From c8a8db8144cf91b9b8d14a1cd3cca9c4796e3e6d Mon Sep 17 00:00:00 2001
From: chilung <b0423031@gmail.com>
Date: Sun, 18 Oct 2026 22:50:37 +0800
Subject: [PATCH 1/4] feat(providers): complete manual pause and resume for API
 key pools

---
 .../provider-workspace/ProviderAuthPanel.tsx  |  15 +-
 .../components/provider-workspace/types.ts    |   1 +
 gui/src/hooks/useProviderAccountPools.ts      |  76 +++++-
 gui/src/pages/Providers.tsx                   |   3 +-
 gui/tests/account-pause-display.test.tsx      |  18 ++
 .../provider-account-pause-refresh.test.tsx   |  20 ++
 src/adapters/google.ts                        |   3 +
 src/cli/account-extended.ts                   |   9 +-
 src/codex/catalog/provider-models.ts          |   3 +-
 src/oauth/index.ts                            |   4 +-
 src/providers/api-key-pause.ts                |  44 +++-
 src/providers/api-keys.ts                     |   9 +-
 src/providers/key-failover.ts                 |   7 +-
 src/providers/openai-sidecar.ts               |   6 +
 src/providers/quota-key-accounts.ts           |  17 +-
 src/router.ts                                 |   2 +
 src/server/auth-cors.ts                       |   2 +-
 src/server/chat-native.ts                     |   9 +
 src/server/images.ts                          |  12 +-
 src/server/management/oauth-account-routes.ts |  30 ++-
 src/server/management/provider-routes.ts      |   3 +-
 src/server/messages-native.ts                 |   5 +
 src/server/responses/request-transport.ts     |  29 ++-
 src/server/responses/run-turn-execution.ts    |  28 ++-
 structure/transports/inventory.md             |   2 +-
 tests/cli/cli-account-key-pause.test.ts       |  21 ++
 .../api-key-auto-pause-distribution.test.ts   | 216 ++++++++++++++++++
 27 files changed, 547 insertions(+), 47 deletions(-)

diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index d6f6b0c833c..5471a9dd786 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -724,15 +724,28 @@ export default function ProviderAuthPanel({
                     <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
-                      disabled={entry.active && !entry.disabled} aria-label={entry.disabled ? `${t("codexAuth.resume")} — ${entry.label ?? entry.masked}` : undefined}>
+                      disabled={(entry.active && !entry.disabled) || busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)} aria-label={entry.disabled ? `${t("codexAuth.resume")} — ${entry.label ?? entry.masked}` : undefined}>
                       <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
                         {entry.label && <code className="pwi-auth-row-secondary">{entry.masked} · {t("prov.accountId")}: {entry.id}</code>}
+                        {entry.disabled && (
+                          <span className="pwi-auth-row-secondary faint">{t("pws.accountPausedHint")}</span>
+                        )}
                       </span>
                       {entry.disabled && <span className="badge badge-muted" title={entry.pauseDetails ? formatAccountPauseTooltip(t, locale, entry.pauseDetails) : undefined}>{t("codexAuth.paused")} · {t("codexAuth.resume")}</span>}
                       {entry.active && !entry.disabled && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                     </button>
+                    {authHandlers.onPauseApiKey && (
+                      <button type="button" className="btn btn-ghost btn-sm"
+                        aria-label={`${t(entry.disabled ? "codexAuth.resume" : "codexAuth.pause")} — ${entry.label ?? entry.masked}`}
+                        title={entry.disabled ? t("pws.accountPausedHint") : undefined}
+                        aria-busy={pausingAccountId === entry.id}
+                        disabled={busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)}
+                        onClick={() => void authHandlers.onPauseApiKey!(item.name, entry, !entry.disabled)}>
+                        {t(entry.disabled ? "codexAuth.resume" : "codexAuth.pause")}
+                      </button>
+                    )}
                     <button type="button" className="btn btn-ghost btn-sm"
                       onClick={() => void authHandlers.onEditAlias(item.name, "api-key", entry.id, entry.label)}>
                       {t("prov.editAlias")}
diff --git a/gui/src/components/provider-workspace/types.ts b/gui/src/components/provider-workspace/types.ts
index 09933657ee3..bf6ca8cd280 100644
--- a/gui/src/components/provider-workspace/types.ts
+++ b/gui/src/components/provider-workspace/types.ts
@@ -106,6 +106,7 @@ export interface ProviderAuthHandlers {
   onRetryAccounts?: (provider: string) => void | Promise<void>;
   onAddApiKey: (provider: string, key: string) => Promise<boolean>;
   onSwitchApiKey: (provider: string, entry: ApiKeyRow) => void | Promise<void>;
+  onPauseApiKey?: (provider: string, entry: ApiKeyRow, paused: boolean) => void | Promise<void>;
   onRemoveApiKey: (provider: string, entry: ApiKeyRow) => void | Promise<void>;
   onEditAlias: (provider: string, type: "oauth" | "api-key", id: string, current?: string) => void | Promise<void>;
   /**
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index 81011166529..b3f4390cfb5 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -550,7 +550,7 @@ export function useProviderAccountPools(deps: {
   };
 
   const switchApiKey = async (provider: string, entry: ApiKeyEntry) => {
-    if (entry.active && !entry.disabled || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    if (entry.active && !entry.disabled || switchingAccountRef.current.has(provider) || pausingAccountRef.current.has(provider) || selectionMutationsRef.current.has(`key:${provider}`)) return;
     const key = invalidateSelectionReads(provider, "api-key");
     const mutation = Symbol();
     selectionMutationsRef.current.set(key, mutation);
@@ -588,6 +588,78 @@ export function useProviderAccountPools(deps: {
     }
   };
 
+  const pauseApiKey = async (provider: string, entry: ApiKeyEntry, paused: boolean) => {
+    if (switchingAccountRef.current.has(provider) || pausingAccountRef.current.has(provider) || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    const target = { provider, accountId: entry.id };
+    pausingAccountRef.current.set(provider, target);
+    setPausingAccounts(current => ({ ...current, [provider]: { ...target, paused } }));
+    const key = invalidateSelectionReads(provider, "api-key");
+    const mutation = Symbol();
+    selectionMutationsRef.current.set(key, mutation);
+    const currentMutation = () => aliveRef.current && mountedRef.current && serverRef.current === apiBase
+      && selectionMutationsRef.current.get(key) === mutation;
+    const label = entry.label ?? entry.masked;
+    let result: { activeId?: string | null; activeAccountId?: string | null; activeAccountChanged?: boolean };
+    try {
+      const res = await fetch(`${apiBase}/api/providers/keys/pause`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: provider, id: entry.id, paused }),
+      });
+      if (!currentMutation()) return;
+      if (!res.ok) {
+        notify(t(paused ? "codexAuth.pauseFailed" : "codexAuth.resumeFailed", { email: label }), false);
+        return;
+      }
+      result = await res.json().catch(() => ({})) as { activeId?: string | null; activeAccountId?: string | null; activeAccountChanged?: boolean };
+      if (!currentMutation()) return;
+      invalidateSelectionReads(provider, "api-key");
+      setKeyPools(current => {
+        const existing = current[provider];
+        if (!existing) return current;
+        const rows = existing.map(row => row.id === entry.id
+          ? { ...row, disabled: paused, ...(paused ? {} : { pauseDetails: undefined }) }
+          : row);
+        const idx = rows.findIndex(row => row.id === entry.id);
+        const ordered = idx >= 0 ? [...rows.slice(idx + 1), ...rows.slice(0, idx)] : rows;
+        const fallbackSelected = paused && entry.active
+          ? ordered.find(row => !row.disabled)?.id ?? null
+          : !paused && !rows.some(row => row.active && !row.disabled)
+            ? entry.id
+            : rows.find(row => row.active)?.id ?? null;
+        const selected = result.activeId !== undefined
+          ? result.activeId
+          : result.activeAccountId !== undefined
+            ? result.activeAccountId
+            : fallbackSelected;
+        return { ...current, [provider]: selectionRows(rows, selected) };
+      });
+      selectionMutationsRef.current.delete(key);
+    } catch {
+      if (currentMutation()) notify(t(paused ? "codexAuth.pauseFailed" : "codexAuth.resumeFailed", { email: label }), false);
+      return;
+    } finally {
+      if (currentMutation()) {
+        invalidateSelectionReads(provider, "api-key");
+        selectionMutationsRef.current.delete(key);
+        void refreshAccountRosters({ provider, kind: "api-key" });
+      }
+      if (pausingAccountRef.current.get(provider) === target) {
+        pausingAccountRef.current.delete(provider);
+        if (aliveRef.current) setPausingAccounts(current => { const next = { ...current }; delete next[provider]; return next; });
+      }
+    }
+    if (!aliveRef.current || !mountedRef.current || serverRef.current !== apiBase) return;
+    notify(t(paused ? "codexAuth.pauseSucceeded" : "codexAuth.resumeSucceeded", { email: label }), true);
+    try {
+      const refreshed = await refreshAccountRosters({ provider, kind: "api-key" });
+      if (result.activeAccountChanged) await Promise.all([fetchConfig(), fetchProviderQuotas(true)]);
+      if (!refreshed) notify(t("pws.accountsLoadFailed"), false);
+    } catch {
+      if (aliveRef.current && mountedRef.current) notify(t("pws.accountsLoadFailed"), false);
+    }
+  };
+
   const removeApiKey = async (provider: string, entry: ApiKeyEntry) => {
     const consented = await confirmAction({
       message: t("prov.keyRemoveConfirm", { key: entry.label ?? entry.masked }),
@@ -712,7 +784,7 @@ export function useProviderAccountPools(deps: {
   return {
     accountSets, accountLoadStates, switchingAccount, pausingAccount, switchingAccounts, pausingAccounts, openAccounts, keyPools, addingKeyFor, newKeyValue,
     setAccountSets, setAccountLoadStates, setSwitchingAccount, setOpenAccounts, setKeyPools, setAddingKeyFor, setNewKeyValue,
-    fetchAccountSets, fetchKeyPools, refreshAccountRosters, switchAccount, pauseAccount, setAccountPoolThreshold, setAccountThreshold, switchApiKey, removeApiKey, addApiKeyValue, addApiKey, editCredentialAlias, removeAccount,
+      fetchAccountSets, fetchKeyPools, refreshAccountRosters, switchAccount, pauseAccount, setAccountPoolThreshold, setAccountThreshold, switchApiKey, pauseApiKey, removeApiKey, addApiKeyValue, addApiKey, editCredentialAlias, removeAccount,
     oauthCardProviders, keyCardProviders, activeAccountNeedsReauth,
   };
 }
diff --git a/gui/src/pages/Providers.tsx b/gui/src/pages/Providers.tsx
index 9c0883a4f91..a71b31ef3c8 100644
--- a/gui/src/pages/Providers.tsx
+++ b/gui/src/pages/Providers.tsx
@@ -389,7 +389,7 @@ export default function Providers({ apiBase }: { apiBase: string }) {
   const {
     accountSets, setAccountSets, accountLoadStates, switchingAccounts, pausingAccounts, keyPools, fetchAccountSets, fetchKeyPools,
     refreshAccountRosters, oauthCardProviders, keyCardProviders,
-    switchAccount, pauseAccount, setAccountPoolThreshold, setAccountThreshold, switchApiKey, removeApiKey, addApiKeyValue, editCredentialAlias,
+    switchAccount, pauseAccount, setAccountPoolThreshold, setAccountThreshold, switchApiKey, pauseApiKey, removeApiKey, addApiKeyValue, editCredentialAlias,
     removeAccount, activeAccountNeedsReauth,
   } = pools;
   const refreshSelection = useCallback((target?: AccountSelectionTarget) => {
@@ -593,6 +593,7 @@ export default function Providers({ apiBase }: { apiBase: string }) {
     onRetryAccounts: async provider => { await fetchAccountSets([provider]); },
     onAddApiKey: addApiKeyValue,
     onSwitchApiKey: switchApiKey,
+    onPauseApiKey: pauseApiKey,
     onRemoveApiKey: removeApiKey,
     onEditAlias: editCredentialAlias,
     onRefreshQuota: refreshProviderQuota,
diff --git a/gui/tests/account-pause-display.test.tsx b/gui/tests/account-pause-display.test.tsx
index 47fcf8ce490..059e4830f87 100644
--- a/gui/tests/account-pause-display.test.tsx
+++ b/gui/tests/account-pause-display.test.tsx
@@ -54,6 +54,24 @@ test.each(["fr", "ko"] as const)("provider OAuth and key tooltips use the app lo
   }
 });
 
+test("API-key pool rows render dedicated Pause and Resume buttons when onPauseApiKey is supplied", () => {
+  const locale = "en";
+  const t = translator(locale);
+  const item = { name: "google-vertex", authMode: "key", adapter: "google", hasApiKey: true } as WorkspaceItem;
+  const win = render(<ProviderAuthPanel item={item} apiBase="" oauth={{ loggedIn: false }}
+    authHandlers={{ ...handlers, onPauseApiKey() {} }}
+    keys={[
+      { id: "k1", label: "Primary Vertex", masked: "AIza****1111", active: true, disabled: false },
+      { id: "k2", label: "Backup Vertex", masked: "AIza****2222", active: false, disabled: true, pauseDetails: details },
+    ]} />, locale);
+  try {
+    const buttons = Array.from(win.document.querySelectorAll("button")).map(btn => btn.getAttribute("aria-label")).filter(Boolean);
+    expect(buttons).toContain(`${t("codexAuth.pause")} — Primary Vertex`);
+    expect(buttons).toContain(`${t("codexAuth.resume")} — Backup Vertex`);
+    expect(win.document.body.textContent).toContain(t("pws.accountPausedHint"));
+  } finally { void win.happyDOM.close(); }
+});
+
 test("Codex tooltip shares the translated reason and app locale date", () => {
   const locale = "fr";
   const t = translator(locale);
diff --git a/gui/tests/provider-account-pause-refresh.test.tsx b/gui/tests/provider-account-pause-refresh.test.tsx
index 5c6f1b32fc0..f8d90603e70 100644
--- a/gui/tests/provider-account-pause-refresh.test.tsx
+++ b/gui/tests/provider-account-pause-refresh.test.tsx
@@ -247,3 +247,23 @@ test.each(["http", "transport"])("a resumed key reports partial success when act
   expect(notices.some(notice => notice.key === "prov.keySwitchFail")).toBe(false);
   expect(pools.keyPools.fixture[0]?.disabled).toBe(false);
 });
+
+test("pauseApiKey pauses active key with ring-order fallback and refreshes roster", async () => {
+  const k1 = { id: "k1", label: "Key 1", masked: "****1", active: false, disabled: false };
+  const k2 = { id: "k2", label: "Key 2", masked: "****2", active: true, disabled: false };
+  const k3 = { id: "k3", label: "Key 3", masked: "****3", active: false, disabled: false };
+  const writes: Array<{ path: string; body: unknown }> = [];
+  respond = async (url, init) => {
+    if (init?.method === "PUT") {
+      writes.push({ path: url, body: JSON.parse(String(init.body)) });
+      return Response.json({ ok: true, activeId: "k3", activeAccountChanged: true });
+    }
+    return Response.json({ activeId: "k3", keys: [k1, { ...k2, active: false, disabled: true }, { ...k3, active: true }] });
+  };
+  await act(async () => { pools.setKeyPools({ fixture: [k1, k2, k3] }); });
+  await act(async () => { await pools.pauseApiKey("fixture", k2, true); });
+  expect(writes).toEqual([{ path: "/pause-hook/api/providers/keys/pause", body: { name: "fixture", id: "k2", paused: true } }]);
+  expect(pools.keyPools.fixture.find(r => r.id === "k2")?.disabled).toBe(true);
+  expect(pools.keyPools.fixture.find(r => r.id === "k3")?.active).toBe(true);
+  expect(notices).toContainEqual({ key: "codexAuth.pauseSucceeded", ok: true });
+});
diff --git a/src/adapters/google.ts b/src/adapters/google.ts
index ed55b5870f5..b1bdc08064c 100644
--- a/src/adapters/google.ts
+++ b/src/adapters/google.ts
@@ -20,6 +20,7 @@ import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, too
 import type { OcxTool } from "../types";
 import { contentPartsToText, parseDataUrl } from "./image";
 import { GCP_CREDENTIAL_MARKER_PREFIX, gcpCredentialMarkerAccount, getVertexAccessToken } from "../lib/gcp-adc";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../providers/api-key-pause";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncatedTurn, vertexTruncationErrorEvent } from "./google-truncation";
@@ -1201,6 +1202,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
         return { url, method: "POST", headers, body: JSON.stringify(envelope) };
       }
 
