[Ingwannu]

Summary

Closes #7377.

Pool traffic headers refresh aggregate usage but keep the independently observed credit balance/clock. An opted-in account can therefore leave selection after five minutes while its usage cache still looks fresh and prevents a WHAM read.

Reuse the existing sweep and bounded pool quota primer with a pool-only credit-renewal reason. Exhausted, opted-in, unpaused/non-reauth pool accounts renew from three minutes of credit age, bypassing aggregate usage freshness. The existing per-credential attempt map bounds retries; generation/query/admission fences stay with the existing reader. The reason performs no native-main reconciliation/claim/probe, and never extends credit validity or authorizes inference from missing/stale evidence. Update the owning contract, index, ADR and configuration reference.

Verification

• Base dev: 79fa97be6e6ae974ccd31d9aeedc2da96a0baa73.
• Before source fix: due-credit refresh and failed-read-backoff regressions fail, with fresh usage preventing any metadata read.
• Final Linux/Bun 1.4.3: bun test --isolate tests/codex-integration/codex-quota-prime.test.ts tests/codex-integration/main-account-credit-renewal.test.ts tests/codex-integration/main-account-hard-lock-recovery.test.ts — 173 pass, 0 fail.
• Includes three-/six-minute evidence, fresh traffic headers, actual selection hold released only by fresh WHAM, existing sweep entry, no native-main access, opt-out/pause/reauth/below-limit/fresh-credit exclusions and failed-read backoff. Metadata is mocked; no paid inference, real WHAM/token request or live account was used.
• A provisional admission assertion passed the pre-request timestamp to a post-request observation and correctly saw future evidence; the fixture now checks at actual observation time. No freshness rule was relaxed.
• Structure/index, privacy and diff checks: recorded after final staging. Current-head hosted typecheck/CI now pass as recorded below. Full local suite/documentation build are deferred to hosted CI under the fixed local envelope (75% CPU, 1536 MiB, zero swap, 300s); root typecheck was not repeated after the previous fixed-envelope timeout.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Keep Draft pending current-head CI and independent account/metadata boundary review. This does not change spending consent, deploy a worker to the installed service, or request merge/release.

Hosted validation

Current head 8692ac9cf578936e402ae2af3d40e3d5bb3eb6a3: Cross-platform CI run 39259235092 completed successfully, including Typecheck, Privacy scan, all four selected Ubuntu test shards, structure and docs build. This supplements the focused local receipts; skipped macOS/Windows remain unverified. Keep Draft for independent boundary review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Carried into #7393 (squash d3dafd3) on dev with a Co-authored-by trailer, as part of the B1 codex pool / hard-lock bundle. It ships in the next release (2.90.0). Thanks!