terminal result. It is not reported as passing. Full-suite validation remains outstanding; this PR is draft pending broader checks.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-context.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-context.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@Hylouis233 Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[Ingwannu]

Intake at b64f0a3054. The latest hygiene job's annotation is specifically PR hygiene failed: unsponsored_surface; this is not evidence that the quota regression test failed. Sponsorship is an owner/maintainer boundary decision, not a contributor instruction to bypass the gate. Keep Draft pending that review and exact-head functional CI. The evidence needed is refresh coalescing/dispatch pacing by credential generation, zero inference or reset redemption during metadata refresh, no stale-credit spending after failure, exact-account isolation and native-main pause behavior. I did not redeem credits, probe accounts or run a scan.

[lidge-jun]

Closing as a duplicate of #7381, which renews pool credit evidence on the existing sweep. Your paused-main regression test will be carried into the pool/hard-lock bundle with Co-authored-by credit. Thank you for the fix.

[lidge-jun]

Follow-up: as promised, the paused-main regression test (and the two auth-context.ts paused-main guards it proved necessary) landed on dev in #7393 (squash d3dafd3) with a Co-authored-by trailer. Thanks!