+      if (isProviderApiKeyPaused(provider)) throw new ProviderApiKeyPausedError();
+
       if (provider.googleMode === "vertex") {
         const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
         reportToolSchemaLoss(compiled.toolSchemaLossReport);
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index d7f635fd50a..e1e00033949 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -848,7 +848,14 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
     const result = await apiJson(deps, baseUrl, "PUT", "/api/providers/keys/pause", { name, id: target.id, paused });
     if (result.status === 0) return proxyUnreachable(result.transportError);
     if (result.status !== 200) return apiError(result.json, `failed to ${verb} account`, result.status);
-    console.log(wantsJson ? JSON.stringify({ ok: true, provider: name, id: target.id, paused }, null, 2) : `${name}: account ${paused ? "paused" : "resumed"}`);
+    if (wantsJson) {
+      console.log(JSON.stringify({ ok: true, provider: name, id: target.id, paused }, null, 2));
+    } else {
+      console.log(`${name}: account ${paused ? "paused" : "resumed"}`);
+      if (result.json.activeAccountChanged === true) {
+        console.error(`Active account changed to ${String(result.json.activeAccountId ?? result.json.activeId ?? "none")}.`);
+      }
+    }
     return 0;
   }
   if (classified.type !== "codex") {
diff --git a/src/codex/catalog/provider-models.ts b/src/codex/catalog/provider-models.ts
index a2d680ce29b..dc8d01e3593 100644
--- a/src/codex/catalog/provider-models.ts
+++ b/src/codex/catalog/provider-models.ts
@@ -9,6 +9,7 @@ import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, expandUserPath, getConfigDir, websocketsEnabled } from "../../config";
+import { isProviderApiKeyPaused } from "../../providers/api-key-pause";
 import { resolveProviderApiKey } from "../../providers/key-store";
 import { captureOAuthAccountSelection, credentialGeneration, getAccountCredentialWithStatus, getAccountSet } from "../../oauth/store";
 import { readKiroAccountModels, kiroObservedContextWindow } from "../../providers/kiro-model-catalog";
@@ -637,7 +638,7 @@ export async function fetchProviderModelsWithAuth(
       "degraded",
     );
   }
-  if (prov.authMode === "oauth" && !apiKey) {
+  if ((prov.authMode === "oauth" && !apiKey) || isProviderApiKeyPaused(prov)) {
     // No usable token (logged out, or account marked needsReauth). Still surface the
     // configured static catalog so the GUI Models tab / rail counts are not empty —
     // matching Cursor's !apiKey → configured degradation and fetch-failure fallback.
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index ef793933a56..8862b9c8aba 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -458,8 +458,8 @@ export class OAuthLoginRequiredError extends Error {
 
 /** An operator-paused account is temporarily unavailable, not an invalid login. */
 export class OAuthAccountPausedError extends Error {
-  constructor() {
-    super("OAuth account is paused. Resume it in account settings and retry.");
+  constructor(message = "OAuth account is paused. Resume it in account settings and retry.") {
+    super(message);
     this.name = "OAuthAccountPausedError";
   }
 }
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
index bae072b82f3..4890828dc1b 100644
--- a/src/providers/api-key-pause.ts
+++ b/src/providers/api-key-pause.ts
@@ -1,12 +1,33 @@
 import { accountAutoPauseFenceMatchesDisk, type AccountAutoPauseFence } from "../config/account-auto-pause-revisions";
 import { randomUUID } from "node:crypto";
-import type { OcxConfig } from "../types";
+import { OAuthAccountPausedError } from "../oauth";
+import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { ProviderApiKeySelection } from "../types/provider";
 import type { AccountPauseDetails } from "../types/account-auto-pause";
 import { apiKeyPoolEntryId } from "./api-keys";
 import { resolveProviderApiKey } from "./api-key-resolve";
 import { commitProviderApiKeySelection } from "./api-key-selection";
 
+export class ProviderApiKeyPausedError extends OAuthAccountPausedError {
+  constructor() {
+    super("API key is paused. Resume it in account settings and retry.");
+    this.name = "ProviderApiKeyPausedError";
+  }
+}
+
+export function isProviderApiKeyPaused(provider: OcxProviderConfig | undefined): boolean {
+  if (!provider || provider.authMode === "oauth" || provider.authMode === "forward" || provider.authMode === "local") {
+    return false;
+  }
+  const pool = provider.apiKeyPool;
+  if (!pool?.length) return false;
+  if (pool.every(entry => entry.disabled === true)) return true;
+  const ref = provider._apiKeyAttempt?.reference ?? provider.apiKey;
+  if (!ref?.trim()) return false;
+  return pool.some(entry => entry.disabled === true && entry.key === ref)
+    && !pool.some(entry => !entry.disabled && entry.key === ref);
+}
+
 export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
   automatic?: { fence: AccountAutoPauseFence; selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
   const result = commitProviderApiKeySelection(config, name, provider => {
@@ -17,15 +38,32 @@ export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: str
     if (!entry || automatic && (entry.disabled || entry.key !== automatic.selection.reference || entry.pauseRevision !== automatic.pauseRevision
       || provider.accountAutoPause?.enabled !== true || resolveProviderApiKey(entry.key) !== automatic.resolvedKey)) return { changed: false, value: false };
     provider.apiKeyPool = pool;
+    const idx = pool.indexOf(entry);
+    const ordered = idx >= 0 ? [...pool.slice(idx + 1), ...pool.slice(0, idx)] : pool;
+    const activeDisabled = () => !provider.apiKey
+      || (pool.some(e => e.disabled && e.key === provider.apiKey) && !pool.some(e => !e.disabled && e.key === provider.apiKey));
+    if (!automatic && Boolean(entry.disabled) === paused) {
+      if (paused && provider.apiKey === entry.key) {
+        const next = ordered.find(e => !e.disabled);
+        if (next) provider.apiKey = next.key;
+        else delete provider.apiKey;
+        return { changed: true, selectionChanged: true, value: true };
+      }
+      if (!paused && activeDisabled()) {
+        provider.apiKey = entry.key;
+        return { changed: true, selectionChanged: true, value: true };
+      }
+      return { changed: false, value: true };
+    }
     entry.disabled = paused;
     entry.pauseRevision = randomUUID();
     if (automatic) entry.pauseDetails = automatic.details;
     else delete entry.pauseDetails;
     if (paused && provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool?.find(e => !e.disabled);
+      const next = ordered.find(e => !e.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
-    } else if (!paused && !provider.apiKey) provider.apiKey = entry.key;
+    } else if (!paused && activeDisabled()) provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
   }, automatic?.selection);
   return result.status === "committed" && result.value;
diff --git a/src/providers/api-keys.ts b/src/providers/api-keys.ts
index 4ced73a61e5..a145ac1677e 100644
--- a/src/providers/api-keys.ts
+++ b/src/providers/api-keys.ts
@@ -276,7 +276,8 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
               pool.push({ id, key: marker, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
             }
           }
-          fresh.apiKey = stored[0]!.marker;
+          const activeCandidate = stored.find(({ id }) => !pool.find(e => e.id === id)?.disabled);
+          if (activeCandidate) fresh.apiKey = activeCandidate.marker;
           return { changed: true, selectionChanged: true, value: stored[0]!.id };
         });
         if (committed.status === "committed") {
@@ -345,10 +346,14 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
       : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
     const entry = pool.find(e => e.id === id);
     if (!entry) return { changed: false, value: false };
+    const idx = pool.indexOf(entry);
     removed = entry.key;
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
+      const ordered = idx >= 0
+        ? [...provider.apiKeyPool.slice(idx), ...provider.apiKeyPool.slice(0, idx)]
+        : provider.apiKeyPool;
+      const next = ordered.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }
diff --git a/src/providers/key-failover.ts b/src/providers/key-failover.ts
index 2c02f9a0ca8..57351f293ad 100644
--- a/src/providers/key-failover.ts
+++ b/src/providers/key-failover.ts
@@ -20,6 +20,7 @@ import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, ResetReplayPol
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { ProviderApiKeyPausedError } from "./api-key-pause";
 // quota-key-accounts imports only node:crypto, the key store and the quota types -- NOT
 // providers/quota.ts -- so the cached reader reaches the dispatch path without dragging the
 // probe machinery onto it.
@@ -486,12 +487,13 @@ export function selectProactiveApiKey(
 ): OcxProviderConfig | null {
   const provider = config.providers?.[providerName];
   if (!provider) return null;
-  const strategy = provider.apiKeyPoolStrategy;
-  if (!strategy) return null;
   if (!hasKeyPoolFailover(provider)) return null;
   const pool = provider.apiKeyPool ?? [];
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
+  const activeDisabled = Boolean(activeEntry?.disabled || (!provider.apiKey && pool.some(entry => entry.disabled)));
+  const strategy = provider.apiKeyPoolStrategy ?? (activeDisabled ? "fill-first" : undefined);
+  if (!strategy) return null;
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
   if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
@@ -565,6 +567,7 @@ export function selectProactiveApiKeyTransport(
 const dispatchKeyCursor = new Map<string, string>();
 function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
   const pool = (provider.apiKeyPool ?? []).filter(entry => !entry.disabled).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  if (pool.length === 0) throw new ProviderApiKeyPausedError();
   const previous = dispatchKeyCursor.get(providerName);
   const start = pool.findIndex(entry => entry.id === previous);
   for (let offset = 1; offset <= pool.length; offset++) {
diff --git a/src/providers/openai-sidecar.ts b/src/providers/openai-sidecar.ts
index c68c0c73e7b..5f18ce05317 100644
--- a/src/providers/openai-sidecar.ts
+++ b/src/providers/openai-sidecar.ts
@@ -1,4 +1,5 @@
 import { resolveProviderApiKey } from "./key-store";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "./api-key-pause";
 import { createOpenAiSidecarCreditGuard } from "./openai-sidecar-credit";
 import {
   CodexPoolAuthenticationError,
@@ -56,6 +57,7 @@ export interface OpenAiImagesProviderSelection {
     provider: OcxProviderConfig;
     apiKey: string;
   };
+  paused?: boolean;
   error?: string;
 }
 
@@ -295,6 +297,7 @@ export function selectOpenAiImagesProvider(config: OcxConfig): OpenAiImagesProvi
     && provider.authMode !== "forward"
     && provider.baseUrl.replace(/\/+$/, "") === "https://api.openai.com/v1"
   ) {
+    if (isProviderApiKeyPaused(provider)) return selection;
     const apiKey = resolveProviderApiKey(provider.apiKey)?.trim();
     if (apiKey) selection.keyed = { providerName: OPENAI_API_PROVIDER_ID, provider, apiKey };
   }
@@ -332,6 +335,9 @@ export function selectImagesProvider(config: OcxConfig): OpenAiImagesProviderSel
       error: `images.provider "${providerName}" must be an API-key openai-responses provider`,
     };
   }
+  if (isProviderApiKeyPaused(provider)) {
+    return { forwardCandidates: [], paused: true, error: new ProviderApiKeyPausedError().message };
+  }
 
   const apiKey = resolveProviderApiKey(provider.apiKey)?.trim();
   if (!apiKey) {
diff --git a/src/providers/quota-key-accounts.ts b/src/providers/quota-key-accounts.ts
index 21d41242016..fd280d43a1b 100644
--- a/src/providers/quota-key-accounts.ts
+++ b/src/providers/quota-key-accounts.ts
@@ -174,12 +174,19 @@ export async function readProviderApiKeyQuotas(
         return !!currentKey && identity(name, current, row.id, currentKey) === key;
       } catch { return false; }
     };
+    const isPaused = () => row.disabled === true
+      || roster(config.providers[name] ?? providerSnapshot).find(candidate => candidate.id === row.id)?.disabled === true;
+    const cached = key ? cache.get(key) : undefined;
     const entry = key && resolved && isCurrent()
-      ? await readEntry(key, force, isCurrent, () => {
-          const isolatedProvider = { ...providerSnapshot, apiKey: resolved, apiKeyPool: undefined };
-          const isolatedConfig = { ...config, providers: { [name]: isolatedProvider } };
-          return probe(isolatedProvider, isolatedConfig);
-        })
+      ? isPaused()
+        ? (cached && (!cached.quota || Date.now() - cached.quota.updatedAt < LAST_GOOD_MS)
+          ? cached
+          : { ts: Date.now(), quota: null, unavailable: true as const })
+        : await readEntry(key, force, isCurrent, () => {
+            const isolatedProvider = { ...providerSnapshot, apiKey: resolved, apiKeyPool: undefined };
+            const isolatedConfig = { ...config, providers: { [name]: isolatedProvider } };
+            return probe(isolatedProvider, isolatedConfig);
+          })
       : { ts: Date.now(), quota: null, unavailable: true as const };
     const result = {
       keyId: row.id,
diff --git a/src/router.ts b/src/router.ts
index e495ad79a61..bf7a5cd9bff 100644
--- a/src/router.ts
+++ b/src/router.ts
@@ -14,6 +14,7 @@ import {
 import type { NormalizedComboConfig } from "./combos/types";
 import { hasOwnProvider } from "./config/provider-name";
 import { anthropicInstanceRowShapeMatches } from "./providers/anthropic-instance-id";
+import { isProviderApiKeyPaused } from "./providers/api-key-pause";
 import { reconcileRouterWarningMemos, routedProviderConfig } from "./providers/routed-config";
 import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import {
@@ -301,6 +302,7 @@ function crossProviderRedirectTarget(config: OcxConfig, providerName: string, va
       );
       return usable ? value : undefined;
     }
+    if (isProviderApiKeyPaused(effective)) return undefined;
     return authMode === "local" || effective.keyOptional === true || Boolean(effective.apiKey?.trim())
       ? value : undefined;
   } catch {
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index d9ca58b20aa..5f88a0253ef 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -1323,7 +1323,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
   for (const [name, provider] of Object.entries(config.providers)) {
     const dto: Record<string, unknown> = {
       ...editor.providers[name],
-      hasApiKey: !!provider.apiKey,
+      hasApiKey: !!provider.apiKey || (provider.authMode !== "oauth" && provider.authMode !== "forward" && (provider.apiKeyPool?.length ?? 0) > 0),
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
     if (name === "xai") {
diff --git a/src/server/chat-native.ts b/src/server/chat-native.ts
index 314ceaad5c8..1fa376b1a77 100644
--- a/src/server/chat-native.ts
+++ b/src/server/chat-native.ts
@@ -64,6 +64,7 @@ import { fastPolicyForModel } from "../providers/service-tier";
 import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import { stampApiKeyAccountLabel } from "../providers/label";
 import { distributedKeyPhysicalFetch, distributedKeyResponseOwner } from "../providers/api-key-response-ownership";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../providers/api-key-pause";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
 import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate-limit";
 import type { OcxProviderTransport } from "../providers/xai-transport";
@@ -329,8 +330,12 @@ export async function runNativeChatAttempt(
   try {
     const proactiveKeyProvider = selectProactiveApiKeyTransport(config, route.providerName, route.provider);
     if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
+    if (isProviderApiKeyPaused(route.provider)) throw new ProviderApiKeyPausedError();
   } catch (error) {
     cleanupAbort(); upstream.abort();
+    if (error instanceof ProviderApiKeyPausedError) {
+      return fail(403, error.message, "permission_error");
+    }
     if (!(error instanceof RequestPacingQueueOverloadError)) throw error;
     const refusal = fail(429, error.message, "rate_limit_error");
     refusal.headers.set("Retry-After", String(error.retryAfterSeconds));
@@ -491,6 +496,7 @@ export async function runNativeChatAttempt(
                   if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
                 }
                 if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, execution.chatBody, config)) {
+                  if (!current && isProviderApiKeyPaused(config.providers[route.providerName])) throw new ProviderApiKeyPausedError();
                   throw new Error("Provider key selection is no longer available for native Chat");
                 }
                 activeProvider = current;
@@ -662,6 +668,9 @@ export async function runNativeChatAttempt(
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
     const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
+    if (sendError instanceof ProviderApiKeyPausedError) {
+      return fail(403, sendError.message, "permission_error");
+    }
     if (sendError instanceof RequestPacingQueueOverloadError) {
       const refusal = fail(429, sendError.message, "rate_limit_error");
       refusal.headers.set("Retry-After", String(sendError.retryAfterSeconds));
diff --git a/src/server/images.ts b/src/server/images.ts
index 302e49a494c..8353034f382 100644
--- a/src/server/images.ts
+++ b/src/server/images.ts
@@ -30,6 +30,7 @@ import { sidecarEnter } from "../lib/sidecar-tracker";
 import { isNonReplayableResponse } from "../lib/upstream-retry";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectImagesProvider } from "../providers/openai-sidecar";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../providers/api-key-pause";
 import { recordDistributedKeyFailure, selectProactiveApiKeyTransport } from "../providers/key-failover";
 import { requestPacingOverloadResponse } from "./responses/pacing-overload";
 import { getProviderRegistryEntry } from "../providers/registry";
@@ -668,7 +669,7 @@ export async function handleImages(
     if (xaiRelay) return xaiRelay;
   }
   if (candidates.error) {
-    return formatErrorResponse(400, "invalid_request_error", candidates.error);
+    return formatErrorResponse(candidates.paused ? 403 : 400, candidates.paused ? "permission_error" : "invalid_request_error", candidates.error);
   }
   const explicitKeyedProvider = config.images?.provider !== undefined && candidates.keyed !== undefined;
   // Admission bearer is valid proxy auth (requireApiAuth already passed) but must never be
@@ -809,8 +810,13 @@ export async function handleImages(
     // Transport variant: this branch reads `provider.baseUrl` and `provider.headers` to build
     // the URL and the request, and it comes back with the credential already resolved.
     let warmKeyProvider;
-    try { warmKeyProvider = selectProactiveApiKeyTransport(config, providerName, candidates.keyed.provider); }
-    catch (error) {
+    try {
+      warmKeyProvider = selectProactiveApiKeyTransport(config, providerName, candidates.keyed.provider);
+      if (isProviderApiKeyPaused(warmKeyProvider ?? candidates.keyed.provider)) throw new ProviderApiKeyPausedError();
+    } catch (error) {
+      if (error instanceof OAuthAccountPausedError) {
+        return formatErrorResponse(403, "permission_error", error.message);
+      }
       const refusal = requestPacingOverloadResponse(error);
       if (refusal) return refusal;
       throw error;
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index 865995ecbf9..ca0d3a74695 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -1121,9 +1121,28 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
     if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
     if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { listProviderApiKeys } = await import("../../providers/api-keys");
+    const beforeActiveId = listProviderApiKeys(config, body.name).activeId;
     const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
-    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
-      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+    if (!setProviderApiKeyPaused(config, body.name, body.id, body.paused)) {
+      return jsonResponse({ error: "key not found" }, 404);
+    }
+    const activeId = listProviderApiKeys(config, body.name).activeId;
+    const activeAccountChanged = beforeActiveId !== activeId;
+    const { clearKeyCooldowns, forgetApiKeyRotationCursor } = await import("../../providers/key-failover");
+    clearKeyCooldowns(body.name);
+    forgetApiKeyRotationCursor(body.name);
+    if (activeAccountChanged) {
+      const { clearModelCache } = await import("../../codex/model-cache");
+      clearModelCache(body.name);
+      clearProviderQuotaCacheFor(body.name);
+    }
+    return jsonResponse({
+      ok: true,
+      activeId,
+      activeAccountId: activeId,
+      activeAccountChanged,
+    });
   }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
@@ -1131,7 +1150,12 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     if (!body.id) return jsonResponse({ error: "missing id" }, 400);
     const { setActiveProviderApiKey } = await import("../../providers/api-keys");
-    if (!setActiveProviderApiKey(config, name, body.id)) return jsonResponse({ error: "key not found" }, 404);
+    if (!setActiveProviderApiKey(config, name, body.id)) {
+      if (config.providers[name]?.apiKeyPool?.some(e => e.id === body.id && e.disabled)) {
+        return jsonResponse({ error: "API key is paused; resume it first" }, 409);
+      }
+      return jsonResponse({ error: "key not found" }, 404);
+    }
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const { clearProviderQuotaCache } = await import("../../providers/quota");
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index 340a245fd93..b742fb703f2 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -902,7 +902,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
-      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel, hasApiKey: !!p.apiKey,
+      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
+      hasApiKey: !!p.apiKey || (p.authMode !== "oauth" && p.authMode !== "forward" && (p.apiKeyPool?.length ?? 0) > 0),
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
diff --git a/src/server/messages-native.ts b/src/server/messages-native.ts
index 192a8d92d23..3203adf89d6 100644
--- a/src/server/messages-native.ts
+++ b/src/server/messages-native.ts
@@ -64,6 +64,7 @@ import {
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
 import { distributedKeyPhysicalFetch, distributedKeyResponseOwner, recordDistributedResponseFailure } from "../providers/api-key-response-ownership";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../providers/api-key-pause";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
 import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import {
@@ -447,8 +448,11 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     try {
       const proactiveKeyProvider = selectProactiveApiKeyTransport(config, route.providerName, route.provider);
       if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
+      if (isProviderApiKeyPaused(route.provider)) throw new ProviderApiKeyPausedError();
     } catch (error) {
       cleanupAbort(); upstream.abort();
+      const localRefusal = localOAuthFailure(error);
+      if (localRefusal) return localRefusal;
       if (!(error instanceof RequestPacingQueueOverloadError)) throw error;
       const refusal = fail(429, error.message, "rate_limit_error");
       refusal.headers.set("Retry-After", String(error.retryAfterSeconds));
@@ -591,6 +595,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
                   if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
                 }
                 if (!current || nativeMessagesDeclineReason({ ...route, provider: current }, body, config, selector) !== undefined) {
+                  if (!current && isProviderApiKeyPaused(config.providers[route.providerName])) throw new ProviderApiKeyPausedError();
                   throw new Error("Provider key selection is no longer available for native Messages");
                 }
                 rebuildFor(current);
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 42ca8b7723a..2ec06591ef6 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -70,6 +70,7 @@ import {
   providerApiKeySelectionIsCurrent,
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../../providers/api-key-pause";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
 import { physicalSendObserverInit, providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
 import type { ProviderFetchOptions } from "./fetch-helpers";
@@ -639,7 +640,10 @@ export async function prepareResponsesTransport(
         const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...route.provider, _apiKeyAttempt: undefined });
         if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
       }
-      if (!current) throw new Error("API key selection is unavailable before dispatch");
+      if (!current) {
+        if (isProviderApiKeyPaused(config.providers[route.providerName])) throw new ProviderApiKeyPausedError();
+        throw new Error("API key selection is unavailable before dispatch");
+      }
       route.provider = current;
       await resolveCopilotSelection(requestParsed, true);
     }
@@ -1088,13 +1092,24 @@ export async function prepareResponsesTransport(
   // The Transport variant, not the bare picker: the picker answers with the PERSISTED row, and
   // a built-in provider stored in its valid minimal form would lose the adapter id, base URL
   // and static headers registry backfill supplies, throwing `Unknown adapter: undefined`.
-  const proactiveKeyProvider = selectProactiveApiKeyTransport(
-    config,
-    route.providerName,
-    route.provider,
-    parsed.options.promptCacheKey,
-  );
+  let proactiveKeyProvider: OcxProviderConfig | null;
+  try {
+    proactiveKeyProvider = selectProactiveApiKeyTransport(
+      config,
+      route.providerName,
+      route.provider,
+      parsed.options.promptCacheKey,
+    );
+  } catch (err) {
+    if (err instanceof OAuthAccountPausedError) {
+      return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(err));
+    }
+    throw err;
+  }
   if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
+  if (isProviderApiKeyPaused(route.provider)) {
+    return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(new ProviderApiKeyPausedError()));
+  }
   route.provider = resolveProviderTransport(
     route.providerName,
     route.provider,
diff --git a/src/server/responses/run-turn-execution.ts b/src/server/responses/run-turn-execution.ts
index f869414bde5..99a64dc78af 100644
--- a/src/server/responses/run-turn-execution.ts
+++ b/src/server/responses/run-turn-execution.ts
@@ -266,6 +266,7 @@ export async function executeResponsesRunTurn(
     const failedKeys = new Set<string>();
     const keyAttemptLimit = route.provider.apiKeyPool?.length ?? 0;
     let lastKeyFailure: Extract<AdapterEvent, { type: "error" }> | undefined;
+    let authRecoveryRefusal: Response | undefined;
     let runTurnAttemptSeq = 0;
     const runTurnAttempt = async (
       targetQueue: AdapterEventQueue,
@@ -372,8 +373,13 @@ export async function executeResponsesRunTurn(
           Object.assign(parsed, routeState);
         }
       } catch (err) {
-        const storageRefusal = mapSpendLedgerStorageError(err, logCtx);
-        emit(storageRefusal ? { type: "error", ...storageRefusal } : err instanceof RequestPacingQueueOverloadError
+        if (err instanceof OAuthAccountPausedError) {
+          const message = publicOAuthAuthenticationErrorMessage(err);
+          authRecoveryRefusal ??= formatErrorResponse(403, "permission_error", message);
+          emit({ type: "error", status: 403, errorType: "permission_error", message });
+        } else {
+          const storageRefusal = mapSpendLedgerStorageError(err, logCtx);
+          emit(storageRefusal ? { type: "error", ...storageRefusal } : err instanceof RequestPacingQueueOverloadError
           ? {
               type: "error",
               status: 429,
@@ -397,6 +403,7 @@ export async function executeResponsesRunTurn(
                 type: "error",
                 message: err instanceof Error ? err.message : String(err),
               });
+        }
       } finally {
         if (attemptSeq === 1) options.comboInitialSend?.permit.release();
         devinProducers.delete(producerAbort);
@@ -477,7 +484,6 @@ export async function executeResponsesRunTurn(
     // selected; the turn then moves to a surviving stored account, or, with none, the client
     // gets the login instruction instead of an opaque upstream 401.
     let oauth401ReplayAttempted = false;
-    let authRecoveryRefusal: Response | undefined;
     const refuseLocalAuthRecovery = (error: Extract<AdapterEvent, { type: "error" }>, cause: unknown): boolean => {
       const cancelled = runTurnAbort.signal.aborted;
       if (!cancelled && !(cause instanceof OAuthTokenRefreshBusyError) && !(cause instanceof OAuthAccountPausedError)) return false;
@@ -961,14 +967,14 @@ export async function executeResponsesRunTurn(
       for await (const event of await preflightRunTurnFailover(
         (async function* () { yield* firstAttemptEvents; })(),
       )) runTurnEvents.push(event);
-      if (authRecoveryRefusal) {
-        cancelResponseCompletion();
-        runTurnAbort.abort();
-        queue.close();
-        cleanupRunTurnAbort();
-        releaseSearchProbeLease();
-        return authRecoveryRefusal;
-      }
+    }
+    if (authRecoveryRefusal) {
+      cancelResponseCompletion();
+      runTurnAbort.abort();
+      queue.close();
+      cleanupRunTurnAbort();
+      releaseSearchProbeLease();
+      return authRecoveryRefusal;
     }
     if (grokDevinPreflight) {
       const preflight = await preflightAdapterEvents(
diff --git a/structure/transports/inventory.md b/structure/transports/inventory.md
index f0c9870e6e7..10a2a7325d1 100644
--- a/structure/transports/inventory.md
+++ b/structure/transports/inventory.md
@@ -45,7 +45,7 @@ surface is listed here so a maintainer can find the owner without grepping:
 | Hosted search relay | `src/server/search.ts`, `src/web-search/devin-executor.ts` | A resolved Devin route uses Cognition's bounded non-inference `GetWebSearchResults` RPC with the active account's credential and allowlisted tenant; other routes use the verbatim ChatGPT relay, or an explicitly configured web-search sidecar backend when no forward provider exists. Distinct from the web-search sidecar loop below. |
 | Image/video generation loop | `src/images/loop.ts`, `src/images/plan.ts`, `src/images/fulfill.ts`, `src/images/xai-client.ts`, `src/images/xai-video-client.ts`, `src/images/artifacts.ts` | A provider-returned image URL is downloaded into a local artifact once, then served locally; warnings stay URL-free because provider CDN URLs may embed credentials. Artifact downloads go through the pinned-IP transport with a 10 s connect deadline (`DOWNLOAD_CONNECT_TIMEOUT_MS`) that bounds TCP/TLS setup on its own, in addition to the 60 s idle timer, and `pinnedHttpsGet` accepts a per-call `connectTimeoutMs`. |
 | GitHub Copilot | `src/providers/xai-transport.ts` (`resolveProviderTransport`), `src/providers/github-copilot-transport.ts` | `resolveProviderTransport` selects the Copilot transport when the routed provider name is `github-copilot`; the Copilot module then resolves its headers and base URL, and the registry seeds the provider row and model fallback. Auto session and intent requests stay on the credential-captured origin; adapter construction follows the [Copilot Auto contract](../providers-and-adapters.md#github-copilot-auto-selection). |
-| API-key pools | `src/providers/api-key-selection.ts`, `src/providers/key-failover.ts` | A configured `apiKeyPoolStrategy` plus a cooling committed key rotates before the first send (`selectProactiveApiKeyTransport`); a 429 still rotates after the send and records a cooldown. `provider.apiKey` keeps mirroring the active entry so routing stays single-key. The pick is inert without a strategy or while the committed key is healthy. |
+| API-key pools | `src/providers/api-key-selection.ts`, `src/providers/key-failover.ts`, `src/providers/api-key-pause.ts` | A configured `apiKeyPoolStrategy` plus a cooling committed key rotates before the first send (`selectProactiveApiKeyTransport`); a 429 still rotates after the send and records a cooldown. `provider.apiKey` keeps mirroring the active entry so routing stays single-key. Paused (`disabled: true`) entries are excluded from proactive selection, reactive failover, and per-key quota probes; if every entry in the pool is paused, inference fails with 403 `permission_error`. |
 | OAuth account failover | `src/oauth/generic-account-failover.ts`, `src/oauth/anthropic-routing.ts`, `src/server/responses/antigravity-validation-refusal.ts`, `src/adapters/antigravity-refusal.ts` | Reactive pre-output 429 recovery is presence-driven with 2+ eligible accounts. Anthropic also handles exact revoked-token 401s under its [reauthentication contract](../providers/anthropic-account-pool.md#revoked-oauth-access-token-recovery) and recovers classified pre-output account-entitlement 403s under its [account-pool contract](../providers/anthropic-account-pool.md#account-entitlement-refusal-recovery), and records the refused account's cooldown even when the request has no retry sends left. Primary Antigravity inference through the Google adapter main dispatch may send once on a live sibling after a replayed 401, a terminal credential-refresh failure that marks the account for reauthentication, or a normalized structured `VALIDATION_REQUIRED` 403, within the existing budget. A bounded message-worded verification 403 persists a generation-fenced `verify_account` cause in `src/oauth/store.ts` and `src/oauth/health.ts`, including singleton and last-account refusals. It reads as `needs-reauth(verify)` in `ocx account list`; silent refresh preserves quarantine, while explicit re-login clears it and retires its failover cooldown. Quarantine does not require a retry slot; if persisting it fails, dispatch exits this adapter exchange’s recovery loop and preserves the original bounded 403 without another recovery send in that exchange; enclosing combo and policy fallback rules remain unchanged. A preserved original 403 after sibling build or pre-send admission failure also exits recovery through common bounded error formatting and the combo failure callback; newly constructed failure responses keep their own delivery. Successful sibling replay uses the captured pool activation and the existing send budget. The 401 and structured 403 sibling paths share one request guard; unrelated 403s and transient refresh failures do not rotate. The fetch web-search sidecar accepts only complete bounded structured `VALIDATION_REQUIRED` 403s through the Google normalizer, carries the sibling token/project without a durable reauthentication mark, and uses adapter-owned physical-send accounting; its contract is [Account refusal and rotation boundaries](responses-failover.md#account-refusal-and-rotation-boundaries). Continuations, native passthrough and image sidecars keep their existing behavior. Generic OAuth accounts can be operator-paused; paused accounts are excluded from selection, failover, and proactive Token Guardian refresh. If every account is paused, the request fails with 403 rather than as a login failure. Pool and `oauthAccountFailover` flags govern proactive routing, not the reactive retry: a disabled Anthropic pool recovers through quota ordering rather than its dormant strategy, a per-provider `enabled` beats the global default in either direction, and a non-positive fill-first threshold disables proactive usage-based rotation. Kiro's `kiroAutoSelection` projects the same candidate eligibility into routing and account-list status; unknown evidence stays eligible, while pause, reauth, suspension, cooldown, and confirmed exhaustion have closed reasons. An active singleton or a pool excluded only from automatic Kiro selection may still attempt its active account; an explicitly paused active account is never dispatched, and an all-paused pool fails with 403. A configured Kiro capacity cap can also time out. Kiro's optional process-local account lease is released at response completion or cancellation; other providers retain their admission path. |
 | OAuth login callback (inbound) | `src/oauth/callback-server.ts` | Every response, including non-callback 404s, closes its connection so a pooled socket cannot deliver a later login to a retired flow on the same callback port. |
 | Alibaba regions | `src/providers/alibaba-region-backup.ts`, `src/providers/alibaba-region-migration.ts`, `src/providers/alibaba-region-startup.ts` | Region migration backs up before rewriting and is idempotent across restarts. |
diff --git a/tests/cli/cli-account-key-pause.test.ts b/tests/cli/cli-account-key-pause.test.ts
index 2c025898af5..3f43c0dcfa4 100644
--- a/tests/cli/cli-account-key-pause.test.ts
+++ b/tests/cli/cli-account-key-pause.test.ts
@@ -58,3 +58,24 @@ test("the defensive pause usage fallback also names API-key pools", async () =>
   const fallback = source.split("\n").find(line => line.includes("${verb} applies to"));
   expect(fallback).toContain('applies to the openai Codex account pool, a generic OAuth provider, or an API-key pool');
 });
+
+test("API-key pause prints active account handoff notice on stderr when activeAccountChanged is true", async () => {
+  const lines: string[] = [], errors: string[] = [];
+  const log = console.log, error = console.error;
+  console.log = value => { lines.push(String(value)); };
+  console.error = value => { errors.push(String(value)); };
+  const deps: AccountDeps = {
+    baseUrl: "http://127.0.0.1:10100",
+    loadConfigImpl: () => ({ providers: { "google-vertex": { adapter: "google", authMode: "key" } } }) as never,
+    fetchImpl: (async (_url, init) => {
+      if (init?.method === "PUT") return Response.json({ ok: true, activeId: "key-2", activeAccountId: "key-2", activeAccountChanged: true });
+      return Response.json({ keys: [{ id: "key-1", label: "primary" }, { id: "key-2", label: "backup" }] });
+    }) as typeof fetch,
+  };
+  try {
+    const code = await cmdPause(["google-vertex", "primary"], deps, true);
+    expect(code).toBe(0);
+    expect(lines).toEqual(["google-vertex: account paused"]);
+    expect(errors).toEqual(["Active account changed to key-2."]);
+  } finally { console.log = log; console.error = error; }
+});
diff --git a/tests/providers/api-key-auto-pause-distribution.test.ts b/tests/providers/api-key-auto-pause-distribution.test.ts
index ce683cbfc2f..ec76530cf72 100644
--- a/tests/providers/api-key-auto-pause-distribution.test.ts
+++ b/tests/providers/api-key-auto-pause-distribution.test.ts
@@ -7,17 +7,21 @@ import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../../src/providers/api-key-selection";
 import { clearKeyCooldowns, forgetApiKeyRotationCursor, selectProactiveApiKeyTransport } from "../../src/providers/key-failover";
 import { routedProviderConfig } from "../../src/router";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 let home: string;
 let previousHome: string | undefined;
+let releaseSpend: () => void;
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
   home = mkdtempSync(join(tmpdir(), "ocx-pause-distribution-"));
   process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
   clearKeyCooldowns(); forgetApiKeyRotationCursor();
 });
 afterEach(() => {
+  releaseSpend();
   clearKeyCooldowns(); forgetApiKeyRotationCursor();
   if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = previousHome;
@@ -76,3 +80,215 @@ test("a disabled distributed selection cannot dispatch even if its revision is u
   const fresh = routedProviderConfig("fixture", config.providers.fixture!);
   for (let n = 0; n < 3; n++) expect(selectProactiveApiKeyTransport(config, "fixture", fresh)?.apiKey).toBe("synthetic-A");
 });
+
+test("setProviderApiKeyPaused rotates in ring order, preserves auto-pause details on idempotent pause, and restores active key on resume", async () => {
+  const { setProviderApiKeyPaused } = await import("../../src/providers/api-key-pause");
+  const config = getDefaultConfig();
+  config.providers = {
+    "google-vertex": {
+      adapter: "google", authMode: "key", googleMode: "vertex", baseUrl: "https://aiplatform.googleapis.com",
+      apiKey: "vertex-B",
+      apiKeyPool: [
+        { id: "A", key: "vertex-A" },
+        { id: "B", key: "vertex-B" },
+        { id: "C", key: "vertex-C" },
+      ],
+    },
+  };
+  saveConfig(config);
+  // Pausing active B advances in ring order to C (not back to index 0 A).
+  expect(setProviderApiKeyPaused(config, "google-vertex", "B", true)).toBe(true);
+  expect(config.providers["google-vertex"]!.apiKey).toBe("vertex-C");
+  // Seed auto-pause details on B and verify manual idempotent pause does not erase them.
+  config.providers["google-vertex"]!.apiKeyPool![1]!.pauseDetails = { reason: "subscription_expired", pausedAt: 12345 };
+  saveConfig(config);
+  expect(setProviderApiKeyPaused(config, "google-vertex", "B", true)).toBe(true);
+  expect(config.providers["google-vertex"]!.apiKeyPool![1]!.pauseDetails).toEqual({ reason: "subscription_expired", pausedAt: 12345 });
+  // Pause C -> wraps around ring to A; pause A -> deletes apiKey.
+  expect(setProviderApiKeyPaused(config, "google-vertex", "C", true)).toBe(true);
+  expect(config.providers["google-vertex"]!.apiKey).toBe("vertex-A");
+  expect(setProviderApiKeyPaused(config, "google-vertex", "A", true)).toBe(true);
+  expect(config.providers["google-vertex"]!.apiKey).toBeUndefined();
+  // Resuming B into an all-paused pool restores B as active and clears pauseDetails.
+  expect(setProviderApiKeyPaused(config, "google-vertex", "B", false)).toBe(true);
+  expect(config.providers["google-vertex"]!.apiKey).toBe("vertex-B");
+  expect(config.providers["google-vertex"]!.apiKeyPool![1]!.pauseDetails).toBeUndefined();
+});
+
+test("all-paused google-vertex and google (AI Studio) pools refuse with 403 permission_error and never leak env or ADC credentials", async () => {
+  const { setProviderApiKeyPaused } = await import("../../src/providers/api-key-pause");
+  const { handleResponses } = await import("../../src/server/responses/core");
+  const { handleChatCompletions } = await import("../../src/server/chat-completions");
+  const { handleClaudeMessages } = await import("../../src/server/claude-messages");
+  const prevEnvKey = process.env.GOOGLE_CLOUD_API_KEY;
+  const prevFetch = globalThis.fetch;
+  process.env.GOOGLE_CLOUD_API_KEY = "leaked-ambient-env-key";
+  let upstreamCalls = 0;
+  globalThis.fetch = (async () => { upstreamCalls++; return new Response("unexpected upstream call", { status: 200 }); }) as typeof fetch;
+  try {
+    const config = getDefaultConfig();
+    config.protocols = { rollout: { managedMessagesNative: true } };
+    config.providers = {
+      "google-vertex": {
+        adapter: "google", authMode: "key", googleMode: "vertex", project: "demo-proj", location: "global",
+        baseUrl: "https://aiplatform.googleapis.com", models: ["gemini-3-flash"],
+        apiKey: "vertex-key-1", apiKeyPool: [{ id: "v1", key: "vertex-key-1" }],
+      },
+      google: {
+        adapter: "google", authMode: "key", baseUrl: "https://generativelanguage.googleapis.com", models: ["gemini-3-flash"],
+        apiKey: "aistudio-key-1", apiKeyPool: [{ id: "g1", key: "aistudio-key-1" }, { id: "g2", key: "aistudio-key-2" }],
+        requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+      },
+      "chat-paused": {
+        adapter: "openai-chat", authMode: "key", baseUrl: "https://example.test/v1", models: ["gpt-4o"],
+        apiKey: "chat-key-1", apiKeyPool: [{ id: "c1", key: "chat-key-1" }, { id: "c2", key: "chat-key-2" }],
+        requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+      },
+      "anth-paused": {
+        adapter: "anthropic", authMode: "key", baseUrl: "https://api.anthropic.com", models: ["claude-sonnet-4-5"],
+        apiKey: "anth-key-1", apiKeyPool: [{ id: "a1", key: "anth-key-1" }, { id: "a2", key: "anth-key-2" }],
+        requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+      },
+    };
+    saveConfig(config);
+    expect(setProviderApiKeyPaused(config, "google-vertex", "v1", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "google", "g1", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "google", "g2", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "chat-paused", "c1", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "chat-paused", "c2", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "anth-paused", "a1", true)).toBe(true);
+    expect(setProviderApiKeyPaused(config, "anth-paused", "a2", true)).toBe(true);
+
+    for (const model of ["google-vertex/gemini-3-flash", "google/gemini-3-flash"]) {
+      const res = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model, input: "hi", stream: false, store: false }),
+      }), config, { model: "", provider: "" });
+      expect(res.status).toBe(403);
+      const body = await res.json() as { error?: { type?: string; message?: string } };
+      expect(body.error?.type).toBe("permission_error");
+      expect(body.error?.message).toContain("API key is paused");
+    }
+    const chatRes = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: "chat-paused/gpt-4o", messages: [{ role: "user", content: "hi" }], stream: false }),
+    }), config, { model: "", provider: "" });
+    expect(chatRes.status).toBe(403);
+    expect((await chatRes.json() as { error?: { type?: string } }).error?.type).toBe("permission_error");
+
+    const msgRes = await handleClaudeMessages(new Request("http://localhost/v1/messages", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: "anth-paused/claude-sonnet-4-5", max_tokens: 32, messages: [{ role: "user", content: "hi" }], stream: false }),
+    }), config, { model: "", provider: "" });
+    expect(msgRes.status).toBe(403);
+    expect((await msgRes.json() as { error?: { type?: string } }).error?.type).toBe("permission_error");
+    expect(upstreamCalls).toBe(0);
+  } finally {
+    globalThis.fetch = prevFetch;
+    if (prevEnvKey === undefined) delete process.env.GOOGLE_CLOUD_API_KEY;
+    else process.env.GOOGLE_CLOUD_API_KEY = prevEnvKey;
+  }
+});
+
+test("readProviderApiKeyQuotas skips probes for paused keys while preserving last-good cached quota", async () => {
+  const { clearProviderApiKeyQuotaCache, readProviderApiKeyQuotas, setCachedProviderApiKeyQuotaForTests } = await import("../../src/providers/quota-key-accounts");
+  clearProviderApiKeyQuotaCache();
+  const config = getDefaultConfig();
+  config.providers = {
+    openrouter: {
+      adapter: "openai-chat", authMode: "key", baseUrl: "https://openrouter.ai/api/v1",
+      apiKey: "key-active",
+      apiKeyPool: [
+        { id: "paused-slot", key: "key-paused", disabled: true },
+        { id: "active-slot", key: "key-active" },
+      ],
+    },
+  };
+  const cachedQuota = { fiveHourPercent: 42, updatedAt: Date.now() };
+  setCachedProviderApiKeyQuotaForTests("openrouter", config.providers.openrouter!, "paused-slot", "key-paused", cachedQuota);
+  const probedKeys: string[] = [];
+  const rows = await readProviderApiKeyQuotas(config, "openrouter", true, async provider => {
+    probedKeys.push(provider.apiKey!);
+    return { kind: "quota", quota: { fiveHourPercent: 15, updatedAt: Date.now() } };
+  });
+  expect(probedKeys).toEqual(["key-active"]);
+  expect(rows.find(r => r.keyId === "paused-slot")?.quota).toEqual(cachedQuota);
+  expect(rows.find(r => r.keyId === "active-slot")?.quota?.fiveHourPercent).toBe(15);
+  clearProviderApiKeyQuotaCache();
+});
+
+test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C sent once, paused B never sent) and management routes enforce 409 on paused activation", async () => {
+  const { handleResponses } = await import("../../src/server/responses/core");
+  const { handleImages } = await import("../../src/server/images");
+  const { handleOauthAccountRoutes } = await import("../../src/server/management/oauth-account-routes");
+  const { fetchProviderModels } = await import("../../src/codex/catalog/provider-models");
+  const prevFetch = globalThis.fetch;
+  const sentKeys: string[] = [];
+  globalThis.fetch = (async (_input, init) => {
+    const h = new Headers(init?.headers);
+    const key = h.get("x-goog-api-key") ?? h.get("authorization") ?? "none";
+    sentKeys.push(key);
+    if (key === "vertex-A") {
+      return Response.json({ error: { code: 429, status: "RESOURCE_EXHAUSTED", message: "quota exceeded" } }, { status: 429 });
+    }
+    return Response.json({
+      candidates: [{ content: { role: "model", parts: [{ text: "ok from C" }] }, finishReason: "STOP" }],
+      usageMetadata: { promptTokenCount: 3, candidatesTokenCount: 2, totalTokenCount: 5 },
+    }, { status: 200 });
+  }) as typeof fetch;
+  try {
+    const config = getDefaultConfig();
+    config.images = { provider: "custom-img" };
+    config.providers = {
+      "google-vertex": {
+        adapter: "google", authMode: "key", googleMode: "vertex", project: "demo-proj", location: "global",
+        baseUrl: "https://aiplatform.googleapis.com", models: ["gemini-3.8-flash"],
+        apiKey: "vertex-A",
+        apiKeyPool: [
+          { id: "A", key: "vertex-A" },
+          { id: "B", key: "vertex-B", disabled: true },
+          { id: "C", key: "vertex-C" },
+        ],
+      },
+      "custom-img": {
+        adapter: "openai-responses", authMode: "key", baseUrl: "https://example.test/v1",
+        apiKeyPool: [{ id: "img-1", key: "img-key-1", disabled: true }],
+      },
+    };
+    saveConfig(config);
+    const res = await handleResponses(new Request("http://localhost/v1/responses", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: "google-vertex/gemini-3.8-flash", input: "ping", stream: false, store: false }),
+    }), config, { model: "", provider: "" });
+    const resText = await res.text();
+    expect(res.status, resText).toBe(200);
+    expect(sentKeys).toEqual(["vertex-A", "vertex-C"]);
+
+    // Activating paused key B via PUT /api/providers/keys/active returns 409 Conflict.
+    const activatePaused = await handleOauthAccountRoutes({
+      req: new Request("http://127.0.0.1/api/providers/keys/active", {
+        method: "PUT", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ name: "google-vertex", id: "B" }),
+      }),
+      url: new URL("http://127.0.0.1/api/providers/keys/active"),
+      config,
+    });
+    expect(activatePaused?.status).toBe(409);
+
+    // Explicit images.provider with all keys paused returns 403 permission_error.
+    const imgRes = await handleImages(new Request("http://localhost/v1/images/generations", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ prompt: "cat" }),
+    }), config, "generations", { model: "", provider: "" });
+    expect(imgRes.status).toBe(403);
+    expect((await imgRes.json() as { error?: { type?: string } }).error?.type).toBe("permission_error");
+
+    // All-paused provider skips live /v1/models discovery without firing upstream fetch.
+    sentKeys.length = 0;
+    const models = await fetchProviderModels("custom-img", { ...config.providers["custom-img"]!, models: ["Static-Model"] });
+    expect(models.map(m => m.id)).toEqual(["Static-Model"]);
+    expect(sentKeys).toEqual([]);
+  } finally {
+    globalThis.fetch = prevFetch;
+  }
+});

From 08d9e9e7e29a062323de26c2d26ba9e59ed5f26a Mon Sep 17 00:00:00 2001
From: chilung <b0423031@gmail.com>
Date: Mon, 19 Oct 2026 01:17:29 +0800
Subject: [PATCH 2/4] fix(providers): address review feedback and eliminate
 unsponsored surface changes

---
 .../provider-workspace/ProviderAuthPanel.tsx  |  2 +-
 gui/src/hooks/useProviderAccountPools.ts      |  3 +-
 gui/src/i18n/de.ts                            |  1 +
 gui/src/i18n/en.ts                            |  1 +
 gui/src/i18n/fr.ts                            |  1 +
 gui/src/i18n/ja.ts                            |  1 +
 gui/src/i18n/ko.ts                            |  1 +
 gui/src/i18n/pt.ts                            |  1 +
 gui/src/i18n/ru.ts                            |  1 +
 gui/src/i18n/tr.ts                            |  1 +
 gui/src/i18n/vi.ts                            |  1 +
 gui/src/i18n/zh-TW.ts                         |  1 +
 gui/src/i18n/zh.ts                            |  1 +
 gui/tests/account-pause-display.test.tsx      |  3 +-
 .../provider-account-pause-refresh.test.tsx   | 14 ++++-
 src/cli/account-extended.ts                   | 24 +++++++--
 src/oauth/index.ts                            |  4 +-
 src/providers/api-key-pause.ts                | 23 ++++++++-
 src/providers/api-keys.ts                     |  4 ++
 src/server/auth-cors.ts                       |  2 +-
 src/server/management/config-routes.ts        |  8 ++-
 src/server/management/oauth-account-routes.ts | 30 ++---------
 src/server/management/provider-routes.ts      |  5 +-
 src/server/responses/compact.ts               | 11 +++-
 src/server/responses/request-transport.ts     |  5 ++
 structure/transports/inventory.md             |  2 +-
 tests/cli/cli-account-key-pause.test.ts       |  2 +-
 .../api-key-auto-pause-distribution.test.ts   | 51 ++++++++++++++-----
 28 files changed, 146 insertions(+), 58 deletions(-)

diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index 5471a9dd786..4f95a2abbf8 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -724,7 +724,7 @@ export default function ProviderAuthPanel({
                     <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
-                      disabled={(entry.active && !entry.disabled) || busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)} aria-label={entry.disabled ? `${t("codexAuth.resume")} — ${entry.label ?? entry.masked}` : undefined}>
+                      disabled={(entry.active && !entry.disabled) || busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)} aria-label={entry.disabled ? `${t("pws.resumeAndActivateKey")} — ${entry.label ?? entry.masked}` : undefined}>
                       <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index b3f4390cfb5..94b73174b72 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -590,6 +590,7 @@ export function useProviderAccountPools(deps: {
 
   const pauseApiKey = async (provider: string, entry: ApiKeyEntry, paused: boolean) => {
     if (switchingAccountRef.current.has(provider) || pausingAccountRef.current.has(provider) || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    const activeKeyMayChange = paused ? entry.active : !keyPools[provider]?.some(row => row.active && !row.disabled);
     const target = { provider, accountId: entry.id };
     pausingAccountRef.current.set(provider, target);
     setPausingAccounts(current => ({ ...current, [provider]: { ...target, paused } }));
@@ -653,7 +654,7 @@ export function useProviderAccountPools(deps: {
     notify(t(paused ? "codexAuth.pauseSucceeded" : "codexAuth.resumeSucceeded", { email: label }), true);
     try {
       const refreshed = await refreshAccountRosters({ provider, kind: "api-key" });
-      if (result.activeAccountChanged) await Promise.all([fetchConfig(), fetchProviderQuotas(true)]);
+      if (result.activeAccountChanged ?? activeKeyMayChange) await Promise.all([fetchConfig(), fetchProviderQuotas(true)]);
       if (!refreshed) notify(t("pws.accountsLoadFailed"), false);
     } catch {
       if (aliveRef.current && mountedRef.current) notify(t("pws.accountsLoadFailed"), false);
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 59d50597311..a3a74ce3e7e 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -2977,6 +2977,7 @@ export const de: Record<TKey, string> = {
   "pws.accountSwitching": "Wechsel läuft…",
   "pws.accountCurrent": "Aktuelles Konto",
   "pws.accountPausedHint": "Bis du das Konto fortsetzt, ist es von der automatischen Auswahl, von Wiederholungen, von der Cooldown-Wiederherstellung, von der manuellen Auswahl und von der proaktiven Token-Erneuerung ausgeschlossen.",
+  "pws.resumeAndActivateKey": "Fortsetzen und verwenden",
   "pws.defaultModelNone": "Keins (Standard des Anbieters verwenden)",
   "pws.discardSettings": "Verwerfen",
   "pws.jsonEditorDesc": "Bearbeiten Sie die JSON-Konfiguration des Anbieters. Änderungen werden sofort gespeichert.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 539edff3150..b16ba4b91dc 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1853,6 +1853,7 @@ export const en = {
   "pws.accountSwitching": "Switching…",
   "pws.accountCurrent": "Current account",
   "pws.accountPausedHint": "Excluded from automatic selection, retries, cooldown recovery, manual selection, and proactive token refresh until resumed.",
+  "pws.resumeAndActivateKey": "Resume and use",
   "pws.defaultModelNone": "None (use provider default)",
   "pws.discardSettings": "Discard",
   "pws.jsonEditorDesc": "Edit the raw provider JSON config. Changes are saved immediately.",
diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts
index 4973ee9d269..fc08deeceec 100644
--- a/gui/src/i18n/fr.ts
+++ b/gui/src/i18n/fr.ts
@@ -1826,6 +1826,7 @@ export const fr: Record<TKey, string> = {
   "pws.accountSwitching": "Changement…",
   "pws.accountCurrent": "Compte actuel",
   "pws.accountPausedHint": "Exclu du choix automatique, des nouvelles tentatives, de la récupération après délai, de la sélection manuelle et du renouvellement proactif du jeton jusqu’à sa réactivation.",
+  "pws.resumeAndActivateKey": "Reprendre et utiliser",
   "pws.defaultModelNone": "Aucun (utiliser la valeur par défaut du fournisseur)",
   "pws.discardSettings": "Abandonner les modifications",
   "pws.jsonEditorDesc": "Modifiez la configuration JSON brute du fournisseur. Les modifications sont enregistrées immédiatement.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 5241ebb7907..99292fca6f0 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -1721,6 +1721,7 @@ export const ja: Record<TKey, string> = {
   "pws.accountSwitching": "切り替え中…",
   "pws.accountCurrent": "現在のアカウント",
   "pws.accountPausedHint": "再開するまで、自動選択、再試行、クールダウン復旧、手動選択、トークンの事前更新の対象外です。",
+  "pws.resumeAndActivateKey": "再開して使用",
   "pws.defaultModelNone": "なし(プロバイダーのデフォルトを使用)",
   "pws.discardSettings": "破棄",
   "pws.jsonEditorDesc": "生のプロバイダー JSON 設定を編集します。変更はすぐに保存されます。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index ed252d6cc67..f90f3bfa9d9 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -3024,6 +3024,7 @@ export const ko: Record<TKey, string> = {
   "pws.accountSwitching": "전환 중…",
   "pws.accountCurrent": "현재 계정",
   "pws.accountPausedHint": "재개할 때까지 자동 선택, 재시도, 쿨다운 복구, 수동 선택 및 사전 토큰 갱신에서 제외됩니다.",
+  "pws.resumeAndActivateKey": "재개 및 사용",
   "pws.defaultModelNone": "없음 (프로바이더 기본값 사용)",
   "pws.discardSettings": "되돌리기",
   "pws.jsonEditorDesc": "프로바이더 JSON 설정을 직접 편집합니다. 저장 즉시 반영됩니다.",
diff --git a/gui/src/i18n/pt.ts b/gui/src/i18n/pt.ts
index 0cfaae10c54..8ce961c349b 100644
--- a/gui/src/i18n/pt.ts
+++ b/gui/src/i18n/pt.ts
@@ -1837,6 +1837,7 @@ export const pt: Record<TKey, string> = {
   "pws.accountSwitching": "Alternando…",
   "pws.accountCurrent": "Conta atual",
   "pws.accountPausedHint": "Excluída da seleção automática, das novas tentativas, da recuperação de cooldown, da seleção manual e da renovação proativa de token até ser retomada.",
+  "pws.resumeAndActivateKey": "Retomar e usar",
   "pws.defaultModelNone": "Nenhum (usar o padrão do provedor)",
   "pws.discardSettings": "Descartar",
   "pws.jsonEditorDesc": "Edite a configuração JSON bruta do provedor. As alterações são salvas imediatamente.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index ab50a613b3d..a68c3cd41f3 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -1812,6 +1812,7 @@ export const ru: Record<TKey, string> = {
   "pws.accountSwitching": "Переключение…",
   "pws.accountCurrent": "Текущий аккаунт",
   "pws.accountPausedHint": "До возобновления исключён из автоматического выбора, повторов, восстановления после задержки, ручного выбора и проактивного обновления токена.",
+  "pws.resumeAndActivateKey": "Возобновить и использовать",
   "pws.defaultModelNone": "Нет (использовать значение провайдера)",
   "pws.discardSettings": "Не сохранять",
   "pws.jsonEditorDesc": "Редактируйте исходную JSON-конфигурацию провайдера. Изменения сохраняются сразу.",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index b1f6670b294..1d9fbc42dbf 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -1839,6 +1839,7 @@ export const tr: Record<TKey, string> = {
   "pws.accountSwitching": "Değiştiriliyor…",
   "pws.accountCurrent": "Mevcut hesap",
   "pws.accountPausedHint": "Devam ettirilene kadar otomatik seçim, yeniden deneme, bekleme süresinden kurtarma, manuel seçim ve proaktif belirteç yenilemesinden hariç tutulur.",
+  "pws.resumeAndActivateKey": "Devam ettir ve kullan",
   "pws.defaultModelNone": "Yok (sağlayıcı varsayılanını kullan)",
   "pws.discardSettings": "Vazgeç",
   "pws.jsonEditorDesc": "Ham sağlayıcı JSON konfigürasyonunu düzenleyin.",
diff --git a/gui/src/i18n/vi.ts b/gui/src/i18n/vi.ts
index f2e60deca7f..dfa5a02631b 100644
--- a/gui/src/i18n/vi.ts
+++ b/gui/src/i18n/vi.ts
@@ -1823,6 +1823,7 @@ export const vi: Record<TKey, string> = {
   "pws.accountSwitching": "Đang chuyển…",
   "pws.accountCurrent": "Tài khoản hiện tại",
   "pws.accountPausedHint": "Được loại trừ khỏi chọn tài khoản tự động, thử lại, hồi phục sau thời gian chờ, lựa chọn thủ công và làm mới token chủ động cho đến khi tiếp tục.",
+  "pws.resumeAndActivateKey": "Tiếp tục và sử dụng",
   "pws.defaultModelNone": "Không có (sử dụng mặc định của provider)",
   "pws.discardSettings": "Huỷ bỏ",
   "pws.jsonEditorDesc": "Chỉnh sửa config dạng JSON thô của provider. Các thay đổi sẽ được lưu ngay lập tức.",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 7dd5863bbf0..61098f36ac3 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -1516,6 +1516,7 @@ export const zhTW: Record<TKey, string> = {
   "pws.accountSwitching": "切換中…",
   "pws.accountCurrent": "當前帳號",
   "pws.accountPausedHint": "恢復前不會參與自動選取、重試、冷卻恢復、手動選擇或主動 Token 刷新。",
+  "pws.resumeAndActivateKey": "恢復並使用",
   "pws.defaultModelNone": "無（使用供應商預設值）",
   "pws.discardSettings": "放棄",
   "pws.jsonEditorDesc": "直接編輯供應商 JSON 配置。更改將立即儲存。",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 25550ed06c1..416c5185381 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -2997,6 +2997,7 @@ export const zh: Record<TKey, string> = {
   "pws.accountSwitching": "切换中…",
   "pws.accountCurrent": "当前账户",
   "pws.accountPausedHint": "恢复前不会参与自动切换、重试、冷却恢复、手动选择或主动令牌刷新。",
+  "pws.resumeAndActivateKey": "恢复并使用",
   "pws.defaultModelNone": "无（使用提供商默认值）",
   "pws.discardSettings": "放弃",
   "pws.jsonEditorDesc": "直接编辑提供商 JSON 配置。更改将立即保存。",
diff --git a/gui/tests/account-pause-display.test.tsx b/gui/tests/account-pause-display.test.tsx
index 059e4830f87..ee1ff5c37fa 100644
--- a/gui/tests/account-pause-display.test.tsx
+++ b/gui/tests/account-pause-display.test.tsx
@@ -48,7 +48,7 @@ test.each(["fr", "ko"] as const)("provider OAuth and key tooltips use the app lo
       expect(win.document.querySelector(".badge-muted[title]")?.getAttribute("title")).toBe(expected);
       if (authMode === "key") {
         expect(win.document.querySelector(".pwi-auth-row-main")?.getAttribute("aria-label"))
-          .toBe(`${t("codexAuth.resume")} — Reserve key`);
+          .toBe(`${t("pws.resumeAndActivateKey")} — Reserve key`);
       }
     } finally { void win.happyDOM.close(); }
   }
@@ -68,6 +68,7 @@ test("API-key pool rows render dedicated Pause and Resume buttons when onPauseAp
     const buttons = Array.from(win.document.querySelectorAll("button")).map(btn => btn.getAttribute("aria-label")).filter(Boolean);
     expect(buttons).toContain(`${t("codexAuth.pause")} — Primary Vertex`);
     expect(buttons).toContain(`${t("codexAuth.resume")} — Backup Vertex`);
+    expect(buttons).toContain(`${t("pws.resumeAndActivateKey")} — Backup Vertex`);
     expect(win.document.body.textContent).toContain(t("pws.accountPausedHint"));
   } finally { void win.happyDOM.close(); }
 });
diff --git a/gui/tests/provider-account-pause-refresh.test.tsx b/gui/tests/provider-account-pause-refresh.test.tsx
index f8d90603e70..75bca970a69 100644
--- a/gui/tests/provider-account-pause-refresh.test.tsx
+++ b/gui/tests/provider-account-pause-refresh.test.tsx
@@ -14,6 +14,8 @@ let pools: ReturnType<typeof useProviderAccountPools>;
 let notices: Array<{ key: string; ok: boolean }>;
 let respond: (url: string, init?: RequestInit) => Promise<Response>;
 let fetchOauth: () => Promise<void>;
+let fetchConfig: () => Promise<void>;
+let fetchProviderQuotas: (refresh?: boolean) => Promise<void>;
 
 const row = (id: string, active: boolean, paused = false): OAuthAccount => ({ id, email: `${id}@example.test`, active, paused });
 
@@ -21,7 +23,7 @@ function Harness() {
   const aliveRef = useRef(true);
   const current = useProviderAccountPools({ apiBase: "/pause-hook", config: null, aliveRef, t: key => key,
     oauthStatus: {}, notify: (key: string, ok: boolean) => { notices.push({ key, ok }); },
-    fetchConfig: async () => {}, fetchOauth: () => fetchOauth(), fetchProviderQuotas: async () => {},
+    fetchConfig: () => fetchConfig(), fetchOauth: () => fetchOauth(), fetchProviderQuotas: refresh => fetchProviderQuotas(refresh),
     codexActiveNeedsReauth: false });
   useLayoutEffect(() => { pools = current; }, [current]);
   return null;
@@ -37,6 +39,8 @@ beforeEach(async () => {
   });
   notices = [];
   fetchOauth = async () => {};
+  fetchConfig = async () => {};
+  fetchProviderQuotas = async () => {};
   const host = win.document.createElement("div");
   win.document.body.appendChild(host);
   await act(async () => { root = createRoot(host as unknown as HTMLElement); root.render(<Harness />); });
@@ -253,10 +257,14 @@ test("pauseApiKey pauses active key with ring-order fallback and refreshes roste
   const k2 = { id: "k2", label: "Key 2", masked: "****2", active: true, disabled: false };
   const k3 = { id: "k3", label: "Key 3", masked: "****3", active: false, disabled: false };
   const writes: Array<{ path: string; body: unknown }> = [];
+  let configRefreshes = 0;
+  const quotaRefreshes: boolean[] = [];
+  fetchConfig = async () => { configRefreshes++; };
+  fetchProviderQuotas = async refresh => { quotaRefreshes.push(refresh === true); };
   respond = async (url, init) => {
     if (init?.method === "PUT") {
       writes.push({ path: url, body: JSON.parse(String(init.body)) });
-      return Response.json({ ok: true, activeId: "k3", activeAccountChanged: true });
+      return Response.json({ ok: true });
     }
     return Response.json({ activeId: "k3", keys: [k1, { ...k2, active: false, disabled: true }, { ...k3, active: true }] });
   };
@@ -266,4 +274,6 @@ test("pauseApiKey pauses active key with ring-order fallback and refreshes roste
   expect(pools.keyPools.fixture.find(r => r.id === "k2")?.disabled).toBe(true);
   expect(pools.keyPools.fixture.find(r => r.id === "k3")?.active).toBe(true);
   expect(notices).toContainEqual({ key: "codexAuth.pauseSucceeded", ok: true });
+  expect(configRefreshes).toBe(1);
+  expect(quotaRefreshes).toEqual([true]);
 });
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index e1e00033949..7c197581ced 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -848,12 +848,30 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
     const result = await apiJson(deps, baseUrl, "PUT", "/api/providers/keys/pause", { name, id: target.id, paused });
     if (result.status === 0) return proxyUnreachable(result.transportError);
     if (result.status !== 200) return apiError(result.json, `failed to ${verb} account`, result.status);
+    const idx = rows.rows.findIndex(row => row.id === target.id);
+    const ordered = idx >= 0 ? [...rows.rows.slice(idx + 1), ...rows.rows.slice(0, idx)] : rows.rows;
+    const beforeActiveId = rows.rows.find(row => row.active && !row.paused)?.id ?? null;
+    const inferredActiveId = paused
+      ? (beforeActiveId === target.id
+        ? (ordered.find(row => row.id !== target.id && !row.paused)?.id ?? null)
+        : beforeActiveId)
+      : (beforeActiveId ?? (rows.rows.some(row => row.paused) ? target.id : null));
+    const activeAccountId = result.json.activeAccountId !== undefined
+      ? result.json.activeAccountId
+      : result.json.activeId !== undefined
+        ? result.json.activeId
+        : inferredActiveId;
+    const activeAccountChanged = typeof result.json.activeAccountChanged === "boolean"
+      ? result.json.activeAccountChanged
+      : beforeActiveId !== activeAccountId;
     if (wantsJson) {
-      console.log(JSON.stringify({ ok: true, provider: name, id: target.id, paused }, null, 2));
+      console.log(JSON.stringify({ ok: true, provider: name, id: target.id, paused,
+        activeAccountId: activeAccountId ?? null,
+        activeAccountChanged }, null, 2));
     } else {
       console.log(`${name}: account ${paused ? "paused" : "resumed"}`);
-      if (result.json.activeAccountChanged === true) {
-        console.error(`Active account changed to ${String(result.json.activeAccountId ?? result.json.activeId ?? "none")}.`);
+      if (activeAccountChanged) {
+        console.error(`Active account changed to ${String(activeAccountId ?? "none")}.`);
       }
     }
     return 0;
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index 8862b9c8aba..ef793933a56 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -458,8 +458,8 @@ export class OAuthLoginRequiredError extends Error {
 
 /** An operator-paused account is temporarily unavailable, not an invalid login. */
 export class OAuthAccountPausedError extends Error {
-  constructor(message = "OAuth account is paused. Resume it in account settings and retry.") {
-    super(message);
+  constructor() {
+    super("OAuth account is paused. Resume it in account settings and retry.");
     this.name = "OAuthAccountPausedError";
   }
 }
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
index 4890828dc1b..eb7dcfa2611 100644
--- a/src/providers/api-key-pause.ts
+++ b/src/providers/api-key-pause.ts
@@ -1,16 +1,21 @@
 import { accountAutoPauseFenceMatchesDisk, type AccountAutoPauseFence } from "../config/account-auto-pause-revisions";
 import { randomUUID } from "node:crypto";
 import { OAuthAccountPausedError } from "../oauth";
+import { clearModelCache } from "../codex/model-cache";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { ProviderApiKeySelection } from "../types/provider";
 import type { AccountPauseDetails } from "../types/account-auto-pause";
 import { apiKeyPoolEntryId } from "./api-keys";
+import { clearKeyCooldowns } from "./api-key-cooldowns";
 import { resolveProviderApiKey } from "./api-key-resolve";
 import { commitProviderApiKeySelection } from "./api-key-selection";
+import { forgetApiKeyRotationCursor } from "./key-failover";
+import { clearProviderQuotaCacheFor } from "./quota/report-cache";
 
 export class ProviderApiKeyPausedError extends OAuthAccountPausedError {
   constructor() {
-    super("API key is paused. Resume it in account settings and retry.");
+    super();
+    this.message = "API key is paused. Resume it in account settings and retry.";
     this.name = "ProviderApiKeyPausedError";
   }
 }
@@ -30,6 +35,7 @@ export function isProviderApiKeyPaused(provider: OcxProviderConfig | undefined):
 
 export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
   automatic?: { fence: AccountAutoPauseFence; selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
+  let activeKeyChanged = false;
   const result = commitProviderApiKeySelection(config, name, provider => {
     if (automatic && !accountAutoPauseFenceMatchesDisk(name, automatic.fence)) return { changed: false, value: false };
     const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
@@ -37,6 +43,7 @@ export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: str
     const entry = pool.find(e => e.id === id);
     if (!entry || automatic && (entry.disabled || entry.key !== automatic.selection.reference || entry.pauseRevision !== automatic.pauseRevision
       || provider.accountAutoPause?.enabled !== true || resolveProviderApiKey(entry.key) !== automatic.resolvedKey)) return { changed: false, value: false };
+    const beforeApiKey = provider.apiKey;
     provider.apiKeyPool = pool;
     const idx = pool.indexOf(entry);
     const ordered = idx >= 0 ? [...pool.slice(idx + 1), ...pool.slice(0, idx)] : pool;
@@ -47,10 +54,12 @@ export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: str
         const next = ordered.find(e => !e.disabled);
         if (next) provider.apiKey = next.key;
         else delete provider.apiKey;
+        activeKeyChanged = beforeApiKey !== provider.apiKey;
         return { changed: true, selectionChanged: true, value: true };
       }
       if (!paused && activeDisabled()) {
         provider.apiKey = entry.key;
+        activeKeyChanged = beforeApiKey !== provider.apiKey;
         return { changed: true, selectionChanged: true, value: true };
       }
       return { changed: false, value: true };
@@ -64,7 +73,17 @@ export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: str
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     } else if (!paused && activeDisabled()) provider.apiKey = entry.key;
+    activeKeyChanged = beforeApiKey !== provider.apiKey;
     return { changed: true, selectionChanged: true, value: true };
   }, automatic?.selection);
-  return result.status === "committed" && result.value;
+  const ok = result.status === "committed" && result.value;
+  if (ok && !automatic) {
+    clearKeyCooldowns(name);
+    forgetApiKeyRotationCursor(name);
+    if (activeKeyChanged) {
+      clearModelCache(name);
+      clearProviderQuotaCacheFor(name);
+    }
+  }
+  return ok;
 }
diff --git a/src/providers/api-keys.ts b/src/providers/api-keys.ts
index a145ac1677e..7e16ec4fe2f 100644
--- a/src/providers/api-keys.ts
+++ b/src/providers/api-keys.ts
@@ -204,6 +204,10 @@ export function sanitizeApiKeyValue(value: unknown): string | undefined {
 }
 
 /** Seed the pool from a legacy bare `apiKey`, and keep `apiKey` mirrored to the active entry. */
+export function providerHasStoredApiKey(provider: OcxProviderConfig): boolean {
+  return !!provider.apiKey || (isKeyAuthProvider(provider) && (provider.apiKeyPool?.length ?? 0) > 0);
+}
+
 function ensurePool(provider: OcxProviderConfig): NonNullable<OcxProviderConfig["apiKeyPool"]> {
   if (!provider.apiKeyPool) provider.apiKeyPool = [];
   if (provider.apiKeyPool.length === 0 && provider.apiKey) {
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index 5f88a0253ef..d9ca58b20aa 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -1323,7 +1323,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
   for (const [name, provider] of Object.entries(config.providers)) {
     const dto: Record<string, unknown> = {
       ...editor.providers[name],
-      hasApiKey: !!provider.apiKey || (provider.authMode !== "oauth" && provider.authMode !== "forward" && (provider.apiKeyPool?.length ?? 0) > 0),
+      hasApiKey: !!provider.apiKey,
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
     if (name === "xai") {
diff --git a/src/server/management/config-routes.ts b/src/server/management/config-routes.ts
index 91d51e128fd..9f3533c4461 100644
--- a/src/server/management/config-routes.ts
+++ b/src/server/management/config-routes.ts
@@ -86,6 +86,7 @@ import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
+import { providerHasStoredApiKey } from "../../providers/api-keys";
 import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../../reasoning-effort";
 import { normalizeVisionReasoningForModel } from "../../vision/reasoning";
 import {
@@ -364,7 +365,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   // for up to 15s, including the admin-token check. An injected reader stays authoritative.
   const readStartupHealthSnapshot = deps.getCachedStartupHealth ?? getStartupHealthSnapshot;
   if (url.pathname === "/api/config" && req.method === "GET") {
-    return jsonResponse(withProviderCatalogCapabilityDTO(safeConfigDTO(config), config));
+    const dto = safeConfigDTO(config) as { providers: Record<string, Record<string, unknown>> };
+    for (const [name, provider] of Object.entries(config.providers)) {
+      const publicProvider = dto.providers[name];
+      if (publicProvider) publicProvider.hasApiKey = providerHasStoredApiKey(provider);
+    }
+    return jsonResponse(withProviderCatalogCapabilityDTO(dto, config));
   }
 
   if (url.pathname === "/api/config" && req.method === "PUT") {
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index ca0d3a74695..865995ecbf9 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -1121,28 +1121,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
     if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
     if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
-    const { listProviderApiKeys } = await import("../../providers/api-keys");
-    const beforeActiveId = listProviderApiKeys(config, body.name).activeId;
     const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
-    if (!setProviderApiKeyPaused(config, body.name, body.id, body.paused)) {
-      return jsonResponse({ error: "key not found" }, 404);
-    }
-    const activeId = listProviderApiKeys(config, body.name).activeId;
-    const activeAccountChanged = beforeActiveId !== activeId;
-    const { clearKeyCooldowns, forgetApiKeyRotationCursor } = await import("../../providers/key-failover");
-    clearKeyCooldowns(body.name);
-    forgetApiKeyRotationCursor(body.name);
-    if (activeAccountChanged) {
-      const { clearModelCache } = await import("../../codex/model-cache");
-      clearModelCache(body.name);
-      clearProviderQuotaCacheFor(body.name);
-    }
-    return jsonResponse({
-      ok: true,
-      activeId,
-      activeAccountId: activeId,
-      activeAccountChanged,
-    });
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
   }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
@@ -1150,12 +1131,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     if (!body.id) return jsonResponse({ error: "missing id" }, 400);
     const { setActiveProviderApiKey } = await import("../../providers/api-keys");
-    if (!setActiveProviderApiKey(config, name, body.id)) {
-      if (config.providers[name]?.apiKeyPool?.some(e => e.id === body.id && e.disabled)) {
-        return jsonResponse({ error: "API key is paused; resume it first" }, 409);
-      }
-      return jsonResponse({ error: "key not found" }, 404);
-    }
+    if (!setActiveProviderApiKey(config, name, body.id)) return jsonResponse({ error: "key not found" }, 404);
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const { clearProviderQuotaCache } = await import("../../providers/quota");
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index b742fb703f2..fd319b900a5 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -2,6 +2,7 @@ import { contextTierRecordConfigError, modelCapabilitiesConfigError, mergeModelC
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../../responses/hosted-tool-policy";
 import { randomUUID } from "node:crypto";
 import { cleanupRemovedGcpCredentials, providerGcpCredentialMarkers, snapshotProviderGcpCredentialMarkers } from "../../providers/gcp-credential-cleanup";
+import { providerHasStoredApiKey } from "../../providers/api-keys";
 import { providerGcpCredentialInputResponse, removeProviderWithGcpCredentials } from "./provider-gcp-credential-routes";
 import { readFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
@@ -903,7 +904,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
       name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
-      hasApiKey: !!p.apiKey || (p.authMode !== "oauth" && p.authMode !== "forward" && (p.apiKeyPool?.length ?? 0) > 0),
+      hasApiKey: providerHasStoredApiKey(p),
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
@@ -1600,7 +1601,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       success: true,
       name,
       disabled: config.providers[name]!.disabled === true,
-      hasApiKey: !!config.providers[name]!.apiKey,
+      hasApiKey: providerHasStoredApiKey(config.providers[name]!),
       ...(shadowDependency ? { dependentShadowIntercept: shadowDependency } : {}),
       ...(name === "xai"
         ? { xaiResponsesOptInState: xaiResponsesOptInState(config.providers[name]!) }
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index cb93a79f280..c6b32ae1937 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -168,6 +168,7 @@ import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve"
 import { hasKeyPoolFailover, rotateProviderTransportOn429, selectProactiveApiKeyTransport, transientRetryPolicyFor } from "../../providers/key-failover";
 import { transientSendCapFor } from "./request-send-budget";
 import { distributedKeyPhysicalFetch, recordDistributedResponseFailure } from "../../providers/api-key-response-ownership";
+import { isProviderApiKeyPaused, ProviderApiKeyPausedError } from "../../providers/api-key-pause";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../../providers/api-key-selection";
 import { stampApiKeyAccountLabel } from "../../providers/label";
 import { shouldAttemptImageTierRetry } from "../image-retry";
@@ -932,9 +933,15 @@ export async function handleResponsesCompact(
       catch (error) {
         const refusal = requestPacingOverloadResponse(error);
         if (refusal) return refusal;
+        if (error instanceof ProviderApiKeyPausedError) {
+          return formatErrorResponse(403, "permission_error", error.message);
+        }
         throw error;
       }
       if (warmKeyProvider?.apiKey) compactProvider = warmKeyProvider;
+      if (isProviderApiKeyPaused(compactProvider)) {
+        return formatErrorResponse(403, "permission_error", new ProviderApiKeyPausedError().message);
+      }
       headers.set("authorization", `Bearer ${resolveProviderApiKey(compactProvider.apiKey)}`);
       stampApiKeyAccountLabel(logCtx, route.providerName, compactProvider);
     }
@@ -1182,6 +1189,7 @@ export async function handleResponsesCompact(
                   if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
                 }
                 if (!current?.apiKey || !supportsNativeResponsesCompactEndpoint(route.providerName, current)) {
+                  if (!current?.apiKey && isProviderApiKeyPaused(config.providers[route.providerName])) throw new ProviderApiKeyPausedError();
                   throw new Error("Provider key selection is no longer available for compact");
                 }
                 const rebuilt = new Headers(sendHeaders);
@@ -1243,7 +1251,8 @@ export async function handleResponsesCompact(
     let outcomeCtx = authCtx;
     const localDispatchRefusal = (error: unknown): Response | undefined => {
       const cause = unwrapUpstreamRetryEvidenceError(error);
-      const response = requestPacingOverloadResponse(cause) ?? spendLedgerStorageErrorResponse(error, logCtx) ?? (cause instanceof SendBudgetExhaustedError
+      const response = (cause instanceof ProviderApiKeyPausedError ? formatErrorResponse(403, "permission_error", cause.message) : undefined)
+        ?? requestPacingOverloadResponse(cause) ?? spendLedgerStorageErrorResponse(error, logCtx) ?? (cause instanceof SendBudgetExhaustedError
         ? unboundPoolSpendRefusalResponse(logCtx) ?? formatErrorResponse(429, "request_send_budget_exhausted", cause.message)
         : mapCodexAuthContextErrorToResponse(cause, {
           now: Date.now(), accountSelector: route.codexAccountNamespace,
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 2ec06591ef6..752d313d3ef 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -641,6 +641,8 @@ export async function prepareResponsesTransport(
         if (fresh) current = selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh;
       }
       if (!current) {
+        // Rethrown through oauthDispatch so adapter-dispatch / passthrough-dispatch map it
+        // as a local 403 admission refusal without charging an upstream send.
         if (isProviderApiKeyPaused(config.providers[route.providerName])) throw new ProviderApiKeyPausedError();
         throw new Error("API key selection is unavailable before dispatch");
       }
@@ -832,6 +834,9 @@ export async function prepareResponsesTransport(
         let nextAdapter: ProviderAdapter;
         try { nextAdapter = await refreshDispatchAdapter(requestParsed); }
         catch (error) {
+          if (error instanceof OAuthAccountPausedError) {
+            return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(error));
+          }
           if (error instanceof AdmissionModelDeniedError) throw error;
           const refusal = copilotRefusalResponse(error);
           if (refusal) return refusal;
diff --git a/structure/transports/inventory.md b/structure/transports/inventory.md
index 10a2a7325d1..d13e8220d90 100644
--- a/structure/transports/inventory.md
+++ b/structure/transports/inventory.md
@@ -45,7 +45,7 @@ surface is listed here so a maintainer can find the owner without grepping:
 | Hosted search relay | `src/server/search.ts`, `src/web-search/devin-executor.ts` | A resolved Devin route uses Cognition's bounded non-inference `GetWebSearchResults` RPC with the active account's credential and allowlisted tenant; other routes use the verbatim ChatGPT relay, or an explicitly configured web-search sidecar backend when no forward provider exists. Distinct from the web-search sidecar loop below. |
 | Image/video generation loop | `src/images/loop.ts`, `src/images/plan.ts`, `src/images/fulfill.ts`, `src/images/xai-client.ts`, `src/images/xai-video-client.ts`, `src/images/artifacts.ts` | A provider-returned image URL is downloaded into a local artifact once, then served locally; warnings stay URL-free because provider CDN URLs may embed credentials. Artifact downloads go through the pinned-IP transport with a 10 s connect deadline (`DOWNLOAD_CONNECT_TIMEOUT_MS`) that bounds TCP/TLS setup on its own, in addition to the 60 s idle timer, and `pinnedHttpsGet` accepts a per-call `connectTimeoutMs`. |
 | GitHub Copilot | `src/providers/xai-transport.ts` (`resolveProviderTransport`), `src/providers/github-copilot-transport.ts` | `resolveProviderTransport` selects the Copilot transport when the routed provider name is `github-copilot`; the Copilot module then resolves its headers and base URL, and the registry seeds the provider row and model fallback. Auto session and intent requests stay on the credential-captured origin; adapter construction follows the [Copilot Auto contract](../providers-and-adapters.md#github-copilot-auto-selection). |
-| API-key pools | `src/providers/api-key-selection.ts`, `src/providers/key-failover.ts`, `src/providers/api-key-pause.ts` | A configured `apiKeyPoolStrategy` plus a cooling committed key rotates before the first send (`selectProactiveApiKeyTransport`); a 429 still rotates after the send and records a cooldown. `provider.apiKey` keeps mirroring the active entry so routing stays single-key. Paused (`disabled: true`) entries are excluded from proactive selection, reactive failover, and per-key quota probes; if every entry in the pool is paused, inference fails with 403 `permission_error`. |
+| API-key pools | `src/providers/api-key-selection.ts`, `src/providers/key-failover.ts`, `src/providers/api-key-pause.ts` | A configured `apiKeyPoolStrategy` plus a cooling committed key rotates before the first send (`selectProactiveApiKeyTransport`); with no strategy, a paused (or missing) committed key in a pool that has paused entries selects the first enabled key as `fill-first`. A 429 still rotates after the send and records a cooldown. `provider.apiKey` keeps mirroring the active entry so routing stays single-key. Paused (`disabled: true`) entries are excluded from proactive selection, reactive failover, and per-key quota probes; if every entry in the pool is paused, inference fails with 403 `permission_error`. |
 | OAuth account failover | `src/oauth/generic-account-failover.ts`, `src/oauth/anthropic-routing.ts`, `src/server/responses/antigravity-validation-refusal.ts`, `src/adapters/antigravity-refusal.ts` | Reactive pre-output 429 recovery is presence-driven with 2+ eligible accounts. Anthropic also handles exact revoked-token 401s under its [reauthentication contract](../providers/anthropic-account-pool.md#revoked-oauth-access-token-recovery) and recovers classified pre-output account-entitlement 403s under its [account-pool contract](../providers/anthropic-account-pool.md#account-entitlement-refusal-recovery), and records the refused account's cooldown even when the request has no retry sends left. Primary Antigravity inference through the Google adapter main dispatch may send once on a live sibling after a replayed 401, a terminal credential-refresh failure that marks the account for reauthentication, or a normalized structured `VALIDATION_REQUIRED` 403, within the existing budget. A bounded message-worded verification 403 persists a generation-fenced `verify_account` cause in `src/oauth/store.ts` and `src/oauth/health.ts`, including singleton and last-account refusals. It reads as `needs-reauth(verify)` in `ocx account list`; silent refresh preserves quarantine, while explicit re-login clears it and retires its failover cooldown. Quarantine does not require a retry slot; if persisting it fails, dispatch exits this adapter exchange’s recovery loop and preserves the original bounded 403 without another recovery send in that exchange; enclosing combo and policy fallback rules remain unchanged. A preserved original 403 after sibling build or pre-send admission failure also exits recovery through common bounded error formatting and the combo failure callback; newly constructed failure responses keep their own delivery. Successful sibling replay uses the captured pool activation and the existing send budget. The 401 and structured 403 sibling paths share one request guard; unrelated 403s and transient refresh failures do not rotate. The fetch web-search sidecar accepts only complete bounded structured `VALIDATION_REQUIRED` 403s through the Google normalizer, carries the sibling token/project without a durable reauthentication mark, and uses adapter-owned physical-send accounting; its contract is [Account refusal and rotation boundaries](responses-failover.md#account-refusal-and-rotation-boundaries). Continuations, native passthrough and image sidecars keep their existing behavior. Generic OAuth accounts can be operator-paused; paused accounts are excluded from selection, failover, and proactive Token Guardian refresh. If every account is paused, the request fails with 403 rather than as a login failure. Pool and `oauthAccountFailover` flags govern proactive routing, not the reactive retry: a disabled Anthropic pool recovers through quota ordering rather than its dormant strategy, a per-provider `enabled` beats the global default in either direction, and a non-positive fill-first threshold disables proactive usage-based rotation. Kiro's `kiroAutoSelection` projects the same candidate eligibility into routing and account-list status; unknown evidence stays eligible, while pause, reauth, suspension, cooldown, and confirmed exhaustion have closed reasons. An active singleton or a pool excluded only from automatic Kiro selection may still attempt its active account; an explicitly paused active account is never dispatched, and an all-paused pool fails with 403. A configured Kiro capacity cap can also time out. Kiro's optional process-local account lease is released at response completion or cancellation; other providers retain their admission path. |
 | OAuth login callback (inbound) | `src/oauth/callback-server.ts` | Every response, including non-callback 404s, closes its connection so a pooled socket cannot deliver a later login to a retired flow on the same callback port. |
 | Alibaba regions | `src/providers/alibaba-region-backup.ts`, `src/providers/alibaba-region-migration.ts`, `src/providers/alibaba-region-startup.ts` | Region migration backs up before rewriting and is idempotent across restarts. |
diff --git a/tests/cli/cli-account-key-pause.test.ts b/tests/cli/cli-account-key-pause.test.ts
index 3f43c0dcfa4..78a233593d3 100644
--- a/tests/cli/cli-account-key-pause.test.ts
+++ b/tests/cli/cli-account-key-pause.test.ts
@@ -49,7 +49,7 @@ test("a failed pause transport reports an unreachable proxy and its cause", asyn
 test("API-key pause JSON uses the same two-space indentation as the other pools", async () => {
   const result = await run("reserve", { json: true });
   expect(result.code).toBe(0);
-  expect(result.lines).toEqual([JSON.stringify({ ok: true, provider: "fixture", id: "key-1", paused: true }, null, 2)]);
+  expect(result.lines).toEqual([JSON.stringify({ ok: true, provider: "fixture", id: "key-1", paused: true, activeAccountId: null, activeAccountChanged: false }, null, 2)]);
   expect(result.writes).toEqual([{ name: "fixture", id: "key-1", paused: true }]);
 });
 
diff --git a/tests/providers/api-key-auto-pause-distribution.test.ts b/tests/providers/api-key-auto-pause-distribution.test.ts
index ec76530cf72..1411933b26b 100644
--- a/tests/providers/api-key-auto-pause-distribution.test.ts
+++ b/tests/providers/api-key-auto-pause-distribution.test.ts
@@ -3,10 +3,12 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { handleManagementAPI } from "../../src/server/management-api";
 import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../../src/providers/api-key-selection";
 import { clearKeyCooldowns, forgetApiKeyRotationCursor, selectProactiveApiKeyTransport } from "../../src/providers/key-failover";
 import { routedProviderConfig } from "../../src/router";
+import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
 import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
@@ -217,10 +219,11 @@ test("readProviderApiKeyQuotas skips probes for paused keys while preserving las
   clearProviderApiKeyQuotaCache();
 });
 
-test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C sent once, paused B never sent) and management routes enforce 409 on paused activation", async () => {
+test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C sent once, paused B never sent) and providerHasStoredApiKey preserves all-paused pools", async () => {
   const { handleResponses } = await import("../../src/server/responses/core");
+  const { handleResponsesCompact } = await import("../../src/server/responses/compact");
   const { handleImages } = await import("../../src/server/images");
-  const { handleOauthAccountRoutes } = await import("../../src/server/management/oauth-account-routes");
+  const { providerHasStoredApiKey, setActiveProviderApiKey } = await import("../../src/providers/api-keys");
   const { fetchProviderModels } = await import("../../src/codex/catalog/provider-models");
   const prevFetch = globalThis.fetch;
   const sentKeys: string[] = [];
@@ -252,7 +255,9 @@ test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C
       },
       "custom-img": {
         adapter: "openai-responses", authMode: "key", baseUrl: "https://example.test/v1",
+        models: ["gpt-4o"], apiKey: "img-key-1",
         apiKeyPool: [{ id: "img-1", key: "img-key-1", disabled: true }],
+        requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
       },
     };
     saveConfig(config);
@@ -264,16 +269,17 @@ test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C
     expect(res.status, resText).toBe(200);
     expect(sentKeys).toEqual(["vertex-A", "vertex-C"]);
 
-    // Activating paused key B via PUT /api/providers/keys/active returns 409 Conflict.
-    const activatePaused = await handleOauthAccountRoutes({
-      req: new Request("http://127.0.0.1/api/providers/keys/active", {
-        method: "PUT", headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name: "google-vertex", id: "B" }),
-      }),
-      url: new URL("http://127.0.0.1/api/providers/keys/active"),
-      config,
-    });
-    expect(activatePaused?.status).toBe(409);
+    // Activating paused key B is rejected while providerHasStoredApiKey remains true for all-paused pools.
+    expect(setActiveProviderApiKey(config, "google-vertex", "B")).toBe(false);
+    expect(providerHasStoredApiKey({ ...config.providers["custom-img"]!, apiKey: undefined })).toBe(true);
+
+    // Compact endpoint with all keys paused in round-robin pool returns 403 permission_error.
+    const compactRes = await handleResponsesCompact(new Request("http://localhost/v1/responses/compact", {
+      method: "POST", headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: "custom-img/gpt-4o", input: "ping" }),
+    }), config, { model: "", provider: "" });
+    expect(compactRes.status).toBe(403);
+    expect((await compactRes.json() as { error?: { type?: string } }).error?.type).toBe("permission_error");
 
     // Explicit images.provider with all keys paused returns 403 permission_error.
     const imgRes = await handleImages(new Request("http://localhost/v1/images/generations", {
@@ -292,3 +298,24 @@ test("Google Vertex and AI Studio 429 failover skips paused keys (A sent once, C
     globalThis.fetch = prevFetch;
   }
 });
+
+test("GET /api/config reports stored API keys when every pool entry is paused", async () => {
+  const config = getDefaultConfig();
+  config.providers = {
+    "google-vertex": {
+      adapter: "google", authMode: "key", googleMode: "vertex", baseUrl: "https://aiplatform.googleapis.com",
+      apiKeyPool: [
+        { id: "A", key: "vertex-A", disabled: true },
+        { id: "B", key: "vertex-B", disabled: true },
+      ],
+    },
+  };
+  const req = new Request("http://127.0.0.1/api/config", { headers: { host: "127.0.0.1" } });
+  const response = await handleManagementAPI(req, new URL(req.url), config, {
+    createManagementConvergeCodex: catalogConvergenceFactory(),
+  }, "gui-session", undefined, { trustedLoopback: true });
+  expect(response?.status, await response?.clone().text()).toBe(200);
+  const dto = await response!.json() as { providers: Record<string, { hasApiKey?: boolean; apiKey?: string }> };
+  expect(dto.providers["google-vertex"]?.hasApiKey).toBe(true);
+  expect(dto.providers["google-vertex"]?.apiKey).toBeUndefined();
+});

From 3a12b1ea66a8f119f67ec1eed5e3b69dcf9449c7 Mon Sep 17 00:00:00 2001
From: chilung <b0423031@gmail.com>
Date: Mon, 19 Oct 2026 01:44:05 +0800
Subject: [PATCH 3/4] fix(providers): harden model discovery, runturn streaming
 refusal, and gui key switching

---
 .../provider-workspace/ProviderAuthPanel.tsx     |  9 ++++++---
 gui/src/hooks/useProviderAccountPools.ts         |  7 +++++++
 src/codex/catalog/provider-models.ts             |  9 +++------
 src/server/responses/request-transport.ts        |  3 ---
 src/server/responses/run-turn-execution.ts       | 16 ++++++++--------
 5 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index 4f95a2abbf8..fb0cb8f3183 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -720,12 +720,13 @@ export default function ProviderAuthPanel({
             {keys.length > 0 && (
               <ul className="pwi-auth-list">
                 {keys.map(entry => (
-                  <li key={entry.id} className={`pwi-auth-acct${entry.active ? " pwi-auth-acct--active" : ""}`}>
-                    <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
+                  <li key={entry.id} className={`pwi-auth-acct${entry.active && !entry.disabled ? " pwi-auth-acct--active" : ""}`}>
+                    <div className={`pwi-auth-row${entry.active && !entry.disabled ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
+                      aria-current={entry.active && !entry.disabled ? "true" : undefined}
                       disabled={(entry.active && !entry.disabled) || busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)} aria-label={entry.disabled ? `${t("pws.resumeAndActivateKey")} — ${entry.label ?? entry.masked}` : undefined}>
-                      <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
+                      <span className={`pwi-auth-dot ${entry.active && !entry.disabled ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
                         {entry.label && <code className="pwi-auth-row-secondary">{entry.masked} · {t("prov.accountId")}: {entry.id}</code>}
@@ -747,11 +748,13 @@ export default function ProviderAuthPanel({
                       </button>
                     )}
                     <button type="button" className="btn btn-ghost btn-sm"
+                      disabled={busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)}
                       onClick={() => void authHandlers.onEditAlias(item.name, "api-key", entry.id, entry.label)}>
                       {t("prov.editAlias")}
                     </button>
                     <button type="button" className="btn btn-ghost btn-sm pwi-auth-row-remove"
                       aria-label={`${t("common.remove")} — ${entry.label ?? entry.masked}`}
+                      disabled={busy || Boolean(switchingAccountId) || Boolean(pausingAccountId)}
                       title={`${t("common.remove")} — ${entry.label ?? entry.masked}`}
                       onClick={() => void authHandlers.onRemoveApiKey(item.name, entry)}>
                       <IconTrash style={{ width: 13, height: 13 }} aria-hidden="true" />
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index 94b73174b72..25d79225231 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -551,6 +551,9 @@ export function useProviderAccountPools(deps: {
 
   const switchApiKey = async (provider: string, entry: ApiKeyEntry) => {
     if (entry.active && !entry.disabled || switchingAccountRef.current.has(provider) || pausingAccountRef.current.has(provider) || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    const target = { provider, accountId: entry.id };
+    switchingAccountRef.current.set(provider, target);
+    setSwitchingAccounts(current => ({ ...current, [provider]: target }));
     const key = invalidateSelectionReads(provider, "api-key");
     const mutation = Symbol();
     selectionMutationsRef.current.set(key, mutation);
@@ -580,6 +583,10 @@ export function useProviderAccountPools(deps: {
     } catch {
       if (currentMutation()) notify(t(resumed ? "prov.keyResumedSwitchFailed" : "prov.keySwitchFail"), false);
     } finally {
+      if (switchingAccountRef.current.get(provider) === target) {
+        switchingAccountRef.current.delete(provider);
+        if (aliveRef.current) setSwitchingAccounts(current => { const next = { ...current }; delete next[provider]; return next; });
+      }
       if (currentMutation()) {
         invalidateSelectionReads(provider, "api-key");
         selectionMutationsRef.current.delete(key);
diff --git a/src/codex/catalog/provider-models.ts b/src/codex/catalog/provider-models.ts
index dc8d01e3593..3e0fcf879b9 100644
--- a/src/codex/catalog/provider-models.ts
+++ b/src/codex/catalog/provider-models.ts
@@ -289,6 +289,9 @@ export async function fetchProviderModelsWithAuth(
       : { apiKey: await resolveModelsAuthToken(name, prov), observed: false }
     : resolveAuth.resolve(name, prov));
   const apiKey = auth.apiKey;
+  if ((prov.authMode === "oauth" && !apiKey) || isProviderApiKeyPaused(prov)) {
+    return observed(configured, "degraded");
+  }
   if (name === "github-copilot" && apiKey) {
     const transport = resolveGithubCopilotTransport({ ...prov, apiKey }, prov.authMode === "oauth"
       ? resolveCopilotApiBaseUrl(auth.oauthApiBaseUrl) : undefined);
@@ -638,12 +641,6 @@ export async function fetchProviderModelsWithAuth(
       "degraded",
     );
   }
-  if ((prov.authMode === "oauth" && !apiKey) || isProviderApiKeyPaused(prov)) {
-    // No usable token (logged out, or account marked needsReauth). Still surface the
-    // configured static catalog so the GUI Models tab / rail counts are not empty —
-    // matching Cursor's !apiKey → configured degradation and fetch-failure fallback.
-    return observed(configured, "degraded");
-  }
   const cloudCodeAssist = effectiveGoogleMode(name, prov) === "cloud-code-assist";
   const project = prov.project ?? auth.oauthProjectId;
   if (cloudCodeAssist && !project) return observed(configured, "degraded");
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 752d313d3ef..52d7b136c7a 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -834,9 +834,6 @@ export async function prepareResponsesTransport(
         let nextAdapter: ProviderAdapter;
         try { nextAdapter = await refreshDispatchAdapter(requestParsed); }
         catch (error) {
-          if (error instanceof OAuthAccountPausedError) {
-            return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(error));
-          }
           if (error instanceof AdmissionModelDeniedError) throw error;
           const refusal = copilotRefusalResponse(error);
           if (refusal) return refusal;
diff --git a/src/server/responses/run-turn-execution.ts b/src/server/responses/run-turn-execution.ts
index 99a64dc78af..6554e68c2ef 100644
--- a/src/server/responses/run-turn-execution.ts
+++ b/src/server/responses/run-turn-execution.ts
@@ -816,14 +816,14 @@ export async function executeResponsesRunTurn(
         // Preflight holds only heartbeats and the first meaningful event. A first-event 429 can be
         // replayed transparently; after any output reaches the bridge, a later error stays terminal.
         eventSource = await preflightRunTurnFailover(eventSource, wsFirstParsed, preflightDeadlineAt);
-        if (authRecoveryRefusal) {
-          cancelResponseCompletion();
-          runTurnAbort.abort();
-          queue.close();
-          cleanupRunTurnAbort();
-          releaseSearchProbeLease();
-          return authRecoveryRefusal;
-        }
+      }
+      if (authRecoveryRefusal) {
+        cancelResponseCompletion();
+        runTurnAbort.abort();
+        queue.close();
+        cleanupRunTurnAbort();
+        releaseSearchProbeLease();
+        return authRecoveryRefusal;
       }
       if (grokDevinPreflight) {
         const preflight = await preflightAdapterEvents(eventSource, undefined, {

From 82c10c98adf591ac7b2dbadb1b8650e9db52a839 Mon Sep 17 00:00:00 2001
From: chilung <b0423031@gmail.com>
Date: Mon, 19 Oct 2026 01:48:56 +0800
Subject: [PATCH 4/4] fix(providers): refresh provider state on pause and add
 active-key inference test

---
 gui/src/hooks/useProviderAccountPools.ts |  3 +--
 tests/cli/cli-account-key-pause.test.ts  | 12 ++++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index 25d79225231..bc12903f626 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -597,7 +597,6 @@ export function useProviderAccountPools(deps: {
 
   const pauseApiKey = async (provider: string, entry: ApiKeyEntry, paused: boolean) => {
     if (switchingAccountRef.current.has(provider) || pausingAccountRef.current.has(provider) || selectionMutationsRef.current.has(`key:${provider}`)) return;
-    const activeKeyMayChange = paused ? entry.active : !keyPools[provider]?.some(row => row.active && !row.disabled);
     const target = { provider, accountId: entry.id };
     pausingAccountRef.current.set(provider, target);
     setPausingAccounts(current => ({ ...current, [provider]: { ...target, paused } }));
@@ -661,7 +660,7 @@ export function useProviderAccountPools(deps: {
     notify(t(paused ? "codexAuth.pauseSucceeded" : "codexAuth.resumeSucceeded", { email: label }), true);
     try {
       const refreshed = await refreshAccountRosters({ provider, kind: "api-key" });
-      if (result.activeAccountChanged ?? activeKeyMayChange) await Promise.all([fetchConfig(), fetchProviderQuotas(true)]);
+      if (result.activeAccountChanged ?? true) await Promise.all([fetchConfig(), fetchProviderQuotas(true)]);
       if (!refreshed) notify(t("pws.accountsLoadFailed"), false);
     } catch {
       if (aliveRef.current && mountedRef.current) notify(t("pws.accountsLoadFailed"), false);
diff --git a/tests/cli/cli-account-key-pause.test.ts b/tests/cli/cli-account-key-pause.test.ts
index 78a233593d3..6dc7790225a 100644
--- a/tests/cli/cli-account-key-pause.test.ts
+++ b/tests/cli/cli-account-key-pause.test.ts
@@ -53,6 +53,18 @@ test("API-key pause JSON uses the same two-space indentation as the other pools"
   expect(result.writes).toEqual([{ name: "fixture", id: "key-1", paused: true }]);
 });
 
+test("API-key pause JSON infers the next active account when the active key is paused", async () => {
+  const result = await run("primary", {
+    json: true,
+    keys: [{ id: "key-1", label: "primary", active: true }, { id: "key-2", label: "backup" }],
+  });
+  expect(result.code).toBe(0);
+  expect(result.lines).toEqual([JSON.stringify({
+    ok: true, provider: "fixture", id: "key-1", paused: true,
+    activeAccountId: "key-2", activeAccountChanged: true,
+  }, null, 2)]);
+});
+
 test("the defensive pause usage fallback also names API-key pools", async () => {
   const source = await Bun.file(repoPath("src/cli/account-extended.ts")).text();
   const fallback = source.split("\n").find(line => line.includes("${verb} applies to"));